0

I'm currently developing a website and am exploring all possible options to restrict file viewing. I'm trying to find a way where I can load php files like my theme-options.php and cpt.php without them been displayed in the admin panel even to admin users e.g appearance > editor.

I'm leaning towards the answer having more to do with file permissions then any actually functions calling specific files and then providing restricted access to all users.

1.How can I restrict access to these files yet load them at the same time?

Thanks

Improve this question

3 Answers 3

Reset to default
0

The simplest way to hide them from the editor is to put them at least two directories deep. The editor only traverses one directory down when displaying files for editing.

Improve this answer
2
  • I guess this awnsers my question - I then just call them using something like 'require_once get_template_directory() . '/inc/theme_settings.php' Commented Apr 24, 2014 at 21:43
  • 1
    yes, that's correct, but with one more level, like /inc/another_folder/theme_settings.php Commented Apr 24, 2014 at 21:53
0

A better sollution would be to add the following to your wp-config.php file:

define( 'DISALLOW_FILE_EDIT', true);

This will disable files from being edited in the backend.

I wouldn't recommend following Milos answer, as there's too many ways to circumvent this, such as installing plugins that allow full wordpress directory access. Plus it makes theme development and troubleshooting that much more cumbersome.

Improve this answer
8
  • assuming OP wants to restrict access to all theme files, which wasn't stated in the question. Commented May 3, 2014 at 2:01
  • Still, it's a far better answer than trying to hide the files deeper in the directory structure, which is at best a band-aid solution that makes things much more difficult in the long term. Commented May 3, 2014 at 2:17
  • a better answer to a different question. Commented May 3, 2014 at 2:58
  • what solution would you propose given the requirement that some files should be hidden while others should be visible? in the case of a cpt.php file given in the example, it could be argued that that code would be more appropriate as a plugin. Commented May 3, 2014 at 3:48
  • Short of getting your hands dirty with .htaccess, I don't think there's a way to block access to specific files through the backend editor. IMO, Brad Daltron's answer was best, as it allows you to remove access via specific user roles, which seems to be sufficient given OP's question. Blocking access through obfuscation will only stop the most uneducated users from accessing the files. Anyone with decent knowledge of WP will be able to circumvent your method, whereas blocking by specific role will be essentially impossible, unless the user is specifically granted access. Commented May 3, 2014 at 4:37
0

Why not put this code in a plugin.

add_action( 'init', 'wpsites_remove_file_viewing' );

function wpsites_remove_file_viewing() {

$author = get_role( 'admin' );

$caps = array(
'edit_files',
'edit_theme_options',
'edit_plugins',
'edit_themes',

);

foreach ( $caps as $cap ) {

$administrator->remove_cap( $cap );

    }
}
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.