note 57530 deleted from ref.session by danbrown

Note Submitter: jmoore at sober dot dk ---- The documentation says that sessions "may" be readable by other users on the system, but since it is so trivial to do, "are readable" is a more accurate statement. For example, this will display the contents of all sessions: <?php exec("cat /tmp/sess_*", $aOutput); print_r($aOutput); ?> Note: Changing sessions to use a directory other than /tmp will be harder to find, but no more secure.