WP Manifestindependent plugin directory
manifest / content / plugin-pdc-internal-products

PDC Internal Products WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

PDC Internal Products Plugin

★ 0stars
967composer installs
v3.1.0latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/openwebconcept/plugin-pdc-internal-products/archive/refs/heads/master.zip

On Packagist as plugin/pdc-internal-products:

composer require plugin/pdc-internal-products
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

README

The Internal Products plugin splits items of the PDC into two types: internal and external.

PDC items will need to be coupled to either one of the two types in order for them to show up in the endpoint. This is to prevent accidental mixing of internal and external items.

An additional data field for Internal Data is added in the admin for all PDC items.

Rest API

This plugin chages the behaviour of the existing owc/pdc/v1/items endpoint in that it returns external items only.

All internal and external items can be accessed on the owc/pdc/v1/items/internal endpoint. In order to receive internal items only, the additional exclude=external parameter can be used as in /owc/pdc/v1/items/internal?exclude=external.

Individual internal items can be accessed either on the owc/pdc/v1/items/{slug}/internal or owc/pdc/v1/items/{id}/internal endpoint. This endpoint will return the content of the Internal Data field under the key [internal-data].

Authorization

In order to make a request to one of the endpoints provided by this plugin user credentials need to be passed along to REST API requests served over https:// using Basic Auth / RFC 7617.

See this wordpress documentation on Application Passwords for a detailed instruction on how to set this up.

How do I get set up?

  • Unzip and/or move all files to the /wp-content/plugins/pdc-internal-products directory
  • Log into WordPress admin and activate the ‘PDC Internal Products’ plugin through the ‘Plugins’ menu

Filters & Actions

There are various hooks, which allows for changing the output.

Action for changing main Plugin object

'owc/pdc/internal-products/plugin'

Translations

If you want to use your own set of labels/names/descriptions and so on you can do so. All text output in this plugin is controlled via the gettext methods.

Please use your preferred way to make your own translations from the /wp-content/plugins/pdc-internal-products/languages/pdc-internal-products.pot file

Be careful not to put the translation files in a location which can be overwritten by a subsequent update of the plugin, theme or WordPress core.

Running tests

To run the the following commands from the root of this project

composer install
composer test

Contribution guidelines

Writing tests

Have a look at the code coverage reports to see where more coverage can be obtained. Write tests. Create a Pull request to the OWC repository.

Who do I talk to?

If you have questions about or suggestions for this plugin, please contact Holger Peters from Gemeente Buren.

Releases

2 releases.

Tag
Published
v3.1.0 latest
Aug 17, 2026 2mo ago
Mar 13, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

PDC Internal Products 3.0.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
3.0.3
Findings
1
Worst severity
medium
Content hash
9d4c7dbc5b0fa7ac4a72add6…

Findings

  • medium Internal PDC REST endpoints only require login

    missing_capability

    Routes items/internal, items/{id}/internal, and items/{slug}/internal use permission_callback that returns is_user_logged_in(). Internal data (keys/values from _owc_pdc_internaldata, passed through the_content) is therefore readable by any Subscriber, not only editors/admins.

    src/InternalProducts/RestAPI/RestAPIServiceProvider.php:45-70

    Recommendation

    Require a capability such as edit_posts or a dedicated PDC internal-read capability instead of mere authentication.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.