Imagemagick problem - GS

[davefaulkner]

Hi All,

Im really grasping at straws here. I realise this may not be the best place to post this thread, but am really having problems with this one.

I have a linux box with PHP, imagemagick and ghostscript installed.

When a user uploads a photo, its meant to get a copyright appended to the bottom of it. In other words, the script creates an black image of the same width, writes users name on the image, the appends that image to the bottom of the original uploaded image as the full image. Problem i have is as follows.

If i run the command:

/usr/local/bin/convert -font Arial.ttf -pen white -draw "text +5+15 TESTMESSAGE" /home/sites/site2/web/upload/temp/footers/testbefore.jpg /home/sites/site2/web/upload/temp/footers/after.jpg

It works fine. But as soon as i put it into a PHP script and try to run it from a webpage, i get the following in the apache error log:
sh: gs: command not found
sh: gs: command not found
/usr/local/bin/convert: Postscript delegate failed.
sh: gs: command not found
sh: gs: command not found
/usr/local/bin/convert: Postscript delegate failed.
/usr/local/bin/convert: Postscript delegate failed.

Even if i "su - httpd" on the box and run the first command, it works fine. The ONLY time it doesnt work is when i try to run it from a webpage.

Any help that anyone can shed on this would be greatly apprecaited.

Regards

Dave

[Sxooter]

Looks like /usr/local/bin/convert is a shell script relying on paths to find the files it needs. You can either edit it to have explicit paths to all it's executables, or find someway of setting a path for it.

Can you call it like:

export PATH=/usr/local/bin:/usr/bin:/bin;command

? or does the ; get eaten in that? I seem to remember some way of doing that without the semi colon, but I'll be durned if I can remember it.

[davefaulkner]

Any idea why it would run as httpd on the actual box itself, b ut when i try to run it as php from a webpage it doesnt work?

Thats the bit thats confusing me

Dave

[Sxooter]

Yeah, the problem is in how apache works.

In order to grab port 80, it has to be run as root, but running things as root is dangerous, since it could allow root level exploits of your box through that vector.

So, apache su-execs all it's child processes to the nobody user (by default) or the httpd user (in redhat, or most installs by me.)

In either case, the child process is promoted to that account with no actual login process and therefore recieves none of the environment that that account would normally get.

So, anything they do, requires absolute paths be declared, since they don't inherit the path of the httpd.user.