Dashboard alert if a plugin was removed from WordPress plugins repo

[sergej.mueller]

If a plugin/theme has been removed for security reasons, WordPress users with an installed plugin must be informed. Ideally as dashboard notification (on update check?). Otherwise the user will never know that the plugin has a security leak.

[SergeyBiryukov]

Related: #29046

[valendesigns]

The hardest part would be deciding on how to tell if the plugin was ever in the repository once it's been removed.

[valendesigns]

This patch requests data from the Plugins API about the active plugins and then save the ones that exist to the found array in the directory_plugins option. When a plugin is removed it will be added to the removed array, in directory_plugins option, so the nag can be displayed. However, it will only show when the plugin is active. Any feedback from the core devs would be much appreciated.

Cheers,
Derek

[dd32]

Worth noting here, that we'd probably add a "removed for x" line to the plugins update-check API response here if we were to go ahead with this.

Realistically, plugins get disabled/removed for a variety of reasons, becoming unlisted in the plugin directory doesn't simply signify security issue / insecure.

[azaozz]

Replying to dd32:

Also that "removed for x reason" should be shown on the Plugins screen, similarly to "update available" notices. Then if it is a security reason, perhaps show on the Dashboard (index.php) and possibly send email to the admin.

Replying to valendesigns:

Looking at 30465.diff: most of this would be handled on the API side. We will only need to add some UI to display these notices. Also debug_backtrace() shouldn't be used in production (as the name suggests). It's very "heavy"/slow.

[nacin]

We need to get a lot better about how we handle plugin removals. Most of the time, it isn't for security. But users are still left in the cold simply because someone has decided to stop wanting to maintain it. I actually dislike this practice, and would rather see it be put into some kind of "abandoned and waiting to be adopted" mode. Perhaps preventing new downloads and notifying users, but not outright closing the page. Once you put it in the directory, you don't really have the option to make it seem like it never existed. Other app stores usually resolve this by allowing people to still access the app's page (and even install it on new devices) as long as you installed it via your account before it was removed.

When it is for security, well, we need to do better at this. But I'm not inclined to change anything in core without first establishing better .org procedures and policies. This is a much larger discussion and doesn't lend itself well to a bug report.

[valendesigns]

Well even if this patch is a wash and never makes it into the core, at the very least it's starting a conversation that needs to take place. The way we handle notifications for outdated plugins, or lack of notifications, needs to change. I agree there are many reasons for a plugin being removed and assuming that its a security reason is not the best approach, but there should be at minimum a set of returned messages for a handful of reasons explaining why the plugin no longer is in the directory i.e. security, user removed, abandoned, etc. that would go a long way to making the UX much better. As well, I would be more than happy to rewrite this patch to use the API and strip out all the extra code that tries to detect plugin removal if we could agree on how the future implementation should work.

@nacin How do we go about making changes to the procedures and policies that govern the Directory? Is this a good first step or do we need to discuss this somewhere else?

[LindsayBSC]

I came here to give a +1 on this as a feature. I know it was marked as "Won't Fix" but ran into a similar issue today on the IRC chat where someone had a plugin installed for 2 years and it was removed from the repo (we assumed because there was a security issue based on it's code) but they never knew it was removed. I understand people really should maintain their own code base HOWEVER since a system is in place for checking for updates from plugins installed from the repo, there could be a system that notifies the user that it no longer exists in the repo.

The way I see it, having a generic message that "this plugin is not longer hosted in the WordPress repo" is better than none. The idea of giving a reason why it was removed is nice, but not as necessary as a simple message.

Again, just giving a +1 to this even though it's mentioned as DNF

[ocean90]

#33350 was marked as a duplicate.

[grapplerulrich]

As the situation has changed over the last four years when @nacin closed this ticket as wontfix would it be a possibility to re-evaluate this?

Now when plugins get pulled from the repo there is reason. For example: ​https://wordpress.org/plugins/no-longer-in-directory/

It would be good to inform users that their plugin is not going to updated and they should look for alternatives.

I would move this from the "Security" component to the "Plugins" component.

[SergeyBiryukov]

#52960 was marked as a duplicate.

[swissspidy]

#56445 was marked as a duplicate.

[joostdevalk]

Reopening this ticket. I think WordPress as a system has a responsibility to tell users whether a plugin is maintained or not. If we know that a plugin has been closed, we should disclose that to the users of that plugin, so they can find an alternative. We've been doing this on WordPress.org for quite a while now, where we only show the reason after 60 days (see ​the code). I think it's time we give that feedback to users in the backend too, and try to reduce the number of sites which have unmaintained / zombie plugins running.

Proposed UI in attachment.

[joostdevalk]

Proposed plugin closed message for the plugins screen.

[SergeyBiryukov]

Replying to joostdevalk:

If we know that a plugin has been closed, we should disclose that to the users of that plugin, so they can find an alternative. We've been doing this on WordPress.org for quite a while now, where we only show the reason after 60 days

Related tickets:

• ​#meta2627 Closed plugins should still have a public page
• ​#meta3356 Plugin Directory: Closed plugins should show WHY closed (with caveat)
• ​#meta4694 Plugin Directory: More user-friendly language regarding plugin closures
• ​#meta5298 Plugin Directory: Show reasons why closed for perma-closures