2016-11-11 Patch for PHP 5.6.28 released. 2016-11-04 Patch for PHP 5.6.27 released. 2016-09-19 Patch for PHP 5.6.26 released. 2016-09-06 Patches for PHP 5.6.23, 5.6.24, 5.6.25, 5.5.37 and 5.5.38 released. 2016-05-31 Patches for PHP 7.0.7, 5.6.22 and 5.5.36 released. 2016-04-29 Patches for PHP 7.0.6, 5.6.21 and 5.5.35 released. 2016-04-01 Patches for PHP 7.0.5, 5.6.20 and 5.5.34 released. 2016-03-11 Patches for PHP 7.0.4, 5.6.19 and 5.5.33 released.

Progamming language PHP allows one to limit executing of external commands via configuration directive safe_mode_exec_dir. This directive should contain full path to a directory conatining programs which PHP script can run. If the script tries to execute a command not located in this directory, the command is not executed. This configuration directive is active only if safe mode is enabled, which means more and sometimes unwanted restrictions to users. PHP has no known possibility to limit executing of external commands with disabled safe mode. Teherefore, here is a patch adding special directive exec_dir straightly into PHP. This directive is very similar to safe_mode_exec_dir, but safe mode has not to be enabled. This patch limits or corrects the behavior of these functions: exec() passthru() proc_open() shell_exec() system() popen() is_executable() The patch was created for purposes of limit execution of external commands of users on a multidomain apache server, first for PHP version 4.2.1. The patch was sent to PHP developers so it could be a part of PHP, but no one of PHP developers was interested in. On the other side, some PHP users wanted this patch, therefore this site was created. Note: The message to the PHP-DEV mailing list has been sent on 2002-06-21.

This patch modifies PHP source, so first of all you need the PHP source, download it from from official PHP site. After unpacking the archive, step into the directory witch PHP unpacked and apply the patch:

If everything went OK, you should see output similar to this one:

Now you have to compile and install the PHP as usual.

All you have to do is set the directive exec_dir. You can do this in php.ini or in configuration files of http server Apache. Beacause of some security reasons, this variable cannot be changed while running PHP script. The directive should contain full path to an existing directory which contains files or symlinks to files which can be executed.

For example, let's imagine a server with http Apache server, which serves 2 virtuals: virtual1.tld and virtual2.tld, each of these being maintained by other person. Maintainer of virtual1.tld wants to execute cp, rm and mv, maintainer of virtual2.tld wants to execute mysqldump. The most clean solution now is to create one directory for virtual1.tld, i.e. /usr/local/php/bin/virtual1.tld and place binaries cp, rm and mv into it (or create symlinks to them). Similary we should create /usr/local/php/bin/virtual2.tld with mysqldump in it. Of cource it is better to create symlinks than to copy raw files, because of upgrades. Now we have to configure Apache:

A bit more simple is to create one directory for whole server containing trusted commands. In our example we can create directory /usr/local/php and place (or create symlinks) cp, mv, rm and mysqldump in it. Now it is enough to edit the php.ini file, where should be this line:

Now we have to describe how the executing works. The name of the command to be executed will be modified, first it will be shorted: only characters behind last occurence of '/' will rest. Before this new command name, the contents of exec_dir will be placed. For example, if we call /bin/cp and directive exec_dir conatins /usr/local/php, the command /bin/cp will be modified to cp and then to /usr/local/bin/cp. This command will be executed.

PHP behavior is influenced by these settings:

• if the exec_dir directive is not set or is set to an empty string, functions exec(), popen() etc. are running without any restrictions
• if safe mode is enabled and safe_mode_exec_dir is set, exec_dir is ignored
• if exec_dir is set, the called command cannot contain strings ".." and ";", similar functionality offers safe_mode_exec_dir

If you want to disable exec_dir in a directory for any reason, just set the value of the directive to none:

Select PHP version: 7.0.77.0.67.0.57.0.47.0.37.0.27.0.17.0.05.6.285.6.275.6.265.6.255.6.245.6.235.6.225.6.215.6.205.6.195.6.185.6.175.6.165.6.155.6.145.6.135.6.125.6.115.6.105.6.95.6.85.6.75.6.65.6.55.6.45.6.35.6.25.6.15.6.05.5.385.5.375.5.365.5.355.5.345.5.335.5.325.5.315.5.305.5.295.5.285.5.275.5.265.5.255.5.245.5.235.5.225.5.215.5.205.5.195.5.185.5.175.5.165.5.155.5.145.5.135.5.125.5.115.5.105.5.95.5.85.5.75.5.65.5.55.5.45.5.35.5.25.5.15.5.05.4.455.4.445.4.435.4.425.4.415.4.405.4.395.4.385.4.375.4.365.4.355.4.345.4.335.4.325.4.315.4.305.4.295.4.285.4.275.4.265.4.255.4.245.4.235.4.225.4.215.4.205.4.195.4.185.4.175.4.165.4.155.4.145.4.135.4.125.4.115.4.95.4.85.4.75.4.65.4.55.4.45.4.35.4.25.4.15.4.05.3.295.3.285.3.275.3.265.3.255.3.245.3.235.3.225.3.215.3.205.3.195.3.185.3.175.3.165.3.155.3.145.3.135.3.125.3.115.3.105.3.95.3.85.3.75.3.65.3.55.3.45.3.35.3.25.3.15.3.05.2.175.2.165.2.155.2.145.2.135.2.125.2.115.2.105.2.95.2.85.2.75.2.65.2.55.2.45.2.35.2.25.2.15.2.05.1.65.1.55.1.45.1.35.1.25.1.15.1.05.0.55.0.45.0.35.0.25.0.15.0.04.4.94.4.84.4.74.4.64.4.54.4.44.4.34.4.24.4.14.4.04.3.114.3.104.3.94.3.84.3.74.3.64.3.54.3.44.3.34.3.2

PHP version:
Date:
Size:
MD5:
Direct link:

There are no known bugs at this moment. If you have exec_dir set to some directory and you will execute command out of it, please let me know at mccohy@kyberdigi.cz.

2014-03-10

Martijn Grendelman requested fix of bug reported on 2012-08-22, mainly because Debain Weezy is shipped with PHP 5.4.4. Patches have been fixed, you can now download valid files.

2012-08-22

Manuel Mausz has discovered a bug in versions 5.4.0 - 5.4.4 inclusive. Bad placing of a new block into original code made some functions (file_exists, is_executable etc.) to return false unless these tested files were placed in directory defined in the exec_dir directive. Thanks for reporting and an attached patch. Please upgrade to version 5.4.5 or higher.

2011-01-03

Antihack000 informed, that calling of PHP function proc_open() completely ignores any value set in variable exec_dir. This bug was fixed in patches for versions 5.2.15 and higher. If you are using lower version, please upgrade.

2008-03-16

Possible memory leak has been found by Manuel Mausz. He also sent a patch for exec_dir patch solving the issue (thanks!). All versions of the exec_dir patch bellow 5.2.11 include the leak, so please upgrade to 5.2.11, patch for this version is secure.

2004-08-16

A minimalistic bug about disabling exec_dir has been discovered by myself. If you want to disable the exec_dir in (i.e.) httpd.conf, you have to add this line somewhere:

Although you set it so, it does not disable the usability of exec_dir, but it tries to run binaries as if they were in the root directory of the filesystem (/ls, /df etc.). If you are in trouble with this, please download new patch for your version of PHP. All patches listed in section download are correct ones, so check the MD5 of the patch you have to those in the list. Vulnerable versions: 4.3.2 - 4.3.8 (inclusive), 5.0.0 and 5.0.1. This is not a really dramatical bug you should really worry about.

2004-06-24

VeNoMouS reported that you can execute commands out of specified directories if you prepend a ';', '|', '&' or may other ugly character to the beginning of the command and try to execute it with the backtick operator. In original safe_mode_exec_dir the backtick operator is turned off, in this patch it is not. Therefore, all the patches listed here were updated with a simple fix that escapes these and other characters the same way as other commands (as exec() or popen()) do. You are strongly encouraged to download new patch for your version of PHP. The patches listed in section download are correct ones, so check the MD5 of the patch you have to those in the list. All version from 4.3.2 to 4.3.7 (inclusive) were vulnerable.