2

I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).

Any ideas on how to do that?

UPDATED (I think this will work):

public function actionMethod() 
{
    $this->requireAjaxRequest();

    $key = craft()->request->getParam('key');

    if($key == 'random-string' && $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
        craft()->plugin_name->actionMethod();
    }

}

Note, this is twinned with a cron tab that looks like: curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string

0

Have your cron job pass in a super-duper top-secret key via the querystring.

yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme

You can use a site like www.guidgen.com to generate the key.

Then just have your action check for that key, make sure it matches and bail if it doesn't.

  • Thanks Brad, does my updated question look like it would work to you? – H2ONOCK Nov 19 '15 at 17:44
  • 1
    Looks good to me! – Brad Bell Nov 19 '15 at 17:50
1

Along with Brad's answer, one additional easy check in your code would be to see if the $_SERVER['REMOTE_ADDR'] is the server's IP and then bail if it's not.

That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.