PHP自动化Wordpress安装程序使用shell_exec（）加速过程

Question

I'm trying to make and automated installer for my platform that download lastest wordpress tar and untar directly in the member directory, then remove all the temp files.

<?php
$dir = $_GET['username'];
if ($dir != null ) {
   print 'Downloading...';
   shell_exec('wget https://wordpress.org/latest.tar.gz -P /home/ubuntu/workspace/members/' . $dir);
   sleep(10);
   print 'OK | ';
   print 'Extracting...';
   shell_exec('tar xvzf /home/ubuntu/workspace/members/' . $dir . '/lastest.tar.gz -C /home/ubuntu/workspace/members/' . $dir);
   sleep(20);
   print 'OK | ';
   print 'Moving to root...';
   shell_exec('mv /home/ubuntu/workspace/members/' . $dir . '/wordpress /home/ubuntu/workspace/members/' . $dir);
   sleep(20);
   print 'OK | ';
   print 'Directory polish...';
   shell_exec('rm /home/ubuntu/workspace/members/' .$dir . '/wordpress | rm /home/ubuntu/workspace/members' . $dir . '/lastest.tar.gz');
   print 'OK | DONE.';
} else {
   print 'Error in get member name';
}

This work fine, latest file where downloaded and extracted, files where moved etc.

I would like to speedup the execution of this script, i've put the sleep()to make sure commands are not executed after the previous is done but I don't know if the system is loaded so I've put much time to wait.

There is a way to exactly know when a process is complete and start next process? will I must to put all in a line using the command separator |? Or there is an easy way to make it faster?

EDIT: According to the Replies it's easy to make this working faster removing the sleep()commands, but this script is pretty unsecure, so how can I make this more secure to execute?

Answer 1

shell_exec does not return until the executing command is complete - which you can verify yourself by running

<?php
shell_exec("sleep 3");
echo "done";

and seeing how long it takes.

Meaning: you do not have to sleep at all.

That being said: using user input directly in a system command is a huge huge security risk. any attacker could inject malicious code and completely compromise your server without lots of effort. a complete loss of data would be the least threatening scenario.

As a baseline: never trust user input!. to make your current code more secure: verify the input - for example, check if it is only alphanumeric, if it's a valid username, if it's the name of the currently logged in user, if the folder actually exists, and so on.
Best would be to store a sanitized path to your user directory in a database and look it up (with parameterized statements, lest you open yourself to SQL Injection instead).