WP Manifestindependent plugin directory
manifest / content / family-notebook

Family Notebook WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

Family Notebook WordPress Plugin

★ 0stars
4release downloads
v1.1.4latest · 4mo ago

Install

Download family-notebook.zip From the v1.1.4 release on GitHub, Jun 23, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/qrussell/family-notebook/releases/download/v1.1.4/family-notebook.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Family Notebook for WordPress

Family Notebook is a high-performance, decoupled React Single Page Application (SPA) that transforms your WordPress site into a private, secure, and mobile-first organization hub. Designed specifically for families and small groups, it bridges the gap between complex project management tools and simple note-taking apps.

🚀 Features

  • Decoupled SPA Architecture: Experience lightning-fast, app-like navigation within WordPress.

  • Workspace Management: Organize data into multiple, isolated workspaces (e.g., "Kitchen Notes," "Kids Schooling," "Financial Planning").

  • Role-Based Access Control: Secure your data with granular permissions (Owner, Organizer, User, Viewer).

  • Modern Block Editor: Built-in modular blocks:

  • Rich Text: Standard note-taking with full formatting.

  • Checklists: Track shopping lists or task completion.

  • Chore Charts: Gamified, weekly chore tracking with status management.

  • PWA-Ready: Installable on mobile devices as a native application for seamless daily access.

  • Template Library: Export folder structures and note templates to reuse across workspaces or share with other WordPress installations.

  • Data Portability: Full JSON-based import/export system for complete control over your family data.

📱 Mobile-First Experience

Family Notebook is optimized for the modern family on the go. When installed as a Progressive Web App (PWA), it provides an edge-to-edge native interface, stripping away theme headers and footers to ensure the focus remains entirely on your content.

🛡️ Security & Integrity

  • IDOR Protection: Built-in verification (fn_is_user_authorized_for_workspace) ensures users only access workspaces they are explicitly members of.
  • Data Serialization Safety: Uses wp_slash() and wp_json_encode to prevent WordPress database layer corruption of complex rich-text block data.
  • Responsive Access Control: The UI contextually hides destructive actions (delete, edit, invite) for users without sufficient permissions.

📥 Installation

  1. Download the latest release from the Releases page.
  2. Upload the .zip file via your WordPress Admin (Plugins > Add New > Upload Plugin).
  3. Activate the plugin.
  4. Create a new page and add the shortcode [family_notebook_app] to a Code or Text module.

⚙️ Configuration

The plugin includes a global administration panel under Family Notebook > Settings:

  • App Login URL: Define the page path where your shortcode is located.
  • Starter Kit Workspace: Select a master template workspace. New workspaces will automatically clone this kit, making it easy to onboard new family members with pre-populated notes.

🛠️ Data Management

  • Backup: Generate a full JSON backup of all workspaces, notes, and templates directly from the settings panel.
  • Restore: Import data from other instances and use the "Re-link Members" tool to automatically map imported members to existing site users via their email addresses.

💻 Developer & Contributor Guide

  • Stack: Built with React, WordPress REST API, and native WordPress database tables.
  • Localization: Fully translatable using @wordpress/i18n. To contribute a translation, please use the provided .pot file in the /languages directory.
  • Building: Ensure you have Node.js installed, then run:
npm install
npm run build

📜 License

This plugin is licensed under the GPLv2 (or later) license, consistent with WordPress development standards.


Pro-Tips for Divi Users

  • Shortcode Integration: Use the [family_notebook_app] shortcode in any Divi Code Module.
  • Blank Canvas: For a truly immersive "App" experience, use a Divi Page Template that removes the header/footer, or use CSS to hide the site header when the PWA display-mode is standalone.

Built by [Cielocloud.org](https://cielocloud.org)

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.4 latest
Jun 23, 2026 4mo ago
family-notebook.zip
2
Jun 23, 2026 4mo ago
family-notebook.zip
0
Jun 22, 2026 4mo ago
family-notebook.zip
0
Jun 20, 2026 4mo ago
family-notebook.zip
1
Jun 15, 2026 4mo ago
family-notebook.zip
0
Jun 13, 2026 4mo ago
family-notebook.zip
1
D+ grade

Security

Family Notebook 1.1.4 · audited by WP Registry

High-severity findings.

3 high 1 medium
Audited release
1.1.4
Findings
4
Worst severity
high
Content hash
dd0b901ead3eb4a90da7caec…

Findings

  • high Unauthed template deletion for any logged-in user

    missing_auth

    fn_api_delete_template only requires is_user_logged_in at the route level and then calls wp_delete_post on the given id with no workspace membership or ownership check. Any Subscriber can delete arbitrary fn_template posts.

    family-notebook.php:407-407

    Recommendation

    Require fn_is_user_authorized_for_workspace on the template’s _fn_workspace_id (and an organizer/owner role) before delete.

  • high Template save/list IDOR across workspaces

    auth_bypass

    fn_api_save_template inserts an fn_template and sets _fn_workspace_id from the request without verifying membership. fn_api_get_templates accepts workspace_id and returns that workspace’s templates without calling fn_is_user_authorized_for_workspace. Any logged-in user can plant or read templates in another family’s workspace.

    family-notebook.php:347-405

    Recommendation

    Enforce fn_is_user_authorized_for_workspace($ws_id) on both save and get; reject ws_id=0 for non-admins if global templates are not intended.

  • high Any workspace member can add users as owner

    missing_capability

    fn_api_add_workspace_user only checks membership via fn_is_user_authorized_for_workspace, not owner/organizer role. The client-supplied role is written directly into app_role, and allowed values elsewhere include owner. A viewer can invite/add an account and grant owner, taking over the workspace.

    family-notebook.php:470-518

    Recommendation

    Restrict add-user to owner/organizer and whitelist assignable roles excluding owner (or require current owner).

  • medium Short predictable workspace join codes

    predictable_token

    join_code is 8 uppercase hex characters derived from md5(uniqid(rand())), ~4.3e9 space. Anyone who obtains or brute-forces a code can set fn_pending_join_code and gain viewer membership on login via fn_process_pending_join_code.

    family-notebook.php:143-143

    Recommendation

    Use wp_generate_password(20, false) or random_bytes-derived tokens (≥128 bits) and rate-limit join attempts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.