外掛標籤
開發者團隊
原文外掛簡介
SiteSelf is a service that works on your WordPress site for you — updating
content, adjusting your design, keeping an eye on things — and reports back in
chat. This plugin is the part that lives on your site, and it exists so your
agent can work on your theme and plugin files rather than content alone.
What it can do
Read and write files inside your themes and plugins folders
Tell your agent how the site is built: WordPress and PHP versions, active
theme, installed plugins, and which company hosts the site
Clear caches
Keep a log of everything it did, readable under Tools → SiteSelf
What it will not do, by design
It never runs code that is sent to it. There is no remote code execution.
It never reads credentials belonging to other services. It reads a short,
fixed list of settings that describe how your site is built, and refuses
anything that looks like a key, token or password.
It writes only inside your themes and plugins folders. Both folders are
resolved before anything is written, so ../ cannot climb out of them, and a
file that turns out to be a shortcut to somewhere else (a symlink) is refused
rather than followed.
It cannot edit files that WordPress itself would not let you edit. Whether a
request is allowed is WordPress’s decision, using the same permissions as its
built-in editors — so DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, a managed
host that switches file changes off, and multisite’s rule that only a network
administrator may touch shared plugin files all apply here too.
Before replacing a file it keeps a copy of the previous version, and it
refuses to save PHP that has a syntax error.
How access works
The plugin adds no new way into your site. Every request must come from a
signed-in WordPress user with the right permissions, using WordPress’s own
application passwords — which you create, and can revoke at any time under
Users → Profile → Application Passwords. Deactivating this plugin stops file
access immediately.
External services
This plugin connects your site to SiteSelf, a service run by Refact at
https://siteself.com. The plugin is the site-side half of that service and is
not useful without it.
The plugin makes no outbound requests of its own. It sends nothing anywhere,
on any schedule. What it does is answer requests that SiteSelf makes to your
site, and it answers them only when they carry a signed-in WordPress user with
administrator permissions — an application password that you created and can
revoke.
What leaves your site when SiteSelf asks. A status request returns a
description of how this site is built:
your site’s name, home address, admin address and language
your WordPress and PHP version numbers
every plugin installed, with its version and whether it is active
your active theme, its version, and whether it is a child theme
which company hosts the site, any must-use plugins that identify them, and
whether the host reports this as a staging copy
the server software string and the file path WordPress is installed at
how many published posts and pages you have
whether this site permits file changes
a public key this plugin creates for the site, so that moving to a new
domain does not look like a different site. The matching private key never
leaves your server — not to SiteSelf, not in any request.
Other requests return the contents of a file inside your themes or plugins
folders, a folder listing, or one of a short fixed list of WordPress settings
that describe how the site is built. Nothing else is readable, and anything
whose name looks like a key, token, secret or password is refused.
Your site’s content is not sent by this plugin. No visitor data, analytics or
personal data of your users is collected, sent or stored by it.
Service terms: https://siteself.com/terms
Privacy policy: https://siteself.com/privacy
