2

I created a script that I run off a CSV of which I manipulate the data and create a new CSV (for imports through magmi).

When I run it through the command line it goes without a hitch.

I then proceeded to create a custom module on my magento site to allow the client to upload the csv from the admin. This is how it looks from the backend

I then have a controller that moves the uploaded file to my script and proceed to call shell_exec which I assumed would be doing exactly what I did when running from the command line.

Instead i got the following error

PHP Fatal error: Call to undefined function snappy_uncompress() in /chroot/home/mywebsite.com/html/lib/Cm/Cache/Backend/Redis.php on line 888

I believe this is due to the fact that my script is loading Mage.

This is my controller:

    public function postAction(){
    if($_POST){

        //Get target directory and file name
        $upOne = substr(getcwd(), 0, strrpos( getcwd(), '/')  );
        $targetDir = $upOne . '/MyScriptDirectory/';
        $targetFile = $_FILES['myFile']['name'];

        //Upload file
        if (move_uploaded_file($_FILES['myFile']['tmp_name'], $targetDir . $targetFile)) {
           // Mage::getSingleton('core/session')->addSuccess('Success');
        } else {
            Mage::getSingleton('core/session')->addError('Failed to upload file');
        }

        //Run script with $targetFile as argument 
        exec (  "cd SunberryImport/ && php main.php "  . $targetFile. " 2>&1",$output, $val );

        //Get output and print to screen
        Mage::getSingleton('core/session')->addError(implode($output));

    }
    $this->loadLayout();
    $this->renderLayout();
}

When I moved my script within the magento application and stopped loading mage within the script I no longer got that error.

I rather keep my script separate from the main application.

Is the problem due to running mage twice in the same php session?

Sorry if I'm not being clear I'm new to both magento and this is my first Magento stack overflow question.

5

First of all, welcome to StackExchange!

I'm really curious why you want to import the CSV using a shell script. Can't you import it via PHP? Because the script you run now is far from secure. Theoretically, if I call my file ; && rm -rf /, it will actually run this command on your command line, with all terrible consequences from there.

I'd suggest to see if you can change this into importing via a regular way by either importing a CSV via a custom importer or maybe you can refactor it so you can use the default Magento importer (see: https://trellis.co/blog/uploading-products-magento-product-excel/).

Last but not least, you could check your code by using default Magento code, like the file uploader (see: https://stackoverflow.com/questions/6734281/magento-image-upload-form-field) and the way to check for post if ($this->getRequest()->getPost().

Hope this will help you along.

| improve this answer | |
  • Thank Argen. Would that be called command ingection? : ) I could just rename the file and pass that in as my argument. – Moshe Sommers Feb 27 '18 at 19:29
  • I'd still not run a command line script based for an action in the browser, since you have way more possibilities and permissions when running a script in the browser. So if possible I'd suggest to use a PHP based import script. – Arjen Miedema Feb 27 '18 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.