Dear Maintainer,

/var/lib/phpmyadmin/tmp/ is created by the installer, php session files are created in there and never cleaned up.

It would be best to have a cronjob cleaning up old session files, like it is done in roundcubemail:
https://salsa.debian.org/roundcube-team/roundcube/-/blob/debian/bullseye/debian/roundcube-core.cron.daily

Best regards
Florian Müller

Hi,

Are you really sure this files are php sessions?

This request raises doubts for me, I will need to check too.

They are twig cache files for sure, but yes they could be cleaned up before each upgrade.

Hi!
Thanks for maintaining phpmyadmin and your fast response!
Yes, for us there are php session files in there.

PHP ships a session cleaner that uses the session.save_path from /etc/php/$
{version}/${conf_dir}/php.ini. Normally the save_path does point to /var/lib/
php/sessions.

I think you are right and the default installation of phpmyadmin stores
session data in /var/lib/php/sessions and everything is fine.
But as we hardened our server, we setup an own php-fpm pool for phpmyadmin and
changed the save_path to /var/lib/phpmyadmin/tmp. It seems like that it is our
own created problem and we do need scripting on our end to clean these files ;)
Yes we see those too and these should be cleaned up.

At least this part of the bug report is actually valid  ;)

Best Regards
Florian

Hello Florian !
tmp directory of phpMyAdmin.
- It could get wiped out at any time
- Some phpMyAdmin code can access it and leak sessions

This will get better with phpMyAdmin 6.0, see:
https://bugs.debian.org/bug=583588
Most probably I will try to process this bug report while packaging
phpMyAdmin 6.0.

But be sure the directory is not in open_basedir for security reasons
that will be better.

Indeed