Execute php block without saving to a file, without changing internal path

Question

Say I have a block of code I would like to test like this:

<?php 
 
 require('wp-blog-header.php');
 require('wp-includes/pluggable.php');
 ..........................
 ..........................
?>

Nginx:

location ~ /internal_token { 
    fastcgi_pass   unix:/tmp/php-fpm.sock;
    fastcgi_param  SCRIPT_FILENAME  # is possible to execute php some how, without call to filename?
    include        fastcgi_params;
}

The invisible file have to be in main root directory of WordPress because use require files, I am trying to avoid creating file or symlynks.

Is there an existing solution to this problem?

Update: I building a system like WordPress toolkit of cpanel, so I will add the feature 1-Click Login

No, it isn't possible. PHP-FPM expects a file name from nginx as specified by FCGI protocol. For example, when you are using docker-compose with several containers including nginx and PHP-FPM, you can have nginx and PHP-FPM in different containers and call PHP-FPM from nginx via TCP, but you can't have PHP code and PHP-FPM daemon in different containers - PHP-FPM needs the PHP code to be accessed via filesystem. — Ivan Shatsky, Nov 07 '21 at 08:34
What is the reason for doing that? How about using PHP `eval()` function? — Truong Hua, Nov 08 '21 at 11:50
It sounds like you want to test things based on a magic key/token present under certain circumstances. Personally, this sounds like it would be a million times easier to do at the application level, WordPress has a plethora of hooks to enable this. However, you could use [`map`](https://stackoverflow.com/a/46831117/231316) to route your request conditionally. You could also [`mirror`](https://nginx.org/en/docs/http/ngx_http_mirror_module.html) the requests to something with an output buffer. Lastly, you could also just use the CLI to invoke and control your request. — Chris Haas, Nov 08 '21 at 21:37
thank you for all the comments, this script is for auto login, I want to be all transparent without save a file in root directory — The nothing, Nov 08 '21 at 22:09
I believe this person is asking for help building a tool for brute-forcing WordPress. — Ярослав Рахматуллин, Nov 12 '21 at 10:15
@Thenothing What are you trying to do ? this sounds like an XY problem — exussum, Nov 12 '21 at 10:30
What do you want to test? The given PHP code is obviously invalid. Also, if you had valid PHP code, why not run it through `php -r`? — Nico Haase, Nov 12 '21 at 10:32
"this script is for auto login" - why do you need to run PHP code for this that is not part of the WordPress core? — Nico Haase, Nov 12 '21 at 10:33
About this: "I believe this person is asking for help building a tool for brute-forcing WordPress." I building a system like WordPress toolkit of cpanel — The nothing, Nov 12 '21 at 11:42

score 1 · Answer 1 · answered Nov 11 '21 at 19:13

If you had an "upstream" you could use nginx's auth_request in order to make an additional request and retrieve data (e.g. server-side authentication token) before continuing with the primary request.

e.g. all requests to /api trigger an auth_request to an internal location /auth/check which returns pass/fail (and optionally data that can be bundled along). If the check passes then the request continues to /api or whatever.

Not sure that helps you and not sure that is possible with php-fpm but pretty useful for some use cases.

Ярослав Рахматуллин · Accepted Answer · 2021-11-12T10:46:27.020

No, it is not possible to execute random PHP code from the context of Nginx configuration.

From the manual

Syntax: fastcgi_param parameter value [if_not_empty]; Default: — Context: http, server, location Sets a parameter that should be passed to the FastCGI server. The value can contain text, variables, and their combination. These directives are inherited from the previous configuration level if and only if there are no fastcgi_param directives defined on the current level.

The following example shows the minimum required settings for PHP:

fastcgi_param SCRIPT_FILENAME /home/www/scripts/php$fastcgi_script_name; fastcgi_param QUERY_STRING $query_string;

The appropriate / intended use of that directive is to set environment variables, not to pass arbitrary code to an arbitrary fast-cgi interpreter.

If you want to execute a specific script, then use the SCRIPT_FILENAME parameter as described in the manual.

I don't think the protocol forbids such behavior, because one can send almost anything with FCGI_PARAMS, at least according to my interpretation. However, judging by this implementation the SCRIPT_FILENAME is at least a convention: PHP OOP fastcgi

Execute php block without saving to a file, without changing internal path

2 Answers2