- How do I install rosell-dk/exec-with-fallback in a Laravel project?
- Install it with Composer by running composer require rosell-dk/exec-with-fallback. It is a plain PHP library that autoloads through Composer, so no service provider, facade, or config file is required in your Laravel app. You can call the class directly from a controller, job, command, or service class.
- Which Laravel and PHP versions does exec-with-fallback support?
- The package is framework agnostic, so it works with any Laravel version that runs on a PHP version allowed by its composer.json constraint. Because it only wraps PHP shell functions, there is nothing Laravel-specific to configure. Check the require section in composer.json before installing on legacy PHP 7 or PHP 8 setups.
- Why does exec() fail on shared hosting and locked-down servers?
- Many shared hosts list functions like exec, shell_exec, passthru, and popen in the disable_functions directive in php.ini, which makes them behave as if they do not exist. Calling a disabled function usually throws a fatal error or emits a warning and returns null, which breaks code written for a normal server. This package detects the situation and uses whichever shell function is still allowed.
- Does exec-with-fallback bypass disable_functions or other PHP security restrictions?
- No. It does not circumvent disable_functions, open_basedir, safe mode style restrictions, or any host policy. It simply picks the first shell execution function that is currently enabled and uses it the same way exec would. If the host disables every relevant function, the library cannot execute anything and the call will fail.
- Which fallback functions does exec-with-fallback try?
- It tries exec first and then falls back to alternatives such as shell_exec, proc_open, passthru, and other emulation techniques until it finds one that works. The exact order and the full list of supported methods are documented in the README. Because some methods capture output differently, the library normalises the result as far as possible.
- How is exec-with-fallback different from symfony/process or Laravel's Process facade?
- symfony/process, which powers Laravel's Process facade and artisan helpers, depends on proc_open being available. If proc_open is disabled, those tools fail even though exec or shell_exec might still work. exec-with-fallback is complementary: it is a thin layer aimed at exactly those locked-down environments where a single function cannot be relied on.
- How can I test my Laravel code when exec() is disabled?
- You can simulate a restricted host locally by running PHP with a custom directive, for example php -d disable_functions=exec,shell_exec artisan your:command. That lets you confirm the fallback path is actually taken instead of only being exercised in production. You can also assert in a test that your command still returns the expected output and exit code under that configuration.
- Can I still capture output and the exit code when a fallback method is used?
- Yes, the goal is to behave like exec: you get the command output and a result code back so your code can branch on success or failure. Small differences can exist between the underlying methods, especially around output buffering and stream handling. Run a quick smoke test on the actual target server if your logic depends on precise output formatting.
- Is it safe to use exec-with-fallback in production?
- It carries the same security profile as calling exec directly, so the risk comes from the command you build, not from the fallback mechanism. Always escape user-supplied arguments with escapeshellarg and escapeshellcmd, validate input, and never interpolate raw request data into a command string. Prefer passing arguments as separate array elements where the underlying function allows it.
- What happens if every shell function is disabled on the server?
- If a host truly disables exec, shell_exec, proc_open, passthru, and the other supported methods, there is no way to spawn a process and this package cannot help. In that case you need a different architecture, such as an HTTP call to an external service, a queue worker with the required permissions, or asking the host to enable one function. The library's value is covering the common partial-lockdown scenario, not defeating a fully sandboxed environment.