WP Manifestindependent plugin directory
manifest / media / acf-gallery-zipper

ACF Gallery Zipper WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Plugin creates a REST endpoint for zipping an ACF gallery field contents.

★ 4stars
v0.3.0latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bond-agency/acf-gallery-zipper/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress plugin for zipping ACF Gallery field contents.

Requirements

This plugin assumes that you have ACF installed.

Installation

Download the zip and install the plugin. Use the hooks to define the post type and field you want to zip.

Usage

The plugin creates a REST endpoint for downloading zip files from the given post. You can get the ACF gallery field contents as zip by accessing that url:

<your-website-url>/wp-json/acf-gallery-zipper/v1/zip/<post-id>

Filters & Actions API

The plugin provides a simple API for interacting with the plugin via WordPress hooks.

Filters

acf_gallery_zipper_post_type

Use this filter to change the default post type. Default: post.

Example:

add_filter( 'acf_gallery_zipper_post_type', 'acf_gallery_zipper_change_default_post_type' );
function acf_gallery_zipper_change_default_post_type( $post_type ) {
  return 'my-new-post-type';
}

acf_gallery_zipper_field_name

Use this filter to change the default field name that the plugin uses for zipping. Default: gallery.

Example:

add_filter( 'acf_gallery_zipper_field_name', 'acf_gallery_zipper_change_default_field_name' );
function acf_gallery_zipper_change_default_field_name( $field_name ) {
  return 'my_gallery_field_name';
}

acf_gallery_zipper_filename

Use this filter to change the zip filename. Default: <post slug>.

Example:

add_filter( 'acf_gallery_zipper_filename', 'acf_gallery_zipper_change_default_filename' );
function acf_gallery_zipper_change_default_filename( $filename ) {
  return $filename . '-suffix'; // .zip will be added automatically.
}

acf_gallery_zipper_use_cache

Use this filter to change the cache usage. By default the zip files are not stored anywhere but deleted right after they are sent to the user. Default: false.

Example:

add_filter( 'acf_gallery_zipper_use_cache', 'acf_gallery_zipper_change_default_use_cache' );
function acf_gallery_zipper_change_default_use_cache( $use_cache ) {
  return true;
}

acf_gallery_zipper_removal_recurrence

Use this filter to change the cache removal recurrence. Default: daily. Possible values: hourly, twicedaily and daily.

Example:

add_filter( 'acf_gallery_zipper_removal_recurrence', 'acf_gallery_zipper_removal_change_default_recurrence' );
function acf_gallery_zipper_removal_recurrence( $recurrence ) {
  return 'hourly';
}

Contributing

We are open for suggestions so open an issue if you have any feature requests or bug reports. Please do not create a pull request without creating related issue first.

Releases

3 releases.

Tag
Published
v0.3.0 latest
Jun 6, 2018 8 years ago
Jun 6, 2018 8 years ago
Jun 6, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

ACF Gallery Zipper 0.3.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.3.0
Findings
1
Worst severity
high
Content hash
2cad2850681897d8f0525f94…

Findings

  • high Unauthenticated REST gallery zip download (missing permission_callback)

    missing_permission_callback

    register_rest_route for /zip/(?P<id>\d+) does not set permission_callback, so the route is publicly readable. Any visitor can request a post ID, have the plugin assemble ZipArchive of get_attached_file paths from the ACF gallery field, and stream it with readfile — enabling bulk media exfiltration and repeated zip creation DoS.

    acf-gallery-zipper.php:64-139

    Recommendation

    Add permission_callback requiring appropriate capability or post readability checks; rate-limit; avoid writing zips under the plugin directory for unauthenticated callers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.