Executing program with arguments from cgi script

[natol44]

Greetings!

I need to run ffmpeg from a CGI script, of course with arguments: Video to process, watermark to add, etc, and output file.

I put all this in one variable:

my $order = "$ffmpeg -i $video -i $watermark parameters etc $output";

with $ffmpeg is the program's address, $video the video address etc.



then I tried with

system "$order";
and
`$order`;

Nothing works.

If I write the output content of $order in the SSH command line, it works.

Where am I wrong? Thank you!

[haukex]

I need to run ffmpeg from a CGI script, of course with arguments

This is a very dangerous thing to do. See Calling External Commands More Safely for why, and for some modules that you could use to make the risk smaller. Assuming this is on a *NIX system, at the very least, you must use the system LIST form, for example system($ffmpeg,'-i',$video,'-i',$watermark,...), and you should additionally validate the variables you're passing to the command.

Nothing works.

I suspect there is an error happening that you're not seeing. See the documentation of system on how to check for errors; the same advice from that documentation on inspecting $? applies to backticks as well.

[natol44]

I finally solved it using system. Risks seem low as the script is working in cron from a non-accessible place from users. Thank you all for your help :)

[hippo]

Risks seem low

History is littered with the corpses of those who said just that.

At least run in taint mode: a low-impact way to remove a lot of the remaining danger.

[bliako]

Are you sure the path $ffmpeg is correct? Better write to a log file what command you are running prior to executing the system() to make sure. And then write the exit code to the log file as well. It's possible to obtain the STDOUT, STDERR (see note below by Anonymous Monk) of the system command simply by my $out = `$order`; Start your debugging with that.

If the path is correct, then there maybe a problem with your parameters, quotation, escape-chars etc. which only appears when running through system(). It could also be that your webserver does not allow to execute system() commands.

But when you eventually find out what's wrong, take haukex's advice very seriously. This is one of lamest ways to get hacked.

[Anonymous Monk]

It's possible to obtain the STDOUT, STDERR of the system command simply by my $out = `$order`;

backticks only capture STDOUT unless you do 2>&1

[bliako]

thanks, I haven't paid attention to this important detail.