Intrinsic Security Disaster
-
The basis of this plugin is founded upon creating a security vulnerability. Files should never be editable through the admin; that only opens your site up for exploitation, if someone were to get hold of your credentials somehow. Files should not even be editable by the Apache/Nginx user itself. They should be committed to your git repo and then git pushed up to the repo on a separate service like GitHub/GitLab/BitBucket/CodeCommit and then git pulled down from that service to your server using a deploy key that only has pull permissions. This will ensure that the files are under version control and cannot be modified by software running on the server. You should have these two lines in your wp-config on the server:
define(‘DISALLOW_FILE_EDIT’, true);
define(‘DISALLOW_FILE_MODS’, true);If you have both these settings marked as true, then this plugin will not work, as it should not. If you do not know how to do this the proper way with git as described, you should either study up on it or hire someone else to do this.
You must be logged in to reply to this review.