WP Manifestindependent plugin directory
manifest / ecommerce / gls-labels

GLS Labels WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

GLS WordPress Plugin: Integrates with GLS Web API for package processing and cancellation. Enables creation of shipping and return labels from the WordPress dashboard.

★ 1stars
22release downloads
v1.0.7latest · 2 years ago

Install

Download gls-labels-v1.0.7.zip From the v1.0.7 release on GitHub, Apr 24, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/caglarop/gls-labels/releases/download/v1.0.7/gls-labels-v1.0.7.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Logo

The GLS Labels is a WordPress plugin that integrates with the GLS Web API for Parcel Processing and Parcel Cancellation, allowing the creation of GLS shipping labels directly from your WordPress dashboard.

🔄 Compatibility

The GLS Labels is compatible with PHP versions from 7.4 to 8.3.

🌟 Features

  • Integration with GLS Web API for Parcel Processing and Parcel Cancellation.
  • Creation of GLS shipping labels and return labels.
  • Ability to cancel parcels.
  • User-friendly interface with a metabox in the order details page.
  • Automatically adds a note to the order with the consignment number, a download link for the label, and a link to cancel the parcel.
  • Translated into English, German, and Turkish.

📥 Installation

You can install the GLS Labels directly from the WordPress admin panel:

  1. Go to the Plugins menu and click "Add New".
  2. Search for "GLS Labels".
  3. Click "Install Now" and then "Activate".

For manual installation:

  1. Download the plugin and unzip it.
  2. Upload the unzipped folder to your WordPress plugin directory (/wp-content/plugins/).
  3. Activate the plugin via the WordPress dashboard.

🚀 Usage

After activating the plugin, you can configure it by going to your WordPress dashboard and navigating to "Settings" -> "GLS Labels". Here you can enter your GLS user ID, your password, your shipper number, and your shipper address.

To create a shipping or return label, go to the order page and click on "Create Shipping Label" or "Create Return Label" in the GLS metabox. The selected label will then be created, and a note will be added to the order with the consignment number and a download link for the label.

🙋 Support

If you need support or have any questions, please create a new issue in our GitHub repository.

📄 License

This plugin is licensed under the MIT. See LICENSE for more information.

🌐 Other Languages

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.7 latest
Apr 24, 2024 2 years ago
gls-labels-v1.0.7.zip
12
Jan 5, 2024 2 years ago
gls-labels-v1.0.5.zip
4
Jan 1, 2024 2 years ago
gls-labels-v1.0.4.zip
4
Jan 1, 2024 2 years ago
gls-labels-v1.0.3.zip
2
D+ grade

Security

GLS Labels 1.0.7 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.0.7
Findings
2
Worst severity
high
Content hash
823fc203b5f466a29e6cc749…

Findings

  • high Missing capability and nonce on GLS label create/cancel admin-post actions

    missing_capability

    gls_labels_download_label / return_label and cancel_parcel only check is_admin(). Any authenticated user can create paid GLS shipments for arbitrary order_id or cancel parcels via parcelId without CSRF protection. Meta box links omit nonces.

    gls-labels.php:95-145

    Recommendation

    Require current_user_can(manage_woocommerce) (and edit shop orders), check_admin_referer on each action, and validate order_id ownership.

  • high CSRF on GLS parcel cancel and label creation

    csrf

    cancel_parcel and label download admin-post handlers have no wp_verify_nonce/check_admin_referer. Order notes embed cancel URLs without nonces. A logged-in shop worker visiting an attacker page can be forced to create/cancel shipments.

    gls-labels.php:358-406

    Recommendation

    Add check_admin_referer for each admin-post action and include nonces in meta-box/order-note links.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.