Question

I have the following two php scripts

remove_directory.php

<?php
start_session();
$userId = $_SESSION['userId'];
exec(escapeshellcmd("rm -rf /var/www/temp/storage/$userId/"));
?>

indirectly_remove_directory.php

<?php
start_session();
exec("nohup php remove_directory.php > /var/www/temp/log.txt &"); 
?>

When I run remove_directory.php from the cgi, it works as expected, recursively removing /var/www/temp/storage/$userId/ but when I run indirectly_remove_directory.php from the cgi, it does not work as expected since it recursively removes /var/www/temp/storage/.

Why does the entire storage directory get removed when I run indirectly_remove_directory.php?

Answer 1

Because when it’s in the background, it’s a command line PHP script, which will NOT have the session cookie available that the in-webserver version does. As such, you get a brand new CLEAN session, meaning that your exec call is actually:

rm -rf /var/www/temp/storage//

because $userID is blank/null.