WP Manifestindependent plugin directory
manifest / media / dominant-color-async

Dominant color async WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Calculate the dominant color for every image in WordPress, asynchronously

★ 10stars
314release downloads
≈10active sites
2.1.0latest · 5 years ago

Install

Download dominant-color-async.zip From the 2.1.0 release on GitHub, Sep 24, 2021

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/creunafi/dominant-color-async/releases/download/2.1.0/dominant-color-async.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Calculate the dominant color for every image in WordPress, asynchronously

What does it do?

Dominant color async calculates the dominant color for images in your WordPress media gallery. It will also tell you if your image has transparency, or not. You can access this information using the dca_get_image_dominant_color and dca_get_image_transparency filters. This information will be calculated after you upload images in the media gallery.

Getting dominant color

$image_id = 123;

// Returns a hex code string or null if dominant color hasn't been calculated yet 
$dominant_color = apply_filters('dca_get_dominant_color', null, $image_id);

if ($dominant_color !== null) {
    echo "Image dominant color: " . $dominant_color;
} else if ($dominant_color === null) {
    echo "Image dominant color hasn't been calculated yet.";
}

Getting transparency

$image_id = 123;

// Returns either true, false or null if transparency hasn't been calculated yet
$has_transparency = apply_filters('dca_get_transparency', null, $image_id);

// Note: use strict comparison here instead of a shorthand to differentiate between false and null
if ($has_transparency === true) {
    echo "Image has transparency";
} else if ($has_transparency === false) {
    echo "Image doesn't have transparency";
} else if ($has_transparency === null) {
    echo "Image transparency hasn't been calculated yet.";
}

How is this different from Dominant Color plugin?

Dominant Color calculates the dominant color synchronously as you are uploading them. This can sometimes take a long time and lead to frustrating experience. Dominant color async will do this processing in the background using Action Scheduler library, leading to more fluid admin experience.

Dominant color async will also allow you to calculate color information for images missing it as a batch process. This makes it easy to integrate the plugin into an existing site.

One thing missing from this plugin is the "palette" functionality of Dominant Color which generates multiple dominant colors for single image and allows you to pick from one of these. If you need this functionality, then Dominant Color is a better choice.

Requirements

  • WordPress 5.0+
  • PHP 7.0+

Installation

  1. Download latest version on GitHub releases.
  2. Upload zip in WordPress admin plugins page or unzip in the wp-plugins directory
  3. See the plugin settings page under Media

Releases

Newest 25 of 35 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.1.0 latest
Sep 24, 2021 5 years ago
dominant-color-async.zip
23
May 4, 2021 5 years ago
dominant-color-async.zip
11
May 4, 2021 5 years ago
dominant-color-async.zip
7
Oct 28, 2020 5 years ago
dominant-color-async.zip
12
Oct 28, 2020 5 years ago
dominant-color-async.zip
5
Oct 28, 2020 5 years ago
dominant-color-async.zip
6
Sep 29, 2019 7 years ago
dominant-color-async.zip
14
Sep 29, 2019 7 years ago
dominant-color-async.zip
8
Sep 29, 2019 7 years ago
dominant-color-async.zip
8
Mar 15, 2019 7 years ago
dominant-color-async.zip
11
Nov 20, 2018 7 years ago
dominant-color-async.zip
8
Nov 12, 2018 7 years ago
dominant-color-async.zip
4
Nov 9, 2018 7 years ago
dominant-color-async.zip
8
Nov 9, 2018 7 years ago
dominant-color-async.zip
7
Nov 5, 2018 7 years ago
dominant-color-async.zip
8
Nov 4, 2018 7 years ago
dominant-color-async.zip
12
Nov 4, 2018 7 years ago
dominant-color-async.zip
8
Nov 4, 2018 7 years ago
dominant-color-async.zip
11
Nov 4, 2018 7 years ago
dominant-color-async.zip
9
Nov 4, 2018 7 years ago
dominant-color-async.zip
8
Nov 4, 2018 7 years ago
dominant-color-async.zip
6
Nov 3, 2018 7 years ago
dominant-color-async.zip
4
Nov 2, 2018 7 years ago
dominant-color-async.zip
10
Nov 1, 2018 7 years ago
dominant-color-async.zip
10
Nov 1, 2018 7 years ago
dominant-color-async.zip
13
All releases on GitHub →

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Dominant color async 2.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.1.0
Findings
1
Worst severity
medium
Content hash
437dfda55a13f410802429e7…

Findings

  • medium Authenticated (Subscriber+) missing authorization and CSRF protection on batch image-processing AJAX

    missing_capability

    The Media → Dominant color async screen is registered with manage_options, but the two AJAX actions that screen uses are registered as wp_ajax_ only and the callbacks never call current_user_can() or check_ajax_referer(). assets/src/script.js posts {action: dominant_color_status|dominant_color_process_all} to ajaxurl with no nonce. WordPress therefore admits every logged-in role, including Subscriber and WooCommerce Customer, via GET or POST to admin-ajax.php. process_all() runs an unbounded attachment query and, for each id missing dominant_color or has_transparency, calls as_enqueue_async_action twice. Bundled Action Scheduler 3.1.6 as_enqueue_async_action() has no unique flag, so the endpoint is floodable and will duplicate jobs. The queue runner treats admin-ajax as is_admin() and may dispatch immediately, then process() writes post meta and decodes images with Intervention/ColorThief — CPU, memory, and actionscheduler table growth. check_status() is not state-changing but runs two posts_per_page=-1 queries (one with a meta EXISTS pair) and returns library totals. Unauthenticated callers get -1. Impact is unauthorized batch processing and resource exhaustion, not RCE or frontend XSS, so medium.

    src/DominantColorAsync.php:56-57,441-467

    Recommendation

    In both AJAX callbacks, require current_user_can('manage_options') and check_ajax_referer() (or wp_verify_nonce on a nonce localized only on the manage_options page). Reject GET for process_all. Cap the status queries (no posts_per_page=-1) and make enqueue unique per attachment/hook so repeats cannot flood the queue.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.