10% owasp-user-location-check

Code Review | OWASP User Location Check

WordPress plugin OWASP User Location Check scored10%from 54 tests.

About plugin

  • Plugin page: owasp-user-locati...
  • Plugin version: 1.1
  • PHP version: 7.4.16
  • WordPress compatibility: 3.0.1-5.7
  • WordPress version: 6.3.1
  • First release: Jan 4, 2016
  • Latest release: Apr 7, 2021
  • Number of updates: 19
  • Update frequency: every 101.3 days
  • Top authors: Off Site Services (100%)

Code review

54 tests

User reviews

1 review

Install metrics

10+ active /813 total downloads

Benchmarks

Plugin footprint 58% from 16 tests

Installer 0% from 1 test

🔺 Critical test (weight: 50) | It is important to correctly install your plugin, without throwing errors or notices
The following installer errors require your attention
  • Install procedure validation failed for this plugin
    • > User deprecated in wp-includes/functions.php+5747
    Function add_option was called with an argument that is deprecated since version 2.3.0 with no alternative available.

Server metrics [RAM: ▲0.04MB] [CPU: ▼3.58ms] Passed 4 tests

Server-side resources used by OWASP User Location Check
Normal server usage
PageMemory (MB)CPU Time (ms)
Home /3.50 ▲0.0441.04 ▼2.50
Dashboard /wp-admin3.35 ▲0.0448.04 ▼1.13
Posts /wp-admin/edit.php3.40 ▲0.0447.74 ▼2.57
Add New Post /wp-admin/post-new.php5.93 ▲0.0491.00 ▼8.11
Media Library /wp-admin/upload.php3.27 ▲0.0438.51 ▲2.79
OWASP /wp-admin/options-general.php?page=owasp3.2433.85

Server storage [IO: ▲0.02MB] [DB: ▲0.00MB] Passed 3 tests

A short overview of filesystem and database impact
This plugin was installed successfully
Filesystem: 5 new files
Database: 2 new tables, 8 new options
New tables
wp_owasp
wp_owasp_black
New WordPress options
widget_recent-posts
widget_recent-comments
db_upgraded
widget_theysaidso_widget
time_owasp
theysaidso_admin_options
can_compress_scripts
email_owasp

Browser metrics Passed 4 tests

An overview of browser requirements for OWASP User Location Check
This plugin renders optimally with no browser resource issues detected
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,793 ▲3214.69 ▲0.271.70 ▼0.0840.97 ▼3.90
Dashboard /wp-admin2,202 ▲225.59 ▲0.0586.04 ▼4.3238.85 ▼3.73
Posts /wp-admin/edit.php2,104 ▲12.00 ▼0.0237.89 ▼3.4831.64 ▼4.61
Add New Post /wp-admin/post-new.php1,529 ▲123.54 ▲0.60617.30 ▼31.5154.66 ▲3.32
Media Library /wp-admin/upload.php1,407 ▲104.23 ▲0.03101.27 ▼3.9148.09 ▲6.10
OWASP /wp-admin/options-general.php?page=owasp9301.9924.9926.96

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 75% from 4 tests

🔸 Tests weight: 35 | The uninstall procedure must remove all plugin files and extra database tables
These items require your attention
  • This plugin did not uninstall successfully, leaving 6 options in the database
    • theysaidso_admin_options
    • widget_recent-posts
    • widget_theysaidso_widget
    • widget_recent-comments
    • db_upgraded
    • can_compress_scripts

Smoke tests 75% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | A smoke test targeting server-side errors
Good news, no errors were detected

SRP 50% from 2 tests

🔹 Tests weight: 20 | It is important to ensure that your PHP files perform no action when accessed directly, respecting the single-responsibility principle
Almost there! Just fix the following items
  • 5× PHP files trigger errors when accessed directly with GET requests:
    • > PHP Notice
      Undefined variable: ip in wp-content/plugins/owasp-user-location-check/includes/addIP.php on line 15
    • > PHP Fatal error
      Uncaught Error: Call to undefined function owasp_time() in wp-content/plugins/owasp-user-location-check/includes/mainSettings.php:13
    • > PHP Notice
      Undefined variable: title in wp-content/plugins/owasp-user-location-check/includes/addIP.php on line 10
    • > PHP Fatal error
      Uncaught Error: Call to undefined function register_activation_hook() in wp-content/plugins/owasp-user-location-check/checker.php:42
    • > PHP Fatal error
      Uncaught Error: Call to undefined function submit_button() in wp-content/plugins/owasp-user-location-check/includes/addIP.php:17

User-side errors Passed 1 test

🔹 Test weight: 20 | This is just a short smoke test looking for browser issues
No browser errors were detected

Optimizations

Plugin configuration 93% from 29 tests

readme.txt Passed 16 tests

Often overlooked, readme.txt is one of the most important files in your plugin
8 plugin tags: user country check, owasp login validation, user location check, security, change user location...

owasp-user-location-check/checker.php 85% from 13 tests

The main PHP file in "OWASP User Location Check" ver. 1.1 adds more information about the plugin and also serves as the entry point for this plugin
Please make the necessary changes and fix the following:
  • Description: Please don't use more than 140 characters for the plugin description (currently 143 characters long)
  • Main file name: Please rename the main PHP file in this plugin to the plugin slug ("owasp-user-location-check.php" instead of "checker.php")

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | Executable files are not allowed as they can serve as attack vectors
There were no executable files found in this plugin338 lines of code in 4 files:
LanguageFilesBlank linesComment linesLines of code
PHP47141338

PHP code Passed 2 tests

An overview of cyclomatic complexity and code structure
Great job! No cyclomatic complexity issues were detected in this plugin
Cyclomatic complexity
Average complexity per logical line of code0.32
Average class complexity0.00
▷ Minimum class complexity0.00
▷ Maximum class complexity0.00
Average method complexity0.00
▷ Minimum method complexity0.00
▷ Maximum method complexity0.00
Code structure
Namespaces0
Interfaces0
Traits0
Classes0
▷ Abstract classes00.00%
▷ Concrete classes00.00%
▷ Final classes00.00%
Methods0
▷ Static methods00.00%
▷ Public methods00.00%
▷ Protected methods00.00%
▷ Private methods00.00%
Functions17
▷ Named functions17100.00%
▷ Anonymous functions00.00%
Constants0
▷ Global constants00.00%
▷ Class constants00.00%
▷ Public constants00.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

All PNG images should be compressed to minimize bandwidth usage for end users
PNG images were not found in this plugin