Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix error when calling shell script from browser #2674

Merged
merged 2 commits into from
Jan 13, 2023

Conversation

Caprico85
Copy link
Contributor

Description (*)

Running a shell script from browser may cause the PHP warning Undefined array key "argv". This happens because shell/abstract.php tries to read $_SERVER['argv'] without checking if it exists. $_SERVER['argv'] is not set when a script is run from browser.

I know running a shell script from browser doesn't make much sense and trying it will result in the message This script cannot be run from Browser. This is the shell script.. But nonetheless, the script should exit gracefully and not trigger a PHP warning.

Manual testing scenarios (*)

  1. Open http://example.com/shell/indexer.php or any other shell script in your browser. Depending on your server settings you will see the warning.

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All automated tests passed successfully (all builds are green)
  • Add yourself to contributors list

@github-actions github-actions bot added the shell Relates to shell scripts label Nov 4, 2022
luigifab
luigifab previously approved these changes Nov 10, 2022
@sreichel
Copy link
Contributor

Why not

if (!isset($_SERVER['argv'])) {
    return $this;
}

@Caprico85
Copy link
Contributor Author

Okay, maybe a bit more readable. I updated my PR.

I changed !isset to empty, so it also returns early when no parameters are given.

@justinbeaty
Copy link
Contributor

justinbeaty commented Jan 13, 2023

I am not sure empty is correct. What about a custom shell script that extends the abstract class, but has no arguments?

edit: maybe not actually a problem since the script name is in argv as well IIRC.

@fballiano
Copy link
Contributor

@justinbeaty I created a script and the run() method works correctly also with this patch, so I think the "empty" is not a problem in this context

@fballiano
Copy link
Contributor

but actually... htaccess forbids to call shell/*.php from browser... so do we need this?

@justinbeaty
Copy link
Contributor

I read it more carefully and see that it wouldn't cause any problems.

Regarding htaccess, I suppose it still doesn't hurt in case someone has a misconfigured server.

@fballiano fballiano merged commit 342e78c into OpenMage:1.9.4.x Jan 13, 2023
@fballiano
Copy link
Contributor

merged and cherrypicked to v20

@Caprico85 Caprico85 deleted the Caprico85-patch-1 branch November 13, 2023 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
shell Relates to shell scripts
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants