incorrect(?) assumption on cron execution security #32150
Description
The questions that was asked:
"Is it possible to use wget instead of php in cron for Magento 2?"
the answer from adobe:
"I think the answer to the question is straightforward - no, you cannot use wget instead of php in cron in Magento 2. And we are not likely to add this by default due to security ramifications."
Please explain. Because running the code under the website user is in my opinion more secure than as a user account. Php even advices to use disable_functions to disable shell execution. (because that bypasses the openbasedir).
Running the cron job via wget/curl allows for php restrictions to be in place, like limit execution time, like the openbase dir.
The command line does not have that at all. How can that be more secure.
The webuser has been configured and secured to execute website scripts and user/shell accounts are not configured to execute website scripts.
I would flag this issue as high. Because if this assumption is indeed incorrect, you have implemented exactly the opposite, and chosen the less secure implementation.