RESTRICT EDIT of PHP files?

Question

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..)

I have developed a plugin, named System Edit Restriction.

Currently, I use this code to make restriction:

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
$restricted_places = array('widgets.php','widgets.php','user-new.php',  'upgrade-functions.php','upgrade.php',  'themes.php',   'theme-install.php',    'theme-editor.php','setup-config.php','plugins.php',    'plugin-install.php','options-head.php','network.php',  'ms-users.php','ms-upgrade-network.php','ms-themes.php',    'ms-sites.php','ms-options.php','ms-edit.php','ms-delete-site.php','ms-admin.php','moderation.php','menu-header.php','menu.php','edit-comments.php',
    //any 3rd party plugins' menu pages, added under "settings"
    'page='
    );
foreach ( $restricted_places as $restriction ) {    if ( stripos($_SERVER['REQUEST_URI'],$restriction) !== false) {exit;}   }

have i missed something? Can any administrator make AJAX-Calls(or etc), which will bypass me codes?

Answer 1

You should sanitize the request URI. I was able to bypass this by adding an additional slash to the URL. For example:

wp-admin/widgets.php

That request displays a blank page (as it should).

wp-admin//widgets.php

That request bypasses the restriction.

It's hard, bordering on impossible, to answer this question in the affirmative (ie "Yes, this works as expected"). As of right now there is at least one way to bypass the restrictions, but I cannot say if there are more.

A better way to do this would probably be to use WordPress' capabilities management. There are a few plugins that provide an interface for managing capabilities. Ex:

https://wordpress.org/plugins/capability-manager-enhanced/