WP Manifestindependent plugin directory

Install

Download confur-production-3.0.4.zip From the v3.0.4 release on GitHub, Sep 24, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bleedingdeacons/confur/releases/download/v3.0.4/confur-production-3.0.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Confur — Conference Question Collation

Licence

Automated collation of answers to conference questions submitted online by groups. Confur provides one place for groups to lodge their answers and one place for region representatives to read them back, organised and ready to discuss.

What it does

Conference cycles are messy. Confur cleans the mess up by separating three things that used to be tangled together:

  1. Groups submit answers through a public-facing form that creates an Answer custom post.
  2. Region reps review in a centralised admin screen — Status (who's submitted, how complete), Results (the full text, by committee, ready to collate).
  3. AA programme content (Steps, Traditions, Responsibility Pledge) is reusable via shortcodes wherever it's needed.

Every question/answer field is backed by Advanced Custom Fields, so the question set itself is editable from the WordPress admin without code changes.

Requirements

Confur is a MIT-licensed plugin published by The Bleeding Deacons.

Installation

  1. Install and activate 12 Step Meeting List and Advanced Custom Fields.
  2. Upload the confur directory to /wp-content/plugins/.
  3. Activate Confur through the Plugins menu in WordPress.
  4. Import the bundled ACF configuration (setup/) — this registers the Answer custom post type and its field group.
  5. Create a public registration page containing a form that creates the Answer post type.

Administration

Under the Conference for Question sidebar menu:

Screen What it shows
Status Submission progress per group/committee — who's filed, who hasn't.
Results The latest answers grouped for collation.

Shortcodes

Answer & question management

[answer_field committee="1" question="1"]    Generate an answer input field
[question number="1" committee="1"]          Render a question with formatting
[committee number="1" name="Finance"]        Open a committee section
[header]                                     Conference meeting header
[progress_table]                             Per-committee progress table
[control position="top"]                     Save controls (Draft / Complete)
[status position="top"]                      Unsaved-changes notice
[days_remaining end_date="2024-12-31" extend_by="0"]   Countdown to deadline

AA programme content

[step number="1"]                            Display an AA Step + PDF link
[tradition number="1"]                       Display an AA Tradition + PDF link
[responsibility_pledge number="1"]           Display the Responsibility Pledge

General utilities

[open_blank href="url" class="…"]Link[/open_blank]      Link that opens in a new tab
[link_email address="x@y" subject="…"]Text[/link_email] Mailto link
[pdf_link url="…" name="file.pdf"]Link[/pdf_link]       Inline PDF download link

Building a release

The plugin ships with a cross-platform build.php script that packages a distributable zip:

php build.php                       # Production zip (default)
php build.php build:production      # Production zip
php build.php build:dev             # Dev zip (keeps tests)
php build.php clean                 # Remove the build/ directory
php build.php --version=2.12.0      # Override version on the way out
php build.php --help                # Show all options

Output lands in build/confur-production-<version>.zip (or -dev-). On every build the script reads the version from the Version: header in Confur.php, syncs the **Version:** line in this README and the Stable tag: line in readme.txt, and stamps the build date into readme.txt immediately after the Stable tag: line.

Testing

PHPUnit is wired up via phpunit.xml. Run the suite with:

# Unix-like
./run-tests.sh

# Windows
run-tests.cmd

Coverage reports drop into coverage/. Line coverage is also reported to Coveralls on every CI run.

Licence

MIT (Modified). See LICENSE for the full text.

Releases

Newest 25 of 27 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
Sep 24, 2026 29d ago
confur-production-3.0.4.zip
3
Sep 24, 2026 29d ago
confur-production-3.0.3.zip
0
Sep 22, 2026 1mo ago
confur-production-3.0.2.zip
1
Sep 20, 2026 1mo ago
confur-production-3.0.1.zip
4
Sep 20, 2026 1mo ago
confur-production-3.0.0.zip
1
Sep 5, 2026 1mo ago
confur-production-2.15.17.zip
5
Sep 5, 2026 1mo ago
confur-production-2.15.16.zip
1
Aug 25, 2026 1mo ago
confur-production-2.15.15.zip
1
Aug 25, 2026 1mo ago
confur-production-2.15.14.zip
0
Aug 17, 2026 2mo ago
confur-production-2.15.13.zip
1
Aug 17, 2026 2mo ago
confur-production-2.15.12.zip
1
Aug 17, 2026 2mo ago
confur-production-2.15.11.zip
1
Aug 9, 2026 2mo ago
confur-production-2.15.10.zip
1
Aug 8, 2026 2mo ago
confur-production-2.15.9.zip
1
Aug 7, 2026 2mo ago
confur-production-2.15.8.zip
1
Aug 7, 2026 2mo ago
confur-production-2.15.7.zip
2
Aug 7, 2026 2mo ago
confur-production-2.15.6.zip
1
Feb 4, 2026 8mo ago
confur-production-2.11.3.zip
0
Jan 17, 2026 9mo ago
confur-production-2.10.1.zip
0
Jan 16, 2026 9mo ago
confur-production-2.9.4.zip
0
Dec 31, 2025 9mo ago
confur-dev-2.4.11.zip
1
Dec 31, 2025 9mo ago
confur-dev-2.4.10.zip
0
Dec 31, 2025 9mo ago
confur-dev-2.4.9.zip
0
Dec 23, 2025 10mo ago
confur-dev-2.3.1.zip
0
Dec 23, 2025 10mo ago
confur-dev-2.2.1.zip
0
All releases on GitHub →
D+ grade

Security

Confur 3.0.4 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
3.0.4
Findings
2
Worst severity
high
Content hash
73389588f7c223886aa0259d…

Findings

  • high Unauthenticated answer overwrite: post ID from spoofable Referer, no nonce

    missing_auth

    admin_post_nopriv_answer_submission (and admin_post_answer_submission) invoke AnswerHandler::handleSubmission with no capability check and no nonce. The target answer post is derived only from HTTP_REFERER via url_to_postid(). Browsers constrain Referer for cross-site forms, but any non-browser client can set Referer to a known answer permalink (e.g. from confirmation email) and POST arbitrary cN_aN fields plus submit_answers status. This overwrites ACF answers, updates status/completion, calls wp_publish_post, and can trigger completion email — an IDOR against other registrants' submissions.

    src/Handlers/AnswerHandler.php:25-119

    Recommendation

    Require a per-answer secret token or WP nonce bound to the post ID (rendered on the answer form). Reject requests whose Referer/post cannot be proven owned by the submitter. Do not trust Referer alone.

  • medium Dashboard HeadsUp AJAX missing capability check

    missing_capability

    wp_ajax_confur_refresh_headsup verifies only confur_headsup_refresh nonce. Any logged-in user (including Subscriber) can create that nonce for themselves and retrieve the widget HTML (recent committee/question activity). The dashboard widget itself is registered without a capability restriction beyond default dashboard access.

    src/Admin/ConfurHeadsUp.php:31-55

    Recommendation

    Require edit_answers (or manage_options) in ajaxRefreshWidget and pass a capability to wp_add_dashboard_widget.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.