WP Manifestindependent plugin directory
manifest / developer / test-script-manager

Test Script Manager WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

WordPress 後台測試腳本管理工具

★ 0stars
12release downloads
≈10active sites
v0.1.1latest · 9mo ago

Install

Download test-script-manager-0.1.1.zip From the v0.1.1 release on GitHub, Jan 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/fishtvlvoe/test-script-manager/releases/download/v0.1.1/test-script-manager-0.1.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress 後台測試腳本管理工具,讓開發者可以直接在後台編寫、管理、執行測試腳本。

功能特色

🎨 Monaco Editor 程式碼編輯器

  • VS Code 同款編輯器
  • PHP、SQL、JavaScript、CSS 語法高亮
  • WordPress 函式自動完成
  • 深色/淺色主題切換

⚡ 即時執行

  • 一鍵執行腳本
  • 即時查看輸出結果
  • 格式化的表格和 JSON 顯示
  • 執行時間和記憶體使用統計

🔄 背景執行

  • 長時間運行的腳本可在背景執行
  • 關閉瀏覽器後繼續執行
  • 執行完成後通知(後台通知、Email)
  • 自動重試機制

📝 版本控制

  • 自動儲存每次修改
  • 查看版本歷史
  • Monaco Diff Editor 比較差異
  • 一鍵還原到任意版本

📊 匯出功能

  • 匯出為 CSV 檔案
  • 匯出為 JSON 檔案
  • 匯出為 Excel 檔案(.xlsx)

📁 組織管理

  • 分類管理腳本
  • 內建常用範本
  • 批次操作(刪除、分類)
  • 搜尋功能

🔒 安全性

  • 僅管理員可存取
  • IP 白名單限制
  • 危險函式偵測
  • 執行逾時保護

安裝

方法一:GitHub Release(推薦)

  1. 前往 Releases 頁面
  2. 下載最新版本的 test-script-manager-x.x.x.zip
  3. 在 WordPress 後台,前往「外掛 → 安裝外掛 → 上傳外掛」
  4. 上傳 ZIP 檔案並啟用

方法二:手動安裝

cd /path/to/wordpress/wp-content/plugins/
git clone https://github.com/fishtv/test-script-manager.git

然後在 WordPress 後台啟用外掛。

自動更新

外掛會自動檢查 GitHub Releases,當有新版本時會在 WordPress 後台顯示更新通知。

使用方式

  1. 啟用外掛後,前往「工具 → Test Script Manager」
  2. 點擊「新增腳本」建立新的測試腳本
  3. 在 Monaco Editor 中編寫 PHP 程式碼
  4. 點擊「執行」按鈕查看結果

快捷鍵

  • Ctrl/Cmd + S - 儲存腳本
  • Ctrl/Cmd + Enter - 執行腳本

範例腳本

資料庫查詢

<?php
global $wpdb;
$users = $wpdb->get_results("SELECT ID, user_login, user_email FROM {$wpdb->users} LIMIT 10");
print_r($users);

查看所有選項

<?php
global $wpdb;
$options = $wpdb->get_results("SELECT option_name, option_value FROM {$wpdb->options} WHERE autoload = 'yes' LIMIT 50");
format_as_table($options);

測試 API

<?php
$response = wp_remote_get('https://api.example.com/endpoint');
$body = wp_remote_retrieve_body($response);
echo json_encode(json_decode($body), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE);

系統需求

  • WordPress 6.4 或更高版本
  • PHP 8.0 或更高版本
  • MySQL 5.7 或更高版本

開發

目錄結構

test-script-manager/
├── test-script-manager.php  # 主外掛檔案
├── includes/
│   ├── class-plugin.php     # 外掛載入器
│   ├── class-database.php   # 資料庫結構
│   ├── class-security.php   # 安全性檢查
│   ├── services/            # 服務層
│   ├── api/                 # REST API
│   └── admin/               # 後台頁面
├── assets/
│   ├── css/                 # 樣式檔案
│   └── js/                  # JavaScript
└── scripts/
    └── release.sh           # 發布腳本

發布新版本

./scripts/release.sh 1.0.1

授權

GPL v2 or later

作者

Fish TV

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.1.1 latest
Jan 31, 2026 9mo ago
test-script-manager-0.1.1.zip
3
Jan 31, 2026 9mo ago
test-script-manager-0.1.0.zip
1
Jan 31, 2026 9mo ago
test-script-manager-1.0.0.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Test Script Manager 0.1.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
0.1.1
Findings
2
Worst severity
medium
Content hash
ccb9eb20c34e5512157a5c3c…

Findings

  • medium Production plugin executes arbitrary admin-supplied PHP via include

    eval_by_design

    REST POST /scripts/{id}/execute (manage_options gated) runs ExecutionService::execute which include()s PHP written under uploads/plugin storage. This is intentional RCE-as-a-feature for admins and expands blast radius of any admin XSS/CSRF/session theft. Flagged as eval-by-design / dev tool rather than a missing-auth bug.

    includes/services/class-execution-service.php:155-155

  • low Script execution console increases production attack surface

    dev_tool_in_production

    Plugin advertises background execution, IP allowlists, and script CRUD for live sites. Leaving an arbitrary-code runner active in production is unnecessary attack surface even when locked to administrators.

    includes/api/class-scripts-api.php:167-210

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.