Description:
------------
Hello,

While developing a new security fix for a script I am working on, I found this issue corrisponding with Windows 2000 NT, which causes the sessions to not reregister a id if the ini_set redefines teh session.save_path to a relitive location.

The following code when used in the windows environment will cause the error which follows:

[CODE]<?php
  define("_PATH_TMP", "./tmp");
  ini_set('session.save_path', _PATH_TMP);
  session_start(); 
  $_SESSION['sid']['obsolete'] = session_id();
  session_regenerate_id();
  $_SESSION['sid']['replaced'] = session_id();
?>
[/CODE]

[ERROR]Warning: Unknown: open(./tmp\sess_3c0fe03c61bac80ca57a1193d3e54aa8, O_RDWR) failed: No such file or directory (2) in Unknown on line 0

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (./tmp) in Unknown on line 0
[/ERROR]

Of course I have takin the proper precautions to be sure the directory existed in the first place... of course, if I dont re-define the the session.save_path, and use the default, it gets created secessfully, like as follows:

[CODE]
<?php
  session_start(); 
  $_SESSION['sid']['obsolete'] = session_id();
  session_regenerate_id();
  $_SESSION['sid']['replaced'] = session_id();
  print_r($_SESSION);
?>
[/CODE]

Now, ill take it another step further, I tried using an exact file location when I defined the session.save_path like so:

[CODE]
<?php
  define("_PATH_TMP", "X:/dir/to/my/tmp");
  ini_set('session.save_path', _PATH_TMP);
  session_start(); 
  $_SESSION['sid']['obsolete'] = session_id();
  session_regenerate_id();
  $_SESSION['sid']['replaced'] = session_id();
  print_r($_SESSION);
?>
[/CODE]

Of course this prooved successful, except for the obvious change of my directory location to my tmp...

Now I did have a chance to try out the same script on a Linux OS with PHP and had no troubles with ./tmp as the tmp directory, so like really, wtf is the problem?