WP Manifestindependent plugin directory
manifest / content / posttype-term-archive

PostType Term Archive WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Allow URLs like /<post_type>/<taxonomy>/<term_slug> in Wordpress

★ 4stars
57release downloads
0.3.11latest · 5 years ago

Install

Download posttype-term-archive.zip From the 0.3.11 release on GitHub, Nov 12, 2020

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mcguffin/posttype-term-archive/releases/download/0.3.11/posttype-term-archive.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Allow pretty Archive-URLs with custom post types, taxonomies and terms.

Usage

Registering a post type taxonomy archive:

do_action('register_post_type_taxonomy', 'book', 'publisher' );

Doing the same, but show some links in WP Menu editor:

do_action('register_post_type_taxonomy', 'book', 'publisher', true );

Same as above

do_action('register_post_type_taxonomy', 'book', 'publisher', array(
    'show_in_menu'  => true,
) );

Same as above but allow admin to disable the archive in permalink settings

do_action('register_post_type_taxonomy', 'book', 'publisher', array(
    'show_in_menu'      => true,
    'show_in_settings'  => true,
) );

Disable configurability entirely:

// filter must be added before or during `plugins_loaded`
// best is to put in mu-plugin, like wp-content/mu-plugins/some-file.php
add_filter( 'posttype_term_archive_settings', '__return_false');

Getting a specfic post type term archive URL:

$post_type = 'book';
$term_id = 123;
$term_slug = 'rainbow-press';
$taxonomy = 'publisher';
$term_object = get_term( $term_id, $taxonomy );

// All these will return something like http://my-site.tld/book/publisher/rainbow-press
// note that when you pass the term as slug, you'll have to pass the taxonomy also.
// will return WP_Error if $post_type + $taxonomy has not been registered first.

$url = apply_filters( 'post_type_term_link', '', $post_type, $term_object );

$url = apply_filters( 'post_type_term_link', '', $post_type, $term_id );

$url = apply_filters( 'post_type_term_link', '', $post_type, $term_slug, $taxonomy );

ToDo

  • [ ] Add Archive URLs to WPSEO.
  • [ ] More Testing with different Polylang setups.
  • [ ] Refactor: put frontend nav menu to standalone singleton

Releases

22 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.3.11 latest
Nov 12, 2020 5 years ago
posttype-term-archive.zip
7
Dec 18, 2019 6 years ago
posttype-term-archive.zip
4
Nov 8, 2018 7 years ago
posttype-term-archive.zip
3
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 9, 2018 8 years ago
posttype-term-archive.zip
2
Oct 8, 2018 8 years ago
posttype-term-archive.zip
2
Oct 8, 2018 8 years ago
posttype-term-archive.zip
2
Oct 8, 2018 8 years ago
posttype-term-archive.zip
2
Jul 26, 2018 8 years ago
posttype-term-archive.zip
2
Jul 3, 2018 8 years ago
posttype-term-archive.zip
2
Jun 28, 2018 8 years ago
posttype-term-archive.zip
2
Jun 28, 2018 8 years ago
posttype-term-archive.zip
3
Jun 28, 2018 8 years ago
posttype-term-archive.zip
2
Jun 16, 2018 8 years ago
posttype-term-archive.zip
4
Jun 16, 2018 8 years ago
posttype-term-archive.zip
4
B grade

Security

PostType Term Archive 0.3.11 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.3.11
Findings
1
Worst severity
medium
Content hash
5adcf800f7075ae473eebc3e…

Findings

  • medium CSRF: permalink archive settings saved without nonce verification

    csrf

    maybe_save_settings on admin_init writes update_option('posttype_term_archives', ...) from $_POST whenever pagenow is options-permalink.php, without checking a nonce or explicitly checking manage_options. An admin visiting a malicious page can be forced to change archive permalink settings.

    include/PosttypeTermArchive/Settings/SettingsPermalink.php:43-61

    Recommendation

    Verify check_admin_referer for the permalink options form and current_user_can('manage_options') before updating the option.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.