I think the problem is that you are storing your images in /srv/www/wp-uploads/blog.linformatronics.nl/2013/01 but your link to the image is https://blog.linformatronics.nl/wp-uploads/2013/01/ccs5licence1.png. What you need to do is tell wordpress to store the images in /srv/www/blog.linformatronics.nl/wp-uploads/2013/01. What your trying to do, it seems, is store images in wp-uploads/blog.linformatronics.nl but the folders should be swapped. It’s the … Read more
There is a simple approach to hold download access on your file. 1. Using .htaccess: Upload a .htaccess file into your wp-content folder. Have a look if one exists already, then append this code to the end of the file. If you don’t have one, just create a new blank file and add this code … Read more
You could add an ID as post_parent to the attachment of the header image via wp_update_post() (even though this seems to be a very very hacky way to do it!) The tricky part is to get the ID out of the attachment URL; fortunately Rarst solved this issue long time ago, so you can manually … Read more
It should be enough to add the content disposition field. But specifically it’s Content-Disposition not Content-disposition I would also add some validation to your filename parameter thats being passed to file_get_contents to ensure it exists and it’s valid. Else you might be vulnerable to directory traversal attacks or remote URL requests
This is not full solution, it’s only a direction for you to work with media uploader Firstly, you need to know how to implement Media Uploader in your plugin/theme. You can learn that from the file: wp-admin/js/custom-background.js which is used by WP for custom background page. If that’s too hard to understand, then read this … Read more
See my question and answer again, you linked it already in your question: simple solution for restricting access to (some) uploads/downloads The solution isn’t that hairy the only necessity – besides configuring the plugin correct – is to create a .htaccess, which you could do programmatically. For that you have to automate the creation of … Read more
have you tried by setting the second argument of wp_signon() to true or blank? set false will prevent wp_signon() from setting secure cookie which is essential for accessing wp-admin if your using ssl. i have tested and $user = wp_signon( $user_data, true ); works as expected.
I’m copying a previous answer here as I think it will help. What this will do is whenever the media library pops up, instead of showing all media for a given post it will filter down to only images attached to the post. You could paste this right into your functions file: /** * Media … Read more
Looks like this is a defect. Ish. As @s_ha_dum mentioned, this is to prevent a directory traversal attack. However, WordPress’ Media Library will happily let you upload a file with two or more periods in a row, even if ms-files.php will refuse to serve it up. So, nothing is technically “broken”, but this certainly isn’t … Read more
.doc files can contain executable scripts, and there is no way to make sure they are safe. The same applies to SVG and some other file types. If WordPress would accept .doc files from any user with the capability upload_files, these files could be used to send malicious code to visitors.