php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #38931 interacting with user account
Submitted: 2006-09-23 01:31 UTC Modified: 2016-06-18 14:58 UTC
From: anfsm at uaa dot alaska dot edu Assigned: cmb (profile)
Status: Closed Package: *General Issues
PHP Version: 5.1.6 OS: windows (2003 SP1)
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: anfsm at uaa dot alaska dot edu
New email:
PHP Version: OS:

 

 [2006-09-23 01:31 UTC] anfsm at uaa dot alaska dot edu
Description:
------------
i would like the feature to modify user non-domain, windows accounts directly without having to resort to an exec(); or shell_exec(); command (probably because i cannot get them to work anyway). a standard old password, new password, confirm password setup would be ideal.

i have tried exec() and shell_exec with sysinternals psexec.exe and windows' built-in runas.exe with net user commands. i have tried setting safe_mode off but i cannot get it to work.

see below for sample



Reproduce code:
---------------
$pp = popen("runas /noprofile /user:machine_name\\administrator \"net user $username $newpassword\"", 'w');
fwrite($pp, $adminpassword);

// and also tried
shell_exec("echo $adminpass | runas /noprofile /user:machine_name\\administrator \"net user $username $newpassword\"");

// as well as for the sysinternals psexec.exe
shell_exec("psexec -u administrator -p $adminpass net user $username $newpassword");

Expected result:
----------------
be able to change local system passwords by web interface without relying on external utilities.

Actual result:
--------------
not possible

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-12-31 22:59 UTC] michael at chunkycow dot com dot au
G'day

This would be insane for security, exec is bad enough to try and shelter from the evil outside army of skript kiddies and friends.
 [2016-06-18 14:58 UTC] cmb@php.net
-Status: Open +Status: Closed -Package: Feature/Change Request +Package: *General Issues -Assigned To: +Assigned To: cmb
 [2016-06-18 14:58 UTC] cmb@php.net
> be able to change local system passwords by web interface
> without relying on external utilities.

That appears to be an extremly uncommon use-case for PHP scripts.
Thus, I'm closing this ticket.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sat Dec 06 15:00:02 2025 UTC