Ticket #744 (defect)

If a user supplies a malicious session id via a cookie, and the server is using file-based sessions, there is a possibility that the application could reference a file outside the session directory. The file name would have to begin with the SESSION_PREFIX. Reading arbitrary files into the session dictionary is mitigated by the use of pickle.load to read the data; similarly, writing is always performed via pickle.dump. File creation and deletion, however, have no such mitigation.