fix(users): prevent accidental user hijacking

src/Handler/Users.hs

@@ -45,7 +45,7 @@ import Auth.Dummy (apDummy)
 
 
 hijackUserForm :: Form ()
-hijackUserForm csrf = do
+hijackUserForm = identifyForm FIDHijackUser $ \csrf -> do
   (btnResult, btnView) <- mopt (buttonField BtnHijack) "" Nothing
   return (btnResult >>= guard . is _Just, mconcat [toWidget csrf, fvWidget btnView])
 
@@ -351,7 +351,7 @@ postUsersR = do
       , dbtExtraReps = []
       }
 
-  $logInfoS "UsersFormResult" $ tshow usersRes
+  -- $logInfoS "UsersFormResult" $ tshow usersRes
   formResult usersRes $ \case
     (act, usersSet)
       | Set.null usersSet && isNotSetSupervisor act ->

src/Utils/Form.hs

@@ -308,6 +308,7 @@ data FormIdentifier
   | FIDAvsSetLicence
   | FIDBtnAvsImportUnknown
   | FIDBtnAvsRevokeUnknown
+  | FIDHijackUser
   deriving (Eq, Ord, Read, Show)
 
 instance PathPiece FormIdentifier where