Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've run across the following snippet in themes from time to time:

if ( ! defined('ABSPATH')) exit('restricted access');

It's at the beginning of some (all?) PHP files in a theme and it's supposed to prevent direct access of the file by nefarious sources.

I see that this isn't included in Twenty Ten or Eleven and I've never seen it recommended in official WordPress documentation. It seems like a good idea to me, but I also don't know enough about security to judge it and can't find much with Google.

Is this something I should have in my custom themes? If so, should it be in all PHP files or just some?

share|improve this question

1 Answer 1

up vote 8 down vote accepted

Usually, you don’t need it. But … there is at least one edge case:

  • If a theme file is a template part,
  • and it is using global variables from the calling context (parent file),
  • and register_globals is on,
  • and it is just using these variables without any security check …

… an attacker can call this file, set the missing variables with GET or POST and make the theme file print those out. And then there is a security problem.

So … the best option is not a context check like the one from your example, but good code: avoid global variables, check their content before you print it out.

In some cases I add the context check when I think somebody else will use my code and change it without security in mind. It doesn’t hurt.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.10.19.1955\r\n            </div>\r\n                <div id=\"additional-notices\">\r\n                    WordPress is a trademark of the WordPress Foundation, registered in the US and other countries. This site is not affiliated with the WordPress Foundation in any way.\r\n        "], "copyright__copyright__copyright": ["is not a context check like the one from your example, but good code: avoid global variables, check their content before you print it out.\n\nIn some cases I add the context check when I think somebody else will use my code and change it without security in mind. It doesn\u2019t hurt.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}