joomla/joomla-cms — pull request #772 by aapis (2013-03-07 20:09:03+00:00)
Title: Incorrect if-test in JSession::get()

The _state test in the "get" method is flawed. Under normal session
operation, the _state is active, and pending logout or an expiration it will
remain active. The if-test in question tests whether the session is not active
AND not expired, and upon evaluating to true will return NULL (I see there is a
note for a more robust error message in the future, but that doesn't help me
today). Under normal operations, for example a user browsing the website, _state is active.