Re: Re: Session contamination?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, April 20, 2006 11:05 pm, Chuck Anderson wrote:
> As to session save path, when I run phpinfo (at my remote Linux
> server)
> it tells me that it is set to "no value." This means it would default
> to
> /tmp. Where is this tmp directory? I have looked at the tmp directory
> that is one level above my site's www directory (outside of the web
> space), but I do not see any session data there. That's why I am
> asking
> if it is a system wide directory, or is it the one in my home
> directory.

It is what you are calling a "system wide directory"

It is named /tmp and it is at the very tip-top of your directory
structure.

Actually, it doesn't HAVE to be called /tmp nor does it HAVE to be at
the tip-top directory. It doesn't even HAVE to be on the same hard
drive as your home directory.  Hell, it might even be on a RAM disk on
some souped-up machines.  In Windoze, it might be called C:/temp Or
not. But who cares about Windows anyway?  Still, it's usually /tmp at
the tip-top, and your post indicates that you probably have some
indicator that that is true.

>From a shell (or php exec) you should be able to do:
ls /
and see '/tmp' in the output.

You may even be able to do:
ls /tmp
and see what is in there.

Or you might not, as you might not have permission to poke around in
there.  And that's a Good Thing.

Hopefully, whatever *IS* in there, you can't view all of it.

tmp directories are handled specially by the operating system.

The exact rules differ from OS to OS and configuration to
configuration, but for starters, you should generally assume that
anything in /tmp is subject to being wiped out when the machine
reboots.  It might not be set up that way, but it's safer to assume it
is, because it might be.

Access to tmp directories is often handled as a special case, to allow
users that normally have no access to the file system at all, to be
allowed to make/delete tmp files.

> If I set the path myself, what would be a good location? (I assume it
> should be outside the web space). Should I make up some random folder
> name (one time) and story my session data within that directory,
> within
> my own home directory?

Your best bet, if possible, is to use s sub-directory of /tmp for
yourself, or for each application, or for whatever you want to
separate from the rest of /tmp

This will keep your stuff separate, but you still enjoy all the
benefits of system tmp directory behaviour.

Unless, of course, you specifically WANT your sessions to survive a
re-boot for some reason, and you are willing to take care of lingering
sessions and the permissions gotchas of rolling your own...

Think long and hard before doing this, as there are subtle permissions
things involved (either way you go) that you don't want to overlook.

-- 
Like Music?
http://l-i-e.com/artists.htm

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux