Do not allow normal admins to impersonate superadmins

src/views/users.js

@@ -3,6 +3,7 @@
 /* global angular */
 /* global Clipboard */
 /* global async */
+/* global ROLES */
 /* global $ */
 
 angular.module('Application').controller('UsersController', ['$scope', '$location', '$translate', '$timeout', 'Client', function ($scope, $location, $translate, $timeout, Client) {
@@ -71,6 +72,19 @@ angular.module('Application').controller('UsersController', ['$scope', '$locatio
         return (roleInt1 - roleInt2) >= 0;
     };
 
+    $scope.canImpersonate = function (user) {
+        // only admins can impersonate
+        if (!$scope.userInfo.isAtLeastAdmin) return false;
+
+        // only users with username can be impersonated
+        if (!user.username) return false;
+
+        // normal admins cannot impersonate owners
+        if (!$scope.userInfo.isAtLeastOwner && [ ROLES.OWNER ].indexOf(user.role) !== -1) return false;
+
+        return true;
+    };
+
     $scope.transferOwnership = {
         busy: false,
         error: null,