Modify NativeFileSessionHandler to avoid open_basedir issue with default session path

[acohin]

Hit the same snag with open_basedir restrictions as described in issue #2579. The trouble is with the Symfony session file storage handler checking the existence of the session path.

This is useful when a website has its own session path, but in many distributions the default session path is shared over the entire server (e.g. /var/lib/php5 in Debian, which also has its own garbage collection implementation tied in with that).

Complementing open_basedir restrictions make sure that runtime code is unable to read session data, as it has no business there from a security perspective. Turning off open_basedir restrictions on such a path will make any session data unnecessary vulnerable to things like remote file inclusion.

Also, in such a situation it is safe to assume the session path always exists, making checking it unnecessary as usually file system permissions prohibit creating a new directory in that location anyway.

This patch modifies the Symfony NativeFileSessionHandler by adding a little exception handling, which takes care of the open_basedir restriction only when the default session path is used. When a session path is specified through config the developer is responsible for making sure that it is within restrictions.

[aembler]

Thanks!

[martinsanders]

Saved many hours of head scratching.