WordPress.org

Making WordPress.org

Opened 16 months ago

Closed 16 months ago

Last modified 16 months ago

#5351 closed enhancement (fixed)

Plugin Security - Notify plugin committers when a new committer is added

Reported by: dd32 Owned by: dd32
Milestone: Priority: normal
Component: Plugin Directory Keywords:
Cc:

Description

To ensure that plugin authors are aware of what's happening with the plugin they're a committer for, we should email existing committers when a new committer is added to a plugin they're a committer for.

The list of committers for a plugin is fairly hidden, and unless an author was to actually look at the list, it's impossible to know that another user has been added until they receive a commit notification.

This would primarily prevent a compromised account being used to add a committer.

Suggested Email that needs some wording work:

From: WordPress Plugins <plugins@...>
Subject: New Committer added to {$plugin_name}

G'Day {$user_login}!

{$new_committer} has been added as a committer to {$plugin_name} by {$committer_who_added_user}.

The following people now have write-access to {$plugin_name}:
 * {$me}
 * {$myself}
 * {$you}

You can manage this list at {$url}.

If you believe this was in error or didn't perform this action yourself,
please contact the Plugins Team immediately and ensure that your password is secure.

-- WordPress Plugins Team

Change History (9)

#1 follow-up: @Ipstenu
16 months ago

I AM FOR THIS.

Can we also do it for the following:

  • adding new 'support' people
  • changing plugin OWNER

(And can we auto-NOT email people if the action was done by a plugin admin? We move things around to fix 'em on the QT for folks and that would be a lot of noise).

#2 in reply to: ↑ 1 @dd32
16 months ago

Replying to Ipstenu:

  • adding new 'support' people
  • changing plugin OWNER

Yep! That sounds reasonable enough.

And can we auto-NOT email people if the action was done by a plugin admin?

Oh I agree on that front :)
They shouldn't get a new-committer email post-approval when the approval process adds them as a committer either.

#4 @dd32
16 months ago

  • Owner set to dd32
  • Resolution set to fixed
  • Status changed from new to closed

In 10121:

Plugin Directory: Add a notification email to committers when a new committer or support rep is added.

Fixes #5351.

#5 @dd32
16 months ago

In 10122:

Plugin Directory: Migrate the Plugin Transferred notification email to the new Email classes.

See #5351.

#6 @dd32
16 months ago

In 10124:

Plugin Directory: Convert Plugin Approved/Rejected emails over to the new Email class.

Additionally, this causes rejected emails not to be sent to blocked users and updates the text slightly.
Props Ipstenu.

See #5351.
Fixes #5354.

#7 @dd32
16 months ago

In 10125:

Plugin Directory: Rename the classes added in [10121] and [10122].

See #5351.

#8 @dd32
16 months ago

In 10126:

Plugin Directory: Rename the classes added in [10121] and [10122].

Missed file in [10125].

See #5351.

#9 @dd32
16 months ago

In 10127:

Plugin Directory: Fix typo.

Props tobifjellner.
See #5351.

Note: See TracTickets for help on using tickets.