WP Manifestindependent plugin directory
manifest / editor / purdue-blocks

Purdue Blocks WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Adds Purdue University branded Gutenberg Blocks

★ 6stars
1.24.34latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/purdue/purdue-blocks/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Purdue Blocks Plugin

Adds Purdue University branded Gutenberg blocks to the editor

Changelog

Relevant changes are documented below.

[1.23.4] 2022-4-26

Added

  • Add Link Text field to personal website link on Faculty card block.

[1.23.0] 2022-4-1

Added

  • Text block hero.

[1.22.28] 2022-3-30

Added

  • Aria label to buttons on profile gallery block.

[1.22.26] 2022-3-24

Updated

  • To Fontawesome 6.

[1.22.24] 2022-3-22

Updated

  • Allow CTA card small to have more links in the content body in addition to read more.

[1.22.23] 2022-3-21

Updated

  • Tabs block issue in new WordPress version.

[1.22.22] 2022-3-17

Updated

  • Remove Bulma dependency that's already added in theme.

[1.22.21] 2022-3-16

Updated

  • Align text on button vertically

[1.22.20] 2022-3-2

Updated

  • Anchor links block to accormodate changets from wp 5.9
  • News and RSS block to use fetch_feed to pull feed.

[1.22.19] 2022-2-17

Updated

  • Anchor links block to accormodate changets from wp 5.9
  • News and RSS block to use fetch_feed to pull feed.

[1.22.17] 2022-2-1

Modified

  • Content page layout block to overwrite column properties added from wp 5.9

[1.22.16] 2022-1-7

Modified

  • Specified font color on Accordion block

[1.22.12] 2021-11-4

Added

  • Contact Card block

[1.22.9] 2021-10-26

Modified

  • Anchor Link Block to add "Include accordion option" and specify background

[1.22.8] 2021-10-26

Modified

  • Unlocked template in accrodion centent area

[1.22.7] 2021-10-25

Added

  • Sidebar box block

[1.22.6] 2021-10-13

Modified

  • Added full height and fax options to faculty card block
  • Added image option to video hero block
  • Added function to pause video when lightbox is closed on large image featured story block.

[1.22.5] 2021-9-27

Modified

  • Added ID attribute to Accordion block and opens it when the id is in the URL

[1.22.3] 2021-9-17

Modified

  • Added lightbox to Large featured story block

[1.22.0] 2021-9-2

Added:

  • Story line block
  • Large featured story block
  • Large text block

Modified:

  • Faculty card block
  • Row of columns
  • Video hero
  • Reason to believe
  • Purdue Button
  • Accordion

[1.21.1] 2021-8-16

Fixed

  • Tabs block issue on Purdue WordPress server

[1.21.0] 2021-8-11

Minor Version Update

  • Added Video Hero Block
  • Added Shape Seperator Block

    Fixed

  • Row of columns block number of columns were resetting to one on page reload

[1.20.0] 2021-7-20

Minor Version Update

  • Added Tabs block
  • Added background image options to Columns Row block

[1.19.3] 2021-7-6

Fix

  • Added missing missing TextControl reference
  • Fixed custom rest api error

[1.19.2] 2021-6-24

Updated

  • Updated Custom side menu block: adjust the height of the gray bar when there is no to top button.

[1.19.1] 2021-6-22

Updated

  • Updated quote block: Remove remove button when there is only one quote.

[1.19.0] 2021-6-21

Minor Version Update

  • Added Columns Row block
  • Added Quote block
  • Added Alert strip block
  • Updated featured story Block to add border and background clor options

[1.18.2] 2021-6-14

Updated

  • Resolve Falcuty Profile Card block overflow issue.

[1.18.1] 2021-6-3

Updated

  • Resolve issues in the Profile Galelry Block with the modal not being scrollable on mobile or if window height was too short.

[1.18.0] 2021-6-2

Minor Version Update

  • Added Mini Hero Block

[1.17.0] 2021-6-1

Minor Version Update

  • Added Profile Gallery Block

[1.16.0] 2021-4-29

Minor Version Update

This version includes many UX improvements and other look & feel updates to Purdue Blocks.

  • Button Block
    • added the purdue button block
  • Feature Story Block
    • Updated options panel to be more user friendly
    • Added header color options
  • Site Hero Block
    • Updated options panel to use radio buttons for hero style selection rather than the toggle switch
    • Removed validation that forced a user to select a 2x1 image even on the 40/60 hero
  • Info Box Hero Block
    • Removed the hero image on mobile screen size and replaces with flat #555960 color background
  • Title Hero Block
    • Updated options panel to be more user friendly
    • Forego the use of different images for desktop and mobile, just use one image for both with inline bg
  • CTA Hero Block
    • Forego the use of different images for desktop and mobile, just use one image for both with inline bg
  • Image Toggle Block
    • Swap order of the icon and heading text; the icon is now on the left and heading on the right
    • Add the Info Box Hero icon to the selector component
    • Added paragraph field as built-in part of the block
  • Accordion Block
    • The arrow will now be centered when the text wraps to two more more lines
  • CTA Card Block
    • Added header color options
    • Added height options
  • Additional
    • Anchor Link Navigation, List, and Sidebar CTA blocks have had their names updated with added 'Right Column - ' at the beginning of each
    • Blocks that have an image or video selector now include a button to remove that media alongside the button that allows the user to select new media

[1.15.4] 2021-3-11

Updated

  • Title Hero Block
  • Add video option to title hero block.
  • Add Hero style options
  • Hide lead-in text when it's empty
  • Faculty Profile Block
  • add name, position, bio, and google scholar link
  • updated card styles

[1.15.3] 2021-3-2

Updated

  • Added info box hero block
  • Removed modernizr code

[1.15.2] 2021-2-2

Updated

  • Added image caption to featured story block.

[1.15.1] 2021-2-2

Updated

  • Added option to add the link link to image in featured story block
  • Hid the subtext when it's empty in Title Hero block

[1.15.0] 2021-1-29

Added

  • Added in blocks built in the Content Hub:
    • Icon-group
    • Podcast
    • Video Embed
    • Ad Banner
  • Added the lead-in and border options to the Title Hero block

[1.14.1] 2021-1-12

Added

  • add optional subtext option to cta hero
  • added custom side menu block
  • Added heading level select box in featured story block
  • Added News block rendered by PHP to make it dynamic

Updated

  • cta button of cta hero is now optional
  • Add "Position" property to accordion container
  • Fix Anchor link navigation Js
  • Add more description to testimonial block
  • Center button text on CTA banner

[1.13.2] 2020-11-4

Updated

  • Fixed link font issue

[1.13.1] 2020-11-2

Updated

  • Fixed large CTA-card link issue
  • Fixed proofpoint font color issue
  • Fix CTA-card and featured story background issues
  • Added the link card and latest post icons to the toggle block
  • Fixed the size of icons on the front end of the toggle block
  • Added check to determine if a certain icon should have a white background depending on a data field on the svg string

[1.13.0] 2020-10-16

Updated

  • Fixed issues with some blocks having broken styles in Internet Explorer
  • Fixed issues with the Image Toggle Block via 1.11.0 and added some new features in the editor
    • Toggle buttons did not work when there were multiple image toggle cards on the page.
    • Fixed a block crash associated with the save function not outputting the same html due to not adding some attributes to the anchor element that wordpress adds automatically on the front-end.
    • Added an optional icon selector menu to add an icon next to the heading.
    • Updated the media upload check to allow for only a single image to be chosen, and show toggle button options based on whether one or two images were selected.
    • Added checking and blocking for if more than 2 images were selected.

[1.12.0] 2020-10-06

Added

  • New Icons for all Purdue Blocks

[1.11.0] 2020-10-06

Added

  • Page Layout Block
  • Image Toggle Block
  • Sidebar CTA Block

[1.10.0] 2020-09-25

Added

  • Anchor link navigation block

Updated

  • Clean up test suites to bring them all up to date and remove unnecessary commeents and references.
  • Style updates and fixes for the RSS feed block

[1.9.0] 2020-09-10

Added

  • Purdue RSS block
  • End-to-end testing suites for Purdue RSS block

[1.8.0] 2020-09-10

Added

  • End-to-end testing suites for each block

[1.7.3] 2020-08-19

Added

  • Card block

    Changed

  • REconfigured with wp-scripts

[1.7.2] 2020-08-18

Added

  • Card block

[1.7.1] 2020-07-30

Added

  • Mobile hero image support for title hero and CTA hero blocks in Wordpress

    Adjusted

  • Updated styles to match style guide

[1.7.0] 2020-07-22

Added

  • Titled Navigation Block
  • Image Showcase Block

[1.5.0] 2020-06-11

Added

  • Jump Button
  • Testimonial Block
  • Drupal support

    Updated

  • IE display bugs
  • Site Hero bugs

[1.4.0] 2020-05-26

Added

  • Add Proof Point block
  • Add List block
  • Add Faculty Profile block

[1.3.1] 2020-05-20

Added

  • Add CTA banner block

[1.3.0] 2020-05-20

Added

  • Add large featured story block

[1.2.0] - 2020-05-18

Added

  • Add CTA Hero block
  • Add Title Hero block

[1.1.0] - 2020-05-13

Added

  • Initial public release

Releases

Newest 25 of 60 recorded releases.

Tag
Published
1.24.34 latest
Mar 14, 2023 3 years ago
Feb 20, 2023 3 years ago
Feb 8, 2023 3 years ago
Jan 20, 2023 3 years ago
Jan 5, 2023 3 years ago
Dec 15, 2022 3 years ago
Dec 14, 2022 3 years ago
Dec 12, 2022 3 years ago
Oct 26, 2022 3 years ago
Oct 12, 2022 4 years ago
Oct 6, 2022 4 years ago
Sep 28, 2022 4 years ago
Sep 28, 2022 4 years ago
Sep 27, 2022 4 years ago
Sep 27, 2022 4 years ago
Sep 14, 2022 4 years ago
Sep 14, 2022 4 years ago
Sep 7, 2022 4 years ago
Sep 6, 2022 4 years ago
Sep 1, 2022 4 years ago
Aug 31, 2022 4 years ago
Aug 26, 2022 4 years ago
Aug 25, 2022 4 years ago
Aug 22, 2022 4 years ago
Aug 16, 2022 4 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Purdue Blocks 1.24.34 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.24.34
Findings
2
Worst severity
high
Content hash
7f8399791ccaff9f2ec50ecf…

Findings

  • high Unauthenticated REST RSS proxy fetches attacker-controlled URLs

    ssrf

    register_rest_route('purduerssfeed/v2','/getFeed/') is a public GET with permission_callback that always returns true and a string url argument. feed_url_endpoint() passes that parameter to fetch_feed() with no capability check, nonce, or host allowlist. fetch_feed uses WP_SimplePie_File → wp_safe_remote_request, so RFC1918/loopback/link-local (including 169.254) are blocked on current WordPress, but any public http(s) URL is fetched by the server and parsed items (or WP HTTP error messages) are returned to the caller. The route is only consumed from the Gutenberg editor (src/purdue-rss/block.js apiFetch), so it should have required edit_posts; as written it is an unauthenticated open proxy and a cheap worker-exhaustion DoS (SimplePie timeout 10s). The plugin declares no minimum WordPress version, so older cores with a weaker wp_http_validate_url list remain fully exposed, including cloud-metadata ranges.

    src/purdue-rss/index.php:8-36

    Recommendation

    Set permission_callback to current_user_can('edit_posts') (this endpoint is only used in the editor). Allowlist https schemes and trusted feed hosts, reject private/loopback/link-local addresses even on older WP, and cap request rate. Do not return raw WP_Error messages to unauthenticated clients.

  • high Stored XSS in dynamic block render_callbacks via unsanitized headerLevel, id, and content

    xss_stored

    Several blocks register PHP render_callbacks that concatenate block attributes into HTML with no esc_html/esc_attr/tag allowlist. headerLevel is interpolated as a raw tag name and id/header/card fields as raw attributes and text. Those values live in Gutenberg block-comment JSON; filter_block_kses_value runs wp_kses on the string, which leaves values such as img src=x onerror=alert(1) or x" onclick="alert(1) unchanged because they are not HTML tags. Authors (publish_posts, no unfiltered_html) and Contributors (draft + moderator preview) can therefore ship frontend JavaScript. Observable payload: publish a purdue-slider block with background=white, header=x, headerLevel=img src=x onerror=alert(1) and visitors receive <img src=x onerror=alert(1) class="purdue-slider__header"...>. The same pattern is live in purdue-news (headerLevel plus unquoted id={$id}), rtb-cards, link-cards, image-gallery, purdue-vertical-slider, and custom-side-menu (unquoted id=). RSS imgURL/imgALT from fetch_feed are also echoed into style/aria-label on the news block. src/accordion/index.php has the same titleLevel sink but is not loaded from purdue-blocks.php.

    src/purdue-slider/index.php:8-19

    Recommendation

    Allowlist heading tags (h1–h6, p) before echoing headerLevel. Escape every attribute with esc_attr (or sanitize_html_class/sanitize_title for anchors) and every text node with esc_html or wp_kses_post. Escape hrefs with esc_url. Apply the same treatment to the other render_callbacks (purdue-news, rtb-cards, link-cards, image-gallery, vertical-slider, custom-side-menu).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.