concrete5/concrete5 — pull request #547 by JohntheFish (2012-06-18 09:18:31+00:00)
Title: Update master

Fixing a security loophole as per
http://www.concrete5.org/developers/bugs/5-5-1/security-flaw-when-giving-permission-to-sign-in-as-user/

As 'Super User' I can give other Administrators permission to 'Sign In as User'. However, having given them this permission, they can now sign in as me and do whatever they want with the system.

As a minimum general principle, someone should never be able to use the 'Sign In as User' facility to sign in as the Super User