In the admin-menu, the 'Run cron' menu item is accessible to any user with 'access administration menu' permission. Would it be a good idea to do an access check on this menu item as well?
I quick-fixed this by changing:
// Add system update links.
admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run cron'), 'path' => 'admin/logs/status/run-cron', 'weight' => 50, 'query' => drupal_get_destination()));
if ($user->uid == 1) {
admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run updates'), 'path' => $base_url .'/update.php', 'weight' => 50));
}
to:
// Add system update links.
if ($user->uid == 1) {
admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run cron'), 'path' => 'admin/logs/status/run-cron', 'weight' => 50, 'query' => drupal_get_destination()));
admin_menu_add_item($_admin_menu, $mid_icon, array('title' => t('Run updates'), 'path' => $base_url .'/update.php', 'weight' => 50));
}
If this seems like a good idea, I could work on a more refined patch.
Comments
Comment #1
brunodboThe above code snippet is in admin_menu.inc, line 149.
Comment #2
sunTwo issues here:
a) While admin/logs/status/run-cron can only be accessed by users with the "administer site configuration" permission,
b) all users, including anonymous users, can always access /cron.php.
Hence, limiting the access to this item would only limit access to the administrative helper menu path. I don't know whether it's worth the trouble.
Comment #3
brunodboYep, that's what I wanted to achieve: I have a role for users administering the site (needing the run cron link), and another role for content admins (not needing the run cron link in the administration menu and, often being non-technical people, possibly confused by the 'Run cron'-link).
Comment #4
sunwell, then file a patch :)
Comment #5
brunodboThe attachted patch adds a 'display cron link' permission on /admin/user/access (in analogy with the 'display drupal links' permission). When this permission is granted, the 'Run cron' link is displayed in the administration menu.
(Note: patch was created from within the /sites/all/modules directory.)
Comment #6
sunGood start! Unfortunately, this won't work out. The system module of Drupal core already defined the required permission to access the path, which is "administer site configuration", so we can not implement a new permission for this path, since the permission of system module will be checked as well.
Comment #7
brunodboThanks for explaining!
Attached patch checks the 'administer site configuration' permission. If it is granted, the 'Run cron' link is displayed - and the user can actually click the link without being sent to a 403 page :-).
Comment #8
brunodboComment #9
sunCommitted a slight variation of this patch to 3.x.