Spuds/playpen — pull request #33 by norv (2012-05-20 20:45:54+00:00)
Title: This is an incorrect test, $_COOKIE[session_name()] will be different tha...

...n session_id() since session_id was just regenerated. $_COOKIE array will be only filled again by PHP at the next page load, not at this point of execution in the script. So testing here if it's filled "correctly" for the _new_ id is not meaningful.

In addition, this re-set of the cookie has been the cause of a security weakness pre-SMF 2.0: losing session data (the rest of session variables) for the new session. If you really want this in, it needs tested for login spamming: incrementing $_SESSION variables such as failed_login must work as expected (i.e. prevent further login attempts after the maximum number of attempts is reached).