| 开发者 |
mantrabrain
ughimire1 MantraBrain gangadharkashyap |
|---|---|
| 更新时间 | 2026年8月21日 18:18 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
sikshya text domain); RTL-friendly layouts are a continuous improvement target—report theme-specific gaps via support.sikshya folder to wp-content/plugins/.A learning management system is software that hosts your lessons, tracks who finished what, and often handles enrollment or payment—so you are not emailing PDFs and spreadsheets by hand.
Yes. This plugin ships a full free core for building courses, enrolling learners, running quizzes, and selling with baseline checkout features. Advanced modules and priority support are available with Sikshya Pro.
No for day-to-day course building. Developers can still extend Sikshya using WordPress hooks, filters, and documented REST endpoints.
It is designed for broad theme compatibility. If layouts clash, test with a default WordPress theme to separate theme CSS from LMS templates.
Yes. Use the native Sikshya blocks (Courses, Login, Registration) or legacy Shortcode blocks with [sikshya_courses], [sikshya_login], and [sikshya_registration] — settings and output match. Sikshya course pages and learner templates work alongside block-based pages and standard WordPress themes.
Yes. Sikshya’s output is standard WordPress templates and shortcodes, so it composes cleanly with Elementor, Divi, Beaver Builder, Bricks, and Oxygen. Drop the Sikshya shortcodes ([sikshya_courses], [sikshya_login], [sikshya_registration]) into any builder widget that renders shortcodes; the rest of your course / lesson / quiz templates render through Sikshya’s own template layer, which respects your theme’s typography and color tokens.
Sikshya stores courses, lessons, and quizzes as standard custom post types, which makes structured imports possible with tools such as WP All Import or with a small migration script targeting the Sikshya REST endpoints. Migrating learner progress (completion history, scores) typically requires a custom mapping — open a support ticket if you’re planning a large migration and want a template script to start from.
Yes. The course catalog, course pages, learner dashboard, quiz player, and learn-page chrome are designed mobile-first with sticky learn-page headers, tap-friendly touch targets (44×44 minimum), keyboard-accessible quiz controls, and ARIA semantics that work with screen readers. Tested on iOS Safari, Android Chrome, and modern WebView contexts.
Sikshya stores only the learner data you choose to collect (account, enrollments, progress, orders) on your WordPress install — nothing is shipped to third-party servers by Sikshya itself. Personal-data export and erasure hooks for WP’s built-in privacy tools are supported, so subject-access and right-to-erasure requests flow through the standard WP Tools → Export/Erase Personal Data screens. Any payment, video, or analytics service you configure has its own privacy obligations — see the Use of third-party services section above.
Create a paid course, set the price, connect Stripe and/or PayPal under Sikshya payment settings, and run a test transaction before accepting live payments.
The free core emphasizes native-style course checkout for speed and clarity. Deeper cart and membership integrations may appear in Pro or via future integrations—check the product page for the current roadmap.
Recurring subscriptions and advanced membership rules are part of the Sikshya Pro positioning. The free tier focuses on strong one-time (and free-course) selling.
Yes, the plugin is flagged for network use. Always verify instructor/student capabilities and data isolation per subsite in staging.
Official guides live on Mantrabrain: Sikshya LMS documentation covers installation, privacy & optional usage tracking, and links to deeper help as the knowledge base grows.
Yes. Sikshya runs entirely inside your own WordPress installation (self-hosted). You are not required to use a separate hosted LMS service to deliver courses, track progress, or process payments you configure (for example Stripe or PayPal).
Yes. Strings use the sikshya text domain and are compatible with Loco Translate, WPML, TranslatePress, and similar workflows.
Use Contact support for account or technical issues, and join the Sikshya LMS Facebook Community for peer discussion and best practices.
Email at mantrabrain@gmail.com with details (do not post exploit steps in public reviews). You may also use the vendor contact page on the product site for coordinated disclosure.
Sikshya (this plugin) is the free foundation. Sikshya Pro is a separate commercial add-on that unlocks advanced features and service levels.
Sikshya outputs normal WordPress pages and URLs. Use clear course titles, excerpts, and internal links from your homepage or blog—same good habits as any WordPress site. Pair with your preferred SEO plugin for meta titles and sitemaps.
Sikshya registers the shortcodes below. Paste them into any page, post, or widget that runs WordPress shortcodes (Shortcode block, Classic editor, or a theme template that calls do_shortcode). Attribute names are lowercase unless noted.
Quick reference
[sikshya_courses]) — Grid or list of published courses (same card UI as the catalog).[sikshya_login]) — Sign-in form (Sikshya auth handler; errors stay on the same page).[sikshya_registration]) — Create a Sikshya student account; optional instructor intent submits a pending teaching application.[sikshya_courses]
What it does: Queries published courses and renders them with the same course card partial used on archives and the catalog.
Attributes (all optional except where a default is listed):
per_page — Number of courses per page. Default 9. Minimum 1, maximum 50.columns — Layout hint. 3 forces a three-column grid; other positive values (up to 6) adjust the auto grid; 0 or omitted uses the default auto layout.view — grid or list. Default grid.category — Filter by course category taxonomy slug (not the numeric ID).tag — Filter by course tag taxonomy slug.search — Free-text search string (same idea as the catalog search).orderby — date, title, or price. Default date.order — asc or desc. Default desc.pagination — 1 (show paging) or 0 (single page). Default 1. When enabled, page links use the query argument sikshya_courses_page so paging does not clash with the main query.[sikshya_courses]
[sikshya_courses per_page="12" view="grid" category="web-design" orderby="price" order="asc" pagination="1"]
[sikshya_courses view="list" search="wordpress" pagination="0"]
[sikshya_login]
What it does: Renders an email-or-username + password form that authenticates through Sikshya’s admin-post handler (wp_signon). Failed logins show a notice on the same URL (no redirect to wp-login.php). Used on the virtual login page and inside checkout.
Attributes:
redirect_to — Absolute or relative URL after successful login. Validated with wp_validate_redirect. If empty, the handler falls back to the HTTP referer, then the site home URL.[sikshya_login]
[sikshya_login redirect_to="/my-account/"]
[sikshya_login redirect_to="https://example.com/checkout/"]
[sikshya_registration]
What it does: Renders a registration form (display name optional, email, password). Creates a WordPress user with the Sikshya student role, then triggers the same new-user email notifications WordPress sends after core registration (wp_send_new_user_notifications, admin + user). Intended for checkout (“Create account”) and custom landing pages.
Attributes:
type — student or instructor. Default student. instructor does not assign the instructor role: the account is a student and a pending instructor application is recorded (same meta as the account “Apply to teach” flow). An administrator approves applications in the dashboard; only then is the sikshya_instructor role added.redirect_to — Same behavior as [sikshya_login] after successful registration.sikshya_send_new_user_notifications (bool, user ID) to disable core emails if you replace them with your own.
Examples
[sikshya_registration]
[sikshya_registration type="student"]
[sikshya_registration type="instructor" redirect_to="/courses/"]
Requires at least: 6.0 and Requires PHP: 7.4 are unchanged, so this update applies to every site already running 1.0.6.load_plugin_textdomain() is now deferred to the init action instead of running while the plugin file is being included. WordPress 6.7+ expects translations to be loaded no earlier than init, and calling it from the bootstrap is the pattern that trips the _load_textdomain_just_in_time notice. Nothing in the load path translated that early, so this is a hardening change rather than a fix for a notice anyone was seeing.permission_callback./sikshya/v1/lessons, /sikshya/v1/quizzes, or /sikshya/v1/courses REST routes from an external client should re-check their integration (see below).
REST auth (fixes information disclosure and paywall bypass)
GET /sikshya/v1/lessons and GET /sikshya/v1/lessons/{id} now require the same canManageLessons capability as the write side. Previously anyone could fetch a lesson's full post_content + every _sikshya_* meta key — this was a paywall bypass for paid courses. Learner consumption goes through /me/quiz-attempt (unaffected — still enforces enrollment).GET /sikshya/v1/quizzes and GET /sikshya/v1/quizzes/{id} now require canManageQuizzes. Previously exposed the ordered question ID list, passing score, time limit, and attempt cap to any client — assessment enumeration for competitors and cheat-sheet builders.GET /sikshya/v1/courses and GET /sikshya/v1/courses/{id} stay public for catalog use, but the returned meta is now built from an explicit allowlist (sikshya_course_price, sikshya_course_duration, sikshya_course_level) instead of dumping every meta key — no more leaking _edit_lock, unpublished sale schedules, AI-generation flags, or third-party plugin meta.
Cross-site request / race conditions
POST /sikshya/v1/me/enroll now enforces post_type === sikshya_course + post_status === 'publish' before any pricing/addon logic. Previously, a draft or private course whose price meta was zero (or cleared) could be self-enrolled via ID enumeration.
SELECT … FOR UPDATE on the redemption rows). Previously two parallel checkouts of a per_user_limit = 1 coupon could both pass the initial count check, both insert redemptions, both discount their orders. A lost race now returns a clean "already used" error with the coupon's used_count rolled back.SocialLogin OAuth state token is now bound to the initiating browser via an HTTPOnly SameSite=Lax cookie and verified with hash_equals on callback. Prevents an attacker from minting a state on their machine and smuggling the callback URL to a victim.EnrollmentRepository list methods (findAll, findByUser, findByCourse, findByStatus, searchWithFilters) now route orderby/order/limit/offset through a shared column-whitelist normaliser. No live SQLi existed (callers pass hardcoded values), but the shape was a trap for future callers.
Web-register flow
POST /sikshya/v1/auth/web-register now records the rate-limit attempt on entry instead of after wp_create_user succeeds. Previously the first attacker in a rate-limit bucket got a full free registration + auth cookie before the limiter engaged.
rejected / suspended / active status. Applicants whose application was terminally decided must be re-considered by an admin — they can't reset themselves to pending by re-submitting the form.
XSS / output escaping
title.rendered into dangerouslySetInnerHTML. Any Author-level user could store XSS in a post title that then executed in the admin's session on list-page view; both sites now render titles as text via a new decodeWpTitle helper.
innerHTML. Prevents stored XSS via admin-configurable checkout fields.
Notes for integrators
GET /sikshya/v1/lessons or /quizzes anonymously, it will now receive 401. Authenticate the client with a REST cookie / JWT / application password held by a user with the appropriate capability, or switch to the curated PublicApiRoutes for public consumption.
composer/installers moved from require to require-dev — it's a Composer build-time plugin, not a runtime dependency, so it had no business shipping to customer sites. The runtime require list is now just PHP 7.4+ and firebase/php-jwt ^6.10 — the bare minimum the plugin actually uses at runtime.build.sh already ran composer install --no-dev --optimize-autoloader before zipping, but the working tree now also reflects production-only deps; a fresh checkout's vendor/ weighs in at ~716 KB instead of the previous 78 MB.mantrabrain.com/plugins/sikshya-lms/ are now deep-linked (Free Course Builder, Video & Text Lessons, Quizzes, Course Certificates, Native Checkout + 31 Pro add-ons), each with feature-specific UTM campaign so analytics attribute click-throughs back to the originating section.docs.mantrabrain.com/sikshya-wordpress-plugin/ to sikshya.mantrabrain.com/docs/; product page URL aligned with /plugins/sikshya-lms/ and "Explore Pro" + "Pricing & plans" CTAs route directly to /pricing/.firebase/php-jwt ^6.10 has a low-severity advisory (CVE-2025-45769, "weak encryption"). The fix requires a major bump to v7.x — slated for the next release after we verify the API delta against JwtAuthService.POST /sikshya/v1/me/quiz-save endpoint and auto_save_data column — a refresh no longer wipes 30 minutes of work. Hydrates on resume._sikshya_lesson_transcript_url and _sikshya_lesson_transcript_text meta with admin UI in the React lesson editor and a calm <details> disclosure beside video / audio players._sikshya_question_explanation meta surfaced as a "Why?" disclosure after grading on the Review answers view.sikshya_learn_course_completion_cta action above the tabs strip for Pro Certificates Advanced to slot a celebratory card.role="tab", aria-controls, aria-selected, tabindex, role="tabpanel", aria-labelledby, hidden mirrored on lesson + quiz templates.display: contents on the wrapping section (the section was zero-height on the lesson page, killing sticky's pin range).
overflow: hidden removed so it stops being clipped behind content.
SCHEMA_VERSION bumped 1.9.0 → 1.10.0 with idempotent migration adding auto_save_data to sikshya_quiz_attempts.
admin_init (handles drop-in deploys without re-activation).sikshya_course_completed action gains an optional 3rd $enrollment_id arg (additive — existing 2-arg listeners unaffected).display: contents mobile-sticky pattern: cleaner than absolutely-positioned shims and respects the document scroll model.
Hardening sprint (carry-over from internal audit)
AUDIT_REGRESSION_TESTS.md for the full ledger.
https://sikshya.mantrabrain.com/docs/.CheckoutDynamicFieldsView and refactored checkout helpers (dfBindDynamicFields, dfSyncValuesFromHost).