Re: Secure way to handle pw on session.
| From: | Micah Gersten | Date: | Tue, 02 Sep 2008 21:40:09 +0000 |
| Subject: | Re: Secure way to handle pw on session. | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-279352@lists.php.net to get a copy of this message | ||
I thought he'd be more worried about something like 'cat /tmp/sess_*'.
Also, you can enable the save_path in the ini file or htaccess file and
then disable the PHP function in the ini file.
Thank you,
Micah Gersten
onShore Networks
Internal Developer
http://www.onshore.com
Robert Cummings wrote:
> On Tue, 2008-09-02 at 16:22 -0500, Micah Gersten wrote:
>
>> If one does not know where the session data is, one cannot inject code
>> to expose it.
>>
>
> PHP knows where the session data is, the very function you gave provides
> the path to it also. If you've got code injection then you've got
> someone who can probably read the return value of session_save_path().
>
> Cheers,
> Rob.
>