Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:40098
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.44.28 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:mime-version:content-type
         :content-transfer-encoding:content-disposition;
        b=DxMojuv2o1znE1jpL7jch2uJuzaA5rW9nRqZHDcTwvgpRq78g8ei7OHzLGD1yKvsy2
         L2hrQOocRh2rc7OBW4J4cg3rOurUKLVUUyoHbNB84IFpcQiTl74bybTANF8urMZkitmt
         HJ0F0I1ZXUu6fAvsIk8x5CL4XDgsQLZ5bQaq0=
Message-ID: <cd5680a20808270130g5acab941uf9c3e8cc2f66f458@mail.gmail.com>
Date: Wed, 27 Aug 2008 12:30:44 +0400
To: "PHP Internals" <internals@lists.php.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: open_basedir + sessions bug (or a feature?)
From: indeyets@gmail.com ("Alexey Zakhlestin")

ext/sessions/mod_files.c:281 has a hardcoded openbasedir-check
skipping of "/tmp" path for storing session-files, if
sessions.save_path is not manually set.

This leads to the failure of session_save_path_variation5 test on mac
os x, as default temporary path here is "/var/tmp" and not "/tmp"

Anyway, this looks like something done wrong from the beginning.
Shouldn't "/tmp" be explicitly added to open_basedir list? Why should
it have any special meaning?
I propose to remove special treatment of "/tmp" (should be mentioned
in upgrade-docs)

Other option would be to skip check for any path, which is returned by
php_get_temporary_directory() call, but that sounds like a very bad
idea.

-- 
Alexey Zakhlestin
http://blog.milkfarmsoft.com/