WP Manifestindependent plugin directory
manifest / updates / load-uploads-from-production

Load Uploads From Production WP RegistryMedium-severity findings · 1 findingOpen the reportB

This plugin rewrites attachment URLs to the production site if they are not found on the staging site. Please de-activate in production.

by The team at PIE · github.com/pie/load-uploads-from-production

★ 0stars
1.1.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pie/load-uploads-from-production/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/pie/load-uploads-from-production ↗

This plugin checks to see if attachments are available via HTTP it your current site URL and, if they return a 404, it replaces the local domain in their URL with the production site URL.

Installation

  1. Upload the Latest Version, either the .zip file via the plugins page in WP Admin or directly to your plugins directory
  2. Activate the plugin
  3. Add your production site URL to WP Admin > Settings > General > Production Adress (URL)

Support

This plugin is offered as is with no warranty and without support. Please do not use it on production sites. If you find a bug or have any suggestions for improvements then please submit them via github issue at https://github.com/pie/load-uploads-from-production/issues

Releases

4 releases.

Tag
Published
1.1.1 latest
Feb 1, 2023 3 years ago
1.1.0
Feb 1, 2023 3 years ago
1.0.1
Jan 26, 2023 3 years ago
1.0.0
Jan 26, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Load Uploads From Production 1.1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.1
Findings
1
Worst severity
medium
Content hash
346ce80f248ee525f4642b1d…

Findings

  • medium Missing capability and nonce on image-cache clear AJAX

    missing_capability

    maybe_clear_image_cache is hooked to wp_ajax_lufp_clear_image_cache with no check_ajax_referer and no current_user_can. Any authenticated user can clear PROD_IMG_URL_CACHE_ID and the success response returns the previous cache array (URL mappings).

    plugin.php:45-70

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →