WP Manifestindependent plugin directory
manifest / performance / mg-cache

MG Cache WP RegistryMedium-severity findings · 1 findingOpen the reportB

Caching plugin for WordPress

by kchevalier@mindgruve.com · github.com/mindgruve/mg-cache · website

★ 0stars
490composer installs
0.9.4latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mindgruve/mg-cache/archive/refs/heads/master.zip

On Packagist as mindgruve/mg-cache:

composer require mindgruve/mg-cache
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mindgruve/mg-cache ↗

MGCache WordPress Plugin

MGCache is an optional helper plugin for MGPress, a WordPress theme library. It allows a user to manage caching for website assets, such as CSS and JavaScript files.

Installing the Plugin

Install this plugin as you would any other:

  1. Make sure you are using a theme based on MGPress.
  2. Download the zip for this plugin (or clone it) and move it to wp-content/plugins in your WordPress installation.
  3. Activate the plugin in Plugins > Installed Plugins.
  4. Go to Settings > Cache to configure the plugin's behavior.

Settings

  • Clear the Cache: Manually purge the cache directory. The next public request will create new cached files.

Assets

  • Cache Stylesheets: Enable caching of CSS stylesheets. This will create a new file on the server with a unique name ("fingerprinted") any time the file changes and set the file headers to maximumize browser caching. Must be enabled for any actions to have affect.

  • Cache JavaScript Files: Enable caching of JavaScript files. This will create a new file on the server with a unique name ("fingerprinted") any time the file changes and set the file headers to maximumize browser caching. Must be enabled for any actions to have affect.

Actions

  • Combine Files: Attempt to combine multiple files into a single file to to minimize server requests. Optionally, files may be grouped into separate requests by the theme.

  • Minify Files: Attempt to minimize the contents of the files by removing comments and extra whitespace.

Releases

8 releases.

Tag
Published
0.9.4 latest
Jan 8, 2016 10 years ago
0.9.3
Jan 7, 2016 10 years ago
0.9.2
Jan 6, 2016 10 years ago
0.9.1
Dec 30, 2015 10 years ago
0.9
Dec 30, 2015 10 years ago
0.8
Jun 8, 2015 11 years ago
0.7
Jun 8, 2015 11 years ago
0.6
Jun 8, 2015 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

MG Cache 0.9.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.9.2
Findings
1
Worst severity
medium
Content hash
fbfb3f955729eab26a058eac…

Findings

  • medium CSRF: cache settings save and GET cache clear without nonce

    csrf

    MgCacheAdmin::printAdminPage() updates options when $_POST['update_MgCacheSettings'] is set and flushes cache when $_GET['clear_cache']=='true', with no check_admin_referer/wp_nonce_field. The submenu is registered with capability update_themes. An attacker can lure a logged-in user who can access Settings → Cache into saving attacker-chosen cache flags or clearing the cache.

    admin/MgCacheAdmin.php:36-67

    Recommendation

    Add wp_nonce_field / check_admin_referer for both actions; prefer admin-post handlers; use manage_options unless update_themes is intentional; re-check current_user_can in the handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →