Bug #24904: Image generation broken with safe_mode on - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #24904

closed

Image generation broken with safe_mode on

Added by Jan Radecker about 13 years ago. Updated over 6 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

4.5.12

Start date:

2011-01-31

Due date:

% Done:

Estimated time:

TYPO3 Version:

4.5

PHP Version:

5.2

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

Since TYPO3 4.5 - if safe_mode is on - the thumbnail generation is broken once again.

Image generation is affected by two issues formerly located at the files t3lib/class.t3lib_stdgraphic.php, t3lib/thumbs.php and t3lib/class.t3lib_div.php.
Now since TYPO3 4.5 some of the issues mentioned above are solved and some new are introduced (or moved to different file).

Related to http://forge.typo3.org/issues/24346 the use of escapeshellcmd() instead of escapeshellarg() solves an issue with safe_mode enabled PHP installations.
The faulty code now moved to file t3lib/utility/class.t3lib_utility_command.php, function imageMagickCommand().

Related to http://forge.typo3.org/issues/21609 escapeshellcmd/escapeshellarg has a problem with umlauts without having set a corresponding Locale .
Since while safe_mode is on exec() implicitly uses escapeshellcmd() the umlauts get lost if wrong or no locale is set.
Since TYPO3 4.5 a wrapper function for exec() was introduced in file t3lib/utility/class.t3lib_utility_command.php which does not set the locale at all.

The attached patch solves these two issues.
(issue imported from #M17419)

Files

17419.diff (1.32 KB) 17419.diff

Administrator Admin, 2011-01-31 13:52

Related issues 3 (0 open — 3 closed)

Actions

Copy link

Updated by Chris topher about 13 years ago

Hi Jan,

thanks for your patch!

To get your patch integrated, please send it to the Core List!
Check out http://typo3.org/teams/core/core-mailinglist-rules/

Actions

Copy link

Updated by Jan Radecker about 13 years ago

Added new patch-File against trunk.
Patch sent to Core list.

Actions

Copy link

Updated by Steffen Gebert about 13 years ago

You can't simply remove the lines regarding systemLocale.

Actions

Copy link

Updated by Steffen Gebert about 13 years ago

Ah, I just noticed that your first patch was in the opposite direction! Looks way better the other way around ;)

Actions

Copy link

Updated by Jan Radecker about 13 years ago

Yes, that's the reason for the second patch.
At first I've accidentally made the diff in wrong direction ;)

Actions

Copy link

Updated by Ernesto Baschny about 13 years ago

Replacing escapeshellarg() with escapeshellcmd() can't be the definitive solution. It might fix this situation, but it will then probably (again) break paths with spaces in it (which was solved with #17489).

Linux / MacOS:
orig: /usr/bin test/convert
escapeshellarg: '/usr/bin test/convert'
escapeshellcmd: /usr/bin test/convert

Windows:
orig: C:/Program Files/ImageMagick/convert.exe
escapeshellarg: "C:/Program Files/ImageMagick/convert.exe"
escapeshellcmd: C:/Program Files/ImageMagick/convert.exe

So please also consider this use-case when trying to fix it. Thanks!

And as far I could see, this is a duplicate of #17489, so no new issue should be needed here (only adds to the confusion). :) Could we close this one and focus on both individual issues (#17489 and #17489)?

Actions

Copy link

Updated by Jan Radecker about 13 years ago

Ok. My fault.
I did not take into account that Windows would be used as a serious web server ;)

I'm trying to find a better solution to please both worlds.

Actions

Copy link

Updated by Juergen Weber about 13 years ago

Is there any progress in this? Currently we have to patch after every single TYPO3 update.

Actions

Copy link

Updated by Jan Radecker about 13 years ago

My request in Core list was rejected.

In my opinion use of escapeshellarg() for a COMMAND is the real problem here.

escapeshellarg() adds single-quote to ARGUMENTS, that's what it was thought for.

Misusing that feature for space-containing command-lines is NOT the right way.

Just because of some TYPO3-Installations on Windows with spaces in imagemagick-path (i think tis is a minority), image-generation is broken on ALL installations using safe_mode.

safe_mode is deprecated, i know, but by now, a lot of hosters still have it enabled.

Actions

Copy link

#10