Linux users have nothing to do with WordPress users. WordPress maintains its own user database, with its own permissions. The linux user PHP is running as is determined by the server setup, usually whatever user that Apache/Nginx/etc are running as. If your PHP can access the entire file system then you have a serious security … Read more
Add this to your theme’s functions.php file: function wpse202681_save_post_action($post_id, $post_object, $update) { $folder = “/temp/files/”; delFolder($folder); } add_action( ‘save_post’, ‘wpse202681_save_post_action’, 10, 3 ); // + delFolder() function definition You will probably have to alter folder paths depending on your /temp/files/ location. This will execute everytime any post is saved. You can restrict it to only … Read more
How do I keep my Files during WordPress and Theme Updates? Don’t edit core WordPress files or the files of themes or plugins you didn’t develop yourself. If those are updated they are replaced entirely and you will lose any changes you make. If you want to customise the theme, create a Child Theme. If … Read more
You should never ever modify WordPress Core files. WordPress has an Plugin API (http://codex.wordpress.org/Plugin_API) that allows you to modify WordPress to your liking without changing Core code. In your case, the solution is to check the contents of the custom meta box fields before they are saved via the save_post action. If the content is … Read more
Of the two option you proposed, the latter is better for maintainability. The reason is, if you ever need to move the site to another server or use the theme on another site, it seems an easier process to move / reuse. If you’re not using the image for themeing, consider just using media library … Read more
The only safe thing to do is to restore the site from a known clean backup. Hacker could have inserted backdoor users or other vulnerabilities in your DB, something you are not going to be able to find based on any list of files, which means that even if you remove all files which obviously … Read more
Firstly add this two line to your functions.php file. Sorry I forgot to mention about this earlier. require_once ABSPATH . ‘wp-admin/includes/class-wp-filesystem-base.php’; require_once ABSPATH . ‘wp-admin/includes/class-wp-filesystem-direct.php’; now you can use WP_Filesystem_Direct::get_contents($path) instead of file_get_contents($path)
Can they theoretically develop a WP plugin to access the files (or even WP config, including DB credentials) of another WP installation? Yes. If your folders are owned by the same user, run as the same user in Apache/Nginx or have read/write access to each other, then it’s possible. Your installations are sandboxed at the … Read more
What is the best way to load the dependencies for the WP_Filesystem? The first or the second code part? WP_Filesystem() is used in conjunction with the global $wp_filesystem variable, so if you use it, then the second code part should be used. And WP_Filesystem() must be called so that the global $wp_filesystem variable is properly … Read more
Short answer, but adequate I think. While I have not tested this, I doubt that there would be a problem if you used the Filesystem API provided by the Core.