PmWiki | Cookbook / FixShortSessions

Summary: How to fix short sessions so you aren't prompted frequently for a password

Version:

Prerequisites:

Status:

Maintainer:

Categories: Administration, Security Passwords

Problem

After spending a long time editing long pages, on saving the changes you may be prompted for a read password.

Solution

If you control the php implementation, try increasing the session.gc_maxlifetime from the default of 1440 (24 minutes) to something larger than the time you expect to spend on any page (an intermediary save button might also help reduce that time)

You could perform this from the vhost configuration with this command
php_value session.gc_maxlifetime 14000 (10 times more than default)

However, if you have your wiki on a shared server, other people may hijack/purge your sessions, so you'd have to provide a directory for holding the sessions. Create a directory under your wiki area (e.g. pub/sess/), chmod 777 pub/sess, then put this in config.php:

     session_save_path("$FarmD/pub/sess"); // (#)

Then copy the .httpauth from wiki.d to pub/sess.

(For more detail, check php docs for Session handling functions)

Notes and Comments

I did it, but got

Fatal error: Call to undefined function: save_path() in /home/yuycom/public_html/local/config.php on line 41

There was a syntax error in the previous version of this page; it should be "session_save_path" and not "session.save_path". Now fixed above. --Pm

Sorry, Pm, when I wrote that I didn't know most anything about the variables pmwiki uses :). -Radu ?

Changing the pub/sess directory to 770 permissions won't work in many PHP environments, as the webserver won't have write access to the directory. Also, SCRIPT_FILENAME isn't reliable for some environments. Better might be to set session.save_path to "$FarmD/pub/sess". --Pm

(#) And actually, now that I think about it, putting the directory in pub/ is not a good idea either. This would make visible the passwords (and possibly other details) that people are using to access the site. It should go in a directory outside of the web hierarchy, or be protected by .htaccess or something similar. --Pm

Does this work with v2.0? How about AuthUser? I don't have a .httpauth file to copy..... -- joe

FixShortSessions

Problem

Solution

Notes and Comments

See Also

Contributors