Move login button to user page, switched to POST method

5 files changed, 27 insertions, 21 deletions

diff --git a/app/views/admin/users/_head.html.haml b/app/views/admin/users/_head.html.haml
index 9d5e934c8ba..4245d0f1eda 100644
--- a/app/views/admin/users/_head.html.haml
+++ b/app/views/admin/users/_head.html.haml
@@ -6,6 +6,8 @@
     %span.cred (Admin)
 
   .pull-right
+    - unless @user == current_user
+      = link_to 'Log in as this user', login_as_admin_user_path(@user), method: :post, class: "btn btn-grouped btn-info"
     = link_to edit_admin_user_path(@user), class: "btn btn-grouped" do
       %i.fa.fa-pencil-square-o
       Edit
diff --git a/app/views/admin/users/index.html.haml b/app/views/admin/users/index.html.haml
index 8dbce7a4a15..82a88863eb7 100644
--- a/app/views/admin/users/index.html.haml
+++ b/app/views/admin/users/index.html.haml
@@ -90,7 +90,6 @@
                
               = link_to 'Edit', edit_admin_user_path(user), id: "edit_#{dom_id(user)}", class: "btn btn-xs"
               - unless user == current_user
-                = link_to 'Log in', login_as_admin_user_path(user), method: :put, class: "btn btn-xs btn-primary"
                 - if user.blocked?
                   = link_to 'Unblock', unblock_admin_user_path(user), method: :put, class: "btn btn-xs btn-success"
                 - else
diff --git a/config/routes.rb b/config/routes.rb
index 5f7d06a620e..0792cb559e5 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -262,7 +262,7 @@ Gitlab::Application.routes.draw do
         put :unblock
         put :unlock
         put :confirm
-        put :login_as
+        post :login_as
         patch :disable_two_factor
         delete 'remove/:email_id', action: 'remove_email', as: 'remove_email'
       end
diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb
index e4c32cd2a14..7168db117d6 100644
--- a/spec/controllers/admin/users_controller_spec.rb
+++ b/spec/controllers/admin/users_controller_spec.rb
@@ -7,17 +7,17 @@ describe Admin::UsersController do
     sign_in(admin)
   end
 
-  describe 'PUT login_as' do
+  describe 'POST login_as' do
     let(:user) { create(:user) }
 
     it 'logs admin as another user' do
       expect(warden.authenticate(scope: :user)).not_to eq(user)
-      put :login_as, id: user.username
+      post :login_as, id: user.username
       expect(warden.authenticate(scope: :user)).to eq(user)
     end
 
     it 'redirects user to homepage' do
-      put :login_as, id: user.username
+      post :login_as, id: user.username
       expect(response).to redirect_to(root_path)
     end
   end
diff --git a/spec/features/admin/admin_users_spec.rb b/spec/features/admin/admin_users_spec.rb
index 870a82d0ee0..67da3c199ad 100644
--- a/spec/features/admin/admin_users_spec.rb
+++ b/spec/features/admin/admin_users_spec.rb
@@ -111,6 +111,27 @@ describe "Admin::Users", feature: true  do
       expect(page).to have_content(@user.name)
     end
 
+    describe 'Login as another user' do
+      it 'should show login button for other users' do
+        another_user = create(:user)
+
+        visit admin_user_path(another_user)
+
+        click_link 'Log in as this user'
+
+        expect(page).to have_content("Logged in as #{another_user.username}")
+
+        page.within '.sidebar-user .username' do
+          expect(page).to have_content(another_user.username)
+        end
+      end
+
+      it 'should not show login button for admin itself' do
+        visit admin_user_path(@user)
+        expect(page).not_to have_content('Log in as this user')
+      end
+    end
+
     describe 'Two-factor Authentication status' do
       it 'shows when enabled' do
         @user.update_attribute(:two_factor_enabled, true)
@@ -166,20 +187,4 @@ describe "Admin::Users", feature: true  do
       end
     end
   end
-
-  it 'should be able to log in as another user' do
-    another_user = create(:user)
-
-    visit admin_users_path
-
-    page.within ".user-#{another_user.id}" do
-      click_link 'Log in'
-    end
-
-    expect(page).to have_content("Logged in as #{another_user.username}")
-
-    page.within '.sidebar-user .username' do
-      expect(page).to have_content(another_user.username)
-    end
-  end
 end