WP Manifestindependent plugin directory
manifest / builders / lollum-page-builder

Lollum Page Builder WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

A simple and lightweight WordPress page builder for developers.

★ 10stars
2.5.1latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/lollum/lollum-page-builder/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A simple and lightweight WordPress page builder for developers.

Description

The Lollum Page Builder plugin is a simple page builder meant for developers. It doesn't provide tons of features, mega-effects or super options. It's a simple grid with a few predefined blocks. And it provides a simple filter for the creation of new blocks. Unannounced pull requests generally not welcome, I maintain this repo as my own page builder. But feel free to open issues to discuss first: the idea is to keep this page builder as simple as possible.

Usage

To add a new custom block:

<?php
function custom_new_blocks( $blocks ) {
    $blocks[ 'gallery' ] = array(
        'id'           => 'gallery',
        'name'         => esc_html__( 'Gallery', 'text-domain' ),
        'description'  => esc_html__( 'Slide of images from the Media library', 'text-domain' ),
        'icon'         => 'fa fa-image',
        'default-size' => '1-4',
        'sizes'        => array(
            '1-4',
            '1-3',
            '1-2',
            '2-3',
            '3-4',
            '1-1',
        ),
        'options'      => array(
            'image-ids' => array(
                'label'       => esc_html__( 'Images', 'text-domain' ),
                'description' => esc_html__( 'The images in this block are not cropped (original size uploaded)', 'text-domain' ),
                'multiple'    => 'true',
                'type'        => 'upload',
            ),
            'max-width' => array(
                'label'       => esc_html__( 'Max width (optional)', 'text-domain' ),
                'type'        => 'text',
                'description' => esc_html__( 'Type the value in px or % (ie. 600px or 80%)', 'text-domain' ),
            ),
        )
    );

    return $blocks;
}
add_filter( 'lollum_page_builder_blocks', 'custom_new_blocks' );

To hide the page builder settings page:

  1. Declare the page builder support in your theme:

     add_theme_support( 'lollum-page-builder-theme' );
  2. Then pass your preferred default values with:

     $options = array(
         'mobile_breakpoint' => 600,
         'boxed_width' => 830,
         'cpt' => array(
             'page',
             'post'
         ),
     );
    
     update_option( 'lpb_options', $options );

Attach the page builder support (1) and the default options (2) to the after_setup_theme hook.

Options

id

  • Type: String

The ID of the block.

name

  • Type: String

The name of the block.

description

  • Type: String

The description of the block.

icon

  • Type: String

The icon of the block. Uses the Font Awesome icon font.

custom-id

  • Type: Boolean
  • Default: true

(Optional) If false, the block will not have the Custom ID field.

clonable

  • Type: Boolean
  • Default: true

(Optional) If false, the block will be not clonable.

default-size

  • Type: String

The initial size of the block.

sizes

  • Type: Array

(Optional) Array of sizes. Possible values:

'sizes' => array(
    '1-4',
    '1-3',
    '1-2',
    '2-3',
    '3-4',
    '1-1'
)

If not provided, the block will be full-width (1-1).

options

  • Type: Array

An array of options.

Available types and specific settings:

text

  • label (String)
  • description (String)
  • std (String, the default value)

number

  • label (String)
  • description (String)
  • std (String, the default value)

textarea

  • label (String)
  • description (String)
  • std (String, the default value)

select

  • label (String)
  • description (String)
  • std (String, the default value)
  • options (Array)

upload

  • label (String)
  • description (String)
  • multiple (String, "true" or "false")

Templates

The plugin looks in lollum-page-builder/templates/block-id.php or in yourtheme/lollum-page-builder/block-id.php to load the block template. The $lpb_data variable is passed to each template. You can get the value of each option with $lpb_data[ 'name-of-the-option' ].

Can I use this plugin with other themes, premium or free?

Yes.

Releases

18 releases.

Tag
Published
2.5.1 latest
Sep 25, 2017 9 years ago
Mar 10, 2017 9 years ago
Feb 2, 2017 9 years ago
Dec 22, 2016 9 years ago
Dec 18, 2016 9 years ago
Dec 7, 2016 9 years ago
Dec 3, 2016 9 years ago
Nov 29, 2016 9 years ago
Nov 25, 2016 9 years ago
Nov 23, 2016 9 years ago
Nov 22, 2016 9 years ago
Nov 21, 2016 9 years ago
Nov 15, 2016 9 years ago
Nov 4, 2016 9 years ago
Nov 3, 2016 9 years ago
Oct 19, 2016 10 years ago
Oct 19, 2016 10 years ago
Oct 19, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Lollum Page Builder 2.5.1 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
2.5.1
Findings
3
Worst severity
high
Content hash
337865a62c913cce6506b37e…

Findings

  • high AJAX set_editor_type: nonce without edit_post capability (IDOR)

    missing_capability

    lpb_set_editor_type verifies a nonce then writes _lpb_editor_type for absint($_POST['post_id']) with no current_user_can('edit_post', $post_id) check. Nonces are localized on post.php/post-new.php for supported CPTs, so any user who can edit one supported post (e.g. Author) receives a valid nonce and can change editor type meta on posts they cannot edit.

    includes/admin/class-lpb-admin.php:34-41

    Recommendation

    After verifying the nonce, require current_user_can( 'edit_post', $post_id ) (and confirm the post type is supported) before update_post_meta.

  • medium AJAX append_blocks: nonce without capability check

    missing_capability

    lpb_append_blocks verifies lpb-append-blocks-nonce then parses attacker-supplied XML and echoes admin edit-block HTML via lpb_print_edit_block. No current_user_can check. A user with a nonce from an edit screen can invoke it; primarily an authorization gap on an admin HTML rendering endpoint.

    includes/admin/class-lpb-admin.php:58-84

    Recommendation

    Require current_user_can('edit_posts') or edit_post for the localized post_id before rendering/importing blocks.

  • low AJAX get_editor_type missing nonce and capability

    information_disclosure

    lpb_get_editor_type echoes _lpb_editor_type for any post_id for any logged-in user with no nonce or capability check. Limited information disclosure of editor-mode meta.

    includes/admin/class-lpb-admin.php:47-52

    Recommendation

    Require a nonce and current_user_can('edit_post', $post_id) before returning meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.