Possible bug/security issue

[Gokkesokken]

found this in core/includes/functions_login.php

if ($postvars['securitytoken'] = 'guest')
				{
					$vbulletin->userinfo['securitytoken_raw'] = sha1($vbulletin->userinfo['userid'] . sha1($vbulletin->userinfo['secret']) . sha1(vB_Request_Web::$COOKIE_SALT));
					$vbulletin->userinfo['securitytoken'] = TIMENOW . '-' . sha1(TIMENOW . $vbulletin->userinfo['securitytoken_raw']);
					$postvars['securitytoken'] = $vbulletin->userinfo['securitytoken'];
					$vbulletin->GPC['postvars'] = sign_client_string(json_encode($postvars));
				}

I am no php expert but i don't think '=' is a comparison operator, at least not according to php.net: http://php.net/manual/en/language.op...comparison.php