WP Manifestindependent plugin directory
manifest / social / dustpress-comments

DustPress Comments WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Comments Helper for DustPress - A WordPress plugin that adds a DustPress helper enabling ajaxified commenting for your website.

★ 1stars
4.7kcomposer installs
1.2.0latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/devgeniem/dustpress-comments/archive/refs/heads/master.zip

On Packagist as devgeniem/dustpress-comments:

composer require devgeniem/dustpress-comments
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

geniem-github-banner

Comments Helper

DustPress helpers are a handy tool for creating templates with a bit more logic. Comments Helper is a DustPress plugin for enabling commenting in DustPress based themes.

Use Comments Helper with your desired parameters and DustPress will provide an AJAX powered commenting for your posts and pages. This plugin provides base templates for a quick start. Just install and enable the plugin. You can override the templates with your own templates by adding them with the corresponding names in /partials directory inside your theme, for example starting with the container in: wp-content/themes/best-theme-ever/partials/commentscontainer.dust.

To enable full page caching on pages using DustPress Comments the helper parameters must be passed via filter or model functions. You have to provide two functions: one for fetching the comments parameters and another for comment form parameters. The filter slug or the model name will be written into the comments section dataset and into a hidden input field in the comment form. Each AJAX request will include the slug or the model name for the DustPress Comments to be able to retrieve the correct helper parameters. There are examples of both cases at the end of this document.

Functionalities

  • threaded comment loading (threaded commenting is enabled via the WordPress discussion settings)
  • comment list rendering
  • form rendering
  • ajaxified pagination (pagination is enabled via the WordPress discussion settings and uses the DustPress Pagination helper)
  • ajaxified comment submission
  • ajaxified and JS powered replying
  • status message displaying and hiding with JS and CSS
  • external JS invocation
  • support for multiple commenting sections on one page!
  • support for full page caching!

Included base templates

  • comments-container.dust (the comments section)
  • comments.dust (comment list, pagination, form)
  • comment.dust (single comment)

Accepted parameters

We will document a full list of parameters in the near future! If you have questions of the helper usage, please contact us at info@geniem.com or create a new issue.

Example usage

We provide two options for using the helper and passing parameters for its use.

Model functions for helper parameters

Both functions will get the current post id as a parameter.

class CommentsModel extends \DustPress\Model {

    public function get_comments_args( $post_id ) {
        // This disables replying to comments.
        $args['reply'] = false;
        return $args;
    }

    public function get_form_args( $post_id ) {

        $args['title_reply']  = __('Comment', 'POF');
        $args['label_submit'] = __('Submit', 'POF');
        $args['class_submit'] = 'button radius';
        $args['remove_input'] = array( 'url' );
        $args['input_class']  = 'radius';

        return $args;
    }
}

Then in your dust partial pass this model for your helper as a string.

{@comments model="CommentsModel" /}

Filter functions for helper parameters

The other way to pass parameters for the helper is to create two filter functions. The filter slug to be passed for the helper is the third part of the filter string devided with /. Each function must extend the passed $args array and then return it.

add_filter( 'dustpress/comments/my_comments/get_comments_args', 'my_comments_get_comments_args', 1, 2 );

function my_comments_get_comments_args( $args, $post_id ) {
    $args['reply'] = false;
    return $args;
}

add_filter( 'dustpress/comments/my_comments/get_form_args', 'my_comments_get_form_args', 1, 2 );

function my_comments_get_form_args( $args, $post_id ) {
    $args['remove_input'] = array( 'url' );
    return $args;
}

Then in your dust partial pass the filter slug for your helper as a string.

{@comments filter_slug="my_comments" /}

Extended functionality

DustPress Comments extends WordPress comment form functionalities with some additional features. Use the following associative keys in your comment form params with the corresponding value types:

  • replace_input: array( '{field_name}' => {somehtml} )
    • replace a comment form input field by assigning an array key to match the name field of the input
  • remove_input: array( '{fieldname}' )
    • remove comment form input by assigning array key to match the input name field

External JavaScript function invocation

If you need to hook your own scripts into DustPress Comments, we provide a handy way of adding external listeners for JavaScript actions. This is done via accessing the global Comments object under the window object which holds our global DustPress object.

var myFunction = function(state, container) {
   if ('success' === state) {
      alert('Your comment was posted!');
    }
};
window.DustPress.Comments.addListener(myFunction);

Each time DustPress Comments is performing an action it will fire your listener function with two parameters. state refers to the state commenting is in and container is the current commenting section as a jQuery object. The section also works a wrapper object for you to fetch all the data that is linked into the commenting at the current state.

Go and build a loader or some other neat functionality!

States

  • submit
  • reply
  • cancelReply
  • paginate
  • success
  • error

Releases

7 releases.

Tag
Published
1.2.0 latest
Nov 19, 2019 6 years ago
Aug 5, 2019 7 years ago
Apr 6, 2018 8 years ago
Oct 16, 2016 10 years ago
Sep 25, 2016 10 years ago
Jun 13, 2016 10 years ago
Jun 8, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

DustPress Comments 1.2.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.2.0
Findings
2
Worst severity
high
Content hash
74ecb44ba01064ec79703e09…

Findings

  • high Unauthenticated arbitrary PHP class instantiation via dustpress_comments_model

    unsafe_input

    handle_ajax_params() reads dustpress_comments_model from POST and, if class_exists(), executes new $comments_model() before requiring get_comments_args/get_form_args. paginate() is reachable unauthenticated via wp_ajax_nopriv_dustpress_comments_paginate and also via a direct after_setup_theme hook that calls paginate() on any request POSTing dustpress_comments_paginate (not limited to admin-ajax.php). An unauthenticated attacker can instantiate any autoloaded/loaded class whose constructor has side effects, which is a classic PHP object-injection/RCE primitive on WordPress sites with rich class graphs.

    classes/comments.php:192-258

    Recommendation

    Do not instantiate attacker-supplied class names. Whitelist allowed model class names (or map slugs to classes), require a nonce, and remove the after_setup_theme direct paginate() bootstrap so pagination only runs through a properly registered AJAX/REST route.

  • medium Unauthenticated comment pagination without nonce on arbitrary front-end POST

    missing_nonce

    plugin.php hooks after_setup_theme and, when dustpress_comments_paginate is present in POST, immediately calls Comments::paginate() which wp_send_json's rendered comment HTML. There is no nonce or referer check. Combined with the model parameter this amplifies unauthenticated reachability beyond admin-ajax.php.

    plugin.php:80-85

    Recommendation

    Remove the after_setup_theme POST bootstrap. Serve pagination only through wp_ajax_* with check_ajax_referer and a fixed allowlisted model.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.