WP Manifestindependent plugin directory
manifest / events / commons-booking-admin-booking

Commons Booking Admin Booking WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

A Wordpress plugin, extending the commons-booking plugin to enable admins of creating bookings for other users

★ 0stars
v0.2.8latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/flotte-berlin/commons-booking-admin-booking/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Description

Commons Booking Admin Booking is a Wordpress plugin which extends the Commons Booking plugin by a form in the booking section of the administration page and enables admins to create bookings for arbitrary users.
Precondition is an exisitng timeframe for the chosen item in the wanted booking period. The limitations (Commons Booking settings) regarding the max. amount of days and the calender period don't exist. A check for already existing bookings is done and the closing days of the chosen location are taken into account. If wanted a confirmation mail can be sent (with same content as the standard booking confirmation email).

Beschreibung

Commons Booking Admin Booking ist ein Wordpress Plugin, welches das Commons Booking Plugin um die Möglichkeit ergänzt, Buchungen aus dem Admin-Bereich heraus zu erzeugen.
Auf der Buchungsseite wird ein Formular eingefügt, das es ermöglicht, für beliebige Nutzer Buchungen zu erstellen. Voraussetzung ist ein bestehender Zeitraum für den gewählten Artikel in der gewünschten Buchungszeit. Die Limitierung (Commons Booking Einstellungen) hinsichtlich maximal buchbarer Tage und des Kalenderzeitraums besteht nicht. Es wird jedoch auf ggf. schon bestehende Buchungen im gewählten Zeitraum geprüft. Schließzeiten des jeweiligen Standortes werden berücksichtigt. Wahlweise kann eine Email zur Bestätigung versendet werden (inhaltlich entspricht diese der Standard-Email zur Buchungsbestätigung).

Releases

2 releases.

Tag
Published
v0.2.8 latest
Aug 22, 2020 6 years ago
May 22, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Commons Booking Admin Booking 0.2.8 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.2.8
Findings
1
Worst severity
medium
Content hash
aedb0e5f6c8a31e63818478c…

Findings

  • medium Capability check commented out on admin booking AJAX

    missing_capability

    check_nonce() verifies wp_verify_nonce for cb_admin_booking_serial / cb_admin_booking_user_search but the current_user_can('manage_options') check is commented out. Authorization is nonce-only; any authenticated principal that can obtain the cb_admin_booking nonce can create bookings for other users.

    classes/class-cb-admin-booking-admin.php:39-66

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.