note 44562 added to function.exec

taj wrote this: exec('/bin/sh -c "/bin/tar -xzf /tmp/'.$filename.' install/desc-file install/info-file install/deps-file"'); but didn't mention any security message. Unlike taj I need to use passthru instead of exec. I am used to monitor data exchange between the browser and target server through a local customed proxy server which uses passthru but ignores my args totally! A straight workaround should be : $command = '-c "mycommand myargs"';passthru($command); But it didn't work (error message: -c myargs : file or directory not found, provided myargs is not a filename or so). taj's suggestion might result in PHP cgi internals doing something like: sh /bin/sh etc..... (sh called twice, the first one is inserted by php engine itself) In normal usage, it should output : permission denied ! And it did. The shell is *not* a regular exec bin on a security-issue standpoint. Would it mean PHP gives exec much more privileges than passthru ? ---- Manual Page -- http://www.php.net/manual/en/function.exec.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+44562 Delete -- http://master.php.net/manage/user-notes.php?action=delete+44562&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+44562&report=yes Search -- http://master.php.net/manage/user-notes.php