Admin auto login for a cron job

Hi, I need to put some script from admin folder in cron job on my server. In that script I use some function from admin/includes/application_top.php . So I use require_once ('includes/application_top.php'); for call that function. When I call this script he need my interaction to login first like admin. Now, I need information on witch way I can create auto login on admin from my script.
Best regards

Here's one approach, which has basic security around it. You can enhance it further if you wish, but this should work as-is:

1. In your cron PHP script that calls application_top, put this before the call to application_top:```
   define('CRON_ADMIN_USER_ID', 99);

You can substitute 99 with whatever admin user id *number* you want, as long as it exists.
 So, when you create the user, it'll be assigned a number. THAT is the  number you need to enter in the define() statement mentioned above.
This number will be used to authenticate login, and for tracking admin activity in the admin activity log.

2. In your /admin/init_includes/init_admin_auth.php script, add the new lines as shown below:```
if (! defined('IS_ADMIN_FLAG')) {
  die('Illegal Access');
}

[B]if (!isset($_SESSION['admin_id']) && defined('CRON_ADMIN_USER_ID') && (int)CRON_ADMIN_USER_ID != 0) {
  $_SESSION['admin_id'] = CRON_ADMIN_USER_ID;
}
[/B]
if (!(basename($PHP_SELF) == FILENAME_LOGIN . '.php')) {

My host uses a GUI for cron job's, so i'm not able to add any lines.
Would there be a differend way to achive the same?

Robbie_79:

My host uses a GUI for cron job's, so i'm not able to add any lines.
Would there be a differend way to achive the same?

you dont need to add a line before your cronjob
you have to create a file in the admin folder
for example cron1.php

<?php
// filename: cron1.php
// make changes in /admin/init_includes/init_admin_auth.php
define('CRON_ADMIN_USER_ID', '13');
define('EMAIL_USE_HTML', false);
require ('includes/application_top.php');

// your code to run via cron 
// sends an email listing all orders with status $os
$os = 1;
$sql = 'SELECT orders_id, date_purchased, order_total, payment_method, customers_name FROM ' . TABLE_ORDERS . ' WHERE orders_status=' . $os;
$res = $db->execute($sql);
$content = 'orders_status: ' . $os . "\n\r\n\r";
while (!$res->EOF){
    $content .= implode(', ', $res->fields) . "\n\r";
    $res->MoveNext();
}
echo 'CRON1 ' . date('Ymd H:i:s');
zen_mail('Admin', STORE_OWNER_EMAIL_ADDRESS, 'ZC open orders', $content, 'ZC Cron1', STORE_OWNER_EMAIL_ADDRESS );

your cronjob command could look like:

/usr/bin/lynx -accept_all_cookies -dump http://localhost/PathTo/admin/cron1.php

thank you very much! it's a first-cron for me ;)

Will this method also make the cron page browser-accesible?

Robbie_79:

Will this method also make the cron page browser-accesible?

if you add a line like ```php
echo "<hr>" . $content;

but simple:  try it

if you need a linux environment under windows :: <http://jars.de/english/ubuntu-804-vmware-image-download-english> to test the console commands

I can't get it to work, im not experienced enough so help would be highly appriciated.

Let me write the full story,

What I want to achive is an automated status update.

I created a new admin page where I can manually batch-update a couple of filtered orders (I.E. all orders older then 7 days with status X and payment method Y etc).

The way I do this is by calling ```php
http://mydomain/admin/cron_status_update.php?action=order_remind

I though doing this by using WGET, its not the prettyest method but it should work
The cron command line looks like:
```php
/usr/local/bin/wget -O /dev/null -q http://mydomain/admin/cron_status_update.php?action=order_cancel

My apache log shows:

serverip - - [21/Mar/2009:17:59:00 +0100] "GET /admin/cron_status_update.php?action=order_cancel HTTP/1.0" 302 578 "-" "Wget/1.10.2"
serverip - - [21/Mar/2009:17:59:00 +0100] "GET /admin/login.php?zenAdminID=8e55e4a77660107242ae112b52be12e HTTP/1.0" 200 1709 "-" "Wget/1.10.2"

worth mentioning is that I made the edits in init_admin_auth.php and defined the cron_admin_user_id in my cron_status_update.php file

Probably i'm trying something silly. I hope someone can point me out whats wrong

Robbie_79:

What I want to achive is an automated status update.

/usr/local/bin/wget -O /dev/null -q http://mydomain/admin/cron_status_update.php?action=order_cancel

the cron1-example do a similar thing, so please try the cron1 example. if this dont work, then please look again at /admin/init_includes/init_admin_auth.php

you can try it directly in the browser: you must be logged-out; if the login displays, something went wrong

hugo13:

you can try it directly in the browser: you must be logged-out; if the login displays, something went wrong

then thats the problem... I cant acces the file directly when i'm logged out, it redirects me to login.php.
I rechecked the edits DrByte gave 10 times for typo's, i can asure you that aint the problem.

I have the Admin Profiles addon installed, maybe thats whats makes the difference?

Robbie_79:

I have the Admin Profiles addon installed, maybe thats whats makes the difference?

yes, this makes a great difference

1. if you have one, you have to edit /admin/init_includes/overrides/init_admin_auth.php in the same way as /admin/init_includes/init_admin_auth.php

2. you have to create an admin user with id==13 ( define('CRON_ADMIN_USER_ID', '13'); ); I did it via phpMyAdmin

3. you must grant permissions to admin-user 13 for the cron1.php via admin/admin_control.php?adminID=13

4. logout & try it via web-browser

5. now the cron-world should be OK

aah great.
If I only checked the AdminProfiles installation for overrides a bit earlyer :blush:

thanks Hugo! u were a great help to me ;)

Any particular reason you choose ID 13 for cron_user?

Robbie_79:

Any particular reason you choose ID 13 for cron_user?
NO, it's only the number in the name

Thanks for this, very useful.

To further secure it and avaoid people being eble to get to the admin without authentication I added:

if ($_SERVER['REMOTE_ADDR'] == $_SERVER['SERVER_ADDR']) {
define('CRON_ADMIN_USER_ID', '999');
}

So that only local scripts would be let through

Wouldn't it be better to put this test in:
/admin/includes/init_includes/overrides/init_admin_auth.php
rather than the script for the cron job?
Then if you make any future cron jobs they will have to be called locally too.

Dr Byte's solution works well for me but I thought I'd add a little caveat which might save somebody some time.

If you run your php program directly as a cron job it won't have the right working directory and won't find /includes/config.php so it will fail with;

ERROR: admin/includes/configure.php file not found. Suggest running zc_install/index.php?
To avoid this you need to tell cron to change directory before invoking PHP to run the program, so your cron command should read

cd "public_html/admin"; /usr/local/bin/php my_program.php	

Remember to leave a space between your path to PHP and the program name, you are invoking PHP with the program name as a parameter.

I hope this helps someone. :smile:

Hi Hugo...

I am unclear on what needs to be added to the init_admin_auth.php file in your example do I just need to define the CRON_ADMIN_USER_ID?

I have already added one to the database via SQL so now I just need to figure out this part and I am golden.

Thanks in advance.
Got toast!

hey - I'm trying to get a cron job to work too now. I keep getting an error in sessions.php so I'm guessing it is failing at authenticating the user or something. Anyone still around that knows how to do this and can help? I'm desperate for help!

Everyone - I got this working too with donothing's help! He/She rocks! This is making a huge difference for me and I greatly appreciate it.

DrByte:

Here's one approach, which has basic security around it. You can enhance it further if you wish, but this should work as-is:

1. In your cron PHP script that calls application_top, put this before the call to application_top:
   snip

2. In your /admin/init_includes/init_admin_auth.php script, add the new lines as shown below:
   snip

I tried this, but in the e-mail that I get when the cron runs, it says this:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <title>***</title> <link href="includes/stylesheet.css" rel="stylesheet" type="text/css" /> <meta name="robot" content="noindex, nofollow" /> </head> <body id="login" onload="document.getElementById('admin_name').focus()"> <form name="login" action="https://www.***.com/storemanager/login.php?zenAdminID=9s5nqcqspgpfgd5v3vls43lor5" method="post"> <fieldset> <legend>Admin Login</legend> <label class="loginLabel" for="admin_name">Admin Username:</label> <input style="float: left" type="text" id="admin_name" name="admin_name" value="" /> <br class="clearBoth" /> <label class="loginLabel" for="admin_pass">Admin Password:</label> <input style="float: left" type="password" id="admin_pass" name="admin_pass" value="" /> <br class="clearBoth" /> <input type="hidden" name="securityToken" value="bcbc7b1f6748bb93cb3aae681b130bfd"> <input type="submit" name="submit" class="button" value="Login" /> <a style="float: right;" href="https://www.***.com/storemanager/password_forgotten.php?zenAdminID=9s5nqcqspgpfgd5v3vls43lor5">Resend Password</a> </fieldset> </form> </body> </html>

Is there something else I can try?