WP Manifestindependent plugin directory
manifest / utilities / pillar

Pillar WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Collection WordPress mini plugins (theme features) to apply theme-agnostic modifications

★ 1stars
4.1kcomposer installs
0.0.2latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/itgalaxy/pillar/archive/refs/heads/master.zip

On Packagist as itgalaxy/pillar:

composer require itgalaxy/pillar
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Collection WordPress mini plugins (theme features) to apply theme-agnostic modifications.

Requirements

Prerequisite How to check How to install
PHP >= 5.6.x php -v php.net

Installation

You can install this plugin via the command-line or the WordPress admin panel.

Via Command-line

If you're using Composer to manage WordPress, add Pillar to your project's dependencies.

composer require itgalaxy/pillar

Then activate the plugin via wp-cli.

wp plugin activate pillar

Via WordPress Admin Panel

  1. Download the latest zip of this repo.
  2. In your WordPress admin panel, navigate to Plugins->Add New
  3. Click Upload Plugin
  4. Upload the zip file that you downloaded.

Usage

  1. Activate this plugin
  2. Open function.php file in your theme.
  3. Add this code for enable mini plugin.
add_action('after_setup_theme', function () {
    add_theme_support('pillar-head-clean-up'); // List of all features placed below
});

Features

What is Feature

  1. Widely applicable. The features we distribute need to be of importance to a large number of developers. Individual preferences for uncommon patterns are not supported.

  2. Generic. Features cannot be so specific that users will have trouble understanding when to use them.

  3. Atomic. Features must function completely on their own. Features are expressly forbidden from knowing about the state or presence of other features. Area of responsibility should be only one (one feature - one area of responsibility).

  4. Unique. No two features can produce the same things.

  5. No conflicts. No feature must directly conflict with another feature.

  6. Theme-agnostic. No styles, no scripts, no images and other stuff.

  7. Open source. No commercial services, packages, libraries and files.

  8. Simple. Only action and filters.

  • No register new post types, taxonomies, widgets and shortcodes.
  • No database schema modification.
  • No public api for use in plugins, themes and etc.
  • No new markup elements on front-end (buttons, tables, lists and etc).

List

Comming soon...

Contribution

Feel free to push your code if you agree with publishing under the MIT license.

Changelog

License

Releases

2 releases.

Tag
Published
0.0.2 latest
Oct 21, 2017 9 years ago
Oct 19, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Pillar 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
61510754b457aa6b0d5d008c…

Findings

  • medium Open redirect when RedirectFeature is theme-enabled

    unsafe_input

    RedirectFeature registers query vars redirect and redirect-code. It runs wp_validate_redirect; if that returns false/empty (typical for external hosts), the else branch calls wp_redirect($sanitizedLocation) which only applies wp_sanitize_redirect and still allows off-site locations. Any site whose theme enables add_theme_support('pillar-redirect') exposes unauthenticated open redirects.

    src/Itgalaxy/Feature/RedirectFeature.php:19-36

    Recommendation

    Remove the else branch; only redirect when wp_validate_redirect / wp_safe_redirect accepts the URL. Never fall back to wp_redirect for failed validation.

  • low Header version mismatches package slug tag

    version_mismatch

    Plugin header Version is 1.0.0 while the audited package slug/tag is pillar-0.0.2 / hashes version 1.0.0. Document for inventory clarity; not directly exploitable.

    pillar.php:1-15

    Recommendation

    Align git tags, slug, and Plugin Name Version header.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.