Re: passwd module

Jan Schneider <[email protected]>
Newsgroups gmane.comp.horde.sork
Message-ID <[email protected]>
Zitat von Eric Jon Rostetter <[email protected]>:

> Quoting Jorge Hernandez <[email protected]>:
>
>>  I have horde 1.1.2 installed with passwd using myscript as  
>> backend, the script has been configured to take args, but using it  
>> as follows, it doesn't send the args to my script, is this the way  
>> to pass my args???:
>
> Try double quotes instead of single quotes on the program line...
>
>>        'program' => '/usr/bin/php  
>> /var/www/htdocs/change_password.php $_POST[userid]  
>> $_POST[newpassword1]'
>
> Try instead:
>
> 'program' => "/usr/bin/php /var/www/htdocs/change_password.php  
> $_POST[userid] $_POST[newpassword1]"
>
> The differnce is, php doesn't expand variables in single quoted strings, but
> does in double quoted strings..  You could also maybe do something like:
>
> 'program' => '/usr/bin/php /var/www/htdocs/change_password.php ' .  
> $_POST[userid] . ' ' . $_POST[newpassword1]
>
> But I don't think that is as clean...

Not to mention that it allows any user to execute arbitrary commands  
on your server!

Jan.

-- 
Do you need professional PHP or Horde consulting?
http://horde.org/consulting/

--
Sork mailing list - Join the hunt: http://horde.org/bounties/#sork
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.