MDL-63786 core_my: prevent dashboard access when logged in as

Stop a "logged in as" session from accessing the user's dashboard
to prevent user JavaScript from being executed in the logged in
as session

lang/en/my.php

@@ -38,3 +38,4 @@ $string['reseteveryonesdashboard'] = 'Reset Dashboard for all users';
 $string['reseteveryonesprofile'] = 'Reset profile for all users';
 $string['resetpage'] = 'Reset page to default';
 $string['reseterror'] = 'There was an error resetting your page';
+$string['unabletoaccess'] = 'As a security precaution, you may not access another user\'s dashboard';

my/index.php

@@ -45,6 +45,13 @@ $reset  = optional_param('reset', null, PARAM_BOOL);
 
 require_login();
 
+if (\core\session\manager::is_loggedinas()) {
+    // Disable access to the user's dashboard for "logged in as" sessions
+    // to mitigate risks associated with loading other users' JavaScript.
+    // See MDL-63786 for more information.
+    redirect(new moodle_url('/', ['redirect' => 0]), get_string('unabletoaccess', 'core_my'));
+}
+
 $hassiteconfig = has_capability('moodle/site:config', context_system::instance());
 if ($hassiteconfig && moodle_needs_upgrading()) {
     redirect(new moodle_url('/admin/index.php'));