WP Manifestindependent plugin directory
manifest / integrations / wp-graphql-offset-pagination

WPGraphQL Offset Pagination WP RegistryMedium-severity findings · 1 findingOpen the reportB

Adds traditional offset pagination support to WPGraphQL

by Esa-Matti Suuronen, Valu Digital Oy · github.com/valu-digital/wp-graphql-offset-pagination · website

★ 84stars
103kcomposer installs
v0.2.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/valu-digital/wp-graphql-offset-pagination/archive/refs/heads/master.zip

On Packagist as valu/wp-graphql-offset-pagination:

composer require valu/wp-graphql-offset-pagination
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/valu-digital/wp-graphql-offset-pagination ↗

Adds traditional offset pagination support to WPGraphQL. This is useful only when you need to implement:

  • Numbered links to the "pages"
  • Ordering with custom SQL
    • Read the tutorial
    • You should read it even if don't plan to use this plugin as it teaches you a lot about WPGraphQL internals!

You should not use this plugin if you can avoid it. The cursors in the wp-graphql core are faster and more efficient although this plugin should perform comparatively to a traditional WordPress pagination implementation.

This plugin implements offset pagination for post object (build-in and custom ones), content nodes and user connections. This means there's no WooCommerce for example but checkout this issue if you are interested in one.

PRs welcome for term connections. See CONTRIBUTING.md.

Usage

query Posts {
    posts(where: { offsetPagination: { size: 10, offset: 10 } }) {
        pageInfo {
            offsetPagination {
                # Boolean whether there are more nodes in this connection.
                # Eg. you can increment offset to get more nodes.
                # Use this to implement "fetch more" buttons etc.
                hasMore

                # True when there are previous nodes
                # Eg. you can decrement offset to get previous nodes.
                hasPrevious

                # Get the total node count in the connection. Using this
                # field activates total calculations which will make your
                # queries slower. Use with caution.
                total
            }
        }
        nodes {
            title
        }
    }
}

The where argument is the same for contentNodes and users.

Installation

Use must have WPGraphQL v0.8.4 or later installed.

If you use composer you can install it from Packagist

composer require valu/wp-graphql-offset-pagination

Otherwise you can clone it from Github to your plugins using the stable branch

cd wp-content/plugins
git clone --branch stable https://github.com/valu-digital/wp-graphql-offset-pagination.git

Prior Art

This a reimplementation of darylldoyle/wp-graphql-offset-pagination by Daryll Doyle. The API is bit different but this one has unit&integration tests and support for latest WPGraphQL.

Releases

3 releases.

Tag
Published
v0.2.1 latest
Mar 21, 2025 1 year ago
v0.2.0
May 6, 2020 6 years ago
v0.1.0
Jan 29, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WPGraphQL Offset Pagination 0.2.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.2.0
Findings
1
Worst severity
medium
Content hash
cf36c865cb0c19f5cf550fad…

Findings

  • medium offsetPagination.size bypasses WPGraphQL max query amount (size -2 loads all rows)

    dos

    op_filter_map_offset_to_wp_query_args / op_filter_map_offset_to_wp_user_query_args copy GraphQL where.offsetPagination.size into WP_Query posts_per_page and WP_User_Query number as intval(size)+1 with no upper bound and no rejection of negatives. WPGraphQL PostObjectConnectionResolver (0.8.4 through current) first sets posts_per_page from min(requested, graphql_connection_max_query_amount default 100)+1, then array_merges sanitize_input_fields() which applies graphql_map_input_fields_to_wp_query — so this plugin's value overwrites the cap. GraphQL Int may be -2, producing posts_per_page/number = -1: WP_Query treats -1 as all matching posts; WP_User_Query only emits LIMIT when number > 0, so -1 is unlimited. Unauthenticated POST /graphql can send { posts(where:{offsetPagination:{size:-2}}){ nodes { id title content } } } and, if pageInfo.offsetPagination.total is selected, op_filter_graphql_connection_query_args also sets no_found_rows=false (SQL_CALC_FOUND_ROWS). Logged-in subscriber/customer can do the same on users. php/MySQL hydrate every returned ID. Published post bodies are already public; the issue is unbounded fetch versus WPGraphQL's 100-item control.

    src/Loader.php:148-180

    Recommendation

    Clamp size to a positive integer no larger than apply_filters('graphql_connection_max_query_amount', 100) (or the resolver's get_query_amount()). Reject size < 1 so intval(size)+1 can never become WP_Query's -1 'all posts' or a WP_User_Query with no LIMIT. absint() offset as well. Keep the size+1 hasMore fetch only after the clamp.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →