[thincom2000]

Because $forumid is set to 'ces_profile', yes you are correct that $dofoo all default to false. However, the permissions for 'ces_profile' are cached before entering $bbcode->parse, so the CES Permissions skips the entire $dofoo = ($checkugp AND $dofoo) branch (see function ces_permissions_customfields to verify).

PHP Code:

$pf_parser->ces_options['ces_profile'][$userinfo['userid']] = convert_bits_to_array($userinfo['permissions']['ces_parser_permissions'], $vbulletin->bf_ugp['ces_parser_permissions']); 


This is then caught in ces_permissions_parse by:

PHP Code:

if (!empty($parser->ces_options["$forumid"][$parser->ces_options['current_userid']])) 


and refills $bbfoo with the appropriate values.