|
Description
David Cook
2020-06-04 00:25:00 UTC
Created attachment 106651 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload Looks good, but the default should be to allow plugin uploads to keep in line with current behavior. (In reply to Kyle M Hall from comment #2) > Looks good, but the default should be to allow plugin uploads to keep in > line with current behavior. Agreed. I was thinking about that late last night and early this morning. While enable_plugins is 0 by default, all the in-Koha documentation says they just need to change it to enable_plugins 1. If they did that, and enable_plugin_browser_upload is 0, they won't even know they need to enable it. So I'll do a follow-up to enable it by default. Created attachment 106671 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Created attachment 106673 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Created attachment 106674 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> I like this. We at biblibre have our CLI script one can find there : https://git.biblibre.com/biblibre/tools/src/branch/master/koha/plugin.sh Note that you must flush memcached then reload starman : reload config and then recompile perl (In reply to Fridolin SOMERS from comment #7) > I like this. > > We at biblibre have our CLI script one can find there : > https://git.biblibre.com/biblibre/tools/src/branch/master/koha/plugin.sh > That's cool! You should check out Bug 25671 where I'm writing a CLI tool for Koha. It's actually mostly done I think but I haven't uploaded the code yet, and I've had too many other tasks lately taking my attention. > Note that you must flush memcached then reload starman : reload config and > then recompile perl Mmm I forgot about that. I haven't had to that in my dev environment, but I think Starman might auto redeploy in dev...I should keep that in mind. Created attachment 107172 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 107173 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Works well and adds to plugin system security.. no regressions found, passes the QA scripts and no obvious code issues. Passing QA Created attachment 107174 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Oops. forgot to attach my QA follow-up first time around.. it just hides the install button if you happen to have your system configured for no uploads but still allow searching for plugins via the UI. (In reply to Martin Renvoize from comment #13) > Oops. forgot to attach my QA follow-up first time around.. it just hides the > install button if you happen to have your system configured for no uploads > but still allow searching for plugins via the UI. Firstly, thanks so much for QAing this, Martin! Really appreciated! Secondly, that's an interesting follow-up! I actually intended to let people install plugins from configured Git repos but just disable plugin file upload via their local browser. If I read your patch correctly, they wouldn't be able to do that with the follow-up, right? I don't mind either way, but I wonder if people should be able to search Git repos but not upload files via the browser? We cannot upload but uninstall, is that ok? (In reply to David Cook from comment #14) > (In reply to Martin Renvoize from comment #13) > > Oops. forgot to attach my QA follow-up first time around.. it just hides the > > install button if you happen to have your system configured for no uploads > > but still allow searching for plugins via the UI. > > Firstly, thanks so much for QAing this, Martin! Really appreciated! > > Secondly, that's an interesting follow-up! > > I actually intended to let people install plugins from configured Git repos > but just disable plugin file upload via their local browser. Ah, if that was your intentention, I don't believe it worked. I'm sure I tested it during QA and as expected, it failed at the plugin upload stage so I disabled the button as a follow-up. Hmm, maybe this needs a minor revisit then to clarify the case. (In reply to Jonathan Druart from comment #15) > We cannot upload but uninstall, is that ok? Good catch, we should probably disallow that too here. Removing from the PQA queue regarding the last comments. (In reply to Jonathan Druart from comment #15) > We cannot upload but uninstall, is that ok? That's a good question. I was thinking that it was OK for them to uninstall them, but I suppose that could be annoying for vendors/administrators... But then plugins installed via Github should be able to be deleted. We don't want to remove the "uninstall" option for all plugins just because we're not letting them upload plugins via the browser. But then if we also block Github installs as well as browser upload/install, then that would be a bit of a moot point. (Although at some point I'm planning to create a plugin for managing plugins from external sources. Prosentient could have a plugin for downloading/installing Prosentient approved plugins, Bywater could have a plugin for downloading/installing Bywater approved plugins, etc.) (In reply to Martin Renvoize from comment #16) > Ah, if that was your intentention, I don't believe it worked. I'm sure I > tested it during QA and as expected, it failed at the plugin upload stage so > I disabled the button as a follow-up. Hmm, maybe this needs a minor revisit > then to clarify the case. That's good to know! I thought that I'd tested it, but I was working pretty fast and furious at one stage. I'll have to review it. David, any updates on this? :) (In reply to Joonas Kylmälä from comment #21) > David, any updates on this? :) Ooops. Missed the email notification. While I still have an interest in plugins, we just don't use them enough to justify me working on them during my job hours. And outside my job I have so few hours available and those I'm putting towards authentication/Mojolicious controller things. So I'll abdicate as assignee. This one has been in the back of my mind for a long time, and I thought it was about time it was revisited. (In reply to Martin Renvoize from comment #17) > (In reply to Jonathan Druart from comment #15) > > We cannot upload but uninstall, is that ok? > > Good catch, we should probably disallow that too here. I agree about preventing uninstall as well. I'll add a patch for that. (In reply to Martin Renvoize from comment #16) > Ah, if that was your intentention, I don't believe it worked. I'm sure I > tested it during QA and as expected, it failed at the plugin upload stage so > I disabled the button as a follow-up. Hmm, maybe this needs a minor revisit > then to clarify the case. I've changed my mind on this one. I agree with your QA follow-up. Created attachment 153824 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 153825 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 153826 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 153827 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Due to the amount of time that's passed, I'm resetting this one to "Needs Signoff". Mind if I amend this from 'enable_plugin_browser_upload' to 'restrict_to_plugin_repos'. My thinking is, instead of a simple on/off switch for uploads we set it to only allow uploads from those repositories listed in plugin_repos. Then if none are listed we disable upload entirely, if some are listed the search and install button works nicely or you can just not restrict and get any uploads. I think we could fairly trivially achieve this be looking at the uploadlocation parameter and checking it's content against the organisation part of the plug_repos config variable. Created attachment 153925 [details] [review] Bug 25672: WIP - Convert to restricting to repo only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are) Some work towards what I was suggesting.. let me know what you think.. it's all a bit crude, but until we get some more of the Plugins foundations solid I think it may be the middle ground we can take. Created attachment 154423 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 154424 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 154425 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 154426 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Created attachment 154427 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Comment on attachment 154427 [details] [review] Bug 25672: Convert to restricting to listed repositories only Review of attachment 154427 [details] [review]: ----------------------------------------------------------------- ::: plugins/plugins-upload.pl @@ +48,5 @@ > + $template->param( plugins_restricted => $plugins_restricted ); > +} > + > +# Exit early if uploads are not enabled > +if ( !$ ) { You've got a little typo here with the variable name. But I'm not sure how this would work with the current implementation of "plugins_restricted"? Created attachment 154453 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Good catch, I've fixed that inline in the latest patch. Created attachment 154455 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. All works in testing for me. Created attachment 154464 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 154465 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 154466 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 154467 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 154468 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 154474 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 154475 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 154476 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 154477 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 154478 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Adding my SO and leaving "Signed Off" since I wrote some of these patches. Kyle, should we consider your SO as QA, or do you want to have another look? I would still like a way to prevent "Uninstall" as well for plugins installed via the CLI, but I think that can be its own thing. I'm also less worried about people uninstalling plugins than installing problematic plugins. Created attachment 156715 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 156716 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156717 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156718 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156719 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156720 [details] [review] Bug 25672: (QA follow-up): tidy up code Test plan outdated. It still mentions enable_plugin_browser_upload. <enable_plugin_browser_upload>0</enable_plugin_browser_upload> ↓↓↓ <plugins_restricted>1</plugins_restricted> ---- > 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says > "Plugin browser upload disabled!" and gives instructions on how to enable > browser upload Outdated. The form is here, but upon uploading the kitchen sink plugin I get «Cannot install plugin from unknown source whilst plugins_restricted is enabled.» Beside the divergence with the test plan (so test plan needs to be aligned with current expectations), the form shouldn't be accessible (even via direct URL), right? Like it was in earlier iterations of this ticket IIUC. (then test plan is correct (needs a proofread of the rest, still)) ---- > 9) Enable Koha plugin git repos and search for "coverflow" > 10) Note that you can find the plugin but you cannot install it Turns out I can! > 11) Change enable_plugin_browser_upload back to 1 and "restart_all" > 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos "not" => "now" ? Seem like a typo? ---- - Rebased patches (thanks to applying on an old main/master commit to circumvent the "sha1 information is lacking or useless" error) - added tidy follow-up Yeah this one has evolved over time so the test plan is certainly outdated. Created attachment 156734 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 156735 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156736 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156737 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156738 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 156739 [details] [review] Bug 25672: (QA follow-up): tidy up code Created attachment 156740 [details] [review] Bug 25672: Restore redirect on restricted upload This patch restores the immediate redirect from plugins-upload should uploads be restricted and an uploadlocation not be specified. Amended test plan: 1) Apply the full patchset 2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml 3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml 4) Confirm that the <plugin_repos> block us not commented and contains at least one trusted organisation in koha-conf.xml 5) Run restart_all (in koha-testing-docker) 6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 7) You should however see a search option and upon search you should have results returned from the chosen trusted organisations listed in the <plugin_repos> block mentioned above. 8) Clicking install on one of the results should work as expected and install the plugin. 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin upload is restricted to only those plugins listed by your server administrator" and gives instructions on how to enable unrestricted browser upload. What we lose here compared to the original patches is the restriction on being able to prevent client side installed plugins from being uninstalled. I think that deserves it's own patch (and implementation) on a new bug.. partly to get it's own mention in the release notes and partly as it's a different, but equality important, functionality. Thanks Martin for the follow-up :) > 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says > "Plugin upload is restricted to only those plugins listed by your server > administrator" and gives instructions on how to enable unrestricted browser > upload. oh no, something bad happened! :o https://pic.infini.fr/hqdr0ovW/XWBCYwwa.png Testing notes: ignore the test plan from the 1st path, the valid one is in patch: «Bug 25672: Restore redirect on restricted upload» Created attachment 157730 [details] [review] Bug 25672: Fix double output_html_with_http_headers We weren't exiting after calling output_html_with_http_headers and so we were ending up with a double template render (and also a subsequent confusion in the cookie consent code). Thanks for testing Victor.. well spotted on the weird double template render there. I've added a follow up to handle that case now. Created attachment 157810 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the patch 2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml 3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml 4) restart_all (in koha-testing-docker) 5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin browser upload disabled!" and gives instructions on how to enable browser upload 7) Install a plugin from the CLI using koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl" 8) Note that the Uninstall option for the plugin does not appear 9) Enable Koha plugin git repos and search for "coverflow" 10) Note that you can find the plugin but you cannot install it 11) Change enable_plugin_browser_upload back to 1 and "restart_all" 12) Note that you can not upload plugins, uninstall plugins, and install plugins from Git repos Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157811 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157812 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157813 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157814 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157815 [details] [review] Bug 25672: (QA follow-up): tidy up code Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157816 [details] [review] Bug 25672: Restore redirect on restricted upload This patch restores the immediate redirect from plugins-upload should uploads be restricted and an uploadlocation not be specified. Amended test plan: 1) Apply the full patchset 2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml 3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml 4) Confirm that the <plugin_repos> block us not commented and contains at least one trusted organisation in koha-conf.xml 5) Run restart_all (in koha-testing-docker) 6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 7) You should however see a search option and upon search you should have results returned from the chosen trusted organisations listed in the <plugin_repos> block mentioned above. 8) Clicking install on one of the results should work as expected and install the plugin. 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin upload is restricted to only those plugins listed by your server administrator" and gives instructions on how to enable unrestricted browser upload. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157817 [details] [review] Bug 25672: Fix double output_html_with_http_headers We weren't exiting after calling output_html_with_http_headers and so we were ending up with a double template render (and also a subsequent confusion in the cookie consent code). Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157836 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the full patchset 2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml 3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml 4) Ensure that the <plugin_repos> block is not commented and contains at least one trusted organisation in koha-conf.xml If needed get it from: debian/templates/koha-conf-site.xml.in 5) Run restart_all (in koha-testing-docker) 6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 7) You should however see a search option and upon search you should have results returned from the chosen trusted organisations listed in the <plugin_repos> block mentioned above. 8) Clicking install on one of the results should work as expected and install the plugin. 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin upload is restricted to only those plugins listed by your server administrator" and gives instructions on how to enable unrestricted browser upload. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157837 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157838 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157839 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157840 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157841 [details] [review] Bug 25672: (QA follow-up): tidy up code Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157842 [details] [review] Bug 25672: Restore redirect on restricted upload This patch restores the immediate redirect from plugins-upload should uploads be restricted and an uploadlocation not be specified. Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Created attachment 157843 [details] [review] Bug 25672: Fix double output_html_with_http_headers We weren't exiting after calling output_html_with_http_headers and so we were ending up with a double template render (and also a subsequent confusion in the cookie consent code). Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Ho, mid air collision, I'm fixing that. Created attachment 157846 [details] [review] Bug 25672: use enable_plugin_browser_upload flag to control plugin upload This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which controls whether or not Koha intranet users can upload Koha plugins via their browser. Like "enable_plugins", it defaults to 0 for new installs. This is useful when you want to provide Koha intranet users with plugins that are pre-installed by administrators (by CLI) or restricting them to plugins from a Github repo. See the following for more information: Bug 23975 - Add ability to search and install plugins from GitHub Bug 23191 - Administrators should be able to install plugins from the command line To test: 1) Apply the full patchset 2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml 3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml 4) Ensure that the <plugin_repos> block is not commented and contains at least one trusted organisation in koha-conf.xml If needed get it from: debian/templates/koha-conf-site.xml.in 5) Run restart_all (in koha-testing-docker) 6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see an option to upload plugins 7) You should however see a search option and upon search you should have results returned from the chosen trusted organisations listed in the <plugin_repos> block mentioned above. 8) Clicking install on one of the results should work as expected and install the plugin. 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says "Plugin upload is restricted to only those plugins listed by your server administrator" and gives instructions on how to enable unrestricted browser upload. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157847 [details] [review] Bug 25672: Enable enable_plugin_browser_upload by default This patch enables enable_plugin_browser_upload by default, since the current behaviour for Koha is to enable browser upload when enable_plugins is 1. Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157848 [details] [review] Bug 25672: (QA follow-up) Hide install after search button If plugin upload is disabled, but there are git repositories listed in the config for plugin searching, then you can search for a plugin and attempt to install it. The install leads to an error page. This patch removes the actions column and install button should the enable_browser_upload option be disabled Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157849 [details] [review] Bug 25672: Prevent uninstall when plugin browser upload disabled When plugin browser upload is disabled, also prevent plugin browser uninstall. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157850 [details] [review] Bug 25672: Convert to restricting to listed repositories only I think instead of a plain on/off switch we should use it in combination with the plugin_repo's and set it to restrict to only those repos' (i.e. disable uploads entirely if no repo's are listed, or just allow those repo's when there are). This patch achieves that, but only if plugins are installed via the plugin browser method. We disable all direct upload avenues, so install is blocked for other cases. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157851 [details] [review] Bug 25672: (QA follow-up): tidy up code Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157852 [details] [review] Bug 25672: Restore redirect on restricted upload This patch restores the immediate redirect from plugins-upload should uploads be restricted and an uploadlocation not be specified. Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 157853 [details] [review] Bug 25672: Fix double output_html_with_http_headers We weren't exiting after calling output_html_with_http_headers and so we were ending up with a double template render (and also a subsequent confusion in the cookie consent code). Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Fixed. Compared the diff to ensure there wasn't a difference that might be lost. My tests[1] were meant as a signoff (not having opinions about how plugins should work to meaningfully review) so a previous person having tested would be freed to QA. Like Kyle so it was perfect :) Also, moved the test plan to the 1st patch to replace to outdated one. [1] Also confirmed that having plugins_restricted = 0 to see the upload form and then doing plugins_restricted = 1 before submitting made the actual upload fail. And not just showing the form. Pushed to master for 23.11. Nice work everyone, thanks! Huzzah! I'm stoked to see this one in a stable version :D (In reply to David Cook from comment #101) > Huzzah! I'm stoked to see this one in a stable version :D Well done. Thanks for keeping up with it. Awesome [U+1F60E] No time to rest though, I see lots of further enhancements to the plugin infrastructure around the corner for the next release. I vest get cracking on the follow-up bug to restore the functionality to prevent uninstall friknthe UI for plugins installed via the CLI. I'm also keen to try and get the plugin signing bug moving again and the metadata move one too. (In reply to Martin Renvoize from comment #103) > Awesome [U+1F60E] > > No time to rest though, I see lots of further enhancements to the plugin > infrastructure around the corner for the next release. I vest get cracking > on the follow-up bug to restore the functionality to prevent uninstall > friknthe UI for plugins installed via the CLI. Oh yes that would be good :D > I'm also keen to try and get the plugin signing bug moving again and the > metadata move one too. \o/ Enhancement not pushed to 23.05.x |
