Re: PHP session management

["Gavin Zuchlinski" <gzuchlinski () pgsit org>]

Sorry to post again, but my last idea was just too complex.

> This isn't really a problem to bypass. If someones got local access,
> it's likely they will have access to some sort of webfolder, wether that
> be a virtualhost, or homedirs(www.foo.com/~username), you can easily
> access the information stored in the session with a script like this:

I think that hashing the session ID in the filename will solve our problems
here. After hashing an attacker wouldnt be able to hijack the session, and
with good file opening restrictions an attacker couldnt open the session
files manually.

-Gavin
http://libox.net/