note 114488 added to function.exec
| From: | sgbeal at googlemail dot com | Date: | Wed, 26 Feb 2014 11:43:15 +0000 |
| Subject: | note 114488 added to function.exec | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-198730@lists.php.net to get a copy of this message | ||
Side-note: regarding the API comment "For practical reasons, it is currently not allowed to
have .. components in the path to the executable."
It is still possible to pass the shell as the first command and a relative path to the script as the
second, so this limitation/security mechanism is not much of one. "sh" can be used to run
non-scripts with relative paths via something like this:
$out = null;
$rc= 0;
exec('sh -c "exec /bin/../bin/ls"', $out, $rc);
print_r( $out);
echo 'rc = '.$rc."\n";
effectively bypassing any "security" gained by the ".." limitation.
----
Server IP: 87.106.1.137
Probable Submitter: 88.217.154.36
----
Manual Page -- http://php.net/manual/en/function.exec.php
Edit -- https://master.php.net/note/edit/114488
Del: integrated -- https://master.php.net/note/delete/114488/integrated
Del: useless -- https://master.php.net/note/delete/114488/useless
Del: bad code -- https://master.php.net/note/delete/114488/bad+code
Del: spam -- https://master.php.net/note/delete/114488/spam
Del: non-english -- https://master.php.net/note/delete/114488/non-english
Del: in docs -- https://master.php.net/note/delete/114488/in+docs
Del: other reasons-- https://master.php.net/note/delete/114488
Reject -- https://master.php.net/note/reject/114488
Search -- https://master.php.net/manage/user-notes.php