WrkLst Plugin

Description

WrkLst is a professional artwork inventory management system. This WordPress plugin connects your WrkLst account to your WordPress site so you can pull artworks, exhibitions, installation views, and press releases directly into the Media Library and into posts and pages.

Features

Inventory

• Inventory tab in the Media Library ("WrkLst Inventory") and a dedicated WrkLst → Inventory admin subpage for browsing the full catalogue
• Real-time search by title, artist, or inventory number, with infinite scroll
• Filter by inventory and availability status, with selections persisted across sessions
• Multi-image artworks are supported — each view can be imported independently
• Metadata preserved on import: titles, captions, descriptions, inventory numbers
• Import-status badges on previously imported works (fully / partially imported)

Exhibitions

• Exhibitions tab in the Media Library ("WrkLst Exhibition") and a dedicated WrkLst → Exhibitions admin subpage with a two-step picker → detail flow
• Installation views and exhibited artworks shown side-by-side on the detail view, with deduplication against the Media Library
• Bulk-import buttons on the exhibition detail view:
  • "Download all installation views"
  • "Download all artworks"
  • "Download all"
  • "Download first image of each artwork" (one image per multi-image artwork) Each button shows the remaining count and skips items already in the Media Library
• Auto-generated alt text for installation images, built server-side from the exhibition data (title, solo/group framing, artists, venue, dates, artwork count)
• Press release HTML copy buttons at the top of the detail header — one click copies cleaned Quill HTML to the clipboard, ready to paste into a post body

Image delivery & settings

• Image format setting (JPEG / WebP) applied to imgproxy URLs for both Media Library thumbnails and uploaded copies
• imgproxy-backed sizes: thumbnails at rs:fit:500:0, uploaded copies at rs:fit:2500:0
• Optional inventory number in WordPress captions, controlled from the settings page
• Biography webhook support (with configurable bio/news formats and a webhook auth token)

Updates

• Self-hosted updates from GitHub — version tags (vX.Y) pushed to wrklst/wrklst-plugin surface in WordPress's Dashboard → Updates flow with one-click install. The checker looks at GitHub releases first, then the highest version tag, and compares it with the installed Version: header; untagged commits on master are never offered

Installation

1. Download the Plugin:

   • Download the zip of the latest version tag, e.g. https://github.com/wrklst/wrklst-plugin/archive/refs/tags/v3.22.zip, or use Code → Download ZIP on the repository page
   • The vendor/ folder is committed, so the zip is complete as downloaded — no composer install step

2. Upload the Plugin:

   • In WordPress go to Plugins → Add New → Upload Plugin and upload the zip, or unzip it into /wp-content/plugins/
   • The folder name inside the zip (wrklst-plugin-3.22, wrklst-plugin-master, …) does not matter; later updates keep whatever folder name you installed with

3. Activate the Plugin:

   • Navigate to 'Plugins' in your WordPress admin
   • Find 'WrkLst Plugin' and click 'Activate'

4. Configure Settings:

   • Go to WrkLst → Settings in your WordPress admin
   • Enter your WrkLst account ID (the part before .wrklst.com)
   • In WrkLst, open Settings → API tokens (https://<account>.wrklst.com/settings/apitokens), create a WordPress plugin token and paste it into "WrkLst API Key"
   • Save the settings

Usage

Importing artworks via the Media Library

1. Open the Media Library and click 'Add New' (or insert media from the post editor)
2. Select the WrkLst Inventory tab
3. Search by title, artist, or inventory number; filter by inventory and/or availability
4. Click an artwork to import it. Multi-image artworks expand so each view can be picked individually

Importing from an exhibition

1. From the Media Library uploader open the WrkLst Exhibition tab, or go to WrkLst → Exhibitions in the admin
2. Pick an exhibition from the picker
3. On the detail view, either click individual installation views / artworks, or use the bulk-import buttons ("Download all installation views", "Download all artworks", "Download all", "Download first image of each artwork"). Already-imported items are skipped automatically
4. If the exhibition has press releases, click the title button at the top to copy the cleaned HTML to your clipboard and paste it into a WordPress post

Inventory overview page

• Open via WrkLst → Inventory in the admin
• Browse the full catalogue in a grid with the same search/filter controls as the Media Library tab
• Click an artwork to import it directly into the Media Library

Managing imported media

• Imported artworks land in the Media Library with all metadata intact and can be inserted into posts and pages with the normal WordPress flow
• Items are flagged to show their import status (fully / partially imported) so the next pass can resume where it left off

Requirements

• WordPress 5.0 or higher
• PHP 7.4 or higher
• Active WrkLst account with API access
• Valid SSL certificate (for secure API communication)

Development

The vendor/ directory is committed to the repository so the repo can be dropped into wp-content/plugins/ and used directly — no composer install step required.

When updating dependencies, run composer update (or composer require ...) and commit the resulting changes to vendor/ and composer.lock together. Bundled tests, fixtures, and dev metadata inside vendor packages are excluded via .gitignore to keep the tree small.

Getting API Access

The plugin authenticates with a WordPress plugin token from your WrkLst account. Any WrkLst admin can create one under Settings → API tokens (https://<account>.wrklst.com/settings/apitokens): choose "WordPress plugin", name it after your site, and paste the token — it is shown only once — into the plugin's settings. A WordPress plugin token can read works and exhibitions for your site and nothing else: no prices, nothing confidential, no access to the rest of the API. Revoke it from the same page at any time.

Support

For support and documentation, please visit WrkLst Support

Changelog

3.22

• Security: the WrkLst API token is now sent only as an Authorization: Bearer header on every request. Three of the four API calls used to put it in the query string, where it lands in access logs and caches
• Security: the Account ID setting is restricted to a wrklst.com subdomain label, so a mistyped or hostile value can no longer point the API token at another host. The API key, webhook token and the two Mustache templates are sanitized on save and escaped on display
• Security: the Biography webhook token is generated with WordPress's CSPRNG (wp_generate_password) instead of uniqid()/mt_rand()
• Security: the AJAX endpoints require the upload_files capability. Before, edit_posts was enough, which let Contributors sideload files into the Media Library
• Security: artwork, exhibition and inventory names from the WrkLst API are HTML-escaped before rendering in wp-admin. A title containing quotes or tags previously broke the picker markup and could inject script into the admin session
• Removed templates/ajax_media_uploader_works.php, an unused file that bootstrapped WordPress through a relative wp-load.php include when requested directly. Also removed the unused assets/admin.js (fully commented out) and assets/send_b64_data.js
• Fix: multi-word searches on the Inventory tab lost their spaces (Agnes Martin reached the API as AgnesMartin). The JavaScript pre-encoded the query and sanitize_text_field() then stripped the percent-encoded characters; values are now encoded once, server-side
• Fix: uninstall.php used the hard-coded wp_postmeta table name (a no-op on sites with a custom table prefix) and a LIKE pattern whose _ matched any character. It now uses $wpdb->postmeta, an escaped prefix match, and also removes the plugin's options
• Fix: icon URLs on the WrkLst → Inventory/Exhibitions admin pages assumed the plugin lives at /wp-content/plugins/wrklst-plugin/. They now use the real plugin URL, so a renamed folder (e.g. a GitHub zip download) or a subdirectory install works
• Fix: the Biography webhook no longer resets the PHP opcode cache on every call, tolerates a non-string token field without a fatal error, and ignores payloads without an artist id
• Plugin header declares Requires at least: 5.0 and Requires PHP: 7.4. PHP 8.4 implicit-nullable deprecation in SettingsApi fixed

3.21

• The settings page now says where the API key comes from: a WordPress plugin token created in WrkLst under Settings → API tokens, linked directly to your account's token page once the Account ID is entered. WordPress plugin tokens are self-service (no more emailing support) and carry exactly the rights this plugin needs — works and exhibitions for the website, nothing else
• Plugin URI corrected to the repository this plugin is released from (wrklst/wrklst-plugin)

3.20

• Fix: importing a single view from a multi-image artwork now populates Description and Alternative Text on the WP attachment again. The sub-image renderer in wrklst-base.js (renderSubImage) was emitting only data-caption and was missing data-description and data-alt, so the click handler had nothing to forward to the AJAX upload. Both attributes now inherit from the parent work — same value as a single-image artwork would carry — since the description and alt belong to the inventory record, not the individual image. (3.19 fixed the same gap on the inventory tab's click handler; this closes the corresponding gap on the sub-image markup it reads from)

3.19

• Fix: importing an artwork from the Media Library "WrkLst Inventory" tab now populates the Description field on the attachment again. The click handler in that tab was sending only image_caption to the AJAX upload endpoint and was missing both image_description and image_alt. Regression introduced in the 3.2 Exhibitions refactor (the new Exhibition handler sent all three; the inventory handler in the same file kept the older payload)
• Fix: italic markup on the artwork title (<i>Title</i>) now survives the import into the WP attachment Caption and Description fields. The AJAX handler was sanitizing both with sanitize_textarea_field, which strips ALL HTML tags. Switched to wp_kses_post, the same kses WordPress applies to post_content/post_excerpt on its own save path

3.18

• Bump mustache/mustache from dev-master (an old commit predating PHP 8.x null-arg fixes) to ^2.14 — picks up v2.14.2. Silences the trim(): Passing null and array offset on null notices in vendor/mustache/mustache/src/Mustache/Tokenizer.php and Parser.php that were appearing on every plugin load on PHP 8.x hosts. The \Mustache_Engine class name used by BiographyWebhook is unchanged

3.17

• Fix: declare plugin_path, plugin_url, and plugin_name on BaseController so PHP 8.2+ stops emitting "Creation of dynamic property is deprecated" notices for every subclass (Admin, Enqueue, AdminCallbacks, AjaxHandler, SettingsLinks, all post types, BiographyShortcode, BiographyWebhook). The notices were noisy enough to fill the WP-CLI plugin-update log on PHP 8.2+ hosts

3.16

• Confirmed artworks in an exhibition are now visually marked with a green "confirmed" badge in the picker grid (admin subpage and Media Library tab)
• New "Confirmed only" toggle on the exhibition detail header. Defaults to on whenever the exhibition has at least one confirmed artwork (the unconfirmed roster is usually still being curated). When on, unconfirmed artworks are hidden from the grid, the bulk-download counts only count confirmed items, and the bulk-download buttons skip unconfirmed inventory. Installation views are unaffected by the toggle since they have no confirmation state
• Picker cards show "(N confirmed)" alongside the artwork count whenever the count differs from the total
• Backend (wrklst-app): the WordPress integration endpoint now emits confirmed: bool on each inventory hit (from exhibitionables.confirmed) and artwork_count_confirmed on the exhibition summary

3.15

• Hide artworks with no uploaded image from the Exhibitions detail view (admin subpage and Media Library tab). Placeholder inventory rows ("Title TBC", "IMAGE IN PROGRESS") were rendering <img src=""> which the browser then resolved against the page URL → 404. Affected items are now filtered out of the rendered grid and the bulk-download counts
• Defensive: when a preview URL is empty, render a 1×1 transparent GIF instead of an empty src to prevent any future no-image hit from re-introducing the same 404

3.14

• Picker preview thumbnails now request the exact same imgproxy URL that wrklst-app uses for its overview cache (rs:fit:500:0 + @webp), so the preview hits the existing cache instead of forcing imgproxy to render an extra variant. The Image Format setting still applies to the uploaded copy

3.13

• Admin menu icon switched to assets/img/wrklst-logo.png (rendered via a plain <img> tag by WordPress). Removed the SVG and orphan Sketch source

3.9

• Fix: the "WrkLst Exhibition" tab inside the WordPress Media Library uploader now populates immediately on open. Previously the initial fetch fired before the submit handler was bound (because the API-credentials callback ran synchronously off the localized nonce), so the picker stayed empty until the user typed a character to re-trigger the fetch

3.8

• New "Download first image of each artwork" bulk button on the Exhibitions detail view (admin subpage + media uploader tab). For single-image artworks it imports the only image; for multi-image artworks it imports the first sub-image only. Already-imported artworks are skipped entirely (no second pick is taken from a multi-image artwork whose first image is already in the library)

3.7

• Bulk-import buttons on the exhibition detail view: "Download all installation views", "Download all artworks", and "Download all" — each shows the remaining count and skips items already in the WP Media Library
• More descriptive auto-generated alt text for installation images (built server-side from the exhibition data: title, solo/group framing, artists, venue, dates, artwork count) so imported install views land with accessible alt text out of the box

3.5

• Press releases on the Exhibitions detail view: when an exhibition has one or more press releases, a row of buttons appears at the top of the detail header showing each release's title; clicking a button copies the cleaned Quill HTML to the clipboard, ready to paste into a WordPress post body. Wired up on both the Exhibitions admin subpage and the Media Library "Import from Exhibition" tab
• Picker cards now show a press-release count alongside the install/artwork counts so it's visible at a glance which exhibitions ship a release

3.4

• Replaced the admin menu icon with the WrkLst monogram SVG, served as a data: URI so it picks up WordPress's admin color scheme automatically. Removed the orphan PNG

3.3

• Self-hosted plugin updates from GitHub: tagged releases at wrklst/wrklst-plugin now surface in WordPress's Dashboard → Updates flow with one-click install, replacing the need to manually re-upload the plugin zip on each release. Powered by yahnis-elsts/plugin-update-checker against GitHub releases (release-asset zip preferred, falls back to source archive of the tag)
• One-time manual upgrade required to reach 3.3 (3.2 does not yet contain the update checker); from 3.3 onward updates land automatically

3.2

• Added an "Exhibitions" tab/subpage with a two-step picker → detail UX: select an exhibition, then browse its installation images and artworks side-by-side
• Added the same Exhibitions tab inside the WordPress Media Library uploader so install images and exhibition artworks can be pulled directly into Media at insert time
• Backend API: new /ext/api/wordpress/exhibitions and /ext/api/wordpress/exhibitions/{id} endpoints that shape installation images and artworks with the same fields as the existing inventory hits, so the renderer and import path are reused unchanged
• Namespaced installation-image source IDs (exh-{id}-{mediaId}) so dedup against the WP media library does not collide with inventory IDs

3.1

• Added "Image Format" setting (JPEG/WebP) on the WrkLst settings page; chosen format is applied to imgproxy URLs for thumbnails and uploaded copies (default: JPEG)
• Switched media library thumbnails to imgproxy rs:fit:500:0 (matches the WrkLst overview cache) and uploaded copies to rs:fit:2500:0
• Accepted images.wrklst.com alongside img.wrklst.com on the upload endpoint
• Slimmed bundled vendor/ (excluded tests/fixtures/dev metadata) and documented the commit-vendor policy

3.0

• Complete refactor using WordPress Backbone.js framework
• Improved multi-image artwork support
• Enhanced search and filtering capabilities
• Better error handling and user feedback
• Performance optimizations

2.0

• Added Media Library integration
• Implemented batch import functionality
• Improved UI/UX

1.0

• Initial release
• Basic import functionality

For more information about WrkLst, visit wrklst.art