Re: [Tiki-devel] More disabled PHP function challenges

On vendredi 6 décembre 2024 09 h 30 min 53 s EST Geoff - Enmore Services wrote:
> All - following on from my previous emails where I described how I have been
> 'scrabbling' to do an upgrade from 24.6 to 27.1 because my hosting company
> has 'imposed' fixed disabling of several PHP functions, this note is about
> two things, the first of which frankly is bonkers!
> 
> 
> 
> 1. Tiki's "Server Fitness" check has been evolving over many releases and
> one of its checks is to list PHP functions and their 'safeness'.  So, it
> continues to say that shell_exec being Disabled is the 'safe' setting and
> only if Tiki needs to run PDF from URL: WebKit (wkhtmltopdf) is this needed,
> and if the other PHP software on the server can be trusted, then and only
> then should this be enabled.
> 
> 
> 
> However much to my surprise, my Tiki 27.1 upgrade on my hoster, now gives
> me:
> 
> 
> 
> Fatal error: Uncaught Error: Call to undefined function shell_exec() in
> /blah-blah/tiki-check.php:2758 Stack trace: #0 {main} thrown in
> /blah-blah/tiki-check.php on line 2758
> 
> 
> 
> So, with my hoster disabling shell_exec I can't run the 'Fitness' check to
> understand why - which is obviously bonkers!
> 
> 
> 
> So, the question this poses, is why are we proliferating the use of PHP
> functions that we simultaneously say are potentially unsafe - something that
> hosters obviously agree with?

We aren't (except by mistake).  The problem you reported is caused by the line 
$which_exec = `which $exec`; 
in tiki-check.php.

This is https://www.php.net/manual/en/language.operators.execution.php[1], and most 
likely wasn't spotted because the backtick operator is just a hidden shell_exec, and should 
be gated as such in a function_exists('shell_exec')

But a similar mistake came into master a month ago which will break the installer:  
https://gitlab.com/tikiwiki/tiki/-/merge_requests/6441[2]

> Just for completeness these are what my hoster disables in 8.3.14:
> 
> allow_url_include, apache_child_terminate, apache_setenv, exec, passthru,
> pcntl_exec, posix_kill, posix_mkfifo, posix_getpwuid, posix_setpgid,
> posix_setsid, posix_setuid, posix_setgid, posix_seteuid, posix_setegid,
> posix_uname, proc_close, proc_get_status, proc_open, proc_terminate,
> shell_exec, show_source, system
> 
> 
> 
> Can anyone say if any of these functions are now being used in Tiki 27?

That's a lot of code to audit to prove a negative.  But most are unlikely to be used.

For those that aren't I only spotted 2 uses without any handling of their potential non-
existance:

* proc_open without (in lib/openpgp/openpgplib.php)

* posix_getpwuid (in lib/filegals/filegalbatchlib.php), (but disabling access to 
posix_getpwuid is pretty weird).




-- 
Benoit Grégoire

--------
[1] https://www.php.net/manual/en/language.operators.execution.php
[2] https://gitlab.com/tikiwiki/tiki/-/merge_requests/6441

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel