WP Manifestindependent plugin directory
manifest / developer / symlinked-plugin-branch

Symlinked Plugin Branch WP RegistryLow-severity findings · 1 findingOpen the reportA-

Easily identify the current git branch of your symlinked WordPress plugins.

by Joseph Fusco · github.com/josephfusco/symlinked-plugin-branch · website

★ 7stars
7composer installs
1.2.1latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/josephfusco/symlinked-plugin-branch/archive/refs/heads/main.zip

On Packagist as josephfusco/symlinked-plugin-branch:

composer require josephfusco/symlinked-plugin-branch
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/josephfusco/symlinked-plugin-branch ↗

Easily identify the current git branch of your symlinked WordPress plugins.

Screen Shot 2023-01-26 at 10 46 19 PM

Example for Faust development

The following example will symlink the Faust WordPress plugin into a WordPress site managed by Local.

Note that the Faust WordPress plugin source code lives inside the wpengine/faustjs so the plugin would display the branch of the faustjs monorepo.

Create the symlink

ln -s \
  ~/Code/faustjs/plugins/faustwp/ \
  ~/Local\ Sites/faust/app/public/wp-content/plugins

At this point, you should be able to see your plugin within your WordPress site.

You can test your work by viewing the plugins page of your website, or by using ls -l <plugins-directory>

Releases

2 releases.

Tag
Published
1.2.1 latest
May 18, 2024 2 years ago
1.2.0
Sep 15, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Symlinked Plugin Branch 1.2.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.2.1
Findings
1
Worst severity
low
Content hash
f247465abf0adf75143b58e5…

Findings

  • low Production debug logging of plugin symlink inventory

    debug_code

    get_plugins_with_symlinks() unconditionally error_log(print_r($symlinked_plugins, true)), leaking plugin names, versions, and symlink paths into PHP error logs on admin/GraphQL use.

    includes/utilities/functions.php:108-112

    Recommendation

    Remove error_log or gate behind WP_DEBUG.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →