[Plugin: Snapshot Backup] ftp_connect errors in PHP error log

I downloaded the latest version and see the new code you added, but this only blocks someone from accessing snapshot-backup.php directly.

I simpler way to accomplish this is to put this at that top of all your plugin pages.

// Direct calls to this file are Forbidden when core files are not present
if ( !function_exists(‘add_action’) ){
header(‘Status: 403 Forbidden’);
header(‘HTTP/1.1 403 Forbidden’);
exit();
}

if ( !current_user_can(‘manage_options’) ){
header(‘Status: 403 Forbidden’);
header(‘HTTP/1.1 403 Forbidden’);
exit();
}

You should be checking the referrer and have nonces on all your forms, except for the forms that are using the WordPress Settings API.

if (isset($_POST[‘bps-view-phpinfo’]) && current_user_can(‘manage_options’)) {
check_admin_referer( ‘bps-view-phpinfo-check’ );

Then in your form add this
<?php wp_nonce_field(‘bps-view-phpinfo-check’); ?>

You still have not secured the sendaway.php file. It is very, very easy to hack. 🙁

// connect to host
$conn = ftp_connect($host);

Change it to this

// If in WP Dashboard or Admin Panels
if ( is_admin() ) {
// If user has WP manage options permissions
if ( current_user_can(‘manage_options’)) {
// connect to host ONLY if the 2 security conditions are valid / met
$conn = ftp_connect($host);

You need to do this kind of security checking throughout your coding. It is better to do security overkill then to not have every single potentially dangerous vulnerability secured.
Thanks,
Ed