{"id":18990178,"date":"2026-08-11T07:41:34","date_gmt":"2026-08-11T07:41:34","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/bug-report-overwrites-disallow_file_edit-in-wp-config-php-issue\/"},"modified":"2026-08-11T07:43:53","modified_gmt":"2026-08-11T07:43:53","slug":"bug-report-overwrites-disallow_file_edit-in-wp-config-php-issue","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/bug-report-overwrites-disallow_file_edit-in-wp-config-php-issue\/","title":{"rendered":"[Bug Report] overwrites DISALLOW_FILE_EDIT in wp-config.php issue"},"content":{"rendered":"\n

Hi WPASE Team,<\/p>\n\n\n\n

I’d like to report a bug in Admin and Site Enhancements Pro regarding the “Disable Plugin and Theme Editor feature.<\/p>\n\n\n\n

Summary<\/strong>
When the “Disable Plugin and Theme Editor setting is OFF (file editing allowed), the plugin still forcibly overwrites the DISALLOW_FILE_EDIT constant in wp-config.php to false on every admin page load \u2014 silently undoing a user’s manual security hardening.<\/p>\n\n\n\n

Steps to reproduce<\/strong><\/p>\n\n\n\n

    \n
  1. Install ASE Pro v8.9.2, keep “Disable Plugin and Theme Editor OFF.<\/li>\n\n\n\n
  2. Manually add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.<\/li>\n\n\n\n
  3. Log in as an administrator and visit any wp-admin page (dashboard, settings, etc.).<\/li>\n\n\n\n
  4. wp-config.php is silently modified: DISALLOW_FILE_EDIT is changed back to false (within seconds).<\/li>\n<\/ol>\n\n\n\n

    Root cause (from code inspection)<\/strong>
    In classes\/class-disable-smaller-components.php, the enable_plugin_theme_editor() method runs on every admin request (skipped only for ajax\/cron). When the option disable_plugin_theme_editor is false (feature OFF), ASE still calls enable_plugin_theme_editor(), which uses WP_Config_Transformer to force DISALLOW_FILE_EDIT to ‘false’.<\/p>\n\n\n\n

    Expected behavior<\/strong>
    When the feature is disabled (setting = false), ASE should NOT touch the DISALLOW_FILE_EDIT constant at all. Users who manually set DISALLOW_FILE_EDIT=true for security hardening should have their setting respected.<\/p>\n\n\n\n

    Impact<\/strong><\/p>\n\n\n\n

      \n
    • Security hardening (DISALLOW_FILE_EDIT=true) is silently reverted, re-enabling the plugin\/theme file editor.<\/li>\n\n\n\n
    • Affects multiple sites using the plugin (we confirmed it on 3 sites).<\/li>\n\n\n\n
    • Hard to detect because there is no log or notice about the modification.<\/li>\n<\/ul>\n\n\n\n

      Suggested fix<\/strong>
      Only run enable\/disable_plugin_theme_editor() logic when the user explicitly enables the corresponding feature. When the setting is OFF, leave wp-config.php untouched. Alternatively, add an opt-out option for ASE not to manage DISALLOW_FILE_EDIT.<\/p>\n\n\n\n

      Environment<\/strong><\/p>\n\n\n\n

        \n
      • WordPress 7.0.3<\/li>\n\n\n\n
      • PHP 8.3.32<\/li>\n\n\n\n
      • Memcached object cache<\/li>\n<\/ul>\n\n\n\n

        Thank you for maintaining a great plugin \u2014 I’m happy to provide more details if needed.<\/p>\n\n\n\n

        Best regards,<\/p>\n","protected":false},"template":"","class_list":["post-18990178","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18990178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":2,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18990178\/revisions"}],"predecessor-version":[{"id":18990183,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18990178\/revisions\/18990183"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18990178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}