WP Manifestindependent plugin directory
manifest / content / plugin-pdc-verordeningen

PDC Verordeningen WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

PDC Verordeningen Plugin

by Yard Internet · github.com/openwebconcept/plugin-pdc-verordeningen · website

★ 1stars
4kcomposer installs
v1.0.8latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/openwebconcept/plugin-pdc-verordeningen/archive/refs/heads/master.zip

On Packagist as plugin/pdc-verordeningen:

composer require plugin/pdc-verordeningen
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/openwebconcept/plugin-pdc-verordeningen ↗

OWC PDC Verordeningen

Setup

Add verordeningen to the repository, and allows to insert them where needed in the PDC item.

How do I get set up?

  • Unzip and/or move all files to the /wp-content/plugins/pdc-verordeningen directory
  • Log into WordPress admin and activate the ‘PDC Verordeningen plugin through the ‘Plugins’ menu

Filters & Actions

There are various hooks, which allows for changing the output.

Action for changing main Plugin object.
'owc/pdc-verordeningen/plugin'

See OWC\PDC\FAQ\Config->set method for a way to change this plugins config.

Via the plugin object the following config settings can be adjusted

  • metaboxes
  • rest_api_fields
Filter the format of the shortcode output
owc/pdc/verordeningen/shortcode/format
Filter the output of the shortcode output
owc/pdc/verordeningen/shortcode/after-format

Translations

If you want to use your own set of labels/names/descriptions and so on you can do so. All text output in this plugin is controlled via the gettext methods.

Please use your preferred way to make your own translations from the /wp-content/plugins/pdc-verordeningen/languages/pdc-verordeningen.pot file

Be careful not to put the translation files in a location which can be overwritten by a subsequent update of the plugin, theme or WordPress core.

We recommend using the 'Loco Translate' plugin. https://wordpress.org/plugins/loco-translate/

This plugin provides an easy interface for custom translations and a way to store these files without them getting overwritten by updates.

For instructions how to use the 'Loco Translate' plugin, we advice you to read the Beginners's guide page on their website: https://localise.biz/wordpress/plugin/beginners or start at the homepage: https://localise.biz/wordpress/plugin

Running tests

To run the Unit tests go to a command-line.

cd /path/to/wordpress/htdocs/wp-content/plugins/pdc-verordeningen/
composer install
phpunit

For code coverage report, generate report with command line command and view results with browser.

phpunit --coverage-html ./tests/coverage

Contribution guidelines

Writing tests

Have a look at the code coverage reports to see where more coverage can be obtained. Write tests Create a Pull request to the OWC repository

Who do I talk to?

If you have questions about or suggestions for this plugin, please contact Holger Peters from Gemeente Buren.

Releases

2 releases.

Tag
Published
v1.0.8 latest
Mar 25, 2025 1 year ago
v1.0.7
Mar 13, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

PDC Verordeningen 1.0.8 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.8
Findings
2
Worst severity
high
Content hash
587a18791aad26e6a8d1bdb3…

Findings

  • high Stored XSS via unescaped ordinance link meta in shortcode

    xss_stored

    The pdc-verordeningen CPT uses capability_type 'post', so Author-and-above users can create/edit posts and set _pdc-verordening-link / _pdc-verordening-new-link (CMB2 text fields and QuickEdit). QuickEditServiceProvider::registerSavePostHandler writes $_POST values with no sanitize_url/esc_url. Shortcode::addShortcode then interpolates that meta into an anchor href via sprintf without esc_url (and title into the title attribute without esc_attr). An Author can store javascript:alert(1) or break out of attributes, achieving stored XSS for all visitors of pages that embed [pdc::verordeningen]. Authors normally lack unfiltered_html, so this bypasses WordPress content filtering.

    src/Verordeningen/Shortcode/Shortcode.php:53-66

    Recommendation

    Sanitize on save with esc_url_raw (and reject non-http(s) schemes). Escape on output with esc_url($link) and esc_attr(get_the_title($id)). Verify a nonce in the QuickEdit save_post handler. Prefer type url in CMB2 fields.

  • medium QuickEdit saves ordinance link meta from unsanitized POST

    unsafe_input

    registerSavePostHandler updates post meta from $_POST["{$prefix}-{$key}"] without sanitization when the user can edit_post. Combined with the unescaped shortcode consumer this is the write half of the stored XSS. Even with output escaping fixed, unsanitized URL meta remains unsafe_input.

    src/Verordeningen/Admin/QuickEdit/QuickEditServiceProvider.php:260-269

    Recommendation

    Apply esc_url_raw / sanitize_text_field per field type before update_post_meta, and check the Quick Edit nonce (_inline_edit).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →