Some sort of conflict with iThemes Security

  • Resolved app1e5auce

    (@app1e5auce)


    2 years, 4 months ago

    It looks like with the newest versions of iThemes Security and WP DB Manager, there is some sort of conflict. The WP DB Manager menu is removed entirely, and if I try to browse to the settings pages via URL I am told I do not have the proper permissions to see the page. This is on admin users.

    When I disable iThemes, the WP DB Manager menu comes back. I’m trying to go through each iThemes setting, disabling them one-by-one, to see which setting is causing this. It has not been working. I have database backups disabled in iThemes.

    I have had both of these plugins on dozens of live sites for years and have not encountered this problem before.

Viewing 6 replies - 1 through 6 (of 6 total)

  • The WP DB Manager menu is removed entirely, and if I try to browse to the settings pages via URL I am told I do not have the proper permissions to see the page. This is on admin users.

    The same here. I’m back to version 2.80.5 again.
    I don’t have iTheme.

    Thread Starter app1e5auce

    (@app1e5auce)

    The same here. I’m back to version 2.80.5 again.
    I don’t have iTheme.

    Do you have any security plugin? Right now I’m guessing this has something to do with WP DB Manager switching its required capability to ‘edit_files’. I’m wondering if iThemes and others might lock down that cap for some reason. Not sure, still looking into it.

    Do you have any security plugin?

    All plugins are disabled, the error remains.

    Found a mistake.
    I disabled the theme and plugin editor in my wp-config.php.
    define('DISALLOW_FILE_EDIT', true);

    I’m leaving that in wp-config.php for security reasons, so I’m deleting the WP-DBManager plugin. It’s a shame after so many years.

    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    • This reply was modified 2 years, 4 months ago by nonick08.
    Thread Starter app1e5auce

    (@app1e5auce)

    I disabled the theme and plugin editor in my wp-config.php.
    define(‘DISALLOW_FILE_EDIT’, true);

    Yup you got it. I just found it myself. In the iThemes Security plugin, there is a setting to disable the Plugin and Theme file editor for security reasons, which I always enable. This setting sets DISALLOW_FILE_EDIT to true, and therefore any checks for the ‘edit_files’ capability will fail, so WP DB Manager gets removed from your menu.

    To the developers: I think its a bad decision abandoning the ‘manage_database’ cap used in the past. Database backups should not be tied to the Plugin and Theme editor. It doesn’t make a lot of sense. I think its perfectly reasonable making your own cap for your own plugin.

    Plugin Author Lester Chan

    (@gamerz)

    Hi,

    Because of a security issue flagged by Automattic, I have to change the capability to be edit_files (as suggested by them) and realized it is no longer in used. So I have changed it to install_plugins instead.

    Let me know if the latest works 2.80.7.

    Version 2.80.7 is working again, thanks!

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Some sort of conflict with iThemes Security’ is closed to new replies.