0

EDIT: Because of the answers below i changed the title and explanation for this question. Maybe there are other people who struggle with saftey questions, like me.

I am a beginner with Wordpress Plugins. I am trying to code a plugin for my customer projects, to add some features, that i nearly always use on every project.

My plugin creates an options page, where i can enable/disable my features with checkboxes.

I created a Feature to automatically add custom jQuery to Wordpress like this:

if( get_option('lwb_jquery') === 'on' ) {

function lwb_jquery() {
    
    // Multisite Support
    if( is_multisite()) {
        $theme_dir = get_stylesheet_directory() . '/sites/' . get_current_blog_id();
        
        if( !file_exists( $theme_dir )) {
            mkdir( $theme_dir );
        }
        
    } else {
        $theme_dir = get_stylesheet_directory();    // Pfad zum aktuellen Theme-Verzeichnis
    }

    // Pfade zu den zu erstellenden Ordnern und der Datei
    $assets = $theme_dir . '/assets';
    $subfolder = $assets . '/js';
    $file_path = $subfolder . '/lwb-script.js';

    // Überprüfe, ob der Ordner 'assets' existiert, falls nicht, erstelle ihn
    if ( !file_exists( $assets )) {
        mkdir( $assets );
    }

    // Überprüfe, ob der Ordner 'js' existiert, falls nicht, erstelle ihn
    if ( !file_exists( $subfolder )) {
        mkdir( $subfolder );
    }

    // Überprüfe, ob die Datei bereits existiert
    if ( !file_exists( $file_path )) {
        
        $file_content = '// Automatischer Inhalt in die neu erstellte Datei';
        // Versuche, die Datei zu erstellen und den Inhalt zu schreiben
        $result = file_put_contents( $file_path, $file_content );

    }
}
add_action( 'admin_init', 'lwb_jquery' );


// Registrieren und einbinden der Javascript Datei
function lwb_jquery_script() {
    
    // Multisite Support
    if( is_multisite()) {
        $url = get_stylesheet_directory_uri() . '/sites/' . get_current_blog_id() . '/assets/js/lwb-script.js';
        wp_enqueue_script('lwb-script', $url, array('jquery'), '1.0', true);    
    } else {
        wp_enqueue_script('lwb-script', get_stylesheet_directory_uri() . '/assets/js/lwb-script.js', array('jquery'), '1.0', true);
    }
}
add_action('wp_enqueue_scripts', 'lwb_jquery_script');  

This code snippet checks, if the feature is enabled. If its enabled, the file to put the custom jQuery code is created, and this file is registered in Wordpress with wp_enqueue_script()

So my question is: Is this a safe way to add my script with this feature?

4
  • if your function checks for the existence of the file then I see no issue with it running multiple times, but the main issue I see is not how many times it happens, but that it happens at all. Constructing a JS file like that and writing it to the filesystem is dangerous, and also not going to work on a lot of hosts that have read only code filesystems. If you want to enable/disable a feature don't delete/write/modify JS files, there are far better and safer ways to implement feature flags that don't involve changes to files at all
    – Tom J Nowell
    Mar 1 at 20:43
  • Thank you for answer. Why is it dangerous to create files with php? The function is only running in the Wordpress Backend (admin_init). In the Backend its also possible to modify theme files... Mar 1 at 22:29
  • if you want to enable/disable features it's better to do that via variables set at runtime that are then checked for in the code that implements the feature. The issue here isn't with writing files, it's with writing executable files such as PHP files or javascript. That kind of operation is usually done for malicious reasons, and opens up lots of avenues for attack and fragility. E.g. the entire thing fails if the folder can't be written to, which is a lot of enterprise and managed WordPress hosts that use git to version control the filesystem
    – Tom J Nowell
    Mar 2 at 23:01
  • 1
    you could also keep the files there and if the feature is turned off, don't enqueue them. I'd also recommend taking a look at developer.wordpress.org/reference/functions/…
    – Tom J Nowell
    Mar 2 at 23:02

1 Answer 1

0

Thank you @Tom J Nowell letting me think about this. I had to think about it the last day, and this is the safe way to do this.

function lwb_jquery() {
    
    $message = '';
    
    // Multisite Support
    if( is_multisite()) {
        $uri = get_stylesheet_directory() . '/sites/' . get_current_blog_id(). '/assets/js/lwb-script.js';
        $file_path = '[AKTIVES THEME]/sites/' . get_current_blog_id() . '/assets/js/lwb-script.js';
        
        if( !file_exists( $uri ) || get_option('lwb_jquery') === '' ) {
            $message = '<strong>Achtung:</strong> JS Datei muss manuell erstellt werden in: <strong>' . $file_path . '</strong>';
        } 
        elseif( file_exists( $uri ) && get_option('lwb_jquery') === 'on' ) {
            $message = 'Super, das Skript kann jetzt verwendet werden unter: <strong>' . $file_path . '</strong>';
        }   
    } else {
        $uri = get_stylesheet_directory() . '/assets/js/lwb-script.js';
        $file_path = '[AKTIVES THEME]/assets/js/lwb-script.js';
        
        if( !file_exists( $uri ) || get_option('lwb_jquery') === '' ) {
            $message = '<strong>Achtung:</strong> JS Datei muss manuell erstellt werden in: <strong>' . $file_path . '</strong>';
        }           
        elseif( file_exists( $uri ) && get_option('lwb_jquery') === 'on' ) {
            $message = 'Super, das Skript kann jetzt verwendet werden unter: <strong>' . $file_path . '</strong>';
        }   
    }
    
    return $message;
    
}
    

// Registrieren und einbinden der Javascript Datei
function lwb_jquery_script() {
    if( get_option('lwb_jquery') === 'on' ) {   
        // Multisite Support
        if( is_multisite()) {
            $url = get_stylesheet_directory_uri() . '/sites/' . get_current_blog_id() . '/assets/js/lwb-script.js';
            wp_enqueue_script('lwb-script', $url, array('jquery'), '1.0', true);    
        } else {
            wp_enqueue_script('lwb-script', get_stylesheet_directory_uri() . '/assets/js/lwb-script.js', array('jquery'), '1.0', true);
        }
    }
}
add_action('wp_enqueue_scripts', 'lwb_jquery_script');  

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.