When you link a civicrm group with a massmailer list in order for the message to be sent by an anonymous cron run you need to make the group viewable to the anonymous user under /admin/access.

This is obviously not good as this allows anonymous users to view the contact info for all members of your group.

If you don't grant this permission, cron simply fails unless called by a logged in user that has the proper permissions.

Comments

onionweb’s picture

onionweb commented
Priority: Normal » Critical

I changed this to critical because it is a showstopper.

pwolanin’s picture

pwolanin commented

I think this issue is fundamentally the same as this: http://drupal.org/node/64857

i.e. Drual needs a way to let cron run as user #1, or another privileged user.

onionweb’s picture

onionweb commented

Actually, if you put

$global user;

at the top of phplist.module's cron hook, then the the email is successfully sent if you browse to cron.php while logged out.

onionweb’s picture

onionweb commented

Scratch that. I was wrong.

onionweb’s picture

onionweb commented

There is a work around:

1. Create user role whose only permission is "view all contacts." Leave every other permission field blank for this role.

2. Create a user and assign the user to this role. Assign the user only to this role. leave the others unchecked.

3. Set the user to "blocked."

4. Note the users UID number.

5. Edit phplist.module:

at the top of the cron hook, put:

$global user;
$orig_user = $user;
$user->uid = [the blocked user's uid]

Then after phplist_process_queue(); put

$user-uid = $orig_user->uid;

That will allow cron to process the queue - and in case the cron run fails, and the user->uid is not reset, it diminshes the potential for a security breach by blocking the user.

But it's kind of gnarly.

onionweb’s picture

onionweb commented

If you don;t wan't to create a user role and blocked user, you set the uid in the above code added to hook cron to "1" and then make sure your cron.php file is only accessible by the server with this htaccess line:


Order deny,allow
Deny from all
Allow from [your_server_ip]

You have to block cron.php in this way because anyone who browses to http://yoursite.com/cron.php become the superuser, even if only temporarily. Perhaps a line that deletes the user cookie and ends the session to also be added to the cron hook, just in case...

onionweb’s picture

onionweb commented 
<Files ~ "(cron.php)$">
Order deny,allow
  Deny from all
 Allow from 67.18.215.217
</Files>
lorisir’s picture

lorisir commented

Thanks for the workaround and the suggestions. I am trying to modify the cron hook in phplist.module to set the UID to 1 but I'm not sure exactly where/how to do that. Can you provide explicit instructions? I have got the .htaccess set up for my server to allow only the cron job to hit cron.php at this point.

Thanks much.