WP Manifestindependent plugin directory
manifest / integrations / tribe-ext-hubspot

Event Tickets HubSpot Integration WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

HubSpot Extension for Event Tickets and Event Tickets Plus

★ 0stars
1.3krelease downloads
≈130active sites
1.0.5latest · 3 years ago

Install

Download tribe-ext-hubspot-1-0-5.zip From the 1.0.5 release on GitHub, Jul 14, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mt-support/tribe-ext-hubspot/releases/download/1.0.5/tribe-ext-hubspot-1-0-5.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

What and Why?

This is the Modern Tribe Extension Template. It allows you to easily extend our plugins: The Events Calendar, Event Tickets, and their associated add-on plugins.

The primary benefits of using this template is that it's gets you up-and-running quicker than building a custom plugin yourself, and it's best to extend one plugin via another plugin instead of adding custom code to your child theme's functions.php file.

We ensure your new extension does not run if its required base plugin is not activated, which helps avoid fatal errors and means fewer class_exists() checks are applicable.

Extensions have been available since The Events Calendar version 4.3.3 (November 16, 2016). If you try to use this template to work with versions before this date, your extension will not run at all.

How?

If you want to suggest an edit to this template, submit a pull request to this repo.

If you want to make your own new extension:

  1. Create your own new repository, prefixing its name with the required tribe-ext- prefix (or else your extension will not run at all, even if activated).
  2. Download the master branch of this template as a .zip and unzip it.
  3. Because you cannot make a new branch until you have an initial commit to your own new repo's master branch, copy this template's license.txt file and commit it to your repo's master branch.
  4. Create a new branch called initial or v1 or whatever is appropriate and check out this branch.
  5. Place the remainder of this template's files in your repo's new branch.
  6. Find and replace these strings throughout all file names and file contents:
    1. Extension plugin's slug: tribe-ext-extension-template
    2. [Base Plugin Name] Extension: [Extension Name]:
      1. [Base Plugin Name] should be something like The Events Calendar
      2. [Extension Name] should be the name of your extension, such as Remove Export Links
    3. [Extension Description] with your extension plugin's short description.
    4. PHP namespace: Tribe\Extensions\Example (must be unique among all extensions)
  7. Set Plugin URI accordingly.
  8. Set GitHub Plugin URI accordingly.
  9. Set Author: and Author URI: accordingly if not being authored by Modern Tribe.
  10. Set the == Description == section of readme.txt
  11. Add your required plugin(s) via $this->add_required_plugin().
    1. You should have at least one required plugin and/or conditionally-required plugin(s), making use of Tribe__Dependency.
    2. If you're requiring a specific version, add a small code comment why this version is required. You should probably also mention this in readme.txt.
  12. Remove the starter bits that don't apply to your extension, such as required PHP version comments.
    1. Look for TODO comments to identify some things to modify or remove, as applicable. For example, remove the entire src directory and the Tribe__Autoloader code if you do not have any settings to add to the admin UI and do not need the autoloader for any other purpose.
    2. It might be advisable to leave the PHP version checking logic (and matching part of readme.txt) unmodified until one of your last commits to ensure you correctly determine the required version.
  13. Add your filters and actions in the init() method, creating your custom methods as needed.
  14. Remove all unused/unnecessary code and comments, as this template may handle edge cases that do not apply to your extension.
  15. Sanitize all input and escape all output, as appropriate.
  16. Double-check your plugin's slug, name, and descriptions still apply to the end result of what your code actually accomplishes.
  17. Set the == Changelog == section of readme.txt.
  18. Delete this README.md file.
  19. Zip and release your plugin!

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.5 latest
Jul 14, 2023 3 years ago
tribe-ext-hubspot-1-0-5.zip
690
Jun 24, 2023 3 years ago
tag only
—
Jan 4, 2023 3 years ago
tribe-ext-hubspot-1-0-3.zip
230
Jun 9, 2022 4 years ago
tribe-ext-hubspot.1.0.2.zip
227
Mar 15, 2022 4 years ago
tribe-ext-hubspot-1-0-1.zip
128
1.0
Jan 7, 2020 6 years ago
tag only
—

Active-site estimate ≈130 comes from the median of recent superseded releases. Method.

C- grade

Security

Event Tickets HubSpot Integration 1.0.5 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.5
Findings
1
Worst severity
high
Content hash
bc5883aee9a78ef7fb4becc7…

Findings

  • high Unauthenticated HubSpot OAuth callback missing auth and state can rebind CRM tokens

    missing_auth

    The front-end rewrite endpoint tribe-hubspot (EP_ROOT) is handled on parse_request with no capability check, no login requirement, and no CSRF/OAuth state. Version 1.0.3 removed the previous nonce-in-query-string guard because HubSpot requires an exact redirect_uri match; the plugin did not replace it with HubSpot's documented state parameter (returned on the callback) or an administrator session gate. Any visitor who requests /tribe-hubspot/?code=<value> (1) deletes the hubspot_setup_queue, (2) fires tribe_hubspot_authorize_site which exchanges the code for access/refresh tokens using the site's stored client_id/client_secret and writes tribe_hubspot_access_token/refresh_token/token_expires, and (3) unconditionally marks HubSpot property/timeline setup as pending even if the exchange fails (Contact_Property_Group::queue_group_name priority 20). Because OAuth client_id is public by design and HubSpot will install an app for any portal that opens the authorize URL, an attacker who authorizes this site's HubSpot app to their own portal and follows the 302 to the victim callback overwrites the site-wide CRM connection; subsequent Event Tickets purchases, RSVPs, attendee updates, and check-ins are delivered to the attacker's HubSpot via Contact_Properties::update and Timeline::create. Garbage codes still flip setup flags so Connection::is_ready() returns false and live sync stops until setup recovers.

    src/Tribe/API/Oauth.php:44-69

    Recommendation

    Do not treat redirect_uri query args as the only CSRF control. Put a high-entropy nonce in HubSpot's OAuth state parameter (supported on the authorize URL and echoed on the callback), bind it to the initiating admin session, and reject callbacks with a missing/invalid state. Also require the same capability as the TEC addons tab (typically manage_options) before exchanging the code or mutating tokens/setup flags. Only wipe queues and set setup statuses to pending after a 200 token response. Keep redirect_uri as the exact registered URL with no extra query string.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.