Zotero Plugins Atlas
Plugins / Reading & PDFs

Wandering File

by zhang-dut · github.com/zhang-dut/zotero-file

Zotero 7 Meet ZotFile: Zotero plugin to manage your attachments: automatically rename, move, and attach PDFs (or other files) to Zotero items.

Reading & PDFsFiles, sync & backup
View source
Downloads a .xpi file (0.7 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
30
ContributorsPeople who have committed code to the repository.
5
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
because it downloads a program over unencrypted http and runs it unchecked
Applies to v0.2.8, released 21 Feb 2024Code checked · not yet tested in a live Zotero
Doesn't work with the current Zotero (10)Works with Zotero 7.
Fork of daidaishengweinan/zotero-fileA copy of another listed plugin, changed by someone else.
Another plugin uses the same IDOne other plugin shares this add-on ID. Zotero can only install one of them.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyUpdates are set to come from an address someone else could controlThe developer uploaded the release file from the zhang-dut account. We haven't yet checked whether this file matches the public source code.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Updates
Updates are set to come from muisedestiny/zotero-file on GitHub, which doesn't exist or isn't public: if the owner of "muisedestiny" published an update there, Zotero would install itThe update address is broken (nothing is there), so Zotero can't update it
Where your data goesContacts developers' servers: www.zotfile.com and zotfile.com3 addresses in 2 groups.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Developer's servers (2)
www.zotfile.comzotfile.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Zotero (1)
Zotero lookup services
Where we found it
www.zotfile.comchrome/content/zotfile/options.js · line 809
var download = Downloads.createDownload({ source: url, target: file });
Powerful capabilitiesDownloads a program over unencrypted http and runs it unchecked, and 5 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Downloads a program over unencrypted http and runs it uncheckedhighHigh concern: a serious problem.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Launches programs on your computermediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Works with files on your computerlowLow concern.
Where we found it
Downloads a program over unencrypted http and runs it uncheckedchrome/content/zotfile/options.js · line 809

A button in its settings (Intel Macs only) downloads ZotFile's Poppler tool from zotfile.com over unencrypted http and runs it without any check, so someone on your network could swap in their own program. The file is no longer on the server, so today the button fails.

var download = Downloads.createDownload({ source: url, target: file });
A zotero:// link (a web page can open one) can make it install add-o…chrome/content/scripts/zoterofile.js · line 190

zotero://plugin

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptchrome/content/scripts/zoterofile.js · line 124

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Launches programs on your computerchrome/content/zotfile/options.js · line 816

Programs it names include unzip

"@mozilla.org/process/util;1"
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7 · not 9, 10, 11 betaDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Zotero 7 ✓ worksZotero 9 ✗ doesn't workZotero 10 ✗ doesn't workZotero 11 beta ✗ doesn't work
What you'll needZotero 7Detected automatically from its code
No further detail for this area yet.
MaintenanceDormant · last release 21 Feb 20245 contributors
No further detail for this area yet.
LanguagesDocumentation language not detectedInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.

What you'll need

Detected automatically
  • Zotero 7Not working with Zotero 10

Where your data goes

We found: contacts developers' servers: www.zotfile.com and zotfile.com. 3 addresses in 2 groups.

Developer's servers (2)
www.zotfile.comzotfile.comnamed in its code
Zotero (1)
Zotero lookup services
Evidence · file and line
www.zotfile.comchrome/content/zotfile/options.js · line 809
var download = Downloads.createDownload({ source: url, target: file });

Forks and alternatives

Fork of daidaishengweinan/zotero-file.

1 other plugin uses the same ID as this one. Every Zotero plugin carries an ID, a name tag Zotero uses to tell plugins apart. These 2 plugins carry the same one, because people copied Wandering File to make their own versions and kept its ID.Show what this means
  • You can only have one. Zotero sees them as the same plugin.
  • Installing another replaces it. If you install one of the others, it takes this one's place.
  • Check what you install. Several share this plugin's name, so make sure the file comes from the one you meant.
Wandering File · this pluginzhang-dut/zotero-fileCNot recommended3021 Feb 2024
Wandering FileCopy · sigmoid-bar/zotero-fileCNot recommended1317 Nov 2023
See all 2 and how they differ →

No forks listed.

Plugins for the same job
  • NoteroReading & PDFs · Files, sync & backupA+Recommended, tested in Zotero
  • ZotMoovOrganising & tags · Files, sync & backupA+Recommended, tested in Zotero
  • Bionic for ZoteroReading & PDFsA+Recommended, tested in Zotero
  • Attachment ScannerOrganising & tags · Files, sync & backupA+Recommended, tested in Zotero

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Install Wandering File
CNot recommended
We don't recommend itIt downloads a program over unencrypted http and runs it unchecked.
Better-graded plugins for the same jobA+NoteroA+ZotMoovA+Bionic for Zotero
Read what we found