Search code examples
phpshellrm

Is rm -f in a php shell command safe?


No user input here, but I still want to check that this is safe:

<?php system('rm /tmp/my-cache/3600/* -f');

Is there any circumstance that could result in that deleting files from another directory? For example what would happen if that directory didn't exist for some reason?

I think it's safe, but I've been bitten by a similar (yet completely different) bit of code before, in a cron job that runs every minute:

cd /tmp/my-cache/3600
find . -maxdepth 1 -mmin +61 -type f -delete

Under some circumstances that folder didn't exist, which meant find deleted any files in the home directory instead!

(The fix was to wrap it inside a if [ -d "/tmp/my-cache/3600" ]; then / fi block)

Like I say, I think the php system call is safe, I just want to check there isn't an extenuating circumstance I don't know about which could cause problems?


Solution

  • rm -f /tmp/my-cache/3600/* is safe, if /tmp/my-cache/3600/ is empty, nothing will be removed.

    The only difference with rm /tmp/my-cache/3600/* (no -f) is that you won't get this warning:

    No such file or directory

    ...but that does not mean something has been removed. According to rm's man page, this happens with the -f option:

    If the file does not exist, do not display a diagnostic message or modify the exit status to reflect an error.

    ...so rm behaves like it has deleted something even when it hasn't.


    find is safe too!

    Instead of checking if the directory exists, then cd into it, and then run find, you should use the following find command:

    find /tmp/my-cache/3600 -maxdepth 1 -mmin +61 -type f -delete
    

    ...because it already does the check for you:

    find: /tmp/my-cache/3600: No such file or directory