Sessions Settings - Possible regression with `Form::hide_session_id()` after PHP 8.4 session changes (v1.1.0.7)

[azpro]

While upgrading my testshop to Phoenix 1.1.0.7, I noticed what appears to be an inconsistency regarding session handling in the admin.

### Configuration

* Phoenix 1.1.0.7
* PHP 8.0.30
* **Force Cookie Use = True**

### Test case

Using a simple GET form in the admin:

Code: Select all

<?= (new Form('status', $Admin->link('orders.php'), 'get'))->hide_session_id() ?>

Submitting this form causes my admin session to be lost and I am redirected to the storefront.

If I remove only hide_session_id()

Code: Select all

<?= (new Form('status', $Admin->link('orders.php'), 'get') ?>

the same form works perfectly.

Additional observation - If I set:

Force Cookie Use = False

the admin form also works, but the storefront starts appending the session ID to URLs again, for example:
shopping_cart.php?sort=1a&ceid=xxxxxxxxxxxxxxxx


So I end up with:

Force Cookie Use = False

* Admin GET forms work.
* Session ID (`ceid`) is appended to storefront URLs.

Force Cookie Use = True

* Storefront URLs are clean (preferred).
* GET forms using `->hide_session_id()` lose the admin session.

Looking at commit https://github.com/CE-PhoenixCart/Phoen ... 77a35aae8b

I noticed that the PHP 8.4 session changes modified both:

* includes/system/segments/application/start_session.php
* includes/system/versioned/1.01.00.07/form.php

It seems that hide_session_id() now always adds the current session ID whenever a session exists, while Href already respects the **Force Cookie Use** setting.

### Question

Is this the expected behaviour?

Should `Form::hide_session_id()` also respect the **Force Cookie Use** configuration when using GET forms, or is there something in my configuration that I have overlooked?

I appreciate any feedback before I start modifying Core code .

Thanks!

[burt]

@BrockleyJohn