Issue #3383223 by poker10, dokumori, dsnopek, catch, berdir, effulgentsia,...

Issue #3383223 by poker10, dokumori, dsnopek, catch, berdir, effulgentsia, mlhess, samuel.mortenson, poiu, moshe weitzman: URL aliases can be used to override trusted urls

modules/path/path.module

@@ -41,6 +41,7 @@ function path_permission() {
   return array(
     'administer url aliases' => array(
       'title' => t('Administer URL aliases'),
+      'restrict access' => TRUE,
     ),
     'create url aliases' => array(
       'title' => t('Create and edit URL aliases'),