I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..)
I have developed a plugin, named System Edit Restriction.
Currently, I use this code to make restriction:
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
$restricted_places = array('widgets.php','widgets.php','user-new.php', 'upgrade-functions.php','upgrade.php', 'themes.php', 'theme-install.php', 'theme-editor.php','setup-config.php','plugins.php', 'plugin-install.php','options-head.php','network.php', 'ms-users.php','ms-upgrade-network.php','ms-themes.php', 'ms-sites.php','ms-options.php','ms-edit.php','ms-delete-site.php','ms-admin.php','moderation.php','menu-header.php','menu.php','edit-comments.php',
//any 3rd party plugins' menu pages, added under "settings"
'page='
);
foreach ( $restricted_places as $restriction ) { if ( stripos($_SERVER['REQUEST_URI'],$restriction) !== false) {exit;} }
have i missed something? Can any administrator make AJAX-Calls(or etc), which will bypass me codes?