Tag Info

Hot answers tagged

9

Hardening WordPress on the WordPress Codex is a very good article on how to secure your WordPress blog, which goes into quite some detail on file permissions, as well as some other methods of securing WP.


9

"All privileges" usually means you should grand everything to the user. However ... I've found at least one article that claims the MySQL user only needs: SELECT INSERT UPDATE Digging deeper, I found that in order to operate fully (automated updates, plug-in installation/uninstallation, etc.), WordPress requires some additional permissions: DELETE ...


8

Use Justin Tadlock's plugin "Members". It gives you the ability to create new roles and edit existing roles, as well as add custom capabilities. All that work that you'd have to do can be taken down to a few clicks. I know you said in your comment on ZaMoose's answer that you are 'looking to write the functionality myself so I have full control over ...


7

You want the admin_menu hook, rather than admin_init. Also, you shouldn't use anonymous functions. Instead, use: function wpse51004_add_menu_page() { add_menu_page('Some Page', 'Some Page', 'manage_options', 'some-slug', 'wpse51004_some_page_callback'); }; add_action('admin_menu', 'wpse51004_add_menu_page'); function wpse51004_some_page_callback() { ...


6

Method 1: Remove the upload_files capability from the respective roles. e.g. removing it from author: $role = get_role( 'author' ); $role->remove_cap( 'upload_files' ); This is saved to the database so it should only happen once, not on every page load. Removing it from the editor role should be the same albeit with the obvious modification. Removing ...


6

Generally, it's never a good idea to have 777 set on anything. Read the links Thomas provided for more detail, but as a general rule 755 for folders and 644 for files is a good practice.


5

Don't let the action die, just do a redirect (to wherever you'd like): function wpse_92155_before_delete_post() { wp_redirect(admin_url('edit.php')); exit(); } // function wpse_92155_before_delete_post add_action('before_delete_post', 'wpse_92155_before_delete_post', 1);


5

The register post type has a parameter called "capabilities" so you can have for instance 'capability' => __('organize_shop'), http://codex.wordpress.org/Function_Reference/register_post_type To create a new user/role/capability you can use add_role, add_cap, for a simple example to get you started: add_role( 'shop_owner', 'Shop Owner', array( ...


5

The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard. Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a ...


5

The UI select element On user-edit.php, you see the drop-down in the UI. The drop down <select> wrapper is hard coded. Then the admin interface does a nifty thing 1) according to the inline comment: // Get the highest/primary role for this user. In fact it is getting the first role, that was assigned to the user (this we have to keep in mind). Then ...


4

The easiest way to restore Super Admin privileges is to add a bit of code to your theme's functions.php file to add yourself back: include(ABSPATH . 'wp-admin/includes/ms.php'); $user = get_userdatabylogin('YOUR_USERNAME'); grant_super_admin($user->ID); Once your Super Admin privileges have been restored you can remove this code from your theme.


4

The admin_menu action will hide the ACF menu, in this example for not-admins. And admin_head will block the access if the URL is accessed directly. E.g.: http://example.com/wp-admin/edit.php?post_type=acf and http://example.com/wp-admin/edit.php?post_type=acf&page=acf-settings add_action( 'admin_menu', 'wpse_59032_remove_acf_menu', 9999 ); add_action( ...


4

WordPress and Apache WordPress needs to be able to use Apache. By default Apache runs on Ubunutu as user www-data. And ... www-data is also a member of the group www-data So when you try to do a Git Pull then every file will have the wrong permissions as it's expecting the owner to be able to run things on Apache. If you do a CHOWN to make everything ...


4

Parts of WordPress use (s)FTP to transfer files. Updates, for example, use (s)FTP. Media uploads do not, at least not unless something has changed in 3.7. If you are connecting to an (s)FTP server you have to provide the credentials that that server needs. Your file permissions won't come into play until after that connection is made. There are constants ...


4

Do not point the URL to admin.php, use admin-post.php instead: '<a href="' . admin_url( 'admin-post.php?action=print.csv' ) . '">' In your plugin register a callback for that action: add_action( 'admin_post_print.csv', 'print_csv' ); function print_csv() { if ( ! current_user_can( 'manage_options' ) ) return; header('Content-Type: ...


4

WordPress only uses one DB user for everything, and he'll need to have all permissions to the database. CREATE and ALTER are used when upgrading, sometimes. INSERT, UPDATE, and SELECT are used all the time.


4

I would use the hook before_delete_post as the last layer of protection against deletion (using @tf's solution, and which is the correct Answer). And first remove the "Delete" options from sight. The following hides the Bulk Actions and the Empty Trash button, and removes the Delete Permanently row action. With this code: add_action( ...


4

A base WordPress installation probably won't do what you want it to. You could set up a multi-site instance and allow users to have their own 'sub' site, or use something like BuddyPress or Mingle that has a user profile feature.


4

heres a brilliant resource for the info you required. wp roles and capabilities


4

Many of the examples assume you're not the only person running stuff on the server, or that suPHP or some other utility is running to make PHP run as a user other than the web server. With a basic Debian LAMP install, where PHP runs as the www-data user, it's safe and normal to set ownership of everything under the web server document root directory as ...


3

As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers. I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads ...


3

The "user" running your webserver (sometimes _www, sometimes www-data, sometimes "nobody") lacks the permissions to edit these files. You can either change them to be owned by that user or change them to 777. To find out what your web server user is, assuming you're running apache, run ps aux | grep httpd in the command line and in the leftmost column, see ...


3

You can set this in the wp-config.php, check the Editing wp-config.php page in the docs.


3

Google is your friend ;) Restrict categories Role Scoper


3

Occasionally I've seen issues doing a manual reset of the password if salts have changed, or if there was an issue with the account before the reset. Some things to try: Are you sure you reset the password for the main admin account, usually ID #1? Trivial, I know, but has happened to me in the past. Try using the Emergency Password Reset Script, as it ...


3

Message you quoted is being generated by members_content_permissions_protect() function. By default it is used as a filter on the_content() and the_excerpt() functions. Since your custom template doesn't use these - there is no case for function to run. Try something like this in template: $content = 'Content to protect'; echo ...


3

@pwnguin, I had the same problems running mod_php with WordPress and I finally figured it out. # chown www-data:www-data /home/CIM140/public_html/wordpress/ -R As long as YOU control the box this won't cause any security issues. EDIT: You might also need to change your umask to 022 so new directories created by WordPress will have 755 permissions ...


3

I solved the problem... my source blog was private i.e. required password... I made it public for couple of minutes, and importer plugin did it's job properly!


3

The others are not needed as you point out. Btw, what you could do is, conditionally set the user/pass based on the requested page. As in unprivileged with select/insert/update/delete for normal usage, and privileged with definition/index related stuff in addition when visiting the upgrade page.


3

Let us solve this by going with your second option. So you want to restrict users from editing published posts, this can be done by adding this to your theme's functions.php file (please read the comments that is added): function restrict_editing_old_posts( $allcaps, $cap, $args ) { // Restrict users from editing post based on the age of post // Bail ...



Only top voted, non community-wiki answers of a minimum length are eligible