<p>You're correct... it should be sending to <code>postLoginRedirect</code>, but there is actually a bug where after impersonating:</p>

<pre><code>// Get the current user
$currentUser = craft()-&gt;userSession-&gt;getUser();
</code></pre>

<p>is returning a cached copy of the previous user (who had CP access).</p>

<p>Will get that fixed for the next release.</p>

<p><strong>Update:</strong></p>

<p>Fixed for the next post <a href="http://buildwithcraft.com/updates#build2596" rel="nofollow">2.2.2596</a> release!</p>

CC BY-SA 3.0
2014-10-22T20:57:17.983Z
2014-10-22T22:05:27.243Z
2014-10-22T22:05:27.243Z
Brad Bell
<p>A client uses the 'Login as user' behaviour to be able to see what users of the site are seeing, useful as it's an e-learning site and each user can see different content based on their progress. The users however, are only allowed to view the public site and not anything in the CP which means when the 'Login as user' is invoked the client is presented with the '<strong>Unauthorized</strong> You don’t have the proper credentials to access this page' message.</p>

<p>Is this right? Looking through the code it seems the function <code>_handleSuccessfulLogin()</code> is called and if the user cannot access the CP then they should be redirected to the <code>postLoginRedirect</code> which in the case of this site is not set, so the user should be redirected to the homepage if I understand correctly.</p>

CC BY-SA 3.0
2014-11-30T04:41:25.170Z
Per Brad's answer, this was a bug and has been fixed. Since this question no longer has any historical value, it will be closed as a "bug report".
Lindsey D
<users><control-panel>
Correct behaviour for 'Login as user' when user cannot access CP?
# Correct behaviour for 'Login as user' when user cannot access CP?

(Asked by: username_0 on 2014-10-22)

A client uses the 'Login as user' behaviour to be able to see what users of the site are seeing, useful as it's an e-learning site and each user can see different content based on their progress. The users however, are only allowed to view the public site and not anything in the CP which means when the 'Login as user' is invoked the client is presented with the '**Unauthorized** You don’t have the proper credentials to access this page' message.

Is this right? Looking through the code it seems the function `_handleSuccessfulLogin()` is called and if the user cannot access the CP then they should be redirected to the `postLoginRedirect` which in the case of this site is not set, so the user should be redirected to the homepage if I understand correctly.

**Tags:** users, control-panel

> **Comments:**
> **username_1**: Per Brad's answer, this was a bug and has been fixed. Since this question no longer has any historical value, it will be closed as a "bug report".  

---

## 1 answers

### Answer by username_2 on 2014-10-22. Score: 1 | Accepted answer

You're correct... it should be sending to postLoginRedirect, but there is actually a bug where after impersonating:
// Get the current user
$currentUser = craft()->userSession->getUser();

is returning a cached copy of the previous user (who had CP access).
Will get that fixed for the next release.
Update:
Fixed for the next post 2.2.2596 release!


---

