Re: Security risk how to use find recommended in php.ini-*
| From: | Christopher Jones | Date: | Wed, 08 Feb 2012 23:40:08 +0000 |
| Subject: | Re: Security risk how to use find recommended in php.ini-* | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57803@lists.php.net to get a copy of this message | ||
On 02/08/2012 03:35 PM, Ondřej Surý wrote:
This is very wrong to recommend: ; NOTE: If you are using the subdirectory option for storing session files [...]Can you log a bug for this at https://bugs.php.net/ ? Thanks, Chris -- Email: christopher.jones@oracle.com Tel: +1 650 506 8630 Blog: http://blogs.oracle.com/opal/; find /path/to/sessions -cmin +24 | xargs rmbecause it is prone to '\n' attack. You can see the security considerations of GNU find.