WP Manifestindependent plugin directory
manifest / updates / disciple-tools-personal-migration

Disciple.Tools - Personal Migration WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Personal migration of contacts and groups owned by a multiplier to another Disciple Tools system.

by discipletools · github.com/discipletools/disciple-tools-personal-migration · website

★ 0stars
110release downloads
≈10active sites
0.4.2latest · 3 years ago

Install

Download disciple-tools-personal-migration.zip From the 0.4.2 release on GitHub, Feb 7, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/discipletools/disciple-tools-personal-migration/releases/download/0.4.2/disciple-tools-personal-migration.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/discipletools/disciple-tools-personal-migration ↗

Plugin Banner

Disciple.Tools - Personal Migration

Allow users to migrate their contacts and groups to another Disciple.Tools system. This plugin adds a section to the users settings page and allows them to a personal migration to another system.

Purpose

For situations where a multiplier is moving their work from one team or system to another team or system.

This plugin supports copying of 2000 contacts and 1000 groups from one system to another. It excludes any contacts labeled as "Access" and includes all contacts and groups that are shared with the user.

Usage

Will Do

  • Gives users power to copy their data between systems
  • Copy 2000 contacts and details
  • Copy 1000 groups and details
  • Copy all associated comments
  • Rebuilds generational connections and cross-references
  • Imports CSV contacts and groups

Will Not Do

  • Does not copy contacts labeled "access" unless granted access
  • Limited to 2000 contacts per site
  • Limited to 1000 groups per site
  • Consider CSV for larger lists (but no cross connection supported with CSV)

Requirements

  • Disciple.Tools Theme installed on a Wordpress Server

Installing

  • Install as a standard Disciple.Tools/Wordpress plugin in the system Admin/Plugins area.
  • Requires the user role of Administrator.

Contribution

Contributions welcome. You can report issues and bugs in the Issues section of the repo. You can present ideas in the Discussions section of the repo. And code contributions are welcome using the Pull Request system for git. For a more details on contribution see the contribution guidelines.

Screenshots

Import Tile Added to Settings Page screenshot

Screen to Import URL and Begin Migration screenshot

Processing Page as Records are copied between systems screenshot

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.4.2 latest
Feb 7, 2023 3 years ago
disciple-tools-personal-migration.zip
52
0.4.1
Oct 29, 2021 4 years ago
disciple-tools-personal-migration.zip
27
0.3
Aug 2, 2021 5 years ago
disciple-tools-personal-migration.zip
15
0.2
Jul 21, 2021 5 years ago
disciple-tools-personal-migration.zip
8
0.1
Jul 17, 2021 5 years ago
disciple-tools-personal-migration.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Disciple.Tools - Personal Migration 0.4.2 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
0.4.2
Findings
2
Worst severity
high
Content hash
d77ee01abf5a9b7dd6d87ff7…

Findings

  • high SSRF in start_migration via file_get_contents with TLS disabled

    ssrf

    private_endpoint action start_migration passes attacker-controlled data.url to file_get_contents with a stream context that disables SSL peer verification. Any authenticated Disciple.Tools user with access_contacts can make the server request internal or external URLs and ingest the response as migration JSON.

    rest-api/rest-api.php:311-340

    Recommendation

    Allowlist HTTPS hosts matching known DT export URLs; use wp_remote_get with sslverify true; reject private/reserved IP ranges.

  • low Notice dismiss AJAX updates dismissed-* options with only a nonce

    missing_capability

    dt_hook_ajax_notice_handler checks a nonce but no capability, then update_option('dismissed-' . $type) where type comes from POST. Any logged-in user who can obtain the localized nonce can flip dismissed-* options.

    disciple-tools-personal-migration.php:241-248

    Recommendation

    Require manage_options or restrict type to a fixed allowlist.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →