[ad_1] Security Review Lead Chris Christoff has announced two new changes for the WordPress Plugin Directory, effective from October 1, 2024. These changes aim to enhance plugin directory security and promote best practices among plugin developers. Mandatory Two-Factor Authentication As of October 1, 2024, all plugin owners and committers must enable Two-Factor Authentication (2FA) to submit new plugins to the WordPress Plugin Directory. This change was announced by Automattic-sponsored developer Dion Hulse last month. Plugin owners are encouraged to enable 2FA, review committers’ access levels, and use additional security features like the SVN password option and Release Confirmation. Detailed guides on Configuring Two-Factor Authentication and Keeping Your Plugin Committer Accounts Secure are also available. Plugin Check Tool From now on, any new plugin submitted to the Plugin Directory will first go through a pre-submission check using the Plugin Check tool. If any errors are found, the submission will be blocked until they are fixed. This new step aims to reduce the review queue by enabling plugin authors to catch common issues before submitting their plugins for manual review. Plugin Check helps by identifying frequent issues, such as mismatched versions between the plugin header and the readme.txt file, incorrect text domains, and erroneous “Tested To” values in the readme. Although Plugin Check adds a layer of automation, it will not replace the manual review of plugins. David Perez from the Plugin Review Team recommended making Plugin Check a part of the development workflow as “In addition to things relevant for the review process, the tool flags violations or concerns around plugin development best practices, from basic requirements like correct usage of internationalization functions to accessibility, performance, and security best practices. It does so using both static checks using PHP_CodeSniffer and dynamic checks, where it actually activates your plugin to test it “live”.” The Plugins Team is working to expand Plugin Check’s coverage to existing plugins. A roadmap detailing this broader application will be released in the coming months. Contributors can help improve the tool via its GitHub Repo. The WordPress community has responded positively to these updates. Josepha Haden Chomphosy tweeted “This was years in the making and is a huge deal. Congratulations (and big thanks) to everyone who contributed!” These two measures are expected to help the WordPress Plugin Team improve the security of the platform while reducing the backlog of plugins awaiting approval. [ad_2] Source link
Continue readingTag Archives: Submissions
WordPress.org Experiments with Rejecting Plugin Submissions with the “WP” Prefix to Mitigate Potential Trademark Abuse – WP Tavern
[ad_1] Many in the WordPress developer community were surprised to learn that WordPress.org is rejecting plugins with the “WP” prefix in the name after Joe Youngblood tweeted the rejection note he received. Although that restriction was put into place approximately seven months ago, there was no official communication on the change. WordPress is now claiming that the @WordPress Foundation has demanded that the developers stop allowing "WP" to be used in plugin names. pic.twitter.com/FyyPJoqXmd — Joe Youngblood (@YoungbloodJoe) August 13, 2021 As the result of the controversy gaining attention on social media and other channels, WordPress Plugin Team member Mika Epstein posted an explanation on the original meta trac ticket, the reasoning for how and why “wp” is being blocked: Using wp- at the beginning of plugin permalinks, yes. Due to how we built this out, the display name is what gets checked and flagged. You can use WPPluginName (no space) and Plugin Name for WP. This stems from part of a longer conversation going on with the Foundation, regarding handling the actual misuse of ‘WordPress’ in plugin names (which, as we all know, is actually trademarked and as such should not be used in your plugin name at all). Because using WP Blah Blah as a name tends to lead to people changing it after approval to “WordPress Blah Blah” we put a pause on it to try and get a handle on how bad is this, what’s the depth of the problem (vs the actual headache of WC -> WooCommerce in names) and so on. There is also the reality that using ‘WP’ or ‘Plugin’ in a plugin permalink is unnecessary and can be harmful to SEO due to repetitive words. No one is claiming WP is trademarked, we’re just trying to minimize confusion and prevent people from accidentally violating trademarks in the future because they change WP to WordPress later on. Whether or not “wp” was trademarked became a particular point of confusion because the commit message on the change said: “Adding in some more things to block based on use and trademarks.” The conversation with the WordPress Foundation that Epstein was referencing was a private discussion about how the team can mitigate trademark abuse. “This came up in the midst of an ad hoc brainstorm about the ways that the loophole could be more effectively managed, and so there wasn’t a lengthy public discussion on it,” WordPress Executive Director Josepha Haden Chomphosy said. “It was part of an experiment for handling that loophole more effectively and wasn’t meant to be permanent. The great thing about experiments in WordPress is that when we see that we’re throwing out the good along with the bad, we can make the necessary changes to do it better.” Haden Chomphosy said that although the original discussion was private, the team plans to make it public via the new meta ticket that was opened yesterday for improving the checks on plugin submissions. “All future discussions will be on the ticket, so as people work on it, then the conversations will be available there,” she said when asked how the trademark abuse mitigation experiment will be evaluated. The WordPress Foundation does not have any employees, but Haden Chomphosy said the representatives who can help with the grey areas of trademark guidelines include herself, Andrea Middleton, and Cami Kaos. She also confirmed that “WP” is not a WordPress trademark and the Foundation is not pursuing trademarking the term. Although each of these individuals referenced have a long track record of protective care for the WordPress community and have demonstrated a sincere desire to see the project grow, they are all employed by Automattic. The Foundation could use some outside representation if those running it are engaging in private decision making and giving directives to the WordPress.org Plugin Team that have significant ramifications for the ecosystem as a whole. For years, the WordPress community has been encouraged to use WP instead of WordPress in plugin names, so the decision to reject plugins with WP in the name is a major, controversial change. The problem for me is 1. you are penalizing everyone for something a few people do. 2. it doesn’t actually fix the problem because I could change any of my plugin names to WordPress after the fact and 3. There’s NO official announcement explaining this. — Brad Williams (@williamsba) August 17, 2021 Those who oppose the current experiment have pointed out that it unfairly penalizes everyone for the few who change their plugin names after approval. It polices potential misuse instead of providing a solution that can flag actual trademark abuse. Some plugin developers have noted that having WP in the plugin name is necessary to differentiate it from extensions for other platforms, since WordPress.org is not the only place where their products are distributed. Many successful businesses have been created on top of plugins with WP as a prefix in the name, such as WP Mail SMTP, WP Fastest Cache, WP Migrate DB, to name just a few. Whether it is beneficial or detrimental to use WP in a brand’s name is immaterial to the discussion at hand. With the current trademark abuse mitigation experiment in place, all new plugin developers hoping to use the WP prefix will have their plugins rejected. Fortunately it isn’t retroactive, but if the team decides the experiment of banning WP in plugin names is a success, it may be up for discussion. Springing experiments on the community without publicly communicating the intent is a misstep for the Foundation. If allowing WP in the name creates wrong expectations for plugin developers regarding their ability to change the name to use WordPress, then the problem needs to be fixed at the root. WordPress.org needs to find a better way to inform developers about which terms are actually trademarked and develop a technical solution to flag name changes that do not comply. This may be a difficult technical problem to solve regarding plugin submission and updates, but it’s worth investing
Continue reading