Storita Connector
| 开发者 | storita |
|---|---|
| 更新时间 | 2026年11月6日 23:30 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Storita Connector exposes safe, read‑only access to your WordPress database over the REST API.
Key features:
- Read‑only queries (SELECT only) with robust validation
- API key authentication (or admin users via WP login)
- Nginx/FastCGI friendly header handling (X-Storita-Key, legacy X-DF-Key, or Authorization)
- Built-in rate limiting (1200 requests per hour per API key by default) and a maximum of 1000 rows per query by default
- Optional table whitelisting (restrict access to specific tables/patterns)
- Excluded tables list (empty by default); passwords, login keys and other secrets are always protected
- Secret redaction: password hashes, WordPress auth keys and salts and the API key are removed from every query result
- Schema explorer and health status endpoints; reading error logs is opt-in and off by default
- Admin settings page with copy‑to‑clipboard helpers
- Google Analytics 4 Integration: Proxy requests to GA4 using the existing Google Site Kit connection (supports standard and real-time reports). This plugin is designed for integrations and reporting tools that need controlled, secure, read-only database access.
安装:
- Upload the plugin folder to
/wp-content/plugins/or install via the Plugins screen. - Activate the plugin through the 'Plugins' screen in WordPress.
- Go to
Settings → Storita. - Configure an API key and (optionally) security controls like rate limits and table whitelist.
更新日志:
2.3.2
- New: consent-first one-click connect to Storita from wp-admin; store settings are read automatically and only name and email are asked.
- New: a connected site shows an Open Storita page without signup wording or re-consent.
- Changed: the connect step retries once on transient connection errors.
- Fixed: site-profile queries with WooCommerce HPOS; the manual API key fallback is kept.
- Security: WooCommerce Analytics reports are served without switching to or acting as any WordPress user; the API key grants read-only report access only.
- Changed: the read-only database and old-copy notices appear only on the Plugins screen and the Storita settings screen.
- Added: optional read-only database connection for /query and /schema (constants STORITA_WP_RO_DB_USER and STORITA_WP_RO_DB_PASSWORD) with a 20-second session statement cap; falls back to the main connection with an admin notice.
- Added: named API keys managed with WP-CLI (wp storita key add|list|revoke); the existing key keeps working as "default".
- Changed: rate limiting is counted per API key name; HTTP 429 responses carry a Retry-After header.
- Changed: /query responses include truncated: true when the row cap cut the result.
- Security: query results are scanned and password hashes, WordPress auth keys and salts and the API key are removed; UNION and derived-table queries on the users, user meta and options tables are refused.
- Changed: rate limiting (1200 requests per hour per API key) and a 1000-row cap are on by default; sites still at the old 0 default move to the new defaults on upgrade. Each query has a 15-second MySQL time cap.
- Changed: reading error logs is opt-in (Settings → Storita → "Allow Storita to read error logs") and off by default.
- Changed: the REST namespace is now storita/v1 and the X-Storita-Key header is accepted; df-db/v1 and X-DF-Key keep working.
- Changed: the Google Analytics proxy always uses the property configured in Site Kit and forwards only GA4 report fields.
- Changed: plugin slug and text domain are now storita-connector (main file storita-connector.php). Requires WordPress 6.2 or later.
- Fixed: escaping in the admin connection-test results; notices no longer hide other plugins' notices or appear site-wide; Clear Cache no longer flushes the whole object cache; all database queries use prepared statements.
- Removed: the unused limit and offset parameters of POST /query.
- Changed: nothing is excluded by default; the excluded-tables list is now empty unless you choose tables.
- Added: WooCommerce API key, webhook and Wordfence 2FA secret tables are always blocked.
- Upgrade: an untouched 2.2.2 default list is cleared automatically; customised lists are kept.
- Prepared for the WordPress.org plugin directory: updates are now delivered by WordPress.org.
- Removed the built-in update checker and the Check for Updates button.
- Plugin name is now Storita Connector.
- Fix: Site Kit GA proxy (/google-analytics/report, /google-analytics/realtime) returned HTTP 500 "Site Kit integration class not found" due to a namespace mismatch; corrected caller references so the Google Analytics fallback path works.
- New endpoint: /df-db/v1/health/runtime — PHP/WP/WC runtime profile + Site Health results
- New endpoint: /df-db/v1/health/logs — list available log sources
- New endpoint: /df-db/v1/health/logs/tail — bounded log tail (allowlist + hard caps)
- Fix: expose plugin version under meta.plugin_version on the auth-gated /site-profile endpoint so Storita's backend can read it without the public /status disclosure (F-L-01).
- Fix: DEFAULT_EXCLUDED_TABLES now resolves against actual $wpdb->prefix at runtime; default exclusions work correctly on custom-prefix installs. MySQL system schemas (information_schema, mysql, performance_schema, sys) blocked by default.
- Polish: remove debug logging, console statements, and dead comments; harden non-critical SQL calls; deduplicate auth helpers; add LICENSE file; correct readme branding; remove version disclosure from public status.
- Security: redact SQL details from /query error responses; deny-by-default for analytics sub-endpoints; require manage_options for browser-based analytics access.
- Security: filter sensitive rows/columns from /query results (wp_users password hashes, wp_options auth keys, wp_usermeta session tokens); reject queries that reference protected fields; block information_schema reconnaissance; move update secret to per-site option with wp-config override.
- Added: Support for Google Analytics 4 Real-time reports via
POST /google-analytics/realtime - Added: Documentation for Real-time reporting
- Improved: Site Kit integration with Reflection-based service access for extended API support
- Added: Google Site Kit status (active, connected, property ID) to store profile endpoint
- Improved: Site Kit integration with status helper method
- Added: Google Analytics 4 integration via Google Site Kit piggybacking
- Added: POST /google-analytics/report endpoint for querying GA4 data
- Improved: Authentication handling for Site Kit credentials
- Added: Stock management settings to store profile endpoint
- Improved: Store profile data accuracy
- Added: Full schema retrieval endpoint
- Added: Documentation for schema endpoints
- Added: API connection testing functionality with modal results in admin
- Added: Cache warning functionality to site profile tests
- Improved: Payment gateway retrieval and filtering logic
- Improved: API requests with follow redirects support
- Added: Enhanced site profile with comprehensive store and WooCommerce metadata
- Added: Order status discovery and classification in site profile
- Added: New helper methods for data retrieval
- Improved: Response format for improved compliance with SQL reference specifications
- Added: GET /site-profile endpoint for comprehensive WooCommerce site analysis with 6-hour caching
- Site profile provides: store config, product catalog stats, pricing analysis, order metrics, customer analytics, checkout settings, marketing integrations, and data health indicators
- Added: Table filtering/search functionality in admin settings for excluded tables
- Improved: Admin UI with enhanced notification styles and better visual hierarchy
- Improved: WooCommerce consumer secret field now preserves existing value when left blank
- Improved: Password field placeholder styling for better UX
- Fixed: Rate limit defaults adjusted for better performance
- Removed: 'wp_options' from default excluded tables list to allow more flexibility
- Added: Initial site-profile endpoint implementation
- Enhanced: Admin UI with new styles and API key management functionality
- Improved: Settings page layout with clearer organization
- Added: Visual style guide documentation
- Security: Removed hardcoded WooCommerce API credentials
- Added: WooCommerce REST API credentials configuration in admin settings
- Added: Comprehensive documentation (10 guides, 4,800+ lines)
- Added: 11 WooCommerce Analytics endpoints with full documentation
- Added: API key validation and authentication for analytics endpoints
- Improved: Error handling for missing WooCommerce credentials
- Admin: New "WooCommerce Analytics Configuration" section with setup instructions
- Docs: Installation, Quick Start, API Reference, Authentication, Security, Troubleshooting, Examples
- Enhanced: WooCommerce Analytics documentation with all endpoints enabled by default
- Added: Storita_WP_Analytics_Route class for WooCommerce Analytics REST API integration
- Added: Initial support for proxying WooCommerce Analytics endpoints
- Feature: First implementation of analytics route registration
- Added: Excluded tables feature with sensible defaults
- Added: Admin settings for managing excluded tables
- Security: Default exclusions for sensitive tables (users, usermeta, options, Action Scheduler, logs, caches)
- Admin: Checkbox-based interface for selecting excluded tables
- Admin: Added "Excluded tables" with checkbox list populated from DB tables and sensible defaults
- Admin: Clearer wording for "Allowed tables"; it is now explicitly optional and works alongside exclusions
- Admin: Improved padding in the Connection Details card
- Added: Optional table whitelisting (admin setting)
- Added: execution_time_ms metadata in query responses
- Added: GET /status health endpoint (public, no authentication required)
- Added: Table whitelisting feature with pattern support (e.g., wp_posts, wp_%)
- Improved: Header compatibility for API key authentication (X-DF-Key, Authorization, Bearer, DF-Key)
- Improved: Error logging for better debugging
- Admin: Copy-to-clipboard functionality for API key and base URL
- Admin: API key generator with secure random generation
- Internal: Refactored to modular structure under includes/ directory
- Internal: Created separate class files (Storita_WP_Config, Storita_WP_REST_API, Storita_WP_Admin)