Re: session.save_path is a big security hole!
| From: | Curt Zirzow | Date: | Thu, 04 Sep 2003 22:12:40 +0000 |
| Subject: | Re: session.save_path is a big security hole! | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-161699@lists.php.net to get a copy of this message | ||
* Thus wrote John W. Holmes (holmes072000@charter.net):
> >>You didnt understand. I change save.session_path to other's site session
> >>directory, do session_start(), write every variable what i want, write
> >>down
> >>session number, go to this site and using this generated session. You
> >>cannt
> >>prevent this ever!
>
>
> Does enabling safe_mode counter any of these writing file issues?
unfortantly no.
>
> We all know the solution is to have a dedicated server, of course. :)
Or a jailed system, usually a bit cheaper for the client.
Perhaps that is the best way to go as a hosting company, and only
offer a really locked down (disabling a bunch of functions) to
simple virtual hosts.
Curt
--
"I used to think I was indecisive, but now I'm not so sure."