WP Manifestindependent plugin directory
manifest / integrations / swiftype-wordpress

Swiftype Search WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Elastic Site Search (Swiftype) Wordpress Plugin for full-text search

★ 25stars
v2.0.5latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/swiftype/swiftype-wordpress/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Elastic Site Search Logo

CircleCI build

The Site Search WordPress Plugin replaces WordPress's default search with a better search engine that is fully customizable via the Site Search dashboard.

Contents


Getting started 🐣

It is recommended that you install the plugin from the Wordpress Plugin Management screen of your Wordpress install (Plugins -> Add New);

Once the plugin is installed and enabled, you will see a new Site Search entry in the admin menu. Go to this entry to configure the Site Search plugins :

  1. Enter your Swiftype API key on the first screen.
  2. Name your search engine and optionally choose a language.
  3. Build your search index by clicking the "Synchronize" button.

Note :

  • Using this plugin assumes that you have already created a Site Search account. If you do not have one, signup for a free 14 day trial.
  • If you already have an account, you will need your API Key in order to configure the plugin. You can find it in on top of the Site Search Account Settings screen on the Site Search site.

Usage

For additional information on how to use and extend the plugin, please visit the plugin notes page.

FAQ 🔮

Where do I report issues with the plugin?

If something is not working as expected, please open an issue.

Where else can I go to get help?

You can checkout the Site Search Plugin discuss forum.

You can contact our support by sending an email to support@swiftype.com.

How to start the development environment

Create the Docker stack

You can create a docker stack using:

docker stack deploy -c stack.yml wordpress-dev

Alternatively, you can use docker-compose instead of stack:

docker-compose -f stack.yml up

Your wordpress dev instance will boot up and be available at http://localhost:8080.

To enter the wordpress container, you can use the followin command:

docker exec -it $(docker ps -a -f label=com.docker.stack.namespace=wordpress-dev -f expose=80/tcp --format "{{.ID}}") /bin/bash

Contribute 🚀

We welcome contributors to the project. Before you begin, a couple notes...

License 📗

Apache 2.0 © Elastic

Thank you to all the contributors!

Releases

5 releases.

Tag
Published
v2.0.5 latest
Sep 15, 2021 5 years ago
Oct 28, 2020 5 years ago
Oct 21, 2019 7 years ago
Oct 17, 2019 7 years ago
Apr 2, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Swiftype Search 2.0.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.0.5
Findings
1
Worst severity
medium
Content hash
b92d45e73095e8d6e7b551d1…

Findings

  • medium Password-protected post content indexed to a public Swiftype engine

    information_disclosure

    Every published post is converted to a Swiftype document with a `body` field equal to html_entity_decode(wp_strip_all_tags(post_content)). shouldIndexPost only requires an allowed post type and a non-empty title; it never inspects post_password or otherwise treats password-protected posts as unsearchable. Batch sync (get_posts post_status=publish) and save_post indexing follow the same rule. On the front end, enqueueSwiftypeAssets localizes the engine's public key as swiftypeParams.engineKey for autocomplete against /api/v1/public/engines/suggest.json. Site Search's public search API is documented to return document fields (including body) when fetch_fields is omitted. Any visitor can copy the engine key from page source and retrieve the full stripped body of password-protected published posts that WordPress would only show after the password. Private/draft posts are not indexed (status must be publish).

    Document/Mapper.php:33-42

    Recommendation

    Do not index posts with a non-empty post_password (or index only title/url and omit body/excerpt). If password-protected documents must exist in the engine, restrict the public engine key / fetch_fields so body is not returned on the public search and suggest endpoints. Re-sync after the change so already-indexed protected bodies are deleted.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.