Page MenuHomeDevCentral

Create individual PHP session directories per php-fpm user
ClosedPublic

Authored by dereckson on Mar 23 2018, 19:25.
Tags
None
Referenced Files
F3716576: D1486.diff
Tue, Nov 5, 16:20
F3715341: D1486.diff
Tue, Nov 5, 05:11
Unknown Object (File)
Thu, Oct 31, 08:56
Unknown Object (File)
Thu, Oct 31, 08:39
Unknown Object (File)
Wed, Oct 30, 08:20
Unknown Object (File)
Wed, Oct 30, 08:20
Unknown Object (File)
Wed, Oct 30, 08:20
Unknown Object (File)
Sun, Oct 27, 07:26
Subscribers
None

Details

Summary

To improve security for applications not using a custom session
handler, it's better to isolate sessions in a directory only
readable by the current php-fpm pool username.

As such, a security issue with one site allowing to browse files
won't allow to hijack sessions on a site served by another php-fpm pool.

Meanwhile, we reset to the default value in php.ini to allow quick tests
with php -S internal server on development servers.

Ref T417.

Test Plan

Test with www.dereckson.be

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
php-individual-session-dirs (branched from master)
Build Status
Buildable 2343
Build 2591: arc lint + arc unit

Event Timeline

dereckson created this revision.
dereckson accepted this revision.
This revision is now accepted and ready to land.Mar 23 2018, 20:37
This revision was automatically updated to reflect the committed changes.