execute Python3 file with Sudo using PHP

Question

hey guy how can i sudo execute a python3 script with PHP? i tried:

exec("sudo -E python3 /var/www/html/send.py " . $_POST['username'] . " " . $_POST['msg']);

that should execute this:

sudo -E python3 /var/www/html/send.py TheUsername TheMessageIinputed

if i executed this comand in the terminal it works but here it doesnt work...

I also put this into sudoers script:

www-data ALL=(ALL) NOPASSWD: ALL

but still doesnt work...

• Jaquarh: & what when someone's username is ; some nasty command script? use the correct escaping!
• couteau: Why not make your python script runnable by www-data? Much safer, though you still need to escape your user input as @Jaquarh suggests.

Answer 1

I hope you know what you are doing, because it is absolutely nuts. And I hope your machine is in a localnet where you are the only person who has access.

Anyway, You can try this if you want to see what is going on:

$user = $_POST['username'];
$msg = $_POST['msg'];
$exec = "sudo -E python3 /var/www/html/send.py $user $msg 2>&1"
exec($exec, $output, $return);
var_dump($output);
var_dump($return);