xwp / stream

🗄️ Stream plugin for WordPress

Stream for WordPress

Track WordPress user and system actions for debugging, logging and compliance purposes.

• Product Website
• Plugin on WordPress.org

Documentation

View the plugin description on WordPress.org for the list of features and screenshots.

Known Issues

• We have temporarily disabled the data removal feature through plugin uninstallation, starting with version 3.9.3. We identified a few edge cases that did not behave as expected and we decided that a temporary removal is preferable at this time for such an impactful and irreversible operation. Our team is actively working on refining this feature to ensure it performs optimally and securely. We plan to reintroduce it in a future update with enhanced safeguards.

Contribute

All suggestions and contributions are welcome! View the contributor documentation for how to report issues and setup the local development environment.

Credits

The plugin is owned and maintained by XWP. View all contributors.

stream's Issues

Add context for Pages

Page actions should be added as a core context of the Stream plugin.

Possible actions:

• Created
• Updated
• Published
• Unpublished
• Trashed
• Deleted

Add custom "pulse" menu icon

Similar to Jetpack and others, we need to add the signature Stream "pulse" icon to the WP Admin menu. It needs to be compatible with both MP6 and classic skin modes.

Add connector for Taxonomies

Taxonomies will be an important connector to add to Stream. Similar to the Posts connector we need to allow custom taxonomies to be supported automatically as well (e.g. Artists).

Create dashboard widget that displays recent activity

It would be great to extend the new Activity widget coming in WordPress 3.8 (depending on how extendable is actually is).

We could add a Configure option to this widget and allow additional contexts (made available via WP_Stream_Query) to be displayed.

Bring back action links

Action links was not implemented after the move to custom tables.

Add context for Widgets

Widget actions should be added as a core context of the Stream plugin.

Possible actions:

• Added (to a sidebar)
• Removed (from a sidebar)
• Updated
• Inactivated (where active widgets go when sidebars are removed)
• Moved (within a sidebar)

Add context for Menus

Menu actions should be added as a core context of the Stream plugin.

Possible actions:

• Created
• Updated
• Deleted
• Assigned (to a location)
• Unassigned (from a location)

Admin screen built by WP_Stream_Query

We will need to build an admin screen for Stream records (that is similar to a post type screen) using WP_Stream_Query.

Requirements:

• Filter by date
• Filter by user
• Filter by connector
• Filter by context
• Filter by action
• Search
• Pagination
• Sortable date column

Same stream shows on all blogs in multisite

When using WordPress Multisite the same stream content shows up for all blogs on the multisite. Other blog owners should not see the actions of other blogs.

This is a fairly simple fix. Add a blog_id column to the {prefix}_stream table. When inserting a new log entry in addition to storing the site_id (for multi-network installs) also store the specific blog id.

Another boon to this is that a stream log viewer can easily be created in the network admin area to monitor the changes across the network.

User context always (incorrectly) assumes that $current_user is only updating their own profile

Within the Users context, when a profile Stream assumes that $current_user is always editing their own profile. However, it could be that an Administrator user is updating someone else's profile on their behalf.

Therefore, the post_author for these stream posts should always be $current_user, but the summary data should still reference the user whose profile was updated.

This same principle can apply to other actions as well, such as registering other users.

Failed login attempts are treated as a "logout" action

When a user has a failed login attempt it's recorded in the stream as a "logout" action by an unknown user.

This is not the desired outcome:

The desired outcome would be something like this:

Confirmation dialog for manual Stream db reset

AJAX loading for user filter in list table

Load users via AJAX, to accommodate for sites with thousands of users. Only use AJAX if user count is more than 50 user.

Using Select2 is preferred, due to the support/activity compared to chosen, and the built-in AJAX of course.

Add context for Media

Media actions should be added as a core context of the Stream plugin.

Possible actions:

• Added
• Attached
• Unattached
• Updated
• Edited (images have an edit mode)
• Deleted

Installer update summary lacking plugin name and version

I recently updated a plugin and neither the plugin name or version was included in the record summary.

Remove some built-in post types from Context filter

I think that some built-in post types need to be filtered out of the Context dropdown (e.g. Attachments, Navigation Menu Items, and Revisions) because no actions are ever available for them.

I realize this might be related to #49 because that would make the loading of Contexts relative to what Contexts are even available via AJAX. But until that can be implemented, perhaps we should remove these for now.

Remove brackets from widget names in Summary

Widget names are currently bracketed when mentioned in record Summaries and I don't think it's necessary.

Use rounded gravatar images in list table

1. I think making user Gravatar images circular would look really slick, especially with the new MP6 skins which is coming standard in WordPress 3.8.

2. The 3px rounded edges also looks nice (as seen on WP.org).

3. The default square image is just boring.

Add connector for Settings API

A major connector that needs to be a core part of Stream are changes that are made to WordPress settings.

It would be amazing if we could break down the Settings connector into different Contexts programmatically based on the $page where that setting lives.

For instance, the Site Title setting would belong to the General context, and the Blog pages show at most setting would belong to the Reading context.

Default settings pages:

• General
• Writing
• Reading
• Discussion
• Media
• Permalinks

Menu name not appearing in summary if deleted while assigned

There is a special circumstance in which the menu name does not appear in the record summary. When a menu is currently assigned to a theme location and is suddenly deleted, two actions are performed.

Firstly the menu is logged as deleted, and secondly, it is logged as unassigned from the theme location.

This causes the menu name to be omitted from the second record. It would be ideal if there was a way to switch the order of the two in this case.

Add context for Plugins

Plugin actions should be added as a core context of the Stream plugin.

Possible actions:

• Installed
• Activated
• Deactivated
• Deleted
• Updated
• Edited

Purge records after defined amount of time

User context should log when users are deleted

I deleted a user account today and noticed that Stream did not log an entry for a deleted user. We should add a "Deleted" action to the User context.

Add connector for Errors

Actions that result in errors should be added as a core part of the Stream plugin.

@shadyvb Should we save errors to the wp_stream table with the type column as error instead of stream? Then the action record that caused the error would become the parent and the error type could be saved as record meta.

Error types:

• Notice
• Warning
• Fatal
• WP Error

Add context for Themes

Theme actions should be added as a core context of the Stream plugin.

Possible actions:

• Installed
• Activated
• Deleted
• Updated
• Edited

Implement Chosen select boxes for record filters

I think a great UI enhancement would be to use Chosen select menus for the filters which will better accommodate long dropdowns. For instance, if there are thousands of registered users on a site the current UI would be very cumbersome.

UI enhancements

The initial version should have some more attractive UI, i'm not suggesting anything, just saying it would be better if we make it more pleasant.

Suggestions ?

@fjarrett

Add support for Screen Options to list table screen

It would be ideal to add support for the Screen Options tab so that columns on the records list table can be customized by users.

Live update of activity records in the stream

Since we now have the Heartbeat API available to us since WordPress 3.6 I think a great enhancement would be to query the latest records into the stream live.

Simply put, this would just be a pseudo-realtime refresh (every 15 seconds) of the records in the database, and we could briefly flash the new records with a faint color as they enter into the stream.

Notices/warnings thrown upon theme activation

Upon activating various themes there are notices/warnings being thrown by the menus/widgets connectors.

Notice: Undefined index: nav_menu_locations in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/menus.php on line 132

Notice: Undefined index: sidebar-4 in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/widgets.php on line 108

Warning: array_diff(): Argument #1 is not an array in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/widgets.php on line 111

Warning: array_diff(): Argument #1 is not an array in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/widgets.php on line 118

To reproduce, try activating Twenty Fourteen and then activate Twenty Eleven.

RSS feed access

There should be alternative access to Stream records via RSS. This will allow other applications to consume the data Stream is recording.

I think that every user should have their own secure key in order to access the feed:

http://mysite.com/?stream_rss_feed=iMGk3456B2x34L7vrD2uET18554n7rE4

This will ensure full compatibility with #59, so that if their Role's access has been denied from Stream, they will no longer be able to access the RSS feed. By having a unique key for each each it also allows restricting access on an individual user basis in the future.

This would need to appear in every user's profile that belongs to a role where access to Stream has been granted:

Add records per page setting to Screen Options

It would be great to add this to the Screen Options tab, just as it works for post types.

I think the default should be 20 instead of the current default of 10.

This will be especially handy since there will likely be thousands of records available and it may be desired to increase this to a large number to avoid hundred of pages of pagination.

Notice thrown when assigning or unassigning a menu from a theme location

A notice is thrown by the menu connector whether assigning or unassigning a menu from a theme location.

Unassigning

Notice: Undefined property: WP_Error::$name in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/menus.php on line 157

Assigning

Notice: Undefined property: WP_Error::$name in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/connectors/menus.php on line 141

Allow commenting on records in the stream

It would be great to allow conversions to take place on activity via comments, and to send an email alert when "Someone has commented on your activity."

To do:

• Create mockup example of comments in the Stream
• Decide on architecture for storing comments
• Create settings for Comments
• Create email template for comment notifications

Option to backup data before resetting Stream database tables

Media appears in Context filter dropdown twice

Fatal error occurs when deleting a menu

Upon deleting a menu under Appearance > Menus a catchable fatal error occurs.

Catchable fatal error: Object of class stdClass could not be converted to string in /srv/www/wordpress-trunk/wp-content/plugins/wp-stream/includes/log.php on line 58

Action filter dropdown and search input conflict

I'm encountering a strange bug when the search input is given focus the action dropdown suddenly goes blank.

I thought maybe there was some sort of naming conflict in the page source, but I can't seem to spot one. Also, there's nothing happening in the console, which would seem to rule out any JS issue.

Master branch build failing

The master branch build is failing on Travis CI, we should aim to get this build passing as soon as we can.

User display name missing when new users are created

When a new user is created the name is missing from the Summary field.

Furthermore, if registration is open and a user registers themselves, the User field in the record is NA.

This is not very helpful data, I realize this could be a challenge since their user account itself is just being created, but it would be best if they are logged as the author.

In fact, it would be awesome if we could distinguish between user accounts being Created by another user or Registered via self-registration, by having two separate actions for these.

Disable Stream if wp-cli is being used

Some connectors ( like installer, which manages plugin/theme operation tracking ) are generating errors during wp-cli commands, due to usage of different upgrader classes than the one used on WordPress admin pages.
That, plus the fact that no user would be associated to actions ( so far ).

Add special support for Settings Revisions

One exciting possibility could be adding special support for the Settings Revisions plugin.

Similar to the idea of having a View Revision link when a revision exists for the post update that occurred, we could do the same if a revision exists for the setting that was updated. Except since you can't preview the revision, perhaps it could just be a simple Undo button?

/cc @westonruter

Log when widgets are removed from sidebar areas

When removing a widget from a sidebar area (by just dragging it away) the action is not logged in the activity stream.

Enable users to enable/disable connectors through an admin UI

There may be some default connectors that may not be desired, rather than having to write an mu-plugin to disable the connector, it would be easier to provide this ability as an option in the UI.

Fire cron event if auto-purge value is updated

Currently the cron event that auto-purges records based on their age is set to run once daily.

However, if the value in this setting is set to 90 days and the user changes it to 1 day they would likely expect that the next time they visit the stream that all records older than 1 day would be gone.

So instead of potentially waiting up to 24 hours for the cron to fire, we should think about forcing it to run each time this value is changed.

Require minimum PHP version for plugin activation

As part of the initial release, we must prevent the plugin from being activated if the minimum PHP version requirement (v.5.3.0) is not met.

version_compare( PHP_VERSION, '5.3.0', '<' )

This will prevent PHP 5.2 users from experiencing shocking fatal errors and not knowing what to do:

Parse error: syntax error, unexpected T_PAAMAYIM_NEKUDOTAYIM, expecting ']'

Add context args to Summary links

Currently, when clicking a Summary link we are only referencing the object_id but this is creating conflicts when users and posts (and potentially other object types) share the same ID value.

We should also include a context arg in these links to avoid this.

Allow records to be individually deleted

I would like to start a discussion about whether or not we should allow individual records to be deleted from the stream.

On one hand, it defeats the purpose of tracking activity if that activity can be deleted by admins at any time. On the other hand, it limits the control some may want over activity they don't care to see, or for some reason want to hide.

Should this exist as a core feature of Stream?

Should it perhaps exist as an extension plugin?

Or should we not allow this at all?

Add connector for Comments

Comment actions should be added as a core context of the Stream plugin.

Possible actions:

• Created
• Updated
• Replied
• Approved
• Unapproved
• Spammed
• Unspammed
• Trashed
• Untrashed
• Deleted
• Comment Flooding
• Duplicate comment attempt

Add setting for role access

We should allow Stream access to be granted to any user role.

However, I think only site Administrators (and Super Admins for multisite) should be able to access the Stream Settings screen.