7

I've seen plenty of posts about cron and ZF but most of the solutions leave the job to be run available to triggering by the public.

What if you want to set up an action that can ONLY be run by cron? Not by some anonymous user and not by someone that has to log in?

The solution I am using involved putting a file outside of my web root, having it bootstrap enough of the ZF to use what I need (like, I don't need the view) and then hit that from cron. My questions are, is this a "best practice" way to do this? What if you needed to make the code accessible over the web but still need to prevent random users from finding and running it?

For illustration, here is what I am doing (that works) for a cron job run from the php command line, and on the same server, something like this:

* 10 * * * php /Apps/ZF/cronjobs/crontest.php

Webroot is: /Apps/ZF/someproject/

crontest.php:

<?php
ini_set('include_path', ini_get('include_path') . ':/Apps/ZF/someproject/library');

define('APPLICATION_PATH','/Apps/ZF/someproject/application');
define('APPLICATION_ENVIRONMENT','test');

//Include the loader (for loading ZF resources)
require_once 'Zend/Loader.php';

//Include the model (to access the Sites model in this case)
require_once(APPLICATION_PATH . '/models/Planets.php');

Zend_Loader::registerAutoload();

$configuration = new Zend_Config_Ini(
    APPLICATION_PATH . '/config/config.ini',
    APPLICATION_ENVIRONMENT
);

// DB adapter
$dbAdapter = Zend_Db::factory($configuration->database);

// DB table setup
Zend_Db_Table_Abstract::setDefaultAdapter($dbAdapter);

// Whatever code we want to run... 
$test = new Model_Planets();

$test->fetchEntries();

Zend_Debug::dump($test);
?>

So, as I said, this works so I'm not looking for someone to write me a solution... just curious about doing this "better". Also, what if I needed this to be accessible via the web but still want to keep it only runnable by cron? What about making it more flexible (because here I am hard coding a few paths that I suspect could be made more dynamic)?

I assume I could make a list of permitted servers, then test that with $_SERVER['REMOTE_ADDR']?

What do you all think? Suggestions? I work alone so I have no colleague to ask for help on this... SO is my colleague, in a way.

4 Answers 4

8

One way is to set an environmental variable.

So in your crontab

SCRIPT_RUN_ENV=cron
* * * * * foo.php // Whatever your line is

Then, in the application, just check that:

if (get_env('SCRIPT_RUN_ENV') != 'cron') {
    echo "Program cannot be run manually\n";
    exit(1);
}

Now, anyone can set their environmental variable to that value and successfully run the cron, but it should stop the trivial running (or accidental)...

But also note that anyone who can edit the environmental variable on the server can already execute it, so there's no real way to secure it from that angle (none that are automated at least)... It's also worth noting that you cannot inject an environmental variable through HTTP.

11
  • Ah! I didn't know you could set a variable in the crontab like that. That is useful but, as you said, anyone could add this variable... I'm still hoping for a more secure solution to the whole thing.
    – Lothar
    Feb 28, 2011 at 19:52
  • 2
    Only code that is requested belongs in the web root. If it's not usable by the webserver, move it outside the web root (including framework libraries, etc). Only content to be served to the browser belongs there...
    – ircmaxell
    Feb 28, 2011 at 19:54
  • 1
    Right but if you need to access something from an instance of cron that is on a remote server (using wget, lynx, curl or somesuch) you would need to keep it in the web root. So the issue of making it secure is still there. Securing it is the real problem in my question.
    – Lothar
    Feb 28, 2011 at 20:30
  • 2
    @Shehi: I would argue it makes it more portable since it's not relying on the SAPI implementation detail which you have no control over. At least with a simple environmental variable you have full control over it (and it really is 100% portable). Not to mention that a good coder uses the tools available to him/her to solve the problem in a manor that makes semantic sense. If this was going to be distributed, I would agree that it's not great to do. However, considering a one-off implementation, I don't see this as being dirty one bit, yet alone bad...
    – ircmaxell
    Feb 28, 2011 at 21:05
  • 1
    @Gaoshan: that depends on the meaning of secure for these purposes. And if someone has access to read and execute code on the local machine, I'd argue that it's impossible to secure it more than this provides. If someone can read the source, they can execute it. And it's impossible to inject an environmental variable through the web server (aside from setting it in web-server configuration). So it really is as secure as you can make it, and as portable as you can make it. Again, depending on the exact problem you're trying to solve...
    – ircmaxell
    Feb 28, 2011 at 21:10
4

Well, the value of PHPSAPI should differ when it's run via cron and web-server.

6
  • 1
    +1 , its much more nicer to determine the environment in your way –
    – tawfekov
    Feb 28, 2011 at 20:20
  • I just tested this, running it via wget from cron, and phpsapi outputs: 'apache2handler'. So wget will show the apache sapi while php from cron will show the cli sapi... seems like cron doesn't have anything to do with it.
    – Lothar
    Feb 28, 2011 at 21:09
  • That is the point... SAPI :) Wget is just another browser, text-based tho, which runs script as website. And cron runs it as a client program.
    – Gelmir
    Feb 28, 2011 at 21:22
  • But it doesn't have anything to do with cron, as you said in your comment. The value of PHPSAPI does not vary when it is run via cron and the webserver. Running wget will always result in the same PHPSAPI (whatever apache is in this case), running php from the command line will always result in the same as well (cli). Whether or not it is run from cron is immaterial.
    – Lothar
    Feb 28, 2011 at 21:33
  • No no no... You are confusing the point of my reply. Your test results were right. If you run it via Cron via wget, it will be wget affecting the PHPSAPI, not cron [PHPSAPI = apache2handler, as expected]. If you run it from command line like * * * * * php script.php, PHPSAPI will be = CLI. So if you need to distinguish Cron execution from regular browser one, just run it like that: * * * * * php script.php. Don't use wget. I just provided one way to solve this disambiguation problem.
    – Gelmir
    Feb 28, 2011 at 21:43
3

The best way to secure your php cron job is putting the php file in a non-public_html folder.

For example:

Your page is in /home/myuser/public_html/test.php

Move it to /home/myuser/test.php

and put in the cron job :

php -q /home/myuser/test.php

Now, no user can enter your page from browser and only the cron job can use it.

1

Not by some anonymous user and not by someone that has to log in?

Use an x.509 client certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.