WP Manifestindependent plugin directory
manifest / content / altlibrarian

Alt Librarian WP RegistryHigh-severity findings · 4 findingsOpen the reportD+ GitLab

The AltLibrarian WordPress plugin as used by the Alternative Library at altlib.org. This is a heavily modified version of WebLibrarian by Robert Heller.

by David Zhang, Matt Gilmore · gitlab.com/altlib/altlibrarian · website

★ 0stars
v1.9.5latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitLab with WP-CLI:

wp plugin install https://gitlab.com/altlib/altlibrarian/-/archive/develop/altlibrarian-develop.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme gitlab.com/altlib/altlibrarian ↗

Description

AltLibrarian is a heavily modified version of WebLibrarian by Robert Heller. This WordPress plugin should work as of version 5.6.1.

Version

This plugin was forked at version 3.2.10.8 and has been in independent development since.

Global Node Dependencies

  • sass
  • typescript
  • webpack
  • webpack-cli

Building

Simply issue npm run build to stage a build of the plugin in ./dev. This will then be used by Docker or can be copied to a local WordPress site. Issue npm run dist to stage a build of the plugin in ./dist for deploying to a public website.

Liability

This plugin does not seek to fit a particular purpose, and is intended for use on the Bellingham Alternative Library WordPress website. Feel free to modify the code and use it in your own projects, but note that the GPL disclaims any liability on our part. In short, this isn't built for you, so don't be surprised when it doesn't do precisely what you want.

Using Docker

Docker compose will look for the following files in docker-files:

  • 00-wordpress.sql - A SQL dump of an existing WordPress site for testing
  • wp-content - Any additional wp-content needed

With these files in place, build altlibrarian then issue npm run compose

You should then be able to access your site at http://localhost.

Using Webpack DevServer

Webpack DevServer will reload pages as changes are made to watched items. Run npm run serve to launch the DevServer in the development configuration. This will rebuild the site upon any code changes and promote them to ./dev. This will also launch a browser to the WordPress site running in the above Docker containers. This Docker configuration allows for reloading of files, so changes updated by DevServer will be visible to the Docker instance immediately. Run npm run debug to build the site, stand it up in Docker, then attach the DevServer to the build directory. This will effectively launch your browser on a copy of the the latest code. Additionally, the DevServer will trigger a reload in your browser upon detected changes.

Releases

6 releases.

Tag
Published
v1.9.5 latest
Sep 22, 2021 5 years ago
v1.9.4
Jun 27, 2021 5 years ago
v1.9.3
Jun 3, 2021 5 years ago
v1.9.2
Mar 18, 2021 5 years ago
v1.9.1
Mar 16, 2021 5 years ago
v1.9.0
Mar 14, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

GitLab does not publish per-asset download counts, so this plugin ranks on stars and activity only.

D+ grade

Security

Alt Librarian 1.9.5 · audited by WP Registry

High-severity findings.

3 high 1 medium
Audited release
1.9.5
Findings
4
Worst severity
high
Content hash
b5c21f21dfc394bc0e64ae4d…

Findings

  • high AJAX check_out/check_in lack capability checks

    missing_capability

    wp_ajax_check_out and wp_ajax_check_in update post/user meta for arbitrary item and patron IDs without current_user_can('manage_circulation') or nonce. Any logged-in patron can check books out as another patron or alter circulation state.

    AltLibrarian.php:719-751

  • high admin_post_delete_item deletes posts without capability/nonce

    missing_capability

    delete_item() calls wp_delete_post on POST ID for any authenticated user hitting admin-post.php?action=delete_item. No manage_collection check or nonce.

    AltLibrarian.php:1544-1565

  • high Admin option updates use is_admin() instead of capability

    missing_capability

    admin_update_email/branding gate on is_admin() which is true for all admin-post requests, not administrators. Any logged-in user can update altlib_email_* and branding options via admin-post.

    AltLibrarian.php:323-360

  • medium Circulation/admin_post handlers missing nonces

    missing_nonce

    Most admin_post_* and wp_ajax_* circulation handlers lack wp_verify_nonce/check_ajax_referer, enabling CSRF against librarians/patrons.

    AltLibrarian.php:123-166

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →