WP Manifestindependent plugin directory
manifest / media / h3-tour-management

H3 Tour Management WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress plugin for managing 3D virtual tours with analytics integration, email notifications, and client delivery

★ 0stars
3release downloads
v2.9.0latest · 7d ago

Install

Download h3-tour-management.zip From the v2.8.0 release on GitHub, Feb 27, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jefferykarbowski/h3-tour-management/releases/download/v2.8.0/h3-tour-management.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Version: 2.5.7 Architecture: S3-Only Direct Upload System

A comprehensive WordPress plugin for managing 3D virtual tours with AWS S3 storage, Lambda processing, analytics integration, and automated migration from legacy name-based to ID-based tours.

Features

Core Tour Management

  • S3 Direct Upload: Browser-to-S3 uploads bypassing server limitations

    • Handles files up to 2GB+ reliably
    • Eliminates Pantheon disk space constraints
    • Direct uploads to AWS S3 with presigned URLs
    • Automatic processing via Lambda webhooks
  • Tour Operations

    • Upload, rename, and delete tours
    • Automatic thumbnail detection
    • ID-based tour system (YYYYMMDD_HHMMSS_8random)
    • Legacy name-based tour migration

User Management

  • Assign tours to specific users
  • Custom user fields using Select2 (no ACF dependency)
  • User-specific tour access control
  • Tour metadata tracking

Analytics & Email

  • Automated analytics emails (Daily/Weekly/Monthly)
  • Google Analytics 4 integration
  • Customizable email templates
  • Email scheduling system

Admin Interface

  • React-based upload interface with real-time progress
  • Intuitive management dashboard
  • Tour overview with thumbnails
  • Email and S3 configuration
  • Migration tools (WordPress admin + WP-CLI)

Architecture Overview

System Design

Browser → AWS S3 → WordPress downloads → Extract & Process → h3panos/TOURNAME/
                   ↓
              Lambda Processing
                   ↓
              Webhook Notification

Key Components:

  • Frontend: React upload component with S3 presigned URLs
  • WordPress: Tour management, user assignments, analytics
  • AWS S3: Direct file storage and retrieval
  • AWS Lambda: ZIP extraction and file processing
  • Database: WordPress options + custom metadata tables

For complete architecture documentation, see:

Requirements

Core Requirements

  • WordPress: 5.0+
  • PHP: 7.4+ with 512MB memory limit
  • Server: Internet connectivity for S3 downloads

AWS Requirements

  • AWS S3 Bucket: For tour file storage
  • IAM User: With S3 read/write permissions
  • AWS Lambda (optional): For server-side processing
  • AWS Credentials: Access key and secret key

Optional

  • Google Analytics 4: For analytics features
  • Google API Client: For real analytics data (via Composer)

Installation

1. Plugin Installation

  1. Upload the plugin folder to /wp-content/plugins/
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Navigate to '3D Tours' in the admin menu

2. AWS S3 Setup

Required for tour uploads. See S3 Architecture Guide for complete setup.

Quick Start:

  1. Create S3 bucket in AWS console
  2. Create IAM user with S3 permissions
  3. Configure WordPress S3 settings
  4. Test S3 connection

Configuration Options:

Option 1 - Environment Variables (Recommended):

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export H3_S3_BUCKET="your-bucket-name"
export H3_S3_REGION="us-east-1"

Option 2 - WordPress Admin:

  1. Go to 3D Tours → S3 Settings
  2. Enter S3 bucket name and region
  3. Enter AWS credentials
  4. Click "Test S3 Connection"

3. AWS Lambda Setup (Optional)

For server-side tour processing, see Lambda Setup Guide.

4. Google Analytics Setup (Optional)

To enable real analytics data:

  1. Install Google API Client:

    composer install
  2. Create Google Cloud service account with Analytics API access

  3. Place credentials at WordPress root: service-account-credentials.json

  4. Grant service account "Viewer" access to GA4 property

Quick Start Guide

See QUICK_START_GUIDE.md for detailed instructions.

Uploading Tours

  1. Go to 3D Tours → Manage Tours
  2. Click "Upload New Tour"
  3. Select your tour ZIP file (up to 2GB)
  4. Enter a tour name
  5. Upload begins automatically (direct to S3)
  6. Monitor real-time progress
  7. Tour processes automatically after upload

Note: S3 configuration required. Files are uploaded directly from browser to AWS S3.

Migrating Legacy Tours

For migrating existing name-based tours to ID-based system:

Via WordPress Admin:

  1. Go to 3D Tours → Admin Tools
  2. Click "Run Migration" tab
  3. Review tours to migrate
  4. Click "Start Migration"

Via WP-CLI:

wp h3tm migrate-tours --dry-run
wp h3tm migrate-tours

See Migration Guide for complete procedures.

Assigning Tours to Users

  1. Edit any WordPress user profile
  2. Find the "3D Tour Access" section
  3. Select tours from dropdown (uses Select2)
  4. Save the user profile

Email Configuration

  1. Go to 3D Tours → Email Settings
  2. Configure sender name and email
  3. Users set email frequency in their profile

Documentation

Main Index: docs/INDEX.md

Core Guides

Architecture & Deployment

Development

Changelog

2.5.0 (Current)

  • Architecture: Trait-based modular code organization
  • S3-Only System: Removed chunked uploads, S3 direct upload only
  • Performance: Reduced memory (1024M → 512M) and execution time (15min → 5min)
  • Migration: Complete legacy-to-ID-based tour migration system
  • Lambda: AWS Lambda integration for server-side processing
  • React: Modern React upload interface with real-time progress
  • Documentation: Phase 3 consolidation (71 docs → 3 authoritative guides)

1.6.0

  • S3-only architecture
  • Removed chunked upload backend (500+ lines)
  • Simplified frontend JavaScript
  • Breaking changes: S3 required for uploads

1.5.8

  • Dual upload system (chunked + S3)
  • S3 direct upload for large files (>100MB)
  • Fallback to chunked upload

1.0.0

  • Initial release
  • Extracted tour management from theme
  • Email scheduling system
  • Google Analytics 4 integration

See CHANGELOG.md for complete version history.

Contributing

See CONTRIBUTING.md for contribution guidelines.

Support

License

GPL v2 or later


Documentation Last Updated: 2025-10-16 (Phase 3 Consolidation)

Releases

Newest 25 of 60 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.9.0 latest
Oct 15, 2026 7d ago
tag only
—
May 18, 2026 5mo ago
tag only
—
Feb 27, 2026 7mo ago
tag only
—
Feb 27, 2026 7mo ago
h3-tour-management.zip
3
Jan 23, 2026 9mo ago
tag only
—
Jan 23, 2026 9mo ago
tag only
—
Jan 23, 2026 9mo ago
tag only
—
Jan 6, 2026 9mo ago
tag only
—
Jan 6, 2026 9mo ago
tag only
—
Jan 6, 2026 9mo ago
tag only
—
Jan 6, 2026 9mo ago
tag only
—
Jan 5, 2026 9mo ago
tag only
—
Dec 2, 2025 10mo ago
tag only
—
Nov 12, 2025 11mo ago
tag only
—
Nov 12, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 28, 2025 11mo ago
tag only
—
Oct 26, 2025 12mo ago
tag only
—
Oct 26, 2025 12mo ago
tag only
—
Oct 24, 2025 12mo ago
tag only
—
Oct 23, 2025 12mo ago
tag only
—
All releases on GitHub →
D+ grade

Security

H3 Tour Management 2.8.0 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
2.8.0
Findings
2
Worst severity
high
Content hash
0e2d4041aad36ece010154a2…

Findings

  • high Unauthenticated Lambda webhook processes state changes when secret unset

    missing_auth

    wp_ajax_nopriv_h3tm_lambda_webhook reads php://input JSON and, unless signature verification is enabled with a non-empty secret, calls handle_processing_success/failure/progress_update. Default get_option(h3tm_lambda_webhook_secret, '') is empty, so !empty($this->webhook_secret) fails and authenticity checks are skipped. Attackers can mark arbitrary tours completed/failed and trigger admin notification emails.

    includes/class-h3tm-lambda-webhook.php:53-120

  • low Unauthenticated cron status AJAX discloses scheduling metadata

    information_disclosure

    wp_ajax_nopriv_h3tm_cron_status returns next_scheduled and last_run option contents with no auth. Limited blast radius (operational metadata).

    includes/class-h3tm-cron-analytics.php:22-45

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.