Hot answers tagged permissions
8
Hardening WordPress on the WordPress Codex is a very good article on how to secure your WordPress blog, which goes into quite some detail on file permissions, as well as some other methods of securing WP.
6
You want the admin_menu hook, rather than admin_init.
Also, you shouldn't use anonymous functions. Instead, use:
function wpse51004_add_menu_page() {
add_menu_page('Some Page', 'Some Page', 'manage_options', 'some-slug', 'wpse51004_some_page_callback');
};
add_action('admin_menu', 'wpse51004_add_menu_page');
function wpse51004_some_page_callback() {
...
5
"All privileges" usually means you should grand everything to the user. However ...
I've found at least one article that claims the MySQL user only needs:
SELECT
INSERT
UPDATE
Digging deeper, I found that in order to operate fully (automated updates, plug-in installation/uninstallation, etc.), WordPress requires some additional permissions:
DELETE
...
5
Use Justin Tadlock's plugin "Members". It gives you the ability to create new roles and edit existing roles, as well as add custom capabilities. All that work that you'd have to do can be taken down to a few clicks.
I know you said in your comment on ZaMoose's answer that you are 'looking to write the functionality myself so I have full control over ...
5
The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard.
Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a ...
4
The easiest way to restore Super Admin privileges is to add a bit of code to your theme's functions.php file to add yourself back:
include(ABSPATH . 'wp-admin/includes/ms.php');
$user = get_userdatabylogin('YOUR_USERNAME');
grant_super_admin($user->ID);
Once your Super Admin privileges have been restored you can remove this code from your theme.
4
The admin_menu action will hide the ACF menu, in this example for not-admins.
And admin_head will block the access if the URL is accessed directly.
E.g.: http://example.com/wp-admin/edit.php?post_type=acf and http://example.com/wp-admin/edit.php?post_type=acf&page=acf-settings
add_action( 'admin_menu', 'wpse_59032_remove_acf_menu', 9999 );
add_action( ...
4
WordPress and Apache
WordPress needs to be able to use Apache. By default Apache runs on Ubunutu as user www-data. And ... www-data is also a member of the group www-data
So when you try to do a Git Pull then every file will have the wrong permissions as it's expecting the owner to be able to run things on Apache.
If you do a CHOWN to make everything ...
4
I would use the hook before_delete_post as the last layer of protection against deletion (using @tf's solution, and which is the correct Answer).
And first remove the "Delete" options from sight. The following hides the Bulk Actions and the Empty Trash button, and removes the Delete Permanently row action.
With this code:
add_action( ...
3
The register post type has a parameter called "capabilities" so you can have for instance
'capability' => __('organize_shop'),
http://codex.wordpress.org/Function_Reference/register_post_type
To create a new user/role/capability you can use add_role, add_cap, for a simple example to get you started:
add_role( 'shop_owner', 'Shop Owner', array( ...
3
Message you quoted is being generated by members_content_permissions_protect() function. By default it is used as a filter on the_content() and the_excerpt() functions. Since your custom template doesn't use these - there is no case for function to run.
Try something like this in template:
$content = 'Content to protect';
echo ...
3
@pwnguin,
I had the same problems running mod_php with WordPress and I finally figured it out.
# chown www-data:www-data /home/CIM140/public_html/wordpress/ -R
As long as YOU control the box this won't cause any security issues.
EDIT:
You might also need to change your umask to 022 so new directories created by WordPress will have 755 permissions ...
3
Many of the examples assume you're not the only person running stuff on the server, or that suPHP or some other utility is running to make PHP run as a user other than the web server.
With a basic Debian LAMP install, where PHP runs as the www-data user, it's safe and normal to set ownership of everything under the web server document root directory as ...
3
Occasionally I've seen issues doing a manual reset of the password if salts have changed, or if there was an issue with the account before the reset. Some things to try:
Are you sure you reset the password for the main admin account, usually ID #1? Trivial, I know, but has happened to me in the past.
Try using the Emergency Password Reset Script, as it ...
3
The UI select element
On user-edit.php, you see the drop-down in the UI. The drop down <select> wrapper is hard coded.
Then the admin interface does a nifty thing 1) according to the inline comment: // Get the highest/primary role for this user. In fact it is getting the first role, that was assigned to the user (this we have to keep in mind).
Then ...
3
The "user" running your webserver (sometimes _www, sometimes www-data, sometimes "nobody") lacks the permissions to edit these files. You can either change them to be owned by that user or change them to 777. To find out what your web server user is, assuming you're running apache, run ps aux | grep httpd in the command line and in the leftmost column, see ...
3
As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers.
I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads ...
3
Let us solve this by going with your second option. So you want to restrict users from editing published posts, this can be done by adding this to your theme's functions.php file (please read the comments that is added):
function restrict_editing_old_posts( $allcaps, $cap, $args ) { // Restrict users from editing post based on the age of post
// Bail ...
2
Sorry to do this, but I stumbled across the answer in the wordpress forums.
It turns out that Role Scoper does this really well. The author of that forum post said it best:
To enable a user to edit one particular page, but not anything else:
Give them a WordPress role of Subscriber
Manage > Pages > Edit their page
Expand the "Editors" tab ...
2
I faced the same situation as you and what i did was create a custom post type named" homepage" and also created "Bainternet Posts Creation Limits" plugin to limit the creation of each post type per user.
Try it out http://wordpress.org/extend/plugins/bainternet-posts-creation-limits/
2
There are no known security vulnerabilities in 2.9.2
If any new vulnerabilities are discovered the fix will be packported. (This has not happened but if it did we would get a version 2.9.3)
WordPress does not have a backport policy that goes further than the previous major release so it is unknown when the 2.9 branch will stop being supported.
WordPress ...
2
First, since you're using a premium Theme, you should first consult the Theme developer's support offerings.
That said, I would try installing the Theme through WordPress, rather than manually:
Delete the existing Theme folder in wp-content\themes`
Go to Dashboard -> Appearance -> Themes, click the Install
Themes tab, then the Upload sub-tab.
...
2
The others are not needed as you point out.
Btw, what you could do is, conditionally set the user/pass based on the requested page. As in unprivileged with select/insert/update/delete for normal usage, and privileged with definition/index related stuff in addition when visiting the upgrade page.
2
I too needed to customise the list of available HTML tags in comments. I didn't want to define the CUSTOM_TAGS variable because it overrides everything that WP sets up in kses.php, but I wasn't sure where to hook the function. A little investigation showed that kses.php initialises its filters via kses_init() which is added as a function to 'init' with the ...
2
The tags that are allowed in comments are stored in the $allowedtags global variable. You can try adding elements to that list (the key is the tag name, the value is an array of allowed attributes). If you have problems with the timing you can play with the CUSTOM_TAGS global variable.
2
WRT to your question "need to apply the class if another class is present and the user's role is (whatever)"
The easiest was to do this, isn't in the code, but yet in the CSS. You can target an element that has more then once class. So, using your class PARTNER_STAR and if your other class is say another you can have your css such that
.another { /* ...
2
I got this almost working, but refinements are needed to fit the specifics of the question and to deal with Attachments and Post-Types differently (see comments in code)...
First, I think it's worth noting how I found the filter:
apply_filters( 'views_' . $screen->id, $views )
inspect element
do a global search in /wp-admin and /wp-includes for ...
2
You can...
Learn about file permission (on wordpress)
Install Wordpress Firewall plugin (version 2 for 3+ versions)
(this dissalow access to any folder or file indirectly)
Hide Your Wordpress Version
Try to update plugins & Wp
install Login Lockdown Plugin
(this stops any brute force attemts)
Verify that your theme doesnt show "publish by $username" ...
2
I just exported the live database, replaced all occurences of the live
siteurl with the local one, and imported on my dev machine.
Finding/replacing with a text editor breaks serialized data; you must change values with MySQL queries in phpmyadmin:
UPDATE wp_options SET option_value = replace(option_value, 'http://www.olddomain.com/', ...
2
Imho that's one of the most important things regarding users:
/**
* Deny access to 'administrator' for other roles
* Else anyone, with the edit_users capability, can edit others
* to be administrators - even if they are only editors or authors
*
* @since 0.1
* @param (array) $all_roles
* @return (array) $all_roles
*/
function ...
Only top voted, non community-wiki answers of a minimum length are eligible
