Show notice if plugin update path does not exist any more

[discobot]

in local plugin/theme listing e.g. if plugin/theme is removed from repository or external update-source is not reachable. Maybe dismissable for ‘a week, month, forever’ or similar.

---

Read-only archive: Issues · ClassicPress/ClassicPress · GitHub

Author: Dora D.

Vote count: 8

Status: open

Tags:

• request-modify-feature

---

Comments

That is an awesome idea indeed. Having at least two plugins which have been closed down or are not available for download anymore, which are giving me major headaches on how to avoid the situation of accidential clicking “update now” out of habit - and then bang! boom! bang! installation broken and have maybe to do all changes this day again, because the latest backup is from the day before.

~ posted by Fabian Wolf

Very good idea. And plugins are removed from the repository for good reason.

~ posted by Avrom

I like this idea on paper, but not so much in practice. I think this could lead to security issues. For example, say an ambitious hacker installed every last plugin in the repo across a network of “monitoring” sites. All they have to do is wait for notices to come up in the dashboard indicating that an update path is no longer available, which is sometimes an indicator that a plugin was removed for security reasons. These notices could direct hackers straight to vulnerable plugins.

~ posted by Mike

I can see Mike’s point regarding security, but i think it’s probably worse for admins to never realise a plugin was removed from the repository as it gives hackers plenty of time to exploit the site.

Take a look at Postman SMTP (Postman SMTP Mailer/Email Log – WordPress plugin | WordPress.org) for example. It was closed months ago and it still has 100k+ installations, even though a direct replacement (fork) exists (POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress – WordPress plugin | WordPress.org)

A hacker can already monitor the whole WP repository quite easily using scripts and identify which plugins get removed.

To me, it would make even more sense for CP to also send an email to the admin user asking them to replace/deactivate the plugin immediately. It’s then up to the admins if they’ll do this or risk their site.

~ posted by George L.

[anon71687268]

@fwolf

Having at least two plugins which have been closed down or are not available for download anymore, which are giving me major headaches on how to avoid the situation of accidential clicking “update now” out of habit - and then bang! boom! bang! installation broken and have maybe to do all changes this day again, because the latest backup is from the day before.

@fwolf, In that case, you can bump the plugin’s version number (in the main PHP file) to some high number and it will never again find an update.