'Controlling access to, and between, child theme custom WordPress PHP scripts
I have a large number of custom PHP scripts running under a child theme in WordPress.
To trigger a script, the user sees a WordPress page which attaches a custom template from a template PHP file in the child theme folder, which then initiates a call, require or include to other scripts in the same or a different folder under the child theme.
I want to prevent any of these PHP scripts being accessed other than through the main WordPress site pages, for example through direct access URL or other ‘unauthorised’ methods.
Most of these scripts are only used by a logged in user, but a few are accessed by users who aren’t logged in.
I tried using this commonly used code even when called from a script within WordPress environment:
if ( ! defined( 'ABSPATH' ) ) {
exit; // Exit if accessed directly
}
at the top of all my scripts, but found that it returned nothing (ie exited) even when a script was executed from another script.
I was wondering whether some kind of code along the lines of (sorry - mix of English and PHP:-))
if ((called from WordPress) || (called from a script in the child theme folder or subfolders))
{execute} ELSE {die}
Update #1
I've tried 'tricking' WordPress into thinking the target script is part of the WP environment (to pass the ABSPATH test) by adding the following to functions.php
function load_my_scripts() {
$my_script = 'MyScriptName';
$path = '/wp-content/themes/mytheme/MDB/' . $my_script . ".php";
if ($path) {
wp_enqueue_script($my_script,$path);
}
}
add_action( 'wp_enqueue_scripts', 'load_my_scripts' );
I've confirmed this enqueues the script to $wp_scripts but it still fails the ABSPATH test when accessed from another script within WordPress.
Appreciate any advice on how best to approach this. Many thanks in advance.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
