WP Manifestindependent plugin directory
manifest / editor / alps-gutenberg-blocks

ALPS Gutenberg Blocks WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

A Wordpress plugin to create Gutenberg plugins that work for ALPS.

★ 4stars
247release downloads
≈10active sites
v2.1.12latest · 1 year ago

Install

Download alps-gutenberg-blocks-v2.1.12.zip From the v2.1.12 release on GitHub, Mar 4, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/adventistchurch/alps-gutenberg-blocks/releases/download/v2.1.12/alps-gutenberg-blocks-v2.1.12.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

ALPS Gutenberg Plugin

This plugin is created to support the ALPS for Wordpress, to provide Gutenberg Blocks with ALPS markup.


This project is based on Create Guten Block.

Local development

👉 Init

On first run of the plugin locally you should install required dependencies

npm install
composer install

Composer could be downloaded from https://getcomposer.org/

Link to the WP installation

You should link the build/alps-gutenberg-blocks into wp-content/plugins of the local WP.

ln -s path/to/plugin/ path/to/wp/wp-content/plugins/alps-gutenberg-blocks

The alps-gutenbers-blocks directory should appear in wp-content/plugins.

👉 npm run dev

  • Use to compile and run the blocks in development mode.
  • Watches for any changes and reports back any errors in your code.

👉 npm run project:build-blocks

  • Use to build production code for your blocks inside dist folder.
  • Runs once and reports back the gzip file sizes of the produced code.

👉 npm run project:set-version

  • Use to sync the current version in code with CHANGELOG.md
  • Sets the plugin version in package.json, plugin.php, commits the changes and creates a related git tag.
  • Push result to the GitHub to run the build and release processes.

i18n

👉 npm run i18n:update-pot

  • Use to generate master file for internationalization.
  • Scans the project files for localizable strings and dumps them to the languages/alps-gutenberg-blocks.pot
  • Open alps-gutenberg-blocks.pot with POEdit to create new and update existing locale files with string translations.
  • Translation files should be named as languages/alps-gutenberg-blocks-{lang_LANG}.po
  • Set language code in en_US format.

👉 npm run i18n:create-json

  • Use to convert .po files to .json
  • Iterates over each .po file in languages and generates .json file with strings.
  • .po file names should be like alps-gutenberg-blocks-en_US.po
  • .json files are used for js scripts.

Plugin release

👉 npm run wp:plugin:build

  • Use on Continuous Integration server to create a plugin archive for distribution
  • Builds plugin artifacts in build directory
  • alps-gutenberg-blocks directory with plugin files
  • alps-gutenberg-blocks.zip – plugin distribution archive
  • alps-gutenberg-blocks.json – plugin metadata for Wordpress updates

👉 npm run wp:plugin:release

  • Use on Continuous Integration server to publish the new version
  • Uploads alps-gutenberg-blocks.zip and alps-gutenberg-blocks.json to CDN
  • Creates GitHub release for manual installation

CI Config

Build script uses Environment Variables to get the config

Var Description Example
CDN_HOST SSH host some.server.com
CDN_USER SSH user username
CDN_PRIVATE_KEY SSH private key content (multiline)
CDN_PRIVATE_KEY_PASS SSH private key passphrase
CDN_ROOT_PATH Path on server for artifacts uploading /var/www

Releases

Newest 25 of 28 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.1.12 latest
Mar 4, 2025 1 year ago
alps-gutenberg-blocks-v2.1.12.zip
21
Jan 9, 2025 1 year ago
alps-gutenberg-blocks-v2.1.11.zip
14
Jan 12, 2024 2 years ago
alps-gutenberg-blocks-v2.1.10.zip
18
Jan 10, 2024 2 years ago
alps-gutenberg-blocks-v2.1.9.zip
7
Jan 3, 2023 3 years ago
alps-gutenberg-blocks-v2.1.8.zip
18
Dec 19, 2022 3 years ago
alps-gutenberg-blocks-v2.1.7.zip
5
Dec 19, 2022 3 years ago
alps-gutenberg-blocks-v2.1.6.zip
4
Dec 15, 2022 3 years ago
alps-gutenberg-blocks-v2.1.5.zip
5
Feb 22, 2022 4 years ago
alps-gutenberg-blocks-v2.1.4.zip
31
Feb 22, 2022 4 years ago
alps-gutenberg-blocks-v2.1.3.zip
7
Feb 21, 2022 4 years ago
alps-gutenberg-blocks-v2.1.2.zip
7
Feb 21, 2022 4 years ago
alps-gutenberg-blocks-v2.1.1.zip
7
Feb 10, 2022 4 years ago
alps-gutenberg-blocks-v2.1.0.zip
7
Jun 15, 2021 5 years ago
alps-gutenberg-blocks-v2.0.1.zip
7
May 27, 2021 5 years ago
alps-gutenberg-blocks-v2.0.0.zip
9
Apr 12, 2021 5 years ago
alps-gutenberg-blocks-v1.9.4.zip
10
Apr 12, 2021 5 years ago
alps-gutenberg-blocks-v1.99.105.zip
7
Apr 12, 2021 5 years ago
alps-gutenberg-blocks-v1.9.2.zip
11
Feb 11, 2021 5 years ago
alps-gutenberg-blocks-v1.9.1.zip
6
Feb 8, 2021 5 years ago
alps-gutenberg-blocks-v1.9.0.zip
5
Jan 29, 2021 5 years ago
alps-gutenberg-blocks-v1.8.1.zip
7
Jan 28, 2021 5 years ago
alps-gutenberg-blocks-v1.8.0.zip
9
Jan 28, 2021 5 years ago
alps-gutenberg-blocks-v1.7.0.zip
6
Aug 31, 2020 6 years ago
alps-gutenberg-blocks-v1.6.1.zip
11
Aug 31, 2020 6 years ago
alps-gutenberg-blocks-v1.6.0.zip
8
All releases on GitHub →

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

ALPS Gutenberg Blocks 2.1.12 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.1.12
Findings
1
Worst severity
high
Content hash
daae502a3e2e3c5872f754dc…

Findings

  • high Stored XSS in Latest Posts block via unescaped heading and button attributes

    xss_stored

    LatestPostsBlock::render() interpolates attacker-controlled Gutenberg attributes directly into front-end HTML. title, linkUrl, and linkLabel are concatenated inside a heredoc (href and element body) with no esc_html/esc_url/esc_attr. readMoreLabel is passed to sprintf as the link inner HTML without escaping. The block is dynamic (JS save returns null), so this HTML is generated at view time and is not re-sanitized by kses. A Contributor or Author can save a latest-posts block whose linkUrl breaks out of the href attribute (for example `" autofocus onfocus="alert(document.domain)`) or uses a javascript: URL; when the post is previewed or published, that markup executes in the visitor's (or reviewing admin's) browser. title and readMoreLabel similarly become stored XSS whenever the stored strings still contain tags. Other values in the same renderer are escaped, which makes these four attributes a clear omission rather than a generic HTML-widget issue.

    src/blocks/latest-posts/block.php:143-153

    Recommendation

    Escape title and linkLabel with esc_html(), linkUrl with esc_url(), and readMoreLabel with esc_html() before output. Prefer esc_url() on every href. Do not concatenate block attributes into HTML via unquoted heredoc interpolation.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.