Re: session.save_path is a big security hole!

From: Date: Thu, 04 Sep 2003 22:03:52 +0000
Subject: Re: session.save_path is a big security hole!
References: 1 2 3 4  Groups: php.general 
Request: Send a blank email to php-general+get-161697@lists.php.net to get a copy of this message
You didnt understand. I change save.session_path to other's site session directory, do session_start(), write every variable what i want, write down session number, go to this site and using this generated session. You cannt prevent this ever!
Does enabling safe_mode counter any of these writing file issues? We all know the solution is to have a dedicated server, of course. :) -- ---John Holmes... Amazon Wishlist: www.amazon.com/o/registry/3BEXC84AB3A5E/ php|architect: The Magazine for PHP Professionals – www.phparch.com

« previous php.general (#161697) next »