if ($pun_user['is_guest'])
{
if ($pun_user['g_search'] == '1')
$links[] = '<li id="navsearch"><a href="search.php">'.$lang_common['Search'].'</a>';
$links[] = '<li id="navregister"><a href="register.php">'.$lang_common['Register'].'</a>';
$links[] = '<li id="navlogout"><a href="login.php?action=out&id='.$pun_user['id'].'&csrf_token='.sha1($pun_user['id'].sha1(get_remote_address())).'">'.$lang_common['Logout'].'</a>';
$info = $lang_common['Not logged in'];
}
That's from the generate_navlinks function. You replaced the login link with a logout link and didn't replace the logout link for regular users with the CSRF link.