Not sure if this a php error - can someone confirm it?

[Paul F. Johnson]

Hi,

I have the following in a php file

$filenames = array("fred.pdf", "sid.pdf", "harry.pdf",
"wibble.pdf");
for ($i = 0; $i < count($filenames); ++$i)
{
  $command='/usr/bin/zip -9 '.$prog.'.zip ".$filenames[$i];
  exec($command);
}

$prog is just a name.

If I set $prog to be getcwd()."foo", then no zip file is created.
Infact, I can set $prog to anything and nothing is created - with one
exception, $prog="/tmp/foo" - this will create the zip file in tmp, but
I can't then do anything with it as the permissions say it belongs to
apache:apache (copy () won't work, neither will cp or mv).

I cannot chown the file via php either (chown ('/tmp/foo.zip',
'paul:paul');)

Have I hit a bug or is it me needing another lobotomy to remove things
that shouldn't be there?

TTFN

Paul
-- 
"Logic, my dear Zoe, is merely the ability to be wrong with authority" -
Dr Who

[Peter Arremann]

On Tuesday 23 May 2006 08:10, PFJ wrote:
>  Hi,
>
>  I have the following in a php file
>
>  $filenames = array("fred.pdf", "sid.pdf", "harry.pdf",
> "wibble.pdf");
>  for ($i = 0; $i < count($filenames); ++$i)
>  {
>    $command='/usr/bin/zip -9 '.$prog.'.zip ".$filenames[$i];
>    exec($command);
>  } 
Why ++$i not $i++?

>  $prog is just a name.
>
>  If I set $prog to be getcwd()."foo", then no zip file is created.
>  Infact, I can set $prog to anything and nothing is created - with one
>  exception, $prog="/tmp/foo" - this will create the zip file in tmp, but
>  I can't then do anything with it as the permissions say it belongs to
>  apache:apache (copy () won't work, neither will cp or mv). 
apache:apache - that
means most likely you run it through the webserver... 
does your apache user have permissions to write to getcwd()."foo" ? most 
likely not, that's why no file was created. If you want to stay with 
executing a system command, try doing so in a popen, that way you can read 
back the output (including the erorr message why the file wasn't created). If 
its just for debugging, passthru() will work too. At least check the return 
code of exec. 

Also, if you're not looking at moving this over to a windows box, you should 
use zlib or bzip2 - both of which have nice well defined php interfaces and 
don't require you to exec out. 


>  I cannot chown the file via php either (chown
> ('/tmp/foo.zip',
>  'paul:paul');) 
Pretty basic security. look at the man page of chown and the
php manual under 
safe_mode.


Peter.

[Jeff Vian]

On Tue, 2006-05-23 at 13:10 +0100, PFJ wrote:
>  Hi,
>  
>  I have the following in a php file
>  
>  $filenames = array("fred.pdf", "sid.pdf", "harry.pdf",
> "wibble.pdf");
>  for ($i = 0; $i < count($filenames); ++$i)
>  {
>    $command='/usr/bin/zip -9 '.$prog.'.zip ".$filenames[$i]; 
      
                              ^^^^^^^^
Not sure if this is a typo or the actual line, but changing delimiters
is not valid
>    exec($command);
>  }
>  
>  $prog is just a name.
>  
>  If I set $prog to be getcwd()."foo", then no zip file is created.
>  Infact, I can set $prog to anything and nothing is created - with one
>  exception, $prog="/tmp/foo" - this will create the zip file in tmp, but
>  I can't then do anything with it as the permissions say it belongs to
>  apache:apache (copy () won't work, neither will cp or mv).
>  
>  I cannot chown the file via php either (chown ('/tmp/foo.zip',
>  'paul:paul');)
>  
>  Have I hit a bug or is it me needing another lobotomy to remove things
>  that shouldn't be there?
>   
Since php is running as the web server user, anything it creates is
owned by apache, and apache must have permissions to write where the
file is created.

Also, apache (the web server) must be able to access/execute in the
directory used.

You will need to make sure that the .conf file for apache/the app
( usually a file in /etc/httpd/conf.d/*.conf ) provides permissions to
write/execute in whatever directory you are using and that permissions
are otherwise restricted.

This also may be impacted by selinux if you have it in enforcing mode.


>  TTFN
>  
>  Paul
>  -- 
>  "Logic, my dear Zoe, is merely the ability to be wrong with authority" -
>  Dr Who
>