WP Manifestindependent plugin directory
manifest / developer / wps

wps WP RegistryHigh-severity findings · 1 findingOpen the reportC- #5 in Developer Tools

WordPress plugin for whoops error handler.

by Andrey "Rarst" Savchenko · github.com/rarst/wps · website

★ 130stars
1.8krelease downloads
≈110active sites
139kcomposer installs
1.2latest · 7 years ago

Install

Download wps.zip From the 1.2 release on GitHub, Dec 18, 2018

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rarst/wps/releases/download/1.2/wps.zip

On Packagist as rarst/wps:

composer require rarst/wps
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/rarst/wps ↗

wps — WordPress plugin for whoops

Latest Stable Version Total Downloads

wps adds whoops error handler to a WordPress installation.

It makes error messages from PHP, admin-ajax.php, and WP REST API a great deal more clear and convenient to work with.

Installation

Composer (recommended) Release archive
composer require rarst/wps Download wps

Usage

The plugin is meant strictly for development and will only work with WP_DEBUG and WP_DEBUG_DISPLAY configuration constants enabled.

Silence errors

whoops can definitely get noisy with a lot of low–grade errors.

Silence errors for irrelevant locations to keep it practical and productive.

Silence for URL

Use ?wps_disable query argument in the URL to temporarily disable whoops.

Silence for path

Use regular expressions to match source file paths and error constants to configure what should be silenced.

This can be called multiple times and/or array of paths can be provided.

Note that the direction of slashes needs to match operating system or write your regexes to match either.

global $wps;

// Silence notices and warnings for any path. 
$wps['run']->silenceErrorsInPaths( '~.*~', E_NOTICE | E_WARNING );

// Silence for specific directory.
$wps['run']->silenceErrorsInPaths( '~/wp-admin/~', E_NOTICE | E_WARNING );

// Silence _except_ specific directory.
$wps['run']->silenceErrorsInPaths( '~^((?!/my-plugin/).)*$~', E_NOTICE | E_WARNING );

// Silence for plugins _except_ specific plugin.
$wps['run']->silenceErrorsInPaths( '~/wp-content/plugins/(?!my-plugin)~', E_NOTICE | E_WARNING );

License

MIT

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2 latest
Dec 18, 2018 7 years ago
wps.zip +1 asset
1,572
wps.zip1,377
wps-1.2.zip195
1.1
Oct 27, 2017 8 years ago
wps-1.1.zip
166
1.0
May 8, 2016 10 years ago
wps-1.0.zip
51

Active-site estimate ≈110 comes from the median of recent superseded releases. Method.

C- grade

Security

wps 1.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.2
Findings
1
Worst severity
high
Content hash
30ffc6e61c4d2fdf0dd72b5f…

Findings

  • high Unauthenticated Whoops error pages dump source, environment, and stack-trace arguments

    information_disclosure

    Plugin::run() calls Whoops\Run::register() (set_error_handler, set_exception_handler, register_shutdown_function) on every request when WP_DEBUG and WP_DEBUG_DISPLAY are true. Those constants are the plugin's documented, required operating mode — WordPress also defaults WP_DEBUG_DISPLAY to true when WP_DEBUG is on — and there is no current_user_can('manage_options'), is_local, or IP check. PrettyPageHandler then renders GET/POST/FILES/COOKIE/SESSION/SERVER/ENV (blacklist is only PHP_AUTH_PW; this plugin never calls blacklist() for WordPress secrets) plus extra tables of get_object_vars($wp), $wp_query, and $post, and Frame::getFileContents() of every stack file. Admin_Ajax_Handler (DOING_AJAX, including nopriv) and Rest_Api_Handler (REST_REQUEST or any URI containing the rest prefix) JSON-encode the exception with addTraceToOutput(true), which includes each frame's args — so a REST/AJAX error can leak mysqli_real_connect/wpdb constructor passwords and other parameters. Unlike Query Monitor, output is not limited to a privileged role. An unauthenticated visitor who hits any notice/warning/exception (easy with WP_DEBUG → E_ALL) receives filesystem layout, plugin/theme source, and whatever secrets the process environment or stack holds. composer.json also places filp/whoops in require (not require-dev) and the README's install path is composer require / a release zip, so the handler is commonly deployed on publicly reachable sites.

    php/class-plugin.php:60-136

    Recommendation

    Do not register Whoops for anonymous front-end requests. Gate the pretty/JSON handlers on current_user_can('manage_options') (or a dedicated capability) and/or an explicit local/dev constant (WP_ENVIRONMENT_TYPE === 'local'). Blacklist DB_PASSWORD, AUTH_KEY/SECURE_AUTH_KEY/LOGGED_IN_KEY/NONCE_KEY and salts, wordpress_logged_in_*, wordpress_sec_*, HTTP_AUTHORIZATION, and common cloud secret env names. Disable addTraceToOutput for unauthenticated AJAX/REST, or strip frame args. Move filp/whoops to require-dev and refuse to boot when WP_ENVIRONMENT_TYPE is production.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →