Question

I have a web application which runs FontForge shell commands using shell_exec() in PHP. I’m worried about potential concurrency issues. Is there a way to make shell_exec() open a unique instance for each user?

One of the commands allows users to convert fonts from one file format to another:

$command = "fontforge -c 'Open($1); Generate($2)' ".$format1." ".$format2;
shell_exec($command);

I’m worried that if USER A opens FONT A and USER B immediately opens FONT B (before the Generate() command for USER A is called), then USER A would mistakenly receive FONT B, since FONT B is currently the ‘open’ font.

Answer 1

You not only have to worry about two users colliding but also one user colliding with himself via multiple requests.

To try and force one font action request per user, you could create pid-like files (but using user id instead of the process id) or you could create a queue of requests (e.g., in a database table) and have a daemon periodically check this queue (setting the working column to 1) for requests by a particular user. Couple this with unique temp working directories per user and collisions will be unlikely.

Either approach has the potential for getting “stuck” (process ends before it can clear the mechanism). This can be combatted by having the daemon process clear the working flags upon its restart.

If you’re not worried about simultaneous requests (via policy) and simply want to avoid collisions, you can forgo any daemons and have your PHP script copy the font files into a newly created uniquely named folder for each request, then copy the resulting font out of it upon completion.