WP Manifestindependent plugin directory
manifest / users / focms-dashboard

FOCMS Dashboard WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Front-end dashboards for FOCMS (Family Outcomes & College Management System) - WordPress plugin

★ 0stars
9release downloads
≈10active sites
v0.2.2latest · 4mo ago

Install

Download focmsdashboardv0.2.2.zip From the v0.2.2 release on GitHub, Jun 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/srjordan6/focms-dashboard/releases/download/v0.2.2/focmsdashboardv0.2.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Front-end dashboards for the Future Officer Candidate Management System — a longitudinal portfolio and life-tracking platform built around the 5-pillar taxonomy (Personal, Academics, Extra Curricular, Career, Higher Education).

This plugin is the read layer for FOCMS. The write side (Custom Post Types, ACF field groups, Notion migration) lives in separate mu-plugins. This plugin's job is to surface the data through two themed, authenticated dashboards.

What it does

Route View Audience
/dashboard Family Dashboard Parents / guardians / system operator
/john Student Portal The student (currently configured for John, becomes /student in commercial multi-tenant)

Both routes:

  • Require WordPress login (anonymous → WP login → return after login)
  • Use mobile-first responsive CSS
  • Apply noindex,nofollow,noarchive meta to prevent search engine crawling
  • Read live data from FOCMS Custom Post Types via a central FOCMS_Data_Provider class

Family Dashboard tabs

  • Pulse (live in v0.2.0) — Quick Stats, Upcoming Deadlines, Training Pulse, Active Goals, Recent Activity
  • Risk (placeholder, Phase 3.3) — Stale records, overdue items, deadline gap analysis
  • Metrics (placeholder, Phase 3.4) — GPA/MAP/ACT trajectory card grid
  • Pathway (placeholder, Phase 3.6) — Admissions probability across 4 pathways (Service Academy, ROTC, Merit, D1 Athletic)

Architecture

  • Theme-independent — uses high-specificity .focms-* CSS classes that won't collide with theme styles
  • Tenant-configurable — all tenant values in define() constants at top of main plugin file (FOCMS_TENANT_ID, FOCMS_FAMILY_SLUG, FOCMS_GRAD_DATE, etc.)
  • Permalink-aware — uses WordPress rewrite rules API; requires Post Name (or similar) permalink structure
  • Defensive read layer — FOCMS_Data_Provider tolerates missing CPTs, missing ACF fields, missing data; widgets gracefully degrade

Installation

Production (via Git Updater)

This repo is set up for the Git Updater WordPress plugin. Once Git Updater is installed and configured:

  1. Add this repo as a managed plugin via Git Updater's settings
  2. WordPress will surface updates whenever a new release is tagged here
  3. Click "Update" in WP admin — same flow as any other plugin update

Manual install (fallback)

  1. Download the latest release ZIP from Releases
  2. WordPress admin → Plugins → Add New → Upload Plugin
  3. Upload the ZIP, install, activate
  4. Visit /dashboard (must be logged in)

Dependencies

  • WordPress 6.0+
  • PHP 7.4+
  • Advanced Custom Fields (ACF) Pro recommended — plugin falls back to get_post_meta if absent
  • FOCMS Custom Post Types registered (separate mu-plugin: jrj-family-cpts.php)

Release process

Releases follow semantic versioning:

  • Patch (0.2.x) — bug fixes, no schema changes
  • Minor (0.x.0) — new widgets, new tabs, new data provider methods
  • Major (x.0.0) — breaking changes to data provider API, template structure changes

To cut a release:

  1. Update version in focms-dashboard.php header AND FOCMS_VERSION constant
  2. Update CHANGELOG.md
  3. Commit: chore: release v0.x.0
  4. Tag: git tag v0.x.0 && git push --tags
  5. Create GitHub Release with the new tag, attach the plugin ZIP as a release asset

Commercial intent

This plugin is part of the FOCMS commercial product roadmap. The single-tenant version (this code) becomes the white-label embed mode for tenants who want their own URL. The multi-tenant SaaS version will replace the WordPress dependency with a Postgres + React stack — see the FOCMS strategic docs in Notion for the full commercial architecture.

License

Proprietary. All rights reserved. Not licensed for redistribution. See LICENSE.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.2.2 latest
Jun 3, 2026 4mo ago
focmsdashboardv0.2.2.zip
3
Jun 3, 2026 4mo ago
focms-dashboard-v0.2.1.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

FOCMS Dashboard 0.2.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.2.2
Findings
1
Worst severity
medium
Content hash
371f28555af7f07e7f1d2a18…

Findings

  • medium Missing capability check: any logged-in user can read family/student dashboard records

    missing_capability

    FOCMS_Auth::enforce_login is the only gate on /dashboard and /john. After confirming FOCMS_Router::is_dashboard_route(), it allows the request solely because is_user_logged_in() is true, then exits. Role helpers can_view_family_dashboard() and can_view_student_portal() also return is_user_logged_in() and are never invoked from the router or templates. A Subscriber (or any other logged-in role) can therefore load templates/dashboard-family.php (Pulse tab) and templates/dashboard-john.php. Those templates call FOCMS_Data_Provider methods that run get_posts() on every jrj_* CPT (student profile, family members, biometrics, academics, scholarships, etc.) with post_status=publish and no current_user_can/read_post filter, then read ACF/post meta via get_field(). Pulse renders GPA, MAP RIT scores, swim PR titles, upcoming application/test/meet deadlines, 30-day training volume, goal progress, and recent activity; the student portal renders a global record count and recent titles across all CPTs, including scholarship rows the data-provider header claims would be filtered. Unauthenticated users are redirected to wp-login.php. There is no state-changing handler.

    includes/class-focms-auth.php:38-70

    Recommendation

    Introduce a real capability (e.g. read_focms_family_dashboard / read_focms_student_portal) or restrict to specific roles, call those checks from enforce_login and from FOCMS_Data_Provider before querying, and keep family vs student datasets separate so scholarship/biometric/family-member fields are not shown on the student portal. Default-deny users who only have Subscriber.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.