WP Manifestindependent plugin directory
manifest / developer / codestar-framework

Codestar Framework WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A Simple and Lightweight WordPress Option Framework for Themes and Plugins

by Codestar · github.com/codestar/codestar-framework · website

★ 313stars
2.3.1latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/codestar/codestar-framework/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/codestar/codestar-framework ↗

Codestar Framework

Codestar Framework

A Simple and Lightweight WordPress Option Framework for Themes and Plugins. Built in Object Oriented Programming paradigm with high number of custom fields and tons of options. Allows you to bring custom admin, metabox, taxonomy and customize settings to all of your pages, posts and categories. It's highly modern and advanced framework.

Contents

Demo

For usage and examples, have a look at :rocket: online demo

Installation

  1. Download the installable WordPress plugin zip.
  2. Upload and active plugin from WordPress → Plugins → Add New
  3. After activation, next step is to configure your settings. You can do it from here :gear: configurations

Quick Start

Open your current theme functions.php file and paste this code.

// Check core class for avoid errors
if( class_exists( 'CSF' ) ) {

  // Set a unique slug-like ID
  $prefix = 'my_framework';

  // Create options
  CSF::createOptions( $prefix, array(
    'menu_title' => 'My Framework',
    'menu_slug'  => 'my-framework',
  ) );

  // Create a section
  CSF::createSection( $prefix, array(
    'title'  => 'Tab Title 1',
    'fields' => array(

      // A text field
      array(
        'id'    => 'opt-text',
        'type'  => 'text',
        'title' => 'Simple Text',
      ),

    )
  ) );

  // Create a section
  CSF::createSection( $prefix, array(
    'title'  => 'Tab Title 2',
    'fields' => array(

      // A textarea field
      array(
        'id'    => 'opt-textarea',
        'type'  => 'textarea',
        'title' => 'Simple Textarea',
      ),

    )
  ) );

}

How to get option value ?

$options = get_option( 'my_framework' ); // unique id of the framework

echo $options['opt-text']; // id of the field
echo $options['opt-textarea']; // id of the field

Documentation

Read the documentation for details :closed_book: documentation

Free vs Premium

Features Free Version Premium Version
Admin Option Framework :heavy_check_mark: :heavy_check_mark:
Customize Option Framework :x: :heavy_check_mark:
Metabox Option Framework :x: :heavy_check_mark:
Nav Menu Option Framework :x: :heavy_check_mark:
Taxonomy Option Framework :x: :heavy_check_mark:
Profile Option Framework :x: :heavy_check_mark:
Comment Option Framework :x: :heavy_check_mark:
Widget Option Framework :x: :heavy_check_mark:
Shortcode Option Framework :x: :heavy_check_mark:
All Option Fields :x: :heavy_check_mark:
Developer Packages :x: :heavy_check_mark:
Unminfy Library :x: :heavy_check_mark:
New Requests :x: :heavy_check_mark:
Autoremove Advertisements :x: :heavy_check_mark:
Life-time access/updates :x: :heavy_check_mark:
:star2: Upgrade Premium Version

Available Option Fields

Accordion Color Icon Select Tabbed
Background Color Group Image Select Slider Text
Backup Date Link Color Sortable Textarea
Border Dimensions Media Sorter Typography
Button Set Fieldset Palette Spacing Upload
Checkbox Gallery Radio Spinner WP Editor
Code Editor Group Repeater Switcher Others

Support

We are provide support forum for premium version users. You can join to support forum for submit any question after purchasing. Free version users support is limited on github.

Release Notes

Check out the release notes

License

Codestar Framework have two different version. Free version has limited features and offers only admin option panel feature. Premium version offers all extensions and more of settings for the best experience and advanced features. You can bundle the framework ( both free and premium ) in your free theme/plugin that you publish inside WordPress.org theme/plugin directory or in premium theme/plugin that you sell on your own website or in marketplaces like ThemeForest. This framework is licensed 100% GPL.

Releases

Newest 25 of 31 recorded releases.

Tag
Published
2.3.1 latest
Jan 28, 2024 2 years ago
2.3.0
Jun 19, 2023 3 years ago
2.2.9
Nov 21, 2022 3 years ago
2.2.8
Apr 13, 2022 4 years ago
2.2.7
Mar 21, 2022 4 years ago
2.2.6
Jan 8, 2022 4 years ago
2.2.5
Dec 17, 2021 4 years ago
2.2.4
Aug 9, 2021 5 years ago
2.2.2
Mar 28, 2021 5 years ago
2.2.1
Dec 31, 2020 5 years ago
2.2.0
Nov 1, 2020 5 years ago
2.1.9
Oct 9, 2020 6 years ago
2.1.8
Sep 6, 2020 6 years ago
2.1.7
Jun 18, 2020 6 years ago
2.1.6
Jun 2, 2020 6 years ago
2.1.5
May 3, 2020 6 years ago
2.1.4
Apr 27, 2020 6 years ago
2.1.3
Jan 3, 2020 6 years ago
2.1.2
Nov 14, 2019 6 years ago
2.1.1
Sep 17, 2019 7 years ago
2.1.0
Jul 10, 2019 7 years ago
2.0.9
May 31, 2019 7 years ago
2.0.8
May 10, 2019 7 years ago
2.0.7
Mar 19, 2019 7 years ago
2.0.6
Mar 6, 2019 7 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Codestar Framework 2.3.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.3.1
Findings
2
Worst severity
high
Content hash
4ed304b70258714abf8007b4…

Findings

  • high Unauthenticated demo-mode toggle via GET csf-demo writes options and loads sample admin framework

    missing_auth

    CSF_Welcome is constructed from views/welcome.php at plugin include time (CSF_Setup::includes on every request, including the front end). set_demo_mode() reads $_GET['csf-demo'] with no is_admin(), current_user_can(), or nonce check, then update_option('csf_demo_mode', true|false). Any visitor can hit GET /?csf-demo=activate. When the stored flag is truthy, the same function includes samples/admin-options.php, which CSF::createOptions('_prefix_my_options') and registers a full sample panel (code editors, upload, backup). On the following CSF::setup() (init), CSF_Options::save_defaults() may persist that sample into option _prefix_my_options and add_action('wp_ajax_csf__prefix_my_options_ajax_save'). This is an unauthenticated settings write plus a persistent extra admin/AJAX attack surface. GET makes it CSRF/prefetch-triggerable without cookies. The Tools > Codestar Framework 'Activate Demo' link is only a convenience UI; the handler is not bound to that page.

    views/welcome.php:101-118

    Recommendation

    Run demo activation only in is_admin(), require current_user_can('manage_options') and a nonce (or admin-post.php with check_admin_referer). Do not honor csf-demo on front-end requests. Consider leaving sample options opt-in via a constant rather than a public query arg.

  • medium Backup AJAX import/reset/export lack capability checks and accept an arbitrary option key

    missing_capability

    csf_import_ajax, csf_reset_ajax, and csf_export are registered on wp_ajax_ (all logged-in users) and only verify nonce action csf_backup_nonce. They never call current_user_can(). $unique is taken from POST/GET and is not compared to CSF::$args['admin_options'] keys. Import json_decodes POST[data], requires an array, wp_kses_post_deep, then update_option($unique, $data). Reset delete_option($unique) even when unique is empty. Export prints get_option($unique) as an attachment. The nonce is created in fields/backup/backup.php and printed on CSF option screens (default menu_capability manage_options; sample backup field is in samples/admin-options.php after demo activation). A subscriber cannot mint that nonce from this package's own UI, so this is not a default-install subscriber takeover. It is still a broken access-control design: any user who can render a backup field (documented menu_capability below manage_options, or any consumer panel that includes type=backup) can read/write/delete arbitrary options, including array-shaped keys such as active_plugins and {$wpdb->prefix}user_roles. CSF_Options::ajax_save / set_options() likewise save on nonce only (csf_options_nonce) with no capability check.

    functions/actions.php:61-150

    Recommendation

    In csf_import_ajax, csf_reset_ajax, and csf_export, require current_user_can('manage_options') (or the matching CSF menu_capability for that unique) after the nonce check. Allowlist $unique against registered CSF option IDs. Do not delete_option/update_option/get_option on caller-supplied keys. Add the same capability check to CSF_Options::ajax_save and set_options().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →