note 114488 deleted from function.exec by cmb

From: Date: Sun, 22 Sep 2019 07:21:46 +0000
Subject: note 114488 deleted from function.exec by cmb
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-212278@lists.php.net to get a copy of this message
Note Submitter: sgbeal at googlemail dot com ---- Side-note: regarding the API comment "For practical reasons, it is currently not allowed to have .. components in the path to the executable." It is still possible to pass the shell as the first command and a relative path to the script as the second, so this limitation/security mechanism is not much of one. "sh" can be used to run non-scripts with relative paths via something like this: $out = null; $rc= 0; exec('sh -c "exec /bin/../bin/ls"', $out, $rc); print_r( $out); echo 'rc = '.$rc."\n"; effectively bypassing any "security" gained by the ".." limitation.

« previous php.notes (#212278) next »