« first day (2774 days earlier)      last day (2170 days later) » 

Jack Johansson
Jack Johansson
12:51 AM
Hey, 1 quick opinion based question. I'm making a plugin that has to interfere with the wp-config.php ( like WP Super Cache does ). I'm wondering, is it better to update wp-config.php every time a setting changes in my plugin, or is it better to write all the changes to an external php file in my plugin folder, and then require it using require() in the wp-config.php?
Of course I will add a if( ! defined('ABSPATH') ) ... to make sure the file isn't being accessed directly.
 
 
2 hours later…
Tom J Nowell
Tom J Nowell
2:43 AM
I can't think of any reason to modify wp-config.php like that
WP Super Cache only does it for WP_Cache but even then I think that's something the user should be doing not the plugin
are you sure these aren't things that could be done via an mu-plugin or a dropin?
 
Jack Johansson
Jack Johansson
3:16 AM
The users don't know how to code and stuff sometimes, or don't have FTP access. I need these values to be set before WordPress loads, that's why I need them inside the wp-config.php
 
 
2 hours later…
Mark Kaplun
Mark Kaplun
5:03 AM
wp-config.php should not be writable by the web server, therefor on secure systems you will have to use FTP to update it, and therefor the use case of "no ftp access" will not be satified for all.
In addition, at the plugin level you have no idea at all where the wp-config.php file is located.
User has to do it, or you need to figure out how to do things without it being done
 
Jack Johansson
Jack Johansson
5:15 AM
@MarkKaplun I guess I have to add a part in readme then, to update it manually if the server is secure, or forget about using it altogether
 
 
3 hours later…
Mark Kaplun
Mark Kaplun
8:17 AM
you can do like what wordpress does when htaccess is not writable and show the code that needs to be C&P in the admin
 
Tom J Nowell
Tom J Nowell
8:42 AM
@JackJohansson what kind of values are you using that need to be set that early?
 
Jack Johansson
Jack Johansson
Some constants that I need to define or change, such as SCRIPT_DEBUG. @TomJNowell
It's a plugin mostly for developers, and to be installed on Localhost. Yet I plan to do it in the best possible way
 
Tom J Nowell
Tom J Nowell
to be fair you don't have to set those in wp-config.php, an mu-plugin named aaaa.php that loads first does just as good for most of it
 
Jack Johansson
Jack Johansson
Even the critical constants? Such as WP_HOME can be set via a mu plugin?
I might as well want to change something like table_prefix, I don't think that would work with a plugin.
 
Tom J Nowell
Tom J Nowell
8:58 AM
eh maybe not that one
 
Jack Johansson
Jack Johansson
I guess I have to split them into 2 categories then. Is there any docs to know which constants need to be defined before WP core actually loads?
 
Tom J Nowell
Tom J Nowell
probably not
stuff like WP_DEBUG etc work using an mu plugin because its the plugins and themes usually being debugged
so missing out on the 50 ms of WP core isn't a big deal
 
Jack Johansson
Jack Johansson
It's not about time. Defining table_prefix after the WP is connected to database is not going to work
 
Tom J Nowell
Tom J Nowell
Im not sure why anybody would change the DB prefix at runtime
 
Jack Johansson
Jack Johansson
But I'm not quit sure when mu plugins fire, since the usual plugins are fired after the database is connected
 
Tom J Nowell
Tom J Nowell
9:03 AM
also don't forget that wp-config.php can be placed 1 level up too
 
Jack Johansson
Jack Johansson
You mean outside the root?
As far as I know WP will look for wp-config.php in the root inside wp-load
 
Tom J Nowell
Tom J Nowell
it also checks 1 folder up
that way your config file is outside the public html folder and totally inaccessible from the net
a great way to avoid disaster if you misconfigure a server and it starts printing rather than executing PHP
 
 
4 hours later…
Michael Ecklund
Michael Ecklund
1:17 PM
I found at least 7 bugs in my plugin testing it in production environments
 
 
8 hours later…
Sisir
Sisir
9:08 PM
Hi all! Hope all is well!
A question to all. How do you secure an ajax endpoint (public)? given that generally used nonces are only good for logged in users?
 
Tom J Nowell
Tom J Nowell
@Sisir don't, use a REST API endpoint, significantly easier to secure
instead of writing every check you need yourself, of which there are quite a few, nonces, validators, sanitisers, auth checks, capability checks, etc
let the REST API do all that for you. Define which parameters to expect, their formats, capabilities and auth requirements etc, and the API code in core will manage all of the checking for you
your code will never even trigger if they fail, and core will send back a forbidden or incorrect request error in standard http notation
 
Feeds
Feeds
9:28 PM
Changes to Our Privacy and Data Policies
Adam Francoeur on May 21, 2018

Stack Overflow has always been committed to protecting your privacy and your data. The European Union’s General Data Protection Regulation has prompted us to review our policies and make sure that we are doing the right thing for all of our users worldwide.

Stack Exchange, Inc. has updated its Terms of Service, Privacy Policy and Cookie Policy for all of our sites.

We have made it easier to understand what types of data we collect and how we use your data.

Our new Terms of Service distinguishes between public network users (those who use our public Stack Exchange Q&A sites) and private network users (those who use Stack Overflow for Teams). …

 

« first day (2774 days earlier)      last day (2170 days later) »