Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus
but I still think it's a bug. The session.save_path is treated as file
system path even if I use memcache as session.save_handler. Here is my
patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt
(against PHP 5.3.1). Maybe it would be clearer what I mean. If I'm
wrong, please someone expain me why.
Jaroslav Hanslik
If this is an expected behavior then I think it should be noted here:
http://www.php.net/manual/en/transports.inet.php
Tyrael
2010/2/15 Jaroslav Hanslik konference@kukulich.cz:
Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus but I
still think it's a bug. The session.save_path is treated as file system path
even if I use memcache as session.save_handler. Here is my patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt (against
PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please
someone expain me why.Jaroslav Hanslik
hi,
Is it supposed to work with file:// URI as well? If yes, the patch may
break this feature.
It would be also nice to add a test case if possible.
Cheers,
If this is an expected behavior then I think it should be noted here:
http://www.php.net/manual/en/transports.inet.phpTyrael
2010/2/15 Jaroslav Hanslik konference@kukulich.cz:
Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus but I
still think it's a bug. The session.save_path is treated as file system path
even if I use memcache as session.save_handler. Here is my patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt (against
PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please
someone expain me why.Jaroslav Hanslik
--
--
--
Pierre
@pierrejoye | http://blog.thepimp.net | http://www.libgd.org
I don't think it's supposed to work with file://. I get the same error.
I know 4 types of session handlers:
- files - save_path should be file system path
- user - save_path could be anything
- memcache - save_path uses format tcp://host:port
(http://cz.php.net/manual/en/memcache.ini.php#ini.memcache.save-path) - memcached - uses format hostname:port
(http://cz.php.net/manual/en/memcached.sessions.php)
So I think that save_path should be treated as file system path only if
the handler is "files". And that is what the patch does.
Test script:
<?php
ini_set('open_basedir', 'C:/');
ini_set('session.save_handler', 'memcache');
session_save_path('tcp://localhost:11211');
?>
Without patch:
Warning: session_save_path(): open_basedir restriction in effect.
File(tcp://localhost:11211) is not within the allowed path(s): (C:/) in
C:\bug.php on line 5
With patch:
No warning and session works.
Jaroslav Hanslik
Dne 15.2.2010 16:44, Pierre Joye napsal(a):
hi,
Is it supposed to work with file:// URI as well? If yes, the patch may
break this feature.It would be also nice to add a test case if possible.
Cheers,
If this is an expected behavior then I think it should be noted here:
http://www.php.net/manual/en/transports.inet.phpTyrael
2010/2/15 Jaroslav Hanslikkonference@kukulich.cz:
Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus but I
still think it's a bug. The session.save_path is treated as file system path
even if I use memcache as session.save_handler. Here is my patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt (against
PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please
someone expain me why.Jaroslav Hanslik
hi,
I was wondering if it worked before when "file:///somet/path" was used
or if it did not, should we support it, to be consistent with what
your patch allows (with tcp, but I can imagine other protocols at some
point).
Cheers,
2010/2/15 Jaroslav Hanslik konference@kukulich.cz:
I don't think it's supposed to work with file://. I get the same error.
I know 4 types of session handlers:
- files - save_path should be file system path
- user - save_path could be anything
- memcache - save_path uses format tcp://host:port
(http://cz.php.net/manual/en/memcache.ini.php#ini.memcache.save-path)- memcached - uses format hostname:port
(http://cz.php.net/manual/en/memcached.sessions.php)So I think that save_path should be treated as file system path only if the
handler is "files". And that is what the patch does.Test script:
<?php
ini_set('open_basedir', 'C:/');
ini_set('session.save_handler', 'memcache');
session_save_path('tcp://localhost:11211');?>
Without patch:
Warning:
session_save_path(): open_basedir restriction in effect.
File(tcp://localhost:11211) is not within the allowed path(s): (C:/) in
C:\bug.php on line 5With patch:
No warning and session works.
Jaroslav Hanslik
Dne 15.2.2010 16:44, Pierre Joye napsal(a):
hi,
Is it supposed to work with file:// URI as well? If yes, the patch may
break this feature.It would be also nice to add a test case if possible.
Cheers,
On Mon, Feb 15, 2010 at 4:28 PM, Ferenc Kovacstyra3l@gmail.com wrote:
If this is an expected behavior then I think it should be noted here:
http://www.php.net/manual/en/transports.inet.phpTyrael
2010/2/15 Jaroslav Hanslikkonference@kukulich.cz:
Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus
but I
still think it's a bug. The session.save_path is treated as file system
path
even if I use memcache as session.save_handler. Here is my patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt
(against
PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please
someone expain me why.Jaroslav Hanslik
--
--
--
Pierre
@pierrejoye | http://blog.thepimp.net | http://www.libgd.org
It didn't work before (tested only on windows).
<?php
ini_set('open_basedir', 'C:/');
session_save_path('file:///C:/Test');
?>
Warning: session_save_path(): open_basedir restriction in effect.
File(file:///C:/Test) is not within the allowed path(s): (C:/) in
C:\bug.php on line 4
Jaroslav Hanslik
Dne 15.2.2010 21:37, Pierre Joye napsal(a):
hi,
I was wondering if it worked before when "file:///somet/path" was used
or if it did not, should we support it, to be consistent with what
your patch allows (with tcp, but I can imagine other protocols at some
point).Cheers,
2010/2/15 Jaroslav Hanslikkonference@kukulich.cz:
I don't think it's supposed to work with file://. I get the same error.
I know 4 types of session handlers:
- files - save_path should be file system path
- user - save_path could be anything
- memcache - save_path uses format tcp://host:port
(http://cz.php.net/manual/en/memcache.ini.php#ini.memcache.save-path)- memcached - uses format hostname:port
(http://cz.php.net/manual/en/memcached.sessions.php)So I think that save_path should be treated as file system path only if the
handler is "files". And that is what the patch does.Test script:
<?php
ini_set('open_basedir', 'C:/');
ini_set('session.save_handler', 'memcache');
session_save_path('tcp://localhost:11211');?>
Without patch:
Warning:
session_save_path(): open_basedir restriction in effect.
File(tcp://localhost:11211) is not within the allowed path(s): (C:/) in
C:\bug.php on line 5With patch:
No warning and session works.
Jaroslav Hanslik
Dne 15.2.2010 16:44, Pierre Joye napsal(a):
hi,
Is it supposed to work with file:// URI as well? If yes, the patch may
break this feature.It would be also nice to add a test case if possible.
Cheers,
If this is an expected behavior then I think it should be noted here:
http://www.php.net/manual/en/transports.inet.phpTyrael
2010/2/15 Jaroslav Hanslikkonference@kukulich.cz:
Hi,
my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus
but I
still think it's a bug. The session.save_path is treated as file system
path
even if I use memcache as session.save_handler. Here is my patch
http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt
(against
PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please
someone expain me why.Jaroslav Hanslik