Timeline for Secure way to add JS Script to Wordpress filesystem
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 4 at 0:38 | vote | accept | LovinQuaQua | ||
| Mar 4 at 0:38 | |||||
| Mar 3 at 23:45 | answer | added | LovinQuaQua | timeline score: 0 | |
| Mar 3 at 23:42 | history | edited | LovinQuaQua | CC BY-SA 4.0 |
Because of the answers below i changed the title and explanation for this question. Maybe there are other people who struggle with saftey questions, like me.
|
| Mar 2 at 23:02 | comment | added | Tom J Nowell♦ | you could also keep the files there and if the feature is turned off, don't enqueue them. I'd also recommend taking a look at developer.wordpress.org/reference/functions/… | |
| Mar 2 at 23:01 | comment | added | Tom J Nowell♦ | if you want to enable/disable features it's better to do that via variables set at runtime that are then checked for in the code that implements the feature. The issue here isn't with writing files, it's with writing executable files such as PHP files or javascript. That kind of operation is usually done for malicious reasons, and opens up lots of avenues for attack and fragility. E.g. the entire thing fails if the folder can't be written to, which is a lot of enterprise and managed WordPress hosts that use git to version control the filesystem | |
| Mar 1 at 22:29 | comment | added | LovinQuaQua | Thank you for answer. Why is it dangerous to create files with php? The function is only running in the Wordpress Backend (admin_init). In the Backend its also possible to modify theme files... | |
| Mar 1 at 20:43 | comment | added | Tom J Nowell♦ | if your function checks for the existence of the file then I see no issue with it running multiple times, but the main issue I see is not how many times it happens, but that it happens at all. Constructing a JS file like that and writing it to the filesystem is dangerous, and also not going to work on a lot of hosts that have read only code filesystems. If you want to enable/disable a feature don't delete/write/modify JS files, there are far better and safer ways to implement feature flags that don't involve changes to files at all | |
| Mar 1 at 20:06 | history | asked | LovinQuaQua | CC BY-SA 4.0 |