I have a little script that I'm trying to run but it dies at exec()
<pre><?php
ini_set("display_errors", 1);
$command = "wget --save-cookies cookies.txt \
--post-data '***' \
--keep-session-cookies \
http://site.com/ac_login.php;
wget --load-cookies cookies.txt \
--keep-session-cookies \
-p http://site.com/ac_landing.php;";
exec($command, $output) or die('fail');
foreach ($output as $num => $line) {
echo $num + 1 . ": " . $line . "\n";
}
?></pre>
If I remove the \ at the end of each line I get a response of
1: wget: missing URL
2: Usage: wget [OPTION]... [URL]...
3:
4: Try `wget --help' for more options.
5: wget: missing URL
6: Usage: wget [OPTION]... [URL]...
7:
8: Try `wget --help' for more options.
I tried moving all the commands to one line but then it dies again. What am I doing wrong? How can I retrieve the error in this script? Adding in a 3rd param for result in exec returns empty.
I'm using this for reference https://stackoverflow.com/a/1432161/763468
The commands work in an SSH console.
First off, I don't think you need that semi-colon after the file name
-p http://site.com/ac_landing.php;
to
-p http://site.com/ac_landing.php
Did you try one command per exec call?
exec("wget --save-cookies cookies.txt --post-data '***' --keep-session-cookies http://site.com/ac_login.php");
exec("wget --load-cookies cookies.txt --keep-session-cookies -p http://site.com/ac_landing.php");
Related
I have a php script that creates a shell script file that finally executes as the www-data user, all of the commands are executed except for the last one which implies a binary file. If I run the command as root, it runs ok...
This is the last part of the script:
&& echo "Tokenizing the file........" >> Logs/table_of_contents.php \
&& perl ../common/Scripts/xmltokenize.pl --filename=xmlfiles/table_of_contents.xml >> Logs/table_of_contents.php \
&& perl ../common/Scripts/xmlrenumber.pl --filename=xmlfiles/table_of_contents.xml >> Logs/table_of_contents.php \
&& echo "Tagging the file........" >> Logs/table_of_contents.php \
# I have added this line to check if it helps but id doesn't
&& export HOME="/tmp/" \
# And this is the command that calls the binary file
&& perl tagfile.pl xmlfiles/table_of_contents.xml \
Here you have the content of the tagfile.pl
use File::Find;
$\ = "\n";
$fn = shift;
if ( $fn =~ /([^\/\.]+)\.xml/ ) { $fileid = $1; } else { exit;};
print $fileid;
$cmd = "perl tagfl2/makevrt.pl 'xmlfiles/$fileid.xml' > 'tagtmp/$fileid.vrt'";
print $cmd;
print `$cmd`;
#ALL OF THE PREVIOUS WORKS
#THIS IS THE ONE THAT GIVES PERMISSION ERRORS
# OF COURSE: "www-data:www-data tagtmp/" and "www-data:www-data $fileid.vrt = table_of_contents.vrt"
$cmd = "cut -f 1 tagtmp/'$fileid.vrt' | tagfl2/treetagger/bin/tree-tagger -no-unknown -token -lemma tagfl2/treetagger/lib/english.par > 'tagtmp/$fileid.tagged'";
print $cmd;
`$cmd`;
$cmd = "perl tagfl2/mrg.pl 'tagtmp/$fileid.vrt' 'tagtmp/$fileid.tagged' > 'tagtmp/$fileid.mrg'";
print $cmd;
`$cmd`;
$cmd = "perl tagfl2/tagxml.pl 'tagtmp/$fileid.mrg' 'xmlfiles/$fileid.xml'";
print $cmd;
`$cmd`;
Here is the error:
sh: 1: tagfl2/treetagger/bin/tree-tagger: Permission denied
Also, just in case:
chown -R www-data:www-data tagfl2/
chmod -R g+rwx tagfl2/
Try to define a full path to the script
$cmd = "perl /[full_path]/makevrt.pl 'xmlfiles/$fileid.xml' > 'tagtmp/$fileid.vrt'";
Why did you update user ownership?
Changing the group ownership should have been enough:
chgrp -R www-data tagfl2/
chmod -R g+rwX tagfl2/
And change the lowercase x by a greater one, to give access/execution permission, only if it is already the case for the user owner (no need to give otherwise).
You may then check the permission like this:
su -m -c 'ls -R tagfl2/' www-data
And see if you reproduce access issue; and then update permission accordingly.
Ok, all solved, one thing was giving the file system, actually the mounted unit, the exec attribution.
The second thing was moving treetagger directory to /usr/local/
Then, at /usr/local/bin/ I have created a soft link this way:
ln -s ../treetagger/bin/tree-tagger
Making the binary file globally executable. Actually, this last step was the ultimate solution.
Then at the tagfile.pl perl script, the line containing the tree-tagger command, I have changed it this way:
cut -f 1 'tagtmp/$fileid.vrt' | /usr/local/bin/tree-tagger -no-unknown -token -lemma tagfl2/treetagger/lib/english.par > 'tagtmp/$fileid.tagged'
im trying to purge single url on cloudflare ,
this is my bash script
#!/bin/bash
if [ -z "$1" ]; then
echo "Usage: $0 http://your.domain.com/url"
exit 0
fi
#get this from Account section in Cloudflare
TOKEN="SECRETTOKEN"
EMAIL="EMAIL"
DOMAIN="DOMAIN"
curl -s https://www.cloudflare.com/api_json.html \
-d "a=zone_file_purge" \
-d "tkn=$TOKEN" \
-d "email=$EMAIL" \
-d "z=$DOMAIN" \
-d "url=$1" >> test.log #output to check if this script work
and my php script
<?php
$domain = parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST);
$actual_link = $_SERVER[HTTP_REFERER];
exec("/bin/bash /path/to/bkl.sh $actual_link");
echo "Success";
header('Refresh: 5; URL=' . $_SERVER['HTTP_REFERER']);
?>
method : i put a button on my website , so when user click on that button it will execute bash script on the server and purge the post url on cloudflare , and after that visitor will be redirect back to the post.
when i manually test bash script in my ssh it work perfectly and the test.log has result "SUCCESS"
but when i run php script on my website the test.log does not generate any output which mean its fail.
thank you hope someone can give me a better solution.
I am doing the conversion from youtube link to gif image ,but i faced some problem while executing exce() function.
echo $ret = exec("youtube-to-gif -u https://www.youtube.com/watch?v={$vidID} -b $start_second -d $different_second -s 480x? -o {$filePath}{$fileName} -f 10", $out, $err);
I am using exec() ,but its not returning any value .Here i am not getting why it is not working.
Thanks ,any suggestion will highly appreciate.
First, store your command in a variable and try echoing it and runnining in a terminal to see if it's valid at all:
$command = "youtube-to-gif -u https://www.youtube.com/watch?v={$vidID} -b $start_second -d $different_second -s 480x? -o {$filePath}{$fileName} -f 10";
echo $command . PHP_EOL;
echo $ret = exec($command, $out, $err) . PHP_EOL;
If it works fine when you run it manually, try full path to youtube-to-gif. Assuming you are running php on Linux, you should be able to do it with this command:
which youtube-to-gif
Now replace youtube-to-gif with the full path in $command.
The idea is that when wget is running and downloading something, I can just add another URL that will be downloaded once the current download is finished. I only want to download 1 file at a time. I wrote this script
#!/bin/bash
test=/tmp/wget-download-link.txt
echo -n "$test" | while IFS= read -N 1 a; do
wget -o /tmp/wget.log -P /mnt/usb -i /tmp/wget-download-link.txt
if [[ "$a" == $'\n' ]] ; then
wget -nc -o /tmp/wget.log -P /mnt/usb -i /tmp/wget-download-link.txt
fi
#printf "$a"
echo download finished
done
The script will check for any new lines that consist of URLs, if there's any, it will rerun wget again, the problem is that this script will just keep looping, wget will download the same file continuously and just rename them if it already exists. How do I make wget re-run if there's any new URLs in the wget-download-link.txt file but stop it when the file already exists?
#msturdy I run your script but wget redownload and rename files that already exist, my script:
#!/bin/bash
test=/tmp/wget-download-link.txt
l=$(wc -l $test)
tail -n $l -f $test | while read url; do
wget -o /tmp/wget.log -P /mnt/usb -i /tmp/wget-download-link.txt
done
my wget-download-link.txt file:
http://media2.giga.de/2014/11/angel-beats-kanade.jpg
http://juanestebanrojas.com/wp-content/uploads/2014/06/angel-beats-wallpapers-4.jpg
http://images5.fanpop.com/image/photos/30100000/Angel-Beats-new-life-angel-beats-30142329-2560-909.jpg
http://kristenhazelkannon.files.wordpress.com/2013/06/angelbeats2.jpg
Downloaded files:
angel-beats-wallpapers-4.jpg
angel-beats-wallpapers-4.jpg.1
Angel-Beats-new-life-angel-beats-30142329-2560-909.jpg.1
Angel-Beats-new-life-angel-beats-30142329-2560-909.jpg
angel-beats-kanade.jpg.2
angel-beats-kanade.jpg.1
angel-beats-kanade.jpg
angelbeats2.jpg
the script keeps running, and will just rename files to .1 .2 .3 etc.
SOLVED WITH THIS
while [ true ] ; do
urlfile=$( ls /root/wget/wget-download-link.txt | head -n 1 )
dir=$( cat /root/wget/wget-dir.txt )
if [ "$urlfile" = "" ] ; then
sleep 180
continue
fi
url=$( head -n 1 $urlfile )
if [ "$url" = "" ] ; then
mv $urlfile $urlfile.invalid
continue
fi
mv $urlfile $urlfile.busy
wget $url -P $dir -o /www/wget.log -c -t 100 -nc
mv $urlfile.busy $urlfile.done
done
Occasionally, I use exec(), shell_exec(), and curl_exec(). Below are typical uses. Assume that where ever I have a PHP variable in them (i.e. $html in the first one), there is a chance that the user has the ability to modify its content.
What should I be concerned about from a security vulnerability perspective? Is escapeshellcmd() and escapeshellarg() the answer, and if so where should it be used?
$cmd='echo "html + '.$html.'" | htmldoc --format pdf > '.$filename;
$cmd='/usr/bin/convert '.$docs.' '.$filename;
$cmd='HOME='.$dir.'; /usr/bin/libreoffice3.5 --headless -convert-to pdf --outdir '.$dir.' '.$file_org;
$cmd='wget -O '.$file_org.' "'.$url.'"';
$cmd='/opt/wkhtmltopdf/bin/wkhtmltopdf "'.$url.'" '.$paramaters;
$cmd='/usr/bin/php -q '.$worker.' '.$session_id.' >/dev/null &';
exec($cmd);
$cmd='sendfax -n -m -w -i '.$id.' -o JohnDoe -D -S "hello#gmail.net" -s "us-leg" -f "'.$from.'" -d "'.$to.'" '.$doc_list;
$cmd = "faxstat -s | grep \"^$jid \"";
$output = shell_exec($cmd);
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_USERAGENT, $_GET['user_agent'] ? $_GET['user_agent'] : $_SERVER['HTTP_USER_AGENT'] );
curl_setopt($ch,CURLOPT_POSTFIELDS,array('aaa'=>$aaa,'bbb'=>$bbb));
$result = curl_exec($ch);
If you don’t validate and/or escape the input values properly, anyone can execute arbitrary commands on your system in behalf of the user that runs PHP.
For command arguments, there is escapeshellarg. Make sure you escape the whole argument value, e.g.:
$cmd='echo '.escapeshellarg('html + '.$html).' | htmldoc --format pdf > '.escapeshellarg($filename);
$cmd='/usr/bin/convert '.escapeshellarg($docs).' '.escapeshellarg($filename);
// […]
$cmd='sendfax -n -m -w -i '.escapeshellarg($id).' -o JohnDoe -D -S "hello#gmail.net" -s "us-leg" -f '.escapeshellarg($from).' -d '.escapeshellarg($to).' '.escapeshellarg($doc_list);