Tag Info

Hot answers tagged

9

Hardening WordPress on the WordPress Codex is a very good article on how to secure your WordPress blog, which goes into quite some detail on file permissions, as well as some other methods of securing WP.


8

"All privileges" usually means you should grand everything to the user. However ... I've found at least one article that claims the MySQL user only needs: SELECT INSERT UPDATE Digging deeper, I found that in order to operate fully (automated updates, plug-in installation/uninstallation, etc.), WordPress requires some additional permissions: DELETE ...


8

Use Justin Tadlock's plugin "Members". It gives you the ability to create new roles and edit existing roles, as well as add custom capabilities. All that work that you'd have to do can be taken down to a few clicks. I know you said in your comment on ZaMoose's answer that you are 'looking to write the functionality myself so I have full control over ...


7

You want the admin_menu hook, rather than admin_init. Also, you shouldn't use anonymous functions. Instead, use: function wpse51004_add_menu_page() { add_menu_page('Some Page', 'Some Page', 'manage_options', 'some-slug', 'wpse51004_some_page_callback'); }; add_action('admin_menu', 'wpse51004_add_menu_page'); function wpse51004_some_page_callback() { ...


6

Method 1: Remove the upload_files capability from the respective roles. e.g. removing it from author: $role = get_role( 'author' ); $role->remove_cap( 'upload_files' ); This is saved to the database so it should only happen once, not on every page load. Removing it from the editor role should be the same albeit with the obvious modification. Removing ...


5

Don't let the action die, just do a redirect (to wherever you'd like): function wpse_92155_before_delete_post() { wp_redirect(admin_url('edit.php')); exit(); } // function wpse_92155_before_delete_post add_action('before_delete_post', 'wpse_92155_before_delete_post', 1);


5

The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard. Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a ...


5

The UI select element On user-edit.php, you see the drop-down in the UI. The drop down <select> wrapper is hard coded. Then the admin interface does a nifty thing 1) according to the inline comment: // Get the highest/primary role for this user. In fact it is getting the first role, that was assigned to the user (this we have to keep in mind). Then ...


5

The register post type has a parameter called "capabilities" so you can have for instance 'capability' => __('organize_shop'), http://codex.wordpress.org/Function_Reference/register_post_type To create a new user/role/capability you can use add_role, add_cap, for a simple example to get you started: add_role( 'shop_owner', 'Shop Owner', array( ...


4

Many of the examples assume you're not the only person running stuff on the server, or that suPHP or some other utility is running to make PHP run as a user other than the web server. With a basic Debian LAMP install, where PHP runs as the www-data user, it's safe and normal to set ownership of everything under the web server document root directory as ...


4

The admin_menu action will hide the ACF menu, in this example for not-admins. And admin_head will block the access if the URL is accessed directly. E.g.: http://example.com/wp-admin/edit.php?post_type=acf and http://example.com/wp-admin/edit.php?post_type=acf&page=acf-settings add_action( 'admin_menu', 'wpse_59032_remove_acf_menu', 9999 ); add_action( ...


4

WordPress and Apache WordPress needs to be able to use Apache. By default Apache runs on Ubunutu as user www-data. And ... www-data is also a member of the group www-data So when you try to do a Git Pull then every file will have the wrong permissions as it's expecting the owner to be able to run things on Apache. If you do a CHOWN to make everything ...


4

I would use the hook before_delete_post as the last layer of protection against deletion (using @tf's solution, and which is the correct Answer). And first remove the "Delete" options from sight. The following hides the Bulk Actions and the Empty Trash button, and removes the Delete Permanently row action. With this code: add_action( ...


4

The easiest way to restore Super Admin privileges is to add a bit of code to your theme's functions.php file to add yourself back: include(ABSPATH . 'wp-admin/includes/ms.php'); $user = get_userdatabylogin('YOUR_USERNAME'); grant_super_admin($user->ID); Once your Super Admin privileges have been restored you can remove this code from your theme.


4

Do not point the URL to admin.php, use admin-post.php instead: '<a href="' . admin_url( 'admin-post.php?action=print.csv' ) . '">' In your plugin register a callback for that action: add_action( 'admin_post_print.csv', 'print_csv' ); function print_csv() { if ( ! current_user_can( 'manage_options' ) ) return; header('Content-Type: ...


4

Parts of WordPress use (s)FTP to transfer files. Updates, for example, use (s)FTP. Media uploads do not, at least not unless something has changed in 3.7. If you are connecting to an (s)FTP server you have to provide the credentials that that server needs. Your file permissions won't come into play until after that connection is made. There are constants ...


3

Let us solve this by going with your second option. So you want to restrict users from editing published posts, this can be done by adding this to your theme's functions.php file (please read the comments that is added): function restrict_editing_old_posts( $allcaps, $cap, $args ) { // Restrict users from editing post based on the age of post // Bail ...


3

The "user" running your webserver (sometimes _www, sometimes www-data, sometimes "nobody") lacks the permissions to edit these files. You can either change them to be owned by that user or change them to 777. To find out what your web server user is, assuming you're running apache, run ps aux | grep httpd in the command line and in the leftmost column, see ...


3

As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers. I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads ...


3

Occasionally I've seen issues doing a manual reset of the password if salts have changed, or if there was an issue with the account before the reset. Some things to try: Are you sure you reset the password for the main admin account, usually ID #1? Trivial, I know, but has happened to me in the past. Try using the Emergency Password Reset Script, as it ...


3

I too needed to customise the list of available HTML tags in comments. I didn't want to define the CUSTOM_TAGS variable because it overrides everything that WP sets up in kses.php, but I wasn't sure where to hook the function. A little investigation showed that kses.php initialises its filters via kses_init() which is added as a function to 'init' with the ...


3

The others are not needed as you point out. Btw, what you could do is, conditionally set the user/pass based on the requested page. As in unprivileged with select/insert/update/delete for normal usage, and privileged with definition/index related stuff in addition when visiting the upgrade page.


3

@pwnguin, I had the same problems running mod_php with WordPress and I finally figured it out. # chown www-data:www-data /home/CIM140/public_html/wordpress/ -R As long as YOU control the box this won't cause any security issues. EDIT: You might also need to change your umask to 022 so new directories created by WordPress will have 755 permissions ...


3

Message you quoted is being generated by members_content_permissions_protect() function. By default it is used as a filter on the_content() and the_excerpt() functions. Since your custom template doesn't use these - there is no case for function to run. Try something like this in template: $content = 'Content to protect'; echo ...


2

I faced the same situation as you and what i did was create a custom post type named" homepage" and also created "Bainternet Posts Creation Limits" plugin to limit the creation of each post type per user. Try it out http://wordpress.org/extend/plugins/bainternet-posts-creation-limits/


2

Sorry to do this, but I stumbled across the answer in the wordpress forums. It turns out that Role Scoper does this really well. The author of that forum post said it best: To enable a user to edit one particular page, but not anything else: Give them a WordPress role of Subscriber Manage > Pages > Edit their page Expand the "Editors" tab ...


2

There are no known security vulnerabilities in 2.9.2 If any new vulnerabilities are discovered the fix will be packported. (This has not happened but if it did we would get a version 2.9.3) WordPress does not have a backport policy that goes further than the previous major release so it is unknown when the 2.9 branch will stop being supported. WordPress ...


2

The tags that are allowed in comments are stored in the $allowedtags global variable. You can try adding elements to that list (the key is the tag name, the value is an array of allowed attributes). If you have problems with the timing you can play with the CUSTOM_TAGS global variable.


2

First, since you're using a premium Theme, you should first consult the Theme developer's support offerings. That said, I would try installing the Theme through WordPress, rather than manually: Delete the existing Theme folder in wp-content\themes` Go to Dashboard -> Appearance -> Themes, click the Install Themes tab, then the Upload sub-tab. ...


2

I've asked a similar but a bit more detailed question lately: MySQL Database User: Which Privileges are needed? The short installation instruction for WordPress ("5 Minutes") state that: Create a database for WordPress on your web server, as well as a MySQL user who has all privileges for accessing and modifying it. This is the minimum of privileges / ...



Only top voted, non community-wiki answers of a minimum length are eligible