Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

2012-02-08 Thread Ondřej Surý
On Thu, Feb 9, 2012 at 00:40, Christopher Jones wrote: > Can you log a bug for this at https://bugs.php.net/ ? Done: https://bugs.php.net/bug.php?id=61020 On Thu, Feb 9, 2012 at 00:43, Reindl Harald wrote: > the main question is why here "cmin" is used instead "mmin"? > find /var/www/sessiondat

Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

2012-02-08 Thread Reindl Harald
Am 09.02.2012 00:35, schrieb Ondřej Surý: > Much better would be: > > find /path/to/sessions -cmin +24 -delete > or at least > find /path/to/sessions -cmin +24 -execdir rm "{}" \; (GNU find) > > The most error-prone way is something we cooked up in Debian: > > find /var/lib/php5/ -depth -minde

Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

2012-02-08 Thread Christopher Jones
On 02/08/2012 03:35 PM, Ondřej Surý wrote: This is very wrong to recommend: ; NOTE: If you are using the subdirectory option for storing session files [...] ; find /path/to/sessions -cmin +24 | xargs rm because it is prone to '\n' attack. You can see the security considerations of G

[PHP-DEV] Security risk how to use find recommended in php.ini-*

2012-02-08 Thread Ondřej Surý
This is very wrong to recommend: ; NOTE: If you are using the subdirectory option for storing session files [...] ;          find /path/to/sessions -cmin +24 | xargs rm because it is prone to '\n' attack. You can see the security considerations of GNU find. Much better would be: find /path/to/s