Hi Oliver,

Some people, myself included, change the name of wp-content to something else as a security measure. However, the problem is that this is hardcoded in cforms.js. I can modify it directly in that file but I really don't like hacking the plugin files as there's a chance I could upgrade and forget about it and leave cforms broken.

I think you could resolve this issue by determining the plugin path in the php file (plugins_url, WP_PLUGIN_URL, etc.) and passing it in as a variable to cforms.js.

Cheers,

Aidan

Hi Oliver,

That's why I said 'determining the plugin path in the php file and passing it in as a variable'.

You could output a JS snippet containing the variable from a PHP file (or alternatively your latter option of placing it into the DOM would work). I don't think it matters that the path could be discovered, the malware bots are scanning websites for wp-content directory to find vulnerable plugins so the security measure or renaming wp-content is still effective. If you don't agree with that assessment, another approach could be to provide an option to set the name of the content folder in a js file inside the cforms-custom folder. At least that way would avoid having to hack the core files.

Cheers,

Aidan