How are default values determined
session.save_path
For session.save_path
, the php.ini defined value is used by default, otherwise the path is determined here:
https://github.com/php/php-src/blob/master/ext/session/mod_files.c#L264
That calls php_get_temporary_directory
which is defined here:
https://github.com/php/php-src/blob/master/main/php_open_temporary_file.c#L192
soap.wsdl_cache_dir
soap.wsdl_cache_dir
attempts to use the defined php.ini value. If it isn't found it will default to /tmp
via this code:
https://github.com/php/php-src/blob/master/ext/soap/soap.c#L520
Read more about STD_PHP_INI_ENTRY
here: http://docstore.mik.ua/orelly/webprog/php/ch14_12.htm
upload_tmp_dir
upload_tmp_dir
is set to NULL (but will use a php.ini override), along with many default values, in:
https://github.com/php/php-src/blob/master/main/main.c#L579
STD_PHP_INI_ENTRY("upload_tmp_dir", NULL, PHP_INI_SYSTEM, OnUpdateStringUnempty, upload_tmp_dir, php_core_globals, core_globals)
and used in file upload here:
https://github.com/php/php-src/blob/master/main/rfc1867.c#L1006
fd = php_open_temporary_fd_ex(PG(upload_tmp_dir), "php", &temp_filename, 1 TSRMLS_CC);
This function, if an empty upload_tmp_dir
is passed, defaults to using the php_get_temporary_directory
function we mentioned earlier.
Also are their any other php.ini variables that involve paths on the file system that you are aware of?
There are plenty. A quick look through https://github.com/php/php-src/blob/master/main/main.c shows plenty of default configs that use paths (open_basedir
, include_path
, sys_temp_dir
, extension_dir
and error_log
to name just a few). In addition, extensions have their own collection of configurations that could include path parameters.
Based on my investigation on windows it seems session.save_path is C:\Windows\Temp. Is this a safe location? When does this get deleted?
When openning temporary files on Windows, PHP sets the permission to be exclusive to the user running your webserver, which should mean only it, and administrators, would be able to access the contents of the file:
https://github.com/php/php-src/blob/master/main/php_open_temporary_file.c#L149