WP Manifestindependent plugin directory
manifest / integrations / wp-sipd

WP SIPD WP RegistryMedium-severity findings · 4 findingsOpen the reportB-

Plugin WP untuk integrasi data dengan SIPD

by Agus Nurwanto · github.com/agusnurwanto/wp-sipd · website

★ 24stars
v1.5latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/agusnurwanto/wp-sipd/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/agusnurwanto/wp-sipd ↗

Optimasi aplikasi SIPD dengan chrome extension dan plugin wordpress Semoga bermanfaat

DONASI

GRUP telegram https://t.me/sipd_chrome_extension

Chrome extension https://github.com/agusnurwanto/sipd-chrome-extension

Cara pakai plugin

  • Install wordpress
  • Install plugin ini dan aktifkan
  • Import SQL file tabel.sql untuk membuat tabel tempat menyimpan data yang diambil dari sipd.kemendagri.go.id
  • Masuk ke dashboard admin wordpress > SIPD Options
    • Masukan Nomor WA dan Nama Pemda
    • Klik tombol Generate Lisensi. Lisensi / API KEY ini akan digunakan di configurasi SIPD chrome extension.
  • Untuk menampilkan SSH menggunakan shortcode [datassh]
  • Untuk menampilkan akun belanja menggunakan shortcode [rekbelanja]
  • Theme yang sudah dites astra theme
  • Install plugin Ultimate Member untuk halaman profil user PA/KPA
  • Tambahkan shortcode [menu_monev] pada form user profile Ultimate Member untuk menampilkan url halaman MONEV sesuai user yang login
  • Jika terjadi koneksi database sql server error karena integrasi simda setting diaktifkan, tambahkan paramter GET no_simda=1 pada url. Parameter ini untuk memutuskan koneksi ke DB SQL SERVER, selanjutnya kita bisa memperbaikan settingan koneksi di menu SIMDA Setting.

HARUS Update php.ini

Optimasi server apache agar proses pengiriman data dari chrome extension ke server wordpress berjalan lancar (edit file php.ini):

  • max_input_vars = 1000000
  • max_execution_time = 300
  • max_input_time = 600
  • memory_limit = 3556M
  • post_max_size = 20M
  • pastikan untuk menghapus kode ; sebagai tanda komentar pada file php.ini, terutama pada configurasi ;max_input_vars. Jika tidak dilakukan maka settingan yang sudah dilakukan akan dianggap sebagai komentar dan tidak dijalankan oleh server apache.

Cara singkron tahun anggaran baru 2022 ke database SQL Server SIMDA

  • Sesuaikan tahun anggaran baru di form SIPD Options > Tahun Anggaran SIPD
  • Ubah database SIMDA sesuai database tahun yang baru di halaman SIMDA Options > Database SIMDA
  • Tambahkan database SIMDA yang baru di database_simda dan lakukan testing koneksi di aplikasi https://github.com/agusnurwanto/SIMDA-API-PHP
  • Lakukan singkroniasi data perangkat daerah menggunakan akun admin daerah atau TAPD pemda di SIPD kemendagri
  • Lakukan cek kembali mapping SKPD di halaman SIMDA Options. Jika di tabel ta_sub_unit belum dibuat data SKPD-nya, maka perlu dibuat dulu manual atau bisa digenerate dengan mengaktifkan opsi di form Integrasi Sub Unit SIMDA sesuai SIPD
  • Setelah dipastikan data mapping SKPD sudah sesuai antara di SIPD dan SIMDA, baru melakukan singkronisasi RKA

Modul Usulan SSH

Permintaan fitur baru

  • User umum bisa request penambahan fitur dengan membuat issue

Video Tutorial

Releases

5 releases.

Tag
Published
v1.5 latest
Feb 11, 2021 5 years ago
v1.4
Jan 10, 2021 5 years ago
v1.3
Nov 17, 2020 5 years ago
v1.2
Nov 6, 2020 6 years ago
v1.1
Nov 2, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B- grade

Security

WP SIPD 1.0.0 · audited by WP Registry

Medium-severity findings.

4 medium
Audited release
1.0.0
Findings
4
Worst severity
medium
Content hash
e3adf0edbaf252adb0987de3…

Findings

  • medium Unauthenticated get_cat_url AJAX missing API key gate

    missing_auth

    wp_ajax_nopriv_get_cat_url resolves a category by POST name and returns its permalink with no api_key check (unlike sibling singkron_* handlers). Enables unauthenticated category existence/URL probing.

    public/class-wpsipd-public.php:1923-1946

    Recommendation

    Require the same api_key validation as other public AJAX endpoints, or remove the endpoint.

  • medium Unprepared SQL interpolation of POST fields in SIPD sync handlers

    unsafe_input

    After api_key validation, handlers build SQL like SELECT ... where tahun_anggaran=".$_POST['tahun_anggaran']." AND ... and string fields with '" . $data['kepala_daerah'] . "' without $wpdb->prepare/absint. Holders of the extension API key (or a leaked key) can attempt injection; numeric contexts lack casting.

    public/class-wpsipd-public.php:123-180

    Recommendation

    Use $wpdb->prepare with %d/%s placeholders; cast IDs with absint.

  • medium Unauthenticated get_cat_url AJAX missing API key gate

    missing_auth

    wp_ajax_nopriv_get_cat_url maps to Wpsipd_Public::get_cat_url. Unlike sibling sync handlers, this method never compares $_POST['api_key'] to crb_api_key_extension. Any unauthenticated caller can POST category names and receive category permalinks (or existence errors), amplifying recon against the public taxonomy.

    public/class-wpsipd-public.php:1923-1945

    Recommendation

    Require the same api_key check as other public AJAX handlers, or remove nopriv registration if only the extension needs this endpoint.

  • medium Unprepared SQL interpolation in SIPD sync/read handlers behind shared API key

    unsafe_input

    State-changing and data-returning AJAX handlers (e.g. singkron_ssh, singkron_user_penatausahaan, get_kas) interpolate $_POST fields and decoded JSON values directly into $wpdb->get_var/$wpdb->get_results strings after only an api_key equality check. Possession of the randomly generated extension API key (or a weak/admin-set key) yields SQL injection / mass data write against custom SIPD tables, including storage of SIPD user passwords in plaintext columns.

    public/class-wpsipd-public.php:123-196

    Recommendation

    Use $wpdb->prepare for all dynamic SQL; cast IDs with absint; hash or omit password fields; treat API key as authentication but not as a substitute for query parameterization.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →