upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-15 22:11:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

Use proc_open to avoid spawning a shell

Browse source 
The use of `exec` will spawn a shell, using `/bin/sh` on POSIX platforms. But in restricted environment, such as AppArmor, this means giving execution to `/bin/sh`, which renders the execution restriction quite useless.
Using an array with `proc_open` reduces this, and paved the way for file streaming instead of temporary file.

Signed-off-by: Glandos <bugs-github@antipoul.fr>
This commit is contained in:
Glandos 2023-02-15 23:37:13 +01:00 committed by GitHub
parent b36a31c918
commit 528e66859b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
lib/private/Preview/Movie.php
View file

@ -125,23 +125,30 @@ class Movie extends ProviderV2 {
$binaryType = substr(strrchr($this->binary, '/'), 1);
if ($binaryType === 'avconv') {
$cmd = $this->binary . ' -y -ss ' . escapeshellarg((string)$second) .
' -i ' . escapeshellarg($absPath) .
' -an -f mjpeg -vframes 1 -vsync 1 ' . escapeshellarg($tmpPath) .
' 2>&1';
$cmd = [$this->binary, '-y', '-ss', (string)$second,
'-i', $absPath,
'-an', '-f', 'mjpeg', '-vframes', '1', '-vsync', '1',
$tmpPath];
} elseif ($binaryType === 'ffmpeg') {
$cmd = $this->binary . ' -y -ss ' . escapeshellarg((string)$second) .
' -i ' . escapeshellarg($absPath) .
' -f mjpeg -vframes 1' .
' ' . escapeshellarg($tmpPath) .
' 2>&1';
$cmd = [$this->binary, '-y', '-ss', (string)$second,
'-i', $absPath,
'-f', 'mjpeg', '-vframes', '1',
$tmpPath];
} else {
// Not supported
unlink($tmpPath);
return null;
}
exec($cmd, $output, $returnCode);
$proc = proc_open($cmd, [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
$returnCode = -1;
$output = "";
if (is_resource($proc)) {
$stdout = trim(stream_get_contents($pipes[1]));
$stderr = trim(stream_get_contents($pipes[2]));
$returnCode = proc_close($proc);
$output = $stdout . $stderr;
}
if ($returnCode === 0) {
$image = new \OCP\Image();