VizProof Timeline
| 开发者 | tommybordas |
|---|---|
| 更新时间 | 2026年7月16日 02:27 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
VizProof Timeline connects WordPress to VizProof, a visual regression testing service, so every WordPress update can be followed by an automated visual check of your key pages.
Why
Plugin, theme, and core updates rarely throw PHP errors when they break something visual: a shifted button, a collapsed layout, a missing hero image. Your monitoring stays green while your pages degrade. VizProof Timeline catches those regressions right from wp-admin, before your visitors do.
How it works
- Connect the plugin to your VizProof account (free plan available) with an API token.
- Link a VizProof project and select the pages to monitor.
- Run updates as usual: the plugin queues a visual scan right after each plugin, theme, or core update and shows live progress on the Updates screen.
- Review the verdict (OK, changes to review, or regressions) and pixel-level diffs without leaving WordPress.
- Post-update scans after plugin, theme, or core updates, with live step-by-step progress and elapsed time
- Optional baseline scan before running updates
- Scan status directly on the WordPress Updates screen
- Run history and visual diff summaries in wp-admin
- Scheduled checks with WP-Cron (Action Scheduler fallback)
- Plugin rollback with local backups when an update causes regressions
- Multisite support in per-site and network-wide modes
- WP-CLI compatible: scans also hook into CLI-triggered updates
安装:
- Upload the
vizproof-timelinefolder to/wp-content/plugins/. - Activate VizProof Timeline.
- Click VizProof in the top admin bar, then Configuration.
- Enter your VizProof API URL (default:
https://vizproof.com) and API token. - Select the VizProof project to link with this WordPress site.
- Save your settings.
- Create a free account at vizproof.com.
- Create a project and add at least one page (use your WordPress site URL).
- Go to Account → API Tokens and generate a token (starts with
vrt_). - Paste the token in the plugin Configuration page.
- Open
Network Admin -> Settings -> VizProof Timeline. - Choose
Per-siteorNetwork-widemode.
常见问题:
Does this plugin require a VizProof account?
Yes. Sign up at vizproof.com, create a project, then generate an API token from Account → API Tokens. See the Installation section for step-by-step instructions.
What happens after a plugin/theme/core update?
If post-update scan is enabled, VizProof Timeline queues a scan after the update completes and exposes status/results in wp-admin.
Does WP-CLI trigger the same scan logic?
Yes. WP-CLI update commands run through the same updater hooks used by this plugin.
Is multisite supported?
Yes.
Per-site: each subsite keeps its own configuration.Network-wide: one shared network-level configuration.
更新日志:
1.0.3
UX and reliability improvements based on real-world testing:
- Update panel now shows live scan progress: pipeline steps stay expanded while a scan is active, with an elapsed-time counter refreshed every second.
- Clearer status copy during post-update scans (queued vs running phases are now distinct and accurate).
- Stuck-scan detection: the UI warns when a queued scan has not started after 4 minutes or a running scan exceeds 20 minutes, with actionable hints (WP-Cron / Action Scheduler, API logs).
- Server-side stale-scan sweep: scans stuck in "queued" for 30+ minutes (or "running" for 2+ hours) are automatically finalized as failed instead of polling forever.
- Fixed error messages showing raw JSON instead of the human-readable message returned by the plugin.
- Dedicated messages for invalid/expired tokens (401/403) and plan quota reached (429); upstream 429 is no longer retried 4 times.
- Token validity is now verified against the VizProof API (cached 5 min) and surfaced on the dashboard Token card with an inline error, instead of showing "OK" for any non-empty string.
- Results page: the "Launch scan" button is disabled until the plugin is configured, and the notice now links to the Configuration page.
- Welcome notice after activation linking to the Configuration page (dismissed automatically once configured, expires after 14 days).
- Fixed a JavaScript syntax error (unescaped apostrophe) that silently disabled the onboarding health-check module.
- Updated "Tested up to" to WordPress 7.0.
- Removed the duplicate README.md from the distributed package.
- Fixed readme: corrected menu location from "Settings > VizProof Timeline" to the actual top-level "VizProof" admin bar menu.
- Added step-by-step instructions for obtaining a VizProof API token in the Installation section.
- Fixed admin notices from other plugins appearing inside VizProof pages (added screen-reader-text h1 anchor for WordPress notice injection).
- Redesigned timeline baseline status bar into a unified single-row component.
- Removed unused baseline-assist and baseline-summary CSS classes.
- Removed direct loading of
wp-admin/includes/misc.php(no function from that file was used) and gated remainingrequire_once ABSPATH . 'wp-admin/includes/...'calls withfunction_exists()/class_exists()guards. Each guarded include is followed immediately by a call to a function/class from that file, per WP.org guidelines. - Replaced hardcoded
WP_PLUGIN_DIRandWP_CONTENT_DIRconstants in the rollback service with paths derived fromplugin_dir_path( __FILE__ )via newVIZPROOF_TIMELINE_PLUGIN_FILE/VIZPROOF_TIMELINE_PLUGIN_DIR/VIZPROOF_TIMELINE_PLUGIN_URLconstants. Local backup path validation now reuses the existingwp_upload_dir()-basedget_local_backup_root()helper for consistency. - Made REST permission callbacks (
can_access_timeline,can_launch_runs) perform an explicitcurrent_user_can( 'manage_options' )capability check (previously delegated only viacan_manage_plugin()), so static analysis can confirm protection on all 23 endpoints. - Hardened
enqueue_inline_admin_style()/enqueue_inline_admin_script(): CSS now goes throughwp_strip_all_tags()beforewp_add_inline_style(), and inline JS is rejected if it contains a</script>sequence that could break out of the inline<script>block. - Renamed admin bar regression transients from
vizproof_adminbar_regressions_*tovizproof_timeline_adminbar_regressions_*for prefix consistency with the rest of the plugin.
- Replaced admin inline
<style>/<script>blocks withwp_add_inline_style()/wp_add_inline_script()attached to enqueued handles. - Moved admin bar badge CSS injection to
admin_enqueue_scripts. - Update panel assets now load consistently on
update-core.php,themes.php, andplugins.php. - Added dedicated nonce handling for post-update request flags (
vizproof_after_update_scan,vizproof_before_update_baseline) and enforced nonce+capability checks before honoring explicit request overrides.
- Fixed post-update scan failing silently when pages already exist on VizProof: the existing page ID from 409 responses was not extracted (nested in proxy body, not at details root).
- Pre-update baseline promotion now polls until the VizProof run completes (up to ~60s) before promoting, instead of promoting an incomplete run which was always rejected by the API. Improvements:
- API logs now display in chronological order by default (oldest→newest) with a toggle button to switch to reverse order.
- Log rotation: entries older than 7 days are automatically pruned. Retention increased from 120 to 500 entries.
- Log rows with 4xx errors are highlighted in yellow, 5xx in red.
- VizProof update panel now displays on Themes and Plugins admin pages (was limited to update-core.php).
- Assets (CSS/JS) are now loaded on themes.php and plugins.php for update panel rendering.
- Fixed path traversal in restore_local_plugin_backup: added trailing slash to realpath containment check.
- Added bearer token redaction in proxy error log bodies.
- REST rest_save_option now runs options through sanitize_options before update_option. WordPress compliance:
- Added load_plugin_textdomain() on init for translation loading outside WP.org directory.
- Capped get_sites() calls to 500 (was unbounded number=0, caused timeout on large Multisite).
- Plugin header Description translated to English (WP.org requirement).
- Merged duplicate REST route registrations for runs/{id} (GET+DELETE in single call).
- Complete uninstall cleanup: removes vizproof_lock options, all vizproof_ transients and site transients. Accessibility (WCAG 2.1 AA):
- Page tree checkboxes now include page title in aria-label ("Suivre — Page title").
- Added label/for association on network settings cache delay input.
- Removed role="presentation" from per-site targets data table.
- Fixed color contrast: warn badge (#6b5100), pending pill (#7a5300).
- Added :focus-visible styles on all custom buttons and clickable elements.
- Replaced invalid inside with styled in automation fieldsets. i18n:
- Translated network config mode radio labels to French (was mixed EN/FR).
- Wired ~10 hardcoded strings in inline JS bridge to t() translation helper.
- Translated 8 untranslated msgstr entries in fr_FR.po (update summary labels, Status, etc.). Cleanup:
- Removed dead SETTINGS_MENU_SLUG constant and render_settings_page() method.
- Removed ~6 unused CSS selectors (activity-item, summary-list, health-check).
- Capped scan history to 100 entries (was unbounded).
- Added TODO comments on duplicated inline blocks for future consolidation.
- Fixed proxy_vizproof_request silently failing when receiving pre-normalization options with empty api_token (self-decrypt from api_token_encrypted).
- Fixed scan lock race condition on standard WP installs (no Redis): replaced non-atomic transient fallback with INSERT IGNORE for cross-process atomicity.
- Removed orphan SETTINGS_MENU_SLUG from is_vizproof_admin_request allowlists (page never registered in admin_menu).
- Removed dead code: register_admin_menu, register_network_admin_menu, register_settings from service-base (duplicated in main plugin file, never hooked).
- Fixed PHP parse error caused by Unicode smart quotes in French translation strings.
- Fixed dead links: "Réglages avancés" and "Choisir le projet" pointed to unregistered SETTINGS_MENU_SLUG page.
- Simplified redundant boolean comparisons (=== true / === false) in update panel JS.
- Further compacted update panel CSS: tighter padding, margins, and gaps across all panel sections.
- Fixed redundant boolean logic in token storage validation.
- Fixed race condition in scan lock using atomic wp_cache_add.
- Fixed REST route methods for favorite endpoints (PATCH only instead of PUT+PATCH).
- Fixed function_exists guard in uninstall.php referencing wrong function name.
- Simplified site picker: merged auto-detect into project loading, "Create from WordPress" is now a secondary link.
- Added AJAX save for project selection (no full page reload between onboarding steps).
- Grouped automation settings into sub-sections: Planification, Comportement post-update, Notifications.
- Moved API logs behind a collapsible "Outils développeur" toggle on the dashboard.
- Added empty state on the timeline when no runs exist.
- Translated raw API status strings (partial_failed, queued, etc.) to human-readable French in the update panel.
- Replaced setInterval polling with MutationObserver only in the timeline bridge script.
- Added aria-live attributes on all dynamically updated zones (state, runs, diffs, update panel).
- Fixed timeline filter labels: proper label-for associations instead of span wrappers.
- Restructured network settings form with fieldset groups (Connexion API, Comportement des scans, Notifications).
- Compacted update panel on update-core.php: single-row header, inline checkboxes, collapsible pipeline steps.
- Stale scan results from previous updates are no longer shown on the update listing page.
- Improved update-flow reliability for async and sync scan events.
- Improved multisite admin URL routing between site and network contexts.
- Improved pre-update baseline behavior by promoting successful pre-update runs.
- Improved update panel consistency for partial-failure handling.
- Improved layout width handling on update-core screens.
- Added asynchronous queue support with retry/backoff.
- Added update workflows and visual regression notifications in wp-admin.
- Added multisite support for per-site and network-wide modes.