Logging in from an out-of-site form is not possible

The same algorithm is present in HEAD, so it should get a proper review there before being backported. It took me a few minutes to figure out what exactly is happening, so I changed the second comment.

Seems reasonable. If it passes the tests, I think it is commit worthy.

Reroll to HEAD.

D7 cannot be affected.

Should it not go to drupal 8 then?

@R.Muilwijk: no, I just meant that I don't believe this particular bug affects Drupal 7, because we completely refactored the session handling code.

Well that is true but when looking at the code the regeneration is done exact the same as it was and needs the patch.

  if (drupal_session_started()) {
    $old_session_id = session_id();
    // Remove the old session cookie.
    unset($_COOKIE[session_name()]);
    session_regenerate_id();
  }
  else {
    // Start the session when it doesn't exist yet.
    // Preserve the logged in user, as it will be reset to anonymous
    // by _drupal_session_read.
    $account = $user;
    drupal_session_start();
    $user = $account;
  }

  if (isset($old_session_id)) {
    // Save the new session cookie for code which assumes it will be present,
    // such as sess_write().
    $_COOKIE[session_name()] = session_id();

    $fields = array('sid' => session_id());
    if ($is_https) {
      $fields['ssid'] = session_id();
      // If the "secure pages" setting is enabled, use the newly-created
      // insecure session identifier as the regenerated sid.
      if (variable_get('https', FALSE)) {
        $fields['sid'] = $session_id;
      }
    }
    db_update('sessions')
      ->fields($fields)
      ->condition($is_https ? 'ssid' : 'sid', $old_session_id)
      ->execute();
  }

Please correct me if I a wrong?

_drupal_session_write doesn't optimize for the cookie-less case anymore, so we don't need the trick in the session regeneration code.