Re: Security risk how to use find recommended in php.ini-*

On Thu, Feb 9, 2012 at 00:40, Christopher Jones <christopher.jones@oracle.com> wrote: > Can you log a bug for this at https://bugs.php.net/ ? Done: https://bugs.php.net/bug.php?id=61020 On Thu, Feb 9, 2012 at 00:43, Reindl Harald <h.reindl@thelounge.net> wrote: > the main question is why here "cmin" is used instead "mmin"? > find /var/www/sessiondata -type f -mmin +60 -exec rm -f {} \; 2> /dev/null > /dev/null Good question about -cmin vs -mmin, but the rest of the command is so much wrong in so many places. Here's the GNU find manual online[1]. -exec rm -f {} \; * prone to symlink attack (see the bugreport) * forcing rm here is only hiding possible errors 2>/dev/null 1>/dev/null * only hiding possible errors O. 1. http://www.gnu.org/software/findutils/manual/html_node/find_html/Security-Considerations-for-find.html -- Ondřej Surý <ondrej@sury.org>