ROBOTSTXT/robotstxt-telemetry
Watch
0
0
Fork
You've already forked robotstxt-telemetry
 0
Code Issues Pull requests Projects Releases 9 Packages Wiki Activity Actions

v1.0.1

Browse source
This commit is contained in:
Javier Casares 2026-08-18 18:03:59 +00:00
commit 5221310caa
6 changed files with 59 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

37
changelog.txt
View file

@ -1,5 +1,42 @@
== Changelog ==
= 1.0.1 =
_Release date: 2026-08-18_
**Highlights**
* Security and reliability review of the 1.0.0 feature set
**Fixed**
* Saving the "Plugins" tab from the Network Admin no longer resets the other network settings to their defaults; the hidden plugins list can now actually be saved in Global mode
* Credentials embedded in URLs are now always stripped from the logs, including URLs without query strings
**Changed**
* The redaction of sensitive keys in the logs now also covers "api-key", "cookie", "session", "private-key", and "private_key"
* Documentation clarified: the WordPress version masking applies to the User-Agent only, and the version query parameters always send the real version
* Development: the Composer manifest now declares name, description, and license (dev tooling only; the plugin has no runtime dependencies)
**Security**
* Full review of capabilities, nonces, sanitization, escaping, uninstall cleanup, and log redaction following OWASP and WordPress Plugin Security guidelines; no vulnerabilities found in the audited areas, and the findings above were addressed
**Compatibility**
* WordPress: 4.0 - 7.1
* PHP: 5.6 - 8.5
* MariaDB: 10.6+
* Multisite: compatible (Per-site and Global modes)
**Tests**
* WordPress 7.2-alpha-63320, PHP 8.5.9, MariaDB 11.8.8
* PHP Coding Standards: 3.13.6
* WordPress Coding Standards: 3.4.1
* PHPCompatibilityWP (PHP 5.6 - 8.5) and wp-since (WordPress 4.0) static reviews for the floor versions
= 1.0.0 =
_Release date: 2026-08-18_

2
includes/class-robotstxt-telemetry-admin.php
View file

@ -320,7 +320,7 @@ if ( ! class_exists( 'Robotstxt_Telemetry_Admin' ) ) {
// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified by check_admin_referer() above.
$tab = isset( $_POST['tab'] ) ? sanitize_key( wp_unslash( $_POST['tab'] ) ) : 'main';
$tab = in_array( $tab, array( 'main', 'logs', 'general' ), true ) ? $tab : 'main';
$tab = in_array( $tab, array( 'main', 'plugins', 'logs', 'general' ), true ) ? $tab : 'main';
if ( 'logs' === $tab ) {
$retention = isset( $_POST['robotstxt_telemetry_retention_period'] ) ? sanitize_key( wp_unslash( $_POST['robotstxt_telemetry_retention_period'] ) ) : '12hours';

7
includes/class-robotstxt-telemetry-logger.php
View file

@ -92,7 +92,7 @@ if ( ! class_exists( 'Robotstxt_Telemetry_Logger' ) ) {
$query_params = $this->redact_array( $query_params );
// Rebuild the URL with redacted query parameters and without credentials.
if ( ! empty( $parsed_url['query'] ) ) {
if ( ! empty( $parsed_url['query'] ) || ! empty( $parsed_url['user'] ) ) {
$redacted_url = $this->build_redacted_url( $parsed_url, http_build_query( $query_params ) );
if ( '' !== $redacted_url ) {
$url = $redacted_url;
@ -315,8 +315,13 @@ if ( ! class_exists( 'Robotstxt_Telemetry_Logger' ) ) {
'token',
'secret',
'api_key',
'api-key',
'apikey',
'nonce',
'cookie',
'session',
'private-key',
'private_key',
);
foreach ( $sensitive_keys as $sensitive_key ) {

4
languages/robotstxt-telemetry.pot
View file

@ -2,14 +2,14 @@
# This file is distributed under the GPL v3 or later.
msgid ""
msgstr ""
"Project-Id-Version: Telemetry disabler (by ROBOTSTXT) 1.0.0\n"
"Project-Id-Version: Telemetry disabler (by ROBOTSTXT) 1.0.1\n"
"Report-Msgid-Bugs-To: https://www.robotstxt.software/plugins/robotstxt-telemetry/"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"POT-Creation-Date: 2026-08-18T16:17:10+00:00\n"
"POT-Creation-Date: 2026-08-18T16:29:26+00:00\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"X-Generator: WP-CLI 2.12.0\n"
"X-Domain: robotstxt-telemetry\n"

19
readme.txt
View file

@ -3,9 +3,9 @@ Contributors: robotstxt, javiercasares
Tags: telemetry, privacy, http, requests, logging
Requires at least: 4.0
Tested up to: 7.1
Stable tag: 1.0.0
Stable tag: 1.0.1
Requires PHP: 5.6
Version: 1.0.0
Version: 1.0.1
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.txt
@ -32,7 +32,7 @@ The dashboard services can also be redirected (all enabled by default): the Even
Outbound requests normally identify the site in the User-Agent header (for example "WordPress/6.9; https://example.com/"). The "Outbound requests" setting controls what is sent: the site URL ("Send your URL"), a fixed hash so the site is no longer identifiable while remaining consistent across requests ("Send a hash", default), or no identifier at all ("Do not send anything").
The reported WordPress version is also configurable: the "WordPress version" setting sends the actual version (default), the major version with the rest masked (for example "7.2.n"), or a nulled version ("0.0.0"). The version is masked in the User-Agent and in the WordPress.org version fields; the checksum and translation requests always use the real version so updates keep working.
The reported WordPress version is also configurable: the "WordPress version" setting sends the actual version (default), the major version with the rest masked (for example "7.2.n"), or a nulled version ("0.0.0"). The version is masked in the User-Agent only; the version query parameters of the update and information APIs always send the real version, so updates keep working.
The installation language can also be hidden: with the "Send en_US as the language of outbound requests" setting (disabled by default), every request to WordPress.org reports English (United States) instead of the real installation language, including the language lists of the update checks and the locale parameters of the core version check, credits, community events, and plugin/theme information APIs. The translation endpoints keep using the real language so installed language packs keep receiving updates.
@ -44,7 +44,7 @@ The Logs screen provides a paginated list with filters by method, host and date
= Privacy by default =
* Sensitive keys (`authorization`, `password`, `pass`, `token`, `secret`, `api_key`, `apikey`, `nonce`) are redacted before anything is written to the database.
* Sensitive keys (`authorization`, `password`, `pass`, `token`, `secret`, `api_key`, `api-key`, `apikey`, `nonce`, `cookie`, `session`, `private-key`, `private_key`) are redacted before anything is written to the database.
* Credentials embedded in URLs are stripped, and query strings are stored redacted.
* Payloads are truncated (64 KB per JSON blob, 64 KB raw body, 16 KB caller trace).
* Log retention is configurable (12 hours by default, 1 day, or 3 days), a maximum of 1000 entries is always enforced, and the cleanup runs when browsing the logs and twice a day automatically.
@ -142,6 +142,13 @@ On WordPress versions older than 5.1, the Core update check Safe mode cannot red
Only the 3 last versions. The full changelog will be at changelog.txt
= 1.0.1 =
* Fixed: saving the "Plugins" tab from the Network Admin no longer resets the other network settings to their defaults (and the hidden plugins list can now be saved in Global mode)
* Fixed: credentials embedded in URLs are now always stripped, including URLs without query strings
* Changed: the redaction of sensitive keys now also covers "api-key", "cookie", "session", "private-key", and "private_key"
* Changed: documentation clarified — the WordPress version masking applies to the User-Agent only, and the query parameters always send the real version
= 1.0.0 =
* First stable release: outbound HTTP request logging with secret redaction, Safe modes for the WordPress.org Core/Themes/Plugins update checks, per-plugin hiding, User-Agent and version controls, installation language masking, dashboard services replaced (news, events, browser check), log retention, and Multisite Per-site/Global modes
@ -152,10 +159,6 @@ Only the 3 last versions. The full changelog will be at changelog.txt
* Changed: the WordPress version masking is now User-Agent only; query parameters always send the real version so updates keep working
* Fixed: the User-Agent masking now covers the trailing-slash form of the site URL used by the update checks
= 0.9.1 =
* Changed: the Settings screen is organized in native WordPress tabs (Settings, Plugins, Logs, General), each saving independently
= Previous versions =
If you want to see the full changelog, visit the [changelog.txt](https://www.robotstxt.software/plugins/robotstxt-telemetry/) page.

4
robotstxt-telemetry.php
View file

@ -4,7 +4,7 @@
* Plugin URI: https://www.robotstxt.software/plugins/robotstxt-telemetry/
* Update URI: https://www.robotstxt.software/plugins/robotstxt-telemetry/
* Description: Reduces the telemetry WordPress sends out and logs every outbound HTTP request, so your site shares less and you can see everything.
* Version: 1.0.0
* Version: 1.0.1
* Author: ROBOTSTXT
* Author URI: https://www.robotstxt.software/
* Text Domain: robotstxt-telemetry
@ -23,7 +23,7 @@ if ( ! defined( 'ABSPATH' ) ) {
exit;
}
define( 'ROBOTSTXT_TELEMETRY_VERSION', '1.0.0' );
define( 'ROBOTSTXT_TELEMETRY_VERSION', '1.0.1' );
define( 'ROBOTSTXT_TELEMETRY_DB_VERSION', '1.1.0' );
define( 'ROBOTSTXT_TELEMETRY_PLUGIN_FILE', __FILE__ );
define( 'ROBOTSTXT_TELEMETRY_PLUGIN_DIR', __DIR__ );