Archived topic
Disallow PHP Execution (For Dummies)
3 replies · Started by Tommy on November 20, 2018
Hi, I've looked through the forum and read through your article, but I'm not understanding. Not sure of the verbiage or my diminishing intelligence, but I'm just not getting it.
I use iThemes Security. I don't want to compromise security, so want to keep the define( 'DISALLOW_FILE_EDIT', true ); line in there.
I also do want to be able to execute PHP hooks in GP.
I added this code in my snippets like mentioned...
add_action( 'after_setup_theme', 'tu_remove_hooks_php_check' );
function tu_remove_hooks_php_check() {
remove_action( 'admin_notices','generate_hooks_php_check' );
}...but am still getting this message:
What do I need to do to disallow file editing, while still being able to run php in the GP hook elements?
TIA!
Hi there,
To bypass that check, you can do this:
add_filter( 'generate_hooks_execute_php', '__return_true' );
However, the whole point of iThemes Security adding that code is to prevent an attacker from executing PHP if they're able to access your Dashboard.
If your Dashboard is secured (2FA, strong password etc..), you have nothing to worry about :)
Perfect - that worked!
However, the whole point of iThemes Security adding that code is to prevent an attacker from executing PHP if they’re able to access your Dashboard.
So then if I plan on using php codes within GP Elements, it's totally pointless to have define( 'DISALLOW_FILE_EDIT', true ); (given that I've secured WP etc etc)?
Exactly. Another point is an attacker could just install a plugin like Code Snippets and execute PHP. That depends on how much the attacker knows though.
Basically, just make sure your Dashboard is very secure :)
