Changeset 3780742

Timestamp:

11/02/2026 09:12:28 PM (32 hours ago)

Author:

omniswp

Message:

siteward 0.17.1

Location:

siteward

Files:

• tags/0.17.1 (added)
• tags/0.17.1/admin (added)
• tags/0.17.1/admin/assets (added)
• tags/0.17.1/admin/assets/admin.css (added)
• tags/0.17.1/admin/assets/admin.js (added)
• tags/0.17.1/admin/class-omnis-admin.php (added)
• tags/0.17.1/admin/views (added)
• tags/0.17.1/admin/views/_helpers.php (added)
• tags/0.17.1/admin/views/add-site.php (added)
• tags/0.17.1/admin/views/overview.php (added)
• tags/0.17.1/admin/views/settings.php (added)
• tags/0.17.1/admin/views/site-detail.php (added)
• tags/0.17.1/admin/views/updates.php (added)
• tags/0.17.1/admin/views/vulnerabilities.php (added)
• tags/0.17.1/includes (added)
• tags/0.17.1/includes/class-omnis-connection.php (added)
• tags/0.17.1/includes/class-omnis-cron.php (added)
• tags/0.17.1/includes/class-omnis-db.php (added)
• tags/0.17.1/includes/class-omnis-flags.php (added)
• tags/0.17.1/includes/class-omnis-http.php (added)
• tags/0.17.1/includes/class-omnis-inventory.php (added)
• tags/0.17.1/includes/class-omnis-notifications.php (added)
• tags/0.17.1/includes/class-omnis-settings.php (added)
• tags/0.17.1/includes/class-omnis-sites.php (added)
• tags/0.17.1/includes/class-omnis-sync.php (added)
• tags/0.17.1/includes/class-omnis-tags.php (added)
• tags/0.17.1/includes/class-omnis-updates.php (added)
• tags/0.17.1/includes/class-omnis-uptime.php (added)
• tags/0.17.1/includes/class-omnis-vuln-feed.php (added)
• tags/0.17.1/includes/class-omnis-vuln.php (added)
• tags/0.17.1/languages (added)
• tags/0.17.1/languages/index.php (added)
• tags/0.17.1/license.txt (added)
• tags/0.17.1/readme.txt (added)
• tags/0.17.1/siteward.php (added)
• tags/0.17.1/uninstall.php (added)
• trunk/admin/assets/admin.css (modified) (1 diff)
• trunk/admin/class-omnis-admin.php (modified) (1 diff)
• trunk/admin/views/settings.php (modified) (1 diff)
• trunk/admin/views/site-detail.php (modified) (1 diff)
• trunk/includes/class-omnis-flags.php (modified) (6 diffs)
• trunk/includes/class-omnis-settings.php (modified) (1 diff)
• trunk/includes/class-omnis-sync.php (modified) (3 diffs)
• trunk/includes/class-omnis-uptime.php (modified) (1 diff)
• trunk/includes/class-omnis-vuln.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/siteward.php (modified) (2 diffs)

siteward/trunk/admin/assets/admin.css

@@ -170 +170 @@
 .omnis-kv .v.warn { color: #b54708; }
 .omnis-kv .v.bad { color: #b42318; }
+.omnis-kv .v .warn { color: #b54708; }
+.omnis-kv .v .bad { color: #b42318; }
 .omnis-kv .v.ok { color: #067647; }
 .omnis-inline-warn { margin-top: 11px; background: #fffaeb; border: 1px solid #fedf89; border-radius: 8px; padding: 8px 10px; font-size: 12px; color: #b54708; }

siteward/trunk/admin/class-omnis-admin.php

@@ -400 +400 @@
                         'notify_vulnerable'    => empty( $in['notify_vulnerable'] ) ? 0 : 1,
                         'notify_rollback'      => empty( $in['notify_rollback'] ) ? 0 : 1,
+                        'vuln_notices'         => empty( $in['vuln_notices'] ) ? 0 : 1,
                         // 1 to 168 hours: below an hour the feed client's own floor rejects it
                         // anyway, and beyond a week a "current" feed is not current.

siteward/trunk/admin/views/settings.php

@@ -147 +147 @@
                                 <p class="section-desc"><?php esc_html_e( 'How often this dashboard fetches the vulnerability data it matches your sites against.', 'siteward' ); ?></p>
                                 <?php omnis_num_row( 'vuln_interval', __( 'Check every (hours)', 'siteward' ), $settings, '', 1 ); ?>
+                                <div class="omnis-row" style="border-top:1px solid #f4f4f5;margin-top:10px">
+                                        <label><input type="checkbox" name="vuln_notices" value="1" <?php checked( ! empty( $settings['vuln_notices'] ) ); ?> /> <?php esc_html_e( 'Warn on each site\'s Plugins screen', 'siteward' ); ?>
+                                                <span class="field-desc"><?php esc_html_e( 'Adds a row under each affected plugin on the site itself, seen only by people who can update plugins there, with the version that fixes it. Sites need Siteward Child 0.9.0 or later. Turn it off if clients log in and should not see these warnings.', 'siteward' ); ?></span>
+                                        </label>
+                                </div>
                                 <p class="section-desc" style="margin:12px 0 0">
                                         <?php

siteward/trunk/admin/views/site-detail.php

@@ -168 +168 @@
                 <div class="omnis-info-card">
                         <h3>⛭ <?php esc_html_e( 'Environment', 'siteward' ); ?></h3>
-                        <div class="omnis-kv"><span class="k"><?php esc_html_e( 'WordPress', 'siteward' ); ?></span><span class="v"><?php echo esc_html( $status && $status->wp_version ? $status->wp_version : '—' ); ?><?php echo ! empty( $core['available'] ) ? ' <span class="warn">· ' . esc_html__( 'update ready', 'siteward' ) . '</span>' : ''; ?></span></div>
-                        <div class="omnis-kv"><span class="k"><?php esc_html_e( 'PHP', 'siteward' ); ?></span><span class="v"><?php echo esc_html( $status && $status->php_version ? $status->php_version : '—' ); ?></span></div>
+                        <?php
+                        $omnis_wp_behind = $status && $status->wp_version ? Omnis_Flags::wp_releases_behind( $status->wp_version, Omnis_Flags::latest_wp( isset( $core['latest'] ) ? (string) $core['latest'] : '' ) ) : 0;
+                        $omnis_php_eol   = $status && $status->php_version ? Omnis_Flags::php_eol( $status->php_version ) : null;
+                        ?>
+                        <div class="omnis-kv"><span class="k"><?php esc_html_e( 'WordPress', 'siteward' ); ?></span><span class="v"><?php echo esc_html( $status && $status->wp_version ? $status->wp_version : '—' ); ?><?php echo ! empty( $core['available'] ) ? ' <span class="warn">· ' . esc_html__( 'update ready', 'siteward' ) . '</span>' : ''; ?><?php if ( $omnis_wp_behind >= 2 ) : ?> <span class="bad">· <?php echo esc_html( sprintf( /* translators: %d: number of major WordPress releases */ _n( '%d release behind', '%d releases behind', $omnis_wp_behind, 'siteward' ), $omnis_wp_behind ) ); ?></span><?php endif; ?></span></div>
+                        <div class="omnis-kv"><span class="k"><?php esc_html_e( 'PHP', 'siteward' ); ?></span><span class="v"><?php echo esc_html( $status && $status->php_version ? $status->php_version : '—' ); ?>
+                                <?php if ( $omnis_php_eol && $omnis_php_eol['ended'] ) : ?>
+                                        <span class="bad" title="<?php esc_attr_e( 'This PHP version no longer gets security fixes. Ask the host to move the site to a supported version.', 'siteward' ); ?>">· <?php echo '' !== $omnis_php_eol['date'] ? esc_html( sprintf( /* translators: %s: date */ __( 'unsupported since %s', 'siteward' ), date_i18n( get_option( 'date_format' ), strtotime( $omnis_php_eol['date'] ) ) ) ) : esc_html__( 'unsupported', 'siteward' ); ?></span>
+                                <?php elseif ( $omnis_php_eol && $omnis_php_eol['days_left'] <= Omnis_Flags::PHP_EOL_SOON_DAYS ) : ?>
+                                        <span class="warn" title="<?php esc_attr_e( 'After this date this PHP version gets no more security fixes.', 'siteward' ); ?>">· <?php echo esc_html( sprintf( /* translators: %s: date */ __( 'security support ends %s', 'siteward' ), date_i18n( get_option( 'date_format' ), strtotime( $omnis_php_eol['date'] ) ) ) ); ?></span>
+                                <?php endif; ?>
+                        </span></div>
                         <?php if ( $status && ! empty( $status->server_ip ) ) : ?>
                                 <?php $omnis_ip_public = filter_var( $status->server_ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ); ?>

siteward/trunk/includes/class-omnis-flags.php

@@ -27 +27 @@
         const SITE_HEALTH       = 'site_health';
         const VULNERABLE        = 'vulnerable';
+        const OUTDATED_PHP      = 'outdated_php';
+        const OUTDATED_WP       = 'outdated_wp';
+
+        /**
+         * End of security support for each PHP branch, from php.net/supported-versions.
+         * A branch older than the first entry ended long ago; a branch newer than the
+         * last is not judged until it is added here, so add each new branch when it
+         * ships (8.6 / 9.0 expected late 2026, supported until the end of 2030).
+         */
+        const PHP_EOL = array(
+                '7.4' => '2022-11-28',
+                '8.0' => '2023-11-26',
+                '8.1' => '2025-12-31',
+                '8.2' => '2026-12-31',
+                '8.3' => '2027-12-31',
+                '8.4' => '2028-12-31',
+                '8.5' => '2029-12-31',
+        );
+
+        /** How soon before a PHP branch's end the site page starts warning, in days. */
+        const PHP_EOL_SOON_DAYS = 180;
 
         /**
@@ -48 +69 @@
                         self::FAILING_CRON      => array( 'label' => __( 'Cron failing', 'siteward' ), 'severity' => 'warning' ),
                         self::SITE_HEALTH       => array( 'label' => __( 'Site Health issues', 'siteward' ), 'severity' => 'warning' ),
+                        self::OUTDATED_PHP      => array( 'label' => __( 'Unsupported PHP', 'siteward' ), 'severity' => 'warning' ),
+                        self::OUTDATED_WP       => array( 'label' => __( 'Outdated WordPress', 'siteward' ), 'severity' => 'warning' ),
                         self::UPDATES_AVAILABLE => array( 'label' => __( 'Updates available', 'siteward' ), 'severity' => 'info' ),
                 );
@@ -178 +201 @@
                         if ( ! empty( $health['site_health']['critical'] ) ) {
                                 $flags[] = self::SITE_HEALTH;
+                        }
+                }
+
+                // PHP past the end of its security support, and WordPress two or more
+                // major releases behind. Both versions come from the site's last sync.
+                if ( ! empty( $snapshot['php_version'] ) ) {
+                        $eol = self::php_eol( (string) $snapshot['php_version'] );
+                        if ( $eol && $eol['ended'] ) {
+                                $flags[] = self::OUTDATED_PHP;
+                        }
+                }
+                if ( ! empty( $snapshot['wp_version'] ) ) {
+                        $latest = self::latest_wp( isset( $updates['core']['latest'] ) ? (string) $updates['core']['latest'] : '' );
+                        if ( self::wp_releases_behind( (string) $snapshot['wp_version'], $latest ) >= 2 ) {
+                                $flags[] = self::OUTDATED_WP;
                         }
                 }
@@ -220 +258 @@
                         self::VULNERABLE        => array( 'label' => __( 'Known vulnerability', 'siteward' ), 'flags' => array( self::VULNERABLE ) ),
                         self::SLOW_LOAD         => array( 'label' => __( 'Slow', 'siteward' ), 'flags' => array( self::SLOW_LOAD ) ),
+                        self::OUTDATED_PHP      => array( 'label' => __( 'Unsupported PHP', 'siteward' ), 'flags' => array( self::OUTDATED_PHP ) ),
+                        self::OUTDATED_WP       => array( 'label' => __( 'Outdated WordPress', 'siteward' ), 'flags' => array( self::OUTDATED_WP ) ),
                         'healthy'               => array( 'label' => __( 'Healthy', 'siteward' ), 'special' => 'healthy' ),
                 );
@@ -261 +301 @@
                 }
                 return $keys;
+        }
+
+        /**
+         * Where a PHP version stands against its branch's end of security support.
+         *
+         * @param string $version e.g. "8.1.33".
+         * @return array|null { branch, date (Y-m-d, '' if before the table), ended, days_left },
+         *                    or null when the version cannot be read or is newer than the table.
+         */
+        public static function php_eol( $version ) {
+                if ( ! preg_match( '/^(\d+)\.(\d+)/', (string) $version, $m ) ) {
+                        return null;
+                }
+                $branch = $m[1] . '.' . $m[2];
+                $first  = array_key_first( self::PHP_EOL );
+                if ( version_compare( $branch, $first, '<' ) ) {
+                        return array( 'branch' => $branch, 'date' => '', 'ended' => true, 'days_left' => 0 );
+                }
+                if ( ! isset( self::PHP_EOL[ $branch ] ) ) {
+                        return null;
+                }
+                $date = self::PHP_EOL[ $branch ];
+                $end  = strtotime( $date . ' 23:59:59 UTC' );
+                return array(
+                        'branch'    => $branch,
+                        'date'      => $date,
+                        'ended'     => time() > $end,
+                        'days_left' => max( 0, (int) floor( ( $end - time() ) / DAY_IN_SECONDS ) ),
+                );
+        }
+
+        /**
+         * The latest WordPress release, as the highest of: the dashboard's own core
+         * update check, the dashboard's own WordPress, the newest version any managed
+         * site runs, and what this site reported. No single source is enough: the
+         * update check can come back empty, and a site on old PHP is only offered the
+         * newest release its PHP can run, which would hide exactly the sites that matter.
+         *
+         * @param string $reported The latest version the site reported, if any.
+         * @return string Version, or '' when unknown.
+         */
+        public static function latest_wp( $reported = '' ) {
+                static $known = null;
+                if ( null === $known ) {
+                        global $wpdb;
+                        $candidates = array( (string) get_bloginfo( 'version' ) );
+                        $core       = get_site_transient( 'update_core' );
+                        if ( is_object( $core ) && ! empty( $core->offers ) && is_array( $core->offers ) ) {
+                                foreach ( $core->offers as $offer ) {
+                                        if ( is_object( $offer ) && ! empty( $offer->current ) ) {
+                                                $candidates[] = (string) $offer->current;
+                                        }
+                                }
+                        }
+                        $table = Omnis_DB::table( Omnis_DB::STATUS );
+                        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- own table name, once per request (static).
+                        $fleet = $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT wp_version FROM {$table} WHERE wp_version <> %s", '' ) );
+                        $known = self::max_version( array_merge( $candidates, (array) $fleet ) );
+                }
+                return self::max_version( array( $known, (string) $reported ) );
+        }
+
+        /**
+         * The highest of a list of version strings ('' when none is valid). Releases
+         * only: one test site on a beta or RC must not make every site look behind.
+         */
+        private static function max_version( array $versions ) {
+                $max = '';
+                foreach ( $versions as $v ) {
+                        if ( preg_match( '/^\d+\.\d+(\.\d+)?$/', (string) $v ) && ( '' === $max || version_compare( $v, $max, '>' ) ) ) {
+                                $max = (string) $v;
+                        }
+                }
+                return $max;
+        }
+
+        /**
+         * How many major WordPress releases (6.9, 7.0, 7.1, ...) a version is behind.
+         *
+         * @param string $version Site's version.
+         * @param string $latest  Latest version.
+         * @return int 0 when current, ahead or unknown.
+         */
+        public static function wp_releases_behind( $version, $latest ) {
+                if ( ! preg_match( '/^(\d+)\.(\d+)/', (string) $version, $a ) || ! preg_match( '/^(\d+)\.(\d+)/', (string) $latest, $b ) ) {
+                        return 0;
+                }
+                // WordPress majors run x.0 to x.9, so x * 10 + y counts releases.
+                return max( 0, ( (int) $b[1] * 10 + (int) $b[2] ) - ( (int) $a[1] * 10 + (int) $a[2] ) );
         }
 
@@ -311 +440 @@
                                 'health'         => ! empty( $row->health ) ? json_decode( $row->health, true ) : array(),
                                 'vulns'          => ! empty( $row->vulns ) ? json_decode( $row->vulns, true ) : array(),
+                                'php_version'    => (string) $row->php_version,
+                                'wp_version'     => (string) $row->wp_version,
                                 'load_time_ms'   => (int) $row->load_time_ms,
                                 'is_up'          => $site && null !== $site->is_up ? (bool) $site->is_up : null,

siteward/trunk/includes/class-omnis-settings.php

@@ -40 +40 @@
                         'notify_vulnerable'    => 1,      // alert on newly discovered vulnerabilities
                         'notify_rollback'      => 1,      // alert when an update was rolled back
+                        'vuln_notices'         => 1,      // show known vulnerabilities on each site's Plugins screen (child 0.9.0+)
                         'vuln_interval'        => 12,     // hours between vulnerability feed checks
                 );

siteward/trunk/includes/class-omnis-sync.php

@@ -45 +45 @@
                 foreach ( $sites as $s ) {
                         $by_id[ (int) $s->id ] = $s;
-                        $spec                  = Omnis_Connection::build_request( $s, 'get_status' );
+                        $spec                  = Omnis_Connection::build_request( $s, 'get_status', self::status_params( (int) $s->id ) );
                         if ( is_wp_error( $spec ) ) {
                                 $errored[ (int) $s->id ] = $spec;
@@ -70 +70 @@
 
         /**
+         * What a status pull hands the site: its known vulnerabilities, for the
+         * warning rows on its own Plugins screen (child 0.9.0+; older children
+         * ignore it). An empty list with on=false tells the child to clear them.
+         *
+         * @param int $site_id Site ID.
+         * @return array
+         */
+        private static function status_params( $site_id ) {
+                $on = (bool) Omnis_Settings::get( 'vuln_notices', 1 ) && class_exists( 'Omnis_Vuln' );
+                return array(
+                        'vuln_notices' => array(
+                                'on'    => $on,
+                                'items' => $on ? Omnis_Vuln::notices_for_site( $site_id ) : array(),
+                        ),
+                );
+        }
+
+        /**
          * Sync a single site (on-demand path).
          *
@@ -81 +99 @@
                 }
 
-                $spec = Omnis_Connection::build_request( $site, 'get_status' );
+                $spec = Omnis_Connection::build_request( $site, 'get_status', self::status_params( (int) $site_id ) );
                 if ( is_wp_error( $spec ) ) {
                         self::process_result( $site, $spec );

siteward/trunk/includes/class-omnis-uptime.php

@@ -339 +339 @@
                         // otherwise be dropped from the recomputed flags.
                         'vulns'          => $row && ! empty( $row->vulns ) ? json_decode( $row->vulns, true ) : array(),
+                        'php_version'    => $row ? (string) $row->php_version : '',
+                        'wp_version'     => $row ? (string) $row->wp_version : '',
                         'load_time_ms'   => $is_up ? (int) $resp_ms : ( $row ? (int) $row->load_time_ms : 0 ),
                         'is_up'          => $is_up,

siteward/trunk/includes/class-omnis-vuln.php

@@ -467 +467 @@
 
         /**
+         * What a site's own Plugins screen should warn about: one short entry per
+         * affected plugin, sent to the child with each status sync. Informational
+         * advisories are left out, as they are from the flag. The child shows an
+         * entry only while the plugin is still on the version scanned here.
+         *
+         * @param int $site_id Site ID.
+         * @return array List of { file, version, severity, count, fix, unfixable, cve, title, link }.
+         */
+        public static function notices_for_site( $site_id ) {
+                $real = array_filter(
+                        self::for_site( $site_id ),
+                        function ( $f ) {
+                                return 'plugin' === ( $f['y'] ?? '' ) && '' !== (string) ( $f['f'] ?? '' ) && empty( $f['e']['n'] );
+                        }
+                );
+                $out = array();
+                foreach ( self::group( $real ) as $g ) {
+                        // The advisory to name: the worst one, preferring one with a CVE.
+                        $rank = array_flip( self::SEVERITIES );
+                        $pick = null;
+                        $best = PHP_INT_MAX;
+                        foreach ( $g['entries'] as $e ) {
+                                $r = isset( $rank[ self::severity( $e ) ] ) ? $rank[ self::severity( $e ) ] : 99;
+                                if ( null === $pick || $r < $best || ( $r === $best && empty( $pick['c'] ) && ! empty( $e['c'] ) ) ) {
+                                        $pick = $e;
+                                        $best = $r;
+                                }
+                        }
+                        $out[] = array(
+                                'file'      => (string) $g['file'],
+                                'version'   => (string) $g['version'],
+                                'severity'  => (string) $g['worst'],
+                                'count'     => (int) $g['count'],
+                                'fix'       => (string) $g['fix'],
+                                'unfixable' => ! empty( $g['unfixable'] ),
+                                'cve'       => isset( $pick['c'] ) ? (string) $pick['c'] : '',
+                                'title'     => isset( $pick['t'] ) ? (string) $pick['t'] : '',
+                                'link'      => $pick ? Omnis_Vuln_Feed::link( $pick ) : '',
+                        );
+                }
+                return $out;
+        }
+
+        /**
          * A site's findings, already grouped by software (for the site detail page).
          *

siteward/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 0.16.2
+Stable tag: 0.17.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -87 +87 @@
 
 == Changelog ==
+
+= 0.17.1 =
+* New: known-vulnerability warnings on each site's own Plugins screen. With each sync the dashboard hands a site its matches, and a row appears under each affected plugin with its rating and the version that fixes it, for people who can update plugins there. On by default; switch it off under Settings, Vulnerability feed (for example if clients log in). Needs Siteward Child 0.9.0 or later on the site.
+* New: Unsupported PHP flag. A site running a PHP version that no longer gets security fixes (8.1 and older today) is flagged, with its own filter on the Sites page. The end-of-support dates come from php.net and are kept in one list in the plugin, so 8.2 is flagged automatically once its support ends on 31 December 2026.
+* New: the site page shows when a site's PHP version stops getting security fixes, from six months before the date, and how long ago it stopped for older versions.
+* New: Outdated WordPress flag, for sites two or more major releases behind the latest WordPress, with its own filter. The site page shows how many releases behind it is.
 
 = 0.16.2 =

siteward/trunk/siteward.php

@@ -4 +4 @@
  * Plugin URI:        https://omniswp.com/features/
  * Description:        Monitor and update many WordPress sites from one lightweight, self-hosted dashboard: uptime monitoring with email alerts, one-click and bulk core/plugin/theme updates, and critical-error detection.
- * Version:           0.16.2
+ * Version:           0.17.1
  * Requires at least: 5.8
  * Tested up to:     7.1
@@ -20 +20 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'OMNIS_VERSION', '0.16.2' );
+define( 'OMNIS_VERSION', '0.17.1' );
 define( 'OMNIS_DB_VERSION', '10' );
 define( 'OMNIS_FILE', __FILE__ );