Re: [PATCH] Modifications for ext/session/
| From: | Peter Brodersen | Date: | Fri, 22 Apr 2005 18:54:48 +0000 |
| Subject: | Re: [PATCH] Modifications for ext/session/ | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-16055@lists.php.net to get a copy of this message | ||
On Wed, 20 Apr 2005 13:00:48 -0400, in php.internals sean@caedmon.net
(Sean Coates) wrote:
>Provided that the code is good: +1
>These sounds like great features (especially for session fixation/hijack
>prevention).
But as long as stuff like
print_r(glob("{.,/tmp}/*",GLOB_BRACE));
.. are possible even in safe_mode/open_basedir-restrictions, these new
functions will have pretty small effect unless one works his way
entirely around the session functionality in the first place...
E.g.:
http://basedir.ter.dk/globall.php
--
- Peter Brodersen