Do not show users list when impersonating user

web/list/user/index.php

@@ -5,6 +5,12 @@ $TAB = 'USER';
 // Main include
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
+// Do not show the users list if user is impersonating another user
+if (isset($_SESSION['look'])) {
+    header("Location: /login/");
+    exit;
+}
+
 // Data
 if ($_SESSION['userContext'] === 'admin') {
     exec (HESTIA_CMD . "v-list-users json", $output, $return_var);