WP Manifestindependent plugin directory
manifest / content / distributor-clone-fix-addon

Distributor Clone Fix Add-on WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Fix external connection subscriptions for cloned sites

by Novembit · github.com/novembit/distributor-clone-fix-addon

★ 0stars
18release downloads
≈10active sites
1.0.1latest · 7 years ago

Install

Download distributor-clone-fix-addon.zip From the 1.0.1 release on GitHub, Jul 23, 2019

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/novembit/distributor-clone-fix-addon/releases/download/1.0.1/distributor-clone-fix-addon.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/novembit/distributor-clone-fix-addon ↗

Distributor Clone Fix add-on is for extending the Distributor Plugin functionality to fix subscriptions if destination site was cloned

Requirements

  • PHP 5.6+
  • WordPress 4.7+
  • Distributor plug-in

Plugin installation

Usage example

Lets assume you've created external connection with distributor plugin from Source site to Destination. Then you've distributed some posts to Destination and in some reason you needed Destination to be cloned. So, you cloned it, we'll name it Clone. Now you created external connection for Clone from Destination. Now, the problem is, that all your posts in Clone will have Subscription created for Destination. This add-on will resolve that case. Let's do it step by step

  • Install Distributor Clone Fix add-on on both sides ( Source & Clone ).
  • After You've installed add-on, Fix Connection action will appear in wp-admin post listing pages bulk actions. screenshot
  • Please note that post type must be distributable. see distributable_post_types function in utils.php distributor plugin
  • Select Posts that you want to be fixed, then select Fix Connection from bulk actions and press apply.
  • You will be prompted to select connection, for our example it will be connection created for Clone. Select it and press apply again.
  • That's all! After action completed add-on will show you notification about success or failure.
  • Please note that this add-on was tested for single-site installation with external connections.

Development and manual builds

  • We are using Webpack for assets compiling and minify and Babel for transpiling JavaScript code.
  • So, you need npm and composer installed.
  • After you cloned repository, make sure to run npm i && composer install in repository root.
  • Then you must build assets. Simply run npm run build.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.1 latest
Jul 23, 2019 7 years ago
distributor-clone-fix-addon.zip
10
1.0
Jul 11, 2019 7 years ago
distributor-clone-fix-addon.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Distributor Clone Fix Add-on 1.0.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.1
Findings
2
Worst severity
high
Content hash
e4346951d29d044fd58890cd…

Findings

  • high REST repair-clone route missing permission_callback (public write)

    missing_permission_callback

    register_rest_route for POST /wp/v2/distributor/repair-clone omits permission_callback. WordPress treats that as publicly accessible. Unauthenticated callers can regenerate dt_subscription_signature meta on spoke posts identified by original IDs, breaking or hijacking Distributor subscription trust between hub and spoke.

    includes/clone-fix-spoke.php:20-55

    Recommendation

    Require a permission_callback that authenticates the Distributor external connection (same auth as other Distributor routes), or at minimum current_user_can('manage_options'). Never leave permission_callback unset on state-changing routes.

  • medium Hub fix_clones AJAX lacks capability check

    missing_capability

    ajax_fix verifies the dt-fix-clones nonce but never calls current_user_can(). The nonce is localized on edit.php for any role that can open that screen. A low-privilege editor/author can trigger push_post_data(), which uses stored external connection credentials to call the spoke repair endpoint and rewrite dt_connection_map on hub posts.

    includes/clone-fix-hub.php:26-65

    Recommendation

    Require current_user_can('manage_options') or a Distributor-specific capability after the nonce check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →