Removed access to .htaccess for admin role
-
Hi team,
Looking at your recent change log you have removed access to .htaccess for the fear of abuse. This doesn’t make sense for roles under Admin.
Why not put an Admin role behind a password wall? Or allow to add a password to specific file types or folders in any role that is managed under Admin?
It seems backwards to remove this and ask people to log in through FTP to access .htaccess. Doesn’t that make your plugin redundant. Anyone can access wp-config.php in your plugin and completely take down the site that way, which can cause more damage compared to the misuse of .htaccess alone.
Please revisit this and add another level of security i.e. password protection, rather then taking features away.
-
Why not follow the route below to secure this without removing access to .htaccess etc:
- Role-Based Access Control
Only allow access to sensitive files like.htaccess,wp-config.php,.env, etc., for users with theadministratorrole or a custom capability (e.g.,filester_manage_sensitive_files). - Optional Password Prompt (Re-authentication)
Prompt users to enter their WordPress password before accessing/editing protected files. This is a common pattern in WordPress (e.g., exporting personal data or changing site settings). - Developer Override (for advanced users)
Add a constant or filter to allow controlled override, like: phpCopyEditdefine('FILESTER_ALLOW_HTACCESS_EDIT', true);or phpCopyEditadd_filter('filester_allow_htaccess_edit', '__return_true');
This approach keeps things locked down by default for most users but still provides developers and advanced admins with the flexibility they need — especially since files like
wp-config.phpare still editable in the current version. - Role-Based Access Control
The topic ‘Removed access to .htaccess for admin role’ is closed to new replies.
