(Applies to 4.7.x as well)
If a module implementor wishes to delete node(s) during a cron run, node_delete fails (silently) due to node_access() check on the anonymous user context (anon users usually don't have node deletion privileges, for good reason)
http://drupal.org/node/28142 suggests that the module can 'switch' user contexts, but this seems to be a kludgey way to do it.
Perhaps node_delete could have a second parameter that allows a bypass of the node_access check? This parameter could default to TRUE.
Or a second version of node_delete that doesn't check node_access?
Or, is there a better way to cleanly delete nodes from within a cron hook in the anonymous user context? Is there another API that should be used instead?
Comments
Comment #1
reg commentedI just came across the same problem, subscribing.
Comment #2
reg commentedI saw a good answer in another post, simply do this:
$userTmp = $user;
$user = node_load(1); #or whatever user you want that has enough permissions
...Your Code...
$user = $userTmp;
For security I also added at the top of my script:
If ($_GET['mycustomvariablenoteasytoguess'] != 'mycustomvaluenoteasytoguess') exit;
Then just add the above value to your call from the cron and that way other people can't run the script and cause deletes, either by accident or on purpose.
Comment #3
dpearcefl commentedConsidering that no new features will be added to D5 and that no one has shown any interest in this issue for a long time, I am closing this issue ticket. If you think we still need this feature request, please reopen it and move it to the D8 issue queue.
Comment #4
promesToday I did run into the same problem on two new sites in D6.
I did, during a cron-run, try to delete:
- event-nodes some time after the end-date of the event (both sites).
- news-nodes (my own defined nodetype) some time after the news-item has been created (one site).
In total it will be up to 50 nodes a month, saving a lot of stupid work.
I would be pleased when there would be a standard drupal function.
Now I have two choices:
- the kludgey way: implement solution #2
- implementation dependend / not failsafe for the future: create a copy of node_delete() without the node_access check.
I vote for an implementation in D8.
Comment #5
promesI just found a Drupal safe way. See Safely Impersonating Another User.
Comment #6
mdupontAs Promes says, the correct way to do this in Drupal 6 is to safely impersonate the admin user just before a sensitive operation such as node_delete(). At this point Drupal 6 will not integrate this feature (this is D8 or D9 stuff if it's still relevant there)