kenw232 Posted January 13, 2013 Share Posted January 13, 2013 I have a script that simply does this: <? $sCMD = `/bin/cat /tmp/test.txt`; echo $sCMD; ?> This works. But my open_dirbase does not include /bin or /tmp. Does anyone know why executing a program using backticks like this bypasses open_basedir? This should not work correct? I'm running PHP 5.3.16 on linux kernel 2.4. Quote Link to comment https://forums.phpfreaks.com/topic/273091-open_basedir-does-not-apply-to-shell_exec-backticks/ Share on other sites More sharing options...
Christian F. Posted January 13, 2013 Share Posted January 13, 2013 I'd use built in PHP functionality, namely file_get_contents (). No need to invoke a shell command for something like this. Quote Link to comment https://forums.phpfreaks.com/topic/273091-open_basedir-does-not-apply-to-shell_exec-backticks/#findComment-1405325 Share on other sites More sharing options...
kicken Posted January 13, 2013 Share Posted January 13, 2013 open_basedir is a PHP setting, and as such only has an effect on PHP's functions. When you run an external program that program is not subject to the same limitations as PHP is. Quote Link to comment https://forums.phpfreaks.com/topic/273091-open_basedir-does-not-apply-to-shell_exec-backticks/#findComment-1405332 Share on other sites More sharing options...
kenw232 Posted January 14, 2013 Author Share Posted January 14, 2013 open_basedir is a PHP setting, and as such only has an effect on PHP's functions. When you run an external program that program is not subject to the same limitations as PHP is. Thanks. That clears it up. Quote Link to comment https://forums.phpfreaks.com/topic/273091-open_basedir-does-not-apply-to-shell_exec-backticks/#findComment-1405437 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.