This is true. Admins should probably never set the access level to 2. I'll make a larger note of it.

Also, I can probably improve things a bit by making the "Show Source" link a form button with a hidden field.

Actually, I should probably just remove level 2 access.

That's cool - it's just that when it is enabled, it lets you go to URLs like show_source_page.php?f_url=/etc/passwd and things like that - basically anything accessible to the web server account. Since it's just a nicety though, i guess it's not really worth fixing when it can be disabled :)

Yeah, I use it for debug purposes quite often.

I can probably do some checks to see if the file you request is in the document root or not.

Fixed in 0.15.0

I've made it so only the administrator can view the source. The option is now off by default. Big warning messages are attached.