refs #4253 supplant security code uncommented

rest/client/supplant.php

@@ -10,7 +10,7 @@ class Supplant extends Vn\Web\JsonRequest {
 			'SELECT id FROM account.user WHERE `name` = #',
 			[$_REQUEST['supplantUser']]
 		);
-/*
+
 		$isClient = $db->getValue(
 			'SELECT COUNT(*) > 0 FROM vn.client WHERE id = #',
 			[$userId]
@@ -24,7 +24,7 @@ class Supplant extends Vn\Web\JsonRequest {
 		);
 		if ($hasAccount)
 			throw new Web\ForbiddenException(s('The user is not impersonable'));
-*/
+
 		return $this->service->createToken($_REQUEST['supplantUser']);
 	}
 }