Poormanscron should not allow changing session of the user who triggered the cron [#805178]

In my previous project, I found that when there's a drupal_set_message('something') in hook_cron, it will display messages to the user who actually triggered the cron by javascript. I know usually it's not a good practice to write drupal_set_message in hook_cron but it does existed in core modules, for example aggregator_cron. It calls aggregator_refresh which contains drupal_set_message.

Here below is the patch I created to fix this issue:

Comment	File	Size	Author
#3	poormanscron.module.patch	731 bytes	andyhu
#3
#2	poormanscron.module.patch	561 bytes	andyhu
#2
#1	poormanscron.module.patch	418 bytes	andyhu
#1
	poormanscron.module.patch	765 bytes	andyhu

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

andyhu CreditAttribution: andyhu commented 21 May 2010 at 05:04

File	Size
poormanscron.module.patch	418 bytes

Changed the patch a bit, it's better but still not ideal.

Comment #2

andyhu CreditAttribution: andyhu commented 22 May 2010 at 00:57

Title:

Poormanscron should not allow drupal messages to be displayed to the user who triggered the cron

» Poormanscron should not allow changing session of the user who triggered the cron

File	Size
poormanscron.module.patch	561 bytes

Changed the patch again, now it should work!

I used session_write_close before cron runs so that any changes for $_SESSION will not be saved during running cron.
Here's the code to prove the concept, we may write it in a page call back or execute it in devel php:

if(!isset($_SESSION['a'])) {
  $_SESSION['a'] = 'b';
}
session_write_close();
drupal_set_message($_SESSION['a']);
$_SESSION['a'] = 'c';
session_write_close();