WP Manifestindependent plugin directory
manifest / content / ingeni-multi-content

Ingeni Multi Content WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Flexible CPT that supports multiple content blocks within a single post.

★ 0stars
2022.04latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/brucemckinnon/ingeni-multi-content/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

A custom post type that allows you to store four discrete blocks of content in a single post.

Originally designed for a recipe page, where the design require discrete areas of content to have their own individual treatments.

Description

    • Super-simple, add up to four blocks of content to a simple post.
    • Display the content using a theme template file, or use the shortcode to display selected content blocks.

Installation

  1. Upload 'ingeni-multi-content' folder to the '/wp-content/plugins/' directory.

  2. Activate the plugin through the 'Plugins' menu in WordPress.

  3. Add new Multi-Content posts.

  4. Display the content using either the shortcode or directly with custom templates

Frequently Asked Questions

How do I use the shortcode? =

Multi Content can be displayed from pages and posts using the [ingeni-multi-block] shortcode.

The following parameters are available:

id = ID of the Multi Content post. Required.

content_id = The content block you wish to display. Supports values between 1 and 4. Defaults to 1.

show_title = Show the title of the content block. Default is 1.

show_content = Show the content of the content block. Default is 1.

class = A wrapper class. Defaults is 'imc_wrapper'. If a blank class is provided, then no wrapping div is applied to the returned HTML.

data-id = A 'data-id' attribute that can be used by JS.

For example:

[ingeni-multi-block id=123 content_id=3 show_title=0 show_content=1 class="my_content_3_no_title"]

Implementing a tabbed panel

Using JS and the 'data-id' attribute, you can implement tabbed panels that use Ingeni Multi Content.

HTML:

[ingeni-multi-block id=263 content_id=1 show_title=1 show_content=0 class="mba_title" data-id=101]

[ingeni-multi-block id=263 content_id=2 show_title=1 show_content=0 class="mba_title" data-id=102]

[ingeni-multi-block id=263 content_id=1 show_title=0 show_content=1 class="mba_content_panel" data-id=101] [ingeni-multi-block id=263 content_id=2 show_title=0 show_content=1 class="mba_content_panel" data-id=102]

CSS:

.panels .mba_content_panel { display: none; font-size: 20px; margin: 7px 0; }

.panels .mba_content_panel.open { display: block; }

JS:

function multiblockVerticalAccordion() { jQuery(".mba_title").mouseenter(function() { toggleVerticalAccordionPanel(jQuery( this ).data("id")); }) .mouseleave(function() { toggleVerticalAccordionPanel(jQuery( this ).data("id")); });

jQuery("[class^=ico-]").mouseenter(function() { toggleVerticalAccordionPanel(jQuery( this ).data("id")); }) .mouseleave(function() { toggleVerticalAccordionPanel(jQuery( this ).data("id")); }); }

function toggleVerticalAccordionPanel(dataId) { if (dataId) { jQuery('.mba_content_panel[data-id="'+dataId+'"]').toggleClass('open'); } }

Changelog

2021.01 - 12 April 2021 - Initial version

2021.02 - 27 Apr 2021 - Added support for Content Block #4

  • Re-factored some of the load/save functions
  • Added support for Content #1 title
  • Added support for specifying a data-id attrib

2022.01 - 2 May 2022 - Test existence of imc_content2_nonce before verifying it.

  • Removed call to uninstall() hook.

2022.02 - 25 May 2022 - imc_content_save() - Test if post_type is set within $POST

2022.03 - 27 May 2022 - imc_content_save() - More checking of $POST fields before attempting to save.

2022.04 - 27 May 2022 - imc_content_save() - fixed simple syntax error.

Releases

4 releases.

Tag
Published
2022.04 latest
May 26, 2022 4 years ago
May 2, 2022 4 years ago
May 4, 2021 5 years ago
Apr 26, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Ingeni Multi Content 2022.03 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2022.03
Findings
1
Worst severity
medium
Content hash
7720bc4a12fe2cd5ffe53801…

Findings

  • medium Stored XSS via unescaped Multi Content CPT fields in shortcode

    ingeni_multicontent CPT uses capability_type=post (Authors can create/publish). Shortcode ingeni-multi-block echoes _imc_content*_title and _imc_content* meta (and post_content for block 1) with no escaping. An Author can plant HTML/event-handler payloads in the title/textarea metaboxes and XSS visitors when the shortcode renders that post.

    ingeni-multi-content.php:388-430

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.