10up / wpcli-vulnerability-scanner

WP-CLI command for checking installed plugins and themes for vulnerabilities reported on wpvulndb.com
MIT License
274 stars 40 forks source link

Add support for Patchstack API #71

Closed iamdharmesh closed 1 year ago

iamdharmesh commented 2 years ago

Description of the Change

As requested in #70, this PR adds support for Patchstack API to check reported vulnerabilities for WordPress core, installed plugins and themes.

Users can choose Patchstack API for vulnerabilities scan by adding VULN_API_PROVIDER constant in wp-config.php. By default, the current WPScan API service will be used.

define( 'VULN_API_PROVIDER', 'patchstack' );

Closes #70

How to test the Change

  1. Add a VULN_API_PROVIDER constant in wp-config.php as below.
    define( 'VULN_API_PROVIDER', 'patchstack' );
  2. Add a VULN_API_TOKEN constant in wp-config.php by getting API key from patchstack.com
    define( 'VULN_API_TOKEN', 'YOUR_TOKEN_HERE' );
  3. Try given vuln commands in readme to scan for vulnerabilities.
  4. Make sure all commands are working fine.
  5. Make sure all commands are working fine with both services (WPScan and Patchstack)

Changelog Entry

Added - Support for Patchstack API

Credits

Props @iamdharmesh, @MARQAS, @dkotter, @jeffpaul.

Checklist:

dkotter commented 1 year ago

@iamdharmesh Code here looks good to me. I spent some time to see if I could get tests to run but I had no luck. If everything else is working here, I'd suggest we comment out the Github Action (so we don't have failing actions on any new PRs), merge this in and then work on fixing the tests in a separate PR /cc @jeffpaul