WP Manifestindependent plugin directory
manifest / integrations / third-party-users-display

Display Third Party Users WP RegistryMedium-severity findings · 1 findingOpen the reportB

A simple package to display users in table on custom endpoint from third party API

by DRC Systems · github.com/rajumakwana/third-party-users-display · website

★ 0stars
12composer installs
v3.0.0latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rajumakwana/third-party-users-display/archive/refs/heads/master.zip

On Packagist as drcsystems/display-third-party-users:

composer require drcsystems/display-third-party-users
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/rajumakwana/third-party-users-display ↗
Drc Systems Display Third Party Users A simple wordpress plugin to display users in table on custom endpoint from third party API. Installation Plugin Installation The plugin can be installed via Composer by the name drcsystems/display-third-party-users. It means they can be installed by adding the entry to composer.json require-dev: or via command line with: (From your wordpress root) Plugin Requirements - Php 5.6 or later - Wordpress 5 or later (The default target version is PHP 7.0+ and Wordpress 5.7) Usage Basic usage When the plugin is installed via Composer, and dependencies are updated, everything is ready and you can view the plugin in wp-admin under plugin where you need to activate it. There are options that can be used to customise which can be found under Settings-Third Party Users in wp-admin Configuration After activating the plugin go to Settings-Third Party Users in wp-admin and change the Endpoint Slug if you want other wise the default value will be used. Following API is used as default to display users: (You can change the API but make sure your API has the same response structure as the default API) Visit the page with your Endpoint Slug to

Releases

3 releases.

Tag
Published
v3.0.0 latest
Jul 19, 2021 5 years ago
v2.0.0
Jul 5, 2021 5 years ago
v1.0.0
Jul 2, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Display Third Party Users 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.0
Findings
1
Worst severity
medium
Content hash
9f8f30a1fa423e59af90ad2a…

Findings

  • medium Unescaped API URL and API fields in frontend DataTables JS

    xss_stored

    The users-list API URL from option my_option_name is printed into inline JavaScript with bare echo (no esc_js/esc_url). Column renderers also concatenate API response fields into HTML without encoding. An administrator who pastes a quote-breaking URL, or any compromise/hostility of the remote JSON API, yields stored XSS for visitors of the wpdtpu users page. Write path is manage_options-only Settings API.

    includes/class/class.datatable.scripts.php:40-90

    Recommendation

    Escape the API URL with esc_js(esc_url($api)) (or json_encode). Escape DataTables cell values (textContent / jQuery text) instead of HTML concatenation. Prefer esc_url_raw on save.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →