WP Manifestindependent plugin directory
manifest / ecommerce / fiscaat

Fiscaat WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Accounting software the WordPress way

by Laurens Offereins · github.com/lmoffereins/fiscaat · website

★ 0stars
0.0.5latest · 12 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/lmoffereins/fiscaat/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/lmoffereins/fiscaat ↗

Fiscaat is accounting software, made the WordPress way

Description

Have you ever been frustrated with accounting software that was slow, bloated and always got your system stuck? Fiscaat is focused on ease of integration, ease of use, web standards, and speed.

We're keeping things as small and light as possible while still allowing for great add-on features through WordPress's extensive plugin system. What does all that mean? Fiscaat is lean, mean, and ready to take on any job you throw at it.

Installation

  1. Place the 'fiscaat' folder in your '/wp-content/plugins/' directory.
  2. Activate Fiscaat.
  3. Visit 'Settings > Fiscaat' and adjust your configuration.
  4. Create some records.
  5. View your financial statements.

Changelog

0.0.1

  • In development

Releases

5 releases.

Tag
Published
0.0.5 latest
Apr 24, 2014 12 years ago
0.0.4
Apr 8, 2014 12 years ago
0.0.3
Apr 2, 2014 12 years ago
0.0.2
Apr 1, 2014 12 years ago
0.0.1
Mar 31, 2014 12 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Fiscaat 0.0.5 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
0.0.5
Findings
2
Worst severity
medium
Content hash
bf6d6469bbb2439bfb2f8ed8…

Findings

  • medium Records import AJAX verifies nonce but not capability

    missing_capability

    fct_records_import_process uses check_ajax_referer but never current_user_can for fiscaat/import caps. Any logged-in user who can obtain the nonce (or if nonce leaks) can drive the importer.

    includes/admin/import.php:223-246

  • medium check_ledger_id AJAX has no auth/nonce and var_dumps request

    missing_capability

    wp_ajax_fct_check_ledger_id handler performs no capability or nonce check and var_dump($_REQUEST['account_id']). Any authenticated user can probe ledger IDs; debug output is info disclosure.

    includes/admin/accounts.php:489-508

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →