Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:40116
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.46.30 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:cc:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=DicSRlHGhIavNbHEJ1oC5yEJYYu30y79nBayj0GkBoTXfbPQBE2eL37ITZrCPlLHH6
         +sbY5a9i3YZnFxWQKOuW55DOmqy/uLSJxDc7ivDvpzoiH2nOMn4jst2ovv+vtoRxY04/
         HXL9kV5PCzcjRb3Kmxopx2P+U7QRLZ9VCmQOg=
Message-ID: <cd5680a20808272307n403b0cd5kea6cee571b5f9183@mail.gmail.com>
Date: Thu, 28 Aug 2008 10:07:05 +0400
To: "Stanislav Malyshev" <stas@zend.com>
Cc: "PHP Internals" <internals@lists.php.net>
In-Reply-To: <48B5CE4A.7000807@zend.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <cd5680a20808270130g5acab941uf9c3e8cc2f66f458@mail.gmail.com>
	 <48B5CE4A.7000807@zend.com>
Subject: Re: [PHP-DEV] open_basedir + sessions bug (or a feature?)
From: indeyets@gmail.com ("Alexey Zakhlestin")

On Thu, Aug 28, 2008 at 1:59 AM, Stanislav Malyshev <stas@zend.com> wrote:
> Hi!
>
>> ext/sessions/mod_files.c:281 has a hardcoded openbasedir-check
>> skipping of "/tmp" path for storing session-files, if
>> sessions.save_path is not manually set.
>
> I would think the idea was to make it easier on inexperienced users. Since
> default AFAIK is /tmp, and it is highly unlikely that somebody would need to
> hide /tmp from the users, it makes more scenarios to work out of the box.
>
>> Anyway, this looks like something done wrong from the beginning.
>> Shouldn't "/tmp" be explicitly added to open_basedir list? Why should
>> it have any special meaning?
>> I propose to remove special treatment of "/tmp" (should be mentioned
>> in upgrade-docs)
>
> Is there any problem that this treatment is causing? I.e. on Mac the default
> is different, but that's not a problem of this treatment - it's rather
> missing special treatment of /var/tmp on mac, I'd say :) So Mac users don't
> get this boon, but is it the reason to remove it form other users?

The proper way is to explicitly specify "/tmp" in open_basedir, and,
actually, there is quite a common practice of doing so.
This "feature" we have was never documented.
It was introduced in 5.2.2, so it wasn't there "forever"

-- 
Alexey Zakhlestin
http://blog.milkfarmsoft.com/