Index: includes/update.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/update.inc,v
retrieving revision 1.82
diff -u -p -r1.82 update.inc
--- includes/update.inc	22 Nov 2010 07:02:58 -0000	1.82
+++ includes/update.inc	5 Dec 2010 02:42:15 -0000
@@ -84,7 +84,7 @@ function update_prepare_d7_bootstrap() {
   // still being used.
   include_once DRUPAL_ROOT . '/includes/install.inc';
   drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION);
-  global $databases, $db_url, $db_prefix, $update_rewrite_settings;
+  global $databases, $db_url, $db_prefix, $update_rewrite_settings, $user;
   if (empty($databases) && !empty($db_url)) {
     $databases = update_parse_db_url($db_url, $db_prefix);
     // Record the fact that the settings.php file will need to be rewritten.
@@ -156,6 +156,18 @@ function update_prepare_d7_bootstrap() {
       ),
     );
     update_extra_requirements($requirements);
+
+    // Allow a D6 session to work, since the upgrade has not been performed yet.
+    $d6_session_name = update_get_d6_session_name();
+    if (!empty($_COOKIE[$d6_session_name])) {
+      require_once DRUPAL_ROOT . '/includes/session.inc';
+      $sid = $_COOKIE[$d6_session_name];
+
+      // Respect the D6 sid and read an existing session with it.
+      $_COOKIE[session_name()] = $sid;
+      session_id($sid);
+      _drupal_session_read($sid);
+    }
   }
 
   // Create the registry tables.
@@ -822,6 +834,48 @@ function update_parse_db_url($db_url, $d
 }
 
 /**
+ * Constructs a session name compatible with a D6 environment.
+ *
+ * @return
+ *   D6-compatible session name string.
+ */
+function update_get_d6_session_name() {
+  global $cookie_domain, $base_url;
+
+  if ($cookie_domain) {
+    // If the user specifies the cookie domain, also use it for session name.
+    $session_name = $cookie_domain;
+  }
+  else {
+    // Otherwise use $base_url as session name, without the protocol
+    // to use the same session identifiers across http and https.
+    list( , $session_name) = explode('://', $base_url, 2);
+    // We escape the hostname because it can be modified by a visitor.
+    if (!empty($_SERVER['HTTP_HOST'])) {
+      $cookie_domain = check_plain($_SERVER['HTTP_HOST']);
+      // Strip leading periods, www., and port numbers from cookie domain.
+      $cookie_domain = ltrim($cookie_domain, '.');
+      if (strpos($cookie_domain, 'www.') === 0) {
+        $cookie_domain = substr($cookie_domain, 4);
+      }
+      $cookie_domain = explode(':', $cookie_domain);
+      $cookie_domain = '.' . $cookie_domain[0];
+    }
+  }
+  // To prevent session cookies from being hijacked, a user can configure the
+  // SSL version of their website to only transfer session cookies via SSL by
+  // using PHP's session.cookie_secure setting. The browser will then use two
+  // separate session cookies for the HTTPS and HTTP versions of the site. So we
+  // must use different session identifiers for HTTPS and HTTP to prevent a
+  // cookie collision.
+  if (ini_get('session.cookie_secure')) {
+    $session_name .= 'SSL';
+  }
+
+  return 'SESS' . md5($session_name);
+}
+
+/**
  * Perform one update and store the results for display on finished page.
  *
  * If an update function completes successfully, it should return a message
Index: modules/simpletest/tests/upgrade/upgrade.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/upgrade/upgrade.test,v
retrieving revision 1.10
diff -u -p -r1.10 upgrade.test
--- modules/simpletest/tests/upgrade/upgrade.test	5 Nov 2010 19:05:02 -0000	1.10
+++ modules/simpletest/tests/upgrade/upgrade.test	5 Dec 2010 02:42:16 -0000
@@ -34,6 +34,9 @@ abstract class UpgradePathTestCase exten
   protected function setUp() {
     global $user, $language, $conf;
 
+    // Load the Update API.
+    require_once DRUPAL_ROOT . '/includes/update.inc';
+
     // Reset flags.
     $this->upgradedSite = FALSE;
     $this->upgradeErrors = array();
@@ -106,10 +109,11 @@ abstract class UpgradePathTestCase exten
     drupal_save_session(FALSE);
     $user = db_query('SELECT * FROM {users} WHERE uid = :uid', array(':uid' => 1))->fetchObject();
 
-    // Generate and set a session cookie.
+    // Generate and set a D6-compatible session cookie.
     $this->curlInitialize();
     $sid = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55));
-    curl_setopt($this->curlHandle, CURLOPT_COOKIE, rawurlencode($this->session_name) . '=' . rawurlencode($sid));
+    $session_name = update_get_d6_session_name();
+    curl_setopt($this->curlHandle, CURLOPT_COOKIE, rawurlencode($session_name) . '=' . rawurlencode($sid));
 
     // Force our way into the session of the child site.
     drupal_save_session(TRUE);