# Bug #50751 - Thread: https://externals.io/message/46991 - Original archive: https://news-web.php.net/php.internals/46991 - Started by Jaroslav Hanslik on 2010-02-15T12:35:57+00:00 - Messages: 6 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #46991 — Jaroslav Hanslik — 2010-02-15T12:35:57+00:00 URL: https://externals.io/message/46991#46991 Hi, my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus but I still think it's a bug. The session.save_path is treated as file system path even if I use memcache as session.save_handler. Here is my patch http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt (against PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please someone expain me why. Jaroslav Hanslik --- ## #46992 — Ferenc Kovacs — 2010-02-15T15:28:03+00:00 URL: https://externals.io/message/46991#46992 · In reply to: #46991 If this is an expected behavior then I think it should be noted here: http://www.php.net/manual/en/transports.inet.php Tyrael 2010/2/15 Jaroslav Hanslik : > Hi, > > my bug report http://bugs.php.net/bug.php?id=50751 was marked as bogus but I > still think it's a bug. The session.save_path is treated as file system path > even if I use memcache as session.save_handler. Here is my patch > http://temp.kukulich.cz/session_save_path_checked_only_if_files.txt (against > PHP 5.3.1). Maybe it would be clearer what I mean. If I'm wrong, please > someone expain me why. > > Jaroslav Hanslik --- ## #46993 — Pierre Joye — 2010-02-15T15:44:52+00:00 URL: https://externals.io/message/46991#46993 · In reply to: #46992 hi, Is it supposed to work with file:// URI as well? If yes, the patch may break this feature. It would be also nice to add a test case if possible. Cheers, > If this is an expected behavior then I think it should be noted here: > http://www.php.net/manual/en/transports.inet.php > > Tyrael > > 2010/2/15 Jaroslav Hanslik : > > […] > > -- > > > > -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #46994 — Jaroslav Hanslik — 2010-02-15T19:29:09+00:00 URL: https://externals.io/message/46991#46994 · In reply to: #46993 I don't think it's supposed to work with file://. I get the same error. I know 4 types of session handlers: 1) files - save_path should be file system path 2) user - save_path could be anything 3) memcache - save_path uses format tcp://host:port (http://cz.php.net/manual/en/memcache.ini.php#ini.memcache.save-path) 4) memcached - uses format hostname:port (http://cz.php.net/manual/en/memcached.sessions.php) So I think that save_path should be treated as file system path only if the handler is "files". And that is what the patch does. Test script: Without patch: Warning: `session_save_path()`: open_basedir restriction in effect. File(tcp://localhost:11211) is not within the allowed path(s): (C:/) in C:\bug.php on line 5 With patch: No warning and session works. Jaroslav Hanslik Dne 15.2.2010 16:44, Pierre Joye napsal(a): > hi, > > Is it supposed to work with file:// URI as well? If yes, the patch may > break this feature. > > It would be also nice to add a test case if possible. > > Cheers, > > > > […] --- ## #46995 — Pierre Joye — 2010-02-15T20:37:43+00:00 URL: https://externals.io/message/46991#46995 · In reply to: #46994 hi, I was wondering if it worked before when "file:///somet/path" was used or if it did not, should we support it, to be consistent with what your patch allows (with tcp, but I can imagine other protocols at some point). Cheers, 2010/2/15 Jaroslav Hanslik : > I don't think it's supposed to work with file://. I get the same error. > > I know 4 types of session handlers: > > 1) files - save_path should be file system path > 2) user - save_path could be anything > 3) memcache - save_path uses format tcp://host:port > (http://cz.php.net/manual/en/memcache.ini.php#ini.memcache.save-path) > 4) memcached - uses format hostname:port > (http://cz.php.net/manual/en/memcached.sessions.php) > > So I think that save_path should be treated as file system path only if the > handler is "files". And that is what the patch does. > > Test script: > > > ini_set('open_basedir', 'C:/'); > ini_set('session.save_handler', 'memcache'); > session_save_path('tcp://localhost:11211'); > > ?> > > Without patch: > > Warning: `session_save_path()`: open_basedir restriction in effect. > File(tcp://localhost:11211) is not within the allowed path(s): (C:/) in > C:\bug.php on line 5 > > With patch: > > No warning and session works. > > > Jaroslav Hanslik > > > Dne 15.2.2010 16:44, Pierre Joye napsal(a): > > […] > -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #46996 — konference@kukulich.cz — 2010-02-15T20:48:17+00:00 URL: https://externals.io/message/46991#46996 · In reply to: #46995 It didn't work before (tested only on windows). Warning: `session_save_path()`: open_basedir restriction in effect. File(file:///C:/Test) is not within the allowed path(s): (C:/) in C:\bug.php on line 4 Jaroslav Hanslik Dne 15.2.2010 21:37, Pierre Joye napsal(a): > hi, > > I was wondering if it worked before when "file:///somet/path" was used > > or if it did not, should we support it, to be consistent with what > your patch allows (with tcp, but I can imagine other protocols at some > point). > > Cheers, > > 2010/2/15 Jaroslav Hanslik: > > […]