#30404 [Opn->Bgs]: wrong behaviour with escaped commands in safemode
| From: | sniper@php.net | Date: | Sun, 12 Dec 2004 00:51:54 +0000 |
| Subject: | #30404 [Opn->Bgs]: wrong behaviour with escaped commands in safemode | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-70056@lists.php.net to get a copy of this message | ||
ID: 30404
Updated by: sniper@php.net
Reported By: php-bug at angehrn dot com
-Status: Open
+Status: Bogus
Bug Type: Program Execution
Operating System: Linux
PHP Version: 4.3.9
New Comment:
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php
In safe-mode the commands passed to exec() are always escaped.
See http://www.php.net/manual/en/function.escapeshellcmd.php
for more information.
Previous Comments:
------------------------------------------------------------------------
[2004-10-23 17:49:13] php-bug at angehrn dot com
with a small shell script, you can reproduce the wrong behaviour:
Reproduce code:
---------------
test.php:
----
<?php
exec('./test_script "test 1.jpg"',$array1,$return1);
exec('./test_script test\ 1.jpg', $array2,$return2);
echo '<pre>';
echo $return1;
print_r($array1);
echo '<br /><br />';
echo $return2;
print_r($array2);
echo '</pre>';
?>
----
test_script:
----
#!/bin/sh
echo $1
echo $2
exit 0
----
Expected result:
----------------
0Array
(
[0] => test 1.jpg
[1] =>
)
0Array
(
[0] => test 1.jpg
[1] =>
)
Actual result:
--------------
0Array
(
[0] => test 1.jpg
[1] =>
)
0Array
(
[0] => test\
[1] => 1.jpg
)
------------------------------------------------------------------------
[2004-10-11 22:59:17] php-bug at angehrn dot com
Description:
------------
if safe_mode is on, i cannot use a command with backslash escaped
commands in exec()
Reproduce code:
---------------
safe_mode off
exec('convert logo: "test 1.jpg"'); - works
exec('convert logo: test\ 1.jpg'); - works
safe_mode on
exec('convert logo: "test 1.jpg"'); - works
exec('convert logo: test\ 1.jpg'); - fails
Expected result:
----------------
it should work like the command with safemode off
Actual result:
--------------
it fails...
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=30404&edit=1