Run composer with a PHP script in browser

Question

Wondering if it's possible to execute composer from the browser with a little PHP wrapper as I don't have access to shell access to the server.

Not sure if you can do this with cURL?

Solution 1

Yes you can run Composer with a little PHP wrapper. All of the Composer source code is available in the Phar file, so it can be extracted and then you can run it after setting up an InputInterface to replace Composer expecting the commands to be passed in via the command line.

If you setup your directory structure like this:

./project  
./project/composer.json
./project/composer.lock
./project/webroot/composerExtractor.php  
./project/var/

Put the code below into composerExtractor.php and then run it from a web-browser, Composer should download all the libraries into:

./project/vendors/

As well as generating the class-loader files in that directory as well.

composerExtractor.php

<?php

define('EXTRACT_DIRECTORY', "../var/extractedComposer");


if (file_exists(EXTRACT_DIRECTORY.'/vendor/autoload.php') == true) {
    echo "Extracted autoload already exists. Skipping phar extraction as presumably it's already extracted.";
}
else{
    $composerPhar = new Phar("Composer.phar");
    //php.ini setting phar.readonly must be set to 0
    $composerPhar->extractTo(EXTRACT_DIRECTORY);
}

//This requires the phar to have been extracted successfully.
require_once (EXTRACT_DIRECTORY.'/vendor/autoload.php');

//Use the Composer classes
use Composer\Console\Application;
use Composer\Command\UpdateCommand;
use Symfony\Component\Console\Input\ArrayInput;

// change out of the webroot so that the vendors file is not created in
// a place that will be visible to the intahwebz
chdir('../');

//Create the commands
$input = new ArrayInput(array('command' => 'update'));

//Create the application and run it with the commands
$application = new Application();
$application->run($input);

?>

Although this is possible, it's not a fantastic idea but may be necessary if you can't use a host that gives you ssh access.

I'd strongly recommend at least getting a static IP address for yourself or your office and then restricting access to just your own IP, as well as probably deleting this script after it's run on the server to prevent it being accidentally run again.

Solution 2

An alternative to Danack's solution, is to include "composer/composer" as a dependency in your composer.json, and just use it's API, instead of extracting the contents from composer.phar.

composer.json

...
"require-dev": {
  "composer/composer": "dev-master",
}
...

Run composer install manually, so you'll be able to require it on the following script:

composer_install.php

<?php
require 'vendor/autoload.php'; // require composer dependencies

use Composer\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;

// Composer\Factory::getHomeDir() method 
// needs COMPOSER_HOME environment variable set
putenv('COMPOSER_HOME=' . __DIR__ . '/vendor/bin/composer');

// call `composer install` command programmatically
$input = new ArrayInput(array('command' => 'install'));
$application = new Application();
$application->setAutoExit(false); // prevent `$application->run` method from exitting the script
$application->run($input);

echo "Done.";

When you access the script from your browser, the command should run as expected.

Solution 3

I think it would be a better idea to actually run Composer on the machine that hosts your source code just before deployment.

You probably checkout your code from some kind of version control before you upload it to your host (or even just have it on your hard drive without). That machine should get Composer installed and execute composer install right before upload. You don't need to expose the production machine to download all the stuff.

Solution 4

I've successfully used this function. Keep in mind, that 'composer-source' is a directory with content extracted from composer.phar archive.

use Symfony\Component\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;
use Symfony\Component\Console\Output\StreamOutput;

function composerInstall() {
    //create composer.json with some content
    require_once 'composer-source/vendor/autoload.php';
    putenv('COMPOSER_HOME=' . __DIR__ . '/composer-source/bin/composer');
    chdir(__DIR__);
    $stream = fopen('php://temp', 'w+');
    $output = new StreamOutput($stream);
    $application = new Application();
    $application->setAutoExit(false);
    $code = $application->run(new ArrayInput(array('command' => 'install')), $output);
    return stream_get_contents($stream);
}

By the way, you can extract composer.phar on this site: http://unphar.com/

View more solutions

Comments

[Omranic]

This solution seems to be perfect for me, but it's for some unknown reasons it's not working. It just creates only the "vendor/bin/composer/.htaccess" & "vendor/bin/composer/cache" .. Any suggestions?

[Endel Dreyer]

Hey @Omranic, please check it out my actual working implementation here: github.com/doubleleft/hook/blob/master/src/Package/Manager.p‌​hp - it uses a second composer.json file for the additional packages. So you'll need to require the autoload.php of both vendor directories in your application.

[danemacmillan]

COMPOSER_HOME should not be pointing to the Composer binary. That environment variable is for setting Composer's home directory, which typically defaults to <user>/.composer. By defining the environment variable as described in your post, a directory called composer will be used for storing its cache, etc, in the /vendor/bin directory, which is not the purpose of that directory. It is not correct usage. It will work, but it is not doing what you think it is doing. Unless permissions interfere, defining it is superfluous.

[Laurens]

I am using this script to execute a composer require twig/twig but it give me this error message: Check getcomposer.org/doc/articles/… for more info on how to handle out of memory errors. Is there a possibility to fix this without having to increase my php memory limit (as I think that 128M should be enough)

[Toby Allen]

@Laurens please ask your question as a seperate Question, not as a comment

[Zane]

Depending on your use case, you may also want to use $application->setCatchExceptions(false); so that the PHP script gets notified of any exceptions that occur. By default they are rendered to stderr if available, PHP output if not.

[Navjot Singh]

I am doing in same way but not able to work and no error is showing for this. anyone can help me on this /