Tag Info

Hot answers tagged

8

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


3

You don't. The get_option() function is a WordPress function. You cannot use it without loading WordPress. More to the point, you should not be calling a file in your plugin directly. You should make your form or whatever is directly linking to that file link to a normal WordPress endpoint instead, and have additional parameters in your plugin to load that ...


3

This is how i set my content directory in wp-config.php // ======================== // Custom Content Directory // ======================== define( 'WP_CONTENT_DIR', dirname( __FILE__ ) . '/somedir' ); define( 'WP_CONTENT_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/somedir' );


3

To disable WordPress Cron Jobs, place this in wp-config.php: define('DISABLE_WP_CRON', true); To schedule a cron job in Linux with cPanel for example... This is the command you might run: wget -q -O - http://www.your-domain.org/wp-cron.php?doing_wp_cron >/dev/null 2>&1 The end of the above command just suppresses any output. Just pick the ...


2

Is it possible to give drop-ins in their own subdirectory of wp-content instead? No, it is not possible without editing the core WordPress code.


2

try to use get_temp_dir() to see if wordpress is using your WP_TEMP_DIR constant. i've tried this code in wp-config.php and it works define('WP_TEMP_DIR', dirname(__FILE__) . '/wp-content/temp/'); but you have to put it before the /* That's all, stop editing! Happy blogging. */ in your wp-config.php file.


2

If you only accept access to the database from localhost (this isn't achieved by defining DB_HOST as localhost)? Not too much by itself (the worst case would be an attacker taking over the admin account), but in combination with other vulnerabilities it might be helpful for an attacker to have access to your config. Login Credentials People reuse their ...


2

Modify your installation such that your custom Farsi language files are associated with a non-standard WPLANG value. For example, instead of the standard 'fa_IR', maybe try something non-standard like 'farsi_IR' (or even 'myCustomFarsi_IR'). This way, when new WordPress versions are released for the "official" Farsi version, you will no longer get ...


2

Consider everything that comes with a vanilla WordPress installation a core file. Core files will be overwritten on updates, so it's not safe to edit them. E.g. wp-config.php isn't a core file, because the vanilla installation comes only with the sample version of that file.


2

Thanks @kaiser but not need to go through your solution I found a easy one and I'll share here for newbie likes me. If you're working on a WP Network site then the steps are: At the top, hover over My Sites and then click Network Admin. At the left, hover over Settings and then click Network Settings. Scroll to the bottom of the page and change the Max ...


2

Yes, you can set the WPMU_PLUGIN_DIR constant in the config file of each of the sites (and WPMU_PLUGIN_URL for the url). By default it is defined as: WP_CONTENT_DIR . '/mu-plugins'


2

The best way is to not do that. There's no need for a plugin file to ever include the wp-config.php. You're doing it backwards. WordPress loads plugins. Plugins don't load WordPress.


1

Try to create a symbolic link within wp-content for each site: ln -s /root/mu-plugins mu-plugins


1

The official reply is that ABSPATH is more for backward compatibility with code which was written when plugins were including wp-config.php and overriding WP_CONTENT_DIR should be enough. https://core.trac.wordpress.org/ticket/29626#comment:3 https://core.trac.wordpress.org/ticket/26592#comment:8


1

You can apply the language_attributes filter to language_attributes() function (source). Basically you can do this by adding something like this to your functions.php: add_filter('language_attributes', 'custom_lang_attr'); function custom_lang_attr() { return 'lang="en-US"'; } Note: Keep in mind, that you're overwriting the language parameter; the ...


1

I assume you are asking about read access, as write access is basically access to inject his own code to do anything he likes with your site. Your assumption that DB info is not sensitive is wrong. Lets assume your site is hosted at godaddy. godaddy AFAIK is using a dedicated mysql servers which probably can be accessed only from their own servers, but if I ...


1

That message means that the php engine tried and failed to find a directory to which to temporarily store the uploaded file until l they are process by php scripts. Since it is happening before any script is being run it is very unlikely that you will be able to solve this by writing any php code. You might be able to change the php upload_tmp_dir setting ...


1

You'll want to add these to your wp-config.php file: define( 'NOBLOGREDIRECT', '' ); define( 'WP_HOME', 'http://dev.domain.com' ); define( 'WP_SITEURL', 'http://dev.domain.com' ); So in its entirety, you'll have: $base = '/'; /** Multisite / Wordpress Network **/ define( 'WP_HOME', 'http://dev.domain.com' ); define( 'WP_SITEURL', ...


1

So in the old days when WordPress updated you got the whole shebang and deleting Akismet after every time was deadly boring. Things had slightly improved since then (partially driven by minimizing traffic it takes to serve update to everyone), but process also got more complicated. Now there are multiple versions of update archive that core might receive ...


1

Silly me, I posted this before doing a proper investigation. The issue isn't with WordPress, it was instead with how Polylang (translation plugin) handled the site url. The solution was to put define('PLL_CACHE_HOME_URL', false); in the wp-config.php before I changed the URL using the WP constants.


1

There's a filter named 'upload_size_limit' where you should be able to change the value. Just add a small mu-plugin for that job: <?php /** Plugin Name: (WPSE) #177620 Alter Upload Size Limit */ add_filter( 'upload_size_limit', function( $limit = 0, $u_bytes = 0, $p_bytes = 0 ) { return ( in_array( get_current_screen()->base, array( /* Add ...


1

You can make your script a part of your WordPress post, just use the $wpdb object provided by the WordPress itself. The $wpdb object already has the database connection established and you can use it to perform any database operation: insert, update, query etc... This is preferable method for doing you DB stuff inside WordPress as you do not have to open any ...


1

(s)FTP into your site, or use a file manager provided by your host, and undo what you did. Then, if you were editing PHP with the built in editor as I suspect, don't ever do that again-- ever. It is like working on an airplane while it is in the air. Create a local copy of your site and work locally. Upload to the host when you know the code works. If you ...


1

It is indeed a security issue to have those left as the defaults, but it is not an extremely serious issue. To mitigate the problem of known default salts, WordPress intentionally recognizes when those values are left as "put your unique phrase here" and will not use that phrase as a key/salt. Instead, it generates random 64 character salts internally and ...


1

There is a section that should look like this: defined( 'ABSPATH' ) || define( 'ABSPATH', __DIR__ . '/' ); require_once( ABSPATH . 'wp-settings.php' ); add_filter() is available after that, you are probably using it too early.


1

For security issues, Hostgator requires more parameters - like port, etc. - in wp-config.php to connect to a remote - non-localhost - mysql server. Read http://support.hostgator.com/articles/cpanel/how-to-connect-to-the-mysql-database-remotely


1

In WordPress error reporting is primarily controlled by WP_DEBUG and other related constants in wp-config.php file. Typically they are completely independent of theme and plugins, although some (well coded) extensions adjust their behavior accordingly with debug settings.


1

I would consider it somewhat safe since that's where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file. There are a couple of things you can do to increase security: Move the wp-config file one level outside the root. Wordpress knows to look for the file ...


1

Try memory_limit = 128M in php.ini. Your syntax may be wrong. You can run a function called phpinfo to see what kind of memory allocation you really have. Make a plain text file and call it phpinfo.php and put just this line in it: <?php phpinfo(); ?> then put the file in the root of your server, and then go to that file with your web browser, ...


1

My advice is to not do long running bulk-operations over a web-connection in the first place. PHP works just fine from the command line. Write your one-time script to do whatever it is that you need it to do. If you need access to WordPress functions in that process, then include the wp-load.php file at the top of the script. Then, go to a shell prompt on ...



Only top voted, non community-wiki answers of a minimum length are eligible