Bug #24904
closed
Image generation broken with safe_mode on
Added by Jan Radecker over 13 years ago.
Updated over 6 years ago.
Description
Since TYPO3 4.5 - if safe_mode is on - the thumbnail generation is broken once again.
Image generation is affected by two issues formerly located at the files t3lib/class.t3lib_stdgraphic.php, t3lib/thumbs.php and t3lib/class.t3lib_div.php.
Now since TYPO3 4.5 some of the issues mentioned above are solved and some new are introduced (or moved to different file).
Related to http://forge.typo3.org/issues/24346 the use of escapeshellcmd() instead of escapeshellarg() solves an issue with safe_mode enabled PHP installations.
The faulty code now moved to file t3lib/utility/class.t3lib_utility_command.php, function imageMagickCommand().
Related to http://forge.typo3.org/issues/21609 escapeshellcmd/escapeshellarg has a problem with umlauts without having set a corresponding Locale .
Since while safe_mode is on exec() implicitly uses escapeshellcmd() the umlauts get lost if wrong or no locale is set.
Since TYPO3 4.5 a wrapper function for exec() was introduced in file t3lib/utility/class.t3lib_utility_command.php which does not set the locale at all.
The attached patch solves these two issues.
(issue imported from #M17419)
Files
Added new patch-File against trunk.
Patch sent to Core list.
You can't simply remove the lines regarding systemLocale.
Ah, I just noticed that your first patch was in the opposite direction! Looks way better the other way around ;)
Yes, that's the reason for the second patch.
At first I've accidentally made the diff in wrong direction ;)
Replacing escapeshellarg() with escapeshellcmd() can't be the definitive solution. It might fix this situation, but it will then probably (again) break paths with spaces in it (which was solved with #17489).
Linux / MacOS:
orig: /usr/bin test/convert
escapeshellarg: '/usr/bin test/convert'
escapeshellcmd: /usr/bin test/convert
Windows:
orig: C:/Program Files/ImageMagick/convert.exe
escapeshellarg: "C:/Program Files/ImageMagick/convert.exe"
escapeshellcmd: C:/Program Files/ImageMagick/convert.exe
So please also consider this use-case when trying to fix it. Thanks!
And as far I could see, this is a duplicate of #17489, so no new issue should be needed here (only adds to the confusion). :) Could we close this one and focus on both individual issues (#17489 and #17489)?
Ok. My fault.
I did not take into account that Windows would be used as a serious web server ;)
I'm trying to find a better solution to please both worlds.
Is there any progress in this? Currently we have to patch after every single TYPO3 update.
My request in Core list was rejected.
In my opinion use of escapeshellarg() for a COMMAND is the real problem here.
escapeshellarg() adds single-quote to ARGUMENTS, that's what it was thought for.
Misusing that feature for space-containing command-lines is NOT the right way.
Just because of some TYPO3-Installations on Windows with spaces in imagemagick-path (i think tis is a minority), image-generation is broken on ALL installations using safe_mode.
safe_mode is deprecated, i know, but by now, a lot of hosters still have it enabled.
- Target version deleted (
0)
Side note: With #25332 safe_mode support has been removed completely in TYPO3 4.6.
- Target version set to 4.5.3
- Target version changed from 4.5.3 to 4.5.4
- Target version changed from 4.5.4 to 4.5.6
- Target version changed from 4.5.6 to 4.5.8
- Target version changed from 4.5.8 to 4.5.12
- Status changed from Needs Feedback to Resolved
Current versions of TYPO3 do no longer support safe_mode.
- Status changed from Resolved to Closed
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by