php and exec

[mrxUx]

a quick question, maybe already answered but I couldn't find anything yet, so please excuse me

I'm using cPanel + LiteSpeed, and for example, I have the following code on a php script:

PHP Code:

<?php
echo ":: ".`which convert`;
?>

Which should come up with the full path of convert (part of imagemagick), however is returning empty, now if I do the same from the user's shell by executing the php: "sudo -u user php -f file.php" y do get the right path.

Another funny thing is, if instead I use `which --help` it works in both and actually "convert" does work without problems, so I'm kinda confused here

[mistwang]

You can set "PATH=...." in lsphp5 "Environment" configuration.

[mrxUx]

Originally Posted by mistwang

You can set "PATH=...." in lsphp5 "Environment" configuration.

Not sure if the issue is there, let me go deeper and show you with a small php script I did to print stuff over LiteSpeed:

PHP Code:

<?php

// no big deal, it will just execute things and print them nice
out("echo \$PATH");
out("ls /usr/bin/which");
out("ls /usr/bin/convert");    
out("/usr/bin/which --version");
out("/usr/bin/convert --version");
out("/usr/bin/which convert");

function out($cmd) {
  $out = trim(`$cmd`);
  echo ":: [$cmd]\n\t$out\n\n";
}
?>

This was the result:

:: [echo $PATH]
	/usr/local/bin:/bin:/usr/bin

:: [ls /usr/bin/which]
	/usr/bin/which

:: [ls /usr/bin/convert]
	/usr/bin/convert

:: [/usr/bin/which --version]
	GNU which v2.19, Copyright (C) 1999 - 2008 Carlo Wood.
GNU which comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.

:: [/usr/bin/convert --version]
	Version: ImageMagick 6.7.1-7 2012-09-15 Q16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2011 ImageMagick Studio LLC
Features: OpenMP

:: [/usr/bin/which convert]
(***EMPTY***)

I hope this helps, as some Gallery scripts try to "autodetect" some binaries but the problem here is that "which" is not giving the right path.

[NiteWave]

my local test not empty, show " /usr/bin/convert" correctly:

:: [echo $PATH]
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin

:: [ls /usr/bin/which]
/usr/bin/which

:: [ls /usr/bin/convert]
/usr/bin/convert

:: [/usr/bin/which --version]
GNU which v2.16, Copyright (C) 1999 - 2003 Carlo Wood.
GNU which comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.

:: [/usr/bin/convert --version]
Version: ImageMagick 6.2.8 02/22/12 Q16 file:/usr/share/ImageMagick-6.2.8/doc/index.html
Copyright: Copyright (C) 1999-2006 ImageMagick Studio LLC

:: [/usr/bin/which convert]
/usr/bin/convert

[mrxUx]

Originally Posted by NiteWave

my local test not empty, show " /usr/bin/convert" correctly:

I guess you're testing it as root, how about using a non privileged user?

Thanks for the updates guys

[NiteWave]

tested with root, also tested with nobody

access it through browser, it runs under lsphp5 user -- nobody.

you can add
out("id");
to confirm it.

[mrxUx]

I'm running out of ideas, not sure what it could be but the funny thing is that this issue happens on all the servers we have.

Why it can execute "which" and only be able to get the help?

[webizen]

are you able to reproduce the issue in Apache?

[mrxUx]

@webizen, yes Sir, this is the output:

:: [echo $PATH]
/bin:/usr/bin

:: [ls /usr/bin/which]
/usr/bin/which

:: [ls /usr/bin/convert]
/usr/bin/convert

:: [/usr/bin/which --version]
GNU which v2.19, Copyright (C) 1999 - 2008 Carlo Wood.
GNU which comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.

:: [/usr/bin/convert --version]
Version: ImageMagick 6.7.1-7 2012-09-15 Q16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2011 ImageMagick Studio LLC
Features: OpenMP

:: [/usr/bin/which --tty-only convert]
/usr/bin/convert

[NiteWave]

not sure why yet, but following tests may inspire others:

PHP Code:

<?php
echo "<pre>";
out("echo \$PATH");
out("echo $PATH");
out("PATH=/usr/local/bin:/bin:/usr/bin /usr/bin/which ls");
out("/usr/bin/which ls");
out("id");
out("alias");
out("env");
echo "</pre>";

function out($cmd) {
  $out = `$cmd`;
  echo ":: [$cmd]\n\t$out\n";
}
?>

the output(in browser):

:: [echo $PATH]
/usr/local/bin:/bin:/usr/bin

:: [echo ]


:: [PATH=/usr/local/bin:/bin:/usr/bin /usr/bin/which ls]
/bin/ls

:: [/usr/bin/which ls]

:: [id]
uid=555(shooting) gid=555(shooting) groups=555(shooting)

:: [alias]

:: [env]
PHPRC=/home/shooting/
PWD=/home/shooting/public_html/Darladog
SHLVL=1
_=/bin/env