Home/ Questions/Q 8850923
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-14T13:00:52+00:00

I have a slight issue im trying to wrap my head around.. I have

  • 0

I have a slight issue im trying to wrap my head around.. I have an application that working on and one of the current features is a supervisor override. Ie, if an specific action is requested a supervisor can enter their credentials the action is performed and the site returns the the previous users credentials.

Is this scenario possible using the Yii framework and the Rights extension? and ideas on how to precede would be greatly appreciated..

BTW my initial idea was to save the current user’s session to the DB, destroy it and start a new session..

thanks

EDIT

A scenario that this would fit would be the following:

  1. Jim is filling out an invoice for a customer. The customer requires a discount to be applied but Jim doesn’t have the necessary credentials in the system to perform that task.
  2. Mark, who is a shift supervisor, does have the correct credentials so he clicks a supervisor override button, logs in and applies the discount to the invoice.
  3. Jim proceeds to finish the invoice and go about his duties.

So in this scenario when Mark click on the override button Jim’s session is destroyed and Mark is allowed to sign into the site. Once the task is complete Marks session is destroyed and Jim’s restored.
This is a scenario that is very common in POS systems where a supervisor can authenticate in a system to perform a single task, without making the previous user re-authenticate..

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Instead of destroying the session completely, you could do the following:

    • on supervisor logon being successful, if there is currently a logged in user, store the logged in user credentials in a ‘fallback’ user account of some kind
    • replace the main user model with the supervisor user model
    • allow the supervisor user to do the needed action
    • on logout, if there is a ‘fallback’ user, instead of destroying session, replace the main user model with the ‘fallback’ user model

    Does that make sense? Instead of destroying session (which then would require your original user to re-logon) you could fake the session being destroyed by swapping out whatever info you needed for the supervisor model.

    It might get a bit fragile, but destroying session means you don’t have access to it anymore …

    • 0