0

I have real problems getting this PHP-script "search.php" that is called from a "form.htm" to work. What am I doing wrong here?

<?php
   $old_path = getcwd();
   chdir('/var/www/html/SOKHJALPMEDEL/');
   $term1 = $_POST['query1'];
   $argument1 = $_GET['$term1'];
   $term2 = $_POST['query2'];
   $argument2 = $_GET['$term2'];
   echo $nu_kor_vi1;
   $outcome = shell_exec("sokare $argument1 $argument2");
   chdir($old_path);
   echo "<pre>$outcome</pre>";
?>

The script is calling a Bash-script "sokare" that is executable systemwide and residning in "/usr/local/bin". The variables $argument1 and $argument2 are passed from the "form.htm" via $term1 = $_POST['query1']; and $term2 = $_POST['query2']; . The Bash-script looks like this. It is supposed to search any PDF-files residing in "/var/www/html/SOKHJALPMEDEL/" for pages containing both searchwords.

#!/bin/bash

pdfgrep -Hn $1 /var/www/html/SOKHJALPMEDEL/*.pdf | cut -f1,2 -d':' > /tmp/sok1.tmp
pdfgrep -Hn $2 /var/www/html/SOKHJALPMEDEL/*.pdf | cut -f1,2 -d':' > /tmp/sok2.tmp
grep -f /tmp/sok1.tmp /tmp/sok2.tmp

exit 0

I keep on getting this error in "/var/log/apache2/error.log" : PHP Notice: Undefined index: $term2 in /var/www/html/SOKHJALPMEDEL/search.php on line 7, referer: http://localhost/SOKHJALPMEDEL/form.htm

Any help clearing my mess up is beautiful:-)

/Paul

  • A quick thought is i'd var_dump() $_POST, as it looks like $term2 is empty. – djsmiley2k - CoW Sep 14 '16 at 13:32
  • Please be aware that there are serious security risks with this code! Anyone would be able to arbitrarily read files and execute commands on your system. You should not directly pass arguments from the client (GET and POST) to the command line, but use regular expressions or some other mechanism to check if they arguments the clients sends make sense. (anyone who uses a ; in the GET will be able to execute other commands), see owasp.org/index.php/Command_Injection (Example 6) – mtak Sep 14 '16 at 13:53
  • It seems like the basic problem is how to make a PHP-variable become a combination of two other PHP-variables, something like "var3 = var1 && var2", so that "var3" could be used as arguments to the script "sokare $1 $2" where "var3" contains "$1", then a space, followed by "$2". – Paul Bergström Sep 14 '16 at 14:03
  • I tried to make a variable equal to "echo" something, such as $var3 = exec("echo $var1 $var2"); , but it doesn't seem to work. – Paul Bergström Sep 14 '16 at 14:05
0

Here is a working script doing what I wanted:

<?php
   $old_path = getcwd();
   chdir('/var/www/html/SOKHJALPMEDEL/');
   $term1 = $_POST['query1'];
   $term2 = $_POST['query2'];
   ob_start();
   echo "{$term1} {$term2}";
   $var = ob_get_clean();
   $outcome = shell_exec("/usr/local/bin/sokare $var");
   chdir($old_path);
   echo "<pre>$outcome</pre>";
?>

The key to get the functionality I was looking for is this piece of code:

ob_start();
echo "{$term1} {$term2}";
$var = ob_get_clean(); 

This creates the variable $var which is used as the argument $1 and $2 used by the Bash-script.

/Paul

  • Please tell us why you made the changes that you did, it helps future readers understand the solution better. – cascer1 Sep 15 '16 at 9:52
  • I will try. ob_start(); echo "{$term1} {$term2}"; $var = ob_get_clean(); – Paul Bergström Sep 15 '16 at 10:15
  • please edit your answer to motivate the changes – cascer1 Sep 15 '16 at 10:16
  • Is there any reason why $var = "{$term1} {$term2}" would not work? Besides that it's still some dangerous piece of code as you're still not checking the contents. Beware that you could also omit query1 or query2 and you would get an error similar to the one you had in your initial post. – Seth Sep 15 '16 at 12:52
  • Seth, you are correct; $var = "{$term1} {$term2}" does work. I'm not a PHP guru. I'm just happy I had it working:-) – Paul Bergström Sep 15 '16 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.