WP Manifestindependent plugin directory
manifest / developer / woodlets

Woodlets WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Create WordPress Page Layouts using Twig Templates

★ 9stars
7krelease downloads
≈180active sites
65composer installs
v0.6.13latest · 6 years ago

Install

Download woodlets-v0.6.13.zip From the v0.6.13 release on GitHub, Oct 6, 2020

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/neochic/woodlets/releases/download/v0.6.13/woodlets-v0.6.13.zip

On Packagist as neochic/woodlets:

composer require neochic/woodlets
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Woodlets is beta. We think it's stable enough be used it in productive environments and we do so.
However you should copy the default templates directory from views/defaultTemplates into the woodlets directory of your theme. This helps to prevent incompatibilities with future Woodlets versions.

Feedback and feature requests are welcome!

Woodlets is a WordPress plugin that makes theme development more productive and fun.
The main features are:

  • Heavily Twig based theme development
  • Create widgets with a single Twig-Template file
  • Multi column page layouts
  • Custom page template fields with data inheritance
  • Simple way to add controls to the theme customizer
  • Compatible with native WordPress widgets

Installation

Installation via TGM Plugin Activation is recommended. With TGMPA Plugin Activation you can define Woodlets as a required dependency for your theme.
But there is also a bundled version that can be installed manually.

Install via TGM Plugin Activation

  1. Install TGM Plugin Activation as they explain in their installation manual.

  2. Include and configure the TGM Plugin Activation library to load Woodlets:

     <?php
     require_once dirname( __FILE__ ) . '/class-tgm-plugin-activation.php';
    
     add_action( 'tgmpa_register', function() {
         $plugins = array(
             array(
                 'name'               => 'Woodlets',
                 'slug'               => 'woodlets',
                 'source'             => 'https://github.com/Neochic/Woodlets/releases/download/v0.6.13/woodlets-v0.6.13-bundled.zip',
                 'required'           => true,
                 'force_activation'   => true,
                 'force_deactivation' => true
             )
         );
         tgmpa( $plugins );
     });

Check "Woodlets Seed"-Theme Tgm.php for a working example.

Install manually

  1. Go to releases page and download the latest bundled release.
  2. Extract the zip archive to your WordPress plugins directory (usually "wp-content/plugins/").
  3. Activate the plugin on the plugins page of your WordPress installation.

Getting started

For the creation of new Woodlets themes we recommend to use "Woodlets-CLI" instead of starting from scratch. It might also be a good idea to take a look at the "Woodlets Example"-Theme.

Create a theme manually

  1. Be sure the Woodlets plugin is installed and activated.

  2. Create a new theme (as the WordPress documentation says it should at least contain style.css and index.php)

  3. Put the following lines into your index.php:

     <?php
     do_action('neochic_woodlets_render_template');

    The action neochic_woodlets_render_template initializes the template rendering.

  4. Activate your new theme.

  5. Create your first page template with at least one column. Learn how to create your own page templates.

  6. Create your first Woodlets widget. Learn how to create custom widgets.

  7. Add your new widget to the allowed widgets configuration of your page template column.

  8. Create or edit a page and use your new page layout to test your widget in backend and frontend.

Further Reading:

Releases

Newest 25 of 41 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.6.13 latest
Oct 6, 2020 6 years ago
woodlets-v0.6.13.zip +1 asset
413
woodlets-v0.6.13.zip373
woodlets-v0.6.13-bundled.zip40
Dec 11, 2018 7 years ago
woodlets-v0.6.12.zip +1 asset
231
woodlets-v0.6.12.zip188
woodlets-v0.6.12-bundled.zip43
Dec 11, 2018 7 years ago
woodlets-v0.6.11-bundled.zip +1 asset
12
woodlets-v0.6.11-bundled.zip7
woodlets-v0.6.11.zip5
Dec 11, 2018 7 years ago
tag only
—
Nov 13, 2017 8 years ago
woodlets-v0.6.9.zip +1 asset
635
woodlets-v0.6.9.zip586
woodlets-v0.6.9-bundled.zip49
Nov 8, 2017 8 years ago
woodlets-v0.6.8.zip +1 asset
178
woodlets-v0.6.8.zip165
woodlets-v0.6.8-bundled.zip13
Sep 29, 2017 9 years ago
woodlets-v0.6.7.zip +1 asset
223
woodlets-v0.6.7.zip169
woodlets-v0.6.7-bundled.zip54
Sep 21, 2017 9 years ago
woodlets-v0.6.6.zip +1 asset
175
woodlets-v0.6.6.zip165
woodlets-v0.6.6-bundled.zip10
Sep 4, 2017 9 years ago
woodlets-v0.6.5.zip +1 asset
184
woodlets-v0.6.5.zip166
woodlets-v0.6.5-bundled.zip18
Sep 4, 2017 9 years ago
woodlets-v0.6.4.zip +1 asset
174
woodlets-v0.6.4.zip167
woodlets-v0.6.4-bundled.zip7
Sep 1, 2017 9 years ago
woodlets-v0.6.3-bundled.zip +1 asset
17
woodlets-v0.6.3-bundled.zip11
woodlets-v0.6.3.zip6
Jun 29, 2017 9 years ago
woodlets-v0.6.2.zip +1 asset
302
woodlets-v0.6.2.zip285
woodlets-v0.6.2-bundled.zip17
May 11, 2017 9 years ago
woodlets-v0.6.0.zip +1 asset
216
woodlets-v0.6.0.zip170
woodlets-v0.6.0-bundled.zip46
Apr 24, 2017 9 years ago
woodlets-v0.5.8.zip +1 asset
178
woodlets-v0.5.8.zip166
woodlets-v0.5.8-bundled.zip12
Apr 14, 2017 9 years ago
woodlets-v0.5.7.zip +1 asset
180
woodlets-v0.5.7.zip167
woodlets-v0.5.7-bundled.zip13
Apr 7, 2017 9 years ago
woodlets-v0.5.6.zip +1 asset
177
woodlets-v0.5.6.zip162
woodlets-v0.5.6-bundled.zip15
Apr 7, 2017 9 years ago
woodlets-v0.5.5.zip +1 asset
11
woodlets-v0.5.5.zip6
woodlets-v0.5.5-bundled.zip5
Apr 6, 2017 9 years ago
woodlets-v0.5.4.zip +1 asset
279
woodlets-v0.5.4.zip272
woodlets-v0.5.4-bundled.zip7
Apr 4, 2017 9 years ago
woodlets-v0.5.3.zip +1 asset
175
woodlets-v0.5.3.zip166
woodlets-v0.5.3-bundled.zip9
Mar 30, 2017 9 years ago
woodlets-v0.5.2.zip +1 asset
204
woodlets-v0.5.2.zip195
woodlets-v0.5.2-bundled.zip9
Mar 30, 2017 9 years ago
woodlets-v0.5.1-bundled.zip +1 asset
18
woodlets-v0.5.1-bundled.zip11
woodlets-v0.5.1.zip7
Mar 29, 2017 9 years ago
woodlets-v0.5.0.zip +1 asset
285
woodlets-v0.5.0.zip276
woodlets-v0.5.0-bundled.zip9
Feb 26, 2017 9 years ago
woodlets-v0.2.6.zip +1 asset
230
woodlets-v0.2.6.zip204
woodlets-v0.2.6-bundled.zip26
Nov 4, 2016 9 years ago
woodlets-v0.2.5.zip +1 asset
230
woodlets-v0.2.5.zip196
woodlets-v0.2.5-bundled.zip34
Sep 28, 2016 10 years ago
woodlets-v0.2.4.zip +1 asset
206
woodlets-v0.2.4.zip191
woodlets-v0.2.4-bundled.zip15
All releases on GitHub →

Active-site estimate ≈180 comes from the median of recent superseded releases. Method.

B grade

Security

Woodlets 0.6.13 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.6.13
Findings
1
Worst severity
medium
Content hash
87be17052a9e0b40df7b1f88…

Findings

  • medium Admin-ajax actions callable by any logged-in user with no capability or nonce check

    missing_capability

    All six wp_ajax_neochic_woodlets_* callbacks in Woodlets::init() are registered without wp_ajax_nopriv (so uid 0 is excluded) but also without current_user_can or wp_verify_nonce. wp_ajax_neochic_woodlets_clear_twig_cache calls TwigFactory::clearTwigCache(), which recursively unlinks ABSPATH/wp-content/woodlets-twig-cache via rrmdir(); a Subscriber GET to admin-ajax.php?action=neochic_woodlets_clear_twig_cache (SameSite=Lax still sends cookies on GET) wipes the Twig cache when enabled. wp_ajax_neochic_woodlets_dismiss_admin_notice writes the current user's meta key neochic_woodlets_notice_dismissed_{$_REQUEST['key']} to $_REQUEST['value'] (key/value attacker-controlled, prefix-limited). get_widget_list/preview/form/update echo widget HTML or JSON for any logged-in caller; preview HTML is inserted with jQuery $() / replaceWith in js/main-build.js. These endpoints are intended for the post editor (edit_page) and the settings screen (manage_options) but are reachable from a customer account.

    src/Woodlets.php:185-250

    Recommendation

    For widget list/preview/form/update require current_user_can('edit_posts') or edit_page on the woodletsPageId and check_ajax_referer. For clear_twig_cache require manage_options plus a nonce. For dismiss_admin_notice allow-list the key (enable_updates_notification, major_release, copy_default_templates) and verify a nonce; do not concatenate raw $_REQUEST['key'] into a meta key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.