Even if the plugin itself is simple enough, it has a few security levels that must be passed in order to send a command:
- First, the plugin will accept connections only from a IP address that the user will set, so even if you know the plugin port, if the IP address that sends the command will not match with the IP from the plugin configuration, the connection will be closed.
- There is the password that also must match with the one from the plugin configuration, if not, again the connection will be closed.
So, if i will add the IP of my webserver, even if you know the port and the password, if you try to access the plugin from another host, it will not work.
In other words, the plugin itself authenticates by IP the source of the commands (the php host), from there it's your job to secure it further, to take care of which users have access to the script.
The included php script is there to give you an idea how to communicate with the plugin, but you can use various ways to send those commands as long you respect the format of the data you will send. I tried also to connect to the plugin directly with putty and it works as long the IP is allowed in the plugin. You can even make a desktop program to be used as a remote, or an android application, or you name it...
I tried to avoid bloating the php script with authentications stuff, because it would seem too complex, i implemented there just the commands protocol.
Also, if you have ideas to increase the security, you can always share them.
