WP Manifestindependent plugin directory
manifest / content / searchwp-finnish-base-forms

SearchWP Finnish Base Forms WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

SearchWP plugin to add Finnish base forms in search index

★ 0stars
180release downloads
≈10active sites
520composer installs
v3.1.0latest · 6 years ago

Install

Download searchwp-finnish-base-forms.zip From the v3.2.0 release on GitHub, Nov 3, 2019

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/joppuyo/searchwp-finnish-base-forms/releases/download/v3.2.0/searchwp-finnish-base-forms.zip

On Packagist as joppuyo/searchwp-finnish-base-forms:

composer require joppuyo/searchwp-finnish-base-forms
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

SearchWP plugin to add Finnish base forms into search index using Voikko.

What does it do?

This plugin allows you to add base forms of Finnish words in SearchWP search index. For example for word koirillekin, tokens koirillekin and koira are saved in the index during indexing. Learn mode by reading this article (in Finnish).

This plugin is compatible with Polylang. If you have Polylang installed, it will only process content written in Finnish.

Options

API type

You can use bundled voikkospell binary (on a linux x64 system) to lemmatize the indexed terms.

There is also an option to use a system-wide voikkospell command line application if you have Voikko installed on your system.

It's also possible to set up an external Node.js API to access Voikko over HTTP. Using the binary or CLI application is much faster because it doesn't have the overhead of performing a HTTP request.

Special thanks to siiptuo for contributing voikkospell support for this plugin!

Add base forms to search query

Enable this option to add base forms to search queries entered by users.

Split compound words

Enable this option to split compound words during indexing (and for user queries if the above option is enabled). For example, the word kerrostaloille is transformed into tokens kerrostaloille, kerrostalo, kerros and talo in the search index.

Search result excerpts

It's possible to generate Google-style search result excerpts where the keywords are highlighted using searchwp_finnish_base_forms_get_excerpt($post, $options) function. It takes the following parameters:

  • Post you want to create excerpt for

  • Array of options

    • length: length of the excerpt, 300 characters by default
    • query: current search query, by default it's get_search_query()
    • fallback Anonymous method that generates excerpt to display if the search query is not found in the post content, by default this will use 'excerpt' field and fall back to 'content' field. The text will be truncated according to length

    This function will automatically check all fields for the search terms that have been configured in SearchWP settings.

Requirements

  • SearchWP 2.5 or later
  • PHP 5.5.9
  • One of the following:
    • A x64 Linux or Mac server
    • A server with voikkospell command line application installed
    • A server with Node.js and about 1GB of spare RAM

Installation

  1. Download latest version from the releases tab
  2. Unzip the plugin into your wp-content/plugins directory
  3. Activate SearchWP Finnish Base Forms from your Plugins page

Bundled voikkospell binary

  1. Go on the Plugins page, find the plugin, click Settings. For API Type select Voikko binary (bundled).

Voikkospell command line

  1. Install voikkospell on your server. On Ubuntu/Debian this can be done with apt install libvoikko-dev voikko-fi
  2. Go on the Plugins page, find the plugin, click Settings. For API Type select Voikko command line.

Node.js web API

  1. Install and start Voikko Node.js web API.
  2. Go on the Plugins page, find the plugin, click Settings and enter the Node API URL there

After installation, remember to re-index the site from SearchWP settings page.

Releases

Newest 25 of 27 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v3.1.0 latest
Nov 3, 2019 6 years ago
tag only
—
Nov 3, 2019 6 years ago
searchwp-finnish-base-forms.zip
26
Dec 21, 2018 7 years ago
searchwp-finnish-base-forms.zip
12
Dec 19, 2018 7 years ago
searchwp-finnish-base-forms.zip
9
Dec 18, 2018 7 years ago
searchwp-finnish-base-forms.zip
10
Dec 18, 2018 7 years ago
searchwp-finnish-base-forms.zip
7
Dec 18, 2018 7 years ago
searchwp-finnish-base-forms.zip
9
Dec 17, 2018 7 years ago
searchwp-finnish-base-forms.zip
7
Dec 15, 2018 7 years ago
searchwp-finnish-base-forms.zip
11
Dec 15, 2018 7 years ago
searchwp-finnish-base-forms.zip
10
Dec 15, 2018 7 years ago
searchwp-finnish-base-forms.zip
10
Aug 17, 2018 8 years ago
searchwp-finnish-base-forms.zip
10
Aug 6, 2018 8 years ago
searchwp-finnish-base-forms.zip
4
Aug 3, 2018 8 years ago
searchwp-finnish-base-forms.zip
7
Aug 3, 2018 8 years ago
searchwp-finnish-base-forms.zip
6
Aug 2, 2018 8 years ago
searchwp-finnish-base-forms.zip
8
Jul 13, 2018 8 years ago
searchwp-finnish-base-forms.zip
9
Jul 13, 2018 8 years ago
searchwp-finnish-base-forms.zip
7
Jul 10, 2018 8 years ago
searchwp-finnish-base-forms.zip
8
Jul 10, 2018 8 years ago
tag only
—
Jul 10, 2018 8 years ago
release.zip
10
Jun 1, 2018 8 years ago
tag only
—
May 30, 2018 8 years ago
tag only
—
May 30, 2018 8 years ago
tag only
—
May 30, 2018 8 years ago
tag only
—
All releases on GitHub →

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

SearchWP Finnish Base Forms 3.2.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
3.2.0
Findings
1
Worst severity
high
Content hash
87d4085692e133b7e7a17c22…

Findings

  • high Authenticated SSRF: Voikko test AJAX sends Guzzle GET to attacker-controlled api_root with no capability or nonce

    ssrf

    The plugin registers wp_ajax_searchwp_finnish_base_forms_test for every logged-in user. The callback reads $_POST['api_type'] and, unless it is exactly 'binary' or 'command_line', calls web_api(['käden'], $_POST['api_root']) with no current_user_can, no check_ajax_referer, and no sanitization. web_api() builds a GuzzleHttp\Client (default allow_redirects max 5, http/https) and getAsync(trailingslashit($api_root) . 'analyze/' . $token). That is curl, not wp_remote_get, so WordPress’s loopback/local-IP HTTP API block does not apply. A Subscriber POSTs action=searchwp_finnish_base_forms_test&api_type=web_api&api_root=http://169.254.169.254/ (or an attacker host that 302s to metadata / 127.0.0.1 / RFC1918). The path suffix /analyze/käden is attacker-bypassable via redirect. The handler only wp_die()s 200 vs 500 depending on whether the JSON BASEFORM list equals ['käsi'], so the body is not returned (blind SSRF + boolean oracle). js/script.js posts this action from the settings form without a nonce, so any logged-in session can also be CSRF’d. Settings writes remain manage_options + check_admin_referer and are not this bug.

    searchwp-finnish-base-forms.php:62-74, 382-394

    Recommendation

    Gate the AJAX action with current_user_can('manage_options') and check_ajax_referer matching the settings nonce. Validate api_root with wp_http_validate_url() and reject loopback, link-local, RFC1918, IPv6 unique-local, and metadata hosts after DNS resolution. Prefer wp_remote_get() so WordPress HTTP request filters apply, disable redirects or restrict them to the same allowlist, and do not take api_root from unprivileged users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.