1

Most of us are used to installing plugins directly from the WordPress.org plugin repository. This is the "official" list of available add-ins, and everything hosted there is guaranteed to be GPL.

But occasionally developers will list beta releases and non-GPL plugins on their own sites. To install these, you have to download a ZIP file, then either upload it to WordPress through the plugin installer or via FTP. For the unaware, it can be a complicated process because there's no one-click setup.

So what would be the potential benefits and drawbacks of enabling one-click plugin installation from any site?

I'm thinking something along this process:

  1. You go to a site hosting a cool plugin.
  2. You enter your blog's address (http://mycoolwordpressblog.com) in a box somewhere.
  3. An oAuth-type box pops up asking you to log in to your blog.
  4. Once you're authenticated, the plugin is added to your site automatically and you're given the option to activate it.

I suggest oAuth so that you only log in to your site (I don't want to give my admin credentials to someone I don't know), but there might be other ways to do it. Remotely uploading the plugin could likely happen using WordPress' built-in XML-RPC system since it already allows you to upload files.

Ideas? Comments? Feedback?

Improve this question
3
  • Also, I've marked this as a wiki since there are likely to be several "right" answers.
    – EAMann
    Commented Apr 13, 2011 at 17:25
  • I like this idea. Are you picturing adding a page to the admin area that accepts a url of a plugin as a query argument, and fetches that plugin? Or do you want to give the external site a way of pushing the plugin to your WordPress install? The second seems more fraught with security problems; the first seems easy to do, though.
    – goldenapples
    Commented Sep 3, 2011 at 17:50
  • The first (enter a URL) would be fairly straight forward, but involves more steps for the end-user. The second (external) could be handled securely through a system like OAuth. Think of Facebook/Twitter where you can post/tweet from external sites once you grant them permission ... similar concept.
    – EAMann
    Commented Sep 6, 2011 at 14:24

2 Answers 2

Reset to default
1

Also look into this tool - http://markjaquith.wordpress.com/2010/07/24/plugin-installer-tool/

Improve this answer
2
  • Just to let you know, that tool doesn't seem to be working with multisite. It sounds promising, though!
    – EAMann
    Commented Apr 13, 2011 at 18:16
  • Good to know! I don't use that tool though, just aware of its existence :)
    – Ashfame
    Commented Apr 13, 2011 at 19:13
1

I think this would bring up some major security issues, look at all the malware you find in "free theme" mills.

Improve this answer
1
  • Not on its own. Even the most malicious system in those free theme mills still needs to be installed by an administrator. Allowing for remote installation would just make it easier for admins to invite the bad guys in to their sites, it wouldn't necessarily expose them to more risk. You can download and install a malware-infected plugin already, it's just a multi-step process.
    – EAMann
    Commented Apr 14, 2011 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.