? sites/default/files
? sites/default/private
? sites/default/settings.php
Index: includes/session.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/session.inc,v
retrieving revision 1.72
diff -u -p -r1.72 session.inc
--- includes/session.inc	28 Sep 2009 22:22:54 -0000	1.72
+++ includes/session.inc	18 Oct 2009 17:22:07 -0000
@@ -152,8 +152,11 @@ function _drupal_session_write($sid, $va
     'timestamp' => REQUEST_TIME,
   );
   $insecure_session_name = substr(session_name(), 1);
-  if ($is_https && isset($_COOKIE[$insecure_session_name])) {
-    $fields['sid'] = $_COOKIE[$insecure_session_name];
+  if ($is_https) {
+    // sid is the primary key and must not be empty. If the "secure pages"
+    // setting is enabled, set sid to the insecure session identifier, otherwise
+    // set sid to the ssid.
+    $fields['sid'] = variable_get('https', FALSE) && isset($_COOKIE[$insecure_session_name]) ? $_COOKIE[$insecure_session_name] : $sid;
   }
   db_merge('sessions')
     ->key(array($is_https ? 'ssid' : 'sid' => $sid))
Index: modules/simpletest/tests/session_test.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/session_test.module,v
retrieving revision 1.13
diff -u -p -r1.13 session_test.module
--- modules/simpletest/tests/session_test.module	15 Oct 2009 16:18:45 -0000	1.13
+++ modules/simpletest/tests/session_test.module	18 Oct 2009 17:22:07 -0000
@@ -158,5 +158,8 @@ function session_test_form_user_login_al
  */
 function session_test_drupal_goto_alter(&$path, &$options, &$http_response_code) {
   global $base_insecure_url;
-  $path = $base_insecure_url . '/' . $path;
+  // Alter the redirect only when the "secure pages" setting is enabled.
+  if (variable_get('https', FALSE)) {
+    $path = $base_insecure_url . '/' . $path;
+  }
 }