Recently I've been looking for a PHP/Linux shell script that would change current working user from "www-data" to the other one.

Since I tried running this service: http://cfgfactory.com/images/servers_hire.png which is basically starting a "call of duty 4" server it worked all fine since I realized there's a bug in the call of duty 4 server that let's you download ANY file from the server I tried downloading ../../../var/www/config.php and that worked just fine... So I setup a new user for this service and that's why I need a way of changing user

That's how I start the server:

function start_cod4($mod,$port,$id){


    $cod4_dir = '/home/bartz/cod4/';
    if(getcwd() != $cod4_dir){
            chdir($cod4_dir);   
    }

    $run = array(
    'sv_hostname' => 'Hire & Play No.'.$id.' by ^1CFG^7Factory.com/host/ - Free game server hiring !',
    'rcon_password' => substr(md5(uniqid()),0,5),
    'g_password' => 'war'.substr(md5(uniqid()),0,3)
    );

    exec('nohup ./cod4_lnxded +set s_num='.$id.' +set net_port '.$port.' +set dedicated 2 +set fs_game mods/'.$mod.' +set sv_punkbuster 1 +set sv_hostname "'.$run['sv_hostname'].'" +set rcon_password "'.$run['rcon_password'].'" +set g_password "'.$run['g_password'].'" +set promod_mode match_mr10 +set g_gametype sd +map '.random_map().' > /dev/null 2>&1 &');
    return $run;

}

So basically I need a PHP or either SH script that would change current working user to another.

Thanks in advance !

link|improve this question
Isn't it easier to make the file config.php only readable for root? No? Then changing the Webserver user won't solve your problem. (PHP is running under the Webserver's account!) – mailq Aug 11 '11 at 22:14
3  
Where do $mod, $port and $id come from? You don't seem to be doing any validation on them, so I'm going to go out on a limb here, and say that if you put this on a webserver, you're fucked. Exec with no validation. HELLO Blackhats! – Tom O'Connor Aug 11 '11 at 22:39
feedback

closed as off topic by Shane Madden, Tom O'Connor, Scott Pack, Zoredache, womble Aug 12 '11 at 2:02

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

1 Answer

Install sudo, and configure it to allow you to run the command as the user without a password.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.