Loading External application/commands from PHP

abcegkm

I am trying to load and run Microsoft Excel from a PHP script using system() or exec() :

$cmd="Excel.exe myfile.xls";
$res = system( $cmd );

but getting the:

"Warning: system() [function.system]: Unable to fork [excel.exe]" error.
Any help would be appreciated.
Thanks

sneakyimp

This page says it's probably a permission issue:
http://www.somacon.com/p255.php

abcegkm

Thanks for the reply. I checked the rights and follow your link but, No difference. The error is still there.
I am also trying to execute an external command on client PC using java's:

Runtime.getRuntime().exec()

How can I use this function incorporated as a onclick() function for an HTML button or submit tag.
Thanks

sneakyimp

You are trying to do stuff that seems like a pretty bad idea from a security perspective.

Running excel on the server might be necessary to process some kind of file, but you should probably consider using something like PHP Excel instead. An unfortunate aspect of trying to launch programs from PHP on your server is that it's usually pretty tricky to sort our permissions issues. The errors are usually not very helpful. "Unable to fork" could mean just about anything: excel not installed, web server user doesn't have permission, or something else even.

Now it should be plainly obvious to you that it's a total and complete security risk for any browser to let you run Java on the client's machine. I do believe this is possible, but have no experience doing it myself. The purveyors of Java have a page describing how to enable Java in one's browser but I would never recommend this. It basically exposes a client machine to remote code execution bugs.

abcegkm

I am already using PHPExcel to create the spread sheet. Now I only need to open it for the client using the Microsoft Excel on his/her PC. I can run an independent java code using Runtime.getRuntime().exec() on the local PC to load the Excel and open any spread sheet but I cannot find a way to do it when running PHP on the webserver.
I am looking for any way to be able to load the excel from PHP either using PHP functions or java script from the html code.
Thx

dalecosp

abcegkm;11049657 wrote:
I am already using PHPExcel to create the spread sheet. Now I only need to open it for the client using the Microsoft Excel on his/her PC.

How. Dare. You.

I mean, really, it's my computer ... can't I decide what to do with a file I downloaded to my computer?

Or is this some requirement from the PHB in the corner office?

If so, let them know that most files that execute themselves after a download are on the quarantine lists at Kapersky, Symantec, F-secure, McAfee, etc.

https://en.wikipedia.org/wiki/Principle_of_least_astonishment

sneakyimp

abcegkm;11049657 wrote:
I am already using PHPExcel to create the spread sheet. Now I only need to open it for the client using the Microsoft Excel on his/her PC. I can run an independent java code using Runtime.getRuntime().exec() on the local PC to load the Excel and open any spread sheet but I cannot find a way to do it when running PHP on the webserver.
I am looking for any way to be able to load the excel from PHP either using PHP functions or java script from the html code.
Thx

Yeah dalecosp is right. You shouldn't be doing that. As long as your web server takes care to send the right headers and mime type when a user downloads the file, then the user's browser should prompt them to either open the file (and let them choose the program) OR save the file somewhere.

sneakyimp

Oh and I forgot to mention that PHP runs on a SERVER usually. PHP scripts running on your server cannot execute commands on the client machine. That should be pretty obvious.

And, like dalecosp said, letting a web server run programs on some visiting client machine is a huge security problem. It's the root of all evil on the internet basically.

abcegkm

I do not dare..... The PHB dears to ask. Calm down... He is deciding what you should do with the file that he let you download to the device that he paid for. I guess you are somehow your own boss and do not have to collect a paycheck every other two weeks.

sneakyimp

abcegkm;11049667 wrote:
I do not dare..... The PHB dears to ask. Calm down... He is deciding what you should do with the file that he let you download to the device that he paid for. I guess you are somehow your own boss and do not have to collect a paycheck every other two weeks.

I'd be willing to bet that the only way in hell you will ever be able to execute excel on a user's machine to open some file would require the user of that machine (over which you may or may not have control) to go out of their way to grant permission to a browser to use Java (or some other program) on their machine. I provided you with a link above that explains how this is done. Here it is again. Maybe you could read it this time.

I believe that all browsers are initially configured to PREVENT any Java or Excel or any other program being launched by the user. The only way to get around this is to convince that user to change their security settings. You might be able to write some kind or script or program that would make the necessary changes for them, but you would have to explain to the user that they must download the program, run it, etc.

If I were you, I would let my own lack of knowledge about how to do this forbidden thing bother me. I would calmly try to explain to my boss that it will introduce a serious security problem to all users who willingly configure their computers to permit this and that it's probably actually easier to just have the user choose what to do with a file when they download it.

dalecosp

abcegkm;11049667 wrote:
I do not dare..... The PHB dears to ask. Calm down... He is deciding what you should do with the file that he let you download to the device that he paid for. I guess you are somehow your own boss and do not have to collect a paycheck every other two weeks.

I'm not mad and not in need of calming ... I kind of figured this was a PHB thing, because I have one, too, and if I hadn't suspected your PHB of being the guilty party I would not have mentioned that possibility. And I'm sorry for not including a requisite smiley :eek: (maybe that's the one I should've used)?

Still I think you have a great case for going back and saying, "we can't do that", and pointing out why with some links to some antivirus vendor pages? I suppose if you have trouble finding such we might try and help with that a bit ...

sneakyimp

Yeah if you need to sell PHB that it's a bad idea, I'd start with the fact that, quite aside from any difficulty you might experience as a dev trying to sort this out, it'll actually be more difficult for your users to grant permission to run Java/Excel/whatever on their machines. Unless, of course PHB expects you to take everyone's computer and make the necessary (and dangerous) configuration changes.

In fact, check out this dialog I get in firefox when I download an excel spreadsheet from a website. Note that I do not have Excel installed so I must use Libre Office to open the file. If I want to skip this dialog and ALWAYS use excel to open the file (which sounds like what your PHB wants) then I can just check the checkbox that says "do this automatically for files like this from now on."

[ATTACH]5229[/ATTACH]

download_dialog_screenshot.png

Weedpacket

Trying to start Excel on the server and opening the spreadsheet there (which is what your original code is trying to do) certainly won't achieve your goal.

While you can serve a file to the client using the appropriate Content-type [man]header[/man] (vnd.ms-excel, to be precise); what the client decides to do with it is up to it and its user's preferences (to start with, you're making the assumption that the client has Microsoft Excel installed on it even before worrying about things like antivirus protection, security settings, and user preferences).

If you really want to open Excel on the user's computer to display the spreadsheet you've generated, you're wanting something more like a Microsoft Office 365 subscription.

abcegkm

Thanks to all with constructive suggestion and even valid criticism.
To all others who maybe read this posts and still feel to guide me to decency:

Oh… come on guys..
We are not here to get moral and ethical lessons. We all know about the pretty obvious techies’ DOs and DON’Ts. One with bad intentions will not come to this kind of forums to ask for help and will not ever listen to your gospel preaching either. He/she will find his/her way one way or the other to our devices somehow working on his free time while have nothing better to do.
I asked a question because I have genuine and descent need for it. With all due respect, you can either help me resolve it or just let your ethical believes guide you out of the way.
Thanks

sneakyimp

OK I'll admit it: I don't know how to launch a program on someone's machine using a browser. This kind of thing is hard because all of the people who write browsers try their best to prevent it because it is a huge security problem.. Someone please correct me if I've overstated that at all. It's been years and years, but I seem to recall having to launch word docs from Internet Explorer years ago and it was hard even then. We had to hire a guy to write an ActiveX control (which involved not just writing the code but also jumping through all kinds of certificate hoops to have the ActiveX control launch without warnings from the browser). We paid that guy a lot of money. And then IE tightened its security model and the ActiveX control we had paid so much money for stopped working. We had to instruct our users to make changes to their operating system and/or browser preferences so that their machine would permit them to run Excel directly from a browser. We eventually gave up on the scheme. That was about 20 years ago.

dalecosp

abcegkm;11049689 wrote:
I asked a question because I have genuine and descent need for it. With all due respect, you can either help me resolve it or just let your ethical believes guide you out of the way.
Thanks

www.dice.com
www.monster.com
www.careerbuilder.com
careers.stackoverflow.com

😉

sneakyimp

dalecosp;11049693 wrote:
www.dice.com
www.monster.com
www.careerbuilder.com
careers.stackoverflow.com

😉

Ouch! :xbones:

But seriously, abcegkm, what you are trying to do will require that you:
A) Train your users to change their machine's configuration to permit this kind of thing or literally do it yourself. I myself don't have any recent experience doing this kind of thing, but I did provide you (twice) with a link about how to enable Java in a user's browser. HERE IT IS A THIRD TIME.

😎 Circumvent your users' browser security measures by HACKING THEM. I would not recommend this. I also don't know how to do it.

Since I realize I'm unable to provide any additional help here, I will recuse myself as you've requested.

EDIT: Last suggestions:
1) write your own browser that doesn't have these security measures in place
2) As Weedpacket suggested, try and use an on-line XLS editor like Windows 365 or Google Docs

abcegkm

Okay.. Since I could not find any legal way to do what I originally intended to do, I finally decided to have the user download the file to his/her local PC and then open it using Excel manually.

<a href='excelFileName' onclick=\"saveFileToDisk(this.href,'excelFileName', function(){}); return false;\">Click Here To Download Excel Document.</a>

I hope now that I was nice and did not cross any line, everyone is happy and can sleep tonight. 🙂
Thanks to all.

Derokorian

abcegkm;11049721 wrote:
I hope now that I was nice and did not cross any line, everyone is happy and can sleep tonight. 🙂
Thanks to all.

I shall not sleep for weeks! I abstained from the discussion because I honestly have no idea how to achieve what you were originally asking for. Hopefully the discussion with the PHB went well and they understand why this is the solution you went with.

sneakyimp

Please do keep in mind that a user's browser will probably give them the option to open the downloaded file with Excel (or whatever program they have installed to edit/view XLS files). Firefox gives you the option to check a little checkbox so that the browser will just skip the prompt and use that program to open the file every single time.

If your people are having any trouble -- E.g., browsers do not recognize the file as an excel file -- then there are things you can do to make sure that the web server sends the correct mime type. Microsoft has a list of the office 2007 ones here.