The project_db_rewrite_sql() hook prevents cron.php from closing tickets that were closed more than a week ago. That is, since cron.php is running as anonymous and anonymous users on my site aren't permitted to see our issues (you must login to do that), the cron task fails to see the tickets that need closing in order to close them.
The solution seems to be to strip out the db_rewrite_sql() call and just execute the given SQL as is (or run cron.php manually as a logged user with access to the issues).
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | project_issue_cron_fix_0.patch | 1.15 KB | hunmonk |
| #3 | project_issue_cron_fix.patch | 1.16 KB | hunmonk |
Comments
Comment #1
hunmonk commentedhm. i thought we had fixed this issue previously...
Comment #2
dwwnope, we never fixed this... we talked about it, but never actually worked on it.
Comment #3
hunmonk commentedi don't think there's a security risk here with removing the db_rewrite_sql(). we're loading up nodes and project comments internally and saving them back again. reviewing the code flow, i don't see any opportunities for any kind of attack vector, and there's no user output.
Comment #4
hunmonk commenteddrumm: hunmonk, eaton: there is a precedent for not using db_rewrite_sql on cron-- the search indexer
moshe_work: hunmonk: looks ok to me too
i believe enough of us agree to move forward with this approach... :)
attached was applied to 5.x-1.x, 4.7.x-1.x, 4.7.x-2.x
Comment #5
(not verified) commented