WP Manifestindependent plugin directory
manifest / privacy / q-gh-consent

Q Consent WP RegistryLow-severity findings · 1 findingOpen the reportA-

Shared consent, cookie and privacy system

by Q Studio · github.com/maketheboat/q-gh-consent · website

★ 1stars
1.5.0-alphalatest · 7 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/maketheboat/q-gh-consent/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/maketheboat/q-gh-consent ↗

Consent System

Build a shared consent, privacy and cookie system

Changelog

1.5.0

  • Moved to standard Q plugin model

1.3.6

  • Issue in helper class

1.3.5

  • Added Q dependency check
  • Added Q debugging logic

1.3.0

  • Moved front-end render controls to Q Settings
  • Renamed Q Consent

1.2.5

  • Comment Clean up

1.2.2

  • Cookie domain changes

1.2.0

  • Added migration check for stored cookies

1.1.3

  • Removed # in cookie string value

1.1.2

  • JS cleanup

1.1.1

  • Removed nonce check around AJAX callback, as failing

0.1

  • Initial working version

Releases

2 releases.

Tag
Published
1.5.0-alpha latest
Aug 15, 2019 7 years ago
1.3.6
Aug 1, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Q Consent 1.5.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.5.0
Findings
1
Worst severity
low
Content hash
0e6755d38d8bbd9982d14815…

Findings

  • low Consent set/reset AJAX registered nopriv without nonce

    missing_nonce

    consent_set and consent_reset are nopriv AJAX handlers. Nonce verification is commented out with a note that security is not important. Handlers only set/unset the visitor's own consent cookie (marketing/analytics flags) — limited blast but violates CSRF hygiene and allows cross-site forcing of consent cookies.

    library/ajax/callback.php:31-124

    Recommendation

    Restore check_ajax_referer for consent_set/reset; keep nopriv only if needed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →