I'm currently developing a website and am exploring all possible options to restrict file viewing. I'm trying to find a way where I can load php files like my theme-options.php and cpt.php without them been displayed in the admin panel even to admin users e.g appearance > editor.

I'm leaning towards the answer having more to do with file permissions then any actually functions calling specific files and then providing restricted access to all users.

1.How can I restrict access to these files yet load them at the same time?

Thanks

up vote 0 down vote accepted

The simplest way to hide them from the editor is to put them at least two directories deep. The editor only traverses one directory down when displaying files for editing.

  • I guess this awnsers my question - I then just call them using something like 'require_once get_template_directory() . '/inc/theme_settings.php' – Dannyw24 Apr 24 '14 at 21:43
  • 1
    yes, that's correct, but with one more level, like /inc/another_folder/theme_settings.php – Milo Apr 24 '14 at 21:53

A better sollution would be to add the following to your wp-config.php file:

define( 'DISALLOW_FILE_EDIT', true);

This will disable files from being edited in the backend.

I wouldn't recommend following Milos answer, as there's too many ways to circumvent this, such as installing plugins that allow full wordpress directory access. Plus it makes theme development and troubleshooting that much more cumbersome.

  • assuming OP wants to restrict access to all theme files, which wasn't stated in the question. – Milo May 3 '14 at 2:01
  • Still, it's a far better answer than trying to hide the files deeper in the directory structure, which is at best a band-aid solution that makes things much more difficult in the long term. – Hybrid Web Dev May 3 '14 at 2:17
  • a better answer to a different question. – Milo May 3 '14 at 2:58
  • what solution would you propose given the requirement that some files should be hidden while others should be visible? in the case of a cpt.php file given in the example, it could be argued that that code would be more appropriate as a plugin. – Milo May 3 '14 at 3:48
  • Short of getting your hands dirty with .htaccess, I don't think there's a way to block access to specific files through the backend editor. IMO, Brad Daltron's answer was best, as it allows you to remove access via specific user roles, which seems to be sufficient given OP's question. Blocking access through obfuscation will only stop the most uneducated users from accessing the files. Anyone with decent knowledge of WP will be able to circumvent your method, whereas blocking by specific role will be essentially impossible, unless the user is specifically granted access. – Hybrid Web Dev May 3 '14 at 4:37

Why not put this code in a plugin.

add_action( 'init', 'wpsites_remove_file_viewing' );

function wpsites_remove_file_viewing() {

$author = get_role( 'admin' );

$caps = array(
'edit_files',
'edit_theme_options',
'edit_plugins',
'edit_themes',

);

foreach ( $caps as $cap ) {

$administrator->remove_cap( $cap );

    }
}

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.