> My first reaction when I read this was "You shouldn't" 😅...
* this was my first reaction as well; in many years of BD and Drupal dev I've never had occasion for this; so i'm curios as to what your use case is.
> Can I do this securely?
depends on a lot
what is the bash script doing? is just `ls` then prolly fine
who can access it; admin only; everyone?
> Can anyone point me at any existing sample code?
@bwpanda has shown how `drush` is doing it; should work in backdrop too, but it should be pointed out a `drush` user is a cli user and already has access to cli and bash scripting ... that is a big difference
> How would I do this?
the how is in the `drush` example.
Might be better to tell us about your use case and find an alternate method to what you are trying to accomplish.
But I agree with everyone else, however that gets called needs to be completely locked down. My off the cuff suggestion is to not have this in a module, but have it embedded into a page and use the normal roles/permissions to lock the page down. Basically KISS.
However, it's not clear to me that this is a good option and I understand the concerns.
We are currently experimenting with another option. We have set up a script that runs on periodic basis. Each time the script runs, it checks the database for a new request. If there is a new request for a specific action, it runs another script on the server to fulfill that request.
In this case, the script is only looking for specific values and if that specific value is present, it takes the action requested.
This seems like it's a lot safer. Any thoughts?
Happy to discuss the specifics with anyone in Zulip. :-)
I did try something similar to this as well, but as far as I can tell, there is no option to set the timezone handling in backdrop's views. :( I can set a different date format, but I cannot...
Being on a vacation, I can't check the option to choose a time zone format in a views block. However, here is another idea: Add the field to a layout.
Backdrop allows individual fields to...
Posted23 hours 59 min ago by Olaf Grabienski (Olafski) on:
With the help of the Backdrop office hours crew, I was able to figure out a solution that works for me.
I just added an explicit format setting to the long-text field before saving it,...
Comments
Here's an example of Drush calling the `fix-permissions.sh` script: https://github.com/backdrop-contrib/drush/blob/2b439610d644a0d82f541b047...
You could use that as a basis for your hypothetical code.
My first reaction when I read this was "You shouldn't" 😅...
...but if you are to, then I would suggest to also pair it with a
user_access()
and/oruser_has_role()
check.If you want to run the script while not logged in, then I'd also add a token to the mix (see how the cron URL token works).
> My first reaction when I read this was "You shouldn't" 😅...
* this was my first reaction as well; in many years of BD and Drupal dev I've never had occasion for this; so i'm curios as to what your use case is.
Might be better to tell us about your use case and find an alternate method to what you are trying to accomplish.
Ignoring "If you should..."
A Backdrop module is just PHP, so, first result from Google:
https://stackoverflow.com/questions/11052162/run-bash-command-from-php
# # #
But I agree with everyone else, however that gets called needs to be completely locked down. My off the cuff suggestion is to not have this in a module, but have it embedded into a page and use the normal roles/permissions to lock the page down. Basically KISS.
Best,
Michael
I did some experimenting and was able to run a bash script located within the Drupal directory using the php function:
https://www.php.net/manual/en/function.exec.php
However, it's not clear to me that this is a good option and I understand the concerns.
We are currently experimenting with another option. We have set up a script that runs on periodic basis. Each time the script runs, it checks the database for a new request. If there is a new request for a specific action, it runs another script on the server to fulfill that request.
In this case, the script is only looking for specific values and if that specific value is present, it takes the action requested.
This seems like it's a lot safer. Any thoughts?
Happy to discuss the specifics with anyone in Zulip. :-)