Re: findfile?

From: William Ahern (william_at_wilbur.25thandClement.com)
Date: 03/16/04 

Date: Mon, 15 Mar 2004 21:10:52 -0800

Sashi <sashi@bez.spamu.o2.pl> wrote:
> Ruby Tuesday wrote:
<snip>
> but there still is the third no so secure ;) option:
> Usage: string shell_exec ( string cmd )
>
> Purpose: Execute command via shell and return complete output as string
> Availability: PHP 4
>
>
> shel_exec("find") or shell_exec("grep") or whatever you use ;) but it's
> quite OS dependant thing.

Actually, calling find(1) through shell_exec() is probably the more secure
solution. A simple link--symbolic or hard--can put a naive implementation
into an endless loop, possibly taking the web server down w/ it. Utilities
like find(1) actually memorize inodes--not files names--so they never follow
the same inode twice.

Just make sure to use escapeshellarg() or escapeshellcmd(). Or, if you want
to do it the hard way use stat() or fstat() to store the inode, and never
descend into a directory w/ the same inode twice.

I don't understand why PHP doesn't actually reflect the actual exec(2)
family of system calls. They let you pass arguments to programs directly,
w/o the trouble of an intervening shell.

- Bill

Relevant Pages

  • Re: PHP [win32] & CLI Testers needed.
    ... written, lets just say to create shell emulation for now, and have ... My previous attempts to create the source below, ended with the loop ... finally resolve any issues due to this problem in PHP compatibility. ... Debug Warning: testforLinuxUser.php line 24 - stream_select: supplied argument is not a valid stream resource ...
    (php.general)
  • Re: Scheduled emails
    ... PHP so am newer than a newbie so hope someone can help. ... loaded from another computer which you have cron job access, but in that case, ... you can have the whole php stuff on that machine instead of your web hotel. ... If you have shell access, then you can write an infinitive loop with sleep, ...
    (alt.php)
  • [Test Needed] PHP [win32] & CLI required for testing.
    ... written, lets just say to create shell emulation for now, and have ... My previous attempts to create the source below, ended with the loop ... stopping due to undefined varible, that requested for user input, the ... finally resolve any issues due to this problem in PHP compatibility. ...
    (alt.php)
  • PHP [win32] & CLI Testers needed.
    ... written, lets just say to create shell emulation for now, and have ... My previous attempts to create the source below, ended with the loop ... stopping due to undefined varible, that requested for user input, the ... finally resolve any issues due to this problem in PHP compatibility. ...
    (php.general)