1

I apologize ahead of time if this question is really basic. My background is in Windows and I am being asked to maintain a RedHat Linux server that is in bad shape and is in production use.

The issue is that the version of PHP is different when executed from a script in Apache vs. the command line.

For example:

From the command line:

enter image description here

From the web page (Apache):

enter image description here

From the a php script called by a web page:

enter image description here

The script is called by this php code and function:

$exec_result = sku_exec(CLIMPORT.FILE_NAV, '', $_POST['nav_skus']);

function sku_exec($file_path, $call, $args)
{
    $exe = $file_path.' ';
    if($call != '' && isset($call) && $call) $exe .= $call.' ';
    $exe .= $args;
//  echo $exe.'<hr />';
    exec('php '.$exe, $return_data);
    return $return_data;
}

I need to downgrade the script to use 5.2.9 instead of 5.4.1.

Where do I even start to look for how this is configured? Why would the version of PHP that Apache is using be different from the version that it is calling from a script?

I looked at Apache’s config file but did not see anything that jumped out at me.

Any suggestions?

Unfortunately, upgrading the server to the latest PHP is not an option at the moment. The plan is to build out a new server and migrate to it.

Improve this question
7
  • Show us the code from the web page that's calling the php script(!?!).
    – womble ♦
    Jul 6, 2012 at 17:32
  • I am beginning to think that this has to do with the account that Apache is running under vs. the account I use for testing
    – rboarman
    Jul 6, 2012 at 18:04
  • 1
    So it'll be a path or binary naming issue (you didn't indicate what command you ran to get the version information in your initial question). Since you've got no Linux skills, you might have an uphill battle tracking this one down, but at the very least run find / -name php to see what different PHP binaries there are on the system. And if you know who wrote that bit of code, do us all a favour and beat them with a stick until they agree to change careers to flower arranging or something.
    – womble ♦
    Jul 6, 2012 at 18:41
  • 1
    This is somewhat unrelated to your question, but the code snippet you've posted contains a classic Command Line Injection vulnerability. You're taking user input directly from a web-based form via the $_POST['nav_skus'] variable, and then you're calling exec('php '.$exe, $return_data) (which contains the value of the $_POST input) later on without actually sanitizing the data first.
    – kmit
    Jul 6, 2012 at 19:12
  • @womble I used find and was able to locate more than ten php binaries. What a mess. The engineer responsible for this mess has long since changed careers.
    – rboarman
    Jul 6, 2012 at 21:20

1 Answer 1

Reset to default
0

Run which php from CLI and add the path to the script so that you are running exec('/path/to/the/cli/php. Should your user be so restricted to not be able to run which (that'd be seriously messed up): the user running the command line has a different environment and so a different PATH to what the user has. The PATH variable, if I remember correctly although it was long ago, exists even in DOS. So take the values in PATH (echo $PATH) and manually check which dir contains a file called php. That's what which does, anyways.

You badly need to read some basic Linux book if this is now your job.

Improve this answer
4
  • My job is really to keep the thing alive until I can migrate a copy to a new environment. I plan on hiring someone to help.
    – rboarman
    Jul 6, 2012 at 20:19
  • The root account has been disabled but I can run sudo bash which seems to be good enough so far.
    – rboarman
    Jul 6, 2012 at 20:22
  • I changed the exec('php'... code to exec('php5'...) and it seems to have worked. Any downsides to this change?
    – rboarman
    Jul 6, 2012 at 21:19
  • @rboarman: That would seem like the least-worst option to fix the immediate problem, under the circumstances.
    – womble ♦
    Jul 7, 2012 at 2:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .