ID: 42077 Comment by: harry at rhsoft dot net Reported By: spam2 at rhsoft dot net Status: Feedback Bug Type: Session related Operating System: Linux PHP Version: 5CVS-2007-07-23 (snap) Assigned To: stas New Comment:
Yes seems to work correct <?php session_start(); echo $a; phpinfo(); ?> Notice: Undefined variable: a in /mnt/data/www/www.rhsoft.net/test.php on line 3 PHP Version 5.2.4RC1-dev __________ Session was started with a save-path outside open_basedir The Warning-Message was written in the global error_log also outside open_basedir Previous Comments: ------------------------------------------------------------------------ [2007-08-07 00:25:39] [EMAIL PROTECTED] Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows (zip): http://snaps.php.net/win32/php5.2-win32-latest.zip For Windows (installer): http://snaps.php.net/win32/php5.2-win32-installer-latest.msi AFAIK, this is now fixed. Please try the snapshot. ------------------------------------------------------------------------ [2007-08-03 18:13:36] harry at rhsoft dot net Nice - The bug is present and you make a release candidate? Aug 2007, PHP 5.2.4 02 Aug 2007, PHP 5.2.4RC1 Hopefully this is a joke...... If this will go to final i need a address to send a bill for changing 200 Host-Files on some servers! Need to make for each one a session-directory and set it to open_basedir or a stupid global configuration that allows scripts reading of all session-files from other users too. But what should we do with global error_log? Give all Hosts access to the log-folder? NO - Never! ------------------------------------------------------------------------ [2007-07-28 13:45:07] harry at rhsoft dot net Is there any change? The downloaded snapshot contains following in "news.txt" Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) If this change goes in php 5.2.4 final it will break many setups "session.save_path" and "error_log" set by admin in php.ini must not checked against open_basedir If you have 100 virtual hosts with open_basedir for each per <Directory> and the server is configured for one central errorlog and one central session.save_path all hosts will crash. You must check changig this in .htaccess/ini_set() against open_basedir but not on the global configuration. A script has not to look in the session-dir because in worst case it can read ALL session-files and display the content - so open_basedir has to block this and did it before the change. ------------------------------------------------------------------------ [2007-07-25 14:31:47] [EMAIL PROTECTED] Re-opening and assign to Stas who has something cooking up for this. ------------------------------------------------------------------------ [2007-07-23 09:12:07] [EMAIL PROTECTED] See http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-3378 for why. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/42077 -- Edit this bug report at http://bugs.php.net/?id=42077&edit=1
