CE Phoenix Cart Forum

Hi

There are a few pages in admin that I now want to get into a cron for updating automatically.

Things like Currencies, backup and probaly others

To update the currencies I would need to emulate the clicking of the update button, but there is a form ID as a session, which I assume is linked the person logged in at the time.

Think the code of the button is admin\inclues\actions\currencies\views\default.php And you can see formid' => $_SESSION['sessiontoken']]

what is the best / easiest way around this as I assume the cron will not have a session.

Thank you

David

The easiest way would be to either

1. Use something that logs in and creates a session.
2. Use something outside the web root that the cron calls. Skip the interface entirely.

There is software that can do the first. Selenium comes to mind. It's designed for testing, but would probably handle your use case.

For the second, you'd write that manually. Because it's bypassing the security checks, it needs to be outside the web root. The particular code that you want to bypass is at https://github.com/CE-PhoenixCart/Phoen ... n.php#L109

The easiest place to avoid it is likely https://github.com/CE-PhoenixCart/Phoen ... on.php#L17

Set up the form values in $_POST and replace that file with one that locates the action without validating the Form.

There are examples of how to do this from a different directory in ext. E.g. https://github.com/CE-PhoenixCart/Phoen ... pn.php#L20

Using chdir there gets you out of ext. What you want is to chdir into admin. You can use getcwd() to check how the directory is set before and after you chdir. Note that cron may set the initial working directly differently than running directly from the command line. Test with something harmless first to get it working before you automate the more dangerous things. An example of something harmless would be to run the thing that updates the currency values. If it doesn't run, you can update manually. If it does run, it will work.

And just to remind you again. You want whatever it is to not be inside the web root. You are turning off a security check for this. Outside the web root, it's only vulnerable to people who have server access (which you should probably verify is restricted; possibly set the file to only be readable by the cron user and a group that includes you; perhaps 460 or 570). Inside the web root, it's vulnerable to anyone who has web access or XSS access. You are literally turning off the XSS check. You do not want to do this in the admin web interface.

Thanks very much for the reply, while I understand some of it, I am struggling.

Is there an add-on I can buy to get the first one working, something I can play and use as a template?

Regards

Selenium: https://www.selenium.dev/

You could use something like Windsurf IDE or Gemini CLI (both free) to try to create the template that you want.

In terms of an add-on, the second approach would be more conducive to an add-on. I do not know of an existing one, but there could be one. Burt has done a certain amount of cron work.

OK cheers, I will PM Burt.

Regards