Index: branches/5.2.x/core/kernel/managers/plain_url_processor.php
===================================================================
diff -u -r16513 -r16826
--- branches/5.2.x/core/kernel/managers/plain_url_processor.php	(.../plain_url_processor.php)	(revision 16513)
+++ branches/5.2.x/core/kernel/managers/plain_url_processor.php	(.../plain_url_processor.php)	(revision 16826)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: plain_url_processor.php 16513 2017-01-20 14:10:53Z alex $
+* @version	$Id: plain_url_processor.php 16826 2025-04-10 05:55:23Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2011 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -69,9 +69,11 @@
 		$template = '';
 		$vars = Array ();
 
-		if ( preg_match('/^([\d]+|)-(.*)$/', $parts[0], $regs) ) {
-			// first "env" component matches "sid-template" format
-			// (will be false, when mod-rewrite url to home page is built)
+		/*
+		 * First "env" component matches "sid-template" format
+		 * (will be false, when mod-rewrite url to home page is built).
+		 */
+		if ( preg_match('/^([\da-f]{' . Session::SID_LENGTH . '}|)-(.*)$/', $parts[0], $regs) ) {
 			$sid = $regs[1];
 			$template = $regs[2];
 			array_shift($parts);
@@ -260,4 +262,4 @@
 
 		return $ret;
 	}
-}
\ No newline at end of file
+}
Index: branches/5.2.x/core/kernel/session/session.php
===================================================================
diff -u -r16797 -r16826
--- branches/5.2.x/core/kernel/session/session.php	(.../session.php)	(revision 16797)
+++ branches/5.2.x/core/kernel/session/session.php	(.../session.php)	(revision 16826)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: session.php 16797 2024-08-16 08:27:01Z alex $
+* @version	$Id: session.php 16826 2025-04-10 05:55:23Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -83,6 +83,8 @@
 	const PURPOSE_STORAGE = 2;
 	const PURPOSE_REFERENCE = 3;
 
+	const SID_LENGTH = 32;
+
 	var $Checkers;
 
 	var $Mode;
@@ -552,7 +554,8 @@
 	 */
 	protected function GenerateSID()
 	{
-		$promise = SecurityGenerator::generateBytes(16);
+		// Generated byte-string is hex-encoded and therefore is twice the requested size.
+		$promise = SecurityGenerator::generateBytes(self::SID_LENGTH / 2);
 		$promise->asSignature()->resolveForPersisting(TABLE_PREFIX . 'UserSessions', 'SessionKey');
 		$new_sid = $promise->asValue()->resolve();