CB

the spoof checking seams normal, but should the link not show at all in the drop-down or should the spoof string be added to the userlist at all times?

You can add the spoofcheck to the link, ideally depending of the target list being hotlink protected or not.

Proposed patch of always adding spoof input to form. Without it the form will submit to (as userlist drop-down does) without the spoof check causing the session error. Spoof parameter isn't checked unless the list is hotlink protected so is harmless to non-protected lists.

Committed in r1253 .

The hotlink-protection fix is only for forms, so it's ok.

Good point Kyle, thanks