WP Manifestindependent plugin directory
manifest / admin / enhr-jp

ENHR-JP WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ GitLab

A testing tool for updating/creating wordpress plugins

★ 0stars
2.1.9latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitLab with WP-CLI:

wp plugin install https://gitlab.com/boeckholtz/enhr-jp/-/archive/master/enhr-jp-master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Description

  • Modular Administration Manager
  • CPT Manager
  • ACF Integration
  • Logging System
  • Multilingual support

Install instructions

Download ENHR-JP plugin

  1. After downloading extract folder in wp-content/plugins
  2. Check if form fields need adjustments for enhr-apply.js to work as expected.

In the folder example you'll find a example of a fully functional apply form.

Example:

<input class="required" type="text" name="apply[firstName]" data-error="Vul je voornaam in">

The attribute data-error is used when a field is empty or didn't validate. Example:

apply[emailAddres], apply[phoneNumber] and apply[file] have an extra validation.

  let $email    = $('#apply-form [type=email]'+requiredFieldName);
  let $phone    = $('#apply-form [type=number]'+requiredFieldName);
  let $file     = $('#apply-form [type=file]'+requiredFieldName);
  let $gender   = $('#apply-form [type=radio]'+requiredFieldName);
  let $button   = $('#apply-form [type="submit"]');

If you want to use the full power of validation and not the default browser validation of your browser use class="required" and set the requiredFieldName in enhr-jp.js to .required.

reCAPTCHA

If you have set the recaptcha value in the ENHR settings you only need to add the following code in your form:

echo \enhr\Helpers\Recaptcha::loadCaptcha();

Note that when you have not set a captcha key in ENHR settings, it obviously won't show a recaptcha.

Releases

Newest 25 of 50 recorded releases.

Tag
Published
2.1.9 latest
Mar 13, 2020 6 years ago
Mar 13, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 12, 2020 6 years ago
Mar 11, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 10, 2020 6 years ago
Mar 5, 2020 6 years ago
Mar 5, 2020 6 years ago
Mar 5, 2020 6 years ago
Mar 5, 2020 6 years ago
All releases on GitLab →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

GitLab does not publish per-asset download counts, so this plugin ranks on stars and activity only.

D+ grade

Security

ENHR-JP 2.1.9 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.1.9
Findings
2
Worst severity
high
Content hash
40e0068b270bf00ef9041be6…

Findings

  • high nopriv jqxhr exposes application logs without auth

    missing_auth

    Unauthenticated access to applies/log branches returns publisher log rows and even echoes the built SQL/query and raw $_POST in JSON (information disclosure aiding exploitation).

    inc/Base/Ajax.php:36-99

  • medium Debug mode enabled in production bootstrap

    dev_tool_in_production

    __ENHR_DEBUG__ is defined true in bootstrap.php, enabling var_dump helpers in Log trait — unnecessary attack surface / info leak in production.

    bootstrap.php:5-5

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.