spiders_flag

Zen 1.5.6 and others I suspect

Minor point in init_sessions...

/**
 * start the session
 */
$session_started = false;
if (SESSION_FORCE_COOKIE_USE == 'True') {
  setcookie('cookie_test', 'please_accept_for_session', time()+60*60*24*30, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), $secureFlag);

  if (isset($_COOKIE['cookie_test'])) {
    zen_session_start();
    $session_started = true;
  }
} elseif (SESSION_BLOCK_SPIDERS == 'True') {
  $user_agent = '';
  if (isset($_SERVER['HTTP_USER_AGENT'])) {
    $user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
  }
  $spider_flag = false;
  if (zen_not_null($user_agent)) {
    $spiders = file(DIR_WS_INCLUDES . 'spiders.txt');
    for ($i=0, $n=sizeof($spiders); $i<$n; $i++) {
      if (zen_not_null($spiders[$i]) && substr($spiders[$i], 0, 4) != '$Id:') {
        if (is_integer(strpos($user_agent, trim($spiders[$i])))) {
          $spider_flag = true;
          break;
        }
      }
    }
  }

I think that there should be a '$spider_flag = false;' in the if part as well as the elseif - or it should be defined outside both. Otherwise it is undefined if one chooses to force cookie use. And you get a warning later on when the variable is used in application_top.php (ln 174 or thereabouts)

As I say minor ....

I would actually say that if the setting is to occur here rather than modifying the detection, that within the if statement of forcing cookie usage that possibly $spider_flag gets set to true then if the session gets started that inside there it is redefined to false. But, almost on a second note, that instead of being set to true in the first if, that it be set to maybe. That is really only to not specifically treat a cookie refusing browser to be a spider, but also not to give it full/complete access as a customer.