[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution

Espoir Baraka pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
e26b10ba by Espoir Baraka at 2026-08-20T15:33:38+02:00
[FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution
---
* [FIX] Enhance php_cli_path handling to prevent arbitrary command execution risks

(cherry picked from commit cbfebbc50b2538190f17dd1f66339094e48a7ebd)

* [FIX] Validate php_cli_path is a real PHP CLI binary to prevent arbitrary command execution

(cherry picked from commit 854b6e201ec2826284fa0a133db1db9936790121)

See merge request tikiwiki/tiki!11004

(cherry picked from commit 44de0d202f8917de9cdcdeaf9985f99b24965427)

See merge request tikiwiki/tiki!11012

(cherry picked from commit 949f91670b610395dc944a59a49f33b1e644e729)

See merge request tikiwiki/tiki!11014

(cherry picked from commit fedba951f9520931be2c897f794a06010070fb46)

See merge request tikiwiki/tiki!11015

(cherry picked from commit 5bc0001ccd2465dac6c7060ff57db2d04b063bf8)

See merge request tikiwiki/tiki!11017

- - - - -


3 changed files:

- lib/prefs/php.php
- lib/prefslib.php
- tiki-admin_security.php


Changes:

=====================================
lib/prefs/php.php
=====================================
@@ -35,5 +35,18 @@ function prefs_php_list()
             'type' => 'flag',
             'default' => class_exists('DateTime') ? 'y' : 'n',
         ],
+        'php_cli_path' => [
+            'name' => tra('Path to the php binary'),
+            'description' => tra(
+                'Path to the php command line binary to be used by tiki when calling command line programs'
+            ),
+            'keywords' => 'command line php path',
+            'type' => 'text',
+            'default' => '',
+            'tags' => ['advanced'],
+            'warning' => tra('Security-sensitive setting. An incorrect path can lead to arbitrary command execution under the web server account.'),
+            'hint' => tra('Set this using system configuration (tiki.ini) so only server administrators can configure it. Hidden by default as a risky preference.'),
+            'help' => 'General-Settings',
+        ],
     ];
 }


=====================================
lib/prefslib.php
=====================================
@@ -22,6 +22,7 @@ class PreferencesLib
         'scheduler_shell_command',
         'smarty_enable_string_eval',
         'wikiplugin_fileaccess_allowed_paths',
+        'php_cli_path',
     ];
 
     private $data = [];


=====================================
tiki-admin_security.php
=====================================
@@ -124,6 +124,13 @@ if ($prefs['scheduler_shell_command'] == 'y') {
         'message' => tra('The "Scheduler shell command" is activated. It can be used by Tiki administrators to execute shell commands which can lead to security risks.')
     ];
 }
+if (! empty($prefs['php_cli_path'])) {
+    $tikisettings['php_cli_path'] = [
+        'risk' => tra('risky') ,
+        'setting' => $prefs['php_cli_path'],
+        'message' => tra('A custom PHP CLI path is configured. This preference is risky and should only be set by server administrators via system configuration.')
+    ];
+}
 
 $risky_message = tra('Enabling this preference is potentially dangerous! Only Tiki administrators should be allowed to enable and use this feature.');
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/e26b10bab98444596114ade194fff188ce408558

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/e26b10bab98444596114ade194fff188ce408558
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs