PHP code not executed when logged out

Resolved cgdannie
(@cgdannie)

8 years, 6 months ago
Hello,

Thank you for your awesome plugin. But I have a little problem.

When I (admin of a single wordpress installation) paste the following code
```
<?php
    echo 'before';
    $someArray = ['foo' => 'bar'];
    echo 'after';
?>
<b>some HTML</b>
```
into the PHP Code Widget inside the Elementor PageBuilder, everything works fine and returns

beforeafter
as long as I am logged in (even with an account, that has only the author role).

When I am logged out, the PHP code is not executed and the following is printed on the site:

'bar']; echo 'after'; ?>
The HTML is rendered fine.

If I paste the same code into a widget outisde of Elementor, everything also works fine.

Do you have any ideas how to solve this issue? I already asked the autohr of the PHP Code Widget: https://ww.wp.xz.cn/support/topic/php-code-not-executed-when-logged-out/#post-9757456
But he thinks, it has something to do with Elementor. Thank you very much!

System Info: https://pastebin.com/Z7Anxeic

Viewing 5 replies - 1 through 5 (of 5 total)

benpines
(@benpines)

8 years, 6 months ago

Hi Dannie,
You cannot execute PHP code inside the code editor, for security reasons.
Cheers

Thread Starter cgdannie
(@cgdannie)

8 years, 6 months ago

Thank you Ben for your fast response. But I am not talking about the theme code editor but the PHP Code Widget, that I dragged into the Elementor page.

If you disabled PHP Code inside of an Elementor page if no user is logged in, how can I enable that again?

Why is this a security reason? WordPress an your plugin are written in PHP. Why shouldn’t I use PHP to fetch data that is else not accessible in the way, I want to display it? For small tasks the PHP Code Widget is much more efficient to use, than writing always a completely new plugin.

pingram
(@pingram3541)

8 years, 6 months ago

You are essentially trying to use it as a live IDE?

@cgdannie You’d have to modify the core plugin to do that. This is totally up to your own discretion but you have to see the implications of the public version having such power and freedom? It could be a disastrous problem for many sites if they got hacked, not to mention how they might be used against the public, government or service. We have rules to follow to be able to be listed on ww.wp.xz.cn and Elementor has to follow those rules too, for the sake of whats best for the community and not just power users.

Again, all the power to you, I’m am sure you can find the code needing adjusting, then use Github updater plugin and every new version of Elementor and/or Elementor Pro, run a script to apply your dev patch and get back to doing your live PHP stuff. (why not use js w/ admin-ajax.php instead – pass json much more efficient no?)

Best of luck and success to you!

pingram
(@pingram3541)

8 years, 6 months ago

Actually, I’m kind of curious what you are doing. There is an Elementor Developer facebook group that would be a great place to get help if needed. Cheers!
Thread Starter cgdannie
(@cgdannie)

8 years, 6 months ago
Thank you, for your answer.

I want to load some fields of some posts to generate custom filter buttons.

I didn’t knew, that enabling php is such a problem because outside of Elementor the PHP Code Widget worked fine.

I also didn’t knew, that WordPress gives us access to the database through ajax requests. This totally solves my problem. Thank you again for your help!
- This reply was modified 8 years, 6 months ago by cgdannie.