Sumotori Dash Agent
| 开发者 | tommybordas |
|---|---|
| 更新时间 | 2026年9月9日 04:31 |
| PHP版本: | 7.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Pairing by code: you paste a short code displayed by your dashboard into the settings screen; the agent then obtains the endpoint and the shared secret by itself. No secret has to be copied by hand. The same pairing can be triggered from WP-CLI, or by an administrator through this site's own REST API — useful when the plugin was installed remotely and nobody is going to open wp-admin to copy a code.
- Administration event reporting: creation or promotion of an administrator account, administrator login, plugin activation or deactivation, completed update, theme switch, account deletion. Every message is signed (HMAC-SHA256) and sent non-blocking: a slow or unreachable dashboard never slows the site down.
- Read-only inventory: the agent exposes two REST routes that answer requests signed by your dashboard. They only write a response: no option is modified, no task is scheduled, no command is executed.
- Multisite: a single link for the whole network, managed from the network administration. The inventory can target any sub-site.
安装:
- Install and activate the plugin.
- Open "Settings → Dash Agent" (on multisite: "Settings" in the network administration).
- Enter the https URL of your dashboard and the pairing code it shows you, then submit.
- The site is paired: administration events are reported and the dashboard can query the inventory.
常见问题:
Does the plugin send anything before pairing?
No. As long as the site is not paired, no event hook is even registered and the
inventory REST routes answer 403. The only thing that starts an exchange is an
administrator deliberately pairing the site, from the settings screen, from
WP-CLI, or through the /pair REST route.
Where is the dashboard address set?
You enter it when pairing. No address is hardcoded in the plugin. If you manage
a fleet of sites, you can also enforce it in wp-config.php:
define( 'SUMOTORI_DASH_AGENT_URL', 'https://your-dashboard.example' );
The settings screen field then displays that value instead of being editable.
What is left in the database after uninstalling?
Nothing. Deleting the plugin erases the configuration option: the site option, the network option, and any options left on sub-sites.
Can a dashboard pair the site without opening wp-admin?
Yes, since version 1.4.0. An administrator of the site — in practice a dashboard
authenticating with an administrator application password the site owner issued
to it — can call this site's own REST API:
POST /wp-json/sumotori-dash/v1/pair
{"url": "https://your-dashboard.example", "code": "XXXX-XXXX"}
The agent then performs exactly the same exchange as the settings form: it calls
<url>/api/pair and stores the endpoint and secret it gets back. The second
accepted body registers the link directly, as wp dash-agent connect does:
POST /wp-json/sumotori-dash/v1/pair
{"endpoint": "https://your-dashboard.example/api/ingest", "secret": "…"}
Send one form or the other, never both. The endpoint must be an https URL and
the secret 16 to 512 printable characters with no space.
Both forms require the manage_options capability (manage_network_options on
a multisite network) — exactly the capability the settings screen already
requires. The route therefore grants its caller nothing they could not already do
by hand in wp-admin; anyone else gets a 403.
A site that is already paired answers 409 and keeps its current link, unless the
body also carries "force": true.
The answer to a successful call is:
{"paired": true, "endpoint": "…", "paired_at": "…", "site_url": "…",
"agent_version": "…", "message": "…"}
The shared secret is never returned, never logged, and never quoted in an
error message. An invalid body gives a 400, a dashboard that cannot be reached or
whose answer cannot be read gives a 502.
Finally, DELETE /wp-json/sumotori-dash/v1/pair, with the same capability,
clears the link: it is the REST equivalent of the "Disconnect this site" button,
so a dashboard can withdraw cleanly from a site it no longer manages.
Can the inventory modify my site?
No. Both inventory routes (/inventory and /sites) are read-only: they write
no option, schedule no task, execute no command, and include no file whose path
would come from the request.
The only route that writes anything is /pair, and all it ever writes is the
link itself — the dashboard endpoint and the shared secret, the same single
option the settings screen saves. It is reserved to administrators of the site,
and it touches nothing else.
Does the plugin work on multisite?
Yes. The link is unique for the whole network and is configured from the network
administration (manage_network_options capability). The inventory can target
any sub-site through the blog_id parameter.
更新日志:
- New signed endpoint
GET /wp-json/sumotori-dash/v1/scan: structural checks that only WordPress can perform. A dashboard scanning files over SSH sees the disk, including what sits outside the document root, and cannot be lied to by code running inside the site; it does not see the database, the scheduler, or the plugin list as WordPress actually renders it. This endpoint covers that second half, and nothing else — it deliberately does not scan files. - Six checks, all read-only: a scheduled
wp-cronhook with no registered callback (a backdoor can live in the scheduler with no file at all); an option over 20 KB whose value contains PHP source, a call toeval()or a long encoded block (a payload that rewrites a theme file on every visit leaves no suspicious file to find); a plugin directory carrying a valid plugin header thatget_plugins()does not return, which means it removes itself through theall_pluginsfilter; a plugin marked active whose file is missing; the effectiveauto_prepend_fileandauto_append_fileas PHP applies them; and the list of must-use plugins, which run without ever being activated. - Nothing is written, changed or deleted: the endpoint only describes. Deciding what is legitimate is left to the dashboard, which keeps a per-site reference of what was already there — without one, a perfectly healthy site would report the same findings on every pass.
- Transients are excluded from the option check: they regenerate, and including them would fill the answer with entries that no longer exist the next day.
- The inventory answer now carries the list of installed themes, not only a count of the ones awaiting an update: for each theme its directory slug, display name, state (active, parent theme of the active child theme, or inactive), installed version, whether an update is pending and the target version, and the parent theme of a child theme. A dashboard can therefore show the themes of a site and cross-check them against a public vulnerability database, as it already does for plugins. At most 100 themes are listed.
- On multisite, the state of each theme is reported for the sub-site being inventoried, exactly as the plugin inventory already does.
- The existing
themes_updatescount is unchanged, so dashboards written against an earlier version keep working. - Nothing else moves: the inventory stays strictly read-only, no personal data is added — a theme name and a version number are not personal data — and no outbound request is made.
- The site can now be paired without anyone opening wp-admin, through a new REST
route
POST /wp-json/sumotori-dash/v1/pair. The body carries eitherurl+code, which runs exactly the same exchange as the settings form, orendpoint+secret, the equivalent ofwp dash-agent connect. This closes the last gap for a dashboard that installed the agent remotely and has no shell access to the site: until now a human had to copy a code by hand. - The route requires
manage_options(manage_network_optionson multisite) — the very capability the settings screen already requires — so it grants its caller nothing they could not already do from wp-admin. Every other request gets a 403. - An already paired site answers 409 and keeps its link unless the body carries
"force": true. An invalid body gives a 400, an unreachable or unreadable dashboard a 502. - The shared secret is never included in the answer, in an error message, or in any log.
- New
DELETE /wp-json/sumotori-dash/v1/pair, same capability, clearing the link: the REST equivalent of the "Disconnect this site" button. - The shared secret is now validated on every path — settings screen, WP-CLI and REST alike: 16 to 512 printable characters, no space and no control character.
- Removed the "Protect the agent against deactivation" option, which copied the
agent file into
wp-content/mu-plugins/. Plugins are not meant to write executable code outside their own directory, so the feature has been dropped entirely rather than kept behind a checkbox. The agent is now an ordinary plugin that is activated, deactivated and uninstalled like any other. uninstall.phpno longer touches themu-pluginsdirectory.- Internal version constant realigned with the plugin header.
- Plugin URI corrected to a page that actually resolves.
- Translation files removed from the package: translations are now handled by translate.wordpress.org, which generates and delivers them automatically.
load_plugin_textdomain()removed — WordPress has loaded translations by itself for plugins hosted on WordPress.org since version 4.6.
- The
mu-pluginscopy becomes an explicit option, disabled by default, with a "Remove from mu-plugins" button. It is no longer performed automatically on activation: the plugin stays normally deactivatable and uninstallable. - The dashboard URL is now entered by the administrator when pairing: no service address is embedded in the plugin any more.
- Added
uninstall.php: uninstalling erases all options and the mu-plugins copy. - All visible strings go through the translation functions (text domain
sumotori-dash-agent) and a.pottemplate is provided. - Compliance review: output escaping, input sanitising, nonce and capability check on every action, unique prefix, removal of error-log writes.
- Pairing by code from the settings screen and from WP-CLI.
- Multisite support: single network link, network block in the inventory,
/sitesroute,blog_idparameter.
- First release: administration event reporting and read-only REST inventory.