#37627 [Opn->Csd]: session_save_directory checks wrong directory in safe mode

ID: 37627 Updated by: iliaa@php.net Reported By: bla at cs dot huji dot ac dot il -Status: Open +Status: Closed Bug Type: Session related Operating System: freebsd 6.1 PHP Version: 5.1.4 New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2006-05-30 07:38:52] bla at cs dot huji dot ac dot il This is the 3rd time I write this reply, it keeps disappearing after I submit it. Anyway: Appending a '/' to the path fixes the problem, thanks. However it should work even without a trailing '/' just like any other path related setting. ------------------------------------------------------------------------ [2006-05-29 12:46:17] tony2001@php.net >Note that /var/spool/session exists and has the right > permissions so there's no need to modify /var/spool). /var/spool/session or /var/spool/sessions ? What if try this: session_save_path("/var/spool/sessions/"); ? ------------------------------------------------------------------------ [2006-05-29 12:34:06] bla at cs dot huji dot ac dot il Description: ------------ When I run this command: session_save_path("/var/spool/sessions"); I get: session_save_path() [function.session-save-path]: SAFE MODE Restriction in effect. The script whose uid is 24713 is not allowed to access /var/spool The information in the message is correct but I suppose the function should check /var/spool/sessions, not /var/spool. (note that /var/spool/session exists and has the right permissions so there's no need to modify /var/spool). Probably the OnUpdateSaveDir() function in session.c should give a different flag to php_checkuid(). ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=37627&edit=1