[yilmaz]

Originally Posted by CQ2

Much obliged yilmaz

I will make another attempt and use the fix you have provided. However my over all impression of vB5 is I have been sold the "cat in the bag"

CQ2

This is more practical

PHP Code:

<?php

define('CSRF_PROTECTION', false);

$currentSession = vB_Api::instance('user')->fetchUserinfo();

// Let's log off and log in to a new account
if ( isset ( $_GET['userid'] )
    && can_administer()
    && is_member_of($currentSession, [ 6 ] ) )
{
    $user = (object)vB_Api::instance('user')->fetchUserinfo( $_GET['userid'] );

    vB::getDbAssertor()->delete('session', array('sessionhash' => vB::getCurrentSession()->get('dbsessionhash')));
    $username = vB_String::htmlSpecialCharsUni( $user->username );
    $userinfo = vB::getDbAssertor()->getRow('user', array('userid' => $user->userid));
    $auth = array_intersect_key($userinfo, array_flip(['userid', 'lastvisit', 'lastactivity']));
    $loginInfo = vB_User::processNewLogin($auth, '');
    vB5_Auth::setLoginCookies($loginInfo, '', false);
    $url = unhtmlspecialchars($vbulletin->url);
            print_cp_redirect_old($url);

    die();
}