WP Manifestindependent plugin directory
manifest / integrations / wp-engine-sites-menu

WP Engine Sites Menu WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin that interacts with the WP Engine API (using the test PHP SDK) to show list of users sites

★ 0stars
6release downloads
v0.0.2latest · 1 year ago

Install

Download wp-engine-sites-menu-0.0.2.zip From the v0.0.2 release on GitHub, Dec 17, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jpollock/wp-engine-sites-menu/releases/download/v0.0.2/wp-engine-sites-menu-0.0.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A WordPress plugin that adds a convenient dropdown menu to your admin bar for quick access to all your WP Engine sites and environments.

Description

This plugin integrates with the WP Engine API to provide easy navigation between your WP Engine sites directly from the WordPress admin bar. It's particularly useful for developers and agencies managing multiple WP Engine installations.

Key Features

  • Quick Access Menu: Adds a dropdown menu to the WordPress admin bar for fast navigation between sites
  • Current Site Display: Clearly shows your current site and its related environments (Production, Staging, Development)
  • Search Functionality: Instantly search through all your WP Engine sites and installations
  • Smart Caching: Caches API responses to minimize API calls and improve performance
  • Secure Storage: Encrypts API credentials using WordPress salts for secure storage
  • Environment Labels: Clearly distinguishes between production, staging, and development environments

Requirements

  • WordPress 5.0 or higher
  • PHP 7.4 or higher
  • WP Engine hosting account
  • WP Engine API credentials

Installation

  1. Download the plugin zip file from the latest release
  2. Go to WordPress admin > Plugins > Add New
  3. Click "Upload Plugin" and select the zip file
  4. Click "Install Now"
  5. After installation, click "Activate"

Manual Installation

  1. Upload the wp-engine-sites-menu folder to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress

Configuration

  1. Go to Settings > WP Engine API in your WordPress admin
  2. Enter your WP Engine username and password
  3. (Optional) Adjust the cache duration for API responses
  4. Click "Save Settings"
  5. Use the "Test Credentials" button to verify your API connection

Usage

Once configured, you'll see a "WP Engine Sites" menu in your WordPress admin bar. This menu provides:

  1. Current Site Section:

    • Shows your current site name
    • Lists all environments (Production/Staging/Development) for quick access
  2. Search Function:

    • Use the search box to filter through all your WP Engine installations
    • Search by site name, install name, or domain
  3. Other Sites:

    • Lists all other WP Engine sites you have access to
    • Includes environment indicators for each installation

Security

The plugin implements several security measures:

  • API credentials are encrypted using WordPress salts
  • All API requests are made server-side
  • Nonce verification for AJAX requests
  • Capability checking for admin functions

Caching

The plugin caches WP Engine API responses to improve performance:

  • Default cache duration: 1 hour (3600 seconds)
  • Configurable through the settings page
  • Cache is automatically cleared when testing credentials
  • Reduces API calls and improves menu load time

Releases

This plugin follows Semantic Versioning:

  • MAJOR version for incompatible API changes
  • MINOR version for added functionality in a backward compatible manner
  • PATCH version for backward compatible bug fixes

Creating a New Release

  1. Update version numbers in:

    • wp-engine-sites-menu.php (Plugin header)
    • JavaScript files where version is specified
    • Any other files referencing the version number
  2. Update the CHANGELOG.md file:

    • Add a new version section
    • Document all notable changes under appropriate categories:
      • Added
      • Changed
      • Deprecated
      • Removed
      • Fixed
      • Security
  3. Create and push a new version tag:

    git add .
    git commit -m "Prepare for version X.Y.Z"
    git tag -a vX.Y.Z -m "Version X.Y.Z"
    git push origin main --tags
  4. The GitHub Actions workflow will automatically:

    • Create a clean distribution package
    • Remove development files
    • Create a zip file
    • Create a GitHub release
    • Attach the zip file
    • Add release notes from CHANGELOG.md

Support

For bug reports or feature requests, please use the GitHub issues page.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This plugin is licensed under the GPL v2 or later.

Screenshots

  1. WP Engine Sites Menu: Quick access dropdown menu in the WordPress admin bar WP Engine Sites Menu

  2. Plugin Settings: Configure your WP Engine API credentials and cache settings Plugin Settings Page

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.0.2 latest
Dec 17, 2024 1 year ago
wp-engine-sites-menu-0.0.2.zip
5
Dec 17, 2024 1 year ago
wp-engine-sites-menu-0.0.1.zip
1
C- grade

Security

WP Engine Sites Menu 0.0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.0.2
Findings
1
Worst severity
high
Content hash
6239fc09f760e375e31cce85…

Findings

  • high Missing capability on WP Engine sites search AJAX

    missing_capability

    search_sites_ajax only calls check_ajax_referer('wpe_search_sites'). The matching nonce is localized in enqueue_admin_scripts for all admin pages with no current_user_can gate. Any authenticated user who can access wp-admin can search and receive WP Engine site names, install names, environments, and wp-admin URLs retrieved with the site's stored API credentials.

    wp-engine-sites-menu.php:304-358

    Recommendation

    Require current_user_can('manage_options') in search_sites_ajax (same as test_credentials_ajax) and only localize the search nonce for privileged users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.