WP Manifestindependent plugin directory
manifest / events / commons-booking-map

Commons Booking Map WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

a Wordpress Plugin, which extends the commons-booking plugin by a map of locations and applied items

★ 1stars
v0.9.2latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/flotte-berlin/commons-booking-map/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Description

Commons Booking Map is a Wordpress plugin, which extends the Commons Booking Plugin by a map of locations and assigned items. Openstreetmap is used as base map. These locations will be shown that have items assigned by a timeframe which ends in the future. The raw positioning is done by transforming the address into geo coordinates and can be fine tuned with a map on the 'edit location' page.
The plugin allows the creation and individual configuration of different maps. Beside other options this contains the height, zoom and map positioning, custom marker images and content of marker popups. The clustering of markers is also supported. Furthermore the items can be prefiltered by categories. It's possible to provide filters to website users, where they can set restrictions for the items shown on the map.
Beside the presentation of locally managed locations and items Commons Booking Map gives you the capability to export/import locations to/from other plugin installations. By this data can be shared, which allows the aggregation and presentation over multiple Wordpress instances.

The inclusion of a Commons Booking map into a page can be done by a shortcode with following scheme: [cb_map id=123].

Beschreibung

Commons Booking Map ist ein Wordpress Plugin, welches das Commons Booking Plugin um eine Kartendarstellung der Standorte mit den dazugehörigen Artikeln erweitert. Als Kartenmaterial wird Openstreetmap verwendet. Als Standorte werden jene angezeigt, denen ein Artikel über einen Zeitraum zugeordnet ist, dessen Ende in der Zukunft liegt. Die Positionierung erfolgt grob über die jeweilige Adresse und kann über eine Karte auf der 'Standort bearbeiten'-Seite feinjustiert werden.
Das Plugin ermöglicht die Erstellung und individuelle Konfiguration von verschiedenen Karten. Dies beinhaltet u.a. die Höhe, Zoom und Kartenpositionierung, angepasste Marker-Grafiken und Inhalte der Marker-Popups. Das Clustern von Markern wird ebenfalls unterstützt. Außerdem können Artikel nach Kategorien vorgefiltert werden. WebseitennutzerInnen können ebenfalls Filter zur Auswahl der angezeigten Artikel angeboten werden.
Neben der Anzeige lokal verwalteter Standorte und Artikel erlaubt Commons Booking Map den Export/Import von Standorten zu/von anderen Plugin-Installationen. So können Daten mit anderen geteilt werden und es wird die Aggregation und Präsentation über mehrere Wordpress-Instanzen hinweg ermöglicht.

Die Einbindung einer Commons Booking Karte in eine Seite erfolgt über einen Shortcode mit folgendem Schema: [cb_map id=123].

Screenshot

example

Credits

leaflet
spin.js
openstreetmap.org
JSON Schema for PHP

Releases

2 releases.

Tag
Published
v0.9.2 latest
May 28, 2020 6 years ago
May 22, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Commons Booking Map 0.9.2 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
0.9.2
Findings
2
Worst severity
high
Content hash
458323e64753a010b50d1d6e…

Findings

  • high Unauthenticated SSRF in location import test AJAX

    ssrf

    wp_ajax_nopriv_cb_map_import_source_test → handle_location_import_test() calls fetch_locations() which wp_safe_remote_post()s to $_POST['url'] with no capability, nonce, or URL allowlist. Unauthenticated attackers can probe internal services / cloud metadata from the server.

    classes/class-cb-map.php:241-280

    Recommendation

    Remove nopriv registration; require manage_options + nonce; restrict URLs to https and block private IP ranges.

  • medium Unauthenticated map import-of-map AJAX gated only by post meta auth_code

    missing_auth

    wp_ajax_nopriv_cb_map_location_import_of_map compares $_POST['auth_code'] to post meta cb_map_import_auth_code then imports locations. No capability/nonce; security depends entirely on secrecy of the temporary code.

    classes/class-cb-map.php:387-400

    Recommendation

    Require authenticated admin + nonce; use short-lived cryptographically random codes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.