[1.x & 2.x] InfoCommand fatals when exec() is disabled, breaking the System Info page

[karl-bullock]

Current Behavior

InfoCommand calls exec() without checking that it is available. On a host where exec is in PHP's disable_functions (common on shared hosting), the call fatals:

Error: Call to undefined function Flarum\Foundation\Console\exec()
  in vendor/flarum/core/src/Foundation/Console/InfoCommand.php:213
Stack trace:
#0 InfoCommand.php(49): Flarum\Foundation\Console\InfoCommand->detectWebServerPhpVersion()
#1 Console/AbstractCommand.php(63): Flarum\Foundation\Console\InfoCommand->fire()

A disabled function is removed from PHP's function table, so the unqualified call inside namespace Flarum\Foundation\Console finds nothing locally, falls through to global, finds nothing there either, and throws. The namespace in the message is a symptom of the disabled function, not of a missing Flarum function.

Because SystemInfoResource runs the command in-process to build its response, the admin panel's System Info page shows only:

Error loading info: undefined

Two call sites are affected:

• detectWebServerPhpVersion(), InfoCommand.php:213 — reached whenever one of the candidate PHP binaries exists and is executable, which is most hosts. This is the one users hit.
• findPackageVersion(), InfoCommand.php:183 — same bug, only reached for packages installed as a git checkout.

Reported by a forum admin here: https://discuss.flarum.org/d/39821-system-info-error-loading-info-undefined

Steps to Reproduce

1. Install Flarum 2.x.
2. Confirm php flarum info works and prints a Web: PHP version.
3. Run it again with exec disabled: php -d disable_functions=exec flarum info.

The command exits 255, having printed only the first line, and logs the error above. Adding disable_functions = exec to the web SAPI's php.ini produces the same failure through the admin System Info page.

Isolating the mechanism, with no Flarum involved:

<?php
namespace Flarum\Foundation\Console;

var_dump(function_exists('exec'));
exec('/usr/bin/php -v', $output, $status);

$ php nsexec.php
bool(true)
$ php -d disable_functions=exec nsexec.php
bool(false)
PHP Fatal error: Uncaught Error: Call to undefined function Flarum\Foundation\Console\exec()

Expected Behavior

The System Info page loads, and php flarum info completes. The web server PHP version is a best-effort field, so where it cannot be determined it should degrade to the "unable to detect" value the command already prints for that case, not take the whole report down.

Environment

• Flarum 2.0.0-rc.8 (reporter) and 2.0.0-rc.5 (my reproduction)
• Affects 1.8 as well: v1.8.19's InfoCommand has the same function with the same unguarded exec() call
• Any host with exec in disable_functions

Possible Solution

Guard both call sites. function_exists() returns false for a disabled function, so it is sufficient on its own:

private function detectWebServerPhpVersion(): ?string
{
    if (! function_exists('exec')) {
        return null;
    }
    // ...
}

and in findPackageVersion():

if (function_exists('exec') && file_exists("$path/.git")) {

I applied exactly that to a 2.x install and re-ran both cases:

exec disabled, guarded    exit 0    PHP version: CLI: 8.3.33, Web: unable to detect
exec allowed,  guarded    exit 0    PHP version: CLI: 8.3.33, Web: 8.3.33

Happy to open a PR for it if that is useful.

Additional Context

Only InfoCommand is affected, so the forum itself keeps working; it is the System Info page and php flarum info that break. Worth noting the failure is silent about its real cause from an admin's point of view, since the page only says undefined.