WP Manifestindependent plugin directory
manifest / updates / git-updater-test-plugin

Git Updater Test Plugin WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

A WordPress plugin proof-of-concept, that uses an API agnostic implementation to intercept the default WordPress plugin update behavior.

★ 5stars
7release downloads
0.0.4latest · 1 year ago

Install

Download git-updater-test-plugin-0.0.4.zip From the 0.0.4 release on GitHub, May 4, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/fabrikage/git-updater-test-plugin/releases/download/0.0.4/git-updater-test-plugin-0.0.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A WordPress plugin that demonstrates remote plugin updates using repository releases API.

Disclaimer

This README file is incomplete and might not provide all the necessary information for using the plugin. Make sure to read through the source code for a better understanding of the plugin's functionality and configuration options.

Overview

This plugin serves as a demonstration of how to implement automatic updates for WordPress plugins using external repository hosting services. It sets up a system that connects to a repository's API, checks for new releases, and provides users with update notifications within the WordPress admin panel.

This repository serves as a proof-of-concept for the plugin's functionality. You can use it as a reference for implementing similar functionality in your own WordPress plugins.

Features

  • Connects to external repository hosting service API (only GitHub for now)
  • Authenticates with repository services using personal access tokens
  • Fetches release information including version numbers, changelog, and download URLs
  • Provides update notifications in WordPress admin when a new version is available
  • Handles the update process through WordPress's built-in updater system

Configuration

The plugin can be configured to check for updates from any compatible repository. The access token must have appropriate permissions to access the repository.

How It Works

The plugin uses the following components:

  • ClientInterface class: Handles communication with the repository API
  • UpdateChecker class: Integrates with WordPress update system
  • Bootstrap class: Initializes the plugin and sets up the update system

The update process follows these steps:

  1. The plugin checks for new releases on the remote with the pre_set_site_transient_update_plugins hook
  2. It compares the current version with the latest release version
  3. If a newer version is available, it displays an update notification
  4. When the user initiates the update, it downloads the new version from the repository

Requirements

  • WordPress 5.0 or higher
  • PHP 8.0 or higher
  • Repository access token with appropriate permissions

Development

For developers, the plugin includes a CI/CD workflow that automatically creates releases when tags are pushed. The workflow:

  • Generates a changelog from commits
  • Prepares the plugin files for distribution
  • Creates a ZIP file with the appropriate version number
  • Uploads the ZIP file as a release asset

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.0.4 latest
May 4, 2025 1 year ago
git-updater-test-plugin-0.0.4.zip
4
May 4, 2025 1 year ago
git-updater-test-plugin-0.0.3.zip
2
May 4, 2025 1 year ago
git-updater-test-plugin-0.0.2.zip
1
May 4, 2025 1 year ago
git-updater-test-plugin-0.0.1.zip
0
A- grade

Security

Git Updater Test Plugin 0.0.4 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
0.0.4
Findings
1
Worst severity
low
Content hash
2352951a8d401a0ef00d404f…

Findings

  • low Force update check missing capability and nonce

    missing_capability

    UpdateChecker::forceUpdateCheck runs on admin_init whenever force-plugin-update is present in the query string. There is no current_user_can check and no nonce, so any logged-in user who can reach wp-admin (including Subscriber) or a CSRF'd admin session can clear the update_plugins transient and force a GitHub update poll. Blast radius is limited to update-check churn/redirect.

    src/UpdateChecker.php:17-24

    Recommendation

    Gate with current_user_can('update_plugins') and check_admin_referer before deleting the transient.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.