Index: flag.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/flag/Attic/flag.module,v
retrieving revision 1.11.2.72.2.31
diff -u -r1.11.2.72.2.31 flag.module
--- flag.module	8 Jan 2010 05:17:57 -0000	1.11.2.72.2.31
+++ flag.module	7 May 2010 23:51:19 -0000
@@ -449,10 +449,10 @@
   switch ($op) {
     case 'login':
       // Migrate anonymous flags to this user's account.
-      if (module_exists('session_api')) {
+      if (module_exists('session_api') && ($sid = flag_get_sid(0))) {
         // The @ symbol suppresses errors if the user flags a piece of content
         // they have already flagged as a logged-in user.
-        @db_query("UPDATE {flag_content} SET uid = %d, sid = 0 WHERE uid = 0 AND sid = %d", $account->uid, flag_get_sid(0));
+        @db_query("UPDATE {flag_content} SET uid = %d, sid = 0 WHERE uid = 0 AND sid = %d", $account->uid, $sid);
         // Delete any remaining flags this user had as an anonymous user.
         db_query("DELETE FROM {flag_content} WHERE uid = 0 AND sid = %d", flag_get_sid(0));
         // Clean up anonymous cookies.
Index: flag.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/flag/Attic/flag.inc,v
retrieving revision 1.1.2.30.2.20
diff -u -r1.1.2.30.2.20 flag.inc
--- flag.inc	8 Jan 2010 05:14:24 -0000	1.1.2.30.2.20
+++ flag.inc	7 May 2010 23:51:18 -0000
@@ -558,9 +558,22 @@
     flag_get_counts(NULL, NULL, TRUE);
     flag_get_user_flags(NULL, NULL, NULL, NULL, TRUE);
 
-    // Perform the flagging or unflagging of this flag.
+    // Find out which user id to use.
     $uid = $this->global ? 0 : $account->uid;
-    $sid = $this->global ? 0 : flag_get_sid($uid);
+
+    // Find out which session id to use.
+    if ($this->global) {
+      $sid = 0;
+    }
+    else {
+      $sid = flag_get_sid($uid);
+      // Anonymous users must always have a session id.
+      if ($sid == 0 && $acount->uid == 0) {
+        return FALSE;
+      }
+    }
+
+    // Perform the flagging or unflagging of this flag.
     $flagged = $this->_is_flagged($content_id, $uid, $sid);
     if ($action == 'unflag') {
       if ($this->uses_anonymous_cookies()) {