WP Manifestindependent plugin directory
manifest / editor / spc-dotstat-plugin

DotStat Block plugin WP RegistryMedium-severity findings · 2 findingsOpen the reportB GitLab

Wordpress Plugin for PDH.stat

by LinkDigital & SPC · gitlab.com/pacific-community/drupal-modules/spc-dotstat-plugin

★ 0stars
1.2.4latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitLab with WP-CLI:

wp plugin install https://gitlab.com/pacific-community/drupal-modules/spc-dotstat-plugin/-/archive/master/spc-dotstat-plugin-master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme gitlab.com/pacific-community/drupal-modules/spc-dotstat-plugin ↗

SPC Wordpress plugin to harvest data from Pacific data hub .Stat portal and display it as tables or charts using custom blocks.

How to

Tutorial post available here.

Information & Requirements

  • Version: 1.2.4
  • Requires at least: 5.4
  • Tested up to: 5.6.1
  • Requires PHP: 7.0

Changelog

  • 1.2.4

    • Use datetime type for time-series chart type (needs a date field configured in the .Stat Dataset)

  • 1.2.3

    • Fix to new SDMX/JSON syntax

  • 1.2.2

    • Display: Upgrade Highcharts to 10.1.0
    • Dataset: Change .stat requests
    • Dataset: Add a JSON viewer

  • 1.2.1

    • Display: Keystat now uses Wordpress Dashicons

  • 1.2.0

    • Display: Keystat styling
    • Display: Keystat dataset indicator selector
    • Dataset: Adding filter option
    • Dataset: Attributes selection fix

  • 1.1.0

    • Code review and changes by SPC

  • 1.0.0

    • Initial development by LinkDigital

Releases

3 releases.

Tag
Published
1.2.4 latest
Jul 7, 2022 4 years ago
1.2.3
Jun 20, 2022 4 years ago
1.2.2
May 20, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

GitLab does not publish per-asset download counts, so this plugin ranks on stars and activity only.

B grade

Security

DotStat Block plugin 1.2.4 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
1.2.4
Findings
2
Worst severity
medium
Content hash
2e4460a5f8dbf7e1880c9f36…

Findings

  • medium AJAX SSRF via user-controlled request_url

    ssrf

    taxcpt_request_url and taxcpt_store_refresh accept request_url from POST and pass it to wp_remote_get after FILTER_VALIDATE_URL only. Any authenticated user who can obtain chart_refresh_nonce (localized on all admin pages) can force the server to fetch arbitrary URLs and receive response bodies.

    parser/statupdate.dotstat.php:139-175

  • medium Dotstat AJAX handlers missing capability checks

    missing_capability

    taxcpt_get_display has no nonce or capability. store_refresh/request_url/keystat verify nonce but never current_user_can/edit_post, so any logged-in role with a valid nonce can refresh datasets and update post meta.

    parser/statupdate.dotstat.php:7-25

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →