note 19186 added to ref.session

One addition to mystran's note: :: make every user (except the www-servers :: user) belong to a group (say users) and :: make public_html owned by <user>.users :: and chmod 705 True, to limit access from the Unix shell. However, if in php.ini open_basedir is left to its default, then a simple PHP script (running with the server's permissions) would reveal the code anyway. In fact, such a script also reveals the session IDs in /tmp, as explained in the warning of session.save_path above. Arjan. -- http://www.php.net/manual/en/ref.session.php http://master.php.net/manage/user-notes.php?action=edit+19186 http://master.php.net/manage/user-notes.php?action=delete+19186 http://master.php.net/manage/user-notes.php?action=reject+19186