> My first reaction when I read this was "You shouldn't" 😅...
* this was my first reaction as well; in many years of BD and Drupal dev I've never had occasion for this; so i'm curios as to what your use case is.
> Can I do this securely?
depends on a lot
what is the bash script doing? is just `ls` then prolly fine
who can access it; admin only; everyone?
> Can anyone point me at any existing sample code?
@bwpanda has shown how `drush` is doing it; should work in backdrop too, but it should be pointed out a `drush` user is a cli user and already has access to cli and bash scripting ... that is a big difference
> How would I do this?
the how is in the `drush` example.
Might be better to tell us about your use case and find an alternate method to what you are trying to accomplish.
But I agree with everyone else, however that gets called needs to be completely locked down. My off the cuff suggestion is to not have this in a module, but have it embedded into a page and use the normal roles/permissions to lock the page down. Basically KISS.
However, it's not clear to me that this is a good option and I understand the concerns.
We are currently experimenting with another option. We have set up a script that runs on periodic basis. Each time the script runs, it checks the database for a new request. If there is a new request for a specific action, it runs another script on the server to fulfill that request.
In this case, the script is only looking for specific values and if that specific value is present, it takes the action requested.
This seems like it's a lot safer. Any thoughts?
Happy to discuss the specifics with anyone in Zulip. :-)
Posted5 days 2 hours ago by Martin Price | System Horizons Ltd (yorkshirepudding) in Weekly Meetings
Recent comments
I've started to read up on creating modules, but I think this is waaay out of my league at the moment due to what I perceive as the complexity of my issue.
find all files with...
@NumerousHats How about using Bee from the command line to upgrade core and modules.
I have some scripts using a modified version of bee in my repos on github if they are any help.
I...
Posted3 hours 8 min ago by Francis Greaves (themetman) on:
We are looking for the similar functionality. I have noticed that Drupal 10 added https://www.drupal.org/project/media_download_tracker . It provides the following information for each...
Hello @NumerousHats,
I agree with your assessment. I am looking into this situation right now.
The root of this problem is that Backdrop CMS is implemented on top of a "stack" of...
Posted2 days 10 hours ago by Graham Leach (Graham Leach) on:
I just installed a Backdrop CMS site with version 1.27.0. I then used the user interface to download and update Backdrop CMS to 1.30.0.
After starting the update process, and on the...
Comments
Here's an example of Drush calling the `fix-permissions.sh` script: https://github.com/backdrop-contrib/drush/blob/2b439610d644a0d82f541b047...
You could use that as a basis for your hypothetical code.
My first reaction when I read this was "You shouldn't" 😅...
...but if you are to, then I would suggest to also pair it with a
user_access()
and/oruser_has_role()
check.If you want to run the script while not logged in, then I'd also add a token to the mix (see how the cron URL token works).
> My first reaction when I read this was "You shouldn't" 😅...
* this was my first reaction as well; in many years of BD and Drupal dev I've never had occasion for this; so i'm curios as to what your use case is.
Might be better to tell us about your use case and find an alternate method to what you are trying to accomplish.
Ignoring "If you should..."
A Backdrop module is just PHP, so, first result from Google:
https://stackoverflow.com/questions/11052162/run-bash-command-from-php
# # #
But I agree with everyone else, however that gets called needs to be completely locked down. My off the cuff suggestion is to not have this in a module, but have it embedded into a page and use the normal roles/permissions to lock the page down. Basically KISS.
Best,
Michael
I did some experimenting and was able to run a bash script located within the Drupal directory using the php function:
https://www.php.net/manual/en/function.exec.php
However, it's not clear to me that this is a good option and I understand the concerns.
We are currently experimenting with another option. We have set up a script that runs on periodic basis. Each time the script runs, it checks the database for a new request. If there is a new request for a specific action, it runs another script on the server to fulfill that request.
In this case, the script is only looking for specific values and if that specific value is present, it takes the action requested.
This seems like it's a lot safer. Any thoughts?
Happy to discuss the specifics with anyone in Zulip. :-)