WP Manifestindependent plugin directory
manifest / editor / content-aggregator-block

Content Aggregator Block WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Display the latest posts for a specified post type, taxonomy, and term.

by Happy Prime · github.com/happyprime/content-aggregator-block · website

★ 5stars
84release downloads
≈10active sites
0.7.0latest · 2 years ago

Install

Download content-aggregator-block.0.7.0.zip From the 0.7.0 release on GitHub, Jan 18, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/happyprime/content-aggregator-block/releases/download/0.7.0/content-aggregator-block.0.7.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/happyprime/content-aggregator-block ↗

Release process

In the latest release branch:

  • wp dist-archive ./ content-aggregator-block.zip --format=zip
  • Tag a release in GitHub and attach content-aggregator-block.zip to the release.

Filters

The following filters are provided to allow customization and extensibility.

contentAggregatorBlock.ExcludePostTypes

This JavaScript filter can be used to modify the options available in the Post type dropdown within the Sorting and Filtering panel. It receives the default array of post type slugs excluded from the options.

contentAggregatorBlock.itemHTML

This JavaScript filter can be used to modify the markup for an individual post item as displayed on editor views. It receives the default markup, the post data (as returned by the REST API route registered by this plugin), and the block attributes.

content_aggregator_block_item

This PHP filter can be used to modify the markup for an individual post item as displayed on front-end views. It receives the default markup, the post data, and the block attributes.

content_aggregator_block_endpoint_post_data

This PHP filter can be used to modify the data returned by the REST API route registered by this plugin. It receives the default data and the post ID.

Changelog

0.7.0

  • Add WP-CLI commands for auditing and upgrading deprecated attributes.
  • Improve fallback handling for deprecated customTaxonomy attribute.
  • Improve handling of the customPostType attribute.
  • Update PHP tooling to use Happy Prime coding standards.
  • Fix a bug when generating post format classes.

1.0.0 will be a breaking change that eliminates the customTaxonomy attribute, termID attribute, and happyprime/latest-custom-posts transform handler.

0.6.1

  • Add missing default value for customTaxonomy block attribute.
  • Bump minimum PHP support to 7.4.

0.6.0

  • Use post meta to identify which content contains content aggregator blocks.
  • Clear Kinsta page cache for URLs containing content aggregator blocks when content is updated.
  • Fix a class name attribute for byline authors.
  • Update project to use Node 18.
  • Update wordpress/scripts to 26.6.0.

0.5.3

  • Allow more than 100 items in a Content Aggregator block.
  • Update wordpress/scripts to 26.1.0.

0.5.2

  • Add content_aggregator_block_pre_render_item filter to allow a plugin or theme to fully take over the display of an item.

0.5.1

  • Add last modified date to sorting options.

0.5.0

  • Enable scrolling in the multiple select interface used for terms.
  • Add a cab-item-title class to the anchor wrapping item titles.
  • Fix an issue looping through post IDs instead of objects.

0.4.1

  • Allow CAB to be filtered by non-public taxonomies.

Releases

9 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.7.0 latest
Jan 18, 2024 2 years ago
content-aggregator-block.0.7.0.zip
16
0.6.1
Dec 5, 2023 2 years ago
content-aggregator-block.0.6.1.zip
8
0.6.0
Jun 22, 2023 3 years ago
content-aggregator-block.0.6.0.zip
14
0.5.3
Mar 31, 2023 3 years ago
content-aggregator-block.0.5.3.zip
4
0.5.2
Nov 30, 2022 3 years ago
content-aggregator-block.0.5.2.zip
15
0.5.1
Nov 22, 2022 3 years ago
content-aggregator-block.0.5.1.zip
7
0.5.0
Nov 4, 2022 3 years ago
content-aggregator-block.0.5.0.zip
4
0.4.1
May 26, 2022 4 years ago
content-aggregator-block.zip
7
0.3.0
Feb 8, 2021 5 years ago
content-aggregator-block.zip
9

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Content Aggregator Block 0.7.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.7.0
Findings
1
Worst severity
high
Content hash
76d39793bddbd44db9557a95…

Findings

  • high Unauthenticated REST posts endpoint discloses full content of arbitrary post types

    missing_permission_callback

    register_posts_endpoint() registers GET content-aggregator-block/v1/posts with permission_callback __return_true and no args schema. posts_rest_response() copies request params post_type, per_page, order, orderby, meta_key, taxonomies, tax_relation, authors, sticky_posts into build_query_args(), which sets WP_Query post_type to the first comma-separated segment of that value, posts_per_page to absint(per_page) with no upper bound, and post_status to publish only. There is no check that the type is public, publicly_queryable, show_in_rest, or that the current user can read_post. The loop then returns get_the_title(), get_the_content() (raw post_content; the_content filters used by membership/paywall plugins never run), excerpt, permalink, author, and every intermediate image-size URL. The only consumer is the block editor (edit.js apiFetch), so this should have been current_user_can('edit_posts'). Observable: an anonymous GET /wp-json/content-aggregator-block/v1/posts?post_type=wp_block&per_page=100 dumps every published reusable block; core WP_REST_Blocks_Controller refuses that without edit_posts. The same call with post_type=wp_template or wp_template_part dumps FSE templates. Any other CPT that stores live rows as publish (including non-public types) is equally readable. Drafts, private, and password bodies are not returned (password hits get_the_password_form). Sibling GET /content-aggregator-block/v1/meta is also __return_true but only echoes registered meta key names.

    includes/block.php:378-451

    Recommendation

    Set permission_callback to a closure that returns current_user_can('edit_posts') (the editor is the only caller). Allowlist post_type against public/viewable types (or types the user can read), cap per_page, and register a REST args schema. Do not return get_the_content() for types whose core REST controllers require a stronger cap (wp_block, wp_template, …). Apply the same edit_posts gate to GET /content-aggregator-block/v1/meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →