WP Manifestindependent plugin directory

Install

Download portal-builder-0.1.9.zip From the v0.1.9 release on GitHub, Aug 17, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/zachbornheimer/portal-builder/releases/download/v0.1.9/portal-builder-0.1.9.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

DragonGate Portals is a WordPress plugin for building public application forms. Submissions land in Google Sheets and Google Drive — not a WordPress applications inbox.

Created by Z. Bornheimer (ZYSYS). Learn more at allintersections.com or zysys.org

Requirements

  • Requires PHP: 8.0 or higher
  • Requires WordPress: 6.4 or higher (Requires at least: 6.4)

Development

mise is the task entrypoint. Node installs go through aube. PHP deps go through Composer.

mise run setup
mise run test
mise run ci
mise run cut-release          # tag current (or next) semver + zip
CUT_RELEASE_PUSH=1 mise run cut-release

First hour: ZIP install to a first test submit

Every control named below is a label that exists in this plugin.

  1. Download the plugin ZIP from the Releases page.

  2. Upload and install. In WordPress admin, go to Plugins → Add New → Upload Plugin. Choose the ZIP and click Install Now.

  3. Activate. Click Activate to enable DragonGate Portals.

  4. Paste Google API keys. Open Portals → Default Settings. Under Google API Keys:

    • Paste the OAuth client JSON (Desktop or Web client from Google Cloud) into Google Secret Key. This is not a service-account key and not Storage Admin.
    • Paste the access token for the Google identity that completed OAuth consent into Google Access Key. FileStore refreshes this token.
    • Share the destination Drive folder and Sheet with that same Google identity (the person who completed consent), not a service-account email.

    Click Test write with a scratch Sheet ID and Drive folder. A DRAGONGATE_TEST row means credentials work. Delete that row. After a successful test write, the connect-Google checklist dismisses.

    After save, Settings shows Key set plus the last four characters of each Google secret. Leave the box blank to keep the saved value. Paste a new value to rotate.

    The full steps live on Portals → Google API Setup (Google API Setup Instructions).

  5. Add a portal. Open Portals → Add New Portal. The definition wizard opens.

  6. Start. On Start, pick the recommended Basic application template (applicant pack + one text field + one file). Festival examples such as Call for Scores stay available as named templates.

  7. Build form. On Build form, add or edit the fields applicants will fill.

  8. Map dests. On Map data, paste each Google Sheet URL and Drive folder. Name each dest. Map every form field to a dest. Sheet column headers = dest names.

  9. Publish. On Publish, set a deadline if you need one, turn on Accepting submissions, then click Save Portal. The Public form URL appears on this step — use Copy link or View public form.

  10. Send a test submit through the public form. The row and files appear in the mapped Google Sheet and Google Drive folder.

  11. Staff console. Open the portal in the wizard. Below the wizard, Recent submissions and Submission packets list dest outcomes and application ids. An administrator (or a user with the dg_edit_submissions capability) can replace a file; that write goes through the Drive dest adapter. Sheet and Drive remain the packet of record — this is an operator console, not a second store.

  12. Applicant packets. A signed-in applicant sees Your submissions for this portal on the public form. They can Replace file on a current packet (same Drive dest adapter) or Recall it so staff no longer treat it as current.

Anyone-audience portals can require Cloudflare Turnstile (set the site key and secret under Default Settings). Logged-in and members portals skip the widget.

Upgrade by ZIP

GitHub Releases are the update channel. This plugin is not on WordPress.org.

WordPress Dashboard. Open Dashboard → Updates (or Plugins). When a newer stable GitHub Release exists (vMAJOR.MINOR.PATCH with a portal-builder-*.zip asset), DragonGate Portals appears as an update. Click Update now. The install folder is dragongate-portals (the release ZIP unpacks under that name). Legacy folders (portal-builder, portal-builder-0.0.4a) self-relocate on load. Portal posts and _portal_definition stay in the database.

Rolling / prerelease tags are ignored. Manual ZIP replace still works:

  1. Download the new ZIP from the Releases page.

  2. Replace the plugin ZIP. In WordPress admin, go to Plugins → Add New → Upload Plugin. Choose the new ZIP. When WordPress offers to replace the current plugin, accept that. Do not delete the plugin folder or portal posts first.

  3. Activate if WordPress deactivated the plugin during the replace.

Features

  • Definition wizard: Start → Build form → Map data → Publish
  • Google Sheets for answers, Google Drive for files
  • One Public form URL per portal
  • Site-wide defaults under Portals → Default Settings

Development

Contributor path only. Strangers installing from a ZIP should follow First hour.

Requirements

  • PHP 8.0 or higher
  • Composer
  • Node.js (optional, for asset building)

Build Process

  1. Clone the Repository:

    git clone --recurse-submodules https://github.com/zachbornheimer/portal-builder.git
    cd portal-builder
  2. Install Dependencies:

    • For production:
      make install-prod
    • For development:
      make install-dev
  3. Build the Plugin:

    • To create a ZIP file for distribution:
      make release

Makefile Commands

  • make clean: Clean the build and dist directories.
  • make build: Build the plugin and create a ZIP file.
  • make release: Install production dependencies and build the plugin.
  • make install-dev: Install development dependencies.
  • make install-prod: Install production dependencies.
  • make update-submodules: Update all git submodules.

Contributing

We welcome contributions to the DragonGate Portals plugin! Please follow the guidelines below:

  1. Fork the repository.
  2. Create a new branch (git checkout -b feature-branch).
  3. Commit your changes (git commit -am 'Add new feature').
  4. Push to the branch (git push origin feature-branch).
  5. Create a new Pull Request.

Please ensure your code follows the WordPress coding standards and includes appropriate documentation and tests.

License

View portal-builder.php for License information.

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.1.9 latest
Aug 17, 2026 2mo ago
portal-builder-0.1.9.zip
3
Aug 17, 2026 2mo ago
portal-builder-0.1.8.zip
0
Aug 17, 2026 2mo ago
portal-builder-0.1.7.zip
1
Aug 17, 2026 2mo ago
portal-builder-0.1.6.zip
1
Aug 17, 2026 2mo ago
portal-builder-0.1.4.zip
1
Aug 17, 2026 2mo ago
portal-builder-0.1.3.zip
1
Aug 16, 2026 2mo ago
portal-builder-0.1.2.zip
1
Aug 16, 2026 2mo ago
portal-builder-0.1.1.zip
1
Aug 16, 2026 2mo ago
portal-builder-0.1.0.zip
0
Aug 18, 2024 2 years ago
portal-builder-0.0.2a.zip
1
D+ grade

Security

DragonGate Portals 0.1.8 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
0.1.8
Findings
2
Worst severity
high
Content hash
492719e7123c09807ec2fa40…

Findings

  • high Reflected XSS in portal application file review hidden fields

    xss_reflected

    render_portal_application_file_review_block echoes $_POST['eappId'] and $_POST['efiles'] into HTML attribute values without esc_attr. An attacker can break out of the attribute and inject script in the response when this block renders on a crafted POST.

    includes/templates.php:324-325

    Recommendation

    Use esc_attr() (or omit echoing raw POST); prefer server-side staged tokens only.

  • medium Staged file DELETE REST allows unauthenticated deletion by token

    missing_auth

    DELETE /files/{token} uses permission_callback __return_true and forgets the staged file if the token is known. Tokens appear high-entropy, but any leak (Referer, logs) enables unauth deletion of uploads mid-application.

    includes/class-portal-staged-file-rest.php:61-73

    Recommendation

    Require the staging nonce or a capability; bind delete to the same auth as stage_file.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.