Question

I’m considering the idea of a browser-based PHP IDE and am curious about the possibility of emulating the command line through the browser, but I’m not familiar enough with developing tools for the CLI to know if it’s something that could be done easily or at all. I’d like to do some more investigation, but so far haven’t been able to find very many resources on it.

From a high level, my first instinct is to set up a text input which would feed commands to a PHP script via AJAX and return any output onto the page. I’m just not familiar enough with the CLI to know how to interface with it in that context.

I don’t need actual code, though that would be useful too, but I’m looking for more of which functions, classes or APIs I should investigate further. Ideally, I would prefer something baked into PHP (assume PHP 5.3) and not a third-party library. How would you tackle this? Are there any resources or projects I should know about?

Edit: The use case for this would be a localhost or development server, not a public facing site.

Answer 1

Call this function trough a RPC or a direct POST from javascript, which does things in this order:

• Write the PHP code to a file (with a random name) in a folder (with a random name), where it will sit alone, execute, and then be deleted at the end of execution.
• The current PHP process will not run the code in that file. Instead it has to have exec permissions (safe_mode off). exec('php -c /path/to/security_tight/php.ini') (see php -?)
• Catch any ouput and send it back to the browser. You are protected from any weird errors. Instead of exec I recomment popen so you can kill the process and manually control the timeout of waiting for it to finish (in case you kill that process, you can easily send back an error to the browser);

You need lax/normal security (same as the entire IDE backend) for the normal PHP process which runs when called through the browser.

You need strict and paranoid security for the php.ini and php process which runs the temporary script (go ahead and even separate it on another machine which has no network/internet access and has its state reverted to factory every hour just to be sure).

Don’t use eval(), it is not suitable for this scenario. An attacker can jump out into your application and use your current permissions and variables state against you.