Autoupgrade plugins Should have SFTP option

[technosailor]

Not critical for WP 2.5, but I think that the plugin autoupgrade routine should provide the option for SFTP. FTP is a security risk and we should enable users to be security minded whenever possible.

My understanding is that the current approach is to test the FTP experience -- most common -- first, and then integrate the less common (more secure) experiences.

I figured as much, just lodging my wish for 2.6. I don't even have FTP turned on so using the upgrade feature isn't an option for me, but I realize I'm in a minority.

Anyone want to create a new filesystem class that abstracts ssh2_sftp?

Replying to ryan:

Anyone want to create a new filesystem class that abstracts ssh2_sftp?

I'll take a stab at it. Are you looking for WP 2.5 or 2.6? Just so I can figure out my timeline.

SFTP should be available if you enable the "Secure" selection & its using the FTP Extension & SSL is supposed:

​http://trac.wordpress.org/browser/trunk/wp-admin/includes/class-wp-filesystem-ftpext.php#L64

64	        if ( $this->options['ssl'] && function_exists('ftp_ssl_connect') ) {
65	            $this->link = ftp_ssl_connect($this->options['hostname'], $this->options['port'],$this->timeout);
66	        } else {
67	            $this->link = ftp_connect($this->options['hostname'], $this->options['port'],$this->timeout);
68	        }

Note however, that it silently falls back to non-ssl if it cant connect with ssl.
SSL shouldnt really be needed though IMO, As it'll only be connecting to localhost, Not another server, Therefor, there's no network nodes in the middle which may be listening in. While the local computer (the www server) could be, it would require root priv. in which case, it could access all the data regardless. I'm just pointing out the fact that 'secure' isnt really needed on that connection, whilst some will still want it anyway.

SFTP != FTP/SSL.

SFTP is FTP over SSH.

Replying to technosailor:

SFTP != FTP/SSL.

SFTP is FTP over SSH.

oops. FTPS is the Secure version of FTP(which the previous statement applies to)

Attached is a patch (one of several /methinks) that will allow plugin authors to create their own admin page form for custom filesystems.

I am currently proceeding under the assumption that an ssh2_sftp filesystem will be plugin territory due to PHP 5/external module/ time constraints for 2.5 release, so I will need hooks to make this possible.

hook to override filesystem credentials form

hook to override filesystem credentials form

Bit of a hackish method there IMO.

Perhaps maybe just having a callback that can be run to display the form required or somesuch.

Replying to DD32:

hook to override filesystem credentials form

Bit of a hackish method there IMO.

Perhaps maybe just having a callback that can be run to display the form required or somesuch.

I'm easy, if you want to write that code? I'm not 100% sure what you're envisioning? Maybe get_credentials_form() that would have a hook for plugin authors to insert new filesystems to choose from?

Oughtn't the password field be an <input type="password"> so that we're not showing the password in the clear? 'Twas a bit startling to see my password typed out there in plain text...

Patch does a little short circuit trick with apply_filters that we use in some other places. If the filter callback returns anything other than empty an empty string, return. Otherwise, fall through the default code.

Accidentally committed in [7460]. I'll leave it in for now so you can try it out.

Are we getting anywhere on the actual SFTP option? FTP over SSH.

I see in the trunk, the FTP/SSL option, but no SFTP. This would really be handy for people who don't have FTP turned on. We only use SFTP on my server.

I see in the trunk, the FTP/SSL option, but no SFTP. This would really be handy for people who don't have FTP turned on. We only use SFTP on my server.

If you have the PHP SSH extension loaded, then #7690 is the ticket that implemented it.

Ahh, thank you, I didn't have the ssh2 module installed so I didn't see the option. :) All good now.