Redmine

This is an interesting find, John. I thought Rails was supposed to store sessions in RAILS_ROOT/tmp/sessions.

Looking at my files system, I have a small number of sessions in the RAILS_ROOT/tmp/sessions directory but a TON (24k+) in my /tmp directory. I do have other apps in addition to Redmine on this box, but it is still interesting why so many files would be in the /tmp directory.

I took the advice of this wiki article and just deleted any old session files from the /tmp directory via:

find /tmp/ -name "ruby_sess*" -cmin +600 -exec rm {} \;

http://wiki.rubyonrails.org/rails/pages/TipsAndTricks

John, did you make sure that the directory RAILS_ROOT/tmp/sessions exists? Otherwise the sessions will be stored in /tmp.

You can cleanup the session directory with a cron job using a command like the one Jim proposed.

With Rails 2.0 you can also use a cookie based session store. You just have to add

config.action_controller.session = { 
  :session_key => 'redmine_session', 
  :secret      => 'nrAgejEZ6QYzGpsMuUA4STX6kJtFjF15' 
}

0.7 will be packaged with Rails 2.0 and with session store set to cookie store by default.

How can I specify my tmp directory as something other than RAILS_ROOT/tmp? (I take it RAILS_ROOT is the root directory of the Redmine install?)

I don't want my Rails directory to be owned and writable by the web server UID for security reasons, so I'm guessing the reason it isn't using storage there is because of that.

Same question for the files directory too, BTW.

Incidentally, I am running trunk and Rails 2.0, so are you saying I shouldn't be seeing this?

I guess you have to make at least the files, log and tmp/* directories writable for the web server UID. I don't see any security issues with it.

Regarding the session store, trunk still uses the file based cookie store.

I use a version control system (git) to track the application install directory. Yes, I suppose I could add those directories to an ignore pattern, but it's cleaner to put the data somewhere else.

Is that stuff really not configurable? That seems like a fairly basic thing. I figured out how to point log elsewhere, but can't figure that out for files and tmp.

Did this actually happen in 0.7 - the sessions set to cookies?

Any news on that?

Cookie store doesn't seem to be the default in 7-stable or even trunk. I have edited my environment.rb file to use cookie sessions. It works fine. There might be issues if Redmine tries to store to much information within the session.

I've been impressed at the very large number of cookies that I've got laying around my temporary directory, tens of thousands!

As it turns out, cookie store isn't default in .80 either. I do not see a ticket for it, so I'm guessing that it isn't going to be added unless there is one, so I created issue #2628 to track the issue.