WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hube2/acf-prevent-timeouts/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Prevent ACF Timeouts

This plugin is for use with Advanced Custom Fields (ACF) and will work with any version of ACF that includes the hooks 'acf/save_post' and 'acf/update_value'. As far as I know this means any version of ACF past or future.

Have you ever created an extremely complex ACF field group for something like a page builder? One day someone is editing a page and they've added more content and fields into the repeaters and flexible content than it can handle and when they save it the page just times out.

This pluign is a means to prevent this situation. This plugin does not speed up the process of saving the updates, but it does prevent the timeout error situation by intervening when the save process is taking too long.

When it appears the the update is taking too long and a timeout may be iminent, this plugin sends the user to a temporary page so that the update can continue in the background. Once the update is complete then the user is sent on their way to the page that they were supposed to get to after the update.

screenshot

Please note again, like I said above, this plugin does not correct the issue in ACF assocaited with saving many custom fields. The bigger problem for me is the timeout that happens when the number of fields becomes too large. While a slow admin may be a little frustrating to some, an admin page that crashes is unexceptable. I may not be able to speed things up but I can stop the page from crashing.

Important Note

Please ensure that your site and all ACF save processes are working correctly and without any errors before activating this pluging. Any errors that may occur when the temporary page is being shown will not be visible. These errors can prevent the correct saving of custom field data.

Filters

There are some adjustments that you can make to this plugin using filters.

Timeout

The timeout is set to 20 seconds. When the page has been processing for this amount of time it will trigger the temporary page will be shown. You can change this duration by adding the following filter to your functions.php file

add_filter('acf/prevent-timeout/time', 'my_acf_timeout_time', 10, 2);
function my_acf_timeout_time($time, $post_id) {
  // set time to 10 seconds
    $time = 10;
    return $time;
}

Updates

This plugin is currently set up to work with GitHub Updater. If it seems popular and useful I will publish it to WordPress.org.

Releases

3 releases.

Tag
Published
1.0.3 latest
Jul 19, 2021 5 years ago
Jun 30, 2021 5 years ago
May 1, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

ACF Prevent Timeouts 1.0.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.3
Findings
1
Worst severity
high
Content hash
1b0fd4b0b2a2e763c8e2bc1b…

Findings

  • high Any logged-in user can delete arbitrary options via AJAX (no capability or nonce)

    missing_capability

    acf_prevent_timeout::refresh() is hooked only to wp_ajax_acf_prevent_timeout_refresh (any authenticated user). It assigns $_GET['id'] to $this->id with no sanitization or prefix check, loads that option, and if $_GET['set_clear'] is truthy (anything other than the string 'false' after a loose compare) calls delete_option($this->id). There is no current_user_can, no check_ajax_referer/wp_verify_nonce, and the action is a GET, so a Subscriber can delete active_plugins, {prefix}user_roles, siteurl, template, rewrite_rules, or any other option, and a CSRF GET/img from a logged-in admin session does the same. Intended IDs are uniqid('acf-prevent-timeouts-'), but the handler never enforces that prefix. get_option() also copies every key of a matching array option onto $this, so a stored 'id' key retargets the delete, and keys named redirect/error/error_text/complete/all_clear/fields_processed are echoed back as JSON.

    acf-prevent-timouts.php:350-402

    Recommendation

    Allow only option names that start with the plugin prefix (acf-prevent-timeouts-). Require a capability consistent with the in-flight ACF save (at least edit_posts) and verify a nonce (check_ajax_referer). Do not delete options over GET. Prefer a non-autoloaded transient keyed to the uniqid, and never copy arbitrary option keys onto $this.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.