Edit report at http://bugs.php.net/bug.php?id=54391&edit=1
ID: 54391 User updated by: c dot madmax at gmail dot com Reported by: c dot madmax at gmail dot com Summary: escapeshellarg strip non-ascii characters Status: Bogus Type: Bug Package: Program Execution Operating System: All Debian and Ubuntu Versions PHP Version: 5.3.6 Block user comment: N Private report: N New Comment: This is a different bug! Bug 44945 is related to utf-8 strings, and the bug is fixed. escapeshellarg() don't remve valid utf-8 characters. But escapeshellarg() remove ISO-8959-1 characters! Previous Comments: ------------------------------------------------------------------------ [2011-03-26 15:18:54] fel...@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ [2011-03-26 15:18:43] fel...@php.net See bug #44945 ------------------------------------------------------------------------ [2011-03-26 15:12:53] c dot madmax at gmail dot com Description: ------------ escapeshellarg() strip non-ascii characters if the LANG environment variable is not set to somthing like LANG=*.ISO-8959-1 e.g. LANG=en_US.ISO-8959-1 The job of escapeshellarg() is only to escape characters and NOT to remove them!!! The manual say nothing about removing characters!!! Removing characters can cause horrible results!!! It should doesn't matter if a shell arg has a ISO-8959-1 charset or UTF-8 charset or any other charset, because it is possible that a filename has a ISO-8959-1 charset and a other filename has a UTF-8 charset!!! escapeshellarg() should only look for quotes and escape them, and nothing else!!! PS: setlocale(LC_ALL, 'en_US.ISO-8959-1') and/or putenv('LANG=en_US.ISO-8959-1') dosn't fix this problem! And i think even if this work it's not good a solution! Test script: --------------- <?php $path = escapeshellarg('/home/www-data/äöüÃÃÃÃ'); // ISO-8959-1 characters = "\xE4\xF6\xFC\xC4\xD6\xDC\xDF" in hex format shell_exec(sprintf('rm -fr %s', $path)); echo sprintf('%s removed', $path); ?> Expected result: ---------------- The test script should remove the folder /home/www-data/äöüÃÃÃà and output: '/home/www-data/äöüÃÃÃÃ' removed Actual result: -------------- The test script remove the folder /home/www-data/ and output '/home/www-data/' removed ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=54391&edit=1
