1

Can anyone of you tell me why this doesn't work?
When i open the file doesnt run anything :(

This is my php file:

<!DOCTYPE html>
<html>
    <head>
        <title>Restarter V1.0</title>
        <meta charset="UTF-8">
    </head>
    <body>
        <?php       
            #Function Declaration
            function testpy() {
                exec("sudo python /var/www/html/reboot.py"); #just executes "reboot now"
            }

            #Get 'gotbut'
            if (isset($_GET['gotbut'])) {
                testpy();
            }
        ?>
        <script>
            window.close(); <!--When i open it from my index.php-->
        </script>
    </body>
</html>

I have also added a line in my "/etc/sudoers" file with the following:

www-data ALL=(ALL) NOPASSWD: ALL

Please help :D
Thanks!

Improve this question
4
  • Have you checked your Apache/Web server logs to see what error it is getting?
    – Ian M
    Oct 20 '16 at 9:47
  • No where is it located? (i am pretty new to those things)
    – dnorhoj
    Oct 20 '16 at 9:48
  • If you are running apache2 /var/log/apache2/error.log
    – Ian M
    Oct 20 '16 at 9:48
  • thanks, it says: [Thu Oct 20 09:27:45.015801 2016] [:error] [pid 743] [client 192.168.0.19:55998] PHP Notice: Undefined index: closetab in /var/www/html/index.php on line 21, referer: http://192.168.0.13/?closetab=1
    – dnorhoj
    Oct 20 '16 at 9:49
1

I see no reason for your configuration not to work, so I expect there's a silly problem sitting somewhere. I suggest you add the following lines to the <body> of your index.php:

<?php
    echo "Current user is: " . get_current_user();
    echo "Command output is " . shell_exec("sudo python /var/www/html/reboot.py");
?>

Hopefully the HTML output you'll get will provide enough insight into the problem you're having.

Aslo note that it's much more secure to have www-data ALL=NOPASSWD: /path/to/reboot.py in sudoers, and locate the script in a place where your webserver doesn't have persmissions to replace it with whatever hackers will manage to upload. Otherwise you risk letting people executing random python code on your RPi with root permissions.

Improve this answer
1
  • Thanks! It worked! I did somehow change the user that php runs on, and then i gave that user perms ;D
    – dnorhoj
    Oct 20 '16 at 10:58
0

Pls dont give the php user perms to sudo. This is a highly security risk. The propper way is to add the file to your php config.

php_admin_value[open_basedir] = "/var/www/html/reboot.py:/usr/share/pear:/usr/share/php:/tmp:/usr/local/lib/php"

should look like this. In case you use fpm add this just to your pool config file.

Improve this answer
1
  • 1
    Could you explain how restricting PHP paths allows to use reboot without sudo?
    – Dmitry Grigoryev
    Oct 21 '16 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.