On wp-admin/plugin-editor.php and wp-admin/theme-editor.php, why WordPress not using $wp_filesystem to read and modify the file? if writing and modifying file do not require wp_filesystem then when to use wp_filesystem?

  • The answer is "because". There are actually much more important places in which it can be useful, and it is not being used Mar 22 '16 at 11:24
  • You shouldn't use the plugin or theme editors as guidelines, they're special cases as they edit runnable code
    – Tom J Nowell
    Mar 22 '16 at 12:23

The real need for the WP_Filesystem is to be able to set the correct file owner/group permissions when writing new files. Reading or overwriting existing files does not change these permissions so the WP_Filesystem is not technically needed for that (though you can use it for that too.)

The reason is it is a potential security risk to write new files without checking owner/group permissions as there is a chance they may be alterable and thus injected with code and executed (mostly on shared servers with poor security, but if the case of plugins and themes you cannot know the end user's setup.)

Reference: http://ottopress.com/2011/tutorial-using-the-wp_filesystem/#comment-10820

Question: If you are only getting contents of a file, you do not need to worry about getting credentials, correct? You are never writing a file to the server, so there is no issue with file ownership. Similarly, if you are updating the contents of a file that already exists, you are not creating the file, so again, no issues with file ownership, correct?

Answer: If you’re reading a file, there’s no issues. If you’re updating a file, while there are no ownership issues, you shouldn’t be updating a file in a plugin or a theme because the updates will be lost when the plugin or theme is upgraded. Which means that to maintain across upgrades, you need to create a new file outside the plugin/theme directory, which means you should still use the WP_Filesystem.

So in answer to the question, for the plugin and theme editors it is not technically needed as they are only editing existing files, you cannot create new ones with them. (Therefore it is somewhat assumed you know the changes will be lost if you update a plugin / theme later without taking steps to preserve the changes.)

But in a broader sense, the question could be considered as "when should/must the WP Filesystem be used?" Since it outputs a user admin form (when the correct permissions are not already in place) it must be used for admin facing options when creating new files (typically via settings pages.)

If creating new files can be avoided (as is often the case) that is often better, as it can confuse the user why credentials are being asked for (unless you add something to explain it!) If you must create new files, use the WP Filesystem. Similarly, you will probably want to use it for creating directories for similar reasons (although directories cannot be executed.)

Better practice is to use it for updating files too where possible, as it can alert the user to the possibility their ownership permissions on those files are wrong - they will get the form (but again not know why unless you explain it!) - but it is not strictly necessary. Using it for reading files can be done too (but not at all necessary.)

There are exceptions of course and in the end it depends on the use case. Further discussion on different use cases is found via the same link provided.

  • that is actually totally incorrect. Using the filesystem API you could have make those files non writable from the webserver and therefor more secure, or to say it differently you could have edited files which the webserver could not write to. Mar 22 '16 at 15:40
  • I knew this would be a can of worms opened,,,. and that's why I provided the reference. But ah well. Anyway, just because you can use the WP Filesystem to do other things does not mean you have to. I stick by my statement, as this is not about read/write permissions being the problem but providing a solution for owner/group ones. When I say "real need" this is what I am referring to. If you can point to anything else it is needed for that cannot be done another way I'm all ears. And yes, my answer does specifically address the exact question.
    – majick
    Mar 22 '16 at 15:50
  • you are getting what otto said totally out of context Mar 22 '16 at 16:10
  • I agree I am "taking" it out of it's context, but I did read the entire page and all comments not to long ago to try to understand it as I needed to implement it for writing some theme files correctly, having not had real need for it before then and just used native PHP functions because that is what I knew (and still find much simpler.) So while I realize my answer is based on this necessity, it did make me realize that so is WP FIlesystem, for this is still the main problem that it solves.
    – majick
    Mar 22 '16 at 17:00
  • The context of the comment you linked to is of "is it smart to generate/edit file dynamically", the question here assumes it is smart.... When you assume that it is a smart thing to do overriding permissions becomes important ;) Mar 22 '16 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.