-2

This question already has an answer here:

I want to bootstrap Drupal from an external PHP file located in Drupal's root directory. The following code will do the job.

error_reporting(E_ALL);
ini_set("display_errors", 1);
define('DRUPAL_ROOT', getcwd());
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

$html_1='<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN"
"http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" version="XHTML+RDFa 1.0" dir="ltr"
  xmlns:content="http://purl.org/rss/1.0/modules/content/"
  xmlns:dc="http://purl.org/dc/terms/"
  xmlns:foaf="http://xmlns.com/foaf/0.1/"
  xmlns:og="http://ogp.me/ns#"
  xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#"
  xmlns:sioc="http://rdfs.org/sioc/ns#"
  xmlns:sioct="http://rdfs.org/sioc/types#"
  xmlns:skos="http://www.w3.org/2004/02/skos/core#"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema#">
<head profile="http://www.w3.org/1999/xhtml/vocab">
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>HOW TO BOOTSTRAP DRUPAL FROM AN EXTERNAL PHP SCRIPT?</title>
</head>
<body>
';

$html_2 ='</body>
</html>';

global $user;

if ((user_is_logged_in()) && ($user->uid == 1)) { 
    //only if this is the admin, do stuff. for example:
    print $html_1;

    print  t("  <h1>This User</h1>\n") ; 

    print "  <p>Logged In</p>\n"; 
    print "  <p>User ID: ".$user->uid."</p>\n"; 

    print $html_2;

} else {
    drupal_access_denied();
    module_invoke_all('exit');
    drupal_exit();
}

Let's say I want to create a script that lets the admin export nodes of a certain content type. And let's assume I don't want to write a custom module or use views. I know that my way of doing that is the wrong way. I'm trying this in order to learn bootstraping Drupal from an external php script. If I put my script in Drupal's root directory, and I don't change anything in the .htaccess file, will the script cause any security issue?

So I want to know if this example safe, i.e. if the code doesn't have any security issues. So my question is about the security of the process.

marked as duplicate by Shawn Conn, Mołot, Yusef Mohamadi, Scott Joudry, Krishna Mohan Sep 4 '15 at 7:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • If you have physical access to disk where Drupal is, talking about security is void. Your script will do what you write, no limits, and Drupal will not stop it. If you read, you read. If you write, you write. Whatever, wherever you want. – Mołot Sep 1 '15 at 18:39
  • Can this script be called from other server? – Shad81 Sep 1 '15 at 18:55
  • It depends on where you put it and how you configure your webserver. Neither is it a Drupal question. – Mołot Sep 1 '15 at 18:56
  • Views data export – Mołot Sep 1 '15 at 19:03
  • @Shad81 If you've security question, you may try ask at: security.stackexchange.com, but you need to specify what exactly concerns you have as it's a bit too broad. No system is secured in 100% and you know about security implications after the fact. As far as you're doing everything the same as Drupal does, you're less affected. Just replicate how it's done in index.php and you should be safe. – kenorb Sep 2 '15 at 8:40
0

Why not to use drush to handle Drupal boostrap as demonstrated below?

So the file can contain a minimum content like (no need to call Drupal bootstrap):

<?php
drupal_set_message('Foo');

then run it as:

$ drush scr foo.php
Foo
  • I'm doing this as a learning task. The admin may run the PHP script via his browser. – Shad81 Sep 1 '15 at 16:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.