WP Manifestindependent plugin directory
manifest / content / curated-archives

Curated Archives WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Block Editor editable pages for your term archives

by Human Made · github.com/humanmade/curated-archives · website

★ 3stars
1.8kcomposer installs
1.1.4latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/humanmade/curated-archives/archive/refs/heads/main.zip

On Packagist as humanmade/curated-archives:

composer require humanmade/curated-archives
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/humanmade/curated-archives ↗

Block Editor editable pages for your term archives.

Installation

Install and activate the plugin. Using Composer is recommended.

composer require humanmade/curated-archives

Template File

By default the appropriate archive content template will be used, for example category.php or archive.php.

You can provide an alternative template for curated archive pages by adding a template file with one of the following names:

  • curated-archive-{$term->slug}.php
  • curated-archive-{$term->term_id}.php
  • curated-archive-{$term->taxonomy}.php
  • curated-archive.php

To output the curated archive page content use the following function:

  • the_curated_archive( $term_id = null ): You can optionally pass the term ID to show the content for.

Filters

  • curated_archives_taxonomies: The taxonomies curated archives supports.
  • curated_archives_post_data: The array of default post data used to create new curated archive posts.
  • curated_archives_template: The default block template for all content, this is passed to the register_post_type() call.

Releases

6 releases.

Tag
Published
1.1.4 latest
Jun 2, 2023 3 years ago
1.1.3
Jun 1, 2023 3 years ago
1.1.2
Jun 1, 2023 3 years ago
1.1.1
Jun 1, 2023 3 years ago
1.1.0
Jun 1, 2023 3 years ago
1.0.0
May 31, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Curated Archives 1.1.4 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.4
Findings
1
Worst severity
high
Content hash
993bba654c11fccf2206551a…

Findings

  • high Unauthenticated preview bypass discloses draft/private curated archives and autosaves

    information_disclosure

    the_curated_archive() treats core is_preview() as authorization to (1) output non-publish curated_archive posts and (2) swap in wp_get_post_autosave($post->ID) with no user id. is_preview() is only WP_Query::$is_preview, set in parse_query whenever the public preview query var is non-empty. WordPress’s real preview capability check (current_user_can($edit_cap) plus the_preview / preview_nonce) runs only for singular is_single||is_page queries, so on a term archive ?preview=true is true for uid 0. filter_template_include() uses the same unauthenticated is_preview() test to still load curated-archive*.php when the shadow post is not publish. Result on any site whose theme calls the_curated_archive() (the documented integration): an unauthenticated visitor who requests /category/{term}/?preview=true receives unpublished draft/private/scheduled landing-page HTML, and for published archives receives the latest {id}-autosave-v1 revision body (in-progress Gutenberg edits) via the_content(). Redirects\redirect_curated_archive_posts() also forwards preview=true onto the term link. Core _show_post_preview() would refuse this without a post_preview_{id} nonce and edit capability.

    inc/template-tags.php:57-72

    Recommendation

    Treat preview as an authenticated capability, not a query-var flag. Before rendering unpublished content or an autosave, require current_user_can('edit_post', $archive_post->ID) (the CPT uses capability_type page). Pass get_current_user_id() into wp_get_post_autosave() so uid 0 cannot load another user’s autosave. Prefer core’s preview_id + preview_nonce (post_preview_{id}) the same way _show_post_preview() does. Apply the same gate in filter_template_include() and do not copy preview=true onto public term redirects unless that cap/nonce passed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →