0

I've got a strange problem, I've recently moved my site to a new Digital Ocean server.

It's setup with Nginx and it's got the standard lock down in the nginx configuration to stop outsiders executing PHP files in wp-admin.

Everything seems to be 100% except that my editors can no longer edit articles but it works 100% for the administrators. There are no errors in my web console, or nginx error logs and nothing is being rejected when I monitor the network connection.

When the editor tries to edit the Visual Editor is just blank, the html view can be seen but the editors can't add tags, categories can't schedule or even save changes.

The only thing I've found is this call isn't being made when editing as an editor

[MyDomain]/wp-admin/load-scripts.php?c=0&load%5B%5D=hoverIntent,common,jquery-ui-draggable,jquery-touch-punch,iris,wp-color-picker,admin-bar,thickbox,heartbeat,autosave,wp-ajax-res&load%5B%5D=ponse,jquery-color,wp-lists,jquery-query,admin-comments,suggest,postbox,tags-suggest,tags-box,word-count,post,editor-expand,shor&load%5B%5D=tcode,media-editor,media-audiovideo,mce-view,imgareaselect,image-edit,svg-painter,wp-auth-check,media-upload,jquery-ui-datepicke&load%5B%5D=r,editor,wplink,wp-embed&ver=4.7.2

The error occurs on this line in meta-boxes.php

<script type="text/javascript">jQuery(document).ready(function(){commentsBox.get(2, 10);});</script>

If I hardcode the call to load-scripts.php it goes past the error but then fails on another call, and on and on.

Here is my nginx config that I think is causing the issue?

        # POST requests and urls with a query string should always go to PHP
    if ($request_method = POST) {
            set $skip_cache 1;
    }
    if ($query_string != "") {
            set $skip_cache 1;
    }

    # Don't cache uris containing the following segments
    if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {
            set $skip_cache 1;
    }

    # Don't use the cache for logged in users or recent commenters
    if ($http_cookie ~* "wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
            set $skip_cache 1;
    }

    location / {
            try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.0-fpm.sock;

            fastcgi_cache_bypass $skip_cache;
            fastcgi_no_cache $skip_cache;

            fastcgi_cache WORDPRESS;
            fastcgi_cache_valid  60m;
    }

    location ~ /purge(/.*) {
        fastcgi_cache_purge WORDPRESS "$scheme$request_method$host$1";
    }

    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
            access_log off; log_not_found off; expires max;
    }

    location = /robots.txt { access_log off; log_not_found off; }
    location ~ /\. { deny  all; access_log off; log_not_found off; }

    location ~ /\.ht {
            deny all;
    }

    location ~ /.well-known {
            allow all;
    }

    # Stop php access except to needed files in wp-includes
    location ~* ^/wp-includes/.*(?<!(js/tinymce/wp-tinymce))\.php$ {
            internal;
    }

    # no access to wp-config.php
    location = /wp-config.php {
            deny all;
    }

    # no access to php files inside an uploads or files folder
    location ~* /(?:uploads|files)/.*\.php$ {
            deny all;
    }

    # no access to files inside wp-content with various types
    location ~* ^/wp-content/.*\.(txt|md|exe|sh|bak|inc|php|pot|po|mo|log|sql)$ {
            deny all;
    }

    # no access to root folder, .htaccess, or .svn files or folders
    location ~ /\.(ht|svn)? {
            deny all;
    }

I'm stumped so hoping some genius can point out what I need to change,

3
  • What happens when you try default WordPress nginx rules? Does it work then?
    – Fayaz
    Commented Feb 22, 2017 at 8:09
  • wp-admin has to be open to access Commented Feb 22, 2017 at 8:50
  • I've removed all the lock down part of the nginx conf and it's still a problem.. so it isn't that.. Commented Feb 23, 2017 at 6:28

1 Answer 1

0

In the end the new server lock down was a red herring.

There is a plugin, somewhere, which is requiring that editors have the role 'manage_options' enabled..

I installed a roles plugin (User Role Editor) and just granted them that extra access and it works now.

I'll need to go through the plugins to find the problem child when I have the time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.