Custom php.ini file in a subfolder causing $ _SESSIONS variable problems

Question

I have a subfolder with two files. The first is email.php, with a form that the user can send me by email. To prevent spam, it also has anti-spam protection and uses the $_SESSION[foo] variables. The second is upload.php, which allows registered users to upload files. Both files worked fine. Now I need to increase upload_max_filesize from the 2MB database for upload.php. My host does not provide access to the main php.ini, but it is recommended to create your own php.ini file in this subfolder. Therefore, I created:

php.ini

 upload_max_filesize = 10M ; post_max_size = 10M ; 

Now I get errors Warning: include() [function.include]: Filename cannot be empty and Warning: include() [function.include]: Failed opening '' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') when I submit the / captcha form to email.php.

 $_SESSION[foo]=$_GET[bar]; else $_SESSION[foo]="foobar.php"; include($_SESSION['foo']); 

I found that $_SESSION[foo] empty even with else . After some research, I found that when I ran phpinfo() , << 28> was no value (the original was / tmp). So now

php.ini

 upload_max_filesize = 10M ; post_max_size = 10M ; session.save_path = /home/foobar/tmp ; 

But I still get the error. If I delete the php.ini file from this folder, the script form on email.php will work fine, but I will return to upload_max_filesize = 2MB for upload.php. Any help would be appreciated.

Answer 1

This is a problem with CGI PHP settings, where php.ini server directives do not cascade into user configurations.

I talked about this in detail here - http://blog.philipbrown.id.au/2009/08/php-suexec-and-custom-php-ini-files/

---

$ _ SESSION [Foo] = $ _ GET [bar]; else $ _SESSION [foo] = "foobar.php"; include ($ _ SESSION ['Foo']);

I am a little confused by this fragment. It is not only invalid ( if , array indices are not quoted), but it is very unsafe.