Fix #23: Possible security issue: Remote Code execution as root

README.md

@@ -5,25 +5,15 @@
 
 Installs Composer, the PHP Dependency Manager.
 
-## Requirements
-
-- php (version 5.3+) should be installed.
-
 ## Role Defaults Variables
 
     composer_path: /usr/local/bin/composer
     composer_update: true
     composer_update_day: 20
-    env_proxy: {}
 
 The path where composer will be installed and available to your system. Should be in your user's `$PATH` so you can run
 commands simply with `composer` instead of the full path.
 
-You can specify where is php with `env_proxy` variable. For example :
-
-    env_proxy:
-      PATH: "/usr/local/zend/bin"
-
 You can also setup a global composer directory and make the bin directory available in the `$PATH` automatically by:
  
     composer_path_env: true
@@ -50,15 +40,17 @@ To prevent that, you must configure github oauth token to go over the API rate l
       roles:
         - { role: kosssi.composer }
 
-## Vagrant
+## Tests
 
 If you have vagrant, you can test this role:
 
     cd tests
     vagrant up
+    vagrant provision
 
 ## Special thanks to contributors
 
 * [jnakatsui](https://github.com/jnakatsui)
-* [yoshz](https://github.com/yoshz)
-* [jrobeson](https://github.com/jrobeson)
+* [Yosh](https://github.com/yoshz)
+* [Johnny Robeson](https://github.com/jrobeson)
+* [Sebastian Krebs](https://github.com/KingCrunch)

defaults/main.yml

@@ -8,7 +8,6 @@ composer_path_env: False
 composer_home_owner: root
 composer_home_group: root
 composer_global_packages: {}
-proxy_env: {}
 
 # Visit https://github.com/settings/applications 
 # and generate personal access token

tasks/install.yml

 ---
 
 - name: Download and install Composer into the target directory.
-  shell:
-    php -r "readfile('https://getcomposer.org/installer');" |
-    php -- --install-dir={{ composer_path|dirname }} --filename={{ composer_path|basename }}
-    creates={{ composer_path }}
-  environment: proxy_env
+  get_url:
+    url=https://getcomposer.org/composer.phar
+    dest={{ composer_path }}
+    mode=0755