#46399 [Fbk->Opn]: cgi 'leaks' shell_exec output to webserver

ID: 46399 User updated by: stefan at konink dot de Reported By: stefan at konink dot de -Status: Feedback +Status: Open Bug Type: CGI related Operating System: Linux 2.6.27 PHP Version: 5.2.6 New Comment: Warning: file_put_contents(php://stderr) [function.file-put-contents]: failed to open stream: Bad file descriptor in /opt/cherokee/var/www/bugs.php on line 2 php stdout The author of the webserver has asked me to also file a bug there. Previous Comments: ------------------------------------------------------------------------ [2008-10-27 10:16:56] lbarnaud@php.net Could you please try the following and report what happens ? <?php file_put_contents("php://stderr", "php stderr\n"); echo "php stdout\n"; ?> ------------------------------------------------------------------------ [2008-10-27 01:17:47] stefan at konink dot de Description: ------------ When a php-cgi issues an shell_exec that outputs code that is expected to be stored in the variable before it. The output is in fact leaked back over the fcgi connection, which will issue a 500. I'm using the Cherokee webserver. Reproduce code: --------------- $debug = shell_exec('/usr/bin/nohup /usr/bin/inkscape -z --file='.$svgfile.' --export-width='.$width.' --export-height='.$height.' --export-png='.$pngfile); The work around seems to be to add: .' 2>&1 1>/dev/null' Expected result: ---------------- Output to be stored in $debug. Actual result: -------------- Outputted over the fcgi line: 00000000 2f75 7372 2f62 696e 2f6e 6f68 7570 3a20 /usr/bin/nohup:. handler_fcgi.c:83: Parsing error: unknown version ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=46399&edit=1