shaneshack

So far I’ve experienced zero issues with WordPress’ functionality. I maintain several WordPress sites and use them extensively, and have modified a few of them extensively without issue.

As to the security issues, I have been unable to derive any unexpected risks from this configuration; although no config is risk free. Through the use of complex passwords, non-default names for uid’s and gid’s, I feel like the config is pretty secure; especially since with this config there is no need for any 777 folders in my directories. I have anonymous FTP disabled, so you must log in as an authorized user. Browsing outside of your FTP directory is locked down/prohibited.

I’m open to being proven wrong on this, but until some one can show me the error of my logic, this is a very convenient configuration. As far as I can tell, this is a relatively safe configuration.

Would really like to see the WordPress geniuses figure out a way around this. ??

I too am having the same problem. Upon securing the wp-admin folder with htaccess/htpasswd, the flash uploader stops working. After a thorough search I found the following information about flash:

“It turns out that Flash, in all browsers besides IE, does not retain a basic authentication session when posting the files for upload. This is a well known problem among flash upload developers because it breaks every application, but there really isnt a great fix.”

As it turns out, the flash uploader problem is non-existent in IE. I have tried several other browsers (firefox, safari, chrome) and in all of them the flash uploader is broken. IE currently is the only browser in which the flash uploader works properly with htaccess/htpasswd authentication. When you go to upload, it asks you for your htaccess user/pass again and then continues to upload successfully.

For me, this has gone from a critical problem, to just an annoyance since I don’t normally use IE for anything except development previewing.

Did you ever find an answer? I have the same problem.