WP Manifestindependent plugin directory
manifest / updates / bp-deploy

BP Deploy WP RegistryHigh-severity findings · 1 findingOpen the reportC-

A simple Wordpress plugin to trigger Bitbucket pipelines.

by William Yallop · github.com/willyallop/bp-deploy

★ 2stars
v1.0.2latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/willyallop/bp-deploy/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/willyallop/bp-deploy ↗
BP Deploy - v1.0.2 BP Deploy is a simple Wordpress plugin to trigger Bitbucket pipelines. This plugin enables you to trigger a pipeline, view trigger history and configure the target repository, workspace and branch for your pipeline trigger. Getting started 1. Enable pipelines in you Bitbucket repository! 2. Create a pipeline that triggers on a commit to a branch. Bellow is an example. 3. Create an app password. Navigate to your Bitbucket "Personal settings" and then to the "App passwords" tab. You will need this password later so keep note of it. 4. Clone the repository into your Wordpress plugin directory. 5. In your wp-config file define the BPAPPPASSWORD variable for the app password you created in step 3. define('BPAPPPASSWORD', 'THEVALUE');. 6. Activate the plugin, and navigate to its settings tab. Fill in the fields. 7. You are ready to trigger deployments. Notes - Uninstalling the plugin will delete the deployment history. - This plugin only supports pipelines that trigger on commits to a branch.

Releases

3 releases.

Tag
Published
v1.0.2 latest
Sep 8, 2022 4 years ago
v1.0.1
Sep 5, 2022 4 years ago
v1.0.0
Sep 3, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

BP Deploy 1.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.0
Findings
1
Worst severity
high
Content hash
afb3d6b4c5a3c5733221d6a1…

Findings

  • high Overly broad REST permission allows Author/Editor to deploy and rewrite Bitbucket settings

    missing_capability

    BP_authorised_users() grants access if the user has role capability administrator OR editor OR author. Authors and editors can GET/POST /bp-deploy/v1/settings (rewrite Bitbucket username/workspace/repo/branch options) and POST /deploy (trigger Bitbucket pipelines using BP_APP_PASSWORD). Deploy and credentialed pipeline control should require manage_options (or a dedicated deploy cap), not Author.

    includes/routes.php:3-43

    Recommendation

    Restrict permission_callback to current_user_can('manage_options') (or a custom deploy capability assigned only to trusted admins). Do not treat Author/Editor as deploy-capable.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →