WP Manifestindependent plugin directory

Install

Download theater-production-subsites.zip From the 0.3.1 release on GitHub, Sep 10, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/figuren-theater/theater-production-subsites/releases/download/0.3.1/theater-production-subsites.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.


figuren.theater Logo

figuren.theater | Production Subsites

allows to create sub-sites of productions, within the WordPress Multisite network for puppeteers - figuren.theater.


Read our blog

See the network in action • Join the network • Create your own network

About

This is the long desc

  • [x] list closed tracking-issues or docs files here
  • [ ] Do you have any ideas ?

Background & Motivation

This plugin allow to create sub-sites (aka posts) of productions (that are not productions itself, so not a typical hierachical post_type), which are populated with pre-made query-block patterns, that work (almost) automatically, e.g.

  • Images (all posts with post-format image and a shadow-tax relationship with the production)
  • Videos (all posts with post-format video and a shadow-tax relationship with the production)
  • Quotes (all posts with post-format quote and a shadow-tax relationship with the production)
  • Press releases (all posts with some defined post_tag (or cat.) and a shadow-tax relationship with the production)
  • a booking Form for that production
  • An auto-generated list of customers, based on played past events
  • Technical rider (needs explicit editing, no automation planned here)
  • a Rating-Kiosk to be shown directly after a show to motivate the audience to rate the production at connected services or within the own site
  • Announcement-Kiosk which highlights the upcoming 3 events and some testimonials (quote-posts or rate-comments) to be shown within a store window or similar

Install

  1. Install via command line
     composer require figuren-theater/theater-production-subsites

Built with & uses

  • dependabot

  • code-quality

    A set of status checks to ensure high and consitent code-quality for the figuren.theater platform.

  • johnbillion/extended-cpts

    A library which provides extended functionality to WordPress custom post types and taxonomies.

    Adds some nice enhancements to the registered post_type(s), but is not required.

  • ....

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

  1. Fork the Project
  2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
  3. Commit your Changes (git commit -m 'Add some AmazingFeature')
  4. Push to the Branch (git push origin feature/AmazingFeature)
  5. Open a Pull Request

Versioning

We use Semantic Versioning for versioning. For the versions available, see the tags on this repository.

Authors

See also the list of contributors who participated in this project.

License

This project is licensed under the GPL-3.0-or-later, see the LICENSE file for details

Acknowledgments

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.3.1 latest
Sep 10, 2026 1mo ago
theater-production-subsites.zip
21
Sep 9, 2026 1mo ago
theater-production-subsites.zip
1
Sep 7, 2026 1mo ago
theater-production-subsites.zip
6
Aug 15, 2026 2mo ago
theater-production-subsites.zip
28
Feb 29, 2024 2 years ago
tag only
—
Feb 29, 2024 2 years ago
tag only
—
B grade

Security

Theater Production Subsites 0.3.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.3.1
Findings
1
Worst severity
medium
Content hash
46a8cff868a84e8e57df4f4d…

Findings

  • medium New-subsite admin action inserts a child draft without a capability or parent-authorization check

    missing_capability

    admin_action_subsite_as_draft() is hooked to admin_action__sub_as_draft. After confirming a nonce for action _sub_as_draft it absint()s attacker-controlled GET/POST 'post', loads that WP_Post, and calls wp_insert_post() with post_status=draft, post_parent set to that ID, and post_type = {that post's type}_sub. wp_insert_post() does not check capabilities. Registration\is_post_allowed() (edit_post + post_type_supports('hierachical-sub-post-type')) is used only when rendering the admin-bar and row-action links that mint the nonce; the handler never calls it, never checks create_posts on the sub type, and never verifies the parent type is allowed. A Contributor or Author who can edit one supported production therefore obtains a valid nonce and can change post= to any ID (another author's production, a page, etc.). Observable: a draft child row appears under the victim parent; if the attacker can publish, Page_List\get_siblings() includes it on that production's public subsite list. Subscriber/unauthenticated users never receive this nonce from the plugin UI and cannot complete the request. current_user_can is imported in this file and unused.

    inc/admin-ui/namespace.php:68,152-216

    Recommendation

    In admin_action_subsite_as_draft(), after loading $post, require Registration\is_post_allowed( $post ) (or current_user_can('edit_post', $post->ID) plus is_post_type_allowed( $post->post_type )) and current_user_can on the sub type's create_posts cap. Reject unknown/unsupported parent types before wp_insert_post(). Keep the existing nonce check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.