hausinteractive

Not sure of Jabawack’s specific issue but this has been my experience with Scissors and Watermark on WordPress 3.5:

Upon Activation these are the messages at the top of the screen:

The plugin Scissors and Watermark need to be set. Please visit the Settings page | Hide Notice.

The plugin generated 242 characters of unexpected output during activation. If you notice “headers already sent” messages, problems with syndication feeds or other issues, try deactivating or removing this plugin.

So the error is of some concern but I forged ahead and clicked on “Settings” and made custom max dimensions for the “Large” size. After the settings were saved this still shows at the top of every WordPress admin page:

The plugin Scissors and Watermark need to be set. Please visit the Settings page | Hide Notice.

Not sure what this means and what isn’t being set. No errors in the apache logs so not much I can do to debug.

Anyway, I uploaded an image larger than my “large” setting image and chose “edit”. In the Scissors and Watermark section I tried Resize, Crop and Rotate:

Resize “worked” but offered none of my presets for thumbnail, medium or large. This is very bad for usability as I don’t want my site admins to have to remember an exact pixel value like 817px to get images sized correctly. It would be nice to allow images to be sized to the max width given, allowing the height to vary or for the height to be cropped.

Crop simply doesn’t work. When I select an area and click “crop” the page refreshes with the original cropping.

Rotate works.

Hey Jaumesala,

If your web hosts allows WordPress FTP/SFTP access you can modify the file /wp-admin/theme-editor.php to also use this function.

This would be considered an advanced hack because:

(1) You are modifying core WordPress files

(2) You will need some understanding of how the code works to only modify the needed parts of the file so that…

(3) you can redo it after you upgrade WordPress if upgrades overwrite the /wp-admin/theme-editor.php file

jafcobend’s pastebin code shows the *differences* between the modified theme-editor.php file and the *original* file that came with WordPress 3.2.1. You will have to manually insert the changes to add this functionality to your wordpress sites running 3.2.1

I should also add that while I agree this isn’t *seriously* more insecure, generally FTP/SFTP accounts are protected by login rate limiters (locking out brute-force attackers after a certain number of attempts) while WordPress is not.

As such I would HIGHLY RECOMMEND installing a plugin such as Login Lockdown as a favor to your web host if you allow WordPress FTP/SFTP access.

Hey guys,

Many already put their SFTP credentials into their wp-config.php file in order to add/delete themes and plugins. What jaumesala is suggesting makes absolute sense–why give WordPress permissions to add a theme if it can’t then proceed to edit it?

One of the main security issues I see is that WordPress accounts aren’t protected as well as SFTP accounts are by default (and are more subject to script attacks).

It seems that use of the WordPress plugin Login Lockdown would go a good distance to resolving that problem.

Additionally, if one’s server handles it, the connections WordPress is making are easily made tighter with SSH vs FTP:

/** in wp-config.php */
/** Force WordPress to use SSH method for plugins and themes */
/** This eliminates the need to log in every time */
define(‘FS_METHOD’, ‘ssh2’);
define(‘FTP_SSL’, ‘true’);
define(‘FTP_BASE’, ‘/home/SFTP-Account/wordpress/’);
define(‘FTP_CONTENT_DIR’, ‘/home/SFTP-Account/wordpress/wp-content/’);
define(‘FTP_PLUGIN_DIR ‘, ‘/home/SFTP-Account/wordpress/wp-content/plugins/’);
define(‘FTP_USER’, ‘SFTP-login’);
define(‘FTP_PASS’, ‘SFTP-password’);
define(‘FTP_HOST’, ‘servername.com’);

While not all servers have (S)FTP access, this would be a HUGE addition for those that do. This might seem small to an engineering type, but would be a game-changer for end users, which is the point.

So all this to say +1 to using (S)FTP credentials to enable theme/plugin editor to “work”.