if client sends ID that does not exist no on_*_session is called
- If a session is expired but not yet deleted from the storage the server calls on_renew_session and creats an empty session. - If the server purged a session from the storage and now a browser opens the page with the session ID the server creates an empty session with this ID and calls neither on_renew_session nor on_create_session but actually creates a session.
I dont know any reason why it shouldn't also call on_renew_session. Therefor just remove filters/sessionfilter.py:488 ;)
The speration renew / create is a bit strange in my opinion. Renew is just a synomym for "creating session with client choosen ID", isn't it?
This applays at leat to the 2.x branch, so i addign it to the 2.2.2 milestone :p
Reported by dino phidev org