Hooks in the WP Security Audit Log plugin allow you to hook into the plugin’s functionality to modify it’s behaviour. This article contains a list of hooks and parameters found in the WP Security Audit Log plugin.
Index of Hooks:
Audit Log Data Hooks
wsal_auditlog_row_user_data
Function
This filter hook runs before displaying the user data of an event on the audit log view. It can be used to filter the user data of each event being displayed on the audit log view.
Parameters
- $row_user_data – User data to display in the audit log row
- $event_db_id – Event database ID
Example Code
1 2 3 4 5 6 7 8 9 10 11 12 13 | /** /** * Method: This function filters user data before displaying on the audit log view. * * @param string $row_user_data - User data to display in the audit log row. * @param integer $event_db_id - Event database id. * @return string */ function sample_auditlog_row_user_data( $row_user_data, $event_db_id ) { // Do something here... return $row_user_data; } add_filter( 'wsal_auditlog_row_user_data', 'sample_auditlog_row_user_data' ); |
wsal_event_data_before_log
Function
This filter hook runs before saving an event in the audit log database. It can be used to filter the event data of a filter and take action accordingly.
Parameters
- $event_id – Event ID
- $event_data – Array of event data
Example Code
1 2 3 4 5 6 7 8 9 10 11 12 13 | /** /** * Method: This function filters event data before saving the event to the database. * * @param array $event_data - Event data. * @param integer $event_id - Event id. * @return integer */ function sample_event_data_before_log( $event_data, $event_id ) { // Do something here... return $event_data; } add_filter( 'wsal_event_data_before_log', 'sample_event_data_before_log' ); |
wsal_event_id_before_log
Function
This filter hook runs before saving an event in the audit log database. It can be used to detect event ids and take the required action.
Parameters
- $event_id – Event ID
- $event_data – Array of event data
Example Code
1 2 3 4 5 6 7 8 9 10 11 12 13 | /** /** * Method: This function filters event data before saving the event to the database. * * @param array $event_data - Event data. * @param integer $event_id - Event id. * @return integer */ function sample_event_data_before_log( $event_data, $event_id ) { // Do something here... return $event_data; } add_filter( 'wsal_event_data_before_log', 'sample_event_data_before_log' ); |
wsal_post_meta_updated
Function
This hook runs before the logging of post meta update events, such as event ID 2062 and 2054 (refer to the complete list of WordPress activity log event IDs for more details). This hook can be used to log events of updated post meta from the front-end, since the plugin only keeps a log of post meta updates done via the WordPress admin pages.
Parameters
- $meta_id – Unique ID of the meta data.
- $object_id – Post ID to which the meta data belongs to.
- $old_meta – Array of the meta data containing key & values of old meta data before it is updated.
- $meta_key – Key of the meta data being updated.
- $meta_value – Value of the meta data being updated.
Example Code
A general example code which shows how to log a meta data updated event in the WP Security Audit Log plugin.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 | /** * Method: Sample code for logging meta data changes event. * * @param int $meta_id - Meta ID. * @param int $object_id - Post ID. * @param array $old_meta - Array of metadata holding keys & values of old meta data before updating the current post. * @param string $meta_key - Meta key. * @param mixed $meta_value - Meta value. */ function my_post_meta_updated( $meta_id, $object_id, $old_meta, $meta_key, $meta_value ) { // Verify your meta key. if ( 'my-key' !== $meta_key ) { return; } // Get post object. $post = get_post( $object_id ); // Get post editor link. $post_editor_link = get_edit_post_link( $post->ID ); // Check if the meta key value has changed. if ( isset( $old_meta[ $meta_id ] ) && $old_meta[ $meta_id ]->val !== $meta_value ) { // Get instance of WSAL. $wsal = WpSecurityAuditLog::GetInstance(); // Log the event. $wsal->alerts->Trigger( 2054, array( 'PostID' => $object_id, 'PostTitle' => $post->post_title, 'PostStatus' => $post->post_status, 'PostType' => $post->post_type, 'PostDate' => $post->post_date, 'PostUrl' => get_permalink( $post->ID ), 'MetaID' => $meta_id, 'MetaKey' => $meta_key, 'MetaValueNew' => $meta_value, 'MetaValueOld' => $old_meta[ $meta_id ]->val, 'MetaLink' => $meta_key, 'EditorLinkPost' => $post_editor_link, 'ReportText' => $old_meta[ $meta_id ]->val . '|' . $meta_value, ) ); } } add_action( 'wsal_post_meta_updated', 'my_post_meta_updated', 10, 5 ); |
Plugin Settings Hooks
wsal_filter_deactivation_email_delivery
Function
By default the plugin sends an email to the website administrator (configured in the WordPress settings) when the plugin is disabled. You can disable this functionality by using this filter.
Example Code
1 2 3 4 5 6 7 8 | /** * Disable the email delivery on activation completely by sending. * * This will completely disable the deactivation email system if it returns true. * * @var bool */ add_filter( 'wsal_filter_prevent_deactivation_email_delivery', '__return_true' ); |
wsal_filter_deactivation_email_delivery_address
Function
By default the plugin sends an email to the website administrator (configured in the WordPress settings) when the plugin is disabled. You can change the email address to which the notification is sent by using the below filter.
Example Code
1 2 3 4 5 6 7 8 9 10 | /** * Change the email address that the wsal deactivation email sends to. * * Returning a string that is not an email address will effectively * short-circuit the mail sending and no email will go out. * * @var string */ add_filter( 'wsal_filter_deactivation_email_delivery_address', function( $address ) { return 'newaddress@example.com'; } ); |
wsal_log_hidden_meta_keys
Function
By default hidden meta keys (custom fields) are ignored by the WP Security Audit Log plugin. The names of these meta keys start with an underscore and are typically used to store posts’ settings. This filter hook allow users to specify an array of hidden meta keys for which the plugin should keep a log of when they or the values they store change.
Parameter
- $meta_keys — Array of hidden post meta keys.
Example Code
1 2 3 4 5 6 7 8 9 10 11 | /** * Add a list of hidden meta keys to be logged by WSAL. * * @param array $meta_keys - Array of hidden post meta keys. * @return array */ function wsal_add_hidden_meta_keys( $meta_keys ) { $meta_keys[] = '_edit_lock'; return $meta_keys; } add_filter( 'wsal_log_hidden_meta_keys', 'wsal_add_hidden_meta_keys', 10, 1 ); |
wsal_infinite_scroll_events
Function
This hook can be used to change the number of events that are shown by default in the audit log viewer when using the infinite scroll view mode.
Parameter
- return – specify the number of events
Example Code
1 2 3 4 | function wsal_increase_infinite_scroll_events() { return 50; } add_filter( 'wsal_infinite_scroll_events', 'wsal_increase_infinite_scroll_events' ); |
Login Prompt Plugin Hooks
wsal_override_session_block_message
Function
This hook filters the message displayed to users when they try to login and their session is blocked because multiple sessions are not allowed.
Parameter
- $message — Override session block message.
Example Code
1 2 3 4 5 6 7 8 9 10 11 | /** * Filter override session block message. * * @param string $message - Override session block message. * @return string */ function wsal_filter_override_session_message( $message ) { $message = __( 'This is override session block message.', 'text-domain' ); return $message; } add_filter( 'wsal_override_session_block_message', 'wsal_filter_override_session_message', 10, 1 ); |
wsal_override_session_password_field
Function
This hook filters the override session password field displayed to users when their session is blocked and are asked to enter the override password.
Parameter
- $password_field — Override password field.
Example Code
1 2 3 4 5 6 7 8 9 10 11 | /** * Session override password field. * * @param string $password_field - Override password field. * @return string */ function wsal_filter_override_session_password_field( $password_field ) { $password_field = '<p><input type="password"></p>'; return $password_field; } add_filter( 'wsal_override_session_password_field', 'wsal_filter_override_session_password_field', 10, 1 ); |
wsal_override_session_password_field_tags
Function
This hook filters the override session password field tags so that they can be displayed using wp_kses function.
Parameter
- $allowed_html_tags — Override password field HTML tags.
Example Code
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | /** * Session override password field HTML tags. * * @param array $allowed_html_tags - Override password field HTML tags. * @return array */ function wsal_filter_override_session_password_tags( $allowed_html_tags ) { $allowed_html_tags = array( 'p' => array(), 'input' => array( 'type' => array(), ), ); return $allowed_html_tags; } add_filter( 'wsal_override_session_password_field_tags', 'wsal_filter_override_session_password_tags', 10, 1 ); |
Third party plugins hooks
wsal_disable_user_switching_plugin_tracking
Function
This hook disables the integration and support with the User Switching plugin. Once the integration is disabled, the plugin reports the actual user doing the change and not the switched to user.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | /** * Register the filtered return to detective login/out tracking on the plugin: * `User Switching`. * * This needs to be hooked in early before the plugin does it's own init. Use * `init` hook but add it on priority lower than 5. */ add_action( 'init', function() { /** * Disable the tracking of the `User Switching' plugin. * * @link: https://wordpress.org/plugins/user-switching/` * * @var bool */ add_filter( 'wsal_disable_user_switching_plugin_tracking', '__return_true' ); }, 4 ); |