WP Manifestindependent plugin directory
manifest / updates / brasa-theme-deploy

Brasa GitHub Theme Deploy WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Deploy any theme from GitHub direct to your WordPress install

★ 2stars
1.1latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/brainwp/brasa-theme-deploy/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Deploy our theme hosted on GitHub automatically whenever you have a commit. Deploy our theme hosted on GitHub automatically whenever you have a commit on a specific branch. Simple, easy, free. How to use: To use the plugin download it by the WordPress panel or upload via FTP in the wp-content folder /plugins . Then activate it. When the plugin is enabled check make sure that the theme is ready in the wp-content folder /themes . The name of the theme folder must match the address on GitHub. Example: Link GitHub: http://github.com/wpbrasil/odin/ in this case, the folder name would be /odin. Once verified these steps, go to your repository on GitHub, then enter the Settings page of the repository within that page, click the link Webhooks & services. Within this page, click Add webhook. A password confirmation box will open, confirm and a form will appear: In Payload URL complete with: http://SITEADDRESS/wp-admin/admin-ajax.php?action=brasadeploy In Content-type, leave the default selection (application/json). In the field Secret, use a strong password, consider using a password generator. Mark webhook to Active and save. Now we can return to the WordPress dashboard. In the

Releases

2 releases.

Tag
Published
1.1 latest
Feb 10, 2017 9 years ago
1.0
Jan 19, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Brasa GitHub Theme Deploy 1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1
Findings
1
Worst severity
medium
Content hash
ee1e2aab4bb03db35daf846a…

Findings

  • medium Unauthenticated GitHub webhook deploy endpoint (HMAC-gated)

    unnecessary_attack_surface

    wp_ajax_nopriv_brasa_deploy accepts unauthenticated POSTs and deploys if X-Hub-Signature HMAC matches brasa_deploy_secret. This is intentional for GitHub webhooks but expands attack surface if the secret is weak/default/empty (empty secret fails closed). Still uses exec/wget/tar on payload-derived paths.

    index.php:93-140

    Recommendation

    Prefer admin-ajax alternatives with hard secret length requirements; replace exec with WP filesystem APIs; refuse deploy if secret entropy is insufficient.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.