TYPO3 Core

In bug 10146 (which I cannot access, but is referenced in the changelog), session fixation has been fixed, so that a new session ID gets generated on each request, if there is no user logged in (the new isExistingSessionRecord checks for this).

However, this renders the fe_session_data table (through $fe_user::setKey('ses', ..)) for anonymous visitors useless: as long as you're not authenticated you'll get a new Session ID on each request and therefore any data stored in the session is lost.

I think the fix might be to expand the isExistingSessionRecord method to also look for entries with the current session ID in fe_session_data (instead of only fe_sessions).

This has been reported to fail with 4.2.4, too.
(issue imported from #M10211)