WP Manifestindependent plugin directory
manifest / forms / download-via-email

Download via Email WP RegistryHigh-severity findings · 4 findingsOpen the reportD+

Embed a form in your pages and posts that accept an email address in exchange for a file to download. The plugin is simpler, quicker, with minimal database usage, and completely in WordPress' way

by Mayeenul Islam (@mayeenulislam) · github.com/mayeenulislam/download-via-email · website

★ 1stars
36release downloads
≈10active sites
1.0.2latest · 10 years ago

Install

Download download-via-email.zip From the 1.0.2 release on GitHub, Nov 24, 2015

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mayeenulislam/download-via-email/releases/download/1.0.2/download-via-email.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mayeenulislam/download-via-email ↗

Embed a form in your pages and posts that accept an email address in exchange for a file to download. The plugin is simpler, quicker, with minimal database usage, and completely in WordPress' way.

Description

Embed a form in your pages and posts that accept an email address in exchange for a file to download. The plugin is simpler, quicker, with minimal database usage, and completely in WordPress' way.

Installation

  1. Download the latest version of the plugin from Github release
  2. Unzip the plugin, and Upload download-via-email folder to the wp-content/plugins/ directory
  3. Activate the plugin through the 'Plugins' menu in WordPress admin panel
  4. Change the necessary settings from the admin panel 'Download via Email' menu page

Now, put the shortcode into page/post [email-downloads file="absolute-path/to/the/file.ext"]

Frequently Asked Questions

What is the shortcode

[email-downloads file="absolute-path/to/the/file.ext"] is the shortcode. You have to mention the absolute path of the file to let the user download the file. It is not necessary to upload the file to your WordPress site, it can be any public path, even can be a Dropbox, OneDrive, or Google Drive link

What type of email is supported as sender?

For now on, only an on-domain email address as sender works, because we used rudimentary WordPress mailer function that works with an on-domain email address like something@yourdomain.com. Default is noreply@yourdomain.com.

Will my download link be encrypted

Yes, we do not believe in sending raw absolute URL of a file, so it's by core encrypted to its maximum strength

Is the mail HTML-formatted

Yes, the email is HTML-formatted by default

For how long the link will be valid?

By default any link that is generated for an email address would be valid for 12 hours only

What happen to the email addresses got by the form?

The email addresses are saved in database, and is visible in the admin menu page

Does the plugin deletes its data on deletion?

Yes, the plugin deletes all its data on uninstallation

What's the default privilege using the plugin?

Default privilege to the admin menu page is 'administrator'. But there is a filter hook nano_ed_role, with this you can add a filter to change the role anytime. :)

Screenshots

  1. Download via Email - how it will look like at the front end
  2. Download via Email - the admin panel settings page

Changelog

1.0.2

  • A function conflicting with WordPress core was fixed

1.0.1

  • New database download_email is added to sort stored email correctly

1.0.0

  • A rudimentary WordPress plugin to enable sending download link to email address
  • Completely in WordPress database schema - no other table, no column
  • Email storage in options table

Upgrade Notice

1.0.2

A function conflicting with WordPress core was fixed

1.0.1

New database download_via_email is added to sort stored email correctly

1.0.0

A rudimentary WordPress plugin to enable sending download link to email address Completely in WordPress database schema - no other table, no column Email storage in options table Deletion of all the data on uninstallation of the plugin

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.2 latest
Nov 24, 2015 10 years ago
download-via-email.zip
26
1.0.1
Oct 30, 2015 11 years ago
download-via-email.zip
7
1.0.0
Sep 30, 2015 11 years ago
download-via-email.zip
3

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Download via Email 1.0.0 · audited by WP Registry

High-severity findings.

2 high 2 medium
Audited release
1.0.0
Findings
4
Worst severity
high
Content hash
91874eebf40edd1cc4d99710…

Findings

  • high Unauthenticated reflected XSS in email-downloads shortcode form

    xss_reflected

    The shortcode form echoes $_POST['download_email'] into an HTML attribute without escaping. An unauthenticated attacker can submit a crafted email value containing a quote-breaking payload so that when the form redisplays (validation path or same request), arbitrary JavaScript runs in the visitor's session on any page embedding [email-downloads].

    download-via-email.php:168-168

    Recommendation

    Escape with esc_attr() (and ideally sanitize_email() for the value). Prefer not redisplaying raw POST on failure.

  • high Unauthenticated reflected XSS in email-downloads shortcode form value

    xss_reflected

    nanodesigns_email_downloads_shortcode reads $_POST['download_email'] and echoes it unsanitized into the input value attribute. HTML5 type=email does not restrain crafted POST bodies. Any visitor can reflect script/event-handler payloads into pages that embed [email-downloads].

    download-via-email.php:119-168

    Recommendation

    Echo with esc_attr(); prefer sanitize_email() before use; add a nonce even on public forms.

  • medium Missing nonce/CSRF protection on public download request form

    csrf

    The shortcode accepts POST download_submit with no wp_nonce_field/wp_verify_nonce. Any site or attacker can CSRF a visitor (or automate unauthenticated POSTs) to trigger wp_mail spam, create download transients, and insert emails into the download_email table.

    download-via-email.php:119-175

    Recommendation

    Add a nonce to the form and verify it before processing; rate-limit submissions.

  • medium Missing nonce on public download-via-email form

    csrf

    The shortcode form posts download_submit without wp_nonce_field/check. An attacker can CSRF a victim into submitting an email address, triggering wp_mail with a download link and writing the email into the plugin's email store — abuse/spam amplification against the site's mailer.

    download-via-email.php:119-170

    Recommendation

    Add a per-form nonce and verify before sending mail or storing emails; rate-limit submissions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →