WP Manifestindependent plugin directory
manifest / developer / codepotent-php-error-log-viewer

PHP Error Log Viewer WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

The PHP Error Log Viewer plugin for ClassicPress brings your error log straight into your dashboard.

★ 1stars
255release downloads
≈20active sites
2.5.5latest · 1 year ago

Install

Download codepotent-php-error-log-viewer-2.5.5.zip From the 2.5.5 release on GitHub, May 26, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/xxsimoxx/codepotent-php-error-log-viewer/releases/download/2.5.5/codepotent-php-error-log-viewer-2.5.5.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

The PHP Error Log Viewer plugin for ClassicPress brings your error log straight into your dashboard. Color-coding helps you to quickly scan even the longest of error logs. Or, just filter out the errors you don't want to see. No more wall-of-text error messages – this plugin turns your PHP error log into an incredibly useful display.

PHP Error Log Viewer plugin for ClassicPress by Code Potent

Fast, Lightweight, and User-Friendly

There are lots of debugging plugins out there – debugging suites, really. This plugin isn't intended to become one of them. The PHP Error Log Viewer plugin handles a very specific task and that is to display the PHP error log in a user-friendly manner than can be easily filtered, styled, sorted, preserved, or purged.

More Debugging, Less Clicking

If you have grown tired of flipping back and forth between screens/browsers/apps/whatever to check and recheck your PHP error log as you're writing code, this will be incredibly handy for you. There's a link to the error log within reach at all times and it doesn't require any special configuration.

Viewing the Error Log

Click the PHP Errors menu item in your admin bar. Hover the menu item momentarily and it will reveal your current PHP version. Alternatively, you can access the error log by navigating to Dashboard > Tools > PHP Error Log.

Filtering the Error Log

The checkboxes across the top of the display allow you to show and hide each of the various types of errors: Deprecated, Notice, Warning, Error, and Other. There are also checkboxes to show and hide the time/date, stack traces, and to sort the error log in reverse. Tick your preferred boxes and click the Apply Filters button to update the display.

Refreshing the Error Log

When viewing the error log, you will find a button to Refresh Error Log at the right side of the page. Clicking this button has the same effect as clicking your browser's refresh button. The error log will be re-read and displayed fresh.

Purging the Error Log

When viewing the error log, you will find a button to Purge Error Log at the right side of the page. Clicking this button will purge all messages from the error log. A confirmation dialog prevents accidental deletion. If your error log is not writable by the PHP process, you will not see this button.

Purging the Error Log via AJAX

In the admin bar, you will find a link PHP Errors which, when hovered, will expose a link to Purge Error Log. Clicking this button will purge all messages from the error log without redirecting you away from the current page. A confirmation dialog prevents accidental deletion. If your error log is not writable by the PHP process, you will not see this link.

Manually Triggering Errors

As of version 2.2.0, there is a function that allows you to manually trigger user-level notices, warnings, or errors and have them neatly displayed in the error log. Here is an example of creating your own wrapper function for added convenience.

/**
     * Creating your own error logging wrapper function
     *
     * This example shows how you might integrate the logging function into your own
     * utility plugin.
     *
     * @param mixed $data   Pass in a string, integer, array, object, etc.
     * @param str $level    Must be notice, warning, or error.
     * @param int $file     Use __FILE__ constant to include filename.
     * @param bool $line    Use __LINE__ constant to include line number.
     */
    function log_data($data, $level='notice', $file=false, $line=false) {

        // If error log plugin is active and the needed function exists...
        if (function_exists('codepotent_php_error_log_viewer_log')) {
            return codepotent_php_error_log_viewer_log($data, $level, $file, $line);
        }

        // Or, if error log plugin is inactive, you can include just the needed function...
        if (file_exists($file = plugin_dir_path(__DIR__).'codepotent-php-error-log-viewer/includes/functions.php')) {
            require_once($file);
            return codepotent_php_error_log_viewer_log($data, $level, $file, $line);
        }

        // If the error log plugin just doesn't exist, there's a fallback.
        trigger_error(print_r($data, true), E_USER_WARNING);

    }

    // Elsewhere, send data to the log like this:
    $data = 'whatever type of data';
    log_data($data, 'notice', __FILE__, __LINE__);

Display Options

The checkboxes at the top of the error log display allow you to choose which types of error messages you want to see. Check any of the boxes and click the Apply Filter button to update the display.

  • Date/Time Check this box to show dates, times, and other meta data.
  • Notice Check this box to show non-critical PHP notices.
  • Warning Check this box to show non-critical PHP warnings.
  • Error Check this box to show critical PHP errors.
  • Other Check this box to show any other errors that didn't meet the above criteria.
  • Show Stack Traces Check this box to show stack traces for critical errors. Note that not all critical errors will generate a stack trace.
  • Reverse Sort Check this box to display the error log with latest errors at the top.

Primary Alert Bubble This filter allows you to hide or redesign the primary (red) alert bubble in the admin bar. This filter accepts a single argument, the markup of the primary alert bubble.

function yourprefix_hide_primary_alert($alert) {
    return '';
}
add_filter('codepotent_php_errror_log_viewer_primary_alert', 'yourprefix_hide_primary_alert');

Secondary Alert Bubble This filter will allow you to hide or redesign the secondary (gray) alert bubble in the admin bar. This filter accepts a single argument, the markup of the secondary alert bubble.

function yourprefix_hide_secondary_alert($alert) {
    return '';
}
add_filter('codepotent_php_errror_log_viewer_primary_alert', 'yourprefix_hide_secondary_alert');

Add Content Before Legend

In cases where you need to insert some contextual information, either of the following filters can be used to place the content before or after the legend. These filters receive an empty string as an argument.

function yourprefix_before_error_log_legend($markup) {
    $markup = '

This content appears before the legend.

'; return $markup; } add_filter('codepotent_php_errror_log_viewer_before_legend', 'yourprefix_before_error_log_legend');

Add Content After Legend

Identical to the filter above, except this filter places your contextual content below the legend.

function yourprefix_after_error_log_legend($markup) {
    $markup = '

This content appears after the legend.

'; return $markup; } add_filter('codepotent_php_errror_log_viewer_after_legend', 'yourprefix_after_error_log_legend');

Using Custom Error Colors

To override the color-coding for the error messages and legend, copy the following styles into your theme's style.css file and make your changes there.

/* Deprecated code. */
#codepotent-php-error-log-viewer .php-deprecated, 
.codepotent-php-error-log-viewer-legend-box.item-php-deprecated {
    border-left:10px solid #847545;
    }
/* Notices. */
#codepotent-php-error-log-viewer .php-notice,
.codepotent-php-error-log-viewer-legend-box.item-php-notice {
    border-left:10px solid #ccc;
    }
/* Warnings. */
#codepotent-php-error-log-viewer .php-warning,
.codepotent-php-error-log-viewer-legend-box.item-php-warning {
    border-left:10px solid #ffee58;
    }
/* Errors. */
#codepotent-php-error-log-viewer .php-error,
.codepotent-php-error-log-viewer-legend-box.item-php-error {
    border-left:10px solid #e53935;
    }
/* Stack traces. */
#codepotent-php-error-log-viewer .php-stack-trace-title,
#codepotent-php-error-log-viewer .php-stack-trace-step,
#codepotent-php-error-log-viewer .php-stack-trace-origin,
.codepotent-php-error-log-viewer-legend-box.item-php-stack-trace-title {
    border-left:10px solid #ef9a9a;
    }
/* Any other messages. */
#codepotent-php-error-log-viewer .php-other,
.codepotent-php-error-log-viewer-legend-box.item-php-other {
    border-left:10px solid #00bcd4;
    }

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.5.5 latest
May 26, 2025 1 year ago
codepotent-php-error-log-viewer-2.5.5.zip
57
Mar 24, 2025 1 year ago
codepotent-php-error-log-viewer-2.5.4.zip
20
Apr 6, 2023 3 years ago
codepotent-php-error-log-viewer-2.5.3.zip
115
Mar 30, 2023 3 years ago
codepotent-php-error-log-viewer-2.5.2.zip
8
Aug 30, 2022 4 years ago
codepotent-php-error-log-viewer-2.5.1.zip
32
Jun 29, 2022 4 years ago
codepotent-php-error-log-viewer-2.5.0.zip
23

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

D+ grade

Security

PHP Error Log Viewer 2.5.5 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.5.5
Findings
2
Worst severity
high
Content hash
6a11db5500be7de2bb950506…

Findings

  • high Stored XSS: PHP error_log lines echoed as HTML in the admin log viewer

    xss_stored

    render_php_error_log() (manage_options Tools page) prints markup_error_rows() with an explicit comment that escaping is skipped because the output is treated as HTML. convert_error_log_into_properties() reads each error_log line, wraps 'PHP …' matches in <strong> and datetimes in <span>, special-cases the string 'User Generated' to keep a </pre> block, and stores the result. markup_error_rows() then concatenates that string into a div with no esc_html()/wp_kses(). The consumer is the admin HTML document, so a <script> or event-handler payload executes as the logged-in administrator (session theft, new admin user, plugin install). Write path: this plugin does not take an 'error' request param; it displays ini_get('error_log'). Unauthenticated and low-priv users can append to that file whenever PHP logs a diagnostic that includes their input — PHP 7+ stack traces dump function arguments; the plugin's own 404 recipe sets WP_DEBUG true so notices/warnings are recorded; includes/functions.php codepotent_php_error_log_viewer_log() trigger_error()s unescaped print_r($data) wrapped in <pre>. Subscriber/customer cannot open the viewer, but they do not need to: the admin is the XSS victim. Not frontend-echo, so high rather than critical.

    codepotent-php-error-log-viewer.php:514-529,988-991,1154-1216

    Recommendation

    Treat default PHP log lines as text: esc_html() each line (or htmlspecialchars with ENT_QUOTES) before wrapping in the row div. If the User Generated helper must keep <pre>/<strong>, whitelist those tags with wp_kses after escaping the payload inside print_r(), and never apply that HTML path to ordinary PHP diagnostics. Do not skip escaping for the whole viewer because one helper wants markup.

  • medium Unauthenticated front-end bootstrap file()s the entire PHP error_log with no size cap

    dos

    The plugin file ends with new PhpErrorLogViewer, so the constructor runs on every WordPress bootstrap (front-end, REST, cron, admin-ajax) for every role including logged-out visitors. convert_error_log_into_properties() is invoked before any capability check: it filesize()s then file()s ini_get('error_log') into $this->raw_errors and runs multiple preg_replace passes per line. Admin-bar badges and the Tools UI are later gated on manage_options, but the parse already happened. There is no byte limit, tail window, or is_admin_bar_showing() short-circuit. Observable: a leftover tens-of-MB debug.log (common when WP_DEBUG_LOG was left on) becomes a full-file memory copy on every public request and trips memory_limit/502 for all visitors; an attacker who can provoke PHP diagnostics can grow that file and amplify the cost. Availability only — log contents are not echoed to unauthenticated clients.

    codepotent-php-error-log-viewer.php:89-97,470-495,1330-1331

    Recommendation

    Do not parse the log unless the current user can manage_options and actually needs counts (is_admin() Tools page or is_admin_bar_showing()). Cap the read (e.g. last N KiB via SplFileObject seek, or skip when filesize exceeds a threshold). Never call file() on the full log from a constructor that runs for anonymous front-end traffic.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.