6

I'm new to PHP, but I've noticed just about every PHP file has a security snippet, "Die if not accessed in the correct manner" script at the beginning; my question, does a child-theme functions.php need something like this as well to make it secure?

PHP:

if ( ! defined( 'ABSPATH' ) ) {
    die( 'Direct Access Not Permitted' );
}
5

Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes:

  1. From a coding/architecture POV, you're declaring "this file needs WordPress".
  2. Any direct hit to one of your theme's files (curious users, bots, "script kiddies" etc.) has the potential to leak a little bit of info (most likely filesystem) and/or litter your error logs (e.g. Undefined function get_header in /bada/bing/bada/boom)
  3. Reiterating 1), it's just good practice.

However, I absolutely hate this:

die( 'Direct Access Not Permitted' );

IMO it should simply be:

if ( ! defined( 'ABSPATH' ) )
    exit;

There is just no point in having that "message". And I'm a big fan of exit. It communicates the fact that this is an expected possible scenario, and in that scenario, I simply wish to quit. I use die for "unexpected" scenarios, like filesystem write errors, database errors etc.

  • This is wrong. WP already masks these files. You're adding redundant functionality. – Jim Maguire Jun 19 '16 at 0:23
  • Sorry but no, it does not. – TheDeadMedic Jun 19 '16 at 0:24
  • @JimMaguire you are mistaken, I think possibly you are thinking of WP htaccess rules, which 404 urls if the file does not exist. I just confirmed it on one of my sites, I get a 500 error on a file that I know doesn't have the check, and then a non-existent file in the same directory gives WordPress 404. I actually want to thank the dead medic, I don't use these checks currently but after reading this answer I will be in future, I hadn't really thought about it that way before (point 1) – Liam Bailey Jun 19 '16 at 12:27
  • Wow.. I think I was drinking when I made the above comment! Ok... 100% I am totally wrong that WP masks these files. – Jim Maguire Jun 20 '16 at 2:05
  • 1
    Wouldn't return be better than exit, as it fails gracefully both if the file was accessed directly and if it was included from another script? – shea Jun 25 '16 at 3:20
2

Most of the times there is no need to check for defined( 'ABSPATH' ) in the child theme.

2

No, functions.php would generate PHP fatals if loaded directly as it uses the WordPress API.

If functions.php tried to bootstrap and load WordPress however, then yes, it would be necessary, but if you've done that then something has gone horribly wrong and you need to start from scratch

0

Loading almost any (if not all) WordPress files directly will give nothing more than a white screen of death if you have your error reporting set properly. This is because it will trigger a fatal PHP error stopping the execution, and the correct public settings for error display is to not show them. However, if you are trying to mask that you are using WordPress or at least go to as great a lengths possible to do so, then you might want to make that check but inside the if trigger a 404 response code.

  • And fill your error log with messages, which you probably wouldn't want – MrCarrot Jun 19 '16 at 10:38
  • A valid point @MrCarrot. However I have never really used those checks in my WP plugins or theme files, and nor have I ever seen them in any of the error logs I have examined so it is a matter of how many times you think people will try to visit site files directly, I personally see it as very rare. – Liam Bailey Jun 19 '16 at 12:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.