#40464 [NEW]: Session.save_path wont use default-value

Ask a Question related to PHP Bugs, Design and Development.

  1. #1

    Default #40464 [NEW]: Session.save_path wont use default-value

    From: benni at gniza dot org
    Operating system: SuSE 9.3
    PHP version: 5.2.1
    PHP Bug Type: *Configuration Issues
    Bug description: Session.save_path wont use default-value

    Description:
    ------------
    I can approve the behavior of BUG-ID 40434

    Sessions won't work without setting a session.save_path explicitly! If you
    just comment the session.save_path-line you get the error:

    ====
    SAFE MODE Restriction in effect. The script whose uid is XZY is not
    allowed to access owned by uid 0 in [Scriptname:Line of session_start()]
    ====

    This behavior is either a bug or the manual is wrong.

    Quote from the manual:
    ==
    session.save_path defines [...]. Defaults to /tmp.
    ==

    If I explicitly set the save_path (to /tmp or somewhere else) all is
    okay!

    Greetings Benjamin


    --
    Edit bug report at [url]http://bugs.php.net/?id=40464&edit=1[/url]
    --
    Try a CVS snapshot (PHP 4.4): [url]http://bugs.php.net/fix.php?id=40464&r=trysnapshot44[/url]
    Try a CVS snapshot (PHP 5.2): [url]http://bugs.php.net/fix.php?id=40464&r=trysnapshot52[/url]
    Try a CVS snapshot (PHP 6.0): [url]http://bugs.php.net/fix.php?id=40464&r=trysnapshot60[/url]
    Fixed in CVS: [url]http://bugs.php.net/fix.php?id=40464&r=fixedcvs[/url]
    Fixed in release: [url]http://bugs.php.net/fix.php?id=40464&r=alreadyfixed[/url]
    Need backtrace: [url]http://bugs.php.net/fix.php?id=40464&r=needtrace[/url]
    Need Reproduce Script: [url]http://bugs.php.net/fix.php?id=40464&r=needscript[/url]
    Try newer version: [url]http://bugs.php.net/fix.php?id=40464&r=oldversion[/url]
    Not developer issue: [url]http://bugs.php.net/fix.php?id=40464&r=support[/url]
    Expected behavior: [url]http://bugs.php.net/fix.php?id=40464&r=notwrong[/url]
    Not enough info: [url]http://bugs.php.net/fix.php?id=40464&r=notenoughinfo[/url]
    Submitted twice: [url]http://bugs.php.net/fix.php?id=40464&r=submittedtwice[/url]
    register_globals: [url]http://bugs.php.net/fix.php?id=40464&r=globals[/url]
    PHP 3 support discontinued: [url]http://bugs.php.net/fix.php?id=40464&r=php3[/url]
    Daylight Savings: [url]http://bugs.php.net/fix.php?id=40464&r=dst[/url]
    IIS Stability: [url]http://bugs.php.net/fix.php?id=40464&r=isapi[/url]
    Install GNU Sed: [url]http://bugs.php.net/fix.php?id=40464&r=gnused[/url]
    Floating point limitations: [url]http://bugs.php.net/fix.php?id=40464&r=float[/url]
    No Zend Extensions: [url]http://bugs.php.net/fix.php?id=40464&r=nozend[/url]
    MySQL Configuration Error: [url]http://bugs.php.net/fix.php?id=40464&r=mysqlcfg[/url]
    benni at gniza dot org Guest

  2. Similar Questions and Discussions

    1. #25574 [Bgs]: empty session.save_path = problem (session.use_only_cookies = 1)
      ID: 25574 User updated by: markus.welsch@suk.de Reported By: markus dot welsch at suk dot de Status: Bogus Bug...
    2. #25574 [Opn->Bgs]: empty session.save_path = problem (session.use_only_cookies = 1)
      ID: 25574 Updated by: iliaa@php.net Reported By: markus dot welsch at suk dot de -Status: Open +Status: ...
    3. #25574 [Opn]: empty session.save_path = problem (session.use_only_cookies = 1)
      ID: 25574 User updated by: markus.welsch@suk.de Reported By: markus dot welsch at suk dot de Status: Open Bug Type:...
    4. #25574 [NEW]: empty session.save_path = problem (session.use_only_cookies = 1)
      From: markus dot welsch at suk dot de Operating system: Linux 2.4.22 (Debian 3.0r1) PHP version: 4.3.3 PHP Bug Type: Session...
    5. session.save_path is a big security hole!
      Theres absolutely no control over session.save_path parameter in php. By setting it to every directory he wants, every user can: 1. (!!!)...
  3. #2

    Default #40464 [Opn->Asn]: Session.save_path wont use default-value

    ID: 40464
    Updated by: [email]iliaa@php.net[/email]
    Reported By: benni at gniza dot org
    -Status: Open
    +Status: Assigned
    Bug Type: *Configuration Issues
    Operating System: SuSE 9.3
    PHP Version: 5.2.1
    -Assigned To:
    +Assigned To: iliaa


    Previous Comments:
    ------------------------------------------------------------------------

    [2007-02-13 15:39:01] benni at gniza dot org

    Description:
    ------------
    I can approve the behavior of BUG-ID 40434

    Sessions won't work without setting a session.save_path explicitly! If
    you just comment the session.save_path-line you get the error:

    ====
    SAFE MODE Restriction in effect. The script whose uid is XZY is not
    allowed to access owned by uid 0 in [Scriptname:Line of
    session_start()]
    ====

    This behavior is either a bug or the manual is wrong.

    Quote from the manual:
    ==
    session.save_path defines [...]. Defaults to /tmp.
    ==

    If I explicitly set the save_path (to /tmp or somewhere else) all is
    okay!

    Greetings Benjamin



    ------------------------------------------------------------------------


    --
    Edit this bug report at [url]http://bugs.php.net/?id=40464&edit=1[/url]

    iliaa@php.net Guest

  4. #3

    Default #40464 [Asn->Csd]: Session.save_path wont use default-value

    ID: 40464
    Updated by: [email]iliaa@php.net[/email]
    Reported By: benni at gniza dot org
    -Status: Assigned
    +Status: Closed
    Bug Type: *Configuration Issues
    Operating System: SuSE 9.3
    PHP Version: 5.2.1
    Assigned To: iliaa
    New Comment:

    This bug has been fixed in CVS.

    Snapshots of the sources are packaged every three hours; this change
    will be in the next snapshot. You can grab the snapshot at
    [url]http://snaps.php.net/[/url].

    Thank you for the report, and for helping us make PHP better.




    Previous Comments:
    ------------------------------------------------------------------------

    [2007-02-13 15:39:01] benni at gniza dot org

    Description:
    ------------
    I can approve the behavior of BUG-ID 40434

    Sessions won't work without setting a session.save_path explicitly! If
    you just comment the session.save_path-line you get the error:

    ====
    SAFE MODE Restriction in effect. The script whose uid is XZY is not
    allowed to access owned by uid 0 in [Scriptname:Line of
    session_start()]
    ====

    This behavior is either a bug or the manual is wrong.

    Quote from the manual:
    ==
    session.save_path defines [...]. Defaults to /tmp.
    ==

    If I explicitly set the save_path (to /tmp or somewhere else) all is
    okay!

    Greetings Benjamin



    ------------------------------------------------------------------------


    --
    Edit this bug report at [url]http://bugs.php.net/?id=40464&edit=1[/url]
    iliaa@php.net Guest

Posting Permissions

  • You may not post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139