Question 245868 in Wordpress Question posted in
The official Wordpress documentation can be found here.

WordPress php file inside plugin 403 error

I’m writing a WordPress plugin and I need to open new windows with some PHP code to display information from a database. The way I’ve gotten it to work so far was to add these pages to the submenu of the plugin, but these files shouldn’t be accessible this way.

I’m aware of the include() function; however, I’ve only gotten it to work in the root of my installation, not actually INSIDE the plugin. Whenever I try to put myphp.php into the intended folder inside the plugin folder, I get a 403 error.

I’ve tried this (https://stackoverflow.com/a/39800534/19996081) solution which was the closest to my issue I could find, but it doesn’t change anything.

Here’s my plugin page which links to myphp.php:

include(site_url("/wp-content/plugins/myPlugin/myphp.php")); 
// some HTML...

<a href="<?php echo site_url("/wp-content/plugins/myPlugin/myphp.php"); ?>" target="blank">click</a>

And myphp.php:

<?php
require_once(dirname(__FILE__) . '/../../../../wp-config.php');
$wp->init();
$wp->parse_request();
$wp->query_posts();
$wp->register_globals();
$wp->send_headers();

// content goes here...

?>

I tried to put the file in different locations, it worked ONLY when myphp.php was in the same folder (root) as wp-config. tried different paths to reach wp-config (hardcoded, $_SERVER) none worked.

Tags:

2

Answers


  1. 0

    Make front end page and allow user to access it with password or something. Wont show page in menu or submenu

    Login or Signup to reply.
  2. 0
    1. in admin area when user is logged in, create a nonce:
    $nonce = wp_create_nonce('whatever_nonce_name');
    1. Make page url like so:
    $pageUrl = site_url("/wp-content/plugins/myPlugin/myphp.php") . "?nonce={$nonce}"

    it’s best to use a dynamic url there and not hardcode the name of your plugin, but that’s another topic.

    1. Add HTML link:
    <a href="<?php echo $pageUrl; ?>" target="blank">click</a>
    1. Inside your php file do something like this:
    <?php
    require_once "../../../../wp-load.php";

    if ( ! isset($_GET['nonce']) || ! wp_verify_nonce($_GET['nonce'], 'whatever_nonce_name')) {
        exit( __('Access denied.') );
    }

    // rest of the code here.
?>
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search