Re: SESSION Security
| From: | Sascha Braun | Date: | Wed, 14 Aug 2002 23:03:22 +0000 |
| Subject: | Re: SESSION Security | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-112619@lists.php.net to get a copy of this message | ||
So, if somebody gets an ftp account somehow, he will be able to get session
vars via a system() command?
----- Original Message -----
From: "Ilia A." <ilia@prohost.org>
To: "Sascha Braun" <saschabraun@gmx.de>; "PHP Mailingliste"
<php-general@lists.php.net>
Sent: Thursday, August 15, 2002 1:27 AM
Subject: Re: [PHP] SESSION Security
> If a person 'somehow' gains read access to the directory where the
sessions
> are stored on your server, then yes it is possible for them to get the
> session id.
>
> Ilia
>
> On August 14, 2002 06:41 pm, Sascha Braun wrote:
> > Is it possible that someone from outside can read the session stored
> > on my webserver for getting unencrypted password and usernames?
> >
> > Schura
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>