open_basedir + sessions bug (or a feature?)

From: Date: Wed, 27 Aug 2008 08:30:44 +0000
Subject: open_basedir + sessions bug (or a feature?)
Groups: php.internals 
Request: Send a blank email to internals+get-40098@lists.php.net to get a copy of this message
ext/sessions/mod_files.c:281 has a hardcoded openbasedir-check skipping of "/tmp" path for storing session-files, if sessions.save_path is not manually set. This leads to the failure of session_save_path_variation5 test on mac os x, as default temporary path here is "/var/tmp" and not "/tmp" Anyway, this looks like something done wrong from the beginning. Shouldn't "/tmp" be explicitly added to open_basedir list? Why should it have any special meaning? I propose to remove special treatment of "/tmp" (should be mentioned in upgrade-docs) Other option would be to skip check for any path, which is returned by php_get_temporary_directory() call, but that sounds like a very bad idea. -- Alexey Zakhlestin http://blog.milkfarmsoft.com/

« previous php.internals (#40098) next »