WP Manifestindependent plugin directory
manifest / themes / wordpress-theme-framework

WordPress Theme Framework WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Lightweight MVC theming framework for developers who want to better organize their own custom themes with an MVC approach.

★ 26stars
3.1.5latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/justcoded/wordpress-theme-framework/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Contributors: aprokopenko Description: Lightweight theme framework base with Model-View concept for developers who want to better organize their own custom themes. Tags: mvc theme, theme boilerplate, oop theme, mini framework Author: JustCoded / Alex Prokopenko Author URI: http://justcoded.com/ Requires at least: 4.7 Tested up to: 5.8 License: GPL3 Stable tag: 3.0

Lightweight theme framework base with Model-View concept for developers who want to better organize their own custom themes.

Description

Just Theme Framework is a lightweight theme framework base with Model-View concept for developers who want to better organize their own custom themes.

Our mini framework features:

  • Better organized templates system.
  • Easy Post Types or Taxonomies registration.
  • Base Model class.
  • Advanced Theme registration class.
  • Easy creation of Admin options pages.
  • Supports numerous plugins:
    • WooCommerce
    • Autoptimize, WP Super Cache (easy customization of scripts optimization)
    • Contact Form 7 (auto save all requests to DB)
    • Just Custom Fields
    • Just TinyMce Custom Styles
    • Just Responsive Images
    • Faker Press

We didn't added "Controllers" level, because WordPress has it's own routing system and replacing it with one more level will impact the site speed. So basically it's very close to standard WordPress theme with much better organization of custom logic parts, custom queries etc.

Better organized templates system

You can now place all templates under "views" folder with section-by-section break down. Search your templates easily under page, post, search folders. Or create new folder for your new Custom Post type and place all your templates there.

Modern layouts system, taken from Laravel and Yii PHP Frameworks. Under views folder you can have different nested layouts to keep header and footer in the same place. All repeatable wrappers from section templates can be moved just as a new layout.

The template system is patched with standard WordPress hooks, which were added in version 4.7. We support all WordPress standard template hierarchy. Our patch just adds /views/{section} prefix to the list of available templates.

Easy Post Types or Taxonomies registration

Use our base PostType or Taxonomy class to register your own Post Types or Taxonomies. It has more intuitive options; built-in support for redirects, if you don't need a single page.

A lot of registered constants simplify the development, because your IDE will help you to set correct supports values, post statuses or order by values in WP_Query.

Base Model class

Base Model class has wrappers for WP_Query, which works correctly with Custom Archives of Custom Post Types. Standard custom archives doesn't have pagination, if you want to print them manually.

Advanced Theme registration class

Nice organized Theme registration class, which has a lot of hooks to patch standard WordPress installation with better security and SEO optimizations.

Easy creation of Admin options pages

Built in wrapper for Titan Framework to rapidly build Admin option pages

Theme Build Example

You can find theme build example here: https://github.com/justcoded/wordpress-theme-boilerplate.

Don't forget to copy requirements.php to your theme and require it at the top of theme functions.php file!

Have a feedback?

Write to us on our github repository: https://github.com/justcoded/wordpress-theme-framework

Installation

  1. Download, unzip and upload to your WordPress plugins directory
  2. Download, unzip and upload Titan Framework (https://wordpress.org/plugins/titan-framework/) plugin to your WordPress plugins directory
  3. Activate Just Theme Framework and Titan Framework plugins within you WordPress Administration Backend
  4. Copy just-theme-framework-checker.php file from plugin directory to your theme's root and include it at the top of your theme functions.php file.
  5. You are okay now to start using the framework.

Upgrade Notice

To upgrade remove the old plugin folder. After than follow the installation steps 1-2.

Changelog

Version 3.1.5 - 6 Sep 2021

* PHP 8 support
* Tested with WordPress 5.8

Version 3.1 - 22 Aug 2019

* New: Theme class property to disable gutenberg for the whole site or specific post types.
* New: Autoptimize post-content filter to add link rel nofollow to external links.
* New: Base class for Cron jobs, which wraps WordPress Cron API and simplify its usage.
* New: Base class for REST Controller, which wraps WordPress REST Controller and simplify its usage. 

Version 3.0.2 - 21 Feb 2019

* Bugfix: Faker generated images doesn't have thumbnails.

Version 3.0.1 - 14 Jan 2019

* Hotfix: Added support for Gutenberg and REST API for Custom Post Types..    

Version 3.0 - 18 Sep 2018

* New: ACF code fields registration support
* New: https://github.com/StoutLogic/acf-builder package dependency and class wrappers

Version 2.3.0 - 22 Aug 2018

* New: Page Builder updates and new builder fields for autocomplete of Posts and Terms.

Version 2.2.0 - 27 June 2018

* New: Support FakerPress plugin to generate PostTypes data with complex custom fields structure.

Version 2.1.1 - 10 January 2017

* New: Updated View component and layouts wrapping rendering. Replaced `layout_open()`/`layout_close()` methods with `extends()` method. Renamed `render()` method to `include()`
* New: Moved Model meta getter methods to separate Postmeta and Termmeta objects.

Version 2.0.1 - 27 November 2017

* New: Removed theme hooks to patch WordPress-generated .htaccess (moved to starter package)

Version 2.0 - 21 November 2017

* New: Namespaces refactored
* New: Package renamed
* New: Should be added as "mu-plugin"
* New: Now is a part of: https://github.com/justcoded/wordpress-starter

Version 1.3.2 - 28 September 2017

* Bugfix: Hide Loadmore button after load last page, fix multiclick

Version 1.3.1 - 11 August 2017

* Bugfix: Missing css and js for Page Builder widgets preview

Version 1.3 - 10 August 2017

* New: Ability to set preview images for widgets based on SiteOrigin Widgets Bundle.

Version 1.2.6 - 9 August 2017

* Hotfix: Page Builder 2.5.10 update. Removed notices (for some reason builder render called twice in new builder version).
* Bugfix: Remove test info from load more helper

Version 1.2.5 - 7 August 2017

* Bugfix: Just Post Preview plugin support: templates hierarchy hook works wrong

Version 1.2.4 - 1 August 2017

* New: Added default Ajax Load More functionality

Version 1.2.3 - 26 May 2017

* Hotfix: PageBuilderWidget raise fatal error when Site Origin Widgets Bundle plugin is not installed or deactivated.

Version 1.2.2 - 12 May 2017

* Hotfix: Page Builder design options (background, borders) were missing in new version. Fixed.

Version 1.2.1 - 12 May 2017

* Improvement: Change wp hook to widgets_init for register_widget method

Version 1.2 - 12 May 2017

* Refactor: Update Page Builder classes to work with new Site Origin Page Builder 2.5+
* New: Added version folder prefix for Page Builder to be able to have different patches inside in future.
* New: Page Builder Row/Widget layouts changed structure to container - style container (instead of wrapper - container) to match origin Page Builder logic
* New: Base class for quick widgets creating based on Site Origin Widgets Bundle pack
* New: Autoptimize class has new exceptions for Wordfence plugin by default.

Version 1.1.3 - 20 April 2017

* New: Enables SVG uploads support by default

Version 1.1.2 - 29 March 2017

* Code style: Fixed code style according to latest WPCS 0.11

Version 1.1.1 - 24 March 2017

* Improvements: Support of Autoptimize plugin improved, added more hooks. Set to move jquery.js, CF7 scripts first, just before optimized cached file.

Version 1.1

* Bug fix: Allow wp-login.php when theme is active, but requirements are not met.
* New: Support for ACF and JCF inside Models. Now you can use "field_{fieldname}" magic property or get_field() method inside models.

Version 1.0

* Our mini-framework launch.

Releases

Newest 25 of 29 recorded releases.

Tag
Published
3.1.5 latest
Sep 6, 2021 5 years ago
Aug 14, 2020 6 years ago
Feb 14, 2020 6 years ago
Jan 31, 2020 6 years ago
Jan 31, 2020 6 years ago
3.1
Aug 22, 2019 7 years ago
Feb 21, 2019 7 years ago
Jan 14, 2019 7 years ago
3.0
Sep 18, 2018 8 years ago
Aug 27, 2018 8 years ago
Aug 22, 2018 8 years ago
Aug 22, 2018 8 years ago
Jun 27, 2018 8 years ago
Jan 10, 2018 8 years ago
Nov 27, 2017 8 years ago
2.0
Nov 21, 2017 8 years ago
Sep 28, 2017 9 years ago
Aug 11, 2017 9 years ago
1.3
Aug 10, 2017 9 years ago
Aug 9, 2017 9 years ago
Aug 7, 2017 9 years ago
Aug 4, 2017 9 years ago
May 26, 2017 9 years ago
May 15, 2017 9 years ago
May 12, 2017 9 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

WordPress Theme Framework 3.1.5 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
3.1.5
Findings
2
Worst severity
high
Content hash
a039b132c68931f516620c20…

Findings

  • high Post_Type always enables show_in_rest, exposing non-public CPTs (and CF7 requests) unauthenticated

    information_disclosure

    Post_Type::register() is supposed to honor $has_rest_api (default false) when calling register_post_type. Instead it runs if ( self::SUPPORTS_GUTENBERG === 'editor' && ! $this->has_rest_api ), which is a constant-to-literal comparison: SUPPORTS_GUTENBERG is defined as SUPPORTS_EDITOR ('editor'), so the condition is always true and $has_rest_api is forced true for every CPT. show_in_rest is therefore always on, including when a theme developer explicitly sets $has_rest_api = false and when $has_single = false (the class default: public=false, publicly_queryable=false, exclude_from_search=true, no single permalink). WordPress core WP_REST_Posts_Controller::check_read_permission allows unauthenticated reads of any post with post_status=publish once show_in_rest is true, regardless of the public flag. Observable: GET /wp-json/wp/v2/{cpt} as a logged-out user returns title/content/excerpt of published items that have no frontend URL. Contact_Form7 extends this class (ID form_request); save_form_request inserts visitor $_POST into post_title/post_content as pending, and the admin metabox relabels Publish to “Mark as read”, which publishes the row and then leaks that PII through the same REST collection. Capability_type remains 'post'. Not subscriber-only — unauthenticated. Does not fire until a theme instantiates a Post_Type subclass (the documented CPT API).

    framework/Objects/Post_Type.php:278-301

    Recommendation

    Replace the constant comparison with a real supports check, e.g. in_array(self::SUPPORTS_EDITOR, (array) $this->supports, true), and only then set $has_rest_api. Honor an explicit false. For non-public CPTs default show_in_rest to false, or register a rest_controller that requires current_user_can on the type’s read_private_posts / edit_posts cap instead of treating publish as world-readable. For form_request, keep status pending (or private) on “mark as read” and never enable show_in_rest.

  • medium Theme enables unsanitized SVG uploads for any user with upload_files

    xss_stored

    Theme::$upload_mime_types defaults to svg => image/svg+xml. theme_setup() always hooks add_upload_mimes when that property is non-empty, and add_upload_mimes() array_merges it into WordPress’s allowed upload list with no sanitizer and no extra capability. Every theme that instantiates the documented Theme base class therefore allows Author (upload_files) and above to upload SVG through the media library. WordPress core does not strip script, onload, or foreignObject from SVG; a crafted image/svg+xml file is stored under wp-content/uploads and served with Content-Type image/svg+xml, so a browser that opens the attachment URL executes the payload in the viewer’s origin (stored XSS, typically used against an administrator who clicks the file). The inline comment even recommends define('ALLOW_UNFILTERED_UPLOADS', true) in wp-config.php, which would additionally disable type checks. Subscriber/customer cannot upload. Not unauthenticated.

    framework/Theme.php:55-57

    Recommendation

    Default $upload_mime_types to an empty array. If SVG must be supported, allow it only for manage_options and run uploads through a dedicated sanitizer that strips script, event handlers, foreignObject, and external entities. Do not document or require ALLOW_UNFILTERED_UPLOADS.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.