[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution

Espoir Baraka pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
44de0d20 by Espoir Baraka at 2026-08-20T09:22:44+02:00
[FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Enhance php_cli_path handling to prevent arbitrary command execution risks

(cherry picked from commit cbfebbc50b2538190f17dd1f66339094e48a7ebd)

* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution

(cherry picked from commit 854b6e201ec2826284fa0a133db1db9936790121)

See merge request tikiwiki/tiki!11004

- - - - -


3 changed files:

- lib/prefs/php.php
- lib/prefslib.php
- tiki-admin_security.php


Changes:

=====================================
lib/prefs/php.php
=====================================
@@ -17,6 +17,9 @@ function prefs_php_list()
             'keywords' => 'command line php path',
             'type' => 'text',
             'default' => '',
+            'tags' => ['advanced'],
+            'warning' => tra('Security-sensitive setting. An incorrect path can lead to arbitrary command execution under the web server account.'),
+            'hint' => tra('Set this using system configuration (tiki.ini) so only server administrators can configure it. Hidden by default as a risky preference.'),
             'help' => 'General-Settings',
         ],
     ];


=====================================
lib/prefslib.php
=====================================
@@ -21,6 +21,7 @@ class PreferencesLib
         'scheduler_shell_command',
         'smarty_enable_string_eval',
         'wikiplugin_fileaccess_allowed_paths',
+        'php_cli_path',
     ];
 
     private $data = [];


=====================================
tiki-admin_security.php
=====================================
@@ -119,6 +119,13 @@ if ($prefs['scheduler_shell_command'] == 'y') {
         'message' => tra('The "Scheduler shell command" is activated. It can be used by Tiki administrators to execute shell commands which can lead to security risks.')
     ];
 }
+if (! empty($prefs['php_cli_path'])) {
+    $tikisettings['php_cli_path'] = [
+        'risk' => tra('risky') ,
+        'setting' => $prefs['php_cli_path'],
+        'message' => tra('A custom PHP CLI path is configured. This preference is risky and should only be set by server administrators via system configuration.')
+    ];
+}
 
 $risky_message = tra('Enabling this preference is potentially dangerous! Only Tiki administrators should be allowed to enable and use this feature.');
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/44de0d202f8917de9cdcdeaf9985f99b24965427

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/44de0d202f8917de9cdcdeaf9985f99b24965427
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs