TYPO3 Core

How come this affects the "+profile" part if the escapeshellarg() you are refering to in the additional info is only around the CMD part? In your case it is:

/usr/bin/convert

Can you give more information on how to reproduce that?

It's not a problem with the argument but with the command itself.
escapeshellarg() adds single quotes around the command

So instead /usr/bin/gm it's now '/usr/bin/gm' including (!) single quotes.

At least with safe_mode turned on, the command is no longer valid.
The message "No such file or directory" in the error log refers to the malformed command, which is not found.

To clarify this, escapeshellarg() is simply the wrong function here because it's supposed to escape ARGUMENTS not the command.
It's better to use escapecmd() instead.

Patch is working for me fine!

Thanks!

Why doen't anybody check if everthing is working in safe_mode.
That is not the first time, that something isn't working after an update.

Jan is right. I was mislead by my solution. The escapeshellarg() just wraps around the command.

Additionally I forgot to mention that the save_mode is turned on. Thanks Jan.

@admin: maybe someone can update my initial bug report and add those.

Thanks for the patch !
This is the real problem.

Why is not resolved in 4.4.6?

Because #24281, which aims to solve this, is not fixed, yet.

There are lots of problems with different environments, esp. Windows or safe_mode enabled.

Thank you, I understand.

With TYPO3 4.5.0 the file to be patched is now: t3lib/utility/class.t3lib_utility_command.php

1. No tumbnails are generated if safe_mode is on
   Since TYPO3 4.4.5 image generation is broken if safe_mode is on.
   This was introduced with http://bugs.typo3.org/view.php?id=6001 which solves an issue with whitespace in "im_path" (which seems to be widely used on Windows).

1. No thumbnails are generated if im_path contains non-ASCII characters.
   $TYPO3_CONF_VARS['GFX']["im_path"] containing german umlauts did not work because escapeshellarg()/escapeshellcmd() strips non-ASCII character if wrong or no Locale set.

1. No thumbnails are generated for images with non-ASCII characters in filename.
   With safe_mode = on exec() calls escapeshellcmd() implicitly wich strips out non-ASCII characters if no or wrong Locale set.

For TYPO3 4.5.0 this patch (16755_TYPO3-4.5.0.patch) solves that issues by setting LC_CTYPE to the value defined in $TYPO3_CONF_VARS['SYS']['systemLocale'].
$TYPO3_CONF_VARS['SYS']['UTF8filesystem'] must be set to 1 and $TYPO3_CONF_VARS['SYS']['systemLocale'] must be set to something reasonable (like 'de_DE.UTF-8').

This patch was tested on Debian Linux 5 running PHP 5.2.6 =========================================================
$TYPO3_CONF_VARS['GFX']["im_path"] containing no whitespace AND "safe_mode = off" does work.
$TYPO3_CONF_VARS['GFX']["im_path"] containing whitespace AND "safe_mode = off" does work.
$TYPO3_CONF_VARS['GFX']["im_path"] containing no whitespace AND "safe_mode = on" does work.
$TYPO3_CONF_VARS['GFX']["im_path"] containing whitespace AND "safe_mode = on" does NOT work, but also did not work without patch - seems to be unsolvable.

This patch was tested on Windows XP running PHP 5.3.3 (XAMPP) =========================================================
$TYPO3_CONF_VARS['GFX']["im_path"] containing no whitespace AND "safe_mode = off" does work.
$TYPO3_CONF_VARS['GFX']["im_path"] containing whitespace AND "safe_mode = off" does work.
$TYPO3_CONF_VARS['GFX']["im_path"] containing no whitespace AND "safe_mode = on" does not work, but also did not work without patch - seems to be unsolvable.
$TYPO3_CONF_VARS['GFX']["im_path"] containing whitespace AND "safe_mode = on" does NOT work, but also did not work without patch - seems to be unsolvable.

With TYPO3 4.5.0 the file to be patched is now: t3lib/utility/class.t3lib_utility_command.php

Thanks a lot!
This patch saved my life!
It works perfectly now with safe mode on.

Yes i know, safe_mode support is going to be dropped with TYPO3 4.6, but for now and TYPO3 4.5 it should still be possible to use safe_mode.

Stock TYPO3 4.5.3 still does not generate images with safe_mode on (running Debian Llinux PHP 5.2 or 5.3).

Problem is still the same, the misusage of escapeshellarg() breaks correct escaping in safe_mode. See http://forge.typo3.org/issues/24904

Since my patch (http://forge.typo3.org/attachments/16792/17419.diff) was declined by the core team i do not have a better solution than to patch every new TYPO3 core over and over again...

Is this solved with #24369 maybe?

Problem was solved (at least for me) by http://forge.typo3.org/issues/24369

Image generation now does work with safe_mode turned on using Debian 5 & 6 (did not test any other OS so far).