Upgrade/Install: Don't send plugins and themes with a non-WordPress.org Update URI to the update-check APIs - #13928
Conversation
…rg `Update URI` to the update-check APIs. Plugins and themes whose `Update URI` header points outside WordPress.org can never receive an update from WordPress.org, but `wp_update_plugins()` and `wp_update_themes()` still disclosed them, headers included, to api.wordpress.org. Omit any item whose `Update URI` is not a WordPress.org URL (`https://wordpress.org/{plugins,themes}/{slug}/` or `w.org/{plugins,themes}/{slug}`). Omitted items are still recorded as checked and still pass through the `update_plugins_{$hostname}` and `update_themes_{$hostname}` filters. See #59631. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
oof, rate limited. |
Plugins and themes whose
Update URIheader points outside WordPress.org can never receive an update from WordPress.org, butwp_update_plugins()andwp_update_themes()still send them, headers included, toapi.wordpress.org. That discloses private and premium plugin/theme lists to a third party, which is a privacy (and potentially GDPR) concern for sites and for plugin vendors.This omits any plugin or theme whose
Update URIis set to something other than a WordPress.org URL, using the forms described in #950 (https://wordpress.org/{plugins,themes}/{slug}/andw.org/{plugins,themes}/{slug}) as the "hosted on WordPress.org" patterns._wp_is_wporg_update_uri()decides whether a header value identifies a WordPress.org hosted item. It is deliberately permissive: if in doubt the item is still sent, which is today's behaviour.wp_update_plugins()builds its payload (and theactivelist) from the remaining plugins only.wp_update_themes()does the same. If the active theme is omitted,activeis dropped too so its slug isn't disclosed.checkedand still pass throughupdate_plugins_{$hostname}/update_themes_{$hostname}, so third-party updaters are unaffected.Not changed: the
translationspayload, which is keyed by text domain and still includes entries for omitted items. That can be a follow-up.Open question: I could not verify server-side behaviour of the API (it isn't open source), including whether the themes endpoint tolerates a request with no
activekey.Trac ticket: https://core.trac.wordpress.org/ticket/59631
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Drafted the implementation, the PHPUnit tests, and this description. The work was done under the direction of a human, who reviewed the changes and takes responsibility for them.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.
🤖 Generated with Claude Code