WP Manifestindependent plugin directory
manifest / content / hours-of-operation

Hours of Operation WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Hours of Operation (HOO) helps you display and manage your hours of operation across a variety of locations and special events.

★ 6stars
v1.0.3latest · 11 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/unc-libraries/hours-of-operation/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Hours of Operation (HOO) HoO Logo

A Wordpress plugin to help you manage and display your hours of operation across a variety of locations and special events. Designed for libraries, Hoo is adaptable enough to work for any organization.

Major features in HOO include:

  • Customizable location profiles with fields for detailed descriptions, contact information, and geolocation coordinates.

  • Customizable event categories for color-coding and prioritizing different types of events, such as regular hours, seasonal hours, and holidays.

  • An attractive default display that includes a Google map view with position markers and a list of the current hours for each location.

  • A detailed view for each location that includes location information and an interactive monthly calendar.

  • Shortcodes for displaying Today and Weekly hours for each location anywhere in your Wordpress site, and another for showing the current status of all the locations at a glance.

  • An API shortcode that creates a consumable JSON view of all location hours so that you can create your own view of the data.

  • Simple permissions that allow only Admin users to create and edit locations and categories while Editor users are only able to create and edit hours events.

  • Uses standard ical and recurrence rules, allowing you to create repeating events, 24-hour events, and open hours that extend past midnight without cluttering the calendar view.

HOO was created by the Core Applications Development team at the University of North Carolina at Chapel Hill Library.

How to Use HOO

To install HOO in an existing Wordpress instance, simply download the plugin file and unzip it in your plugins directory. Activate it and look for the Hours of Operation menu in your administrative sidebar to get started.

Setting up Locations and Events

You will need to create at least one Location and provide latitude and longitude information for it in order for the Google map display to work correctly.

Displaying Hours

When you are ready to display your hours, create a Wordpress page and add a HOO shortcode to it. For the main display with the Google map, use [hoo widget="full"]. See the Shortcodes submenu for other shortcode display options.

Uninstalling

If you need to completely delete HOO, deactivate the plugin and select the Delete option in the plugins menu to remove all data and database tables from your installation.

Development

Requirements

This plugin uses Composer for dependency management. You will first need to install the dependencies with make dependencies or php composer.phar update

Installation

git clone git@gitlab.lib.unc.edu:cappdev/hours-of-operation.git
cd hours-of-operation
make dependencies
ln -s /<full-path-to-this-directory> /<full-path-to-your-wordpress-plugins-directory>

Dependencies

HoO uses Doctrine 2 ORM and Recurr. I highly recommend getting familiar with them.

License

Hours of Operation is licensed under the GNU General Public License, version 2.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.3 latest
Aug 24, 2015 11 years ago
hours-of-operation-v1.0.3.tar.gz
7
Jul 13, 2015 11 years ago
hours-of-operation-v1.0.1.tar.gz
7
Jul 9, 2015 11 years ago
hours-of-operation-v1.0.0.tar.gz
3
D+ grade

Security

Hours of Operation 1.0.3 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.3
Findings
2
Worst severity
high
Content hash
49348f2d0903418fd28f8e48…

Findings

  • high Unauthenticated-capability AJAX can delete locations, categories, and events

    missing_capability

    State-changing AJAX callbacks (location_delete, category_delete, location_event_delete, plus order/visibility toggles) are registered only as wp_ajax_* (logged-in) but perform no current_user_can() and no check_ajax_referer/wp_verify_nonce. Any authenticated user, including Subscriber, can POST to admin-ajax.php and delete or reorder hours data that is rendered publicly via shortcodes.

    src/Hoo/Admin/LocationController.php:238-273

    Recommendation

    Require current_user_can('edit_pages') (or manage_options) and check_ajax_referer() on every mutating AJAX handler before touching entities.

  • medium Admin form POSTs never verify emitted nonces (CSRF for edit_pages users)

    csrf

    Admin views call wp_nonce_field() for create/update actions, but LocationController/EventController/CategoryController POST handlers never call wp_verify_nonce(). A CSRF request from an editor/admin session can create/update/delete schedule records.

    src/Hoo/Admin/LocationController.php:158-201

    Recommendation

    Call wp_verify_nonce( $_POST['_wpnonce'], $action ) before applying POST mutations; die on failure.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.