Recently, Nextcloud has been throwing the error ErrorCall to undefined function OC\Core\BackgroundJobs\exec() nextcloud. As I understand it, it wants me to remove the exec function from disable_functions. I tried splitting PHP 8.4 for websites and PHP 8.5 for Nextcloud, and attempted to configure php.ini, but as I understand it, the configuration is the same for all of them. I’ve read that enabling exec for WordPress sites is not secure. Has anyone encountered this before? Could you tell me how to solve it?
If anyone needs it, we do it like this
- Create a template /usr/local/hestia/data/templates/web/php-fpm/PHP-8_4-Nextcloud.tpl
- Write there
; origin-src: deb/php-fpm/multiphp.tpl
;#=========================================================================#
;# Default Web Domain Template #
;# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
;# https://hestiacp.com/docs/server-administration/web-templates.html #
;#=========================================================================#
[%domain%]
listen = /run/php/php%backend_version%-fpm-%domain%.sock
listen.owner = %user%
listen.group = www-data
listen.mode = 0660
user = %user%
group = %user%
pm = ondemand
pm.max_children = 8
pm.max_requests = 4000
pm.process_idle_timeout = 10s
pm.status_path = /status
php_admin_value[upload_tmp_dir] = /home/%user%/tmp
php_admin_value[session.save_path] = /home/%user%/tmp
php_admin_value[open_basedir] = /home/%user%/.composer:/home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/tmp:/var/www/html:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f admin@%domain%
; === SECURITY: Disable dangerous features
php_admin_value[disable_functions] = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,system,passthru,shell_exec,proc_open,popen
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /home/%user%/tmp
env[TMPDIR] = /home/%user%/tmp
env[TEMP] = /home/%user%/tmp
- Apply templates to the
v-rebuild-web-domains user account(change user to your own) - Select a template in the panel for NC
All
Keep in mind that this configuration won’t work if the exec function is already disabled in /etc/php/8.4/fpm/php.ini. You can disable functions that are currently enabled, but you cannot enable functions that have already been disabled.
As I see, ‘exec’ is disabled in the main file, but I enabled it in the NC template, and as I see, there are no errors about ‘ErrorCall to undefined function OC\Core\BackgroundJobs\exec() nextcloud’. Or am I misunderstanding this?
You can’t enable it in NC template if it is disabled in main php.ini.
Just add this php (something like check-exec.php) to test whether exec works in your NC site:
<?php
echo function_exists('exec') ? (exec('echo test', $out) !== false ? $out[0] : 'exec failed') : 'exec is disabled';
now in the main file disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,system,passthru,shell_exec,proc_open,popen
А в WP
disable_functions exec,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,system,passthru,shell_exec,proc_open,popen
Show the output of this command;
grep '^disable_functions' /etc/php/8.4/fpm/php.ini
Did you restart the service?
systemctl restart php8.4-fpm
Yes, it has been restarted. I seem to be confused now, in the main file exec is enabled, but in WP it is disabled in a separate template).
That’s what I said, you can disable a function in the backend template if it is enabled but you cannot enable a function in backend template if it is disabled in main php.ini.
Got it, but won’t it damage Hestia if I enable various functions for NC, or is it still unsafe and I should think about using NC separately from everyone else?
The more functions you enable, the greater the risk. I also have Nextcloud installed, and I’ve disabled the exec function. After checking the logs, I can’t find any errors related to it.
Just for context, this is a personal installation with only one user and a very, very low workload, so it’s possible that CleanupBackgroundJobsJob.php never calls the exec function. Also, I use the system cron to handle the cleanup tasks.
If you want multiple sites to use the same PHP version but enable the exec function only for Nextcloud, you’ll need to edit the main php.ini file to enable exec, then create custom backend templates for the other sites that disable the exec function.
Yeah, I know, it’s a pain… 
You could also ignore that “error” in the log, it isn’t important.
Rename it nextcloud-PHP-8_4 instead otherwise version detection will not work on rebuild