Mammute Result Lookup

A standalone WordPress plugin for publication-approved participant results and certificates. It provides private administrative records and a flexible participant lookup component; it never creates a public participant directory.

Requirements and installation

• WordPress 6.5+, PHP 7.4+, MySQL/MariaDB with CREATE/ALTER and GET_LOCK support.
• No Composer, Node, ACF, theme edits or search plugin required at runtime.
• Elementor is optional. The native widget uses elementor/widgets/register; tested with Elementor 3.32.0. ACF is not required; the plugin uses its own canonical data tables.
• Install dist/mammute-result-lookup-1.7.0.zip through Plugins → Add New → Upload, then activate. Or copy the runtime plugin folder into wp-content/plugins/.
• Activate separately on each multisite site. Network activation is deliberately rejected. Storage is site-prefixed; activation does not iterate other sites.
• Use HTTPS in production. Test with the actual site's caching, proxy, theme and Elementor configuration before publishing.

Direct certificate URLs

In the certificate section, paste an optional Direct certificate URL. A valid URL wins over saved media; clearing it returns to the media source. Both values are retained. Saving still validates referenced media permissions/files; remove a stale local reference if validation requests it. Save-and-add clears both certificate sources for the next person.

Only complete HTTPS URLs up to2048 bytes are accepted. Surrounding spaces are trimmed; path/query/fragment encoding is preserved. Credentials, controls, malformed escaping, HTTP, protocol-relative, javascript/data/file and custom schemes are rejected. Use ASCII or punycode hostnames; Unicode paths are supported. No DNS, HEAD/GET, download, mirroring, proxy or metadata request is performed by PHP.

JPEG/PNG/WebP URL paths get a responsive, proportion-preserving preview in a stable4:3 frame. The path is only a display hint, not a verified content type. PDF, SVG and unknown paths get links without iframe/embed execution. Unavailable images show existing Persian fallback guidance and retain links; a syntactically valid but unreachable URL does not silently switch to another certificate. External downloads may open instead of saving; the remote host/browser controls that behavior.

Only after a unique approved lookup does the browser load a certificate image. Configuring an external source and approving publication permits that browser connection; the host can receive the visitor’s IP/browser information. Links use no opener/referrer context, and images use no-referrer. A URL is not made private by storing it here. Use only public, approved resources without confidential credentials. Configure CSP img-src for your chosen certificate host; a blocked image retains its open link. URLs never become searchable.

Format2 CSV/XML exports and JSON backups add certificate_url. Version1 files with their original columns remain accepted: legacy merge imports preserve a matching record’s URL; new records get an empty URL. Explicit blank URLs in format2 clear the value. Restoring a version1 backup restores its original no-URL state. Version2 restore validates URLs and preserves media IDs; unsafe rows block restore. Backups contain references, never remote file contents or search-policy settings.

Upgrade1.7 adds an empty-default varchar(2048) column through the existing locked dbDelta migration. Visit wp-admin after update; the schema marker advances to2 only after checks pass. Existing media/records remain unchanged. Back up the database/media first: ALTER may briefly lock the result table. Interrupted upgrades can be retried from wp-admin. Old pending bulk previews must be uploaded again. Schema-1 binaries cannot operate on schema2; rollback requires a full pre-upgrade database/plugin backup, not a marker edit. Deactivation/uninstall retain URL data. Clear page/asset caches after deployment.

Administrative workflow

Open Participant results (requires manage_options, normally administrators). Create a record with an event key, full name and mobile number. Optional fields are team/group, score, placement, evaluation summary, certificate identifier, a media attachment and an optional direct certificate URL. Score and placement are text so event-specific grading works; 0 is preserved. Empty optional fields are omitted from the card. Summaries are plain text.

Choose an existing event/team from the editable suggestions, or type a new value. Suggestions come from saved records, are capped at 30, and narrow as you type. Teams are scoped to the selected event. Changing the event does not silently change the team. Score and placement deliberately remain text: grades and arbitrary placements are valid.

Choose a certificate with the native Media Library picker or paste a public HTTPS URL. Preview/remove controls are inline; Use a media ID exposes the existing numeric reference (0 means none). Evaluation prose and embedding help use expandable sections. Publication approval stays visible and required; all result fields are public-facing, never confidential notes.

Save and add another saves without leaving the page, keeps only event/team in the current form, clears all participant-specific fields/media/approval, and focuses the next name. Save participant keeps the saved record open. No batch selections or participant details are written to browser storage. Pending saves lock the controls. Validation errors preserve entered values and focus the relevant field. A network failure can leave the write outcome unknown: check saved records before retrying. Duplicate mobiles within an event and stale edits remain server-authoritative errors. Without JavaScript, normal form submission works and validation failures retain the form; adding another retains the event through the redirect, but not the team.

The saved-participant list has an exact event filter, 20-row pagination, masked mobile numbers, a certificate-reference status and an explicit Edit participant action. File selected indicates a stored reference, not continuous file availability; the edit form and public renderer validate the actual file. On narrow screens rows become cards. Delete remains a separate disclosure with explicit permanent-delete confirmation; it removes only the result, never media.

Event keys contain 1–64 lowercase ASCII letters/digits/hyphens/underscores, beginning with a letter or digit. Each event permits one record per normalized mobile number; the same person may have a separate record in another event. Event keys are public page scopes, never passwords. There is no score threshold or participant data in code.