[Bug Report] overwrites DISALLOW_FILE_EDIT in wp-config.php issue

  • Resolved Diiamo

    (@luislu)


    1 month ago

    Hi WPASE Team,

    I’d like to report a bug in Admin and Site Enhancements Pro regarding the “Disable Plugin and Theme Editor feature.

    Summary
    When the “Disable Plugin and Theme Editor setting is OFF (file editing allowed), the plugin still forcibly overwrites the DISALLOW_FILE_EDIT constant in wp-config.php to false on every admin page load — silently undoing a user’s manual security hardening.

    Steps to reproduce

    1. Install ASE Pro v8.9.2, keep “Disable Plugin and Theme Editor OFF.
    2. Manually add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.
    3. Log in as an administrator and visit any wp-admin page (dashboard, settings, etc.).
    4. wp-config.php is silently modified: DISALLOW_FILE_EDIT is changed back to false (within seconds).

    Root cause (from code inspection)
    In classes/class-disable-smaller-components.php, the enable_plugin_theme_editor() method runs on every admin request (skipped only for ajax/cron). When the option disable_plugin_theme_editor is false (feature OFF), ASE still calls enable_plugin_theme_editor(), which uses WP_Config_Transformer to force DISALLOW_FILE_EDIT to ‘false’.

    Expected behavior
    When the feature is disabled (setting = false), ASE should NOT touch the DISALLOW_FILE_EDIT constant at all. Users who manually set DISALLOW_FILE_EDIT=true for security hardening should have their setting respected.

    Impact

    • Security hardening (DISALLOW_FILE_EDIT=true) is silently reverted, re-enabling the plugin/theme file editor.
    • Affects multiple sites using the plugin (we confirmed it on 3 sites).
    • Hard to detect because there is no log or notice about the modification.

    Suggested fix
    Only run enable/disable_plugin_theme_editor() logic when the user explicitly enables the corresponding feature. When the setting is OFF, leave wp-config.php untouched. Alternatively, add an opt-out option for ASE not to manage DISALLOW_FILE_EDIT.

    Environment

    • WordPress 7.0.3
    • PHP 8.3.32
    • Memcached object cache

    Thank you for maintaining a great plugin — I’m happy to provide more details if needed.

    Best regards,

    • This topic was modified 1 month ago by Diiamo.
    • This topic was modified 1 month ago by Diiamo.
Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Bowo

    (@qriouslad)

    3 weeks, 6 days ago

    @luislu thank you for the detailed feedback. Good point.

    In the next release, there will be additional checks, where existing “DISALLOW_FILE_EDIT = true” in wp-config.php will trigger ASE to issue a warning and disable the “Disable the plugin and theme editor” checkbox, as follows.

    If no “DISALLOW_FILE_EDIT = true” exists or if “DISALLOW_FILE_EDIT = false” exists, ASE will take over editing that value by checking or unchecking the “Disable the plugin and theme editor”, with appropriate warning message. e.g. “Disable the plugin and theme editor. Note that ASE set DISALLOW_FILE_EDIT to true in wp-config.php. Unchecking this setting will set it to false.”

    What do you think?

    p.s. it seems that you enjoy using ASE. Please consider copying what you wrote in your comment “Thank you for maintaining a great plugin” as a review at https://wordpress.org/plugins/admin-site-enhancements/#reviews. You can write more ofcourse. Thanks. 🙂

    Thread Starter Diiamo

    (@luislu)

    3 weeks, 5 days ago

    Hi @qriouslad,

    Yes, go ahead. Already published a review.

    Thank you

    Plugin Author Bowo

    (@qriouslad)

    3 weeks, 5 days ago

    @luislu Thanks. Please do test once the new version is released next Monday.

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.