Executing git commands via php over http

Question

OS - Ubuntu 14.04

I am working on deployment using GIT webhooks for it.

I have added the deployment keys to git repo and now I want to trigger the git pull origin master command when a push happens from my local repo.

This is the test.php file I call via browser:

<?php       
    //echo "THis is a test file on a test repo for testing the deploy functionality using github webhooks!!!!";
    echo exec('whoami');
    echo exec('sh -x /var/www/proj/test/git.sh');
?>

This is the git.sh shell file:

#!/bin/bash
cd /var/www/proj-dir/test
git pull origin master

When I run this on terminal using php test.php I get the correct result as expected:

 ubuntu From github.com:repo/test
 * branch            master     -> FETCH_HEAD
 Already up-to-date.

ubuntu for whoami followed by the git pull output.

Now here's the issue when I call the same http://example.com/test.php via the browser it shows the user or whoami output as www-data, which is apache user, but I tried updating the permissions of the php file to execute and changing the user to www-data but did not work.
checked the apache logs and when I execute through the browser I get a permission error

  Please make sure you have the correct access rights and the repository exists. + cd /var/www/proj/deploy-test + git pull origin master

Host key verification failed. fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.

What updates do I need to make so the file works via browser request?

If I need to update the sudoers file what should be the updates?

Update
I added the .ssh keys to the var/www/ dir as that is the home for apache user. But I still get the

git pull origin master
error: cannot open .git/FETCH_HEAD: Permission denied

Also I added a line for the www-data user to be able to execute the sh file.

 www-data ALL=(anthony) NOPASSWD: /var/www/mysite/vendor/tmd/auto-git-pull/scripts/git-pull.sh

Reference here Still no luck
Updated the permissions for .git folder to www-data user

sudo chown www-data:www-data /var/www/proj/test/.git

You need to make sure that it's the correct user that asks for the pull. What user has pull rights from the repo? Seems you need to be ubuntu. — nicoX
– nicoX, Commented Aug 20, 2015 at 11:55
yes ubuntu,but I believe when accessing over http the apache user which is www-data needs to have permission to execute the script.After going through many posts I learnt I need to probably update the sudoers file for www-data to have correct permissions. PLease corect if my direction is wrong — KillABug
– KillABug, Commented Aug 20, 2015 at 11:57
Couldn't you just chmod the script so group/other has execution rights. And it seems your script is being executed. — nicoX
– nicoX, Commented Aug 20, 2015 at 12:01
Tried that,I swithced the user to www-data for the php and shell file,but did not work! I get www-data` as a result of whoami on browser that menas the user trying to run is www-data,right? Otherwise I might be under wrong assumptions — KillABug
– KillABug, Commented Aug 20, 2015 at 12:04
@nicoX I got it working but I am not sure about the security implications involved. I had to change the permissions to .git folder to www-data:www-data. This works fine,but I tried adding sudo ubuntu in my shell file but it gives me sudo: no tty present and no askpass program specified. I would request to add a solution with answer so that I can give a few points to you and close the thread. — KillABug
– KillABug, Commented Aug 24, 2015 at 9:09

pjvleeuwen · Accepted Answer · 2017-04-07 23:23:52Z

This does not seem to be a PHP issue but a git config issue. Git is configured correctly for user ubuntu and not for user www-data.

You can try to make PHP run something as ubuntu, but that does not seem the easiest nor the correct. I would suggest configuring git correctly for the www-data user.

I suspect you can reproduce the issue by running on the terminal:

# become www-data user
sudo su www-data
# actions from your git.sh file
cd /var/www/proj-dir/test
git pull origin master

After verifying you do indeed have a reproduction scenario you can try to fix the problem for the www-data user.

Chances are there is a difference between the output of git config --list when run as either user. For more help on that score see https://git-scm.com/book/en/Getting-Started-First-Time-Git-Setup

It might als be that file permission / ownership differences are causing problems. To rule out, I suggest you use a git clone ... as user www-data to create a new clone and working copy in some other path in your filesystem. Then see again if the git pull now works as expected.

You may consider giving www-data its own working copy anyway (regardless of permission problems). This would also prevent having to deal with possible uncommitted changes in the working copy that result in merge problems. Handling these automatically / unattended from PHP / git.sh might be cumbersome.

The proposed workflow would then be: develop as ubuntu in your current working directory and add/commit/push your changes. Then have PHP do the pull as itself (as www-data).

Collectives™ on Stack Overflow

Executing git commands via php over http

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related