From 4585f189b6d4d75f63d42b6d80151d5e5ed64d9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Fri, 19 Apr 2024 16:14:11 +0200
Subject: [PATCH] fix: prevent impersonating superadmin users

---
 src/Security/Voter/ImpersonationVoter.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/Security/Voter/ImpersonationVoter.php b/src/Security/Voter/ImpersonationVoter.php
index 12574f2..103a91f 100644
--- a/src/Security/Voter/ImpersonationVoter.php
+++ b/src/Security/Voter/ImpersonationVoter.php
@@ -39,6 +39,11 @@ class ImpersonationVoter extends Voter
             return false;
         }
 
+        // if the target user is superadmin, do not grant access
+        if (true === $targetUser->isSuperAdmin()) {
+            return false;
+        }
+
         // Admin is the only role allowed to impersonate
         if (false === $this->security->isGranted('ROLE_ADMIN')) {
             return false;