WP Manifestindependent plugin directory
manifest / i18n / relevanssi-finnish-base-forms

Relevanssi Finnish Base Forms WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Relevanssi plugin to add Finnish base forms in search index

by Johannes Siipola · github.com/joppuyo/relevanssi-finnish-base-forms · website

★ 2stars
30release downloads
≈10active sites
20composer installs
v1.1.1latest · 8 years ago

Install

Download relevanssi-finnish-base-forms.zip From the v1.1.1 release on GitHub, Aug 11, 2018

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/joppuyo/relevanssi-finnish-base-forms/releases/download/v1.1.1/relevanssi-finnish-base-forms.zip

On Packagist as joppuyo/relevanssi-finnish-base-forms:

composer require joppuyo/relevanssi-finnish-base-forms
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/joppuyo/relevanssi-finnish-base-forms ↗

Latest Stable Version

Relevanssi plugin to add Finnish base forms into search index using Voikko.

What does it do?

This plugin allows you to add base forms of Finnish words in Relevanssi search index. For example for word koirillekin, tokens koirillekin and koira are saved in the index during indexing. Learn mode by reading this article (in Finnish).

Options

API type

You can use bundled voikkospell binary (on a linux x64 system) to lemmatize the indexed terms.

There is also an option to use a system-wide voikkospell command line application if you have Voikko installed on your system.

It's also possible to set up an external Node.js API to access Voikko over HTTP. Using the binary or CLI application is much faster because it doesn't have the overhead of performing a HTTP request.

Special thanks to siiptuo for contributing voikkospell support for this plugin!

Add base forms to search query

Enable this option to add base forms to search queries entered by users.

Split compound words

Enable this option to split compound words during indexing (and for user queries if the above option is enabled). For example, the word kerrostaloille is transformed into tokens kerrostaloille, kerrostalo, kerros and talo in the search index.

Requirements

  • Relevanssi 4.0.4 or later
  • PHP 5.5.9 or later
  • One of the following:
    • A x64 Linux server
    • A server with voikkospell command line application installed
    • A server with Node.js and about 1GB of spare RAM

Installation

  1. Download latest version from the releases tab
  2. Unzip the plugin into your wp-content/plugins directory
  3. Activate Relevanssi Finnish Base Forms from your Plugins page

Bundled voikkospell binary

  1. Go on the Plugins page, find the plugin, click Settings. For API Type select Voikko binary (bundled).

Voikkospell command line

  1. Install voikkospell on your server. On Ubuntu/Debian this can be done with apt install libvoikko-dev voikko-fi
  2. Go on the Plugins page, find the plugin, click Settings. For API Type select Voikko command line.

Node.js web API

  1. Install and start Voikko Node.js web API.
  2. Go on the Plugins page, find the plugin, click Settings and enter the Node API URL there

After installation, remember to re-index the site from Relevanssi settings page.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.1 latest
Aug 11, 2018 8 years ago
relevanssi-finnish-base-forms.zip
19
v1.1.0
Aug 11, 2018 8 years ago
relevanssi-finnish-base-forms.zip
11
v1.0.0
Jun 1, 2018 8 years ago
tag only
—

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Relevanssi Finnish Base Forms 1.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.1
Findings
1
Worst severity
high
Content hash
e974ecb5e5690e5793a74662…

Findings

  • high Authenticated SSRF: Voikko test AJAX sends Guzzle GET to attacker-controlled api_root with no capability or nonce

    ssrf

    The plugin registers wp_ajax_relevanssi_finnish_base_forms_test for every logged-in user. The callback reads $_POST['api_type'] and, unless it is exactly 'binary' or 'command_line', calls web_api(['käden'], $_POST['api_root']) with no current_user_can, no check_ajax_referer, and no sanitization. web_api() builds a GuzzleHttp\Client (default allow_redirects max 5, http/https) and getAsync(trailingslashit($api_root) . 'analyze/' . $token). That is curl, not wp_remote_get, so WordPress’s loopback/local-IP HTTP API block does not apply. A Subscriber POSTs action=relevanssi_finnish_base_forms_test&api_type=web_api&api_root=http://169.254.169.254/ (or an attacker host that 302s to metadata / 127.0.0.1 / RFC1918). The path suffix /analyze/käden is attacker-bypassable via redirect. The handler only wp_die()s 200 vs 500 depending on whether the JSON BASEFORM list equals ['käsi'], so the body is not returned (blind SSRF + boolean oracle). js/script.js posts this action from the settings form without a nonce, so any logged-in session can also be CSRF’d. Settings writes remain manage_options + check_admin_referer and are not this bug.

    relevanssi-finnish-base-forms.php:38-50, 323-337

    Recommendation

    Gate the AJAX action with current_user_can('manage_options') and check_ajax_referer matching the settings nonce. Validate api_root with wp_http_validate_url() and reject loopback, link-local, RFC1918, IPv6 unique-local, and metadata hosts after DNS resolution. Prefer wp_remote_get() so WordPress HTTP request filters apply, disable redirects or restrict them to the same allowlist, and do not take api_root from unprivileged users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →