#48345 [NEW]: system() funciotn docs: how to prevent cmd.exe

From: giosp at panozzo dot it Operating system: Windows 2003 PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: system() funciotn docs: how to prevent cmd.exe Description: ------------ In the documentation of system(), exec(), shell_exec(), popen(), passthru() and other external proces execution function there should be the following notes: 1. All these functions does not execute the requested process directly: they execute a shell (cmd.exe ? bash ? which criteria is used ? %COMSPEC% in windows ?). 2. Executing the standard CMD.EXE in windows is not possible when running as a non administrator user, so these function will fail in a standard IIS environment, where the current PHP script is executed as ISUR_MACHINENAME 3. The only secure way to execute a process in windows bypassing cmd.exe, is to use the proc_open() function with the option "bypass_shell" Reproduce code: --------------- --- From manual page: function.system --- <?php passthru("ping www.hp.com"); ?> Expected result: ---------------- A typical ping output Actual result: -------------- Warning: passthru() [function.passthru]: Unable to fork [ping www.hp.com] in C:\Inetpub\wwwroot\prova.php on line 2 -- Edit bug report at http://bugs.php.net/?id=48345&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=48345&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=48345&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=48345&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=48345&r=fixedcvs Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=48345&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=48345&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=48345&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=48345&r=needscript Try newer version: http://bugs.php.net/fix.php?id=48345&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=48345&r=support Expected behavior: http://bugs.php.net/fix.php?id=48345&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=48345&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=48345&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=48345&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=48345&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=48345&r=dst IIS Stability: http://bugs.php.net/fix.php?id=48345&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=48345&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=48345&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=48345&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=48345&r=mysqlcfg