using popen instead of shell_exec. shell_exec is disabled in safe mode.

default configuration moved to functions.php
file_exists() test is no longer used because it is not accurate (#1499134) and
requires full path to fortune program.

plugins/fortune/config_default.php → plugins/fortune/config_sample.php

@@ -1,7 +1,7 @@
 <?php
 
 /**
- * Default Fortune plugin configuration
+ * Sample Fortune plugin configuration file
  *
  * Configuration defaults to /usr/games/fortune with short quotes
  *
@@ -13,15 +13,8 @@
  */
 
 /**
- * program that displays quotes
- * @global string $fortune_location
+ * Command that is used to display fortune cookies
+ * @global string $fortune_command
+ * @since 1.5.2
  */
-$fortune_location = '/usr/games/fortune';
-
-/**
- * options that have to be passed to program
- * @global string $fortune_options
- * @since 1.5.1
- */
-$fortune_options = '-s';
-?>
+$fortune_command = '/usr/games/fortune -s';

plugins/fortune/functions.php

@@ -11,14 +11,10 @@
  */
 
 /**
- * Declare configuration globals
+ * Declare configuration global and set default value
  */
-global $fortune_location, $fortune_options;
-
-/**
- * Load default config
- */
-include_once(SM_PATH . 'plugins/fortune/config_default.php');
+global $fortune_command;
+$fortune_command = '/usr/games/fortune -s';
 
 /**
  * Load site config
@@ -35,33 +31,33 @@ if (file_exists(SM_PATH . 'config/fortune_config.php')) {
  * @since 1.5.1
  */
 function fortune_function() {
-    global $fortune_visible, $color, $fortune_location, $fortune_options;
+    global $fortune_visible, $color, $fortune_command;
 
     if (!$fortune_visible) {
         return;
     }
 
-    $exist = file_exists($fortune_location);
-
-    if ($fortune_options!='') {
-        $fortune_command=$fortune_location . ' ' . $fortune_options;
-    } else {
-        $fortune_command=$fortune_location;
-    }
-
-    echo "<div style=\"text-align: center;\"><table cellpadding=\"0\" cellspacing=\"0\" border=\"0\" bgcolor=\"$color[10]\">\n".
+    echo "<table cellpadding=\"0\" cellspacing=\"0\" border=\"0\" bgcolor=\"$color[10]\" align=\"center\">\n".
         "<tr><td><table width=\"100%\" cellpadding=\"2\" cellspacing=\"1\" border=\"0\" bgcolor=\"$color[5]\">\n".
         "<tr><td align=\"center\">\n";
     echo '<table><tr><td>';
-    if (!$exist) {
-        printf(_("%s is not found."),$fortune_location);
-    } else {
-        echo "<div style=\"text-align: center;\"><em>" . _("Today's Fortune") . "</em></div><pre>\n" .
-            htmlspecialchars(shell_exec($fortune_command)) .
-            "</pre>\n";
+
+    /* open handle and get all command output*/
+    $handle = popen($fortune_command,'r');
+    $fortune = '';
+    while ($read = fread($handle,1024)) {
+        $fortune .= $read;
     }
+    /* if pclose return != 0, popen command failed. Yes, I know that it is broken when --enable-sigchild is used */
+    if (pclose($handle)) {
+        // %s shows executed fortune cookie command.
+        $fortune = sprintf(_("Unable to execute \"%s\"."),$fortune_command);
+    }
+    echo "<div style=\"text-align: center;\"><em>" . _("Today's Fortune") . "</em></div><pre>\n" .
+            htmlspecialchars($fortune) .
+            "</pre>\n";
 
-    echo '</td></tr></table></td></tr></table></td></tr></table></div>';
+    echo '</td></tr></table></td></tr></table></td></tr></table>';
 }
 
 /**
@@ -91,4 +87,3 @@ function fortune_function_load() {
 
     $fortune_visible = getPref($data_dir, $username, 'fortune_visible');
 }
-?>

plugins/fortune/setup.php

@@ -48,4 +48,3 @@ function fortune_load() {
     include_once(SM_PATH . 'plugins/fortune/functions.php');
     fortune_function_load();
 }
-?>