Severity: MEDIUM
Location: lib/Service/SoftwareCatalogue/ContactPersonHandler.php lines 486–507
Description:
The user-create path fires exec("$phpBin -r '...' > /dev/null 2>&1 &") to pre-warm the filesystem for the new user. Two problems:
-
Fork-bomb via C3: Since convertToUser (C3) is unauthenticated, any caller who triggers repeated user creation will cause this exec to fork an unbounded number of PHP processes in the background.
-
NC 34 fatal in forked script: The spawned script calls \OC::$server->get(IUserManager::class) — fatal on NC 34 — inside a background process with no error recovery.
Suggested fix:
Replace exec() with a queued NC background job via IJobList::add(). Move the filesystem setup to the job class so it runs asynchronously under the cron worker's lifecycle management.
Source: deep team-reviewer pass 2026-05-27
Severity: MEDIUM
Location:
lib/Service/SoftwareCatalogue/ContactPersonHandler.phplines 486–507Description:
The user-create path fires
exec("$phpBin -r '...' > /dev/null 2>&1 &")to pre-warm the filesystem for the new user. Two problems:Fork-bomb via C3: Since
convertToUser(C3) is unauthenticated, any caller who triggers repeated user creation will cause thisexecto fork an unbounded number of PHP processes in the background.NC 34 fatal in forked script: The spawned script calls
\OC::$server->get(IUserManager::class)— fatal on NC 34 — inside a background process with no error recovery.Suggested fix:
Replace
exec()with a queued NC background job viaIJobList::add(). Move the filesystem setup to the job class so it runs asynchronously under the cron worker's lifecycle management.Source: deep team-reviewer pass 2026-05-27