PHP's "exec()" function no longer works for our project ("confluence")

Help
1

Since the recent changes, I find that the PHP “exec()” function no longer works. For example:

$command = “date”;
$result = exec( $command, $output, $retval );
echo “result:”.print_r($result)."
";
echo “output:”.print_r($output)."
";
echo “retval:”.print_r($retval)."
";

outputs:

result:1
output:1
retval:1

whereas on a system with a working “exec()”, the output should be something like:

Wed Sep 30 14:31:48 PDT 2020result:1
Array ( [0] => Wed Sep 30 14:31:48 PDT 2020 ) output:1
0retval:1

2

You can see an example of this problem by visiting http://confluence.org/rsf-test.php
This page uses the PHP script:

$result = exec(“date”, $output, $retval);
echo “result:”.print_r($result).", output:".print_r($output).", retval:".print_r($retval);

The output is:
result:1, output:1, retval:1

The output should look like:
Thu Oct 1 17:28:04 PDT 2020Array ( [0] => Thu Oct 1 17:28:04 PDT 2020 ) 0result:1, output:1, retval:1

3

In recovering from the first major outage we experienced this Summer, we worked closely with other campus IT units, one of which was Security. We made several assurances to them, a consequence of which is that, as a rule, exec() will not be available for any PHP based projects on any of the backends we provide moving forward. We are happy to collaborate on workarounds or special accommodations, but those are best handled in a private ticket. Since you have one currently open in RT, let’s cover that there. If others read this and find it applies to them, I urge them to either reply here so we can open an RT ticket on their behalf, or simply open an RT ticket directly describing how the disabling of exec() impacts their site.

4

Yes, we’re going to need an exemption from this rule for our project (“confluence”).

To reassure you about this: The “exec()” functionality is used only by our project’s administrators, when managing the site - not by the general public (when visiting the site casually). Our administrators (just a handful of users) are authenticated by the site; they are the only people who are able to run PHP scripts that call “exec()” (these scripts ensure that only administrators can run them). The general public will not be able to run PHP scripts that call “exec()”.

5

Any update on this? As I noted earlier, we need “exec()” (again, for some of our administrative functions, not on pages visited by the general public).

6

Fortunately we were able to implement a ‘work around’, so that we no longer need to call “exec()” from our scripts. So, I withdraw my request.