• Resolved bluenet

    (@bluenet)


    With the recent change to “Security Hardening”, my previously written php scripts that automatically create php crons, no longer work. All dynamically created crons, still require the “needs attention” edit / resave.

    Is there a way to update my php scripts with the hash key, etc, so they run on their without editing a second time? I have some weekly and monthly scripts that I could use this for.

    Thanks in advance.

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Author John Blackbourn

    (@johnbillion)

    WordPress Core Developer

    Does your PHP script run within the context of the site? Or is it entirely separate?

    If it runs in the context of the site then you can use the following to create the $args for the cron event:

    $php = 'echo "Hello, World!"';
    $args = array(
      array(
        'code' => $php,
        'name' => 'My event name',
        'hash' => wp_hash( $php ),
      )
    );
    wp_schedule_event( ..., $args );

    Ref: https://github.com/johnbillion/wp-crontrol/blob/da0863cfc17ca1ed0b4ea34a289ae1a63a4357fc/src/bootstrap.php#L201-L207

    I might extract this into a help function that you can call directly, but you can use that for now.

    Let me know how it goes.

    Thread Starter bluenet

    (@bluenet)

    Hi John – On the github link, I noticed your array keys “code” and “hash” use the same variable ($cr->hookcode). Does the hash have to be hashed version of the code? or could the hash be the hashed “name” element? or any other unique text.

    Thoughts?

    Plugin Author John Blackbourn

    (@johnbillion)

    WordPress Core Developer

    Yes, the hash needs to be a hashed version of the PHP code in order to prevent it from being tampered.

    Thread Starter bluenet

    (@bluenet)

    I re-read your initial response again. While this is in context of the site, but I’m accessing *.php files using wp_remote_get(). Using your example and a few alternatives, I’m unable to get the hash to match and continue to receive the “needs attention” error. Is there a way to generate a hash for local PHP files?

    $php = "wp_remote_get('https://localdomain.com/test.php');";
    $args = array(
      array(
        'code' => $php,
        'name' => 'My event name',
        'hash' => wp_hash( $php ),
      )
    );
    wp_schedule_event( ..., $args );

    Thanks for your time. I appreciate it.

    Plugin Author John Blackbourn

    (@johnbillion)

    WordPress Core Developer

    What the PHP code actually does isn’t relevant, the key piece is if you’re able to call wp_schedule_event() and have it schedule the event then you should also be able to call wp_hash() on the PHP code and have it generate a valid hash.

    I don’t think I can help you much more with this. Your code looks correct. Are you able to create a PHP cron event manually from the Tools -> Cron Events -> Add New screen?

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Dynamically Creating PHP Crons with “Security Hardening”’ is closed to new replies.