bonny / wordpress-simple-history

🔍🕵️‍♀️ WordPress audit log that track user changes in WordPress admin using a nice activity feed.

Simple History

A WordPress activity log for what matters

Simple History is a WordPress audit log plugin that logs various things that occur in WordPress and then presents those events in a very nice GUI.
It's great way to view user activity and keep an eye on what the admin users of a website are doing.

Installation

Download from WordPress.org and activate.

Usage

Viewing history events

This screenshot show the user activity feed:

• It has an active filter/search in use:
  • only show changes performed by a specific user
  • it only shows event that are of type post and pages and media (i.e. images & other uploads)
• A thumbnail is shown for the image that is uploaded

Events with different severity

Simple History uses the log levels specified in the PHP PSR-3 standard.

Quick diff lets you see what's changed

Events have context with extra details

Each logged event can include useful rich formatted extra information. For example: a plugin install can contain author info and a the url to the plugin, and an uploaded image can contain a thumbnail of the image.

Plugin API

Developers can easily log their own things using a simple API:

<?php

// This is the easiest and safest way to add messages to the log
// If the plugin is disabled this way will not generate in any error
apply_filters('simple_history_log', 'This is a logged message');

// Or with some context and with log level debug:
apply_filters(
	'simple_history_log',
	'My message about something',
	[
		'debugThing' => $myThingThatIWantIncludedInTheLoggedEvent,
		'anotherThing' => $anotherThing
	],
	'debug'
);

// Or just debug a message quickly
apply_filters('simple_history_log_debug', 'My debug message');

// You can also use functions/methods to add events to the log
SimpleLogger()->info("This is a message sent to the log");

// Add events of different severity
SimpleLogger()->info("User admin edited page 'About our company'");
SimpleLogger()->warning("User 'Jessie' deleted user 'Kim'");
SimpleLogger()->debug("Ok, cron job is running!");

You will find more examples in the examples.php file.

Development

Running tests

See the README in tests directory.

Sponsors

Support the free version of Simple History by becoming a sponsor. You can sponsor using PayPal or becoming a GitHub Sponsor.

wordpress-simple-history's Issues

How to find a directory

__DIR__ . "/../

Please be advised how to do this:
https://github.com/Yoast/wordpress-seo/blob/trunk/wp-seo.php#L36-L38
https://github.com/Yoast/wordpress-seo/blob/trunk/wp-seo-main.php#L13-L29

Wrong capability for settings menu

Update capability to edit_settings:
http://wordpress.org/support/topic/wrong-capability-for-settings-menu
"all settings/options pages should require the capability manage_options because that's what this capability is there for."

Screenshots

As WP recommends please move PNG-s to /assets.

Plugin update results in Post "" updated

Hello,

when I update a plugin, the rss feed only displays following:
Post "" updated

Is it possible to implement this by default that your hooks covers plugins too?
e.g. Plugin "xyz" updated

Or did I have to implement it in the the theme with your provided function myself?
In my opinion I think Plugin should treated the same way as posts and implement by the plugin as default.

Nevertheless great work so far, keep at it!

BR,
mybecks

prev ajax call should be cancelled if new one is inititated before the old is finished

if not: otuput can "flicker"

Non-WP.org plugin's "View plugin info"

Please handle non-WP.org plugins.

Filter for user role

Option/filter to filter the history for specific user roles. Too much info for the common user sometimes.

Add option to log IP address of the admin Logins

IP logging would be good even for successful login.

People accidentally save passwords on public computers or someone else's computers, so, it'd be good to have a trace of IP address from which they've logged in.

Examples for custom history events do not work as written

On the wordpress plugin page there are several examples of using PHP to do custom events that don't seem to work. I found that I had to add the object_id array item to get it to accept the simple history, otherwise it would fail silently.

links in RSS feed kinda don't go anywhere

I have an crazy idea: let them go somewhere!

Lightbox

Please consider using WP's Thickbox (when clicking on the date)
as in https://github.com/szepeviktor/option-inspector this plugin shows the values of serialized wp-options.

database error during install

got this when doing install using wp-cli:

Activating 'simple-history'... WordPress databasfel för Unknown column 'action_description' in 'field list' förfrågan INSERT INTO wp_simple_history SET date = '2013-06-17 10:04:47', action = 'activated', object_type = 'plugin', object_subtype = '', user_id = '0', object_id = '', object_name = 'Simple History', action_description = '' skapat av include('/Users/bonny/.composer/vendor/wp-cli/wp-cli/php/wp-cli.php'), WP_CLI\Runner->after_wp_load, WP_CLI\Runner->_run_command, WP_CLI::run_command, WP_CLI\Dispatcher\Subcommand->invoke, call_user_func, Plugin_Command->install, WP_CLI\CommandWithUpgrade->install, Plugin_Command->install_from_repo, Plugin_Command->activate, activate_plugin, do_action('activate_simple-history/index.php'), call_user_func_array, simple_history_install, simple_history_add Success: Plugin 'simple-history' activated.

Option to filter RSS feed

Add filters to RSS feed, so user can get feed of only actions performed by a specific user, for attachments, for posts, etc.

Clean code

Please avoid globals

$GLOBALS["simple_history"] = new SimpleHistory();

and constantly changing contants in a class.

const VERSION = "2.0.21";

The plugin's main file is for storing the version.

Add simple_historymeta table

Adding a meta table would be nice to share more information associated with any log event. The meta table would be:

CREATE TABLE wp_simple_historymeta (
meta_id bigint(20) unsigned NOT NULL AUTO_INCREMENT,
event_id bigint(20) unsigned NOT NULL DEFAULT '0',
meta_key varchar(255) DEFAULT NULL,
meta_value longtext,
PRIMARY KEY (meta_id),
KEY event_id (event_id),
KEY meta_key (meta_key)
);

WordPress have a builtin Metadata API that would be nicely added. http://codex.wordpress.org/Metadata_API

Hook to display UI for only one user

Do you have a hook to display Simple History UI for only an array of userID-s?

Add reload-button

Make it easier to reload the history by adding a reload-button. Currently you have to click the search-button or reload the page completely.

Location of button: how about at bottom, where the pagination/nav is? Next to the item count would be logical I think.

Add uninstall.php

Currently the plugin in nasty: it creates a table, but does not remove it during uninstall.

Reference:

http://www.wptavern.com/plugin-developers-use-uninstall-php-please?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+WordpressTavern+%28WordPress+Tavern%29

Admin <--> frontend

Please consider separating frontend code from admin code.

Admin code shouldn't be parsed and executed on frontend calls.

Log delete media replace and remove media

it would be great if we can log media deleted and replace media when you use enable media replace

https://wordpress.org/plugins/enable-media-replace/

username unknown when logging in via oauth

I just started using an oauth plugin that allowed me to login to wordpress using my google account. The message in simple-history was "Unknown user logged in warning". The details contained my actual user login. The oauth plugin i used is perrybutler/WP-OAuth in github.com. The _user_login field in the message details is correct.

id  9613
logger  SimpleUserLogger
level   warning
date    2015-01-17 21:17:17
message     Unknown user logged in
type    
initiator   wp_user
occasionsID     706f252c2c3e693a80cb250d010a398e
subsequentOccasions     1
rep     1
repeated    1
occasionsIDType     706f252c2c3e693a80cb250d010a398e
context_message_key     user_unknown_logged_in
_message_key    user_unknown_logged_in
_user_id    1
_user_login     hdeadman
_user_email     [email protected]
_server_remote_addr     123.123.123.123

Build process

You can add a small script to the plugin build process that optimizes out code like this

if ( defined("SIMPLE_HISTORY_LOG_DEBUG") && SIMPLE_HISTORY_LOG_DEBUG ) {

These shouldn't get into releases.
So a build process separates source code from the released software package.

Anyone wishing to debug could directed here to this repo.

add option to configure items per page

add an option to display Number of items per page for dashboard, instead to get the same parameters for dashboard and page, maybe a filter would be great

add option to enable/disable RSS Feed

RSS Feed is a good idea but i think when you don't use this option to disable it with enable field.

When you enable RSS Feed, the RSS feed generate, When you disable RSS Feed, the feed isn't generate.

Decent plugin name

Please consider some day a descriptive name for the plugin file instead of index.php.
You must know this change will deactivate the plugin.

Possibility to disable icon for user

Hi,
when you go on dashboard or on history page, it would be great if we can disable icon (gravatars) for user when we don't use it.

Notice: Trying to get property of non-object @upload

Try uploading the latest Sucuri Scanner

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 453

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 454

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 455

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 456

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 457

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 458

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 459

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 460

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 461

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 462

Notice: Trying to get property of non-object in /var/www/subdirwp/server/static/plugins/simple-history/loggers/SimplePluginLogger.php on line 463

deleted user hidden from nav

Also if/when I delete a user who had a history log, their username appears to just be "hidden" from the navigation instead of removed. For example, if my user navigation links look like:

By all users | mr-so-and-so | mr-hello | mr-wp-guy

If I delete users mr-hello and mr-wp-guy the links look like:

By all users | mr-so-and-so | |

source:
http://wordpress.org/support/topic/a-couple-of-chnages-and-suggestions?replies=6#post-4342819

datepicker range to filter result

add datepicker range to filter search result on dashboard and History pages

Check upgrade prodecure - db updated over and over

Got this from a user, double check the upgrade function:

...from 1.3.2 to 1.3.4....we are seeing a message printed to the history over and over every few minutes while logged in:

"Plugin "Simple History" upgraded it's database"
Details "Database version is now version 2"
+8 occasions

Filter for user in 2.0.4 not working

Trying to set a user, I managed to select a user in the drop-down, but then the UI looks like this and the filter yields no result (although there are entries from the selected user):

WP 4.0.1 on Linux, browser on Windows, both in FF and Chrome

Fine Tune what is logged

Hi. Firstly great Plugin. Thanks!

Unfortunately my website DB is getting overloaded by the entires created by this Plugin. What I really need is a way to fine tune what is/isn't logged.

Is this possible/in the works?

Much appreciated

Some entries missing in the French PO file

Dear Pär,

I discovered your great "Simple History" plugin today and installed it on a freshly updated French-speaking WP installation. It was very well translated overall. However, when clicking on "Simple History" in the "Dashboard" menu I bumped into a sentence in English: "1 event today from one user" which was not translated. And on the side, there was a "Filter history" form with all entries in English...

After checking the French PO file, I did not find any untranslated entries. Maybe this PO file has not be regenerated for a while from the source code, maybe these untranslated entries are still not considered as translatable... Is it normal?

I hope it helps. Thanks in advance, and happy holidays!

David.

Admin-frontend separation

Is it a good idea to separate code for admin pages and the frontend?

Maybe you could benefit from it:

• more managable code
• faster execution

Add more options to an event, as free text

Make it possible to add much more info about av event/object, as plain text. Will not be translateable, but can be very useful in some cases when more details about something is nice.

Show icons/images for events

Would be nice to be able to show image if event is attachment. Perhaps users also. More types?

Add faq box who resume each log level

i think a new faq box below filter history box on simple history page would be great to memoring each color for actions. Sometimes you doesn't know exaclty which action is egal to log level

Debug : Update option action
Info : Edit Page / Menu etc...
Warning : Error login

Code design

https://github.com/bonny/WordPress-Simple-History/blob/master/templates/settings-statsLoggers.php
Please consider functional separation.

• a function to query the DB ($wpdb->prepare())
• a function to calculate values into one object
• a function to ouput the template
• a function to include CSS, JS

You must know MVC.

Rename Simple History to PRISM

On my mind since the whole thing buzzed in the USA and worldwide. Is it easy enough to rename this plugin? Or does it mean that users lose all their data?

• It can be the WP version of the internationally infamous spying/monitoring system.
• It sounds catchy
• It's easier to type prism_{function} instead of simple_history_{function}.
• The plugin name is still available in the plugin repository.

I'm falling for the catchy part.

This is not an urgent request/question, but can be implemented when introducing the rewritten codebase of this plugin, containing

• fully integrated log modules
• better usage of i18n
• separated functionality
• support for all essential core events
• support XML-RPC events
• support in-dev JSON events
• better code documentation
• multisite support
• more 3rd party plugin support?

Use extender class for hooking core plugin events

For cleaner code and separation of plugin functionality, we should hook the plugin core events using the extender class. This also lets users enable/disable the registration of these events so they can select only the events they want to be recorded.

simple_history/db_purge_days_interval

Do you mean simple_history/db_purge_days_interval is days to keep?

Maybe someone will misunderstand it.
It sounds like how often do you want to purge the history.

Classes in the plugin's folder

WP scans the plugin's folder for *.php.
Plese consider moving classes to a subdir.

Create some unit tests

Would be nice to have some unit tests associated to the API.

capability to view log should be for admins only?

as reported here:
http://wordpress.org/support/topic/wrong-capability-for-settings-menu?replies=3

"the History page under the Dashboard menu is also requiring the capability edit_pages. I suggest you change it as well; browsing the history and seeing who did what should be a task of admins only."

what's the best capability to use? manage_options?

MySQL optimization

If you are querying the DB by other fields than id there should be indexes for those queries.
https://github.com/bonny/WordPress-Simple-History/blob/master/inc/SimpleHistory.php#L1003

A simple way to debug it is to turn on
http://dev.mysql.com/doc/refman/5.5/en/server-system-variables.html#sysvar_log_queries_not_using_indexes
on your dev box.

Color statues for items [created/deleted]

a color status for enable, disable, create, delete items

test to see if post types should have no prefix

the different post types are named like: Post/Post, Post/Page, Post/Custom_post_type etc. ...streamlining this to only the name of the post/cpt?

Add loading indicator

Export function to CSV

an export function to csv for log based on the filter selection. it's more a tool for project director and for security manager.

Plugin API Example links to 404 page

in the readme in the Plugin API section it says "See more examples at simple-history.com/docs" but the link takes the user to a 404 page in simple-history.com.