From: Eric Hodel <drbrain@...7.net>
Date: 2007-11-17T16:18:42+09:00
Subject: Re: [PATCH] CGI::Session::PStore partitioned directories

On Nov 16, 2007, at 04:22 , Maurice Aubrey wrote:
> Tanaka Akira wrote:
>> In article <473D827F.10909@gmail.com>,
>>   Maurice Aubrey <maurice.aubrey@gmail.com> writes:
>>> @@ -56,6 +58,7 @@
>>>             unless session.new_session
>>>               raise CGI::Session::NoSession, "uninitialized session"
>>>             end
>>> +          FileUtils.mkdir_p dir unless File.exist? dir
>>>            @hash = {}
>>>          end
>>>          @p = ::PStore.new(path)
>> What's happen if someone creates a symlink from /tmp/0 to
>> your home directory?
>
> What's a safe approach?

You'd need to securely create a directory in /tmp to hold your  
sessions.  I think something like:

session_dir = File.join(Dir.tmpdir, 'RUBY-CGI-SESSIONS')
File.mkdir_p session_dir, :mode => 0700

--
Poor workers blame their tools. Good workers build better tools. The
best workers get their tools to do the work for them. -- Syndicate Wars