I have access to a shared web host.
The website installed there uses exec(). About 4 months ago the function was enabled, but now they have put it on the disable_functions list. They put exec, passthru and shell_exec on that list but they forgot to put system:) This makes me think that the server admin is not very aware on what he's doing. Anyway, they now say that those functions should have never be enabled and they wont re-enable them.
The installed website uses exec() to start some php scripts that would do some background work. Right now i'm looking to see if there is any other "legal" way to start those php scripts in background(i expect system() to work, but maybe they will disable it in the future also).
And now my simple question:
In the perdefined file structure i see a cgi-bin folder. Whats its use? From what i read on the web it is used to generate "dynamic" pages when accessed through the browser, but the server has php anyway installed, so i dont see its use.
/cgi-bin/ is a directory where CGI script should be placed.
You can work around restrictions on exec in PHP by using CGI.
Create a file named somefile.sh with contents:
#!/bin/sh
printf "Content-Type: text/plain\n\n"
#your code here
This will only work if /bin/sh actually exists, and is executable (if you're not in a chroot without /bin/sh for example)
There are enough ways to get a command executed. If they disable CGI, you can continue with SSI.
Related
I had developped a shell script and I wanted to create an UI with it. I decided to use a web interface with a local server because I have few knowledges in HTML/PHP, more than QT or Java. I simply want that my html can run a shell script on my computer.
I have an Apache php server which I start in localhost with apachectl.
In /var/www/html/ I have a shell script and a test_web.php file which execute this script with exec('/var/www/html/test.sh')
In my html I have this:
<form method="POST" action="test_web.php?">
<input type="submit" value="Execute" name="exec">
</form>
If I click on Execute, it opens a new page where I see the output of echo commands from the script but it is not executed on the terminal as a standard script (like if the script is not executed on server side).
I want this script to be executed as started from the terminal.
Thank you for your help
As suggested by some commentators, you could use the Apache cgi features to be able to execute directly your test.sh file (1), but since you say you are using a Php enabled Apache server, you have an alternative and easier option with Php which you partially already tried (2). In both cases, you will need to take care of the permissions and ownership of the bash script, and its execution environment for it to produce the same results as on the command line (3).
1. CGI
CGI stands for Common Gateway Interface. It allows web servers to execute programs that are executable on the host, and interface with the web server. That is a protocol per se, and CGI can be used not only to execute programs, but also for creating dynamic sites. You could program a dynamic website in any language, provided the executable is programmed to receive data via stdin from the server and interpret the headers, decode any contents properly, and that the program can return proper dynamic data to the server via stdout, with proper headers, Content-type, etc.
There are libraries for helping in this task for many languages (for C, Perl has a CGI module in is Core Modules, etc., and even for Bash).
On Linux, to use CGI with Apache 2, you would need to make sure that your Apache configuration loads the required module for supporting it, and select the directory where your web server will be allowed to execute the programs:
# uncomment or add the directive for the module
LoadModule cgid_module modules/mod_cgid.so
# one way to allow the server to execute cgi programs is to
# set a ScriptAlias directive to a directory dedicated to CGI programs
ScriptAlias "/cgi-bin/" "/var/www/html/cgi-bin/"
You put your test.sh script in /var/www/html/cgi-bin/, and browser can be pointed to http://localhost/cgi-bin/test.sh to directly execute the script. There are other configurations possible, see this Apache CGI tuturial.
If you need to execute the Bash program and want your CGI to send anything to the browser, the first echo sent by the Bash script shall be the following output:
Content-type: text/html
followed by whatever dynamic html you want to produce.
2. Php
Really all these complications may not be necessary since you say you use a Php enabled Apache server, and since you probably do not want the Bash script to send html directly to the browser.
In that case, the shell_exec() command or backticks operator, will allow you to run your Bash script and obtain its output in a Php variable, and do whatever you want to do with it in Php.
You say you have tried using the exec command, which should work also, except that you get a status code in response, and not the program output.
If your execution command does not work at all, this may be because of permissions, ownership or execution environment issues.
3. Permissions, ownership and execution environment
Have a look at your Apache logs for errors produced by the exec or shell_exec commands.
The script needs to have execution permissions, and needs to be readable and executable by the web server.
For instance, on Debian, Apache web server runs as a user www-data, so a script would need to be owned and executable by that user:
chown www-data:www-data test.sh
chmod u+x test.sh
You can find the location of the Apache logs and the user and group under which the web server runs in your Apache configuration file by inspecting (as root) the results of:
apachectl -S
Another possible issue is the environment in which Apache will be running the script. That environment, may or not include the same environment variables, the $PATH will be different and may not include all directories available to a "normal" user executing the same script on the console.
Again, check for errors in the logs.
The most frequent cause for failure is a Bash command not found because it is not in the $PATH of the Apache process. The quick fix is then to change the script to prefix the command with its full path.
So, for instance, if your test.sh uses a program called validjson, open your terminal as a user that can execute the script without errors, and check where it is:
$ which validjson
validjson: /usr/local/bin/validjson
and instead of calling validjson in the script assuming it is in the $PATH, call it instead with its full path /usr/local/bin/validjson reported by the which command.
If you are calling other scripts or programs, they may have the same issues, check that until you have debugged the execution of your script.
I'm trying to launch a perl script from within a PHP-based website. In that perl script, I'm using a package, that's installed on a non-standard location. So, to make all packages on that location available without launching perl as "perl -I /path/to/packages", or placing "lib /path/to/packages;" in every perl script I make, I added "/path/to/packages" to the PERL5LIB environmental system variable, and everything works fine when a regular user executes the script. However, when this perl-script is launched from the website, all environmental system variables seem to be inaccessible (tested with $ENV{"PERL5LIB"} and $ENV{"LOGNAME"} in perl, both are uninitialized), causing the perl script to crash because it can't find the required packages in #INC.
How can I make those perl packages available for launch from the website without lauching every perl script with "perl -I /path/to/packages script.pl" and without putting "lib /path/to/packages;" on top of every perl script?
There is two possible way to solve it:
If you own/access the web server, you could add variables globally.
(for apache)
http://www.perlmonks.org/?node_id=844715
<Directory /var/www/>
SetEnv PERL5LIB /your/lib/path
Another workaround that you could setup and maintain your libraries related to script then reach it from your perl script. Please check out FindBin module for this. http://www.perl.com/pub/2002/05/14/mod_perl.html
You could store your script ./bin/, and your libs at ./lib/
If you are using your libs more than one place, you could link it to ./lib/.
#!/usr/bin/perl
use FindBin ();
use lib "$FindBin::Bin../lib/";
use test;
print "test.pm => $INC{'test.pm'}\n";
You have to insure that PER5LIB is set in the environment that your web server launches from.
You'll need to consult the manual for your particular web server to find the configuration command that set environment variables, or you'll need to modify the launcher script (e.g. apachectl) an add the logic to properly set PERL5LIB.
aaaaannnd... somebody was posting examples at the same time I was posting this...
I asked the system admin for help and found out that we're not using apache (as expected) but nginx. That being said, the solution was to add the PERL5LIB definition to the /etc/nginx/fastcgi_params file like this:
sudo echo 'fastcgi_param PERL5LIB "custom/path/to/perl/modules";' >> /etc/nginx/fastcgi_params
sudo service nginx reload
Thank you #LenJaffe and #user1126070 for pointing me in the right direction!
I am sorry if this question was answered.
Why can't I run php code directly without using terminal on mac.What I mean when you double click on html file it automatically opens in the browser but not in the case of php.If I try to double click on php it opens with some text-editor.
Any help would be helpful.
Try this (for mac),
Open terminal
cd to folder
Start php server - php -S 127.0.0.1:8000
Open browser and enter - http://localhost:8000/file-name.php
I think you don't understand what PHP is ...
HTML is a markup-language, that can directly be understood by the browser. If the browser opens the file, it can do something with the content.
As PHP is a programming-language, you need a parser. This parser is your PHP executable. This program can understand PHP and does nothing more, than running the code and giving something as result. This result may be an HTML webpage, an image or whatever.
Since you said, you're using a mac, here's a quick introduction on how to set up your personal webserver:
On Mac OSX, PHP and Apache (that's what I use in this example) is already installed and pre-configured. You can just start using it like this:
Go into your system preferences and verify that Web Sharing is enabled.
Open the Finder and go to /Library/WebServer/Documents/localhost. All files that are in there are processed by the local webserver (Apache and PHP, if you want to know that). Place your file in there and open your webserver and call http://localhost/YourFile.php and it will call the file YourFile.php and show you what the output of the script is.
EDIT:
If you are using PHP for scripts, like bash-scripts, see the answer #andreas-baumgart provided.
To run PHP in MAC, one should start the built-in Apache Web server and also enable the PHP already installed.
This can be done with the following steps.
Go to /etc/apache2/httpd.conf and change the permission to sudo chmod 777 httpd.conf
Then open the above file to uncomment the line #LoadModule php5_module libexec/apache2/libphp5.so
To start the apache built-in server, use the command sudo apachectl start in the terminal.
Now .php files can be created and run from the terminal using php -f filename.php and it can also be run on a browser using http://localhost/filename.php
You cannot execute plain PHP scripts as they are no executable programs but source code. As such they contain just the receipt for an interpreter to create executable code. In order to run your PHP script you need to pass it to the PHP interpreter. In your scenario you can archive that by providing a shebang.
To run your script on double click try this:
Make the script executable using chmod +x yourscript.php
Prepending the according Shebang to the files content: #!/usr/bin/env php.
Select a PHP file in Finder, hit CMD-i and change "Open With" to "Terminal.app".
Late response, but was looking into doing this for myself, this coming up as one of the results in my searching wanted to provide 2 solutions since I ultimately came to both on my own.
Solution #1
The simple way is to go a round about way by writing a wrapper file to execute the script you're working on. Create a file with the following code:
#!/usr/bin/php
<?php
include('name-of-php-script.php');
?>
Save it as wrapper.command The name wrapper isn't important, but the command extension tells Finder that this is a shell script to open up in Terminal. The file itself just executes whatever php script is in the include.
Solution #2
The specific inquiry requires a bit of work.
First make sure that the 1st line of the php script is:
#!/usr/bin/php
This is where the preinstalled version of PHP is installed on Mac OS X. You can always verify by running this command in terminal:
whereis php
Once you've added the Shebang line to the php script you've readied it for automatic execution.
To make it double clickable executeable you have to do the following:
Right click on the PHP script and click Get Info. Click where it says Open With, click the default option to see all the available options. Select Other...
Switch where it says Enable: from Recommended Applications to All Applications, and click the checkbox for Always Open With. Choose Terminal as the application. Finally, you have to click the button that says Change All...
OS X will verify you want it to set Terminal as the default application to open .php files
This will make every php file open up in terminal by default, but unless they contain the #!/usr/bin/php line they won't actually run.
Try MAMP
MAMP 4 brings even more opportunities for web developers. We are now supporting MySQL 5.6 and Nginx is now fully integrated. Server starting times have been improved.
Because .php files are not 'executable' per se, instead they are just text files with a PHP extension.
You need to run the php interpreter against the file to execute on it's contents.
My setup is as follows: Windows 7, XAMPP with Apache and PHP enabled I have a PHP script in which I call an external program to do run a conversion. This external program is an EXE file, which requires 3 attributes:
The source file
The destination file
Additional flags (conversion type etc)
When I use the command line tool built into XAMPP to execute my script, everything works fine. But when I use the exec() function in my PHP script, no output file is created. I'm pretty sure the conversion is actually happening (it takes about 5 seconds, about the same time it takes to run the PHP script).
I think it's a permissions thing, so I already moved the EXE file to the same folder as my PHP file and adjusted the permissions of the entire folder (I granted all permissions to all users). I also disabled the Windows UAC and tried to put the command in a BAT file. The file just is not created.
Any help or tips would be greatly appreciated!
My PHP code is as follows:
exec('c:\converter.exe c:\src.txt c:\dst.txt -f', $output);
print_r($output);
When I print out $output, the array turns out to be empty. When I put the exact same command in Command Prompt, the code works like a charm (no syntax errors). I use absolute paths as well.
Try to copy your executable file in same folder as your application.
try
exec("script.exe src.txt dst.txt", &$output);
echo $output;
also, do not forget to use escapeshellcmd() to add some security to your application.
Thank you very much for your input! As it turns out, it was Windows issue caused by the 'Interactive Services Detection' feature. Apache was running as a system service, which prevented calls to external programs (with a GUI). I disabled the run-as-service feature in XAMPP, which solved the problem. A more thorough explanation can be found here: http://php.net/manual/en/book.exec.php
I'm trying to configure my local development environment to read .less files so that I can edit .less files during development and only convert to .css when it's time to go live. Make sense?
I'm running MAMP as my local testing server. I'm following the instructions I found here:
http://programming-perils.com/155/parse-less-files-on-the-fly-and-serve-them-as-css/#comment-920
In short, the plan is to use an htaccess file catch requests to .css files and direct them to a PHP script which compiles the .less file of same name and returns the css code.
Everything seems to be working from the command line. I can compile a .less file from the command line and it spits out the css. I know my rewrite rule is working because I can type the url into a browser and see the output of my php script. For example, if my PHP script calls echo shell_exec('pwd'); I will see a path printed in the browser.
THE PROBLEM is that I can't get the less script to run unless I SSH to the localhost as root. When I exit SSH and run the command I get "Permission denied". I suspect this is what happens when my PHP script tries to call this... so it's returning nothing.
I guess the question boils down to how can I get my PHP script to run the less compiler?
UPDATE! I solved the problem...
It turns out that the less command (path/path/lessc) needed to be sudo'ed. PHP wasn't doing this, so the shell_exec() command wasn't returning anything. That's why my echo statements DID work.
There are a lot of ways to sidestep this, but I determined that editing the list of sudoers with sudo visudo was the best for my purposes. There was a lot of helpful tips on this post. Through trial and error, I figured out that PHP uses the www-data account. Adding this line fixed my problem:
www-data ALL=(ALL) NOPASSWD: /var/root/node/npm/node_modules/less/bin/lessc
Something to remember is that you STILL have to add sudo to the command that gets fed to shell_exec(). Hope this is helpful to someone else.
Maybe it would be easier if you'd use the PHP implementation of lesscss: lessphp
It turns out that the less command (path/path/lessc) needed to be sudo'ed. PHP wasn't doing this, so the shell_exec() command wasn't returning anything. That's why my echo statements DID work...
See my edits to the question above.