Git WebHook will not pull (PHP)

Asked 12/10, 2012 at 10:15 Answered 11/9, 2020 at 12:21

I have a PHP file, hook.php, that looks like this:

<?php `cd .. && git pull`;

The file is located in /var/www/oliverash.me/site/. However, the git repository that needs to be pulled is /var/www/oliverash.me/. ./site is the folder Apache looks to as the document root.

When I run the file in my browser, it does not seem to be pulling the repository.

I have also tried to echo the result, but the page is blank.

<?php echo `cd .. && git pull`;

Dentistry answered 12/10, 2012 at 10:15 Comment(6)

Does it require a password to do the pull? Or is it using local file access? – Amateurism 12/10, 2012 at 10:22

No password. Using SSH but with no passphrase. – Dentistry 12/10, 2012 at 10:33

is php in safe_mode which doesn't let you out of this document root? – Disgorge 12/10, 2012 at 10:44

I run echo cd .. && pwd`` and that seemed to work fine, but I’m not sure if safe mode being enabled would restrict me from doing that. I’ll have a look and post back here when I’ve found out. – Dentistry 12/10, 2012 at 10:51

Check the apache error log for any error. – Adrea 14/10, 2012 at 13:18

error: cannot open .git/FETCH_HEAD: Permission denied? – Dentistry 14/10, 2012 at 13:51

I can't post a comment in reply to you, but I am assuming that you are running a *nix system. You will be getting a permission denied if your apache/php daemons don't have permission to access .git/. You can change the owner/group of the .git/ directory recursively. Or do a chmod -R o+rw .git/* to give everyone (ie, not owner, not group) access to read and write in the git directory, which should clear up the permissions error that you are getting.

EDIT Just re-read the question, so what follows probably isn't needed, but leaving it just in case.

Though, doing that, you need to keep in mind that anyone with access to your server will be able to go to http://myurl/.git/ etc to access those. So as a security precaution, I would add a .htaccess file like:

order deny, allow
deny from all

in the.git directory so that apache will deny access from a web browser to everything in there.

Gilcrest answered 15/10, 2012 at 6:52 Comment(15)

Many thanks. Almost sorted, I think. However, now I’m getting this error in error_log: Could not create directory '/var/www/.ssh'.^M Host key verification failed.^M fatal: The remote end hung up unexpectedly – Dentistry 15/10, 2012 at 21:48

Start off trying mkdir /var/www/.ssh then chmod o+rw /var/www/.ssh to set up the .ssh directory with access for all. Let me know what errors you may get after that. That should help solve the first two, and hopefully it will solve the last one since the Host key should be able to be verified after. – Gilcrest 15/10, 2012 at 23:54

Now I’m just getting this: Host key verification failed.^M fatal: The remote end hung up unexpectedly. Why did it want a .ssh in www? – Dentistry 16/10, 2012 at 14:17

I think it wanted the .ssh as apache's 'home' directory. What happens when you run the command from the command line? I am assuming it works correctly, but checking just in case. If it works fine, you should be able to resolve it by copying from your ~/.ssh in to /var/www/.ssh and doing a chmod 0+r * inside that directory. – Gilcrest 16/10, 2012 at 15:8

After this I’m getting fatal: Unable to create '/var/www/oliverash.me/.git/ORIG_HEAD.lock': Permission denied. Should I chmod o+r* /var/www/oliverash.me? – Dentistry 16/10, 2012 at 15:17

I would think most in /var/www/oliverash.me/ should already be o+r, but doing chmod o+rw /var/www/oliverash.me/.git should solve that. – Gilcrest 16/10, 2012 at 15:27

So I got it working by creating a symbolic link from /root/.ssh to /var/www/.ssh, running chmod o+r * inside of .ssh, and then finally chmod o+rw /var/www/oliverash.me/.git. I think I can see why this was necessary – the git pull command worked through SSH because I was logged in as root, and that account had the SSH keys necessary for the git remote. The apache user didn’t. Is that right? – Dentistry 16/10, 2012 at 15:39

I would be interested in getting things working using the other method @pjz suggested, whereby I had a line to /etc/sudoers. I think this means I won’t have to worry about permissions on .git on future projects. – Dentistry 16/10, 2012 at 15:40

The git pull only gets so far, however, as these errors are now appearing in my error_log: hastebin.com/fimuloloru.coffee. – Dentistry 16/10, 2012 at 15:45

That is correct. And adding to sudoers would work, but for the most part, you never want your web service to have permission to run anything as the root user. It would be better to add your apache user to a group that you give +rw access to directories with. Though, since you created the symbolic link with .ssh you should have any more issue with other projects as well - just make sure you +rw the new .git directories that you end up creating. – Gilcrest 16/10, 2012 at 15:47

Should I execute chmod o+rw /var/www/oliverash.me to solve this new error? – Dentistry 16/10, 2012 at 15:49

Those errors are because your apache user doesn't have permission to change within your pulled git. Do a chmod -R o+rw to the base directory that git is using. – Gilcrest 16/10, 2012 at 15:50

You learn fast! Exactly that, might want to do it recursively though so add -R before the o+rw – Gilcrest 16/10, 2012 at 15:50

You might be able to help with my next issue, too! #12919481 – Dentistry 16/10, 2012 at 17:4

Just run through all of this again – to clarify, the symbolic link didn’t work, so I had to actually copy the files. – Dentistry 21/10, 2012 at 16:0

You've certainly got a permissions issue, maybe a couple.

The php page is going to execute as the apache user
That user must be able to write to the git repo in question
That user must be able to do the pull in question
You didn't specify what the source of the pull is, but if it's, for instance, a git: or ssh: repo, then that user will need perms (keys, username/password, whatever) to access the remote to do the pull from.
Just saw that it wants /var/www/.ssh - so you're using a ssh:// remote, which is fine, but since it's running as user apache (/var/www is user apache's homedir), it's looking for keys in /var/www/.ssh, which it's not finding, hence the failure. Solutions:
1. use sudo to switch to a user that does have perms and run the git pull as that user (in your php, do 'sudo git pull', and in your /etc/sudoers put a line allowing user apache to run the 'git pull' command)
2. set up a .ssh/config file that specifies a Host that's the remote, a User to use to login, and an Identity that is the path to the private key that the remote will allow to ssh in and do the pull.

Gesticulative answered 16/10, 2012 at 14:49 Comment(3)

Is it the apache user or the www user? – Dentistry 16/10, 2012 at 15:9

@OliverJosephAsh: As written, the whoami command outputs the username, that is apache in your case, the /var/www directory is the that user's home-directory. – Predation 16/10, 2012 at 15:16

I tried adding apache ALL = (root) /usr/bin/git pull to /etc/sudoers. Still getting the same error in my error_log: sudo: sorry, you must have a tty to run sudo. Here’s my most recent hook.php. – Dentistry 16/10, 2012 at 15:30

create webhook.php in the root or anywhere from where you can access it

$result = exec("cd /path/to/repo && git pull origin branch");

make sure the permission is 775 and user of your file and your site directory is www-data owner

Blockade answered 11/9, 2020 at 12:21 Comment(0)

You are having a problem with the user here that is executing the command.

According to your various comments, the system commands are executed as the user named apache (homedir is /var/www). You can verify this by running the whoami command from within your PHP script:

<?php echo `whoami`;

That user named apache is commonly the user your webserver runs under, which then runs PHP which then runs the shell commands.

Obviously you want to run the command as some other user, but you have not shared so far the information which one.

Run the shell command under the right user and the problem should go away.

On a linux system, the command to run other commands under a different user is called sudo, another one su:

Alternatively you can make use of suexec to execute PHP under a different user than the webserver user.

In any case you need to ensure that you have a user that is able to execute the git command. I have no clue how you tested that on your own, best way I know is to ssh into the server box, do the git pull manually and collect the needed data like user-name, homedirectory etc. .

Predation answered 16/10, 2012 at 14:24 Comment(2)

whoami returns apache. If I precede the command with sudo, then I get the following error in my error_log: sudo: sorry, you must have a tty to run sudo – Dentistry 16/10, 2012 at 14:37

Yes the user is apache apache, www was only the basename of the homedir. And then the tty error, please see https://mcmap.net/q/369081/-sudo-in-php-exec and other similar ones. maymay.net/blog/2010/03/17/… – Predation 16/10, 2012 at 14:48

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags