WP Manifestindependent plugin directory
manifest / developer / woocommerce-dev-helper

A WooCommerce Dev Helper WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

A simple plugin for helping develop and debug WooCommerce & extensions

★ 37stars
1.0.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/godaddy-wordpress/woocommerce-dev-helper/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This is a simple and opinionated plugin for helping develop/debug WooCommerce & extensions. DO NOT USE ON A PRODUCTION SERVER.

Use Forwarded URLs

Once activated, this plugin will make WordPress use HTTP_X_FORWARDED_FOR for all your links instead of your site URL. No configuration needed.

We like to use NGrok for this.

Subscriptions

Adds a "renew" link to each subscription under WooCommerce > Subscriptions for easy renewal processing. This is particularly useful for testing payment gateways that supports subscriptions.

Allows for minutes and hours-long Subscription periods for quicker testing.

Memberships

Allows for minutes and hours-long Membership lengths for quicker testing.

Bogus Gateway

Adds a testing payment gateway that will call the $order->payment_complete() method to simulate a credit card payment. Can also be used for Subscriptions automatic renewals.

Global Functions

  • wp_debug_backtrace() - helper for using the debug_backtrace() function with a bit more sanity
  • wp_var_dump() - helper for var_dump, allowing you to return the output instead of printing
  • wp_var_log() - helper for error_log that uses print_r() or optionally wp_var_dump()
  • wp_print_r() - helper for print_r that wraps the output in <pre> HTML tags
  • wc_dev_session - JS helper to get all the current session data in console

Misc

  • Removes the WooCommmerce Updater notice
  • Removes the strong password requirement for customer accounts
  • Helper for logging actions/filters fired during a page load -- simply add ?wcdh_hooks=actions|filters|all, reload the page, and your desired hooks will be printed to the error log, along with the fired count

Installation

Download and install just like any other WordPress plugin. If you want to be really fancy, symlink it into your installs instead.

Changelog

1.0.1 - 2023.08.02

  • Tweak - Add a field at checkout when selecting the bogus payment gateway to specify the desired payment result
  • Fix - Fix support for ngrok.io
  • Misc - Remove support for ForwardHQ

1.0.0 - 2018.11.06

  • Refactor - Use namespaces and rename classes
  • Tweak - Add support for ngrok
  • Fix - Ensure images load for products when using an https tunnel
  • Misc - Require PHP 5.3+

0.8.1 - 2017.12.13

  • Fix - Remove WC 3.3+ "Connect to WooCommerce" notice when official plugins are active

0.8.0 - 2017.07.22

  • Tweak - Remove dependency on WooCommerce
  • Tweak - Add support for domain forwarding as early as possible

0.7.0 - 2017.04.12

  • Feature - Use the Bogus gateway for Subscriptions automatic renewals
  • Fix - Subscriptions integration throwing a warning in WooCommerce 3.0+

0.6.0 - 2017.02.18

  • Feature - Adds a bogus gateway that calls $order->payment_complete() when used

0.5.0 - 2017.01.19

  • Feature - Dump the current session in AJAX to display in browser console

0.4.2 - 2016.10.21

  • Tweak - Filter the human access length for membership plans that have a length in minutes or hours set via this helper plugin (Memberships 1.7.2+)

0.4.1 - 2016.10.18

  • Fix - Minutes and hours-long periods in membership plans did not work properly or when creating a user membership in admin and setting the length from the membership plan default

0.4.0 - 2016.06.06

  • Feature - Added minutes and hours Subscription periods for quicker Subscriptions testing
  • Feature - Added Memberships support with minutes and hours Memberships periods for quicker access and dripping testing
  • Feature - Added wp_print_r() helper function

0.3.0 - 2015.12.28

  • Feature - Removes WooCommerce 2.5+ strong password requirement for customer registration

0.2.0 - 2015.09.04

  • Feature - Subscriptions 2.0 Compatibility
  • Fix - Fix is_ssl() when using Forward

0.1.0 - 2015.07.25

  • Initial Release

Releases

8 releases.

Tag
Published
1.0.1 latest
Aug 2, 2023 3 years ago
Feb 22, 2019 7 years ago
Dec 13, 2017 8 years ago
Jul 23, 2017 9 years ago
Nov 9, 2016 9 years ago
Nov 9, 2016 9 years ago
Nov 9, 2016 9 years ago
Dec 28, 2015 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

A WooCommerce Dev Helper 1.0.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.1
Findings
1
Worst severity
high
Content hash
41a686f44f894ef610c59f3c…

Findings

  • high Subscriber+ can trigger arbitrary WooCommerce Subscriptions renewals with no capability or nonce check

    missing_capability

    When WooCommerce Subscriptions 2.0+ is active, process_renew_action is hooked to load-edit.php. The handler returns unless $_REQUEST['post_type']==='shop_subscription' and WP_Posts_List_Table::current_action()==='renew' (which is just $_REQUEST['action']), then absint($_REQUEST['post']) and do_action('woocommerce_scheduled_subscription_payment', $subscription_id) — the same hook WCS uses to charge the payment method on file. There is no current_user_can() and no wp_verify_nonce() (a bulk-posts nonce is placed on the admin “Renew” link but never verified). WordPress core: wp-admin/admin.php calls auth_redirect() then do_action("load-{$pagenow}") in the non-plugin-page branch, then returns to edit.php, which only later checks current_user_can($post_type_object->cap->edit_posts). This handler wp_redirect()s and exit()s first, so the cap check never runs. Any logged-in role, including Subscriber/Customer, visiting GET /wp-admin/edit.php?post_type=shop_subscription&action=renew&post={id} charges that subscription. SameSite=Lax sends cookies on a top-level GET, so this is also CSRF against any logged-in browser. The constructor additionally forces woocommerce_subscriptions_is_duplicate_site to false, disabling WCS’s staging-site payment guard. The legacy pre-2.0 path does verify a nonce but still has no capability check.

    includes/Integrations/Subscriptions.php:111-135

    Recommendation

    Require current_user_can('manage_woocommerce') (or the shop_subscription edit_posts cap) and check_admin_referer('bulk-posts') (or a dedicated nonce) before firing woocommerce_scheduled_subscription_payment. Do not exit via redirect until those checks pass. Do not force woocommerce_subscriptions_is_duplicate_site to false on production. Prefer admin_post_{action} over load-edit.php.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.