Automattic / jetpack

Security, performance, marketing, and design tools — Jetpack is made by WordPress experts to make WP sites safer and faster, and help you grow your traffic.
https://jetpack.com/
Other
1.59k stars 799 forks source link

JITM: update AK and VP buttons when user has a plan but hasn't activated the plugins #5604

Open jeherve opened 7 years ago

jeherve commented 7 years ago

Steps to reproduce the issue

Same thing with the “Enable Backups” button after publishing a post.

On Comments page I see a prompt to “Automate Spam Blocking”. Clicking takes me to the Plans page on WordPress.com, even though I already have a plan.

What I expected

The more logical thing to do would be to detect AK / VP is installed, just not activated, and so activate it.

beaulebens commented 6 years ago

I'm not 100% sure what's possible within the context of a JITM, but technically, those messages probably shouldn't be showing at all for sites that already have a plan.

I think we should

  1. Prevent those JITMs from showing if you already have a plan, and then possibly
  2. Show a new message that encourages you to activate the appropriate plugin to get spam protection/backups, which either activates them directly if possible, or at least takes you to the plugin view.
withinboredom commented 6 years ago

It already won't show if you have a plan, it's likely the JITM was cached from before the plan purchase. Activating a plugin would clear the cache (which should have happened when the plan was purchased).

I'll add a jitm to prompt for activation of the plugins.

withinboredom commented 6 years ago

IOW, I don't think it's a good idea to auto-activate the plugin (they may have deactivated it on purpose). However, making a jitm activate the plugin is a bit simpler

withinboredom commented 6 years ago

I spent late into the night hacking on this. I believe this is doable (allowing a jitm to activate/install VP/Akismet). However, as JITMs work right now, it needs some thought on security/authentication. JITMs were mostly designed as a message display vehicle, and don't really care if the user is pretending to be someone else.

I put together a proof of concept (D10732-code) and it needs a bit of work. We'll likely revisit this in the near future, after GDPR.