open_basedir + sessions bug (or a feature?)
| From: | Alexey Zakhlestin | Date: | Wed, 27 Aug 2008 08:30:44 +0000 |
| Subject: | open_basedir + sessions bug (or a feature?) | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-40098@lists.php.net to get a copy of this message | ||
ext/sessions/mod_files.c:281 has a hardcoded openbasedir-check
skipping of "/tmp" path for storing session-files, if
sessions.save_path is not manually set.
This leads to the failure of session_save_path_variation5 test on mac
os x, as default temporary path here is "/var/tmp" and not "/tmp"
Anyway, this looks like something done wrong from the beginning.
Shouldn't "/tmp" be explicitly added to open_basedir list? Why should
it have any special meaning?
I propose to remove special treatment of "/tmp" (should be mentioned
in upgrade-docs)
Other option would be to skip check for any path, which is returned by
php_get_temporary_directory() call, but that sounds like a very bad
idea.
--
Alexey Zakhlestin
http://blog.milkfarmsoft.com/