How to change time in Debian by Website PHP?

Question

I want change time in Debian by my website

I have one field where I want write my time

<input type="input" class="form-control boxed" name="date_time"/>

and this is my code which won't work

exec('date +%Y-%m-%dT%H:%M -s "'.$_POST['date_time'].'"');
exec('hwclock -w'); 

Answer 1

The reason why this is not working is probably because php user do not have enough permissions to do that. Which is good. You should not do that. Especially not in this way. Imagine someone posting to your server something like this:

 curl -d 'date_time=2021-06-10T02:22";malicious_command;echo "' -X POST http://your.server.tld/

What php is going to execute? Something like this:

date +%Y-%m-%dT%H:%M -s "2021-06-10T02:22";malicious_command;echo ""

And boom. Your machine just run malicious_command. This could be any command. Stealing and destroying Your data or just take control on this machine: More about those type of attacks: https://owasp.org/www-project-top-ten/2017/A1_2017-Injection

Set proper timezone on your server: https://linuxize.com/post/how-to-set-or-change-timezone-on-debian-10/

Then keep your local clock up to date by periodically querying ntp servers. Rdate and cron are ok for this task.