Pure Demo Importer
| 开发者 | themepure |
|---|---|
| 更新时间 | 2026年9月23日 21:57 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Pure Demo Importer adds a Demo Importer admin page to any WordPress theme that registers itself with the plugin. It can:
- Export the current site's content (content.xml WXR), widgets (widgets.wie) and customizer settings (customizer.dat) into a single ZIP.
- Import any of the above on a fresh WordPress install, with auto-install and activation of required plugins from the WordPress.org repo.
- Show a live system-requirements check before import with copy-paste fix instructions.
- Optionally reset the site (delete posts/widgets/customizer mods) before importing.
pure_demo_importer_register action — see "Registering demos" below.
安装:
- Upload the
pure-demo-importerfolder to/wp-content/plugins/. - Activate "Pure Demo Importer" from the Plugins screen.
- From your theme's
functions.php(or a core plugin's bootstrap), hook thepure_demo_importer_registeraction and callThemePure_Demo_Importer::register()with your config. See the "Registering demos" section for a full example.
常见问题:
The plugin says "No demos configured" — what now?
Either your theme/core plugin hasn't called ThemePure_Demo_Importer::register(), or it called it with an empty demos array. See the "Registering demos" section above for the correct hook + call pattern. If you want to populate demos via filter only (no register() array), use the {theme_slug}_demo_importer_demos filter described above.
Will reset delete my Pure Demo Importer plugin?
No. The reset always preserves Pure Demo Importer itself — deactivating the plugin running the reset would terminate the request mid-flight. Use the themepure_di_reset_preserve_plugins filter to preserve additional plugins.
Does this work without the WordPress Importer plugin installed?
Yes. Pure Demo Importer vendors the full WordPress Importer plugin internally at vendor/wordpress-importer/. There is no runtime dependency on the upstream plugin being installed.
Where is the import log?
wp-content/uploads/themepure-di-logs-{random}/import.log — rotated at ~2 MB. Disable with add_filter( 'themepure_di_logging_enabled', '__return_false' );.
更新日志:
1.0.12
- Security: removed the SQL-pack import/export subsystem. It executed statements from a downloaded
.sqldump verbatim, which is an arbitrary-SQL path and has no place in a WordPress.org release. Normal WXR / widgets / customizer importing is unchanged. - Security: removed the bundled regex-based SVG "sanitizer" and stopped allowlisting
svg/svgzor forcing a MIME type from the filename. SVG in demo content is now refused during import unless a proven sanitizer library (enshrined/svg-sanitize, as bundled by Safe SVG) is installed. - Security: all XML now loads through a single hardened path —
LIBXML_NONET, no entity substitution, DOCTYPE refused, document size capped, libxml error state always restored. The deprecatedlibxmlentity-loader toggle is gone. - Security:
WP_Import::import()can no longer read arbitrary fields from the original request.$_POSTis replaced with a minimal allowlisted array for the duration of the call and restored in afinallyblock, along with filters, deferred counting, cache invalidation and output buffers. - Security: every outbound download now goes through one safe downloader — http/https only, loopback / private / link-local / unique-local blocked for IPv4 and IPv6, every redirect hop revalidated, redirect and response-size caps, partial files cleaned up on failure.
- Security: the selective-reset payload is now limited by byte size and nesting depth before decoding.
- Security: private upload directories are now named with a per-site random suffix and protected with Apache 2.4-compatible rules, a
web.configand anindex.phpstub, instead of Apache-2.2-only.htaccesssyntax that could 500 a directory on Apache 2.4. - Removed all
set_time_limit()andmemory_limitini_set()calls. Imports rely on bounded AJAX chunks; memory headroom is requested once via WordPress's ownwp_raise_memory_limit( 'admin' ). - Fixed a PHP 8.4 implicit-nullable parameter deprecation.
- Removed the
tools/build-sql-pack.phpdeveloper script from the distributed package.
- Recommended-plugin installs are now resolved exclusively from the WordPress.org Plugin Directory — no other source (remote or local) is ever used.
- Initial release.
- AJAX queue-driven import with progress UI.
- Single-shot and chunked WXR import paths.
- Vendored WordPress Importer (no runtime dependency on the upstream plugin).
- Widgets, customizer, metafields, Elementor kit, URL replacement steps.
- Reset site with self-preservation + filterable preserve-list.
- Auto page reload after successful reset.