Do not allow unfiltered uploads for admins by default

[ryan]

When someone compromises an admin account, often one of the first things they do is upload some .php files. This is allowed because admin users have the unfiltered_upload capability. Perhaps this should be disallowed by default, with a wp-config define enabling it again. With this disallowed and all write permissions on files locked down, adding arbitrary code is much harder even when an admin account is compromised.

[westi]

+100

All users should be limited by the whitelist and admins should add filetypes to that with knowledge.

​http://wordpress.org/extend/plugins/pjw-mime-config/

[ryan]

(In [11887]) Disallow unfiltered uploads for admins by default. fixes #10692

[ryan]

(In [11888]) Disallow unfiltered uploads for admins by default. fixes #10692 for 2.8

[dd32]

Whats the point of the do_not_allow capability?

[snakefoot]

Are you not missing a break in the case statement in the 2.8 patch ?

[ryan]

It happens to work without the break since an imaginary cap is inserted, but the break should be there. Well-spotted.

[ryan]

(In [11912]) Add missing break. Props snakefoot. fixes #10692

[ryan]

[11913]

[snakefoot]

You are welcome :), I'm maintaining a Wordpress 2.0 installation while waiting for a blocking issue will be resolved. I monitor the code changes related to security issues to see if they are relevant for Wordpress 2.0.