WP Manifestindependent plugin directory
manifest / utilities / plugin-sb-simple-time-tracker

Silverback Time Tracker WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A simple WordPress time tracker plugin which creates an admin page for tracking time spent on activities/jobs.

by WC Bessinger · github.com/vanbess/plugin-sb-simple-time-tracker

★ 1stars
v1.0.3latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/vanbess/plugin-sb-simple-time-tracker/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/vanbess/plugin-sb-simple-time-tracker ↗
Job/Activity Time Tracker for WordPress This is a WordPress plugin that allows you to track the time you spend on your projects and tasks, or whatever you're attempting to keep track of. Nuttin fancy, just a simple tool to help you keep track of time. Tracking data is saved to the database via AJAX calls, using a custom post type 'jobs' (hidden from public view). Other than that, nothing much to say... I just built this little tool to help me keep track of time spent, main reason being that I couldn't really find a tool that was simple and fitted my needs. Oh, and it also auto converts time spent to invoiceable units, so you can easily see how much you should bill your clients. Functionality will probably be added in the future, but for now, this is it. Should be a good jumping off point if you're looking to build something similar.

Releases

4 releases.

Tag
Published
v1.0.3 latest
Jul 12, 2024 2 years ago
v1.0.2
Jul 9, 2024 2 years ago
stable
Jul 8, 2024 2 years ago
master
Jul 8, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Silverback Time Tracker 1.0.3 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.3
Findings
2
Worst severity
high
Content hash
af198abfab6016320947053e…

Findings

  • high Missing capability checks on state-changing AJAX handlers

    missing_capability

    All seven wp_ajax_* handlers (jt_delete_job, jt_save_clients, jt_save_activities, jt_add_job_activity, jt_update_time_entries, jt_update_units, jt_update_duration) only call check_ajax_referer and never current_user_can. Nonces are localized via admin_enqueue_scripts on every admin page (including profile.php reachable by Subscribers). jt_delete_job calls wp_delete_post() on attacker-supplied jobID with no post-type or ownership check, enabling deletion of arbitrary posts/pages. Other handlers update options and post meta.

    ajax.php:6-202

    Recommendation

    Require current_user_can('manage_options') (matching the admin menu gate) in every AJAX handler; verify post_type === 'jobs' before delete/update; restrict script localization to the plugin admin screen.

  • medium Stored XSS via unsanitized client/activity names echoed in admin

    xss_stored

    jt_save_clients/jt_save_activities store array_filter($_POST['clients|activities']) without per-item sanitization. admin.php echoes values with bare echo $client / echo $activity, enabling stored XSS when an admin views Time Tracker after a low-priv write.

    admin.php:47-68

    Recommendation

    Sanitize each client/activity with sanitize_text_field on save and escape with esc_attr/esc_html on output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →