WP Manifestindependent plugin directory
manifest / integrations / lore-opensim-map

L.O.R.E. - Leaflet OpenSimulator Regional Explorer WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Leaflet OpenSimulator Regional Explorer - WordPress Plugin

by Gundahar Bravin · github.com/mteedev/lore-opensim-map · website

★ 3stars
14release downloads
v1.1.1latest · 1mo ago

Install

Download lore-opensim-map-v1.1.1.zip From the v1.1.1 release on GitHub, Aug 25, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mteedev/lore-opensim-map/releases/download/v1.1.1/lore-opensim-map-v1.1.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mteedev/lore-opensim-map ↗

L.O.R.E.

Leaflet OpenSimulator Regional Explorer

L.O.R.E. Compass

"Every Region Has a Story"

A modern, interactive WordPress plugin that displays your OpenSimulator grid as a beautiful, clickable Leaflet.js map. Click any region to get its name, a one-click teleport link, and a registration button — all fully customizable to match your grid's branding.

✨ Features

  • 🗺️ Interactive Leaflet map — zoom, pan, explore your entire grid
  • 🔍 Region search — live search box with instant dropdown results
  • 🚀 One-click teleport — dynamically built hop:// links from your grid URL
  • 🎨 Color picker — choose your own accent and button colors in the admin
  • 📊 Batch sync with progress bar — syncs regions in batches of 50, no timeouts
  • ⭐ Featured region marker — highlight your welcome/landing region
  • 🌙 Dark mode support — popups adapt automatically
  • 🔌 Simple shortcode — [lore_map] drops the map anywhere

📸 Screenshots

🗺️ Map Overview

Map Overview

🚀 Region Popup

Region Popup

🔍 Search in Action

Search

⚙️ Admin Settings Panel

Admin Settings

🔧 Requirements

  • WordPress 5.5 or higher
  • PHP 7.4 or higher
  • An OpenSimulator grid with a MySQL/MariaDB Robust database
  • Read access to the Robust database from your WordPress server
  • Warp3D or compatible map tile service running on your grid

📦 Installation

Method 1: WordPress Admin (Recommended)

  1. Download the latest lore-opensim-map.zip from Releases
  2. In WordPress Admin go to Plugins → Add New → Upload Plugin
  3. Choose the zip file and click Install Now
  4. Click Activate Plugin

Method 2: FTP / FileZilla

  1. Unzip lore-opensim-map.zip
  2. Upload the lore-opensim-map folder to /wp-content/plugins/
  3. Go to Plugins in WordPress Admin and activate L.O.R.E.

⚙️ Configuration

Go to Settings → L.O.R.E. Map and fill in the sections:

🌐 Grid Settings

Setting Description
Grid Name Your grid's display name (shown in map attribution)
Grid URL Your grid's login URI, e.g. mygrid.com:8002
Registration URL Link for the "Join Free Today" button in popups

💡 The Teleport button URL is built automatically from your Grid URL + the region name. No manual configuration needed!

🗄️ Database Settings

L.O.R.E. connects directly to your OpenSimulator Robust database to sync region data.

Setting Description
Database Host IP or hostname of your Robust database server
Database Name Usually robust
Database User A MySQL user with read access to the regions table
Database Password The database user's password

🔒 Security note: Use a read-only MySQL user for best practice. L.O.R.E. only ever reads from the regions table.

🗺️ Map Settings

Setting Default Description
Map Tile URL (blank) Your Warp3D tile URL pattern
Default Zoom 3 Initial zoom level (1–8)
Center X 1000 Starting X grid coordinate
Center Y 1000 Starting Y grid coordinate

🎨 Appearance

Use the color pickers to set:

  • Accent Color — popup title, search border, coordinate text
  • Button Color — Teleport button gradient

⭐ Featured Region (optional)

Enter the exact name of a region to highlight with a special marker (pulsing glow, gold star, or pin drop). Leave blank to disable.

🔄 Region Sync

Click Sync Regions from Grid to import all regions from your Robust database. The progress bar shows you exactly how many batches have completed. Syncing in batches of 50 ensures no PHP timeouts regardless of grid size.

📋 Shortcode

Basic usage:

[lore_map]

All options:

[lore_map width="100%" height="600px" zoom="3" center_x="1000" center_y="1000" grid_url="mygrid.com:8002"]
Parameter Default Description
width 100% Map width
height 600px Map height
zoom From settings Initial zoom (1–8)
center_x From settings Starting X coordinate
center_y From settings Starting Y coordinate
grid_url From settings Override the grid URL for this map instance

❓ FAQ

Q: The map shows tiles but clicking regions says "Unknown Region" A: Go to Settings → L.O.R.E. Map and click Sync Regions from Grid. The region database needs to be populated first.

Q: Some large (var) regions only work when clicked in the lower-left corner A: This is normal OpenSimulator behavior. Variable-size regions store only their anchor (lower-left) coordinate in the database. Consider adding a note above the map for visitors.

Q: My grid uses a different coordinate range than 1000–2000 A: Set Center X and Center Y in the admin to match your grid's actual coordinate range. NWG-style grids often use coordinates around 10000.

Q: Teleport links open my viewer but land me somewhere wrong A: Make sure your Grid URL is correct in settings. The format should be yourgrid.com:8002 without http://.

Q: Can I display multiple maps on the same page? A: Yes! Each [lore_map] shortcode creates an independent map instance.

🗂️ File Structure

lore-opensim-map/
├── lore-opensim-map.php    # Main plugin file
├── assets/
│   ├── lore.js             # Map initialization, popups, search
│   ├── lore.css            # All styles
│   └── compass.png         # Plugin icon
├── screenshots/
│   ├── map-overview.png
│   ├── region-popup.png
│   ├── search.png
│   └── admin-settings.png
├── README.md
├── CHANGELOG.md
└── LICENSE

📝 Changelog

See CHANGELOG.md

📚 Full Documentation

📖 Need help? Want detailed guides?

Visit the L.O.R.E. Wiki for comprehensive documentation:

The Wiki has everything you need to get the most out of L.O.R.E.! 🚀

📄 License

GPL v2 or later — see LICENSE

👤 Author

Gundahar Bravin

🙏 Credits

  • Leaflet.js — the amazing open-source mapping library
  • OpenSimulator — the open-source virtual world platform
  • Compass rose image used with appropriate rights - (downloaded from pngegg).

Built with ❤️ for the OpenSimulator community

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.1 latest
Aug 25, 2026 1mo ago
lore-opensim-map-v1.1.1.zip
5
v1.1.0
Feb 18, 2026 8mo ago
lore-opensim-map-v1.1.0.zip
7
v1.0.1
Feb 17, 2026 8mo ago
lore-opensim-map-v1.0.1.zip
1
v1.0.0
Feb 17, 2026 8mo ago
lore-opensim-map-v1.0.0.zip
1
C- grade

Security

L.O.R.E. - Leaflet OpenSimulator Regional Explorer 1.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.1
Findings
1
Worst severity
high
Content hash
2dce31e8d82e66c33e52fb2d…

Findings

  • high Stored XSS in region popups via unsanitized server_uri / grid_url / register_url

    xss_stored

    showPopup() builds the Teleport and Join markup with string concatenation and hands it to Leaflet setContent(), which sets innerHTML. region.server_uri is only stripped of a leading http(s):// and a trailing slash — quotes, angle brackets, and event-handler payloads are passed through. ajax_lore_sync_batch / cron_sync_regions copy OpenSim regions.serverURI into wp_{prefix}lore_regions.server_uri with no esc_url_raw. Public AJAX lore_get_region_info (nopriv, no nonce) and lore_get_regions then return that column to the browser. A grid resident who can register a region (common on public/hypergrid OpenSim; no WordPress account required) sets serverURI to e.g. http://x.com"><img src=x onerror=…>; after the administrator clicks Sync Regions (or cron runs), every visitor who clicks that cell executes the payload. Secondary writers into the same sink: [lore_map grid_url=…] (Contributor+/Author; used only when server_uri is empty) and option lore_register_url (Join href; manage_options, no sanitize_callback on register_setting). region_name is passed through escHtml() and encodeURIComponent(); server_uri is not. WordPress auth cookies are HttpOnly, but same-origin JS in an administrator's browser can fetch wp-admin HTML, extract nonces, and create users.

    assets/lore.js:157-182

    Recommendation

    Never concatenate region or setting strings into HTML. Build the popup with DOM APIs (createElement/textContent/setAttribute) or a single escHtml/encodeURI-component pass on hopUrl, registerUrl, and gridUrl; allowlist server_uri to http(s) hosts before using it. Sanitize on ingest: esc_url_raw on serverURI, sanitize_text_field on regionName, and add sanitize_callback to every register_setting (esc_url_raw for URLs, sanitize_hex_color for colors). Reject shortcode grid_url values that are not a host:port. Add current_user_can('manage_options') next to the lore_sync nonce as defense in depth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →