WP Manifestindependent plugin directory
manifest / integrations / disciple-tools-mobile-app-plugin

Disciple.Tools - Mobile App Extension WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

The Wordpress Plugin extension to support the Disciple.Tools mobile app

★ 0stars
1.3krelease downloads
≈100active sites
v1.17.1latest · 3 years ago

Install

Download disciple-tools-mobile-app-plugin.zip From the v1.17.1 release on GitHub, Sep 22, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/discipletools/disciple-tools-mobile-app-plugin/releases/download/v1.17.1/disciple-tools-mobile-app-plugin.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Plugin Banner

Disciple.Tools Mobile App Plugin

The Disciple.Tools Mobile App extends the Disciple.Tools system to support mobile app integration.

Team

Dependent Repo

Setup

This plugin is bundled with the JWT plugin.

If you get errors like "Only authenticated users can access the REST API" from the app then you may need to update your .htacces Debugging: make a POST request to/wp-json/jwt-auth/v1/token (with username and password post fields) to get the token.

POST /wp-json/jwt-auth/v1/token/validate with the token in the Authorization hearder as Bearer {token}. If you get this error: "Authorization header not found" then you need to update your .htaccss with:

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

Or with:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

Known Issues

We have observed conflicts when certain other plugins are installed which prevent the D.T Mobile App plugin from operating as expected. The following plugins and hosts have been observed to have issues:

  • JetPack multiple versions on multiple hosting providers and even self-hosted
  • Creative Mail by Constant Contact v1.2.1 on Bluehost

There will also be a conflict if you're also using another JWT Token provider plugin like: https://wordpress.org/plugins/jwt-authentication-for-wp-rest-api/

Basic Design Idea

Basic Design Idea

Releases

18 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.17.1 latest
Sep 22, 2023 3 years ago
disciple-tools-mobile-app-plugin.zip
381
Mar 20, 2023 3 years ago
disciple-tools-mobile-app-plugin.zip
142
Oct 29, 2021 4 years ago
disciple-tools-mobile-app-plugin.zip
226
Apr 16, 2021 5 years ago
disciple-tools-mobile-app-plugin.zip
102
Mar 10, 2021 5 years ago
disciple-tools-mobile-app-plugin.zip
46
Feb 18, 2021 5 years ago
disciple-tools-mobile-app-plugin.zip
87
Feb 8, 2021 5 years ago
disciple-tools-mobile-app-plugin.zip
27
Jan 26, 2021 5 years ago
disciple-tools-mobile-app-plugin.zip
31
Aug 25, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
82
Aug 14, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
24
Jun 12, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
49
Apr 30, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
23
Apr 26, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
7
Mar 10, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
14
Jan 21, 2020 6 years ago
disciple-tools-mobile-app-plugin.zip
20
Jan 10, 2020 6 years ago
tag only
—
Nov 12, 2019 6 years ago
disciple-tools-mobile-app-plugin.zip
16
Oct 21, 2019 7 years ago
disciple-tools-mobile-app-plugin.zip
24

Active-site estimate ≈100 comes from the median of recent superseded releases. Method.

C- grade

Security

Disciple.Tools - Mobile App Extension v1.17.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
v1.17.1
Findings
1
Worst severity
high
Content hash
87bda02dfc7930e8b44064d6…

Findings

  • high Unauthenticated Expo push-token leak via web-accessible vendor tokens.json

    information_disclosure

    send_notification_on_channels() boots the Expo SDK with Expo::normalSetup(), which constructs ExpoFileDriver. That driver writes every subscribed token to vendor/alymosul/exponent-server-sdk-php/storage/tokens.json (relative to the SDK: __DIR__.'/../../storage/tokens.json'). The storage directory ships with only a .gitignore (no index.php, no .htaccess). After the first push, an unauthenticated GET to /wp-content/plugins/disciple-tools-mobile-app-plugin/vendor/alymosul/exponent-server-sdk-php/storage/tokens.json returns JSON of all ExponentPushToken[...] values the site has used. Channel names are notification_type . user_id . time(), so the file also maps tokens to DT user IDs and never prunes old keys. The plugin does not call Expo::setAccessToken, and Expo's push send API treats the token as the destination capability: an attacker POSTs to https://exp.host/--/api/v2/push/send and delivers arbitrary titles/bodies to missionaries' devices. Tokens are also stored in user option dt_push_tokens (correct); the file copy is an unnecessary, world-readable duplicate.

    includes/functions.php:156-188

    Recommendation

    Do not use Expo::normalSetup() under a web-reachable plugins path. Implement ExpoRepository with an in-memory array or a non-public location (uploads outside the docroot, or a WP option/transient), or call setStorage() on a path protected by web-server rules. Deny HTTP access to vendor/**/storage. Prefer sending tokens from dt_push_tokens directly without persisting them to a file. Enable Expo push access tokens (setAccessToken) so a leaked device token is not sufficient to send.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.