Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Most of us are used to installing plugins directly from the WordPress.org plugin repository. This is the "official" list of available add-ins, and everything hosted there is guaranteed to be GPL.

But occasionally developers will list beta releases and non-GPL plugins on their own sites. To install these, you have to download a ZIP file, then either upload it to WordPress through the plugin installer or via FTP. For the unaware, it can be a complicated process because there's no one-click setup.

So what would be the potential benefits and drawbacks of enabling one-click plugin installation from any site?

I'm thinking something along this process:

  1. You go to a site hosting a cool plugin.
  2. You enter your blog's address (http://mycoolwordpressblog.com) in a box somewhere.
  3. An oAuth-type box pops up asking you to log in to your blog.
  4. Once you're authenticated, the plugin is added to your site automatically and you're given the option to activate it.

I suggest oAuth so that you only log in to your site (I don't want to give my admin credentials to someone I don't know), but there might be other ways to do it. Remotely uploading the plugin could likely happen using WordPress' built-in XML-RPC system since it already allows you to upload files.

Ideas? Comments? Feedback?

share|improve this question
    
Also, I've marked this as a wiki since there are likely to be several "right" answers. –  EAMann Apr 13 '11 at 17:25
    
I like this idea. Are you picturing adding a page to the admin area that accepts a url of a plugin as a query argument, and fetches that plugin? Or do you want to give the external site a way of pushing the plugin to your WordPress install? The second seems more fraught with security problems; the first seems easy to do, though. –  goldenapples Sep 3 '11 at 17:50
    
The first (enter a URL) would be fairly straight forward, but involves more steps for the end-user. The second (external) could be handled securely through a system like OAuth. Think of Facebook/Twitter where you can post/tweet from external sites once you grant them permission ... similar concept. –  EAMann Sep 6 '11 at 14:24
add comment

2 Answers

up vote 1 down vote accepted

Also look into this tool - http://markjaquith.wordpress.com/2010/07/24/plugin-installer-tool/

share|improve this answer
    
Just to let you know, that tool doesn't seem to be working with multisite. It sounds promising, though! –  EAMann Apr 13 '11 at 18:16
    
Good to know! I don't use that tool though, just aware of its existence :) –  Ashfame Apr 13 '11 at 19:13
add comment

I think this would bring up some major security issues, look at all the malware you find in "free theme" mills.

share|improve this answer
    
Not on its own. Even the most malicious system in those free theme mills still needs to be installed by an administrator. Allowing for remote installation would just make it easier for admins to invite the bad guys in to their sites, it wouldn't necessarily expose them to more risk. You can download and install a malware-infected plugin already, it's just a multi-step process. –  EAMann Apr 14 '11 at 14:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.