Hot answers tagged

7

Your site has likely been hacked. My site had the Darkleech infection, which injected some malicious code into wp-includes/nav-menu.php, causing .htaccess to reset to 444 on any page load. I'd recommend you install the Sucuri plugin and let it restore any files that have been corrupted. Assuming your site was hacked, use their Post-Hack tab to reset ...


7

The only prerequisite for current_user_can() is an existing wp_get_current_user(). The latter is defined in pluggable.php, so you can use it after plugins_loaded. The _doing_it_wrong() call you are citing in your question is wrong for itself. My guess is that you took that from BuddyPress or bbPress. Both are running into a recursion if they don't wait that ...


3

The difference is that 'edit_published_posts' allows the user to edit posts whose status has been set to 'published', in other words, live content. The 'edit_posts' allows users to edit unpublished (e.g. draft) posts. For most bloggers, the distinction is irrelevant, but if you're using Wordpress for a company or a newsroom, you may want all posts to be ...


2

As of writing, this functionality now resides in the class WP_List_Table, in the method "views()". The filter now looks like this: $views = apply_filters( "views_{$this->screen->id}", $views ); $views will contain an array of each list element: [19-Feb-2016 11:43:44 UTC] Array ( [all] => <a href="link_to_view" class="current">Alle ...


2

Only logged in user can upload media from front end. Below code will allow users to see only their media files and not others. Put this in your theme's functions.php file. I hope this helps. add_action( 'pre_get_posts', 'users_own_attachments'); function users_own_attachments( $wp_query_obj ) { global $current_user, $pagenow; if ( ...


2

If you check user capability before init means there're chances you are the responsible for the setting of the current user object. If you access user after init, then you are sure that something else already setup the user, most the times core itself. This is why accessing user after init is considered safe. In fact, early access may possibly break some ...


2

@David , you are right about the wp-includes/nav-menu.php file. I spotted & removed it there but it did not help. After weeks of research, I came across this post on Wordpress backdoor removal, followed the steps and voila, the issue was resolved. I also contacted my hosting company and they helped me tighten my wordpress security. Here are some of the ...


2

I found the answer, dropping it here in case someone need it. You need to be logged in as a user that has the edit_posts capability. With that capability, you also get access to the private query vars, including post_status. Taken from this similar issue.


2

»your user account« describes the system user of the remote host. Depending on the environment of your hosting provider, this is typically the same as the basic FTP account. In fact, it's a user on an operating system. So yes, you should be able to change it via FTP. As there are typically many users working on one remote host, it's important to set the ...


1

This is right. You can use Wordpress in exactly the same way as you were using your OLD CMS. Wordpress is being used by Top newspapers / magazines and websites and they've editors / authors and bloggers and ofcourse they have groups & roles. CNN, Mashabale, TechCrunch, etc are all based on Wordpress. There are Free and Premium both type of plugins to ...


1

I am not confident your guess at "being included instead" is accurate. The inclusion of core file is hardcoded in wp-settings.php pretty hard, it would be extremely challenging to subvert under normal circumstances. I have trouble imaging scenario in which functions.php of the theme will be loaded, but add_action() will be unavailable. This simply shouldn't ...


1

IIS 7 creates "IUSR" as default user to access files via IIS. So make user IUSR has write access to files/folders. How to check if IUSR has read Access? Right Click -> Folder -> Properties -> Security Tab See if IUSR is in Group or user names list, If No. Click Edit -> Add -> Advanced -> Find Now -> Select IUSR and click OK four times Another way is ...


1

I'm inclined to think that BuddyPress and bbPress should be checking something else before issuing the _doing_it_wrong message I changed both routines to also check the actual setting of $current_user. global $current_user; if ( is_null( $current_user ) ) { _doing_it_wrong( ... ); } The Notices were no longer displayed. The testing for ...


1

The point of hardening is to avoid the core files to be manipulated by external users (on shared hosting) and by the webserver (as it is the main source of exploits). Since the update runs via the webserver it is obvious that if you hardened your files against webserver initiated manipulation, the update will fail. Most people probably get around it by ...


1

Try this by keeping in current theme functions.php Change your roles instead of author function add_theme_caps() { // gets the author role $role = get_role( 'author' ); // This only works, because it accesses the class instance. // would allow the author to edit others' posts for current theme only $role->add_cap( 'edit_posts' ); } ...


1

It appears this was actually a firewall issue, not a permissions issue. Opening up a certain range of IP addresses on UFW via the Wordfence support article fixed the issue. The backupwordpress plugin seemed to work correctly once the DNS was resolved fully as well.


1

Checking what permissions you are actually setting is always a good idea before just doing so. 644 = Owner Read/Write, Group Read, Others Read 664 = Owner Read/Write, Group Read/Write, Others Read 4 - Read, 2 - Write, 1 - Execute You can see from sequence above 644 the first number 6 would be 4+2, Read+Write. It's always OWNER/GROUP/OTHERS, so first ...


1

Problem was, that the FTP user does not equal the Apache / webserver user. I just had to (recursively) own the wordpress directory /var/www for the www-data/webserver user: sudo chown -R www-data:www-data /var/www Please refer to this link for further info about the owner of a directory.


1

There are three ways you could do this: 1. Upload all into the Media Library The most tiresome way, IMHO, is to upload all the images you got via the media library. 2. Use a plugin You can use plugins like Add From Server to import your images easily to the Media Library 3. WP-CLI Easiest way once you got WP-CLI installed. Run wp media import to import ...



Only top voted, non community-wiki answers of a minimum length are eligible