WP Manifestindependent plugin directory
manifest / media / dosync

DOSync WP RegistryHigh-severity findings · 1 findingOpen the reportC-

DigitalOcean Spaces Sync Plugin

by theranger · github.com/theranger/dosync · website

★ 2stars
v1.1.0latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/theranger/dosync/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/theranger/dosync ↗
About This plugin captures all file uploads (images and attachments) and stores files in DigitalOcean Spaces container. Files are deleted from Wordpress upload directory to save disk space. File locations are changed accordingly to point to DigitalOcean Spaces container. When deleting files from media library, they will be removed from Spaces bucket as well. This plugin has a basic support to move existing media library items to Spaces. Please be careful, making backups from existing library is highly recommended before trying this! Installation 1. Upload the plugin files to the /wp-content/plugins/dosync directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the Plugins screen in WordPress. 3. Use the Settings - DOSync page to configure the plugin (Digital Ocean API key required). Credits @bitkidd - Original version of this plugin (https://github.com/bitkidd/DigitalOcean-Spaces-Sync)

Releases

2 releases.

Tag
Published
v1.1.0 latest
Mar 28, 2020 6 years ago
v1.0.0
Mar 27, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

DOSync 1.1.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.0
Findings
1
Worst severity
high
Content hash
9d23db9f47bd17ddbea89844…

Findings

  • high Missing auth on DigitalOcean Spaces sync AJAX

    missing_capability

    wp_ajax_dos_sync and wp_ajax_dos_test_connection register handlers with no current_user_can and no check_ajax_referer. Any authenticated user (Subscriber+) can trigger handleSync()/testConnection(), uploading media library files to the configured Spaces bucket and exercising stored credentials.

    plugin.php:58-59

    Recommendation

    Require manage_options (matching the settings page) and check_ajax_referer before sync/test actions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →