In the admin-menu, the 'Run cron' menu item is accessible to any user with 'access administration menu' permission. Would it be a good idea to do an access check on this menu item as well?

I quick-fixed this by changing:

// Add system update links.
admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run cron'), 'path' => 'admin/logs/status/run-cron', 'weight' => 50, 'query' => drupal_get_destination()));
  if ($user->uid == 1) {
    admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run updates'), 'path' => $base_url .'/update.php', 'weight' => 50));
  }

to:

// Add system update links.
  if ($user->uid == 1) {
    admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run cron'), 'path' => 'admin/logs/status/run-cron', 'weight' => 50, 'query' => drupal_get_destination()));
    admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run updates'), 'path' => $base_url .'/update.php', 'weight' => 50));
  }

If this seems like a good idea, I could work on a more refined patch.

CommentFileSizeAuthor
#7 cron_link2.patch1.22 KBbrunodbo
#5 cron_link.patch1.68 KBbrunodbo

Comments

brunodbo’s picture

The above code snippet is in admin_menu.inc, line 149.

sun’s picture

Category: feature » bug
Priority: Normal » Minor

Two issues here:

a) While admin/logs/status/run-cron can only be accessed by users with the "administer site configuration" permission,

b) all users, including anonymous users, can always access /cron.php.

Hence, limiting the access to this item would only limit access to the administrative helper menu path. I don't know whether it's worth the trouble.

brunodbo’s picture

Hence, limiting the access to this item would only limit access to the administrative helper menu path.

Yep, that's what I wanted to achieve: I have a role for users administering the site (needing the run cron link), and another role for content admins (not needing the run cron link in the administration menu and, often being non-technical people, possibly confused by the 'Run cron'-link).

sun’s picture

well, then file a patch :)

brunodbo’s picture

Status: Active » Needs review
StatusFileSize
new1.68 KB

The attachted patch adds a 'display cron link' permission on /admin/user/access (in analogy with the 'display drupal links' permission). When this permission is granted, the 'Run cron' link is displayed in the administration menu.

(Note: patch was created from within the /sites/all/modules directory.)

sun’s picture

Status: Needs review » Needs work

Good start! Unfortunately, this won't work out. The system module of Drupal core already defined the required permission to access the path, which is "administer site configuration", so we can not implement a new permission for this path, since the permission of system module will be checked as well.

brunodbo’s picture

StatusFileSize
new1.22 KB

Thanks for explaining!

Attached patch checks the 'administer site configuration' permission. If it is granted, the 'Run cron' link is displayed - and the user can actually click the link without being sent to a 403 page :-).

brunodbo’s picture

Status: Needs work » Needs review
sun’s picture

Version: 5.x-2.8 » 5.x-3.x-dev
Status: Needs review » Fixed

Committed a slight variation of this patch to 3.x.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.