Been a while since i done it, but i’ve used thickbox to display php files, so i know it’s possible to use it for other things, i’ll go see if i’ve still got the code i used and make a suggestion.
—
Checked whilst i was writing the reply, here’s the attachment.php from a theme where i used thickbox to handle the display of attachments, some were php/phps files, others were images.
https://wordpress.pastebin.com/pRPCYP9Y
I also had to add php and phps to the whitelist for allowed mime types in order to upload them, which was done with the following.
function custom_upload_mimes ( $mimes ) {
$mimes['php'] = 'application/x-httpd-php-source';
$mimes['phps'] = 'application/x-httpd-php-source';
return $mimes;
}
add_filter( 'upload_mimes' , 'custom_upload_mimes' );
On top of that i also forced a content type in the upload directory(via htaccess file in the upload folder) when a file matched .php or .phps, i don’t have that code backed up but it looked like something along these lines though.
<FilesMatch "\.(php|phps)$">
Content-Type: application/x-httpd-php-source
</FilesMatch>
Beyond that, i’m not really sure if there was anything else i did(was 3 months ago and i’m no longer using the code), but perhaps you can take something away from the code i’ve provided.
EDIT: Additionally i added some URL rewrites to swap out the real file locations for some custom URLs, but that doesn’t play any part in the code working(that was just a personal touch so people couldn’t query the php files directly, etc..)