WordPress.org
Get WordPress

Make WordPress Core

Changes between Version 5 and Version 6 of Ticket #53298, comment 6


Ignore:
Timestamp:
07/12/2023 06:17:11 AM (3 years ago)
Author:
machineitsvcs

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #53298, comment 6

    v5 v6  
    33Unless your concern is that the message stating wp-config.php exists instructs that the wp-config.php be deleted first, and that this would result in a broken installation if wp-config-sample.php also did not exist, requiring the wp-config-sample.php file be re-uploaded, which is already presented in a message if the file is missing anyway, so the messaging wouldn't even have to change.
    44
    5 Regardless, in my opinion, it just seems that logically it should consider if wp-config.php exists first, and only check if wp-config-sample.php exists if not. Although the improved performance from removing the two additional file_exists calls in the current version would negligable, it should still be seen as best practice in most use-cases.
     5Regardless, in my opinion, it just seems that logically it should consider if wp-config.php exists first, and only check if wp-config-sample.php exists if not. Although the improved performance from removing the two additional file_exists calls in the current version would be negligable, it should still be seen as best practice in most use-cases.
    66
    77As for the security situation I mentioned, I was referring specifically just to restricting open_basedir to not include the directory above the web directory (which shouldn't need to be explained), and that such a restriction, in combination with the deletion of wp-config-sample.php file, would result in the PHP warning message in the log. That is all. Deleting the wp-config-sample.php file in and of itself is not necessarily a "security measure" - although deleting the file on a completed installation does reduce the unnecessary overhead from requests to this file, which subsequently loads the wp-settings.php file, which loads numerous other functions for no reason, to inevitably return a "Database Error - Error establishing a database connection" page, whereas on a completed installation the wp-config.php returns nothing (except a 200 response) if it is even publicly accessible (I personally block public access to wp-config.php using .htaccess). However, most do not take any similar steps to restrict public access to the wp-config-sample.php file if it still exists, as they assume like you did that it's a non-issue. Which isn't wrong exactly, but I believe it could definitely be improved upon, but that's for another discussion I guess. Hopefully this at least helps to explain why someone, like me, would delete the wp-config-sample.php file, and be plagued by the persistent error log messages/warnings due to bad actors trying to probe the setup-config.php file on my sites with the current file check order used.