Support external session loading

"Needs review" is only for bugs with a patch needing review. Setting to active.

function _drupal_session_read($sid) {
  global $user, $is_https;

  // Write and Close handlers are called after destructing objects
  // since PHP 5.0.5.
  // Thus destructors can use sessions but session handler can't use objects.
  // So we are moving session closure before destructing objects.
  drupal_register_shutdown_function('session_write_close');

  // Handle the case of first time visitors and clients that don't store
  // cookies (eg. web crawlers).
  $insecure_session_name = substr(session_name(), 1);
  if (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name])) {
    $user = drupal_anonymous_user();
    return '';
  }

  // Otherwise, if the session is still active, we have a record of the
  // client's session in the database. If it's HTTPS then we are either have
  // a HTTPS session or we are about to log in so we check the sessions table
  // for an anonymous session with the non-HTTPS-only cookie.
  if ($is_https) {
    $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject();
    if (!$user) {
      if (isset($_COOKIE[$insecure_session_name])) {
        $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid AND s.uid = 0", array(
        ':sid' => $_COOKIE[$insecure_session_name]))
        ->fetchObject();
      }
    }
  }
  else {
    $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid", array(':sid' => $sid))->fetchObject();
  }

  // We found the client's session record and they are an authenticated,
  // active user.
  if ($user && $user->uid > 0 && $user->status == 1) {
    // This is done to unserialize the data member of $user.
    $user->data = unserialize($user->data);

    // Add roles element to $user.
    $user->roles = array();
    $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
    $user->roles += db_query("SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = :uid", array(':uid' => $user->uid))->fetchAllKeyed(0, 1);
  }
  // We didn't find the client's record (session has expired), or they are
  // blocked, or they are an anonymous user.
  else {
    $session = isset($user->session) ? $user->session : '';
    $user = drupal_anonymous_user($session);
  }

  return $user->session;
}

This bug should be first fixed in d7. Let's see first what the testbot says. I guess a simpletest could help here, too :)

#4: session.inc_.patch queued for re-testing.

Rerole for d7

Yes, i think thats the default patch behavior.

I fail to see where the "critical bug" is here. Someone calling a *private* core function directly is not something we want or need to support.

Also, marking as needs work, because supposing we want to do that, the code is not correct: the correct session identifier to use depends on HTTP vs HTTPS.

If we want to implement that as a feature request, I suggest adding a function that simply sets $_COOKIE[session_name()] and calls drupal_session_initialize().

Sorry, but you are *not* supposed to call a function explicitly marked as private. _drupal_session_read()/sess_read() are supposed to be called from PHP only.

And again, you probably don't even have to, I guess that simply doing this should work:

session_id($my_externally_retrieved_id);
session_start();

Refer to the PHP documentation for proper use of the session API. Calling a private API function of Drupal doesn't qualify as "proper use".

On the contrary, _drupal_session_read()/sess_read() do exactly what they are designed for: being registered as PHP "read" session callbacks.

See http://php.net/manual/en/function.session-set-save-handler.php for the documentation and example of those callbacks. You will see that *none of them* call session_id(), that's just not what they are designed for.