Hot answers tagged permissions
5
The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard.
Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a ...
4
I would use the hook before_delete_post as the last layer of protection against deletion (using @tf's solution, and which is the correct Answer).
And first remove the "Delete" options from sight. The following hides the Bulk Actions and the Empty Trash button, and removes the Delete Permanently row action.
With this code:
add_action( ...
4
WordPress and Apache
WordPress needs to be able to use Apache. By default Apache runs on Ubunutu as user www-data. And ... www-data is also a member of the group www-data
So when you try to do a Git Pull then every file will have the wrong permissions as it's expecting the owner to be able to run things on Apache.
If you do a CHOWN to make everything ...
4
The admin_menu action will hide the ACF menu, in this example for not-admins.
And admin_head will block the access if the URL is accessed directly.
E.g.: http://example.com/wp-admin/edit.php?post_type=acf and http://example.com/wp-admin/edit.php?post_type=acf&page=acf-settings
add_action( 'admin_menu', 'wpse_59032_remove_acf_menu', 9999 );
add_action( ...
3
The UI select element
On user-edit.php, you see the drop-down in the UI. The drop down <select> wrapper is hard coded.
Then the admin interface does a nifty thing 1) according to the inline comment: // Get the highest/primary role for this user. In fact it is getting the first role, that was assigned to the user (this we have to keep in mind).
Then ...
3
Let us solve this by going with your second option. So you want to restrict users from editing published posts, this can be done by adding this to your theme's functions.php file (please read the comments that is added):
function restrict_editing_old_posts( $allcaps, $cap, $args ) { // Restrict users from editing post based on the age of post
// Bail ...
2
As per the following from http://codex.wordpress.org/Hardening_WordPress#File_Permissions
/wp-content/
User-supplied content: intended to be completely writable by all users (owner/user, group, and public).
Within /wp-content/ you will find:
/wp-content/themes/
Theme files. If you want to use the built-in theme editor, all files need to be ...
2
I got this almost working, but refinements are needed to fit the specifics of the question and to deal with Attachments and Post-Types differently (see comments in code)...
First, I think it's worth noting how I found the filter:
apply_filters( 'views_' . $screen->id, $views )
inspect element
do a global search in /wp-admin and /wp-includes for ...
2
I too needed to customise the list of available HTML tags in comments. I didn't want to define the CUSTOM_TAGS variable because it overrides everything that WP sets up in kses.php, but I wasn't sure where to hook the function. A little investigation showed that kses.php initialises its filters via kses_init() which is added as a function to 'init' with the ...
2
You have to give the capability a true or false, like this:
add_role('user', 'User', array( 'read' => true ));
To fix it, first remove the role and than re-add it again.
remove_role('user');
add_role('user', 'User', array('read' => true));
http://codex.wordpress.org/Function_Reference/add_role
1
That's an interesting question. You could probably Create Custom Roles and use Roles and Capabilities ( codex.wordpress[dot]org/Roles_and_Capabilities ) to your advantage.
You might also be able to add Custom Fields To each User ( wpengineer[dot]com/2173/custom-fields-wordpress-user-profile ) that could help you achieve this goal.
This bit of code below ...
1
You can try
if( current_user_can( 'subscriber' ) ) {
add_filter( 'show_password_fields', '__return_false' );
}
see also
http://wpengineer.com/2285/disable-password-fields-for-non-admins/
http://adambrown.info/p/wp_hooks/hook/show_password_fields
1
I solved it. The problem was, that I called the function inside of another function, called later. The snippet in the question works like it should.
I thought about deleting the question, but I think for other users, that are searching for a way to do something like that, the snippet would be interesting.
1
If you are the only "Administrator" and the rest of the users is lower level roles it is possible to achieve this. ACF has the option to set a rule to only display it based on user role.
Under "Edit Field Group" (where you setup the fields) there is a tab called "Location" where this is set (see the attached screenshot).
1
Changing the db prefix on a WordPress installation requires more than simply changing the prefix on the tables. There are also options that use the db prefix in the options tables. You'll need to update them as well. Specifically the wp_user_capabilties and the wp_user_level keys in the {db_prefix}_options table.
See the following tutorial for further ...
1
This article explains a method in which you can add a file type to the list of allowed file types.
Copy and paste the following code into your functions.php:
add_filter('upload_mimes', 'custom_upload_mimes');
function custom_upload_mimes ( $existing_mimes=array() ) {
// add your extension to the array
$existing_mimes['prc'] = ...
1
I'm sure you could specify some capabilities while registering the Post Type itself. Although, here is a more robust version that can be used widely across the administration dashboard.
/**
* Hide dashboard administrator menus from disallowed user roles.
*
* @author Michael Ecklund
* @access public
*
* @return void
*/
public function hide_menus(){
...
1
You need to talk to your web host Versio.nl; something is amiss with their shared server configurations.
Files and folders should never be 777. Wordpress needs no more than 644 on files and 755 on folders. And Wordpress should be able to create directories.
Some plugins require the /wp-content/ folder be made writeable, but in
such cases they will let ...
1
If you look at Wordpress's explanation of Roles and Capabilities, you will see that the correct role you should have assigned them is Author.
That being said, if you for some reason don't want to change them to Authors, you can alter the capabilities that a role has. See the full list of Editor capabilities here.
remove_cap( 'editor', 'read_private_posts' ...
1
It's stupid, but you can't. (Not without editing core, anyway.) Right at the top of the nav-menus.php source code is an edit_theme_options check that's not filterable.
http://core.trac.wordpress.org/browser/tags/3.4.1/wp-admin/nav-menus.php
If you're not concerned about your editors trying anything too shady, you could simply hide the menu items using a ...
1
wp-content should be 755, otherwise WordPress will think it has global write access, and won't fallback to the FTP filesystem method if it doesn't.
Might be worth checking if PHP is running in safe mode - this can also be the troublemaker (though I'm aware WordPress can still upgrade with it on).
1
Did you check the Apache capability for it? If Not yet, open the httpd.conf of your Apache directory and remove the '#' that's prepended to the line 'LoadModule rewrite_module modules/mod_rewrite.so' plus change the term 'AllowOverride None' to 'AllowOverride All'. That did the trick for me after a many hours of searching...
1
You may as I have found need to change the group that apache runs under. In ubuntu you can do this by editing the /etc/apache2/envvars file.
The above answer by AlxVallejo is mostly correct but this (Tom's) is a better answer with regards to setting permissions
...
1
In FileZilla you use SFTP connection to access your server and it works (because it was setup on server). But in wp-admin you use FTPS connection, which is probably doesn't setup on server. Pay attention that SFTP != FTPS.
A solution could be to change File System method in your wp-config.php file by adding FS_METHOD constant with direct value, it will ...
1
When using save_post you are usually add/updating user-inputted data from a metabox into the database. When do this you should check that your metabox's nonce is valid.
You should also check permissions as save_post is triggered inside wp_insert_post(), and not just when the you create/edit a post admin side.
1
Add this to your functions.php.
if ( !current_user_can( 'edit_users' ) ) { //Change the edit_user" to whatever capability you need to retain the notifications
add_action( 'init', create_function( '$a', "remove_action( 'init', 'wp_version_check' );" ), 2 );
add_filter( 'pre_option_update_core', create_function( '$a', "return null;" ) );
}
Or if you ...
1
Based on this answer, yours was easy:
add_filter('post_row_actions', 'wpse_49800_qe_download_link', 10, 2);
add_filter('page_row_actions', 'wpse_49800_qe_download_link', 10, 2);
// for Custom Post Types
// add_filter('cpt_name_row_actions', 'wpse_49800_qe_download_link', 10, 2);
function wpse_49800_qe_download_link($actions, $post) {
...
Only top voted, non community-wiki answers of a minimum length are eligible
