authorize.php Doesn't Respect Custom Session Handlers

Problem/Motivation

Users can implement their own custom session handler systems by setting the 'session_inc' variable to something other than the default "includes/session.inc". This setting isn't respected by authorize.php however, which has a hard coded include to "includes/session.inc".

This leads to either fatal errors (if the custom session handler doesn't check if the default handler is loaded) or failed session loading (if it does check).

Proposed resolution

Remove hard coded include to "includes/session.inc" in authorize.php and let the session handler be loaded properly by the bootstrap process.

Remaining tasks

1. Write patch for D7 and D8.
2. Community to test patch(es) #1.
   1. Install Drupal 7 or 8 – standard profile
   2. Go to authorize.php (D7: /authorize.php; D8: /core/authorize.php)
   3. Ensure that the message "It appears you have reached this page in error." appears.
   4. Create the file '/custom_session.inc' with the following contents:

      <?php
      
      function drupal_session_initialize() {
        echo('Custom session handler was called.');
        exit();
      }
      

   5. Add the following line to /sites/default/settings.php:

      $conf['session_inc'] = 'custom_session.inc';
      

   6. Go to authorize.php (D7: /authorize.php; D8: /core/authorize.php)
   7. Ensure that the fatal error "Cannot redeclare drupal_session_initialize()" occurs.
   8. Apply relevant patch #1.
   9. Go to authorize.php (D7: /authorize.php; D8: /core/authorize.php)
   10. Ensure that the message "Custom session handler was called." appears.

3. Commit patches to D7 and D8.

User interface changes

None.

API changes

None.