Shell_exec returns NULL, but when trying from the console it works

Question

I have three php scripts. First, I start with an init script. The second is launched by the first, and the second uses shell_exec to get the output from the third script, periodically passing it various parameters.

But this does not happen. When I var_dump output of shell_exec , in the second script I get NULL . But when I print the actual command that is used in shell_exec in the second script and try to enter it into the console, it works very well!

I tried the command from the console of the same user with which I run the init script.

This may be a resolution issue. But I have the correct permission settings i.e.

• + x for the third script
• the third script (virtually all three) belongs to the same user and group, I use the console with

Note. I tried to run the third script using shebang as well as remove shebang and add php to the script path. Everything works fine with root.

Also, another note, the first script redirects the output of the second script to the log file (this is where I found the third script returning NULL on shell_exec )

UPDATE: code of the second script that uses shell_exec

 $command = "/var/data/user-data.php '{$user}' '{$request['token']}' '{$request['secret']}'"; $data = json_decode( shell_exec( $command ), true ); 

I tried to print $command as well as var_dump( shell_exec( $command ) ) . The former returns the expected (params), and the latter returns NULL

Answer 1

Without commenting directly on the problem -

Stop. Do not spread it. This is a protective minefield.

 $command = "/var/data/user-data.php '{$user}' '{$request['token']}' '{$request['secret']}'"; 

What happens if the user passes, say:

 http://yoursite.com/index.php?token=';rm -rf / # 

Answer: your entire server is deleted (or at least everything that a PHP script user can touch). Naturally, there are other, more insidious things that people can do. And this vulnerability can and will be found by automatic scanners, which, in turn, will automatically lead to the root server.

So do not disconnect, especially when you just call another PHP script. Put your code in the function, include the php file in it and call the function when you need the data.