Domoticz PHP PHP2SHELL vulnarable?

[aberger]

Hi all,

I can not find the answer so I ask it here. Is Domoticz vulnarable for teh PHP CVE's released today? Of is the default docker container containing vulnarabilities of theis kind?

Thx in advance,

Ap Berger

[RNEE]

Domoticz is written in C++, its plugins etc are Python, Lua and dzVentz.

I dont think Domoticz is vulnerable.

This forum however is PHP.

[lost]

There is indeed a documented command line parameter related to php (-php_cgi_path), never used it myself:
https://wiki.domoticz.com/Command_line_parameters

But looks nothing is enabled by default and php is not even in the list of programming languages on the github page of the project.

Domoticz being small configurations friendly (raspberries...), it's dynamic web handling focus on client side rendering (thus JS) rather than server server side (PHP): For this, better to have the added load distributed on clients than all handled by web server.

[gizmocuz]

Domoticz is written in C++ and does not include or run PHP. Only when you start it with -php_cgi_path and point it at a php-cgi binary yourself, .php files in the www folder are passed to that PHP, and then you should keep that PHP up to date like any other. The Docker image does not contain PHP.

[gizmocuz]

Addition: the -php_cgi_path option is mainly used for Dashticz, which needs PHP. If you use it that way, keep that PHP installation up to date. Without Dashticz you do not need PHP at all; the built-in Dynamic Dashboard (Dashboard Dynamic in the menu) offers the same and more, and runs without PHP.