[PHP-DEV] Security risk how to use find recommended in php.ini-*

This is very wrong to recommend: ; NOTE: If you are using the subdirectory option for storing session files [...] ;          find /path/to/sessions -cmin +24 | xargs rm because it is prone to '\n' attack. You can see the security considerations of GNU find. Much better would be: find

Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

On 02/08/2012 03:35 PM, Ondřej Surý wrote: This is very wrong to recommend: ; NOTE: If you are using the subdirectory option for storing session files [...] ; find /path/to/sessions -cmin +24 | xargs rm because it is prone to '\n' attack. You can see the security considerations of

Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

Am 09.02.2012 00:35, schrieb Ondřej Surý: Much better would be: find /path/to/sessions -cmin +24 -delete or at least find /path/to/sessions -cmin +24 -execdir rm {} \; (GNU find) The most error-prone way is something we cooked up in Debian: find /var/lib/php5/ -depth -mindepth 1

Re: [PHP-DEV] Security risk how to use find recommended in php.ini-*

On Thu, Feb 9, 2012 at 00:40, Christopher Jones christopher.jo...@oracle.com wrote: Can you log a bug for this at https://bugs.php.net/ ? Done: https://bugs.php.net/bug.php?id=61020 On Thu, Feb 9, 2012 at 00:43, Reindl Harald h.rei...@thelounge.net wrote: the main question is why here cmin is