From 14867e3fddff40edc7c50757e4e9beacc5519b06 Mon Sep 17 00:00:00 2001
From: "Jens L." <jens@goauthentik.io>
Date: Wed, 20 Nov 2024 21:31:00 +0100
Subject: [PATCH] root: fix activation of locale not being scoped (#12091)

closes #12088

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---
 authentik/brands/middleware.py | 8 +++++---
 authentik/core/middleware.py   | 8 +++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/authentik/brands/middleware.py b/authentik/brands/middleware.py
index 71650cc621..52af854e33 100644
--- a/authentik/brands/middleware.py
+++ b/authentik/brands/middleware.py
@@ -4,7 +4,7 @@ from collections.abc import Callable
 
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
-from django.utils.translation import activate
+from django.utils.translation import override
 
 from authentik.brands.utils import get_brand_for_request
 
@@ -18,10 +18,12 @@ class BrandMiddleware:
         self.get_response = get_response
 
     def __call__(self, request: HttpRequest) -> HttpResponse:
+        locale_to_set = None
         if not hasattr(request, "brand"):
             brand = get_brand_for_request(request)
             request.brand = brand
             locale = brand.default_locale
             if locale != "":
-                activate(locale)
-        return self.get_response(request)
+                locale_to_set = locale
+        with override(locale_to_set):
+            return self.get_response(request)
diff --git a/authentik/core/middleware.py b/authentik/core/middleware.py
index f59b9aa6b7..1d20455a1b 100644
--- a/authentik/core/middleware.py
+++ b/authentik/core/middleware.py
@@ -5,7 +5,7 @@ from contextvars import ContextVar
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
-from django.utils.translation import activate
+from django.utils.translation import override
 from sentry_sdk.api import set_tag
 from structlog.contextvars import STRUCTLOG_KEY_PREFIX
 
@@ -31,17 +31,19 @@ class ImpersonateMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         # No permission checks are done here, they need to be checked before
         # SESSION_KEY_IMPERSONATE_USER is set.
+        locale_to_set = None
         if request.user.is_authenticated:
             locale = request.user.locale(request)
             if locale != "":
-                activate(locale)
+                locale_to_set = locale
 
         if SESSION_KEY_IMPERSONATE_USER in request.session:
             request.user = request.session[SESSION_KEY_IMPERSONATE_USER]
             # Ensure that the user is active, otherwise nothing will work
             request.user.is_active = True
 
-        return self.get_response(request)
+        with override(locale_to_set):
+            return self.get_response(request)
 
 
 class RequestIDMiddleware: