Thursday, September 27, 2018

How to show uploaded php file as plain text instead of executing it in wordpress?

Leave a Comment

Edit a testme.php file in /tmp.

<?php echo  "test"; ?> 

Edit a new post titled test and upload file /tmp/testme.php ,pubish it with url http://home.local/wp/?p=4785.
enter image description here

I want to see the content in testme,click it,pop up new window in wordpress. enter image description here

Go on to click it.test shown in webpage.

My expect :
1.just click testme in test post for one time.
2.show the testme.php as plain text ,

<?php echo  "test"; ?> 

instead of the result of executing testme.php.

test 

I make a configuration according some material show php file as plain text in apache.

sudo vim /etc/apache2/sites-available/000-default.conf

<VirtualHost *:80>     ServerName www.home.local     ServerAdmin webmaster@localhost     DocumentRoot /var/www/html     ErrorLog ${APACHE_LOG_DIR}/error.log     CustomLog ${APACHE_LOG_DIR}/access.log combined         <Directory /var/www/html>             Options Indexes FollowSymLinks MultiViews             AllowOverride All             allow from all             php_flag engine off             AddType text/plain php         </Directory> </VirtualHost> 

Reboot apache2(build in debian).

sudo systemctl restart apache2 

To open the post http://home.local/wp/?p=4785,i got the following output in webpage:

<?php /**  * Front to the WordPress application. This file doesn't do anything, but loads  * wp-blog-header.php which does and tells WordPress to load the theme.  *  * @package WordPress  */  /**  * Tells WordPress to load the WordPress theme and output it.  *  * @var bool  */ define('WP_USE_THEMES', true);  /** Loads the WordPress Environment and Template */ require( dirname( __FILE__ ) . '/wp-blog-header.php' ); 

2 Answers

Answers 1

You already have the right code — AddType text/plain php, which will make Apache treats PHP files (or files where the name ends with .php) as plain-text files.

But assuming the following:

  • You have WordPress installed in the /var/www/html directory.

  • The PHP files are uploaded to the default uploads folder in WordPress (wp-content/uploads).

If you set the directory to /var/www/html/wp-content/uploads as in:

<Directory /var/www/html/wp-content/uploads>   AddType text/plain php </Directory> 

You'd get the results you wanted — only PHP files in the uploads folder will be treated as plain-text files, and not all PHP files in the /var/www/html directory. This explains the issue with "To open the post http://home.local/wp/?p=4785, I got the following output", where that output is the code in the file /var/www/html/index.php. I mean, you used <Directory /var/www/html>, which makes Apache treats the index.php file as a plain-text file, instead of executing the PHP code in the file.

ALTERNATE METHOD: Use the .htaccess file.

Particularly if you can't edit or have no access to the Apache's configuration (.conf) file.

  1. Create .htaccess in the uploads folder, if it's not already there.

  2. Then add AddType text/plain php in that file.

Additional Notes

I want to see the content in testme.php, click it, pop up new window

I'm sure you can do that or already have the code/solution, but an easy way, is just add target="_blank" to the attachment/file link.. or with JavaScript, you can use window.open().

And you must take full security measures since allowing people to upload PHP files could harm your site and/or your site users.

Answers 2

What are you trying to accomplish? It seems you're trying to get a hyperlink that displays the contents of a PHP file. WordPress posts are stored in the database. So when you say "publish it", what are you talking about? The database entry that refers to a WordPress post, or the PHP file? If all you want on the screen is the unexecuted contents of the PHP file, you shouldn't be publishing a WordPress "post". What is contained in the post? If you're talking about putting a PHP file as the CONTENT of a post, that would be a different thing too. Probably the easiest way to display the content of a PHP file is to just rename it to a text file.

myFile.php => myFile.php.txt

If You Enjoyed This, Take 5 Seconds To Share It

0 comments:

Post a Comment