Why are anonymous visitors logged in when they visit /user/[uid] page? This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:-

    &lt;?php
global $user;
$uid = arg(1);
$user = user_load($uid);
$roles = $user-&gt;roles;

if (in_array('RoleName1', array_values($roles))) {
 print "&lt;a href='/xyz'&gt;&lt;img src='/sites/default/files/image.png' style='max-height:200px;max-width:200px;'&gt;&lt;/a&gt;";
}
if (in_array('RoleName2', array_values($roles))) {
 print "&lt;a href='/xyz'&gt;&lt;img src='/sites/default/files/image.png' style='max-height:200px;max-width:200px;'&gt;&lt;/a&gt;";
}

?&gt;


It checks for a couple of Roles and shows an image if they have a particular Role.

When an anonymous user now loads a user account page, they are logged in as that user! Visiting "/user/1" means they are logged in as the admin user!!!
This is no security hole, it's the custom code you shared.

// When you load the global user object ...
global $user;
// ... and then assign another user object to the global $user object ...
$user = user_load(&lt;any_uid&gt;);
// ... Drupal basically changes the context of the current user.
// It's kind of a hacky login by code.
// Hacky because, till this code executes
// there's no log about the user login, until drupal writes the current session into the database.


Typically $account is advised to prevent accidents like this.

$account = user_load(&lt;any_uid&gt;);