WP Manifestindependent plugin directory
manifest / content / one-viewer

One Viewer WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Wordpress plugin to show posts by categoies

★ 3stars
9release downloads
v1.0.0latest · 7 years ago

Install

Download wp-one-viewer-1.0.0.zip From the v1.0.0 release on GitHub, Jun 17, 2019

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tr4him/one-viewer/releases/download/v1.0.0/wp-one-viewer-1.0.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

One Viewer: A Single Page Application To Show Posts With VueJs.

One Viewer is a lightweight Wordpress plugin that pulls posts filtered by category from the Wordpress API. It shows the posts in a nice interface created with VueJs framework, and has a smooth animation when navigating through the posts by clicking next and previous buttons.

One Viewer allows the user to decide which posts should be added to the plugin's interface by selecting one or multiple categories from the settings page.

FEATURES

  • Easy to use without any configuration.
  • Loading posts with AJAX.
  • Navigation Buttons.
  • Navigate using the keyboard ("j" and "k" keys).
  • Support for swiping on touch-enabled devices.
  • Responsive and mobile-friendly.
  • "Settings" page to select categories.
  • Easily integrated with any theme without affecting any existing styles.

Requirements

  • WordPress >= 4.9

Installation

  1. Download the plugin from the Releases tab.
  2. Install using the WordPress built-in Plugin installer, or Extract the .zip file and drop the contents in the wp-content/plugins/ directory of your WordPress installation.
  3. Activate the plugin through the Plugins menu in WordPress.
  4. Navigate to Dashboard ▸ Settings ▸ OneViewer and select your categories.
  5. Navigate to https://www.YOURURL.com/viewer to see your posts.

This plugin will create a page at'/viewer', please note that if you already have a page with the same name you will not be able to access your old page, but you will not lose any data. To avoid this problem you will have to re-name your old page's slug name. Otherwise, if you disabled the plugin the old page will be back to work.

Developer information

  1. Clone this repo inside your plugins folder.
  2. Open the folder on your preferable editor.
  3. This plugin is lightweight and based on CDN libraries.
  4. Nothing to compile or config.
  5. Happy Hacking :)

Folder Architecture

├── assets                   
│   ├── css                             # Custom styles.
│   ├── js                              # VueJs Application.
│  
├── includes                            # Core Files.
│   ├── class-one-viewer.php            # Class to manage all the plugin's logic.
│   ├── class-one-viewer-endpoints.php  # Class to manage the plugin's routes.
│  
├── templates                           # Plugin Html templates.
│   ├── page-one-viewer.php             # Front-end HTML tempalte.
│   
└── wp-one-viewer.php                   # Plugin bootstraping and plugin info.

Contributing

All contributions are welcome.

License

MIT

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.0 latest
Jun 17, 2019 7 years ago
wp-one-viewer-1.0.0.zip
9
Jun 17, 2019 7 years ago
tag only
—
B grade

Security

One Viewer 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
631995e45a3c859b7f3b185e…

Findings

  • medium getPostById returns non-published posts without capability check

    information_disclosure

    getPostById loads get_post($request[id]) and returns the full post object in REST without verifying post_status === publish or current_user_can(read_post). Unauthenticated callers who know/guess an ID can read draft/private/password posts (title, content, etc.).

    includes/class-one-viewer-endpoints.php:123-180

    Recommendation

    Only return posts that pass is_post_publicly_viewable() / post_status publish, or require read_post capability.

  • low REST routes missing permission_callback

    missing_permission_callback

    Both custom routes omit permission_callback (required best practice since WP 5.5).

    includes/class-one-viewer-endpoints.php:29-50

    Recommendation

    Add an explicit permission_callback.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.