WP Manifestindependent plugin directory
manifest / users / libtrack-pro

Library Gate Register WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Free WordPress plugin for library gate management — QR/barcode student entry/exit tracking

by Your Library · github.com/qmgcwlibrary-sketch/libtrack-pro

★ 1stars
23release downloads
≈20active sites
v2.3.5latest · 2mo ago

Install

Download libtrack-pro-v2.3.0.zip From the v2.3.0 release on GitHub, Aug 12, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/qmgcwlibrary-sketch/libtrack-pro/releases/download/v2.3.0/libtrack-pro-v2.3.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/qmgcwlibrary-sketch/libtrack-pro ↗

LibTrack Pro — Library Gate Register

Free, open-source WordPress plugin for campus library gate management. QR/barcode student entry-exit tracking, multi-gate schedules, full-screen kiosk display, shift management, and rich analytics reports.

Version: 2.3.5  |  Requires WordPress: 5.8+  |  Requires PHP: 7.4+  |  License: GPLv2

Developed by T.C. Thirunavukkarasu, College Librarian, Quaid-E-Millath Government College for Women (Autonomous), Chennai. Released free for all libraries worldwide.

Table of Contents

Features

Category What it does
Gate Management Multiple campuses, multiple gates per campus, open/close time schedules, auto-close exits at gate closing time
Student Master Registration number, name, photo, gender, degree, course, year, shift, email, mobile — bulk import via CSV
QR / Barcode Scan Camera-based (QR, Code-128, Code-39, EAN-13, Data Matrix) + USB hardware scanner + manual fallback
Entry / Exit Logic Smart toggle — last action determines next type; visit duration calculated on exit
Full-Screen Kiosk Cinematic dark-mode display, live clock, animated student card with avatar, rotating side panels (quotes, new arrivals, notices, live stats, leaderboard)
Shifts Morning / Evening / Night or custom; shift-wise traffic reports
Reports & Analytics Daily traffic, monthly trend, gate comparison, heatmap, gender breakdown, exam vs normal period, month-over-month, student attendance
Leaderboard Monthly and all-time top visitors shown on kiosk
Backup & Restore One-click ZIP backup, scheduled auto-backup, chunked restore — safe on large databases
Circulation Basic book issue/return tracking with due-date management
Koha Import Direct CSV import from Koha ILS patron exports

Requirements

  • WordPress 5.8 or later
  • PHP 7.4 or later (8.0+ recommended)
  • MySQL 5.7+ or MariaDB 10.3+
  • PHP ZipArchive extension (for backup/restore)
  • PHP GD or Imagick extension (for QR code generation)

Installation

From GitHub (ZIP)

  1. Download libtrack-pro-v2.3.5-release.zip from the Releases page.
  2. In WordPress admin go to Plugins → Add New → Upload Plugin.
  3. Upload the ZIP and click Install Now, then Activate.
  4. Go to LibTrack → Gates and create your first gate.
  5. Go to LibTrack → Students and import or add your students.

From Source

cd wp-content/plugins/
git clone https://github.com/YOUR-USERNAME/library-gate-register.git

Then activate the plugin in Plugins → Installed Plugins.

Quick Start

  1. Create a Gate — LibTrack → Gates → Add Gate. Set campus name, gate name, and open/close times.
  2. Import Students — LibTrack → Students → Bulk Import CSV (see format below), or add individually.
  3. Open the Kiosk — Add [lgr_kiosk gate_id="1"] to any WordPress page, then open it full-screen on your library display.
  4. Scan — Students tap their card or the librarian scans the QR. Entry/exit is toggled automatically.
  5. Reports — LibTrack → Reports → choose date range, gate, or period type.

Shortcodes

Shortcode Description Capability required
[lgr_kiosk gate_id="1"] Full-screen kiosk display for a specific gate None (public page)
[lgr_scanner gate_id="1"] Embedded scan widget for admin use on a page manage_options

Note: The scanner shortcode requires the user to be logged in as an administrator. It is intended for staff-only pages, not public-facing ones.

Kiosk Setup

  1. Create a dedicated WordPress page (e.g. "Library Kiosk").
  2. Add [lgr_kiosk gate_id="X"] where X is your gate ID (visible in LibTrack → Gates).
  3. In LibTrack → Kiosk Settings, generate a Kiosk Token for the device. Copy it.
  4. Open the kiosk page on your display device and append ?lgr_token=YOUR_TOKEN the first time. The token is stored locally from that point on.
  5. Press F11 for full-screen. The kiosk auto-refreshes and handles offline queuing if the network drops.

CSV Import Format

The student import accepts CSV with the following columns (header row required):

Column Required Notes
cardnumber ✓ Unique registration/card number
surname ✓ Family name
firstname Given name
othernames Middle name / initials
gender Male or Female
dateofbirth YYYY-MM-DD or DD/MM/YYYY
dateenrolled YYYY-MM-DD
dateexpiry YYYY-MM-DD
categorycode Degree / member type code
sort1 Course / programme
sort2 Year / batch
shift Morning / Evening / Night
email
phone
branchcode Campus / branch

Koha ILS patron export CSVs are accepted directly without column remapping.

Security Notes

  • Backup files are protected from direct web access (.htaccess + index.php guard written automatically). Use a backup folder inside wp-content/uploads/ or outside the web root entirely.
  • Kiosk tokens are stored as SHA-256 hashes. The raw token is shown once on generation; it cannot be recovered, only revoked. Tokens older than 30 days without activity are flagged in the admin.
  • Student photos accept only JPEG, PNG, and WebP — SVG is explicitly blocked.
  • The scanner shortcode requires manage_options. Do not embed it on public pages.
  • All database queries use $wpdb->prepare(). All admin output is escaped with esc_html() / esc_attr().

Contributing

Pull requests are welcome. Please:

  1. Fork the repository and create a feature branch (git checkout -b feature/my-change).
  2. Follow WordPress Coding Standards.
  3. Test against WordPress 5.8+ and PHP 7.4+.
  4. Open a PR with a clear description of what changed and why.

Bug reports and feature requests via GitHub Issues.

Changelog

See CHANGELOG.md for the full version history.

Latest — v2.3.5 (2026-08-17)

  • Security: 6 vulnerabilities fixed (shortcode auth, SVG XSS, rate limiting, bulk delete CSRF, backup exposure, token tracking)
  • Performance: All DATE() WHERE predicates replaced with SARGable range predicates; composite indexes added
  • Data integrity: All scan writes and CSV imports wrapped in database transactions
  • WP.org compliance: uninstall.php, text domain, output escaping, trailingslashit()

License

GPLv2 or later. See LICENSE file.

Developed with ❤️ for libraries everywhere by T.C. Thirunavukkarasu, College Librarian, Quaid-E-Millath Government College for Women (Autonomous), Chennai, India.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.3.5 latest
Aug 17, 2026 2mo ago
tag only
—
v2.3.0
Aug 12, 2026 2mo ago
libtrack-pro-v2.3.0.zip
23

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

D+ grade

Security

Library Gate Register 2.3.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.3.0
Findings
2
Worst severity
high
Content hash
2c74b926ddde914e50b970f0…

Findings

  • high Public shortcode nonce authorizes unauthenticated student PII leaderboard API

    missing_auth

    wp_ajax_nopriv_lgr_kiosk_leaderboard and wp_ajax_nopriv_lgr_kiosk_data treat a valid lgr_nonce as full authorization. Unlike handle_scan / authenticate_scan_request(), they never call current_user_can('manage_options'). LGR_Public_Handler::maybe_enqueue() localizes wp_create_nonce('lgr_nonce') for every visitor of a published page that contains [lgr_kiosk], [lgr_scanner], or even [lgr_student_card] — including uid 0. Logged-out WordPress nonces are shared across all guests, so anyone who can view such a page (the plugin's documented setup) can replay that nonce against admin-ajax.php and receive top-visitor student_name and reg_number values plus live inside/unique counts, with no kiosk device token. This bypasses the token-or-admin gate that maybe_render_raw_kiosk() and handle_scan() enforce. Observable: open a public page with [lgr_scanner], copy lgrVars.nonce, POST action=lgr_kiosk_leaderboard&nonce=... as a logged-out user; the JSON includes names and card numbers. Scan/export/student CRUD remain admin-or-token and were not included in this finding.

    includes/class-lgr-ajax.php:808-887

    Recommendation

    Mirror authenticate_scan_request() on kiosk_data and kiosk_leaderboard: require current_user_can('manage_options') when authenticating via nonce, and require a valid POST kiosk_token for unauthenticated kiosk terminals. Stop publishing lgr_nonce on [lgr_scanner]/[lgr_student_card] pages that are not meant to read the full leaderboard. Keep the ?lgr_kiosk=1 token gate and apply the same token check inside shortcode_kiosk() if the page should not be a public PII display.

  • medium Stored XSS in admin attendance student autocomplete

    xss_stored

    The Reports attendance tab builds dropdown HTML by concatenating AJAX-returned student name and cardnumber into innerHTML and a data-name attribute with no JavaScript escaping. search_students() returns firstname/surname/cardnumber from lgr_students; those fields are stored via sanitize_text_field, which strips tags but preserves quotes. A stored name such as x" onmouseover="alert(document.cookie) breaks out of data-name and executes when an administrator types a matching query on the attendance tab. Write path is manage_options (student form, CSV import, Koha auto-import), so this is admin-to-admin stored XSS, not a Subscriber gadget. The sibling admin.js QR modal innerHTML path is unused (no .lgr-qr-btn markup). Kiosk front-end uses textContent / esc() and is not this sink.

    includes/class-lgr-admin.php:4182-4188

    Recommendation

    Build dropdown nodes with createElement/textContent or escape &, <, >, ", ' before interpolation. Keep using textContent on the kiosk; apply the same helper (lgrEsc already exists in admin.js) here.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →