Hot answers tagged

7

The only prerequisite for current_user_can() is an existing wp_get_current_user(). The latter is defined in pluggable.php, so you can use it after plugins_loaded. The _doing_it_wrong() call you are citing in your question is wrong for itself. My guess is that you took that from BuddyPress or bbPress. Both are running into a recursion if they don't wait that ...


4

Your site has likely been hacked. My site had the Darkleech infection, which injected some malicious code into wp-includes/nav-menu.php, causing .htaccess to reset to 444 on any page load. I'd recommend you install the Sucuri plugin and let it restore any files that have been corrupted. Assuming your site was hacked, use their Post-Hack tab to reset ...


4

Okay here we go. It is a bug in WordPress itself. I have already shortly explained the issue in my question, so either have a look at it or check out the ticket linked above for more details. Until the issue is properly resolved I propose this dirty, dirty hack. It is based off the idea that as soon as another sub-menu that is accessible is added ...


3

Because I had cut and pasted define(’FS_METHOD’,’direct’); from the web, the incorrect quote characters were pasted into the file. should be define('FS_METHOD', 'direct'); The incorrect quote character also changed the encoding of the file somehow. If anyone has deeper knowledge of this issue please let me know in the comments.


3

Thanks @kaiser but not need to go through your solution I found a easy one and I'll share here for newbie likes me. If you're working on a WP Network site then the steps are: At the top, hover over My Sites and then click Network Admin. At the left, hover over Settings and then click Network Settings. Scroll to the bottom of the page and change the Max ...


2

Plugins that would do this are: WPFront User Role Editor -- free & paid both do what you're asking User Role User Role and Capabilities Or you can write it into your theme's functions.php consult Roles & Capabilities in the WP Codex for the details and read this easy-to-understand guide on how to add those capabilities yourself Personally, ...


2

I found the answer, dropping it here in case someone need it. You need to be logged in as a user that has the edit_posts capability. With that capability, you also get access to the private query vars, including post_status. Taken from this similar issue.


2

Clear your browser cache or use another browser to load the site, this may be a cache issue.


2

Only logged in user can upload media from front end. Below code will allow users to see only their media files and not others. Put this in your theme's functions.php file. I hope this helps. add_action( 'pre_get_posts', 'users_own_attachments'); function users_own_attachments( $wp_query_obj ) { global $current_user, $pagenow; if ( ...


2

If you check user capability before init means there're chances you are the responsible for the setting of the current user object. If you access user after init, then you are sure that something else already setup the user, most the times core itself. This is why accessing user after init is considered safe. In fact, early access may possibly break some ...


2

»your user account« describes the system user of the remote host. Depending on the environment of your hosting provider, this is typically the same as the basic FTP account. In fact, it's a user on an operating system. So yes, you should be able to change it via FTP. As there are typically many users working on one remote host, it's important to set the ...


1

IIS 7 creates "IUSR" as default user to access files via IIS. So make user IUSR has write access to files/folders. How to check if IUSR has read Access? Right Click -> Folder -> Properties -> Security Tab See if IUSR is in Group or user names list, If No. Click Edit -> Add -> Advanced -> Find Now -> Select IUSR and click OK four times Another way is ...


1

The point of hardening is to avoid the core files to be manipulated by external users (on shared hosting) and by the webserver (as it is the main source of exploits). Since the update runs via the webserver it is obvious that if you hardened your files against webserver initiated manipulation, the update will fail. Most people probably get around it by ...


1

Try this by keeping in current theme functions.php Change your roles instead of author function add_theme_caps() { // gets the author role $role = get_role( 'author' ); // This only works, because it accesses the class instance. // would allow the author to edit others' posts for current theme only $role->add_cap( 'edit_posts' ); } ...


1

It appears this was actually a firewall issue, not a permissions issue. Opening up a certain range of IP addresses on UFW via the Wordfence support article fixed the issue. The backupwordpress plugin seemed to work correctly once the DNS was resolved fully as well.


1

Checking what permissions you are actually setting is always a good idea before just doing so. 644 = Owner Read/Write, Group Read, Others Read 664 = Owner Read/Write, Group Read/Write, Others Read 4 - Read, 2 - Write, 1 - Execute You can see from sequence above 644 the first number 6 would be 4+2, Read+Write. It's always OWNER/GROUP/OTHERS, so first ...


1

First, choose one wordpress role your writer'll have : author, contributor, editor... or a custom role. then customize your chosen role with capacities in your functions.php theme file : if ( ! function_exists( 'writer_set_roles' ) ): function writer_set_roles() { global $wp_roles; // post / page editing ...


1

You need to forward the http:// to https:// to avoid infinite loop. if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS']='on';


1

The fellow above was correct, however the string MUST be above: require_once(ABSPATH . 'wp-settings.php'); This is located within wp-config.php :)


1

This is treading very close to being off-topic as it asks specifically about a particular plugin, but the answer is quite generic: You can remove the capabilities you don't need. function remove_cap_wpse_186316(){ remove_cap( 'yourwoorole', 'yourwoocap' ); remove_cap( 'yourwoorole', 'yourwoocap1' ); } add_action( 'admin_init', ...


1

This is right. You can use Wordpress in exactly the same way as you were using your OLD CMS. Wordpress is being used by Top newspapers / magazines and websites and they've editors / authors and bloggers and ofcourse they have groups & roles. CNN, Mashabale, TechCrunch, etc are all based on Wordpress. There are Free and Premium both type of plugins to ...


1

I am not confident your guess at "being included instead" is accurate. The inclusion of core file is hardcoded in wp-settings.php pretty hard, it would be extremely challenging to subvert under normal circumstances. I have trouble imaging scenario in which functions.php of the theme will be loaded, but add_action() will be unavailable. This simply shouldn't ...


1

Wp-content contains plugins and themes. So, if I can read and write into those files, I could add malicious code very easily. This malicious code can then do interesting things. You are basically inviting a lot of trouble. As for not understanding permissions: http://www.thegeekstuff.com/2010/04/unix-file-and-directory-permissions/ ...


1

You're using the admin_init hook to add menus - use admin_menu instead. The init hook runs early enough for wp-admin/menu.php to add it to the sidebar menu, but not for the plugin page loading in wp-admin/admin.php In other words, when you actually try to load the plugin page, your menu code hasn't fired and WordPress fails with that rather generic error.


1

There's a filter named 'upload_size_limit' where you should be able to change the value. Just add a small mu-plugin for that job: <?php /** Plugin Name: (WPSE) #177620 Alter Upload Size Limit */ add_filter( 'upload_size_limit', function( $limit = 0, $u_bytes = 0, $p_bytes = 0 ) { return ( in_array( get_current_screen()->base, array( /* Add ...


1

@David , you are right about the wp-includes/nav-menu.php file. I spotted & removed it there but it did not help. After weeks of research, I came across this post on Wordpress backdoor removal, followed the steps and voila, the issue was resolved. I also contacted my hosting company and they helped me tighten my wordpress security. Here are some of the ...


1

I'm inclined to think that BuddyPress and bbPress should be checking something else before issuing the _doing_it_wrong message I changed both routines to also check the actual setting of $current_user. global $current_user; if ( is_null( $current_user ) ) { _doing_it_wrong( ... ); } The Notices were no longer displayed. The testing for ...



Only top voted, non community-wiki answers of a minimum length are eligible