session.save_path and open_basedir

From: Date: Sat, 20 Feb 2016 13:43:18 +0000
Subject: session.save_path and open_basedir
Groups: php.general 
Request: Send a blank email to php-general+get-325412@lists.php.net to get a copy of this message
Hi, i noticed that "session.save_path" doesn't have to be included in "open_basedir". I tried this with PHP 5.6.18-1~dotdeb+7.1 on Debian wheezy and a Apache 2.4 mod_proxy_fcgi/PHP-FPM setup. Isn't this contrary to Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz) in http://php.net/ChangeLog-5.php#5.2.4 ? Or has something changed since then? I've been away from configuring PHP for some time... thanks matthias

« previous php.general (#325412) next »