Notas da versão 1.2.3: 1 reforço de segurança
Segurança
- Fixed an authentication bypass affecting all REST API endpoints that responded to unauthenticated requests.
Changelog do WP Debug Toolkit Pro
O que mudou em cada versão, da mais recente para a mais antiga. As notas são as publicadas pelo desenvolvedor, no idioma original.
- Mais recente 1.2.3
- 7 versões
Notas da versão 1.2.2: 2 correções 1 reforço de segurança
Correção
- Viewer login failing on hosts that strip cookies from API responses
- Blocklist typo and missing entries left rate-limit.db, viewer-settings.db, and rate-limit.json readable via the file viewer endpoint
Segurança
- Global rate-limit floor on viewer auth, protects against rotating-IP brute-force attempts
Notas da versão 1.2.1: 2 correções
Correção
- Plugin updates failing with "Unauthorized" for Early Supporter / legacy licenses
- Open_basedir warnings flooding the PHP error log on non-Flywheel hosts with restrictive open_basedir
Notas da versão 1.2.0: 20 novidades 6 melhorias 13 correções 5 reforços de segurança
Novidade
- Time-limited query recording with shareable URLs and automatic stop, record queries on demand instead of leaving capture always on
- Group duplicate log entries toggle with count badges in the viewer
- Performance warnings on Overview page when debug mode or query logging is enabled
- Proxy and CDN support, disable IP binding toggle for proxied environments, with Cloudflare and Akamai header detection
- Manage session IP binding from the WordPress admin Viewer Settings tab
- View and clear rate-limited IPs from the WordPress admin Viewer Settings tab
- Flywheel hosting compatibility
- wp-config.php writability diagnostics in Site Health with safe temporary permission elevation
- wp dbtk api command group, discover, list, show, search, call, edit, export, import, and bootstrap REST API endpoints from the terminal
- Semantic annotation layer for wp dbtk api edit, method-level descriptions, safety classification, auth notes, return-shape notes, tags, and verification markers; persisted across discovery rescans
- wp dbtk api export / import for portable annotation packs with merge and replace-source modes
- wp dbtk api bootstrap, generate a Markdown brief of a plugin's endpoints for fresh agent sessions
- wp dbtk query-log start/stop/status/read commands for recording control and query analysis from the terminal
- wp dbtk log read command for filtered debug log reading from the terminal
- Summary and --memory flags for wp dbtk query-log read, view per-page performance overview and memory usage from recordings
- Profile flag on wp dbtk api call with full, queries, and summary modes
- CLI documentation suite, setup guide, usage guide, command reference, AI assistant guide, REST endpoint profiling guide
- Q keyboard shortcut to open the query recording dialog, with a shortcut badge on the Record button
- Reinstall Viewer action on the Overview page, regenerates viewer files without re-prompting for password; bound to the I shortcut when the viewer is installed
- "Always Logging" warning pill with tooltip on the Database Queries card when SAVEQUERIES or enhanced logging is persistently enabled
Melhoria
- Lazy-load services, deferred to point-of-use instead of eager init on every request
- Cache health check results for 5 minutes with auto-invalidation on settings change
- Faster admin page loads, cache license API responses and pass initial settings inline to eliminate redundant API calls
- Settings now work on hosts with restrictive file permissions via automatic permission elevation and restore
- Actionable error messages for admin users when settings fail to save
- Replace SAVEQUERIES with filter-based query capture for safer API endpoint profiling
Correção
- PHP 8.4 deprecation warning for E_STRICT constant in notifications mu-plugin
- Session IP binding failures behind load balancers and CDNs
- Viewer install no longer blocked by read-only wp-config.php
- Graceful degradation when wp-config.php is not writable
- Settings page showing the wrong status for debug, query logging, and other toggles
- File path detection showing empty in Settings when initial page data is used
- Viewer session authentication failing on local HTTP environments
- Viewer password status showing the wrong value on the Settings page
- Viewer settings modal not closing after a successful save
- Viewer theme out of sync between the sidebar toggle and the Settings modal
- Viewer sidebar "Keyboard Shortcuts" button now opens the shortcuts reference
- License activation state not syncing across admin sections without a page reload
- wp dbtk query-log stop no longer disables global query logging when ending a recording session; stats labels clarified to distinguish session totals from log totals
Segurança
- Harden standalone viewer, add execution guard, expand blocked files list, and add directory listing protection
- Tighten wp-config backup file permissions to 0600
- Strengthen encryption key generation in viewer manager
- Improve HTTPS detection on local domains
- Comprehensive security hardening: input validation and sanitization, API response hardening, session and CSRF improvements, data exposure prevention, and cleaner deactivation/uninstall lifecycle
Notas da versão 1.1.0: 22 novidades 9 melhorias 9 correções 13 reforços de segurança
Novidade
- Query Logger - Real-time database query monitoring with slow query detection and performance metrics
- Query Statistics Dashboard - Visual insights into query performance and component-level breakdowns
- N+1 Query Detection - Automatically identifies and highlights repeated queries with aggregate statistics
- Database query error logging with detailed error messages and filtering
- Query export to CSV, JSON, and TSV formats with accurate component attribution
- Dynamic query statistics that recalculate based on active filters
- WP-CLI commands for license activation, debug toggling, viewer setup, and log management (wp dbtk)
- Email notification system for error alerts with customizable templates
- Automatic log cleanup with delete/archive/truncate methods, size limits, and age-based rotation
- Viewer permissions health check with repair button in Site Health
- Viewer settings for query dashboard limit, tail scan MB, max entry MB
- PHP memory limit management (writes to wp-config.php)
- Upload limit controls via WordPress filters
- Settings UI redesign with modern tabbed interface
- Modular licensing system with grandfathered benefits for early adopters
- Oversized entry warnings and “Large” filter in Query Viewer
- Custom file paths configuration (DBTK_CONFIG_PATH, DBTK_LOG_PATH constants)
- Error level selection in Settings (Debug, Info, Warning, Error)
- Cache busting in Admin and Viewer apps
- WordPress internationalization (wp-i18n) support
- Psalm static analysis with type hints
- Partner discounts page
Melhoria
- Production and performance warnings in setup wizard for debug mode and query logging
- “Install without tools” option to set up the viewer without enabling debugging tools
- Setup wizard defaults tools to disabled, users opt in consciously
- Viewer installer wizard with step-by-step guidance
- Redesigned crash recovery system with cleaner UI and granular plugin/theme controls
- License management moved to Settings page
- Targeted cache clearing (plugin-specific transients only)
- Enhanced output buffer management
- Better type safety and code quality across PHP and React code
Correção
- Query Viewer tail reader no longer returns 0 entries on huge final log line
- Viewer auth rate limiter fallback when PDO SQLite is unavailable
- Directory permission issues on restrictive servers (umask handling)
- Viewer installation on hosts where WordPress files are in subfolders
- Path validation now supports relative paths securely
- Health check now properly loads WordPress admin functions
- Admin CSS isolation prevents conflicts with other plugins
- Compatibility with UiPress Lite and WP Dark Mode
- wp-config.php duplicate constants when reinstalling viewer
Segurança
- Query logs encrypted at rest
- Password protection now mandatory for viewer (8-character minimum)
- SQLite-based rate limiting with progressive brute-force protection
- Enhanced session security with 30-minute timeout and IP binding
- Strengthened path traversal prevention with expanded blocklist
- Replaced exec with token_get_all for PHP syntax validation
- Fixed wp-config.php case-sensitivity bypass vulnerability in viewer
- Added protection for secure-debug.php (GridPane compatibility)
- Scoped CORS headers to plugin endpoints only
- Restricted wp-config backup file permissions
- Hardened viewer config and auth files against direct access
- Expanded viewer blocked files list with additional sensitive file patterns
- Added directory listing protection for query log storage
Notas da versão 1.0.1: 1 novidade 2 melhorias 3 correções
Novidade
- Full GridPane hosting compatibility
Melhoria
- Simplified configuration file detection logic
- Better error messages for file permission issues
Correção
- Critical GridPane issue where uninstalling the plugin would break sites due to secure-debug.php dependency
- Debug constants modification for non-standard wp-config.php structures
- Log viewer access for logs stored outside the web root
Notas da versão 1.0.0: 1 melhoria
Melhoria
- Initial release
Versão na DROPE: 1.2.3
As versões disponíveis na DROPE são liberadas para assinantes e para quem comprou o produto.
O que mudou
110 mudanças em 7 versões
- Novidade 43
- Melhoria 18
- Correção 29
- Segurança 20