I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..)

I have developed a plugin, named System Edit Restriction.

Currently, I use this code to make restriction:

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
$restricted_places = array('widgets.php','widgets.php','user-new.php',  'upgrade-functions.php','upgrade.php',  'themes.php',   'theme-install.php',    'theme-editor.php','setup-config.php','plugins.php',    'plugin-install.php','options-head.php','network.php',  'ms-users.php','ms-upgrade-network.php','ms-themes.php',    'ms-sites.php','ms-options.php','ms-edit.php','ms-delete-site.php','ms-admin.php','moderation.php','menu-header.php','menu.php','edit-comments.php',
    //any 3rd party plugins' menu pages, added under "settings"
foreach ( $restricted_places as $restriction ) {    if ( stripos($_SERVER['REQUEST_URI'],$restriction) !== false) {exit;}   }

have i missed something? Can any administrator make AJAX-Calls(or etc), which will bypass me codes?

  • 1
    It would probably be easier to maintain and more fail-safe if you have a additional user role for those restrictions. – Nicolai Jun 4 '15 at 16:05

You should sanitize the request URI. I was able to bypass this by adding an additional slash to the URL. For example:


That request displays a blank page (as it should).


That request bypasses the restriction.

It's hard, bordering on impossible, to answer this question in the affirmative (ie "Yes, this works as expected"). As of right now there is at least one way to bypass the restrictions, but I cannot say if there are more.

A better way to do this would probably be to use WordPress' capabilities management. There are a few plugins that provide an interface for managing capabilities. Ex:


  • wow! thanks so much for attention! ... have you any other ideas how to bypass it in other ways? – T.Todua Jun 4 '15 at 16:16
  • 1
    Not any that I see, but if I had to guess I would say there are. There may be other ways to create a URL that maps to the same file, but doesn't match your restrictions. There may also be other ways to get WordPress to load content that bypasses your restrictions. In general, it is better to check if users should be able to use certain functionality rather than checking if a user can access a URL the corresponds to that functionality. This is why I suggested using capability management. – Mathew Tinsley Jun 4 '15 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.