4 ms·

wget /wp-content/database Laughing deeply in my whole heart. Also, can't wait to use it (drastically simplify hosting for certain usecases) - hope it will lan

wget /wp-content/database Laughing deeply in my whole heart. Also, can't wait to use it (drastically simplify hosting for certain usecases) - hope it will land soon! Long live Wordpres

giancarlostoro 3y ago
Really should be in a parent directory that will never be visible by anyone's browser.
- ilyt 3y ago
  Which is not how wordpress install is set up to work, because of both webhost and wordpress developers incompetence
stefanos82 3y ago
Before they added SQLite as WP plugin, I would use https://github.com/aaemnnosttv/wp-sqlite-db/ https://github.com/aaemnnosttv/wp-sqlite-db/ and I would use `define('DB_DIR', '/absolute/custom/path/to/directory/for/sqlite/database/file/');` to define the database location of my choice; I believe they would let users do the same with core support.
tredre3 3y ago
The usual mitigation for safely using sqlite in PHP projects is as follows: - Have a .htaccess to block it. Only works with Apache of course but that covers most shared hosting. - Have rewrite rules that takes precedence. Only works if the user enables url rewriting (automatic only on Apache) - Part of the sqlite database file name will be randomized. eg sqlite_xJ4D6e1E3.db. That usually works well but I suppose in theory it can be bruteforced... - The documentation will recommend it should be placed outside the webroot but the installer won't do it automatically because it can't safely assume the user has access to the parent folder. Realistically not that many people will end up doing that. I, for one, am still excited to no longer have to deal with questionable plugin to use wordpress on a mysql-free server.
amiga-workbench 3y ago
I really wish Wordpress would ditch the shared-hosting first deployment model and grow up a bit. Thankfully https://roots.io/bedrock/ https://roots.io/bedrock/ exists to bridge the gap if you're absolutely forced to use WP.
indymike 3y ago
Hopefully the database file has to be located outside of DocumentRoot so you cannot do that.

wget /wp-content/database Laughing deeply in my whole heart. Also, can't wait to use it (drastically simplify hosting for certain usecases) - hope it will land soon! Long live Wordpres

giancarlostoro 3y ago

Really should be in a parent directory that will never be visible by anyone's browser.

ilyt 3y ago
Which is not how wordpress install is set up to work, because of both webhost and wordpress developers incompetence

stefanos82 3y ago

Before they added SQLite as WP plugin, I would use https://github.com/aaemnnosttv/wp-sqlite-db/ https://github.com/aaemnnosttv/wp-sqlite-db/ and I would use `define('DB_DIR', '/absolute/custom/path/to/directory/for/sqlite/database/file/');` to define the database location of my choice; I believe they would let users do the same with core support.

tredre3 3y ago

The usual mitigation for safely using sqlite in PHP projects is as follows: - Have a .htaccess to block it. Only works with Apache of course but that covers most shared hosting. - Have rewrite rules that takes precedence. Only works if the user enables url rewriting (automatic only on Apache) - Part of the sqlite database file name will be randomized. eg sqlite_xJ4D6e1E3.db. That usually works well but I suppose in theory it can be bruteforced... - The documentation will recommend it should be placed outside the webroot but the installer won't do it automatically because it can't safely assume the user has access to the parent folder. Realistically not that many people will end up doing that. I, for one, am still excited to no longer have to deal with questionable plugin to use wordpress on a mysql-free server.

amiga-workbench 3y ago

I really wish Wordpress would ditch the shared-hosting first deployment model and grow up a bit. Thankfully https://roots.io/bedrock/ https://roots.io/bedrock/ exists to bridge the gap if you're absolutely forced to use WP.

indymike 3y ago

Hopefully the database file has to be located outside of DocumentRoot so you cannot do that.