Download the PHP package eriktorsner/wp-checksum without Composer
On this page you can find all versions of the php package eriktorsner/wp-checksum. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download eriktorsner/wp-checksum
More information about eriktorsner/wp-checksum
Files in eriktorsner/wp-checksum
Package wp-checksum
Short Description Check plugin and theme consistency
License MIT
Homepage https://github.com/eriktorsner/wp-checksum/
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wp-checksum
wp-checksum
Wp-cli sub command for verifying checksum data for themes and plugins. It checks the md5 sum of all files inside each plugin and theme and compares against what the same plugin/theme looks like on the WordPress repo. The core wp-cli command has this functionality for core, this sub command brings the same for plugins and themes.
wp-checksum checks for added, removed or modified files and prints out info about files that does not match the original file as it exists in the .org repositories.
Backend api
wp-checksum uses a backend API (https://api.wpessentials.io) to retreive the checksums for known plugins and themes from our database. It's also possible to run wp-checksum in local mode, In this case wp-checksum, downloads zip-files directly from the Wordpress.org repository and avoid using the API. There are several advantages of using the API over local mode:
- Performance
- Reliability
- WordPress.org does't keep zip-files available for all versions of all plugins, roughly 15% av all plugins are affected. The remote API can deliver checksum data for these plugins but that's not possible when running wp-checksum locally.
- The diff sub command currently only works with the remote API
Read more about how the api and hourly rate limits work in the section "Backend api and rate limits" below.
Known issues
- Does not ignore minor changes in a plugin/themes readme.txt file. This may lead to false positives
- A locally developed plugin or theme may trigger false positives if a plugin or theme in the official repository has the same name.
- Does not know how to verify premium plugins.
- Some plugins and themes does not have all historic versions available and therefore can't be checked (but who uses old plugin versions anyway?)
- Some plugins add files into it's own installation folder. This will trigger false positives
Installation
Globally, as a wp-cli package
Via composer
wp-checksum can also be installed manually or via compser.
To activate wp-checksum when installed locally via composer, you need to edit (or create) your wp-cli.yml file to make sure it includes the vendor/autoload.php file.
Running wp-checksum
Global options
- --format Optional. How to format the output. Table (default), json, csv or yaml
- --apikey Optional. Specify key to override the default key
- --local Optional. Run in local mode. Download zip files from wordpress.org for local extraction and comparision.
- --localcache Optional. Specify where wp-checksum keeps copies of downloaded zip files. Defaults to /tmp
wp checksum all|theme|plugin
The base functionality of wp-checksum. Verifies local checksum data for everything (all), all plugins (plugin) or all themes (theme). For the plugin and theme sub commands, you can optionally specify a slug to just verify a specific plugin or theme.
OPTIONS
- slug Optional. Name of a specific plugin or theme to check. Leave blank to check all installed
- --format Optional. How to format the output. Table (default), json, csv or yaml
- --details Optional. Set this flag to output details about all modified/added/deleted files
- --apikey Optional. Specify key to override the default key
wp checksum diff <type> [<slug>] <path>
Diff a file in your local WordPress install with it's original
OPTIONS
- type core, theme or plugin
- slug The slug to identify the plugin or theme. Skip this arg for core files
- path Path of the file to check, relative to the root of core or the theme or plugin
The diff command determines the local version of the object to compare and then retreives the corresponding original file. If both files are found, the two files are compared using the command diff. Output is colored so that new or changed lines in the local version are red.
wp checksum quota
Displays the current api rate limit usage.
OPTIONS
- --apikey Optional. Specify key to override the default key
wp checksum apikey <action> [<apikey>]
Get or set the api key stored in the current WordPress installation.
OPTIONS
- action Mandatory. Get (print) or set (store) default key
- apikey Mandatory for action=set. Specify key to store as default key in WP options table
wp checksum register <email>
Connect your email address to the default (or specified via --apikey) key to raise your hourly api rate limit.
OPTIONS
- email Mandatory. Get (print) or set (store) default key
Examples
Output
By default, wp-checksum will output a table with information with the number of changes detected printed out;
In this example, there are two premium plugins and two plugins from the repository. The premium plugins can't be checked. One of the checked plugins has issues, the other one is fine:
To get more details, the --details switch can be used:
Naturally, getting detailed output makes a whole lot more sense when using yaml, or json:
Parameters in wp-cli.yml
Default values for parameters apikey, details, local, localcache and format can be entered into the wp-cli.yml file. Add a section named checksum:
Specifying the api key
The api key can be specified in multiple ways. wp-checksum will try to locate an api key in the following order:
- Passed in via the --apikey command line parameter
- Specified in the wp-cli.yml file
- Specified in the environment variable WP_CHKSM_APIKEY
- Found in the options table in the current WordPress installation
If no api key is found in any of the above locations, wp-checksum will attempt to create an anonymous api key and store it in the WordPres options table. Creating an anonymous api key might fail if too many new keys are generated at the same time from the same source IP address.
Backend api and hourly rate limits
The backed api and database are work in progress and requires a fair amount of work. In order to minimize various kinds of abuse, the api has an hourly rate limit. The first time you use wp-checksum, an anonymous api key is generated and stored in the WordPress options table. The anonymous key grants up 30 requests api per hour (subject to change). If you register and validate your email address, your hourly limit is raised to 100 requests per hour (subject to change). If you need to go beyond 100 requests per hour, you are welcome to subscribe to the service and paying a (small) montly fee. If you do that, also know that you are supporting a project that I think can do a lot of good for the WordPress community. Thanks in advance.
Please go to https://www.wpessentials.io/product-category/api-access/ to subscribe to a paid api key.
I've previously announced a plan to release the code for the backend api as open source. While I havent completely abandoned that plan it's not going to be a high priority in the short term (2017). The main reasons is that the backend API has grown a lot more complex that it initially was and it's simply not feasable to maintain that service and support other users as well.
Change log
Version 0.3.0
New sub command diff. Unit tests added, 97% coverage.
Version 0.2.0
Changed default behaviour. The naked command "wp checksum" previously was a short for for sub command "wp checksum all". Now the naked command just displays usage information.
