WP Manifestindependent plugin directory
manifest / i18n / polylang-translate-existing-media

Polylang Add-on: Translate existing media WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Bulk translate and replace all existing media in content, featured image and meta fields when you enable translations in media with Polylang.

★ 28stars
2.6kcomposer installs
0.2.2latest · 7 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/aucor/polylang-translate-existing-media/archive/refs/heads/master.zip

On Packagist as aucor/polylang-translate-existing-media:

composer require aucor/polylang-translate-existing-media
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

screen shot 2017-01-23 at 17 02 03

Description

Polylang Translate existing media is an add-on for the multilingual WordPress plugin Polylang. This add-on let's you bulk translate and replace all existing media in content, featured image and meta fields you enable translations in media. This plugin is based on my other Polylang plugin polylang-copy-content.

When to use:

  • When turning existing site to multi-lingual
  • When enabling media translations when you already have media uploaded and added to content

Basic feature list:

  • Translate all media (images and galleries) that are inside content, meta fields and featured image
  • Takes care all post types (that are not 'attachment', 'revision', 'acf-field', 'acf-field-group', 'nav_menu_item', 'polylang_mo')
  • Image translations are linked automatically
  • You can add your own custom fields that have image IDs
  • Uses Polylang's functions, no messing around

This is open source and I cannot give you any guarantees, though it has worked for me in many projects. Please, report issues and contribute!

Installation

How-to use (takes around 5 minutes):

  • Take a backup of your database
  • Download plugin and activate (you will need Polylang active)
  • Enable Media translations in Polylang Settings
  • Set all content without language to default language from "Languages" admin page
  • Click "1. Translate the whole media library" from the admin notice
  • Click through steps (50 posts at a time). Each step will take some time.
  • Click "2. Translate existing images in content" from the admin notice
  • Click through steps (50 posts at a time). Each step will take some time.
  • Deactivate and delete plugin when you have gone through all the steps

Composer:

$ composer aucor/polylang-translate-existing-media

With composer.json:

{
  "require": {
    "aucor/polylang-translate-existing-media": "*"
  },
  "extra": {
    "installer-paths": {
      "htdocs/wp-content/plugins/{$name}/": ["type:wordpress-plugin"]
    }
  }
}

Filters

Add your own custom fields that have images saved as IDs:

function prefix_custom_fields_to_translate($custom_fields) {
    // return keys of your custom fields with image id
  return array(
    'my_custom_image_field',
    'other_custom_image_field'
  );
}
add_filter( 'polylang-translate-existing-media-custom-fields-with-image-id', 'prefix_custom_fields_to_translate' );

Issues and feature whishlist

Issues:

(No known issues, yet)

To-do:

  • Include terms and their custom fields
  • Replacing count might be off, make it more informative

Changelog

0.2.2

  • PHP 7.2. compatibility

0.2

  • New Feature: Translate whole media library
  • New Feature: API for custom_fields that save the image as ID
  • New Feature: Add filter to excluded post types polylang-translate-existing-media-skip-post-types
  • Improvement: Include all post_status
  • Bugfix: Don't copy featured image, just translate the existing one

Releases

3 releases.

Tag
Published
0.2.2 latest
Nov 28, 2018 7 years ago
Feb 3, 2018 8 years ago
Sep 30, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Polylang Add-on: Translate existing media 0.2.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.2.2
Findings
1
Worst severity
high
Content hash
d8caac0bfe8f5e7118dfd201…

Findings

  • high Unauthenticated bulk media translation and post-content rewrite via admin_init GET flags

    missing_auth

    PolylangTranslateExistingMedia hooks translate_existing_media to admin_init with no current_user_can() and no nonce. The constructor only bails when DOING_AJAX is defined, then registers the hook whenever global $polylang is set. If Polylang media_support is on (the documented setup) and $_GET['polylang-translate-existing-media-library'] is present, the handler queries 50 attachments and calls translate_attachment() → wp_insert_attachment(), add_post_meta for _wp_attachment_metadata/_wp_attached_file, and PLL language/translation writes. If $_GET['polylang-translate-existing-media'] is present, it walks 50 posts of every translated post type and $wpdb->update()s post_content, update_post_meta()s HTML-bearing public meta, and set_post_thumbnail()s. WordPress wp-admin/admin-post.php runs do_action('admin_init') before is_user_logged_in(), so an unauthenticated GET to /wp-admin/admin-post.php?polylang-translate-existing-media-library=start&polylang-translate-existing-media-library-p=1 (paginate with -p) performs the privileged migration; the later 400 from a missing admin_post action does not roll it back. The same GET on /wp-admin/profile.php works as Subscriber. admin_notices echoes the Start/Continue links to every wp-admin user, so the CSRF URLs are also one click away for low-privilege sessions. Preconditions: Polylang active and media translations enabled. Observable: new attachment posts appear and/or published post_content and featured images are rewritten across the site.

    polylang-translate-existing-media.php:28-47,53-266,290-297,606-641

    Recommendation

    Require current_user_can('manage_options') (or manage_categories plus upload_files, matching Polylang's media UI) and check_admin_referer() before either bulk path. Do not run the migrator on a bare admin_init GET; use a dedicated admin-post action that dies after a capability failure, or a Tools page form with POST. Restrict admin_notices to the same capability. After a successful run, consider auto-deactivating as the readme already instructs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.