[wp-trac] [WordPress Trac] #26273: If possible, change file permissions on deactivated plugins so they're not web-accessible.

[WordPress Trac]

#26273: If possible, change file permissions on deactivated plugins so they're not
web-accessible.
----------------------------+-----------------------
 Reporter:  kirrus          |       Owner:
     Type:  enhancement     |      Status:  reopened
 Priority:  normal          |   Milestone:
Component:  Administration  |     Version:
 Severity:  minor           |  Resolution:
 Keywords:                  |     Focuses:
----------------------------+-----------------------
Changes (by planetzuda):

 * status:  closed => reopened
 * resolution:  wontfix =>


Comment:

 There are a multitude of options here. To get around the multi-site issue,
 we can just not apply it to multi-site.  We could check to see what
 plugins are inactive by using is_plugin_inactive. We can check to see this
 with code like if(!is_multisite() && is_plugin_inactive('hello.php')) {
 defined('ABSPATH') or die('this plugin is deactivated');  }

 You would have to get a list of deactivated plugins and then provide that
 variable to is_plugin_inactive, so we block all plugins and use whatever
 method is decided on.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/26273#comment:10>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform