[JeremyL]

Anyone else not finding the code int he core file? This is a brand new install with the latest download.

III. includes/func/func.core.php
===================
RECOMMENDED:
The following change to "func.core.php" is recommended
to help prevent search engines from picking up Sesson IDs
when visiting X-Cart. This *issue* has been reported to X-Cart
devs and will be fixed in the next release of X-Cart (4.1.4).

NOTE: This change is for X-Cart 4.1.x series. Owners of 4.0.x, please
verify if this alteration is needed.

-----------
Find Code:
-----------

    if (!empty($XCARTSESSID) && !isset($HTTP_COOKIE_VARS[$XCART_SESSION_NAME]) && !eregi("$XCART_SESSION_NAME=", $location)) {
        $location .= ((strpos($location, '?') != false)?'&':'?')."$XCART_SESSION_NAME=".$XCARTSESSID;
    }

------------
Replace With
------------

    if (!empty($XCARTSESSID) && !isset($HTTP_COOKIE_VARS[$XCART_SESSION_NAME]) && !eregi("$XCART_SESSION_NAME=", $location) && !defined('IS_ROBOT')) {
        $location .= ((strpos($location, '?') != false)?'&':'?')."$XCART_SESSION_NAME=".$XCARTSESSID;
    }

This is the closest thing I can find but it looks like it may have already been fixed

    if (!empty($XCARTSESSID) && (!isset($HTTP_COOKIE_VARS[$XCART_SESSION_NAME]) || defined("SESSION_ID_CHANGED")) && !eregi("$XCART_SESSION_NAME=", $location) && !defined('IS_ROBOT')) {
        $added[] = $XCART_SESSION_NAME."=".$XCARTSESSID;
    }