Session Permissions

[aanbar]

I am not reporting this as a bug, I was messing with apache configurations & disabled suphp which created a session with the apache user information, after re-enabling suphp which switched to my userid I've got these errors from session files driver.

This one is normal:

Severity: Warning
Message: fopen(/var/lib/php5/ci_session1df5c5147c908bc476d886e8cb106942ac5022a4): failed to open stream: Permission denied
Filename: drivers/Session_files_driver.php
Line Number: 162

but these, should be handled differently as on line 162 we are returning boolean, but it's never checked afterwards, which causes the following errors to appear:

Severity: Warning
Message: rewind() expects parameter 1 to be resource, boolean given
Filename: drivers/Session_files_driver.php
Line Number: 188

Severity: Warning
Message: fread() expects parameter 1 to be resource, boolean given
Filename: drivers/Session_files_driver.php
Line Number: 194

This requires some checking so only the relevant warning appear (which is the permission denied one).

[narfbg]

If you're not reporting this as a bug ... what is it? What are you suggesting?

[aanbar]

I am expecting 1 warning only from this, which is the permission denied; it shouldn't try to re-wind a file it cannot access nor fread it.

A boolean is returned, and it's being used as a resource.

[narfbg]

I got that from the initial description, but it doesn't answer my question ...

[narfbg]

Nevermind my previous comments ... it looks like a bug to me and you said you're not reporting it as such, so I wanted to know what are you reporting it as, but that's a moot point.

I'm more interested in how you managed to trigger these warnings. read() shouldn't be called more than once unless you've executed session_reset() and so you shouldn't be getting the one on line 188 ...

[aanbar]

I am not calling anything manually, I'm just autoloading the library, maybe when you're trying to read session data it calls read again ignoring the fact that it doesn't have permission in which case the _file_handle is already set to FALSE which results in having the other 2 errors.

The session file was already created using different uid/gid & had data when I switched back to suphp to have it use my uid/gid.

[narfbg]

Well, that doesn't sound logical (there's no reason for repeated read() calls other than session_reset()), but I'll have to do some low-level testing either way ...

[narfbg]

That should do it ... Although, another PHP bug is actually the cause for read() even being executed.

PHP 7 finally fixes it: https://wiki.php.net/rfc/session.user.return-value
I'll work on that later.