WP Manifestindependent plugin directory
manifest / integrations / gearlab-tools-wordpress

GearLab Tools WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Official WordPress plugin for GearLab Website Tools

★ 0stars
48release downloads
563composer installs
v1.1.0latest · 6 years ago

Install

Download gearlab-tools-wordpress-v1.1.0.zip From the v1.1.0 release on GitHub, Jun 26, 2020

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sitecrafting/gearlab-tools-wordpress/releases/download/v1.1.0/gearlab-tools-wordpress-v1.1.0.zip

On Packagist as sitecrafting/gearlab-tools-wordpress:

composer require sitecrafting/gearlab-tools-wordpress
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

GearLab Tools for WordPress

Integrate your WordPress site seamlessly with the GearLab Tools suite.

Installation

Installing Manually

Download the .zip archive of the latest release and place the extracted directory in wp-content/plugins. Activate the plugin from the WP Admin as you normally would.

Installing via Composer

Add the requirement to your composer.json:

composer require sitecrafting/gearlab-tools-wordpress --prefer-dist

NOTE: if you are tracking your WordPress codebase as one big monorepo, the --prefer-dist flag is important! It tells Composer to find and download the .zip archive instead of the full Git repository. Without this flag, it will create the plugin directory as a Git submodule and strange things will happen.

Usage

Getting Started

After installing and activating the plugin, go to the GearLab Tools section of the WP Admin. Enter your API Key, Collection ID, and Base URI as provided by GearLab. All settings are required.

Search

With GearLab Tools, you can override the default WordPress search functionality, which is extremely limited by default, with results from the ElasticSearch crawler that powers GearLab Search. To do this you must first enter your settings as described above, in Getting Started.

Once you've entered your GearLab Tools settings, but before enabling overriding WordPress search globally, you can test from the command line to see if you get results. To do this, run wp gearlab search <search term>. You should see a JSON object like this:

{"results": [{"url": "https://www.example.com/example-page", "title": "Example Page", "snippet": "Some content"}, ...]}

Once you've entered the settings above correctly, you're ready to enable GearLab Tools Search to override the default WP search. Enable the option Override default WordPress search and save the settings again. You should now see a basic search results page rendered by GearLab Tools whenever you perform a search.

Search Shortcode

Out of the box, you can use the [gearlab_search] shortcode in any RTE that supports shortcodes. This is the recommended approach for most cases.

However, basic searches (using WordPress's standard s query param), will still render your theme's default search.php template (assuming there is one). You can redirect global searches to the page your shortcode lives on in the Settings. Go to Settings > GearLab Tools and select Redirect searches to a specific page. Type the URI, e.g. /search, in the text box that appears.

Save your changes and you're good to go! Default searches will now redirect to your page. Note that all query string parameters will be preserved except s, which will be renamed to glt_search to avoid conflicting with WordPress's default functionality.

Overriding Timber templates

This plugin has special support for Timber.

To override how Timber renders your search results, you can add Theme Overrides. These are files that the plugin looks for in your theme and loads it if finds them, falling back to the plugin's own templates if it does not. These files are (relative to your theme root):

  • gearlab-tools/search.php: Main PHP template to run. If you want to support e.g. a UI for filtering on metaTag, override this file and see the examples below.
  • (Timber template path)/gearlab-tools/search.twig: Main Twig template for rendering the search page. If you don't need to change the backend functionality (e.g. how search filters are applied) and only want to change how the overall search results page is rendered, override this file.
  • (Timber template path)/gearlab-tools/search-result.twig: Render a single search result with Twig.

...where (Timber template path) is anywhere that Timber already knows to look for Twig templates. The most commone place is the templates or views directory in your theme.

Override the GearLab search.php template

Place something like the following in your theme at gearlab-tools/search.php (this example does not rely on Timber):

// NOTE: the client may throw an exception!
use Swagger\Client\ApiException;

// Call out to the API
try {
  // search with some sensible defaults
  $response = GearLab\search();
} catch (ApiException $e) {
  error_log($e->getMessage());
  $response = [];
}

wp_header();

// Render results
foreach (($response['results'] ?? []) as $result) : ?>
  <article class="search-result">
    <h1><a href="<?= $result['url'] ?>><?= $result['title'] ?></a></h1>
    <p><?= $result['snippet'] ?></p>
  </article>
<?php endforeach; ?>

<?= GearLab\paginate_links($response) ?>

<?php wp_footer(); ?>

For more custom behavior, you can pass params directly to GearLab\search():

use Swagger\Client\ApiException;

// Override your site's pagination settings.
$count = 25;

// Note that we can't use $paged here, because WordPress core won't
// necessarily report the same number of pages as GearLab, leading to 404s
// in cases where GearLab has more result pages than WP would.
$pageOffset = ($_GET['page_num'] ?? 1) - 1;


// Call out to the API
try {
  $response = GearLab\search([
    // Pass the user's search term to the API.
    'query'     => get_query_var('s'),
    // Tell the API how many results we want per page.
    'resLength' => $count,
    // Tell the API which page of results we want.
    'resOffset' => $pageOffset * $count,
    // Tell the API to only return results of a certain type
    'metaKey'   => $_GET['my_content_type'],
  ]);
} catch (ApiException $e) {
  error_log($e->getMessage());
  $response = [];
}


// Render results
foreach (($response['results'] ?? []) as $result) : ?>
  <article class="search-result">
    <h1><a href="<?= $result['url'] ?>><?= $result['title'] ?></a></h1>
    <p><?= $result['snippet'] ?></p>
  </article>
<?php endforeach; ?>

<?= GearLab\paginate_links($response) ?>

Search Autocomplete

In addition to providing superior search results, GearLab Tools also adds search autocomplete to your search template out of the box. You don't need to do anything to make this work, although you may want to override the default jquery-ui-autocomplete styles.

The only assumption this module makes about your HTML is that the search input can be found at the selector form [name="s"], i.e. a form element whose name attribute is "s". Because of how WordPress search is implemented, this assumption will hold true unless your search functionality is overriding WordPress core in an advanced way.

For the curious, this feature works by registering a custom WP REST route at /wp-json/gearlab/v2/completions and telling jquery-ui-autocomplete to grab its autocomplete suggestions from that route.

WP-CLI Custom Commands

The plugin implements WP-CLI commands for major GearLab Tools REST endpoints, such as search:

wp gearlab search tacos

This will automatically use the credentials you've configured in the plugin settings.

Run wp gearlab --help to list subcommands.

As with other WordPress options, you can configure the plugin options with wp option:

wp option get gearlab_api_key
wp option get gearlab_collection_id
wp option get gearlab_base_uri
wp option get gearlab_enabled
wp option set gearlab_api_key supersecure
wp option set gearlab_collection_id 12345
wp option https://prd.search-api-gateway.aws.gearlabnw.net
wp option set gearlab_enabled 1

Development

To build a new release, choose the Git tag name and run:

bin/build-release.sh <TAG>

This will create a .tar.gz and a .zip archive which you can upload to a new release on GitHub.

If you have hub installed, the script will detect it and prompt you to optionally create a GitHub release directly.

Releases

16 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.0 latest
Jun 26, 2020 6 years ago
gearlab-tools-wordpress-v1.1.0.zip +1 asset
10
gearlab-tools-wordpress-v1.1.0.zip6
gearlab-tools-wordpress-v1.1.0.tar.gz4
May 18, 2020 6 years ago
gearlab-tools-wordpress-v1.1.0-rc.2.zip +1 asset
11
gearlab-tools-wordpress-v1.1.0-rc.2.zip7
gearlab-tools-wordpress-v1.1.0-rc.2.tar.gz4
May 13, 2020 6 years ago
gearlab-tools-wordpress-v1.1.0-rc.1.tar.gz +1 asset
4
gearlab-tools-wordpress-v1.1.0-rc.1.tar.gz2
gearlab-tools-wordpress-v1.1.0-rc.1.zip2
May 7, 2020 6 years ago
gearlab-tools-wordpress-v1.0.2.tar.gz +1 asset
4
gearlab-tools-wordpress-v1.0.2.tar.gz2
gearlab-tools-wordpress-v1.0.2.zip2
May 6, 2020 6 years ago
gearlab-tools-wordpress-v1.0.1.tar.gz +1 asset
4
gearlab-tools-wordpress-v1.0.1.tar.gz2
gearlab-tools-wordpress-v1.0.1.zip2
May 5, 2020 6 years ago
gearlab-tools-wordpress-v1.0.0.zip +1 asset
5
gearlab-tools-wordpress-v1.0.0.zip3
gearlab-tools-wordpress-v1.0.0.tar.gz2
Feb 18, 2020 6 years ago
gearlab-tools-wordpress-v0.2.4.zip +1 asset
10
gearlab-tools-wordpress-v0.2.4.zip7
gearlab-tools-wordpress-v0.2.4.tar.gz3
Feb 1, 2020 6 years ago
gearlab-tools-wordpress-v0.2.3.tar.gz +1 asset
4
gearlab-tools-wordpress-v0.2.3.tar.gz2
gearlab-tools-wordpress-v0.2.3.zip2
Jan 31, 2020 6 years ago
gearlab-tools-wordpress-v0.2.2.tar.gz +1 asset
4
gearlab-tools-wordpress-v0.2.2.tar.gz2
gearlab-tools-wordpress-v0.2.2.zip2
Jan 31, 2020 6 years ago
tag only
—
Jan 31, 2020 6 years ago
tag only
—
Dec 18, 2019 6 years ago
gearlab-tools-wordpress-v0.1.0.tar.gz +1 asset
4
gearlab-tools-wordpress-v0.1.0.tar.gz2
gearlab-tools-wordpress-v0.1.0.zip2
Dec 17, 2019 6 years ago
gearlab-tools-wordpress-v0.0.4.tar.gz +1 asset
7
gearlab-tools-wordpress-v0.0.4.tar.gz4
gearlab-tools-wordpress-v0.0.4.zip3
Dec 17, 2019 6 years ago
gearlab-tools-wordpress-v0.0.3.tar.gz +1 asset
8
gearlab-tools-wordpress-v0.0.3.tar.gz4
gearlab-tools-wordpress-v0.0.3.zip4
Dec 17, 2019 6 years ago
gearlab-tools-wordpress-v0.0.2.tar.gz +1 asset
6
gearlab-tools-wordpress-v0.0.2.tar.gz3
gearlab-tools-wordpress-v0.0.2.zip3
Dec 17, 2019 6 years ago
gearlab-tools-wordpress-v0.0.1.tar.gz +1 asset
6
gearlab-tools-wordpress-v0.0.1.tar.gz3
gearlab-tools-wordpress-v0.0.1.zip3
D+ grade

Security

GearLab Tools 1.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
1.1.0
Findings
3
Worst severity
high
Content hash
32ba6b36fb3d3ac548791400…

Findings

  • high REST completions route missing permission_callback

    missing_permission_callback

    register_rest_route for gearlab/v2/completions omits permission_callback. On WordPress versions that treat missing callbacks as public, any visitor can GET completions with an arbitrary prefix/term. The handler calls GearLab\completions() which uses the site-stored API key against the configured base URI, enabling API quota abuse and disclosure of search-index completion strings.

    src/Rest/GearLabRestController.php:24-43

    Recommendation

    Add an explicit permission_callback. If public autocomplete is required, use __return_true and add rate limiting; otherwise require a capability or a signed/public nonce. Never expose unbounded authenticated API proxying.

  • medium Settings save verifies nonce but not capability

    missing_capability

    On admin_menu, any POST triggers AdminPage::save_settings, which only checks wp_verify_nonce(..., 'gearlab_tools') before update_option for API key, collection id, base URI, and search overrides. There is no current_user_can('manage_options') in the save path. Nonce-only auth on a handler that writes secrets is insufficient per WP hardening guidance.

    src/AdminPage.php:85-94

    Recommendation

    Require current_user_can('manage_options') before updating options, and only process saves on the gearlab-tools settings page action.

  • low Settings fields echoed without escaping

    missing_escaping

    settings-meta.php prints gearlab_api_key, collection id, base URI, and redirect values with raw <?= $data[...] ?> inside HTML attributes, enabling stored admin XSS if an option value contains quotes/markup.

    views/settings-meta.php:4-12

    Recommendation

    Use esc_attr() for all option values printed into attributes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.