Language: PHP
Label: safe
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
function finishLogin($userinfo)
{
	if (isset($userinfo['userid']) && $userinfo['userid'] != '') {
		session_regenerate_id();
		CurrentUser::setData($userinfo);

		$language = $userinfo['def_language'] ?? Settings::Get('panel.standardlanguage');
		CurrentUser::setField('language', $language);

		if (isset($userinfo['theme']) && $userinfo['theme'] != '') {
			$theme = $userinfo['theme'];
		} else {
			$theme = Settings::Get('panel.default_theme');
			CurrentUser::setField('theme', $theme);
		}

		$qryparams = [];
		if (isset($_SESSION['lastqrystr']) && !empty($_SESSION['lastqrystr'])) {
			parse_str(urldecode($_SESSION['lastqrystr']), $qryparams);
			unset($_SESSION['lastqrystr']);
		}

		if ($userinfo['adminsession'] == '1') {
			if (Froxlor::hasUpdates() || Froxlor::hasDbUpdates()) {
				Response::redirectTo('admin_updates.php?page=overview');
			} else {
				if (isset($_SESSION['lastscript']) && !empty($_SESSION['lastscript'])) {
					$lastscript = $_SESSION['lastscript'];
					unset($_SESSION['lastscript']);
					if (preg_match("/customer\_/", $lastscript) === 1) {
						Response::redirectTo('admin_customers.php', [
							"page" => "customers"
						]);
					} else {
						Response::redirectTo($lastscript, $qryparams);
					}
				} else {
					Response::redirectTo('admin_index.php', $qryparams);
				}
			}
		} else {
			if (isset($_SESSION['lastscript']) && !empty($_SESSION['lastscript'])) {
				$lastscript = $_SESSION['lastscript'];
				unset($_SESSION['lastscript']);
				Response::redirectTo($lastscript, $qryparams);
			} else {
				Response::redirectTo('customer_index.php', $qryparams);
			}
		}
	}
	return false;
}