Tag Info

Hot answers tagged

6

Method 1: Remove the upload_files capability from the respective roles. e.g. removing it from author: $role = get_role( 'author' ); $role->remove_cap( 'upload_files' ); This is saved to the database so it should only happen once, not on every page load. Removing it from the editor role should be the same albeit with the obvious modification. Removing ...


4

Do not point the URL to admin.php, use admin-post.php instead: '<a href="' . admin_url( 'admin-post.php?action=print.csv' ) . '">' In your plugin register a callback for that action: add_action( 'admin_post_print.csv', 'print_csv' ); function print_csv() { if ( ! current_user_can( 'manage_options' ) ) return; header('Content-Type: ...


4

Parts of WordPress use (s)FTP to transfer files. Updates, for example, use (s)FTP. Media uploads do not, at least not unless something has changed in 3.7. If you are connecting to an (s)FTP server you have to provide the credentials that that server needs. Your file permissions won't come into play until after that connection is made. There are constants ...


2

This issue is solved. The permission problem has to do with how files are uploaded to the WordPress site while updating. The suPHP solution is my preference at this point because it is simpler and requires less permissions on files, but if you don't want to do that then you'll have to take care to get your FTP user playing nicely with WordPress. suPHP ...


2

You have to give the capability a true or false, like this: add_role('user', 'User', array( 'read' => true )); To fix it, first remove the role and than re-add it again. remove_role('user'); add_role('user', 'User', array('read' => true)); http://codex.wordpress.org/Function_Reference/add_role


2

WP routinely runs into permission issues with updates. Whenever its Filesystem API detects that file operations required cannot be performed it requests login credentials to perform update over FTP or SSH. Since third party automated code cannot make such request interactively that's the reason it likely just fails. There is number of Upgrade Constants ...


1

Here's what Codex has to say on restricting database user privileges: For normal WordPress operations, such as posting blog posts, uploading media files, posting comments, creating new WordPress users and installing WordPress plugins, the MySQL database user only needs data read and data write privileges to the MySQL database; SELECT, INSERT, UPDATE and ...


1

I've followed Kaiser's instructions and written the following code that allows me to grant user-management capabilities to a specific role and prevent privilege escalation to any built-in role (my code should be tweaked if you define custom intermediary roles). // add user-management capabilities add_action('admin_init', function() { $role = get_role( ...


1

as s_ha_dum said in the comments you could do something remove_menu_page However, the problem with this is it doesn't actually prevent the user from editing the plugin if they know the url. From the codex: Removing a menu does not replace the need to filter a user's permissions as appropriate. When I run into this problem I tend to use Justin ...


1

Right, I've managed to solve the problem. Maybe this answer helps other people who encounter the issue again. The problem is inherently in the installation procedure when installing via the package manager in ubuntu. The actual issue was in the database configuration, the installation had set WP_CONTENT_DIR to /srv/www/wp-content/localhost, a directory I ...


1

Well, it can't and won't work. You should think how iframe really works. All it does is send a request to server with given URL (src parameter) and display response. Why inserting <?php bloginfo('template_directory'); ?>/training-form.php as src wouldn't work? Just go to this address and see, what you'll get. Nothing or some trash. Why? Because this ...


1

Yes, I use the Members plugin on a few projects where I need to customize or specify certain permissions. Your workflow would be Create a new Role (named something like "Partial Admin" or whatever you'd like to name these people. Add those people to this role (removing them from the Administrator role). Edit the role permissions (for example, you would ...


1

In your case best solution is create your own custm role and assign them only the capabilities you users need. Regarding wordpress, for what I can understand from your question the only cabability you should give them is read. In this way they will see only the profile. Problems start with the plugin, you don't say (or I don't understand) which is the ...


1

Your local site is on a Mac, which uses a different users and groups system than a production (linux) environment. I would recommend that you change the permissions to what they should be on the local dev environment to what they should be before you upload them to a production/QA environment. Please refer to this article for more on the specific permission ...


1

You can simply delete the lines from your wp-config.php. define('FTP_HOST', 'yourhost.com'); define('FTP_USER', 'youruser'); define('FTP_PASS', 'yourpass'); However, this does not automatically mean that you are secure. There are a lot of backdoors where malware could be injected, starting from the server, security-issues in your plugins, outdated ...


1

Here's the code from wp-admin/includes/file.php: if ( ! $method && function_exists('getmyuid') && function_exists('fileowner') ){ if ( !$context ) $context = WP_CONTENT_DIR; // If the directory doesn't exist (wp-content/languages) then use the parent directory // as we'll create it. if ( WP_LANG_DIR == $context ...


1

Please review the information here: http://codex.wordpress.org/Roles_and_Capabilities Specifically, the following: Editor – somebody who can publish and manage posts including the posts of other users. An Editor is exactly that - someone who can edit what other people are doing. Ensure that the Users who you want to have Editor rights are assigned ...


1

The problem The problem is, that you have a custom capability_type. This means, that this post type will be handled differently from default post types, that have a capability type of post: Users need to be granted access to this capabilities. Important thing here: This is a good decision. Foundation What you're missing is mapping the capabilities to ...


1

The Formidable Form plugin seems to ignore database errors in many places in the code. Setting WP_DEBUG to true uncovered that the forms are not created because some tables are missing (no indication is given to the user). Further investigation has shown that the tables fail to create when the plugin is activated (no indication is given to the user). The ...


1

Your files should be owned by your account. Period. They should not be owned by the "apache" user. This is insecure. The files may need to be readable by the apache user. The recommended permissions are 755 for folders and 644 for files. With the exception of the wp-config.php file, which should be set to the lowest permissions that work. This would be 640, ...



Only top voted, non community-wiki answers of a minimum length are eligible