WP Manifestindependent plugin directory
manifest / utilities / dude-really-simple-ads

Really simple ads WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A simple way to manage, track and show ads

★ 11stars
67composer installs
1.2.4latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/digitoimistodude/dude-really-simple-ads/archive/refs/heads/master.zip

On Packagist as digitoimistodude/dude-really-simple-ads:

composer require digitoimistodude/dude-really-simple-ads
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Note This ad plugin is considered legacy. You should really consider using air-ads.

Really simple ads

Digitoimisto Dude Oy is a Finnish boutique digital agency in the center of Jyväskylä.

Table of contents

Please note before using

By using this code bases, you agree that the anything can change to a different direction without a warning.

Features

Basic feature list includes

  • Multiple ad places
  • Campaigns containing multiple ads
  • Sheculed ads with start and end time
  • Sheculed campaigns with start and end time
  • Simple view and click counter per ad (JavaScript)
  • Ad view throttle prevention, so F5 will not bump up the display count (JavaScript)
  • Private notes for ads and campaigns

Usage

Register ad places

Ad places are registered with drsa_ad_placement_sizes hook. You should pass nested array containing one array element per each ad place. See basic exmaple below.

add_filter( 'drsa_ad_placement_sizes', 'myprefix_register_ad_places' );
function myprefix_register_ad_places() {
    $spots = array(
        array(
            // title whichs shows when adding ads
            'name'      => __( 'Frontpage default' ),

            // unique identified for this placed, used to get ads
            'id'        => 'frontpage-default',

            // add size, uploaded image will be tested against these values
            'width'     => 480,
            'height'    => 480,

            // for having multiple ads in the same place, ads will be shown in the order of least shown to most shown
            'multiple'  => true,
        ),
    );

    return $spots;
}

Get active ad

Getting the active ad is fairly simple, just use get_the_active_ad function and pass the used ad place as a paremeter.

If there is active campaign for that ad place, a random active ad assigned to selected place will be returned. When there is no active campaign, active single ad for place is returned. Default ad and link will be returned if no active campaign or ad are found, if there is no default then return is false.

When there is ad, return is array containing the ad place name, image src, target address and click counter class. Simple usage example is below, but you can modify it according to your needs. Click counter class needs to be in the same element with the target href.

$ad = false;
if ( function_exists( 'get_the_active_ad' ) ) {
    $ad = get_the_active_ad( 'frontpage-default' );
}

if ( $ad ) {
    echo '<a href="' . $ad['target'] . '" target="_blank" class="' . $ad['click_counter_class'] . '"><img src="' . $ad['src'] . '" class="ad ad-place-' . $ad['place'] . '"/></a>';
}

Always check the existance of function.

Adding a shortcode to embed ads into content

You can make your own shortcode to get ads everywhere you want, for example into the content of blog post. Below is simple example of shortcode usage.

add_shortcode( 'ad', 'myprefix_shortcode_show_ad' );
function myprefix_shortcode_show_ad( $atts ) {
    if ( ! function_exists( 'get_the_active_ad' ) ) {
        return; // plugin not active, bail
    }

    if ( empty( $atts ) ) {
        return; // no attributes to shortcode, bail
    }

    // no ad place defined, show error to user and bail if visitor
    if ( ! isset( $atts['place'] ) ) {
        if ( is_user_logged_in() && current_user_can( 'edit_others_posts' ) ) {
            return __( 'No ad place defined', 'textdomain' );
        } else {
            return;
        }
    }

    // get the ad
    $ad = get_the_active_ad( $atts['place'] );

    // no active ad, show error to user and bail if visitor
    if ( ! $ad ) {
        if ( is_user_logged_in() && current_user_can( 'edit_others_posts' ) ) {
            return __( 'No active ads or campaigns', 'textdomain' );
        } else {
            return;
        }
    }

    // return ad html
    return '<a href="' . $ad['target'] . '" target="_blank" class="' . $ad['click_counter_class'] . '"><img src="' . $ad['src'] . '" class="ad ad-place-' . $ad['place'] . '"/></a>';
}

Hooks

Plugin contains a set of hooks for you to use and modify behavior of plugin.

Set default ad and link

If there is no active ads for the place, you can set default image and link for the ad place in question with two different hooks.

Use filter drsa_default_ad/{place-id} to set default ad image src. Use filter drsa_default_ad_target/{place-id} to set default ad address.

Disable UTM tags in ad target url

By default UTM tags are inserted automatically to the ad target address, use filter drsa_use_utm to disable it.

To disable globally, use add_filter( 'drsa_use_utm', '__return_false' ); To disable by ad place, use add_filter( 'drsa_use_utm\{place-id}', '__return_false' ); To disable by single ad, use add_filter( 'drsa_use_utm\ad\{ad-id}', '__return_false' );

Disable or change ad view throttle time

If visitor reloads the page or visits in the same page again within 30 seconds after first visit, the new visit is not counted to ad views. If same ad is shown in multiple pages, each page has it's own throttle prevention. For exmaple if ad is in sidebar, reload within 30 seconds in frontpage does not count new view but visit in another page will.

This is simple prevention to ensure that view count is somewhat accurate.

Change the throttle time with filter drsa_counter_cookie_timeout, return thtrottle time in milliseconds. To disable the feature, return zero.

End ads display at specific amount of views

Set filter drsa_end_ads_by_show_count to true, to switch ad ending from date to view count.

Allow alternative images for ads

Set filter drsa_allow_alternative_image to true, to allow alternative images for ads. This will ad a alternative image field in ad edit screen. Use drsa_alternative_image_desctiption_text filter, to change the description of the field. Default ''.

Changelog

Changelog can be found from releases page.

Contributing

If you have ideas about the plugin or spot an issue, please let us know. Before contributing ideas or reporting an issue about "missing" features or things regarding to the nature of that matter, please read Please note section. Thank you very much.

TODO

[ ] better inline commenting

Releases

9 releases.

Tag
Published
1.2.4 latest
Jun 11, 2024 2 years ago
Sep 4, 2023 3 years ago
Jan 10, 2023 3 years ago
Dec 28, 2022 3 years ago
Dec 2, 2022 3 years ago
Mar 22, 2022 4 years ago
Mar 22, 2022 4 years ago
Feb 26, 2021 5 years ago
Jan 28, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Really simple ads 1.2.4 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.2.4
Findings
2
Worst severity
high
Content hash
51749334f436a02d20faeb8f…

Findings

  • high Stored XSS in ads list via unescaped ad target URL

    xss_stored

    DRSA_Post_Type::list_columns_content prints the ad destination into a single-quoted href with no esc_url()/esc_attr(). The write path is the CMB2 field _drsa_ad_target_url (type text_url, protocols http/https), which sanitizes with esc_url_raw(). That uses esc_url() in 'db' context, so apostrophes are allowed and not converted to '. The drsa_ad CPT uses capability_type 'post', so an Author (or any role that can edit a drsa_ad and set a featured image — the preview column only emits the <a> when both $src and $target are non-empty) can publish an ad whose target is https://evil.example/?x='onclick='alert(document.domain). When an Administrator/Editor opens Ads in wp-admin, the column HTML becomes <a href='https://evil.example/?x=' onclick='alert(document.domain)' ...> and the handler runs in the admin origin. Subscriber cannot reach this write path. Plugin-owned front-end code returns the URL from get_the_active_ad() rather than echoing it; theme output is out of scope.

    includes/extending-class-post-type.php:180-188

    Recommendation

    Echo the destination with esc_url() (display context) or esc_attr( esc_url( $target ) ), and escape $src the same way. Do not interpolate esc_url_raw() values into HTML attributes. Optionally raise drsa_ad/cpt/capability_type above 'post' if Authors should not manage site-wide ads.

  • medium Unauthenticated drsa_count AJAX allows unbounded stats inserts and unthrottled counter writes

    dos

    wp_ajax_nopriv_drsa_count and wp_ajax_drsa_count both call DRSA_Show_Ads::update_statistics. Auth is only check_ajax_referer('drsa'.$ad). get_the_active_ad() puts that nonce in localized JS (action 'drsa'+ad id) on every page that shows an ad; for logged-out users the nonce is the shared uid-0 value, so any visitor who can load an ad slot can call the endpoint. $_POST['page'] and $_POST['place'] are only sanitize_text_field'd (varchar 128), are not bound to the real placement or request URI, and form the UPDATE key. When the UPDATE matches 0 rows the handler INSERT's a new wp_drsa_ad_data row. An unauthenticated client can therefore mint unique page/place pairs and grow the table without a server-side rate limit (the 30s throttle lives in sessionStorage in public/js/script.js and is skippable). Observable: POST action=drsa_count&ad=<id>&nonce=<from page>&page=<random>&place=<random> returns success and adds a row; repeating with new page/place fills the table. Consumer DRSA_Metaboxes::ad_meta_data does SELECT * FROM wp_drsa_ad_data WHERE ad_id=%d and dumps every row into an admin table and frappe-charts dataset, so the flood also hangs the ad edit screen. The same request increments _drsa_campaing_show_counter / _drsa_campaing_click_counter on the ad post (no post-type check beyond the nonce-bound id). If the site enabled drsa_end_ads_by_show_count, reaching _drsa_ad_timing_end_view_count delete_post_meta's _drsa_ad_show and get_the_active_ad() stops returning that ad. Default install does not enable that filter; unbounded inserts always work.

    public/extending-class-show-ads.php:232-276

    Recommendation

    Bind page/place to the server-known placement and request path instead of trusting POST. Enforce a server-side per-ad/IP rate limit (do not rely on sessionStorage). Require the post to exist and be a published drsa_ad before updating meta. Add a unique index on (ad_id, date, page, place) and cap or aggregate inserts. Do not delete _drsa_ad_show from this unauthenticated endpoint without additional proof the view is legitimate. Use $wpdb->prefix instead of the hardcoded wp_drsa_ad_data table name.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.