Changeset 14979

Timestamp:

07/17/2026 04:22:01 PM (3 weeks ago)

Author:

obenland

Message:

Plugin Directory: Better prevention against duplicate plugin submissions

Props frantorres, obenland, timse201.
Closes ​https://github.com/WordPress/wordpress.org/pull/698.

Location:

sites/trunk/wordpress.org/public_html/wp-content

Files:

• plugins/plugin-directory/shortcodes/class-upload.php (modified) (3 diffs)
• themes/pub/wporg-plugins-2024/js/upload.js (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php

@@ -98 +98 @@
                         )
                 ) {
-                        $for_plugin    = absint( $_POST['plugin_id'] ?? 0 );
-                        $upload_result = $uploader->process_upload( $for_plugin );
+                        $for_plugin = absint( $_POST['plugin_id'] ?? 0 );
+
+                        // Lock to prevent duplicate submissions from double-clicks or page reloads
+                        $lock_key = 'plugin_upload_lock_' . get_current_user_id() . '_' . $for_plugin;
+                        if ( false === wp_cache_add( $lock_key, time(), 'wporg-plugins', 5 * MINUTE_IN_SECONDS ) ) {
+                                $upload_result = new \WP_Error(
+                                        'upload_in_progress',
+                                        __( 'Your previous upload is still being processed. Please wait a moment before trying again.', 'wporg-plugins' )
+                                );
+                        } else {
+                                $upload_result = $uploader->process_upload( $for_plugin );
+                                wp_cache_delete( $lock_key, 'wporg-plugins' );
+                        }
 
                         if ( is_wp_error( $upload_result ) ) {
@@ -369 +380 @@
                                                                         </label>
 
-                                                                        <input class="upload-button wp-block-button__link" type="submit" value="<?php esc_attr_e( 'Upload', 'wporg-plugins' ) ?>"/>
+                                                                        <input class="upload-button wp-block-button__link" type="submit" value="<?php esc_attr_e( 'Upload', 'wporg-plugins' ); ?>" data-uploading-label="<?php esc_attr_e( 'Uploading…', 'wporg-plugins' ); ?>"/>
                                                                 </form>
                                                                 <?php
@@ -630 +641 @@
                                 </p>
 
-                                <input id="upload_button" class="wp-block-button__link" type="submit" value="<?php esc_attr_e( 'Upload', 'wporg-plugins' ); ?>"/>
+                                <input id="upload_button" class="wp-block-button__link" type="submit" value="<?php esc_attr_e( 'Upload', 'wporg-plugins' ); ?>" data-uploading-label="<?php esc_attr_e( 'Uploading…', 'wporg-plugins' ); ?>"/>
                         </form>
                 <?php endif; // $can_submit_new_plugin

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/js/upload.js

@@ -50 +50 @@
         } );
 
+        // Prevent duplicate submissions by disabling the submit button
+        $( 'form.plugin-upload-form' ).on( 'submit', function() {
+                var $button = $(this).find( 'input[type="submit"]' ),
+                        uploadingLabel = $button.data( 'uploadingLabel' );
+
+                $button.prop( 'disabled', true );
+
+                if ( uploadingLabel ) {
+                        $button.val( uploadingLabel );
+                }
+        } );
+
 })( jQuery );