Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on suPHP. I am assuming you use it exactly like PHP and it magically knows to run all scripts as the owner of that script.
I am creating a dynamic website which lets users upload scripts and execute them. Right now this is limited to javascript but I want to also allow them to execute serverside PHP scripts. As the default Apache user is www-data
, I want to use suPHP. My idea is to create an intermediate script, lets call it load.php
, which takes as an argument the user's target script, lets call it target.php
. load.php
then checks to see if the user owns target.php
, and if they do, launches target.php
.
But then what's to stop the user from within target.php
issuing a command like (I am not sure if this example is accurate as I can't find any documentation on suPHP).
shell_exec("suphp /home/someOtherUser/test.php");
Does suPHP need a user's password to execute these scripts?
Janne Pikkarainen pointed out that suPHP starts as root, then switches to the owner of a file before executing it. So now I have two questions.
- If the PHP script that's executed by suPHP (as the owner, lets call him user1) in turn contains
shell_exec("php /home/user2/test.php");
, will this return an error since user1 is trying to launch user2's script, or will suPHP kick in again and change from user1 to user2. - what's to stop user1 from executing javascript/HTML code such as
<form action="/home/user2/test.php" method="get">
?