Ok, how dangerous is shell_exec really?

jols

Well-Known Member
Mar 13, 2004
1,107
3
168
Apparently Fantastico can not un-install a package if shell_exec is switched off.

No we do not phpsuexec installed.

Yes, we do have open_basedir restrictions enabled, along with many other security features.


Should I be concerned about switching on shell_exec just so our Fantastico users can do their un-installs?
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,437
33
473
Go on, have a guess
It's up to you to judge the benefits against the disadvantages. Turning the function off helps protect vulnerably/poorly coded PHP web scripts installed on the server, especially in a non-phpsuexec/suphp environment. The advantage of not disabling it is that fantastico functions. If you'd prefer to leave it disabled, I'd suggest lobbying netenberg.com to code their removal scripts using php functions instead of relying on shell.
 

mrprez

Well-Known Member
Jun 14, 2002
93
0
166
Another advantage is that users will be more likely to remove unwanted scripts rather than leaving them sit there not being used or updated. This to me causes more security issues than having shell_exec activated.
 

jols

Well-Known Member
Mar 13, 2004
1,107
3
168
Isn't it possible to switch on shell_exec just for Fantastico?
I only wish this were the case.

Netenberg says that you must switch shell_exec on for the entire server just so Fantastico can un-install packages. IMO this is by far the worst thing about Fantastico.
 

brianoz

Well-Known Member
Mar 13, 2004
1,146
7
168
Melbourne, Australia
cPanel Access Level
Root Administrator
That sounds like a generic answer, I'd want to dig further. As far as I know the version of PHP that runs for WHM is a different binary? Maybe it runs as mod_php? If so, you could use a .htaccess file and php_flag settings to enable shell_exec. If not, you could probably add a php.ini file somewhere else.
 

Infopro

Well-Known Member
May 20, 2003
17,076
521
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
I only wish this were the case.

Netenberg says that you must switch shell_exec on for the entire server just so Fantastico can un-install packages. IMO this is by far the worst thing about Fantastico.
Well, that's not exactly what they said to you.


http://www.netenberg.com/forum/index.php?topic=6132.0


Can you enable phpsuexec? Is this an option?

or use suphp.

without one of those enabled, fantasico cannot reliably remove scripts that it has installed. If you wish to leave the exec feature disabled, you should be prepared to help your users manually remove scripts when they are done with them.

Regards,
Either suggestion sound like sound ideas to me.

And I agree with MaraBlue in that thread. No problems here to speak of. (so far to date)