From 0c07a0568e3c10f97662a3f346177c47b4b373b1 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 22 Oct 2020 12:45:15 +0200
Subject: [PATCH] do not allow a second user substitution

---
 views/bootstrap/class.Bootstrap.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/views/bootstrap/class.Bootstrap.php b/views/bootstrap/class.Bootstrap.php
index 527a6ca4b..fffc26021 100644
--- a/views/bootstrap/class.Bootstrap.php
+++ b/views/bootstrap/class.Bootstrap.php
@@ -346,9 +346,11 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 				echo "     </ul>\n";
 				echo "    </li>\n";
 			}
-			if($this->params['user']->isAdmin()) {
-				$showdivider = true;
-				echo "    <li><a href=\"../out/out.SubstituteUser.php\">".getMLText("substitute_user")."</a></li>\n";
+			if(!$this->params['session']->getSu()) {
+				if($this->params['user']->isAdmin()) {
+					$showdivider = true;
+					echo "    <li><a href=\"../out/out.SubstituteUser.php\">".getMLText("substitute_user")."</a></li>\n";
+				}
 			}
 			if($showdivider)
 				echo "    <li class=\"divider\"></li>\n";