0

Pretty straight forward question, but I'll provide any clarifications needed.

The reason I'm asking is this: I created a child theme that pulls in a custom-functions.php file. This allows devs to customize the site without editing the child theme. I know that's the purpose of a child theme, but for the sake of brevity I won't go into the reasoning behind all that.

I put custom-functions.php in /wp-content/uploads/customizations. Is this a security risk? And if so, what's a better place to put it. I don't want to put it in my child theme because it'll get overwritten when the theme is updated.

3
  • 1
    In this case you're supposed to fork the child theme, or the parent, creating a grandchild theme by putting templates in uploads to get around it isn't good ( is there a reason you didn't ask about your problem but instead asked about the solution? This seems like a classic X Y problem ). Needing grandchild themes or some equivalent is usually a sign that things aren't right
    – Tom J Nowell
    Mar 18 at 9:27
  • 1
    Why can't this file just be a plugin? A plugin is just a PHP file in wp-content/plugins after all. Mar 18 at 10:18
  • Thanks guys, I posted another question that asks about the problem and not the solution. @JacobPeattie, does a plugin seem like a good fit for that situation?
    – Diego
    Mar 19 at 15:51
3

Yes it is unsafe, though not for the reasons you think. DO NOT DO THIS.

If your developers can upload a PHP file to your site that gets executed, then that PHP file can undo all other security measures that you put in place. The location of the file is irrelevant. Functionally, there is no difference from editing plugins directly.

Additionally, a common security enhancement is to prevent PHP execution in the uploads folder, and assume any PHP in the uploads folder is malicious.

Either way, your proposed development process is highly unusual and problematic. I strongly advise against this. Moving the files uploaded to another folder will not improve security.

Do not let developers upload PHP to the uploads folder. It is not a good idea.

12
  • Thanks @Tom. When you say: If your developers can upload a PHP file to your site that gets executed, then that PHP file can undo all other security measures that you put in place. The location of the file is irrelevant. Does that mean it's equally unsafe to allow developers to create or edit a child theme?
    – Diego
    Mar 19 at 14:32
  • WordPress doesn't sandbox code, a hook is a hook, WP can't tell the difference between code that came from a child theme, a plugin, a parent theme, etc. Once the code is loaded, it's all just code. The only exception is that things are loaded in different orders, and that WP by default looks at specific locations for template files to load. But once those files are loaded they can do as they please. If a dev can run code on your server then they can do anything they want
    – Tom J Nowell
    Mar 19 at 15:20
  • E.g. I could write a template for you, and inside that template put a wp_insert_user call that creates an admin user for myself, or downloads a PHP shell to let me bypass WP completely and give me limited SSH access and a file browser.
    – Tom J Nowell
    Mar 19 at 15:22
  • However, if you don't trust these developers, why are you working with them? Use version control to manage code, take a backup before hand, and pay a fair hourly rate with a reputable freelancer/agency
    – Tom J Nowell
    Mar 19 at 15:23
  • Sorry I should have clarified this. I'm not worried about devs. When I asked about security, I meant against hacking. By putting php in the /uploads directory, am I creating some kind of back door that malicious actors can take advantage of?
    – Diego
    Mar 19 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.