#13843 [Com]: add the execv functionality to PHP

ID: 13843 Comment by: cira at mercenarylabs dot com Reported By: a dot genkin at toronto dot edu Status: Open Bug Type: Feature/Change Request Operating System: Unix PHP Version: 4.0.6 New Comment: After much configuration, I was able to write a dynamic shell script containing shell redirection symbols, and then run the script using exec(), system(), or passthru(). It's not the best solution, but if you wish to run more complex calls to the system in safe mode, dump the commands to a file and then use PHP to exec that file. -Samantha Previous Comments: ------------------------------------------------------------------------ [2002-01-24 04:52:30] derick@php.net The space is usually not a problem, but a ; is. However execv is a nice idea, making this into a feature request. Derick ------------------------------------------------------------------------ [2002-01-24 04:44:57] veins at skreel dot org I understand that pipes and redirections could break the point of using safe_mode but, what I can't understand, is how a space in an argument can make the system vulnerable... ------------------------------------------------------------------------ [2001-10-29 16:27:41] a dot genkin at toronto dot edu Rats! I meant to say "to standard out" in the last sentence. ------------------------------------------------------------------------ [2001-10-29 16:23:58] a dot genkin at toronto dot edu Rasmus, what you are saying about shell redirection being a threat under safe mode makes sesnse. But how about being able to pass parameters with spaces in them? I cannot see any security implication in that... In any case, I want to be able to read standard error from the command I'm executing... How about providing a PHP variant of C's execv() in PHP, so that I could pass it an array of parameters? And, perhaps, add a flag to existing program execution functions to duplicate standard error to standard in. ------------------------------------------------------------------------ [2001-10-29 16:14:34] a dot genkin at toronto dot edu I forgot to add that it appears that this bug is not Solaris-specific, but, rather, safe mode specific. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/13843 -- Edit this bug report at http://bugs.php.net/?id=13843&edit=1