Solution 1 sounds good to me, we will need different cookie name too then; but that's not a bad thing in my opinion.

Here is an attempt of a fix :
https://github.com/Grapsus/LimeSurvey/commit/aedf007eb639f547c65fd4a24108e8aa38ec2804

Could you see if it fixes the problem for you too and tell me if you see any security issues with this patch ?

I set my session save path in my virtualhost.

And save path MUST be inaccessible by http, if we use ls directory : it's accessible by http (and .htaccess can not allways block).

Then :
if(Yii::app()->getConfig('sessiondir') and is_writable(Yii::app()->getConfig('sessiondir'))
only ...
( and explain why sessiondir MUST NOT BE in limesurvey path).
And it's not a LS bug, it's a server misconfiguration.

PS:
I think leave it by default is the good way : the server admin can set session.savepath if needed)

After talking to the LS team, here is what was decided for this issue :

• do not attempt to change save_path in LS, it's way too troublesome
• only display and use Session lifetime setting when using a DB session, in which case each session has its own expiration time
• for regular file-based sessions it's up to the server admin to set appropriate PHP ini values

Here is the new fix code :
https://github.com/Grapsus/LimeSurvey/commit/7cc1842c30bad2b479b6bd46e98b6a6b3ef87ea9

Looks good, please don't forget to update the documentation, too.

Fix committed to 2.05 branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=13485

I don't agree with differing behavior based on the database backend though.

In my opinion we should change the session save path to the runtime directory.

Which by default is better protected than /tmp anyway.

That way we can have 2 folders for sessions: 1 for admin and 1 for survey.

Please do not "resolve" this issue but instead confirm and set goal to 2.05+ so we can do a proper fix then. (For now your solution looks ok)

sammousa : the danger is to set a session_save_path inside limesurvey directory. It's a real security issue.
I think session_save_path must be managed by server admin and not limesurvey admin.

PS:
Maybe in config.php only, but not in LS admin web.

There won't be any changes to session_save_path - it is a really bad idea to give anyone control over that except for the server admin - as it can be a huge security issue (as it has been repeatedly pointed out). I would also not know of any web application seriously changing that.

Hi,

http://phpsec.org/projects/phpsecinfo/tests/save_path.html

In a linux web server all files in /tmp have the sticky bit : http://en.wikipedia.org/wiki/Sticky_bit the no probem to leave SESSION here

2.00+ Build 131122 released