Validate if an application is at the server - php

I have an own webserver and for one of my clients I need to be able to search through PDF's. I've asked my hostingprovider to install the xPDF package. Now I've come to testing and I'm calling this line of code in a PHP script:
$content = shell_exec('/usr/local/bin/pdftotext test.pdf -');
The only thing is, I'm getting a NULL result with. So, my question, is there a way to validate if the program is really installed? Btw, I'm not even sure if the path is correct. I'm pretty new if it comes to having an own webserver. I've taken this example from : http://davidwalsh.name/read-pdf-doc-file-php

If you have shell access, log in using SSH, and try
whereis pdftotext
if the only thing you get is a
pdftotext:
then it is most likely not (or not properly) installed.

Related

php exec with vboxmanage to start virtual server.

I am trying to do a simple project to start a VirtualBox VM using a PHP script. My server is win 7 ultimate and running php5.3 I am using the vboxmanage.exe to start the server. cmd works great in a batch file or typed right into cmd line.
When I use:
exec("path to vboxmange.exe" startvm "vm name");
it doesnt work. If I change the code to:
exec(dir);
it works fine. I did some searching and everyone seemed to mention permissions for IIS_IUSRS. I set it to have read and execute on the vboxmanage.exe and tried to do it for cmd.exe but cant seem to get it to allow me to do this, though it doesnt seem necessary as it can run other cmds like dir.
another theory I have is that exec wraps the entire cmd in "" and this doesnt work when I try to type it in to cmd line manually. I have tried to trim it off but that doesnt work cause exec adds it on so nothing I do before can stop this.
any suggestions for another way to do this or what it might be?
From exec in the PHP Manual:
Note: When safe mode is enabled, you can only execute files within the
safe_mode_exec_dir. For practical reasons, it is currently not allowed
to have .. components in the path to the executable.
Check the value of your safe_mode_exec_dir in your php.ini. I would guess that it would be fairly restrictive by default.
If that doesn't work, take a look in the comments. Particularly, this comment might be of help to you.

Apache/PHP + LibreOffice

I've installed the LibreOffice RPMS (have tried both 3.5.3 and 3.4.6) on my CentOS machine, and I'm trying to make PHP run a shell script that calls LibreOffice. In the shell script, it runs executes this line:
/opt/libreoffice3.4/program/soffice --headless -convert-to $extension.pdf "$1" -outdir $folder
However, this command will cause the following message to appear:
./createpdf.sh: line 8: /opt/libreoffice3.4/program/soffice: Permission denied
The line itself is fine. If I echo it and run it manually in SSH, it works fine. This is most likely because I'm running it as a different user (note: not as the user that installed it, and not as root), with different permissions.
Desperate as I was, I've already tried chmodding the entire libreoffice folder to 777, and tried to make the 'apache' user the owner. No luck there. Would anyone have a clue as to why it's not letting apache run it, and how I can solve this?
As an alternative to running from the command line, have you considered running UNO (the Open/Libre Office alternative to COM) with the PUNO PHP wrapper. That way, you don't need to worry about permissions
See also Universal Network Objects (UNO): there are Python, Java, etc. bridges for use it. There are applications for simplify the use for convertions, see Docvert and JODConverter (jODconverter and pyODconverter).
All of then can be called as web-service or exec by PHP.

PHP's shell_exec won't allow "Watir::Browser.new :firefox" to execute

I'm brand new to ruby and Watir, here's my issue...
I have a MySQL DB with test data that I need. I've done a lot in the past with this data and so I have a whole library of PHP tools for accessing this data, marking data as in use/used/bad/etc, and in general I have a lot of time invested in the PHP framework. So I'd really like to use the PHP framework as a wrapper around the Watir script - for example, use PHP to grab test user login data from the DB and pass it to the ruby script for processing.
I now have sites with javascript that need work/testing and PHP & cURL can't deal with this. So I'm working with Watir-WebDriver on Ubuntu 10.10 (Maverick, Desktop not Server) for these sites. The problem I'm having is with the use of PHP's shell_exec of the ruby script with all the Watir code.
The PHP shell_exec is executing the file - I can see it because I have some puts lines in the file which are being displayed. However, the code appears to be failing on the line
ff = Watir::Browser.new :firefox
I'm not getting an error from PHP.
The PHP line is:
echo shell_exec('ruby /var/www/watir_test.rb');
The ruby script works fine when I call it from a terminal window with the line:
ruby /var/www/watir_test.rb
I originally expected this was a permissions issue since it worked from the command line but not from a browser. However, since it can call the file well enough to return the hardcoded data I've provided for the test then ruby file permissions don't seem to be the issue. Could there be a permissions issue with opening a Firefox window from the www-data user?
When I run
ruby -d -v /var/www/watir_test.rb
I get:
{:extension=>:webdriver} {"app.update.enabled"=>"false"} {"browser.link.open_newwindow"=>"2"} {"browser.shell.checkDefaultBrowser"=>"false"} {"extensions.update.enabled"=>"false"} {"security.warn_entering_secure.show_once"=>"false"} {"webdriver_assume_untrusted_issuer"=>true} {"startup.homepage_welcome_url"=>"\"about:blank\""} {"browser.tabs.warnOnClose"=>"false"} {"extensions.update.notifyUser"=>"false"} {"toolkit.networkmanager.disable"=>"true"} {"security.warn_entering_weak.show_once"=>"false"} {"webdriver_firefox_port"=>"7055"} {"browser.download.manager.showWhenStarting"=>"false"} {"extensions.logging.enabled"=>"true"} {"network.manage-offline-status"=>"false"} {"network.http.max-connections-per-server"=>"10"} {"security.warn_submit_insecure"=>"false"} {"security.warn_entering_weak"=>"false"} {"security.warn_leaving_secure"=>"false"} {"prompts.tab_modal.enabled"=>"false"} {"security.warn_viewing_mixed.show_once"=>"false"} {"dom.max_script_run_time"=>"30"} {"webdriver_accept_untrusted_certs"=>true} {"browser.safebrowsing.enabled"=>"false"} {"security.warn_leaving_secure.show_once"=>"false"} {"signon.rememberSignons"=>"false"} {"javascript.options.showInConsole"=>"true"} {"app.update.auto"=>"false"} {"browser.EULA.3.accepted"=>"true"} {"browser.tabs.warnOnOpen"=>"false"} {"dom.disable_open_during_load"=>"false"} {"network.http.phishy-userpass-length"=>"255"} {"security.warn_entering_secure"=>"false"} {"browser.startup.homepage"=>"\"about:blank\""} {"browser.EULA.override"=>"true"} {"browser.dom.window.dump.enabled"=>"true"} {"browser.startup.page"=>"0"} {"browser.link.open_external"=>"2"} {"browser.search.update"=>"false"} {"browser.sessionstore.resume_from_crash"=>"false"} {"security.warn_viewing_mixed"=>"false"} {"dom.report_all_js_exceptions"=>"true"} {"webdriver_enable_native_events"=>false} {"devtools.errorconsole.enabled"=>"true"}
How do I get PHP to execute the shell_exec properly? The script works and my initial tests were run using firewatir (which shell_exec ran fine) but I am really wanting to use Watir-WebDriver instead of FireWatir - WatirWebDriver should be capable of running a Chrome browser (and IE on a Windows machine) while FireWatir can only run Firefox.
Thanks
Gabe
Here's my "Create Browser" code:
# Include the RubyGems file
require 'rubygems'
# Include the Watir-WebDriver file.
require 'watir-webdriver'
# Create the necessary objects
def create_browser(proxy)
# Setup the proper Firefox Profile
profile = Selenium::WebDriver::Firefox::Profile.new
profile.proxy = Selenium::WebDriver::Proxy.new :http => proxy
puts "<br>Using proxy " + proxy + "..."
#ff=FireWatir::Firefox.new :profile => profile
ff = Watir::Browser.new :firefox #, :profile => profile
puts "<br>Firefox ready..."
return ff
end
If the server is headless, you should install the headless gem so that Firefox can work.
require 'watir-webdriver'
require 'headless'
headless = Headless.new
headless.start
b = Watir::Browser.start 'www.google.com'
puts b.title
b.close
headless.destroy
See: http://watirwebdriver.com/headless/
It't a permission problem, the PHP script runs with the permissions of the server, normally apache.
You can do a sudo www and try to run the script then with rb to see if there is a problem when running ruby with the server user.
Put the two lines of code that is below at the very top of your PHP script. The result of this is that when you browse to your PHP page with your browser it will display exactly what the errors are, including any permission errors.
ini_set("display_errors",1);
error_reporting(E_ALL);
So a recent update to Firefox killed it's support for Watir (no JSSH update if I remember). As a result I rewrote what little code I had for Selenium::WebDriver. But I'm thinking that isn't particularly relevant (its included in case it is relevant I don't know it).
My ultimate solution was to use phpseclib. This allows me to SSH into the machine via their SSH2 PHP class. Once logged in as my typical username (with typical password) I was able to fire off a headless version of my script no problem. The only real issues this creates is that I now have to view everything that's going on through log files and screenshots but that was likely to be true no matter what solution I came up with.
phpseclib needs your username and password for the server (at least until you set some form of public private key pair). So I wouldn't want to do this on a publicly available machine without a couple of layers of security - like setting .htaccess to deny read access to the file with the login data, encrypting the password stored in the file, etc. However, for my purposes I'm logging into one machine on my LAN from another machine on my LAN. The password is only good on my LAN (not my web servers) and while my LAN can see out it should not be (easily) available to the rest of the world (to the best of my knowledge). So the security concerns are minimal.
I never did figure this out. Headless isn't the answer to getting PHP to exec the script. I'm pretty sure it is a permissions issue with Firefox's executable but I can't be positive until I find an actual fix.
Ultimately I've had to break up the tool where PHP manages the DB and task scheduling. Then PHP creates text files with all the data necessary for ruby to run the browser to right site, login, etc, etc... Then ruby moves the data file to one of a few different folders (success, failure, bad login, etc) and adds some text to the data file. Finally PHP parses all this info in the moved text files and updates the DB with that info.
It's less than ideal but it is getting the job done. Now I just need to figure out how to run all of this with mutliple threads...
Thanks for the help

Accessing kd Debugger via php

I work at a small computer shop, and we have to analyze windows minidumps all the time. My idea was to install the Windows Debugging Tools on a windows PC and use apache/PHP as an interface to it. That way I could just set up an HTML upload form that would accept the minidump file, run it through KD, then spit out the output.
It nearly works. I created a special user just for apache so I could assign it write privaleges to C:\symbols, and I use the following code:
<?php
$kdScript = "\"\\Program Files\\Debugging Tools for Windows (x86)\\kd.exe\" -c \"!analyze -v;Q\" -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -z ";
$kdScript .= $_FILES["myFile"]["tmp_name"];
$output = `$kdScript`;
print("<pre>$output</pre>");
?>
The problem I'm having is that the symbols are not downloaded as they should be. I've verified apache is running as the user I think it is by calling "whoami" from inside backticks. I've verified that I can run the windows version of wget from within backticks, so I have access to the network. I can file_put_contents() into a new file under C:\symbols, so I have file creation permissions.
Also, I tried having PHP simply output the command to the browser so I could copy and paste it into a terminal. I was able to run a command prompt as my apache user via "runas", paste the command from PHP's output into the prompt, and it worked as expected, downloading all the symbols it needed to C:\symbols. Of course, I had to point it to a dump file NOT in the PHP temp directory, but this shouldn't make a difference.
What could be the problem? Just as a side note, all of this is local on a trusted pc in a company that has a total of 3 employees/owners. Security for this project is irrelavent.
Not sure what your exact problem is, but the symbol server client code is finicky and not very debuggable, it took us lots of tinkering to implement our version of this. You can always direct folks there or use it yourself:
http://www.osronline.com/page.cfm?name=analyze
-scott

Get apache linux user from php

I'm on a foreign linux system and need to determine the user that apache runs on (and so does php).
The aim:
I need to get the owner of the script (this is no problem as I can use SplFileInfo) and compare it to the owner of the apache process.
I'm open to any alternative proposals.
Regards,
Mario
Edit:
Additional info:
The script is a thumbnail generator, that uses an XML file to generate thumbs from larger images. The script needs to create folders and write files. As I cannot influence the php configuration and I do not have any shell access, this has to be done very silently.
The creation process stopps via exception and sends a mail on failue. As most of php's function cannot throw exceptions on failue, I need some manual checks to determine the environment I'm in. Therefore I need the apache user to compare it to some directory or fileowner.
You can call the php exec function to execute whoami:
<?php echo exec('whoami'); ?>
see posix_getuid() and posix_getpwuid()
Some complicated answers here.
This works for me:
$user = getenv('APACHE_RUN_USER');
Not sure if this is just a new thing that been added to apache since this question was asked but it's definitely there now.
phpinfo will dump a lot of system information. For apache2 installs, there is a section that displays the apache user and group ids. Try creating a php script that just has one line, a call to phpinfo(), and open it in your web browser.
Some php script must be run on apache user (cli), whoami is not appropriate in that case.
Here is my solution :
$output = exec('apachectl -S 2>/dev/null | grep User');
$apacheUser = preg_match('/name="([^"]+)"/', $output, $match) ? $match[1] : 'www-data';

Categories