Bug 25672 - Administrators should be able to restrict client-side plugin upload to trusted sources
Summary: Administrators should be able to restrict client-side plugin upload to truste...
Status: Needs documenting
Alias: None
Product: Koha
Classification: Unclassified
Component: Plugin architecture (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: David Cook
QA Contact: Kyle M Hall
URL:
Keywords: rel_23_11_candidate
Depends on:
Blocks: 25370 35011
  Show dependency treegraph
 
Reported: 2020-06-04 00:25 UTC by David Cook
Modified: 2023-12-14 15:32 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00


Attachments
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.15 KB, patch)
2020-07-08 12:00 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.84 KB, patch)
2020-07-08 23:08 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.17 KB, patch)
2020-07-09 07:15 UTC, Nicolas Legrand
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.88 KB, patch)
2020-07-09 07:15 UTC, Nicolas Legrand
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.22 KB, patch)
2020-07-22 08:05 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.96 KB, patch)
2020-07-22 08:05 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.27 KB, patch)
2020-07-22 08:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.33 KB, patch)
2023-07-24 06:21 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.93 KB, patch)
2023-07-24 06:21 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.29 KB, patch)
2023-07-24 06:21 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.58 KB, patch)
2023-07-24 06:21 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: WIP - Convert to restricting to repo only (4.96 KB, patch)
2023-07-26 14:35 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.33 KB, patch)
2023-08-15 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.93 KB, patch)
2023-08-15 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.29 KB, patch)
2023-08-15 11:45 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.58 KB, patch)
2023-08-15 11:45 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.25 KB, patch)
2023-08-15 11:45 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.25 KB, patch)
2023-08-16 08:35 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.68 KB, patch)
2023-08-16 09:10 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.39 KB, patch)
2023-08-16 11:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (1.99 KB, patch)
2023-08-16 11:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.35 KB, patch)
2023-08-16 11:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.63 KB, patch)
2023-08-16 11:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.73 KB, patch)
2023-08-16 11:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.43 KB, patch)
2023-08-17 00:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.04 KB, patch)
2023-08-17 00:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.40 KB, patch)
2023-08-17 00:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.68 KB, patch)
2023-08-17 00:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.77 KB, patch)
2023-08-17 00:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.49 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.04 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.40 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.68 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.77 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up): tidy up code (1.23 KB, patch)
2023-10-09 01:55 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.50 KB, patch)
2023-10-09 11:43 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.04 KB, patch)
2023-10-09 11:43 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.40 KB, patch)
2023-10-09 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.69 KB, patch)
2023-10-09 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.80 KB, patch)
2023-10-09 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: (QA follow-up): tidy up code (1.23 KB, patch)
2023-10-09 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Restore redirect on restricted upload (8.76 KB, patch)
2023-10-09 11:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: Fix double output_html_with_http_headers (2.17 KB, patch)
2023-10-24 09:51 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.55 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.09 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.46 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.74 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.84 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: (QA follow-up): tidy up code (1.29 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Restore redirect on restricted upload (8.80 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: Fix double output_html_with_http_headers (2.23 KB, patch)
2023-10-25 15:28 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.64 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.09 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.46 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.74 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.83 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up): tidy up code (1.29 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Restore redirect on restricted upload (7.84 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Fix double output_html_with_http_headers (2.23 KB, patch)
2023-10-25 16:25 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload (7.70 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Enable enable_plugin_browser_upload by default (2.15 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up) Hide install after search button (2.51 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Prevent uninstall when plugin browser upload disabled (2.79 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Convert to restricting to listed repositories only (14.88 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: (QA follow-up): tidy up code (1.34 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Restore redirect on restricted upload (7.89 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25672: Fix double output_html_with_http_headers (2.28 KB, patch)
2023-10-25 16:35 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-06-04 00:25:00 UTC
Administrators should be able to prevent Koha web users from uploading/installing/uninstalling Koha plugins, and instead allow uploading/installing/uninstalling Koha plugins on the server-side from the CLI.

This would allow Koha web users to "use" plugins, but it would require plugins to be vetted and managed by a server sysadmin. 

This should improve stability and maintainability.
Comment 1 David Cook 2020-07-08 12:00:27 UTC
Created attachment 106651 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
Comment 2 Kyle M Hall 2020-07-08 12:09:33 UTC
Looks good, but the default should be to allow plugin uploads to keep in line with current behavior.
Comment 3 David Cook 2020-07-08 23:05:03 UTC
(In reply to Kyle M Hall from comment #2)
> Looks good, but the default should be to allow plugin uploads to keep in
> line with current behavior.

Agreed. I was thinking about that late last night and early this morning. While enable_plugins is 0 by default, all the in-Koha documentation says they just need to change it to enable_plugins 1. If they did that, and enable_plugin_browser_upload is 0, they won't even know they need to enable it.

So I'll do a follow-up to enable it by default.
Comment 4 David Cook 2020-07-08 23:08:53 UTC
Created attachment 106671 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.
Comment 5 Nicolas Legrand 2020-07-09 07:15:39 UTC
Created attachment 106673 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Comment 6 Nicolas Legrand 2020-07-09 07:15:42 UTC
Created attachment 106674 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Comment 7 Fridolin Somers 2020-07-20 15:33:41 UTC
I like this.

We at biblibre have our CLI script one can find there :
https://git.biblibre.com/biblibre/tools/src/branch/master/koha/plugin.sh

Note that you must flush memcached then reload starman : reload config and then recompile perl
Comment 8 David Cook 2020-07-21 06:59:56 UTC
(In reply to Fridolin SOMERS from comment #7)
> I like this.
> 
> We at biblibre have our CLI script one can find there :
> https://git.biblibre.com/biblibre/tools/src/branch/master/koha/plugin.sh
> 

That's cool! You should check out Bug 25671 where I'm writing a CLI tool for Koha. It's actually mostly done I think but I haven't uploaded the code yet, and I've had too many other tasks lately taking my attention. 

> Note that you must flush memcached then reload starman : reload config and
> then recompile perl

Mmm I forgot about that. I haven't had to that in my dev environment, but I think Starman might auto redeploy in dev...I should keep that in mind.
Comment 9 Martin Renvoize 2020-07-22 08:05:13 UTC
Created attachment 107172 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2020-07-22 08:05:17 UTC
Created attachment 107173 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Martin Renvoize 2020-07-22 08:06:04 UTC
Works well and adds to plugin system security.. no regressions found, passes the QA scripts and no obvious code issues.

Passing QA
Comment 12 Martin Renvoize 2020-07-22 08:12:23 UTC
Created attachment 107174 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 13 Martin Renvoize 2020-07-22 08:13:20 UTC
Oops. forgot to attach my QA follow-up first time around.. it just hides the install button if you happen to have your system configured for no uploads but still allow searching for plugins via the UI.
Comment 14 David Cook 2020-07-23 02:31:21 UTC
(In reply to Martin Renvoize from comment #13)
> Oops. forgot to attach my QA follow-up first time around.. it just hides the
> install button if you happen to have your system configured for no uploads
> but still allow searching for plugins via the UI.

Firstly, thanks so much for QAing this, Martin! Really appreciated!

Secondly, that's an interesting follow-up!

I actually intended to let people install plugins from configured Git repos but just disable plugin file upload via their local browser.

If I read your patch correctly, they wouldn't be able to do that with the follow-up, right?

I don't mind either way, but I wonder if people should be able to search Git repos but not upload files via the browser?
Comment 15 Jonathan Druart 2020-07-23 10:22:04 UTC
We cannot upload but uninstall, is that ok?
Comment 16 Martin Renvoize 2020-07-23 19:05:46 UTC
(In reply to David Cook from comment #14)
> (In reply to Martin Renvoize from comment #13)
> > Oops. forgot to attach my QA follow-up first time around.. it just hides the
> > install button if you happen to have your system configured for no uploads
> > but still allow searching for plugins via the UI.
> 
> Firstly, thanks so much for QAing this, Martin! Really appreciated!
> 
> Secondly, that's an interesting follow-up!
> 
> I actually intended to let people install plugins from configured Git repos
> but just disable plugin file upload via their local browser.

Ah, if that was your intentention, I don't believe it worked. I'm sure I tested it during QA and as expected, it failed at the plugin upload stage so I disabled the button as a follow-up.  Hmm, maybe this needs a minor revisit then to clarify the case.
Comment 17 Martin Renvoize 2020-07-23 19:06:30 UTC
(In reply to Jonathan Druart from comment #15)
> We cannot upload but uninstall, is that ok?

Good catch, we should probably disallow that too here.
Comment 18 Jonathan Druart 2020-07-24 14:49:36 UTC
Removing from the PQA queue regarding the last comments.
Comment 19 David Cook 2020-07-29 03:17:40 UTC
(In reply to Jonathan Druart from comment #15)
> We cannot upload but uninstall, is that ok?

That's a good question. I was thinking that it was OK for them to uninstall them, but I suppose that could be annoying for vendors/administrators...

But then plugins installed via Github should be able to be deleted. We don't want to remove the "uninstall" option for all plugins just because we're not letting them upload plugins via the browser.

But then if we also block Github installs as well as browser upload/install, then that would be a bit of a moot point.

(Although at some point I'm planning to create a plugin for managing plugins from external sources. Prosentient could have a plugin for downloading/installing Prosentient approved plugins, Bywater could have a plugin for downloading/installing Bywater approved plugins, etc.)
Comment 20 David Cook 2020-07-29 03:18:15 UTC
(In reply to Martin Renvoize from comment #16)
> Ah, if that was your intentention, I don't believe it worked. I'm sure I
> tested it during QA and as expected, it failed at the plugin upload stage so
> I disabled the button as a follow-up.  Hmm, maybe this needs a minor revisit
> then to clarify the case.

That's good to know! I thought that I'd tested it, but I was working pretty fast and furious at one stage. I'll have to review it.
Comment 21 Joonas Kylmälä 2021-04-08 10:19:53 UTC
David, any updates on this? :)
Comment 22 David Cook 2021-06-02 02:50:34 UTC
(In reply to Joonas Kylmälä from comment #21)
> David, any updates on this? :)

Ooops. Missed the email notification.

While I still have an interest in plugins, we just don't use them enough to justify me working on them during my job hours. 

And outside my job I have so few hours available and those I'm putting towards authentication/Mojolicious controller things. 

So I'll abdicate as assignee.
Comment 23 David Cook 2023-07-24 06:06:12 UTC
This one has been in the back of my mind for a long time, and I thought it was about time it was revisited.

(In reply to Martin Renvoize from comment #17)
> (In reply to Jonathan Druart from comment #15)
> > We cannot upload but uninstall, is that ok?
> 
> Good catch, we should probably disallow that too here.

I agree about preventing uninstall as well. I'll add a patch for that.
Comment 24 David Cook 2023-07-24 06:14:47 UTC
(In reply to Martin Renvoize from comment #16)
> Ah, if that was your intentention, I don't believe it worked. I'm sure I
> tested it during QA and as expected, it failed at the plugin upload stage so
> I disabled the button as a follow-up.  Hmm, maybe this needs a minor revisit
> then to clarify the case.

I've changed my mind on this one. I agree with your QA follow-up.
Comment 25 David Cook 2023-07-24 06:21:46 UTC
Created attachment 153824 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 26 David Cook 2023-07-24 06:21:49 UTC
Created attachment 153825 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 27 David Cook 2023-07-24 06:21:53 UTC
Created attachment 153826 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 28 David Cook 2023-07-24 06:21:56 UTC
Created attachment 153827 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.
Comment 29 David Cook 2023-07-24 06:22:57 UTC
Due to the amount of time that's passed, I'm resetting this one to "Needs Signoff".
Comment 30 Martin Renvoize 2023-07-25 14:51:29 UTC
Mind if I amend this from 'enable_plugin_browser_upload' to 'restrict_to_plugin_repos'.

My thinking is, instead of a simple on/off switch for uploads we set it to only allow uploads from those repositories listed in plugin_repos.  Then if none are listed we disable upload entirely, if some are listed the search and install button works nicely or you can just not restrict and get any uploads.

I think we could fairly trivially achieve this be looking at the uploadlocation parameter and checking it's content against the organisation part of the plug_repos config variable.
Comment 31 Martin Renvoize 2023-07-26 14:35:26 UTC
Created attachment 153925 [details] [review]
Bug 25672: WIP - Convert to restricting to repo only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are)
Comment 32 Martin Renvoize 2023-07-26 14:36:20 UTC
Some work towards what I was suggesting.. let me know what you think.. it's all a bit crude, but until we get some more of the Plugins foundations solid I think it may be the middle ground we can take.
Comment 33 Martin Renvoize 2023-08-15 11:44:54 UTC
Created attachment 154423 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 34 Martin Renvoize 2023-08-15 11:44:57 UTC
Created attachment 154424 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 35 Martin Renvoize 2023-08-15 11:45:00 UTC
Created attachment 154425 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 36 Martin Renvoize 2023-08-15 11:45:02 UTC
Created attachment 154426 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.
Comment 37 Martin Renvoize 2023-08-15 11:45:05 UTC
Created attachment 154427 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.
Comment 38 David Cook 2023-08-16 00:09:22 UTC
Comment on attachment 154427 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

Review of attachment 154427 [details] [review]:
-----------------------------------------------------------------

::: plugins/plugins-upload.pl
@@ +48,5 @@
> +    $template->param( plugins_restricted => $plugins_restricted );
> +}
> +
> +# Exit early if uploads are not enabled
> +if ( !$ ) {

You've got a little typo here with the variable name. 

But I'm not sure how this would work with the current implementation of "plugins_restricted"?
Comment 39 Martin Renvoize 2023-08-16 08:35:04 UTC
Created attachment 154453 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.
Comment 40 Martin Renvoize 2023-08-16 08:36:22 UTC
Good catch, I've fixed that inline in the latest patch.
Comment 41 Martin Renvoize 2023-08-16 09:10:51 UTC
Created attachment 154455 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.
Comment 42 Martin Renvoize 2023-08-16 09:11:16 UTC
All works in testing for me.
Comment 43 Kyle M Hall 2023-08-16 11:29:18 UTC
Created attachment 154464 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 44 Kyle M Hall 2023-08-16 11:29:24 UTC
Created attachment 154465 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 45 Kyle M Hall 2023-08-16 11:29:27 UTC
Created attachment 154466 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 46 Kyle M Hall 2023-08-16 11:29:29 UTC
Created attachment 154467 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 47 Kyle M Hall 2023-08-16 11:29:31 UTC
Created attachment 154468 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 48 David Cook 2023-08-17 00:24:26 UTC
Created attachment 154474 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 49 David Cook 2023-08-17 00:24:30 UTC
Created attachment 154475 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 50 David Cook 2023-08-17 00:24:34 UTC
Created attachment 154476 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 51 David Cook 2023-08-17 00:24:38 UTC
Created attachment 154477 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 52 David Cook 2023-08-17 00:24:42 UTC
Created attachment 154478 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 53 David Cook 2023-08-17 00:27:57 UTC
Adding my SO and leaving "Signed Off" since I wrote some of these patches.

Kyle, should we consider your SO as QA, or do you want to have another look?
Comment 54 David Cook 2023-08-17 00:30:31 UTC
I would still like a way to prevent "Uninstall" as well for plugins installed via the CLI, but I think that can be its own thing. 

I'm also less worried about people uninstalling plugins than installing problematic plugins.
Comment 55 Victor Grousset/tuxayo 2023-10-09 01:55:33 UTC
Created attachment 156715 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 56 Victor Grousset/tuxayo 2023-10-09 01:55:37 UTC
Created attachment 156716 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 57 Victor Grousset/tuxayo 2023-10-09 01:55:41 UTC
Created attachment 156717 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 58 Victor Grousset/tuxayo 2023-10-09 01:55:47 UTC
Created attachment 156718 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 59 Victor Grousset/tuxayo 2023-10-09 01:55:52 UTC
Created attachment 156719 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 60 Victor Grousset/tuxayo 2023-10-09 01:55:56 UTC
Created attachment 156720 [details] [review]
Bug 25672: (QA follow-up): tidy up code
Comment 61 Victor Grousset/tuxayo 2023-10-09 01:58:44 UTC
Test plan outdated. It still mentions enable_plugin_browser_upload.

<enable_plugin_browser_upload>0</enable_plugin_browser_upload>
↓↓↓
<plugins_restricted>1</plugins_restricted>

----

> 6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
> "Plugin browser upload disabled!" and gives instructions on how to enable
> browser upload

Outdated. The form is here, but upon uploading the kitchen sink plugin I get «Cannot install plugin from unknown source whilst plugins_restricted is enabled.»

Beside the divergence with the test plan (so test plan needs to be aligned with current expectations), the form shouldn't be accessible (even via direct URL), right? Like it was in earlier iterations of this ticket IIUC. (then test plan is correct (needs a proofread of the rest, still))

----

> 9) Enable Koha plugin git repos and search for "coverflow"
> 10) Note that you can find the plugin but you cannot install it

Turns out I can! 

> 11) Change enable_plugin_browser_upload back to 1 and "restart_all"
> 12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

"not" => "now" ? Seem like a typo?

----

- Rebased patches (thanks to applying on an old main/master commit to circumvent the "sha1 information is lacking or useless" error)
- added tidy follow-up
Comment 62 David Cook 2023-10-09 02:02:41 UTC
Yeah this one has evolved over time so the test plan is certainly outdated.
Comment 63 Martin Renvoize 2023-10-09 11:43:56 UTC
Created attachment 156734 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 64 Martin Renvoize 2023-10-09 11:43:59 UTC
Created attachment 156735 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 65 Martin Renvoize 2023-10-09 11:44:03 UTC
Created attachment 156736 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 66 Martin Renvoize 2023-10-09 11:44:06 UTC
Created attachment 156737 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 67 Martin Renvoize 2023-10-09 11:44:09 UTC
Created attachment 156738 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 68 Martin Renvoize 2023-10-09 11:44:13 UTC
Created attachment 156739 [details] [review]
Bug 25672: (QA follow-up): tidy up code
Comment 69 Martin Renvoize 2023-10-09 11:44:16 UTC
Created attachment 156740 [details] [review]
Bug 25672: Restore redirect on restricted upload

This patch restores the immediate redirect from plugins-upload should
uploads be restricted and an uploadlocation not be specified.

Amended test plan:
1) Apply the full patchset
2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml
3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml
4) Confirm that the <plugin_repos> block us not commented and contains at
   least one trusted organisation in koha-conf.xml
5) Run restart_all (in koha-testing-docker)
6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
   an option to upload plugins
7) You should however see a search option and upon search you should have
   results returned from the chosen trusted organisations listed in the
   <plugin_repos> block mentioned above.
8) Clicking install on one of the results should work as expected and install
   the plugin.
9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
   "Plugin upload is restricted to only those plugins listed by your server
   administrator" and gives instructions on how to enable unrestricted browser
   upload.
Comment 70 Martin Renvoize 2023-10-09 11:46:14 UTC
What we lose here compared to the original patches is the restriction on being able to prevent client side installed plugins from being uninstalled.

I think that deserves it's own patch (and implementation) on a new bug.. partly to get it's own mention in the release notes and partly as it's a different, but equality important, functionality.
Comment 71 Victor Grousset/tuxayo 2023-10-09 22:02:02 UTC
Thanks Martin for the follow-up :)

> 9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
>   "Plugin upload is restricted to only those plugins listed by your server
>   administrator" and gives instructions on how to enable unrestricted browser
>   upload.

oh no, something bad happened! :o https://pic.infini.fr/hqdr0ovW/XWBCYwwa.png


Testing notes: ignore the test plan from the 1st path, the valid one is in patch: «Bug 25672: Restore redirect on restricted upload»
Comment 72 Martin Renvoize 2023-10-24 09:51:16 UTC
Created attachment 157730 [details] [review]
Bug 25672: Fix double output_html_with_http_headers

We weren't exiting after calling output_html_with_http_headers and so we
were ending up with a double template render (and also a subsequent
confusion in the cookie consent code).
Comment 73 Martin Renvoize 2023-10-24 09:52:09 UTC
Thanks for testing Victor.. well spotted on the weird double template render there.

I've added a follow up to handle that case now.
Comment 74 Kyle M Hall 2023-10-25 15:28:12 UTC
Created attachment 157810 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the patch
2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml
3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml
4) restart_all (in koha-testing-docker)
5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
an option to upload plugins
6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
"Plugin browser upload disabled!" and gives instructions on how to enable
browser upload
7) Install a plugin from the CLI using
koha-shell kohadev -c "/usr/share/koha/bin/devel/install_plugins.pl"
8) Note that the Uninstall option for the plugin does not appear
9) Enable Koha plugin git repos and search for "coverflow"
10) Note that you can find the plugin but you cannot install it

11) Change enable_plugin_browser_upload back to 1 and "restart_all"
12) Note that you can not upload plugins, uninstall plugins, and install
plugins from Git repos

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 75 Kyle M Hall 2023-10-25 15:28:20 UTC
Created attachment 157811 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 76 Kyle M Hall 2023-10-25 15:28:23 UTC
Created attachment 157812 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 77 Kyle M Hall 2023-10-25 15:28:25 UTC
Created attachment 157813 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 78 Kyle M Hall 2023-10-25 15:28:28 UTC
Created attachment 157814 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 79 Kyle M Hall 2023-10-25 15:28:30 UTC
Created attachment 157815 [details] [review]
Bug 25672: (QA follow-up): tidy up code

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 80 Kyle M Hall 2023-10-25 15:28:33 UTC
Created attachment 157816 [details] [review]
Bug 25672: Restore redirect on restricted upload

This patch restores the immediate redirect from plugins-upload should
uploads be restricted and an uploadlocation not be specified.

Amended test plan:
1) Apply the full patchset
2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml
3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml
4) Confirm that the <plugin_repos> block us not commented and contains at
   least one trusted organisation in koha-conf.xml
5) Run restart_all (in koha-testing-docker)
6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
   an option to upload plugins
7) You should however see a search option and upon search you should have
   results returned from the chosen trusted organisations listed in the
   <plugin_repos> block mentioned above.
8) Clicking install on one of the results should work as expected and install
   the plugin.
9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
   "Plugin upload is restricted to only those plugins listed by your server
   administrator" and gives instructions on how to enable unrestricted browser
   upload.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 81 Kyle M Hall 2023-10-25 15:28:35 UTC
Created attachment 157817 [details] [review]
Bug 25672: Fix double output_html_with_http_headers

We weren't exiting after calling output_html_with_http_headers and so we
were ending up with a double template render (and also a subsequent
confusion in the cookie consent code).

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 82 Victor Grousset/tuxayo 2023-10-25 16:25:00 UTC
Created attachment 157836 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the full patchset
2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml
3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml
4) Ensure that the <plugin_repos> block is not commented and contains at
   least one trusted organisation in koha-conf.xml
   If needed get it from: debian/templates/koha-conf-site.xml.in
5) Run restart_all (in koha-testing-docker)
6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
   an option to upload plugins
7) You should however see a search option and upon search you should have
   results returned from the chosen trusted organisations listed in the
   <plugin_repos> block mentioned above.
8) Clicking install on one of the results should work as expected and install
   the plugin.
9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
   "Plugin upload is restricted to only those plugins listed by your server
   administrator" and gives instructions on how to enable unrestricted browser
   upload.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 83 Victor Grousset/tuxayo 2023-10-25 16:25:03 UTC
Created attachment 157837 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 84 Victor Grousset/tuxayo 2023-10-25 16:25:08 UTC
Created attachment 157838 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 85 Victor Grousset/tuxayo 2023-10-25 16:25:12 UTC
Created attachment 157839 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 86 Victor Grousset/tuxayo 2023-10-25 16:25:17 UTC
Created attachment 157840 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 87 Victor Grousset/tuxayo 2023-10-25 16:25:22 UTC
Created attachment 157841 [details] [review]
Bug 25672: (QA follow-up): tidy up code

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 88 Victor Grousset/tuxayo 2023-10-25 16:25:51 UTC
Created attachment 157842 [details] [review]
Bug 25672: Restore redirect on restricted upload

This patch restores the immediate redirect from plugins-upload should
uploads be restricted and an uploadlocation not be specified.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 89 Victor Grousset/tuxayo 2023-10-25 16:25:55 UTC
Created attachment 157843 [details] [review]
Bug 25672: Fix double output_html_with_http_headers

We weren't exiting after calling output_html_with_http_headers and so we
were ending up with a double template render (and also a subsequent
confusion in the cookie consent code).

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 90 Victor Grousset/tuxayo 2023-10-25 16:26:56 UTC
Ho, mid air collision, I'm fixing that.
Comment 91 Victor Grousset/tuxayo 2023-10-25 16:35:04 UTC
Created attachment 157846 [details] [review]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload

This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which
controls whether or not Koha intranet users can upload Koha plugins via
their browser. Like "enable_plugins", it defaults to 0 for new installs.

This is useful when you want to provide Koha intranet users with plugins
that are pre-installed by administrators (by CLI) or restricting them
to plugins from a Github repo. See the following for more information:
Bug 23975 - Add ability to search and install plugins from GitHub
Bug 23191 - Administrators should be able to install plugins from the command line

To test:
1) Apply the full patchset
2) Confirm <enable_plugins>1</enable_plugins> is present in koha-conf.xml
3) Add <plugins_restricted>1</plugins_restricted> to koha-conf.xml
4) Ensure that the <plugin_repos> block is not commented and contains at
   least one trusted organisation in koha-conf.xml
   If needed get it from: debian/templates/koha-conf-site.xml.in
5) Run restart_all (in koha-testing-docker)
6) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see
   an option to upload plugins
7) You should however see a search option and upon search you should have
   results returned from the chosen trusted organisations listed in the
   <plugin_repos> block mentioned above.
8) Clicking install on one of the results should work as expected and install
   the plugin.
9) Go directly to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says
   "Plugin upload is restricted to only those plugins listed by your server
   administrator" and gives instructions on how to enable unrestricted browser
   upload.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 92 Victor Grousset/tuxayo 2023-10-25 16:35:08 UTC
Created attachment 157847 [details] [review]
Bug 25672: Enable enable_plugin_browser_upload by default

This patch enables enable_plugin_browser_upload by default,
since the current behaviour for Koha is to enable browser upload
when enable_plugins is 1.

Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 93 Victor Grousset/tuxayo 2023-10-25 16:35:11 UTC
Created attachment 157848 [details] [review]
Bug 25672: (QA follow-up) Hide install after search button

If plugin upload is disabled, but there are git repositories listed in
the config for plugin searching, then you can search for a plugin and
attempt to install it. The install leads to an error page.

This patch removes the actions column and install button should the
enable_browser_upload option be disabled

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 94 Victor Grousset/tuxayo 2023-10-25 16:35:15 UTC
Created attachment 157849 [details] [review]
Bug 25672: Prevent uninstall when plugin browser upload disabled

When plugin browser upload is disabled, also prevent plugin browser
uninstall.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 95 Victor Grousset/tuxayo 2023-10-25 16:35:18 UTC
Created attachment 157850 [details] [review]
Bug 25672: Convert to restricting to listed repositories only

I think instead of a plain on/off switch we should use it in combination
with the plugin_repo's and set it to restrict to only those repos' (i.e.
disable uploads entirely if no repo's are listed, or just allow those
repo's when there are).

This patch achieves that, but only if plugins are installed via the
plugin browser method. We disable all direct upload avenues, so install
is blocked for other cases.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 96 Victor Grousset/tuxayo 2023-10-25 16:35:22 UTC
Created attachment 157851 [details] [review]
Bug 25672: (QA follow-up): tidy up code

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 97 Victor Grousset/tuxayo 2023-10-25 16:35:26 UTC
Created attachment 157852 [details] [review]
Bug 25672: Restore redirect on restricted upload

This patch restores the immediate redirect from plugins-upload should
uploads be restricted and an uploadlocation not be specified.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 98 Victor Grousset/tuxayo 2023-10-25 16:35:30 UTC
Created attachment 157853 [details] [review]
Bug 25672: Fix double output_html_with_http_headers

We weren't exiting after calling output_html_with_http_headers and so we
were ending up with a double template render (and also a subsequent
confusion in the cookie consent code).

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 99 Victor Grousset/tuxayo 2023-10-25 16:45:55 UTC
Fixed. Compared the diff to ensure there wasn't a difference that might be lost.
My tests[1] were meant as a signoff (not having opinions about how plugins should work to meaningfully review) so a previous person having tested would be freed to QA. Like Kyle so it was perfect :)

Also, moved the test plan to the 1st patch to replace to outdated one.

[1] Also confirmed that having plugins_restricted = 0 to see the upload form and then doing plugins_restricted = 1 before submitting made the actual upload fail. And not just showing the form.
Comment 100 Tomás Cohen Arazi 2023-10-31 14:06:28 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 101 David Cook 2023-10-31 23:18:25 UTC
Huzzah! I'm stoked to see this one in a stable version :D
Comment 102 Tomás Cohen Arazi 2023-10-31 23:29:52 UTC
(In reply to David Cook from comment #101)
> Huzzah! I'm stoked to see this one in a stable version :D

Well done. Thanks for keeping up with it.
Comment 103 Martin Renvoize 2023-11-01 05:47:21 UTC
Awesome 😎

No time to rest though, I see lots of further enhancements to the plugin infrastructure around the corner for the next release. I vest get cracking on the follow-up bug to restore the functionality to prevent uninstall friknthe UI for plugins installed via the CLI.

I'm also keen to try and get the plugin signing bug moving again and the metadata move one too.
Comment 104 David Cook 2023-11-01 06:03:24 UTC
(In reply to Martin Renvoize from comment #103)
> Awesome 😎
> 
> No time to rest though, I see lots of further enhancements to the plugin
> infrastructure around the corner for the next release. I vest get cracking
> on the follow-up bug to restore the functionality to prevent uninstall
> friknthe UI for plugins installed via the CLI.

Oh yes that would be good :D

> I'm also keen to try and get the plugin signing bug moving again and the
> metadata move one too.

\o/
Comment 105 Fridolin Somers 2023-11-08 08:23:36 UTC
Enhancement not pushed to 23.05.x