Run composer with a PHP script in browser

Question

Wondering if it's possible to execute composer from the browser with a little PHP wrapper as I don't have access to shell access to the server.

Not sure if you can do this with cURL?

Answer 1

Without shell exec privileges try this from within PHP:

<?php

require_once 'phar://composer.phar/src/bootstrap.php';

$application = new Composer\Console\Application();
$application->setAutoExit(false);
$application->run(new Symfony\Component\Console\Input\ArrayInput([
  'command' => 'status',
]));

Answer 2

An alternative to Danack's solution, is to include "composer/composer" as a dependency in your composer.json, and just use it's API, instead of extracting the contents from composer.phar.

composer.json

...
"require-dev": {
  "composer/composer": "dev-master",
}
...

Run composer install manually, so you'll be able to require it on the following script:

composer_install.php

<?php
require 'vendor/autoload.php'; // require composer dependencies

use Composer\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;

// Composer\Factory::getHomeDir() method 
// needs COMPOSER_HOME environment variable set
putenv('COMPOSER_HOME=' . __DIR__ . '/vendor/bin/composer');

// call `composer install` command programmatically
$input = new ArrayInput(array('command' => 'install'));
$application = new Application();
$application->setAutoExit(false); // prevent `$application->run` method from exitting the script
$application->run($input);

echo "Done.";

When you access the script from your browser, the command should run as expected.

Answer 3

I don't know if this is always done on installation, but I installed composer via Ubuntu's package, and it included "Composer" in the "/use/share/php" directory (which is in the include path).

Therefore, by simply having installed composer on the machine at all, I am able to do:

require_once 'Composer/autoload.php';
$application = new Composer\Console\Application();

Answer 4

Similar to Endel's answer, but I needed to capture the output from composer show --direct in an array, so I extracted some code from the ShowCommand file in the composer repository and made a composer-wrapper library, with which I can do:

$cw = new \shadiakiki1986\ComposerWrapper();
$packages = $cw->showDirect();

and get an associative array like ['composer/composer'=>'1.3.0.0']

Answer 5

I've successfully used this function. Keep in mind, that 'composer-source' is a directory with content extracted from composer.phar archive.

use Symfony\Component\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;
use Symfony\Component\Console\Output\StreamOutput;

function composerInstall() {
    //create composer.json with some content
    require_once 'composer-source/vendor/autoload.php';
    putenv('COMPOSER_HOME=' . __DIR__ . '/composer-source/bin/composer');
    chdir(__DIR__);
    $stream = fopen('php://temp', 'w+');
    $output = new StreamOutput($stream);
    $application = new Application();
    $application->setAutoExit(false);
    $code = $application->run(new ArrayInput(array('command' => 'install')), $output);
    return stream_get_contents($stream);
}

By the way, you can extract composer.phar on this site: http://unphar.com/

Answer 6

I think it would be a better idea to actually run Composer on the machine that hosts your source code just before deployment.

You probably checkout your code from some kind of version control before you upload it to your host (or even just have it on your hard drive without). That machine should get Composer installed and execute composer install right before upload. You don't need to expose the production machine to download all the stuff.

Answer 7

Yes you can run Composer with a little PHP wrapper. All of the Composer source code is available in the Phar file, so it can be extracted and then you can run it after setting up an InputInterface to replace Composer expecting the commands to be passed in via the command line.

If you setup your directory structure like this:

./project  
./project/composer.json
./project/composer.lock
./project/webroot/composerExtractor.php  
./project/var/

Put the code below into composerExtractor.php and then run it from a web-browser, Composer should download all the libraries into:

./project/vendors/

As well as generating the class-loader files in that directory as well.

composerExtractor.php

<?php

define('EXTRACT_DIRECTORY', "../var/extractedComposer");


if (file_exists(EXTRACT_DIRECTORY.'/vendor/autoload.php') == true) {
    echo "Extracted autoload already exists. Skipping phar extraction as presumably it's already extracted.";
}
else{
    $composerPhar = new Phar("Composer.phar");
    //php.ini setting phar.readonly must be set to 0
    $composerPhar->extractTo(EXTRACT_DIRECTORY);
}

//This requires the phar to have been extracted successfully.
require_once (EXTRACT_DIRECTORY.'/vendor/autoload.php');

//Use the Composer classes
use Composer\Console\Application;
use Composer\Command\UpdateCommand;
use Symfony\Component\Console\Input\ArrayInput;

// change out of the webroot so that the vendors file is not created in
// a place that will be visible to the intahwebz
chdir('../');

//Create the commands
$input = new ArrayInput(array('command' => 'update'));

//Create the application and run it with the commands
$application = new Application();
$application->run($input);

?>

Although this is possible, it's not a fantastic idea but may be necessary if you can't use a host that gives you ssh access.

I'd strongly recommend at least getting a static IP address for yourself or your office and then restricting access to just your own IP, as well as probably deleting this script after it's run on the server to prevent it being accidentally run again.