[mod_python] Re: popen() and mod_python

Sebastien Maret sebastien.maret at gmail.com
Wed Apr 11 11:17:16 EDT 2007

Jorey Bump <list at joreybump.com> writes:

> Jon-Pierre Gentil wrote:
>> Sebastien Maret wrote:
>>> import os
>>> def index(req):
>>>           p = os.popen ("/bin/sh", 'w')
>>>    p.write ("ls >> log")
>>>    p.close ()
>>>    f = open("log")
>>>    s = f.readlines()
>>>    f.close()
>>>    return s
>>> Although the same kind of script works fine when I run it from the
>>> command line, it does not work when I put it on my webserver. The pipe
>>> does not seems to be opened. Is it for security reasons? Is there a
>>> workaround?
>> It looks like you're returning the string instead of using req.write()
>> to output the data.  A request handler expects an HTTP code return
>> value, not the string output..
> That's not true of all handlers. The OP might be using Publisher,
> which only requires a string to be returned.

I do use the publisher. I should have mentioned that.

> Try using full paths to all binaries and files. The apache user is
> likely to have a very different environment than your normal user at
> the command line, and there's no guarantee that it won't change
> beneath your feet. Rule out all ambiguity.

That was it. The ls >> log command was trying to create a file in the
current directory, which turns out to be /. Using a full path for the
log file solved the problem.

> Also, you might want to try with something simpler, such as returning
> only the output of ls. In fact, I'm not sure I see the purpose of
> opening /bin/sh here, but maybe you have something else in mind other
> than this example, hopefully not evil. :)

This was just an example.

Thanks for the help.

More information about the Mod_python mailing list