LibTrack Pro — Library Gate Register

Free, open-source WordPress plugin for campus library gate management. QR/barcode student entry-exit tracking, multi-gate schedules, full-screen kiosk display, shift management, and rich analytics reports.

Version: 2.3.5  |  Requires WordPress: 5.8+  |  Requires PHP: 7.4+  |  License: GPLv2

Developed by T.C. Thirunavukkarasu, College Librarian, Quaid-E-Millath Government College for Women (Autonomous), Chennai. Released free for all libraries worldwide.

Table of Contents

• Features
• Requirements
• Installation
• Quick Start
• Shortcodes
• Kiosk Setup
• CSV Import Format
• Security Notes
• Contributing
• Changelog
• License

Features

Requirements

• WordPress 5.8 or later
• PHP 7.4 or later (8.0+ recommended)
• MySQL 5.7+ or MariaDB 10.3+
• PHP ZipArchive extension (for backup/restore)
• PHP GD or Imagick extension (for QR code generation)

Installation

From GitHub (ZIP)

1. Download libtrack-pro-v2.3.5-release.zip from the Releases page.
2. In WordPress admin go to Plugins → Add New → Upload Plugin.
3. Upload the ZIP and click Install Now, then Activate.
4. Go to LibTrack → Gates and create your first gate.
5. Go to LibTrack → Students and import or add your students.

From Source

cd wp-content/plugins/
git clone https://github.com/YOUR-USERNAME/library-gate-register.git

Then activate the plugin in Plugins → Installed Plugins.

Quick Start

1. Create a Gate — LibTrack → Gates → Add Gate. Set campus name, gate name, and open/close times.
2. Import Students — LibTrack → Students → Bulk Import CSV (see format below), or add individually.
3. Open the Kiosk — Add [lgr_kiosk gate_id="1"] to any WordPress page, then open it full-screen on your library display.
4. Scan — Students tap their card or the librarian scans the QR. Entry/exit is toggled automatically.
5. Reports — LibTrack → Reports → choose date range, gate, or period type.

Shortcodes

Note: The scanner shortcode requires the user to be logged in as an administrator. It is intended for staff-only pages, not public-facing ones.

Kiosk Setup

1. Create a dedicated WordPress page (e.g. "Library Kiosk").
2. Add [lgr_kiosk gate_id="X"] where X is your gate ID (visible in LibTrack → Gates).
3. In LibTrack → Kiosk Settings, generate a Kiosk Token for the device. Copy it.
4. Open the kiosk page on your display device and append ?lgr_token=YOUR_TOKEN the first time. The token is stored locally from that point on.
5. Press F11 for full-screen. The kiosk auto-refreshes and handles offline queuing if the network drops.

CSV Import Format

The student import accepts CSV with the following columns (header row required):

Koha ILS patron export CSVs are accepted directly without column remapping.

Security Notes

• Backup files are protected from direct web access (.htaccess + index.php guard written automatically). Use a backup folder inside wp-content/uploads/ or outside the web root entirely.
• Kiosk tokens are stored as SHA-256 hashes. The raw token is shown once on generation; it cannot be recovered, only revoked. Tokens older than 30 days without activity are flagged in the admin.
• Student photos accept only JPEG, PNG, and WebP — SVG is explicitly blocked.
• The scanner shortcode requires manage_options. Do not embed it on public pages.
• All database queries use $wpdb->prepare(). All admin output is escaped with esc_html() / esc_attr().

Contributing

Pull requests are welcome. Please:

1. Fork the repository and create a feature branch (git checkout -b feature/my-change).
2. Follow WordPress Coding Standards.
3. Test against WordPress 5.8+ and PHP 7.4+.
4. Open a PR with a clear description of what changed and why.

Bug reports and feature requests via GitHub Issues.

Changelog

See CHANGELOG.md for the full version history.

Latest — v2.3.5 (2026-08-17)

• Security: 6 vulnerabilities fixed (shortcode auth, SVG XSS, rate limiting, bulk delete CSRF, backup exposure, token tracking)
• Performance: All DATE() WHERE predicates replaced with SARGable range predicates; composite indexes added
• Data integrity: All scan writes and CSV imports wrapped in database transactions
• WP.org compliance: uninstall.php, text domain, output escaping, trailingslashit()

License

GPLv2 or later. See LICENSE file.

Developed with ❤️ for libraries everywhere by T.C. Thirunavukkarasu, College Librarian, Quaid-E-Millath Government College for Women (Autonomous), Chennai, India.