In my previous project, I found that when there's a drupal_set_message('something') in hook_cron, it will display messages to the user who actually triggered the cron by javascript. I know usually it's not a good practice to write drupal_set_message in hook_cron but it does existed in core modules, for example aggregator_cron. It calls aggregator_refresh which contains drupal_set_message.

Here below is the patch I created to fix this issue:

Members fund testing for the Drupal project. Drupal Association Learn more

Comments

andyhu’s picture

FileSize
418 bytes

Changed the patch a bit, it's better but still not ideal.

andyhu’s picture

Title: Poormanscron should not allow drupal messages to be displayed to the user who triggered the cron » Poormanscron should not allow changing session of the user who triggered the cron
FileSize
561 bytes

Changed the patch again, now it should work!

I used session_write_close before cron runs so that any changes for $_SESSION will not be saved during running cron.
Here's the code to prove the concept, we may write it in a page call back or execute it in devel php:

if(!isset($_SESSION['a'])) {
  $_SESSION['a'] = 'b';
}
session_write_close();
drupal_set_message($_SESSION['a']);
$_SESSION['a'] = 'c';
session_write_close();
andyhu’s picture

FileSize
731 bytes

Here is another patch which fix the issue I found together with the issue here http://drupal.org/node/793590

Dave Reid’s picture

Version: 6.x-2.2 » 6.x-2.x-dev

The latest 6.x-2.x code changes the session to the anonymous user and uses the same exact thing that the Drupal 7 cron feature does.