WP Manifestindependent plugin directory
manifest / admin / wp-clients-handoff

WP Clients Handoff WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

★ 9stars
45release downloads
≈10active sites
v0.3.1latest · 3 years ago

Install

Download wp-clients-handoff.zip From the v0.3.1 release on GitHub, Jul 12, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/dplugins-opensource/wp-clients-handoff/releases/download/v0.3.1/wp-clients-handoff.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Never forget what you need to do on your website


Thanks for the coffee. Donate on Ko-fi.


Download latest release.


alt text alt text alt text alt text


Thanks for the coffee. Donate on Ko-fi.


Introducing your Ultimate Todo List Manager for WordPress!

✅ Manage Tasks Effortlessly with WPCH Main

WPCH Main is a powerful WordPress plugin designed to revolutionize the way you manage your tasks and stay organized. With WPCH Main, you can effortlessly create and manage a comprehensive todo list directly from your WordPress dashboard.

🔥 Stay Organized with Intuitive Task Management

Stay on top of your tasks with WPCH Main's intuitive features. Add new tasks, mark them as completed, and even rename or delete tasks with just a few clicks. The plugin provides a user-friendly interface that allows you to easily organize your tasks using drag-and-drop functionality.

🌈 Export/ Import tasks

But that's not all! WPCH Main takes task management to the next level with advanced capabilities. Export your tasks as a JSON file for seamless sharing and backup, ensuring you never lose important information. Need to import tasks? No problem! WPCH Main allows you to import tasks from a JSON file effortlessly.

Installation

  1. Download latest release from Download latest release.
  2. go to plugins
  3. Add new
  4. Upload zip
  5. Once plugin is activated you will get your new "Website Todo List" widget.

Changelog

0.3.1 • If in edit mode hitting the enter will save changes • When user press edit input will be focused automatically

0.3.0 • Updated build process (Yaml)

0.2.1 • Fix: Rename is not reloading

0.2.0 • Released publicly

0.1.1 • Initial release for Todo Widget

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.3.1 latest
Jul 12, 2023 3 years ago
wp-clients-handoff.zip
29
Jul 12, 2023 3 years ago
wp-clients-handoff.zip
9
Jul 12, 2023 3 years ago
wp-clients-handoff.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

WP Clients Handoff 0.3.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.3.1
Findings
1
Worst severity
medium
Content hash
d48037acf9babc0e523bcb6b…

Findings

  • medium Missing capability check on WPCH_saveTask/WPCH_getTasks: Subscriber can wipe and replace the admin task list

    missing_capability

    WPCH_saveTask() executes `DELETE FROM {prefix}wpch_tasks` and re-inserts caller-supplied tasks, and WPCH_getTasks() returns all tasks, gated only by check_ajax_referer('ajax-nonce'). The nonce is localized (WPCH_ajax.WPCH_nonce) on the dashboard for any logged-in role. Any Subscriber can therefore delete or rewrite the site's handoff to-do list and read it. The INSERT also concatenates raw values (magic-quoted from $_POST, so not directly injectable, but unsafe).

    includes/todo-list.php:162-194

    Recommendation

    Require current_user_can('manage_options') in both handlers, restrict the widget to that capability, and use $wpdb->insert() with sanitized/cast values.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.