search

apengstrom / skip-wordpress-org

Skip calls to wordpress.org, block Matt, eloquently.
5 stars 0 forks source link

plugins page fails on activation of this plugin #1

Open mrtwebdesign opened 1 month ago

mrtwebdesign commented 1 month ago

Screenshot 2024-09-27 at 1 20 38 PM Maybe defined( 'ABSPATH' ) or die( 'Not today!' ); in the main plugin file was a mistake?

mrtwebdesign commented 1 month ago

I didn't realize there was another line. This solution may just be fundamentally broken. Did you test this? Or was the code theoretical? Screenshot 2024-09-27 at 1 47 12 PM

apengstrom commented 1 month ago

@mrtwebdesign It has all been theoretical as I've been debugging how the API calls are being made and implemented throughout different parts of the administrator. Some functions may be broken for now as a result of the temp code, and by no means should this allow any updating to work (because the calls will be blocked).

Definitely continue to send feedback my way. I will be working to evolve this plugin over the weekend if at all possible.

mrtwebdesign commented 1 month ago

Got it! We almost kept it on, but plugin and plugin-install were both breaking, and I'm wonder if there are other side-effects outside those pages. I'm happy to see someone working on it. I'm sure WP Engine is as well. We have a LOT of clients on WP Engine and it feels like we are under attack.

apengstrom commented 1 month ago

Understood - I will try to test / implement an update tonight. I do plan on working on it over the weekend to make it more refined. The function under scrutiny right now is really only there because I had a plugin using wp_remote_post to hit api.wordpress.org - completely non-standard. So, you could theoretically comment that function out and still use the rest of the code, if that makes sense.

For wp_remote_post, I can’t filter with the pre_http_request hook. That was the problem I ran into and why I added the extra function. I was able to “hack” it by jacking the http request args in the other function and die() if it was attempting to hit one of the offending URLs. I was unable to get it to work if I just went to exit() instead, so yes that piece is still under my heavy scrutiny, haha.

I'll update this if I get a workaround added.