search

imFORZA / wp-listings-pro

WP Listings Pro
1 stars 1 forks source link

Submission Issue #3 - Allowing Direct File Access to plugin files #145

Closed bhubbard closed 7 years ago

bhubbard commented 7 years ago

Direct file access is when someone directly queries your file. This can be done by simply entering the complete path to the file in the URL bar of the browser but can also be done by doing a POST request directly to the file. For files that only contain a PHP class the risk of something funky happening when directly accessed is pretty small. For files that contain procedural code, functions and function calls, the chance of security risks is a lot bigger.

You can avoid this by putting this code at the top of all php files:

if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
bhubbard commented 7 years ago

I gave this a first pass, but give it one more to make sure we got every file.

bradleymoore111 commented 7 years ago

I don't see anymore, I think you got them.