Health Check plugin: Feedback needed from forum regulars

adding IRC suggestions here for reference:

– cj: https://httpd.apache.org/docs/2.2/mod/mod_proxy.html#x-headers

– beaulebens: better to use core PHP JSON stuff, but WP has compat to deal with it

X-FORWARDED-FOR: ‘<? echo $_SERVER[‘HTTP_X_FORWARDED_FOR’]; ?>’

idea from aaron:

“can a user get a list of what IS on their server (PHP version/installed modues/settings, MySQL version, etc) and copy/paste to send it to someone? (or even just enter an E-Mail address and click send)”

of interest on the x-forwarded-for thingy:

https://core.trac.www.ads-software.com/ticket/9235

I have run into a number of issues related to permissions on folders. It’s mostly related to plugins and 775 / 777 on wp-content/uploads and the ability to create files and sub-folders within. More recently since switching to a Plesk based VPS environment.

If there is anything about the user / method that creates the directories / permissions for them that can be shown?

Denis: Thanks for posting that for me. It would be useful for plugins that end up requiring a higher PHP or MySQL version than the health check plugin recommends, as well as for plugins that need something like GD or ImageMagick, etc. I could simply have the user install health check and post the output in the support forums, etc.

Listing everything that is/isn’t available / installed isn’t really the point of the health-check plugin.

I would rather keep the plugin focused on checking the configuration and health of the install for now.

It might make more sense in a separate plugin, but it would definitely be something nice to have.

Here’s what comes to mind first.

PHP Health

Check the GD library.

Check for the Suhosin extension. (This can screw up all sorts of things)

Send test e-mails and catch errors.

WordPress Health

CRC all core files to find malware.

Scan .htaccess for cloaked redirects.

Scan posts table for obfuscated script injections.

Scan term_relationships for orphaned objects.

I know you said you didn’t want to check for *everything* but mod_rewrite should be there.

Pretty permalinks won’t work without it, and if someone in 3.0 goes to add more blogs using the subfolder format, they won’t work either.

Check the GD library.
Check for the Suhosin extension. (This can screw up all sorts of things)
Send test e-mails and catch errors.

These sound good. It would nice to be able to detect specific configurations of Suhosin which cause issues if that is possible as it can easily be configured in a compatible way (much like mod_security can)

CRC all core files to find malware.
Scan .htaccess for cloaked redirects.
Scan posts table for obfuscated script injections.
Scan term_relationships for orphaned objects.

The first three sound like things that the Exploit Scanner plugin should do more than the Health Check plugin.

Is the fourth one a common issue – what is the cause and the consequence?

I know you said you didn’t want to check for *everything* but mod_rewrite should be there.

I believe Denis has added that already ??

These sound good. It would nice to be able to detect specific configurations of Suhosin which cause issues if that is possible as it can easily be configured in a compatible way (much like mod_security can)

I had a lot of experience with this at the XMB project. More than 50% of the time, the webmaster is not able to configure Suhosin because that option has been disabled at the server level. From a development perspective, the configurations that will conflict with the application are almost impossible to predict. In other words, if suhosin.post.max_vars is set to 50, how do you predict the location or magnitude of any conflict in WordPress? Given the nature of the extension, we decided diagnosing it was counterproductive, and instructed webmasters to have Suhosin uninstalled if they wanted tech support for server errors.

Is the fourth one a common issue – what is the cause and the consequence?

Yes I believe WordPress fails to delete relationships for custom taxonomies before version 2.9. Consequently, there could be a lot of garbage floating around in that table. Not sure if the upgrader actually checks for that?

see also https://core.trac.www.ads-software.com/ticket/10821

GD, JSON, mod_rewrite, IP address – done

I also added a check that suggests using the latest and greatest for each of Apache, PHP and MySQL.
https://plugins.trac.www.ads-software.com/browser/health-check/branches/alpha/hc-tests/

For the email check, it seems like a good idea, but who do we send it to? The user himself? If we rely on mail()’s return value, I suspect the test won’t be as reliable as it should be.

@aaron and westi: I like the idea of adding a checkbox near the run tests button, as in “send me the results by email”. it’s simple enough to implement, not intrusive at all, and it could be useful when delivering support.

@idealien: there is, yes. I added a check for safe_mode and another for open_basedir. When either or both are raised, it frequently means you can’t create folders.

@miqrogroove: if you’ve a potential patch to check for the stuff from Suhosin that causes problems, please send it by email.

re the lost terms, I think it should be fixed in WP directly. in the upgrader for instance.