WP Manifestindependent plugin directory
manifest / content / tukutoi-search-and-filter

TukuToi Search and Filter WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Searches, Filters and Custom Loops for WordPress Posts, Terms and Users.

by TukuToi · github.com/tukutoi/tukutoi-search-and-filter · website

★ 0stars
41release downloads
≈10active sites
2.29.1latest · 4 years ago

Install

Download tukutoi-search-and-filter.zip From the 2.29.1 release on GitHub, Jun 28, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tukutoi/tukutoi-search-and-filter/releases/download/2.29.1/tukutoi-search-and-filter.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/tukutoi/tukutoi-search-and-filter ↗

TukuToi Search & Filter

Build Searches and Filters for WordPress Posts, Terms and Users.

Description

With TukuToi Search & Filter you can build custom Queries and Front End filters, to search thru your Post, Terms or Users. The plugin should be used together with TukuToi ShortCodes, to ensure full library of ShortCodes to display data.

Changelog

2.29.1

[Fixed] Uninstall checked on wrong plugin slug

2.29.0

[Added] Support for Custom Taxonomy Queries both in AJAX and Reload.

2.28.4

[Fixed] Missing Text Domains and some Comments for CPCS Review.

= 2.28.3

[Fixed] Undefined pag_arg when search is not ajax.

= 2.28.2

[Fixed] Template applied to Loop results got duplicated to other loop results when on ajax/same page

2.28.1

  • [Added] Merge ShortCode Types and declarations instead of overwriting filter argument

2.28.0

  • [Added] Instance is now passed to the tkt_src_fltr_query_args filter so we can target specific loops

2.26.0

  • [Fixed] Search, Pagination Reset and Loop now all act on their own instances if several on same page
  • [Fixed] Mixing both types of search and loop (AJAX and reload) now works smooth with all search inputs and loops
  • [Fixed] Mixing Select2 and non-Select2 on the same search instance now works smooth
  • [Fixed] All localised scripts now load on demand only, and build an object to update, instead of appending objects
  • [Changed] JavaScript is now NameSpaced for localised, but global usage.

2.25.2

  • [Added] Filter type (AJAX or Full page Reload) GUI Option
  • [Added] Custom paginate Links function with li_classes, ul_classes, a_classes, current_classes support
  • [Added] New ShortCode to display a Spinner or else value during AJAX operations
  • [Added] Reset functionality with native reset type button on both AJAX and Reload
  • [Fixed] Post Query Args post_type was not validated to array if comma separated, but instead just defaulted to text validation (and sanitization). Teaching moment: Luckily all TukuToi Plugins have a standard default fallback for sanitization (sanitize_text_field) or this would have been a securtiy issue, but just a bug
  • [Fixed] Several Select2 instances on same Searh Form are now working
  • [Changed] Several GUI improvements in form of hints and warnings
  • [Changed] Privided method to maybe localise scripts

2.20.3

  • [Fixed] use $.on('event', selector, function()) instead of shorthand $.live('event', function())
  • [Added] Filter to filter the main query after Search and Filter settings are passed to it: tkt_src_fltr_query_args
  • [Fixed] Custom Category Selector for search inputs did not render custom classes even if passed to shortcode
  • [Fixed] Changed query type to be post_tag instead of (wrongly) using tag

2.19.0

  • [Added] Full AJAX Pagination support with dynamically updating pagination links
  • [Changed] Some code refactor and safety additions

2.18.1

  • [Added] Support for Custom ShortCodes inside Attributes
  • [Fixed] Conditional was broken if only TukuToi ShortCode wihout Search and Filters was active

2.17.0

  • [Added] Support Conditionals in Loops, and ShortCodes in attributes in loops, while retaining query capability
  • [Changed] ShortCode declarations now support a inner key, declaring whether ShortCodes is allowed inside attributes

2.16.2

  • [Fixed] Shenanigans with Nested and Attribute ShortCodeds in Loops

2.16.1

  • [Fixed] ShortCodes where not preprocessed
  • [Added] Common Files and logic
  • [Changed] Filter name to preprocess ShortCodes

2.15.0

  • [Added] Added missing shortcode param in the GUI for loop
  • [Removed] Superfluos files
  • [Changed] Definitions class constructor requirements

2.14.0

  • [Added] Added Full Pagination Support for several loops on same page

2.13.0

  • [Added] Added Pagination Support both for reload and for ajax.
  • [Added] ShortCode attributes for loop to determine per-page and custom page var
  • [Added] Support for custom and native pagination vars

2.12.0

  • [Added] AJAX search support for on the fly input
  • [Added] Sanitize $_GET call for AJAX query

2.11.0

  • [Added] AJAX search support

2.10.0

  • [Added] Optional Select2 Support in Select Search Inputs on front end

2.9.0

  • [Added] Full support for User, Taxonomy and Post Select Search Dropdowns
  • [Added] Full support for Select Dropdowns single and multiple type
  • [Added] Fixed the two core functions for user and taxonomy dropdowns and added to a (hopefully temporary) plugin file
  • [Added] Added full support for all possible Post Query Vars

2.5.1

  • [Fixed] Avoid PHP Notice when URL unknown URL param is passed
  • [Changed] Search Template ShortCode is not anymore internal and thus user can insert thru GUI
  • [Added] Search Template ShortCode form has now nice notices about correct usage
  • [Added] Results Loop ShortCode form has now nice notices about correct usage and functioning GUI
  • [Added] Search ShortCodes "Search By" options for post query
  • [Added] Button ShortCodes options

2.0.0

  • [Changed] Using new Plugin structure
  • [Changed] Removed templating system and added in-editor templating
  • [Added] Added ShortCodes for text search and select search
  • [Added] Added ShortCodes for Buttons (Reset, Submit, etc)
  • [Added] Added ShortCode for Results loop
  • [Changed] Refactor, adhere to WPCS

1.0.0

  • [Added] Initial Release

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.29.1 latest
Jun 28, 2022 4 years ago
tukutoi-search-and-filter.zip
21
2.29.0
Jun 17, 2022 4 years ago
tukutoi-search-and-filter.zip
13
2.28.4
Jun 11, 2022 4 years ago
tukutoi-search-and-filter.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

TukuToi Search and Filter 2.29.1 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
2.29.1
Findings
3
Worst severity
high
Content hash
aba04963ec6bb714524d0ef2…

Findings

  • high Unauth AJAX WP_Query allows overriding post_status to disclose private/draft posts

    information_disclosure

    tkt_ajax_query is registered for nopriv and authenticates only via wp_verify_nonce('tkt_ajax_nonce'). Nonces are localized on public pages that render the AJAX loop shortcode (wp_create_nonce for the current user, including uid 0). set_query_args merges attacker-supplied $_GET['query_args'] into the WP_Query arguments, so post_status, post__in, author, meta_query, etc. can override the shortcode defaults (which normally set post_status to publish). Results return matching post IDs to the client.

    public/class-tkt-search-and-filter-posts-query.php:280-328,351-513

    Recommendation

    Whitelist allowed query vars; force post_status to publicly visible statuses for unauthenticated/low-priv callers; do not trust client-supplied query_args for privileged statuses.

  • high Unauth tkt_ajax_loop renders arbitrary post IDs with client-controlled template via do_shortcode

    missing_auth

    tkt_ajax_loop (nopriv) accepts objects[] (post IDs) and template from POST after nonce-only auth. For each ID it calls get_post() (no capability/status check), setup_postdata, apply_filters('tkt_post_process_shortcodes'), and do_shortcode on the attacker-supplied template (wp_kses_post). Combined with tkt_ajax_query ID discovery, this renders non-public post content to anonymous users.

    public/class-tkt-search-and-filter-posts-query.php:217-273

    Recommendation

    Verify each post is publicly viewable for the current user before rendering; ignore client template and use server-side stored templates; require a capability stronger than a scrapeable nonce for privileged content.

  • medium AJAX handlers rely on nonce alone without capability checks

    missing_capability

    All three nopriv AJAX actions (tkt_ajax_query, tkt_ajax_loop, tkt_ajax_pagination) treat a valid tkt_ajax_nonce as sufficient authorization. WordPress nonces are not authentication; logged-out nonces are available to anyone who can view a page that localizes them.

    includes/class-tkt-search-and-filter.php:331-336

    Recommendation

    Keep nopriv only for explicitly public queries; bind queries to server-side instance configurations rather than client-supplied args.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →