| 1 | | @Ipstenu - thanks for clearing this up. As I have a partnership with PayPal and did many PayPal integrations, I can confirm that the most secure way for this, is to generate SHA2-512 or RSA *.cert file for each plugin after it is released and keep that file in plugins folder. The cert will ensure that request is coming from that exact plugin. It should be an URL of W.org and plugin's admin dashboard image icon checksum or Plugin/Plugin.php (main file with meta description) or just a meta description checksum. It won't be a checksum of whole zip, but at least of that one thing it could be. Otherwise I can how hack any plugin of W.org putting there random information and submitting to report, even maybe '1.0-EVIL' version to i.e. bbPress. And this will be see on reports screen for everyone, as I can print there any message I want with version as long as it match the Semver rule, and Semver allows to name the release. So that's a security risk. |
| | 1 | @Ipstenu - thanks for clearing this up. As I have a partnership with PayPal and did many PayPal integrations, I can confirm that the most secure way for this, is to generate SHA2-512 or RSA *.cert file for each plugin after it is released and keep that file in plugins folder. The cert will ensure that request is coming from that exact plugin. It should be an URL of W.org and plugin's admin dashboard image icon checksum or Plugin/Plugin.php (main file with meta description) or just a meta description checksum. It won't be a checksum of whole zip, but at least of that one thing it could be. Otherwise I can now hack any plugin of W.org putting there random information and submitting to report, even maybe '1.0-EVIL' version to i.e. bbPress. And this will be see on reports screen for everyone, as I can print there any message I want with version as long as it match the Semver rule, and Semver allows to name the release. So that's a security risk. |