php-windows Digest 30 Apr 2004 07:56:19 -0000 Issue 2232
Topics (messages 23601 through 23605):
Running PHP scripts as a different user
23601 by: Jason Barnett
23605 by: De Greef S�bastien
Re: Running PHP as another user
23602 by: Svensson, B.A.T. (HKG)
23603 by: Jason Barnett
PHP running as ISAPI
23604 by: Helio Rubens Kamogawa
Administrivia:
To subscribe to the digest, e-mail:
[EMAIL PROTECTED]
To unsubscribe from the digest, e-mail:
[EMAIL PROTECTED]
To post to the list, e-mail:
[EMAIL PROTECTED]
----------------------------------------------------------------------
--- Begin Message ---
It seems that several people have run into a problem where PHP did not
have permission to access certain folders / files in Windows. I have
two solutions that I have tried on WinXP, if others could verify if this
works on other Windows platforms this would be helpful.
Solution #1:
Use the function CACLS to grant PHP's user access to the file / folder
and then return permissions to normal when finished. To do this
manually use
1. Start -> Run -> cmd
2. "CACLS somefile.ext /E /G youruser:F "
3. "c:\php5\php.exe -f yourphpfile.php"
3. "CACLS somefile.ext /E /D youruser"
Since this is a shell command, I thought we could also do this from a
php script. Unfortunately, I couldn't get it to work? Here's what I
tried for those that want to give it a shot:
function switchUserExec($absfile, $user = null, $permission = 'F', $php
= 'C:/php5/php.exe') {
$absfile = escapeshellarg($absfile);
$user = escapeshellarg($user);
$permission = escapeshellarg($permission);
$php_cli = escapeshellarg($php_cli);
$com = getenv('ComSpec').' /C ';
exec("$com CACLS $absfile /E /G $user:$permission");
exec("$com $php -f $absfile", $result);
exec("$com CACLS $absfile /E /D $user");
return $result;
}
Solution #2 (suphp.bat):
@ECHO OFF
REM This is an example batch file for Windows systems running php.
REM It should enable you to run PHP from the command line as any user
REM you specify. The main reason I made this was to temporarily give
REM PHP permission to access files of a specific user. Change these
REM lines to match the user and path info for your system
SET "PHP=C:\php5\php-win.exe"
SET "USER=someuser"
SET "PHP_FILE=C:\path\to\somescript.php"
REM You *can* add the switch /savecred to save the password
REM and avoid retyping each time, not sure how secure this is?
RUNAS /user:%USER% "%PHP% -f %PHP_FILE%"
@ECHO ON
--- End Message ---
--- Begin Message ---
why don't you try runas in the exec() function ?
"Jason Barnett" <[EMAIL PROTECTED]> a �crit dans le message news:
[EMAIL PROTECTED]
> It seems that several people have run into a problem where PHP did not
> have permission to access certain folders / files in Windows. I have
> two solutions that I have tried on WinXP, if others could verify if this
> works on other Windows platforms this would be helpful.
>
>
>
> Solution #1:
> Use the function CACLS to grant PHP's user access to the file / folder
> and then return permissions to normal when finished. To do this
> manually use
> 1. Start -> Run -> cmd
> 2. "CACLS somefile.ext /E /G youruser:F "
> 3. "c:\php5\php.exe -f yourphpfile.php"
> 3. "CACLS somefile.ext /E /D youruser"
>
> Since this is a shell command, I thought we could also do this from a
> php script. Unfortunately, I couldn't get it to work? Here's what I
> tried for those that want to give it a shot:
>
> function switchUserExec($absfile, $user = null, $permission = 'F', $php
> = 'C:/php5/php.exe') {
> $absfile = escapeshellarg($absfile);
> $user = escapeshellarg($user);
> $permission = escapeshellarg($permission);
> $php_cli = escapeshellarg($php_cli);
> $com = getenv('ComSpec').' /C ';
>
> exec("$com CACLS $absfile /E /G $user:$permission");
> exec("$com $php -f $absfile", $result);
> exec("$com CACLS $absfile /E /D $user");
>
> return $result;
> }
>
>
>
>
>
> Solution #2 (suphp.bat):
>
> @ECHO OFF
> REM This is an example batch file for Windows systems running php.
> REM It should enable you to run PHP from the command line as any user
> REM you specify. The main reason I made this was to temporarily give
> REM PHP permission to access files of a specific user. Change these
> REM lines to match the user and path info for your system
>
> SET "PHP=C:\php5\php-win.exe"
> SET "USER=someuser"
> SET "PHP_FILE=C:\path\to\somescript.php"
>
> REM You *can* add the switch /savecred to save the password
> REM and avoid retyping each time, not sure how secure this is?
> RUNAS /user:%USER% "%PHP% -f %PHP_FILE%"
> @ECHO ON
--- End Message ---
--- Begin Message ---
One can also tell the IIS - provided one uses ISS - to let certain script
run as certain users when accessed with IIS. (This is probably wiser than
giving away the executing rights on individual executables - as I seen been
suggested previously - since the control on What&When will be much higher
this way.)
-----Original Message-----
From: Jason Barnett
To: [EMAIL PROTECTED]
Sent: 2004-04-29 19:03
Subject: [PHP-WIN] Running PHP as another user
It seems that several people have run into a problem where PHP did not
have permission to access certain folders / files in Windows. I have
two solutions that I have tried on WinXP, if others could verify if this
works on other Windows platforms this would be helpful.
Solution #1:
Use the function CACLS to grant PHP's user access to the file / folder
and then return permissions to normal when finished. To do this
manually use
1. Start -> Run -> cmd
2. "CACLS somefile.ext /E /G youruser:F "
3. "c:\php5\php.exe -f yourphpfile.php"
3. "CACLS somefile.ext /E /D youruser"
Since this is a shell command, I thought we could also do this from a
php script. Unfortunately, I couldn't get it to work? Here's what I
tried for those that want to give it a shot:
function switchUserExec($absfile, $user = null, $permission = 'F', $php
= 'C:/php5/php.exe') {
$absfile = escapeshellarg($absfile);
$user = escapeshellarg($user);
$permission = escapeshellarg($permission);
$php_cli = escapeshellarg($php_cli);
$com = getenv('ComSpec').' /C ';
exec("$com CACLS $absfile /E /G $user:$permission");
exec("$com $php -f $absfile", $result);
exec("$com CACLS $absfile /E /D $user");
return $result;
}
Solution #2 (suphp.bat):
@ECHO OFF
REM This is an example batch file for Windows systems running php.
REM It should enable you to run PHP from the command line as any user
REM you specify. The main reason I made this was to temporarily give
PHP PHP permission to access files of a specific user. Change these
REM lines to match the user and path info for your system
SET "PHP=C:\php5\php-win.exe"
SET "USER=someuser"
SET "PHP_FILE=C:\path\to\somescript.php"
REM You *can* add the switch /savecred to save the password
REM and avoid retyping each time, not sure how secure this is?
RUNAS /user:%USER% "%PHP% -f %PHP_FILE%"
@ECHO ON
--- End Message ---
--- Begin Message ---
B.A.T. Svensson wrote:
One can also tell the IIS - provided one uses ISS - to let certain script
run as certain users when accessed with IIS. (This is probably wiser than
giving away the executing rights on individual executables - as I seen been
suggested previously - since the control on What&When will be much higher
this way.)
I do like that much better than what I've whipped out... however, I
don't use IIS :-/ Solution #1 below would really only be useful to me
if I could get PHP to do it all within a user-defined function. Now I
am no IIS guru, but I'd be willing to bet that it works something like
Solution #2 below (but perhaps they use the actual script name in the
RUNAS call instead of the executable?).
Specifically, does anyone here know exactly how Windows determines
permissions for PHP (e.g. does it check PHP executable permission, then
script's permissions, etc.?)
-----Original Message-----
From: Jason Barnett
To: [EMAIL PROTECTED]
Sent: 2004-04-29 19:03
Subject: [PHP-WIN] Running PHP as another user
It seems that several people have run into a problem where PHP did not
have permission to access certain folders / files in Windows. I have
two solutions that I have tried on WinXP, if others could verify if this
works on other Windows platforms this would be helpful.
Solution #1:
Use the function CACLS to grant PHP's user access to the file / folder
and then return permissions to normal when finished. To do this
manually use
1. Start -> Run -> cmd
2. "CACLS somefile.ext /E /G youruser:F "
3. "c:\php5\php.exe -f yourphpfile.php"
3. "CACLS somefile.ext /E /D youruser"
Since this is a shell command, I thought we could also do this from a
php script. Unfortunately, I couldn't get it to work? Here's what I
tried for those that want to give it a shot:
function switchUserExec($absfile, $user = null, $permission = 'F', $php
= 'C:/php5/php.exe') {
$absfile = escapeshellarg($absfile);
$user = escapeshellarg($user);
$permission = escapeshellarg($permission);
$php_cli = escapeshellarg($php_cli);
$com = getenv('ComSpec').' /C ';
exec("$com CACLS $absfile /E /G $user:$permission");
exec("$com $php -f $absfile", $result);
exec("$com CACLS $absfile /E /D $user");
return $result;
}
Solution #2 (suphp.bat):
@ECHO OFF
REM This is an example batch file for Windows systems running php.
REM It should enable you to run PHP from the command line as any user
REM you specify. The main reason I made this was to temporarily give
PHP PHP permission to access files of a specific user. Change these
REM lines to match the user and path info for your system
SET "PHP=C:\php5\php-win.exe"
SET "USER=someuser"
SET "PHP_FILE=C:\path\to\somescript.php"
REM You *can* add the switch /savecred to save the password
REM and avoid retyping each time, not sure how secure this is?
RUNAS /user:%USER% "%PHP% -f %PHP_FILE%"
@ECHO ON
--- End Message ---
--- Begin Message ---
Hi!
I am setting up a windows 2003 machine, with IIS 6 and PHP 4.3.6. I've
followed the instructions on php.net to install php as CGI or ISAPI.
I had creepy experiences with PHP running as ISAPI on W2k and IIS 5. I
had a lot of GPFs and Internal Server Errors even on ASP apps. A lot of
people is using php as isapi and don't have any problem.
I currently use PHP as CGI on win2k, but, because the architeture of
windows2003, I have permissions problems ( 403 - Forbidden ). I 've
granted permissions on c:\inetpub\wwwroot\<user>; c:\php ;
c:\windows\php.ini to the following users:
<user>
worker_<user> ( app pool identity )
IUSR_<user ( anon. IIS user )
Php only works as CGI when I set the identity of the app. pool to Local
System / Network, but in a shared enviroment, it's not acceptable.
My questions are:
- Is php 4.3.6 running ISAPI stable enough to run in a enviroment with
more than 400 sites?
- If I want to use php as CGI, which folders should I grant permissions?
Regards,
Helio
--- End Message ---
