WordPress / plugin-check

A repository for the new Plugin Check plugin from the WordPress Performance and Plugins Team.
https://wordpress.org/plugins/plugin-check/
GNU General Public License v2.0
264 stars 54 forks source link

Update checker inside vendor folder is not detected #640

Open ernilambar opened 1 month ago

ernilambar commented 1 month ago

For update checker, currently we look for plugin-update-checker.php.

But we ignore folders "node_modules" and "vendor" folder by default when we scan files.

Those who have plugin-update-checker inside the vendor folder as a composer package are not being detected. Interestingly that is the case for more than 90% of the plugins who bundle update checker.

ernilambar commented 1 month ago

Another interesting case is that, in one plugin, author has renamed the updater like company-update-checker. It would be good to have those detected also but may be it would not be that easy I guess.

Edit: Instead of company name it seems the forked package of original update checker: "kernl/kernl-update-checker". Several plugins have bundled this updater.

ernilambar commented 1 month ago

I checked several plugins today. Following are the frequent occurrences:

vendor/yahnis-elsts/plugin-update-checker
vendor/plugin-update-checker/
vendor/kernl/kernl-update-checker/
swissspidy commented 1 month ago

Another interesting case is that, in one plugin, author has renamed the updater like company-update-checker. It would be good to have those detected also but may be it would not be that easy I guess.

Instead of looking for those specific file names and folder names, wouldn't it be better to look for the actual source code usage instead? Like search file contents for strings like PluginUpdateChecker.

ernilambar commented 1 month ago

Like we don't have the files list of vendor folder due to exclusion, I think it would be inefficient to again scan and read all files and folder inside vendor folder which would probably have hundreds of files. Moreover, regex match in those large number of files could also take significant processing time. So I was thinking about is_dir() and file_exists() conditionals.