Description of problem:

moodle's cron can be executed in two ways:
-> standard crontab (if moodle service enabled with chkconfig)
-> web cron, sort of wget http://server/moodle/admin/cron.php

There should be an 'allow, deny...' block in apache so
the cron can't be run remotely via web by any unautenticated user.
Even worse, some valuable information is displayed in the
browser when cron is executed: new users, system paths...

I suggest to add the following code to restrict access to localhost:

<Location /moodle/admin/cron.php >
  <IfModule mod_authz_core.c>
    # Apache 2.4
    Require local
  </IfModule>
  <IfModule !mod_authz_core.c>
    # Apache 2.2
    Order Deny,Allow
    Deny from All
    Allow from 127.0.0.1
    Allow from ::1
 </IfModule>
</Location>

Version-Release number of selected component (if applicable):

moodle-2.4.6-1.el6.noarch

How reproducible:



Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: