WP Manifestindependent plugin directory
manifest / updates / agreable-catfish-importer-plugin

Agreable Catfish Importer Plugin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

For importing Catfish content in to Croissant

★ 1stars
3kcomposer installs
7.1.0latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/shortlist-digital/agreable-catfish-importer-plugin/archive/refs/heads/develop.zip

On Packagist as shortlist-digital/agreable-catfish-importer-plugin:

composer require shortlist-digital/agreable-catfish-importer-plugin
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

For importing Catfish content in to Croissant

Setup

Add variable

CATFISH_IMPORTER_TARGET_URL=http://www.shortlist.com/

Commands

Commands should be run from croissant command runner

Import runner

run php croissant plugin:catfish:import to start import. You might want to use nohup/disown. Import might take few hours and your ssh connection might close.

import runner have additional options

-p amount of processes -c amount of posts imported per one process --update run only posts updated from last time -l limit amount of posts --date-limit="d/m/Y" it will ignore all posts older than the date limit -vvv to change default symfony command verbosity

Manual posts update

run wp eval-file src/cli-runner/catfish-import-posts.php {space separated urls}. This command will update posts by their urls. use --debug to increase verbosity

Get imported posts stats

run wp eval-file src/cli-runner/catfish-posts-update-times.php. This will give you list of post_url{SEPARATOR}update_time of current 'stock'

User roles

For security reasons when new user is created from old system they are all assigned one and only one role called 'purgatory' to make it possible for those people to log in, you will have to adjust their privileges

Nohup command

nohup php croissant plugin:catfish:import >>/tmp/catfish_cmd_output.log 2>> /tmp/catfish_cmd_error.log &

Releases

10 releases.

Tag
Published
7.1.0 latest
Oct 23, 2017 9 years ago
Oct 17, 2017 9 years ago
Sep 1, 2017 9 years ago
Aug 31, 2017 9 years ago
Aug 23, 2017 9 years ago
Aug 16, 2017 9 years ago
Aug 15, 2017 9 years ago
Jul 27, 2017 9 years ago
Jul 27, 2017 9 years ago
Jul 10, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Agreable Catfish Importer Plugin 3.0.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
3.0.0
Findings
2
Worst severity
high
Content hash
4c368e0c2fb50c5e54cf40b0…

Findings

  • high Missing auth and nonce on Catfish reimport AJAX

    missing_auth

    The wp_ajax_catfish_reimport handler accepts a post id, reads catfish_importer_url meta, and calls Api::importPost() with no check_ajax_referer/wp_verify_nonce and no current_user_can (e.g. edit_post). Any logged-in Subscriber can force a remote reimport that overwrites post content.

    app/editor.php:8-24

    Recommendation

    Require current_user_can('edit_post', $id) (or manage_options) and check_ajax_referer before importing.

  • medium Missing nonce on Catfish reimport AJAX

    missing_nonce

    Same handler lacks CSRF protection; a logged-in victim visiting an attacker page could be induced to reimport posts if session cookies are present.

    app/editor.php:8-24

    Recommendation

    Add check_ajax_referer with an action tied to the post id; send nonce from admin.js.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.