Add private sites module #10333

scruffian · 2018-10-16T16:40:45Z

This adds a "Private site" module to Jetpack. The code is based on a similar plugin from WordPress.com.

Fixes #7857

Internal reference: p5XAZ9-1Pk-p2

Changes proposed in this Pull Request:

A new module to make a site private
Changes to the Jetpack interface to activate/deactivate the module

Testing instructions:

Scenario 1

Enable the private site module under Settings > Security

In wp-admin, the Site Visibility option appears disabled for private sites

Visit your site, you should still be able to see it
Visit your site in an incognito window, you should see this:

Create a new user on your site (with any role). Log in as this new user. You should be able to see the site.
Update this user to have no role on this site. Now you should see this:

At a glance dashboard widget shows that the site is private

Scenario 2

Enable the publicize module under Settings > Sharing and verify that posts are auto-posted to the connected social media account
Enable the private site module
Create a new post and verify that the new post is not auto-posted.
Disable private site module and verify that new posts are now auto-posted.

jetpackbot · 2018-10-16T16:42:24Z

	Warnings
⚠️	"Proposed changelog entry" is missing for this PR. Please include any meaningful changes

This is an automated check which relies on PULL_REQUEST_TEMPLATE. We encourage you to follow that template as it helps Jetpack maintainers do their job. If you think 'Testing instructions' or 'Proposed changelog entry' are not needed for your PR - please explain why you think so. Thanks for cooperation 🤖

Generated by 🚫 dangerJS against 6326e10

mdawaffe · 2018-10-16T23:29:47Z

This is a cool and really useful feature. It'll be nice to get it integrated, especially so that WordPress.com will have more complete information about what sites are private (right now, we do some little heuristics checks to get partial information).

For v1, I don't think we should worry about invites/members, feed authentication, or privatizing links. I think the main focus should be getting something simple in place that locks everything down (requiring authentication for normal blog views, REST API, OPML, etc., an appropriate robots.txt response, …). It'd be nice to get a list of what's important first.

I haven't tested this PR, but I'm reasonably certain that much of the more complicated stuff (particularly invites) will not be fully functional as written outside of the WordPress.com infrastructure.

Besides trimming this down to an MVP, another alternative would be to point people at an existing privacy plugin. That might cause us backward-compatibility headaches in the future (though I don't think it would be too bad), and could be an "easy" (ha!) work-around for whatever is blocked by the lack of private sites in Jetpack.

kraftbj · 2018-10-17T16:24:44Z

In terms of something existing, we often suggest https://wordpress.org/plugins/registered-users-only/ to folks by @Viper007Bond. It'll lock down just about everything, but could be smoother with REST requests.

matticbot · 2018-11-20T14:43:27Z

This PR looks like it might contain user tracking functions. We need to make sure that it is GDPR Compliant.

Rules triggering this positive scan:

Called "jetpack_activate_module" hook.

cc: @pesieminski

matticbot · 2018-11-20T14:46:00Z

This PR looks like it might contain user tracking functions. We need to make sure that it is GDPR Compliant.

Rules triggering this positive scan:

Called "jetpack_activate_module" hook.

cc: @pesieminski

matticbot · 2018-11-20T15:42:20Z

This PR looks like it might contain user tracking functions. We need to make sure that it is GDPR Compliant.

Rules triggering this positive scan:

Called "jetpack_activate_module" hook.

cc: @pesieminski

brbrr · 2018-11-20T16:00:32Z

I noticed modules/shortcodes/js/blocks/vr-block.js included in this PR. Is this block needed here?

jeherve · 2018-11-20T16:02:03Z

I noticed modules/shortcodes/js/blocks/vr-block.js included in this PR. Is this block needed here?

The file was removed from Jetpack a little while ago, so it may be a rebase gone wrong? Either way, the file should indeed be removed from that PR.

matticbot · 2018-11-20T16:58:15Z

This PR looks like it might contain user tracking functions. We need to make sure that it is GDPR Compliant.

Rules triggering this positive scan:

Called "jetpack_activate_module" hook.

cc: @pesieminski

scruffian · 2018-11-20T16:58:57Z

@brbrr yes, sorry a rebase gone wrong. fixed now.

matticbot · 2018-11-21T10:14:01Z

This PR looks like it might contain user tracking functions. We need to make sure that it is GDPR Compliant.

Rules triggering this positive scan:

Called "jetpack_activate_module" hook.

cc: @pesieminski

scruffian · 2018-11-21T10:40:49Z

I updated this to conform to the WordPress coding standards.

jeherve

I left a few notes that hopefully will help a bit.

modules/private.php

jeherve · 2018-11-21T11:27:45Z

modules/private.php

+	update_option( 'blog_public', 1 );
+}
+
+add_action( 'parse_request', 'privatize_blog', 100 );


Is this enough to make sure we block access to RSS feeds, Core's REST API, and WordPress.com's REST API requests for that site?

Updated to block the Core REST API. I guess we don't need to do that for the WordPress.com REST API as this module won't be enabled on WPCOM, since we have a different one there?

As long as the Jetpack site is connected to WordPress.com and the JSON API module is active in Jetpack (it's enabled by default and there is no easy way to deactivate it, the UI is hidden), the site's content will be available via the WordPress.com REST API. Here is an example:

https://public-api.wordpress.com/rest/v1.1/sites/53262711/posts/

It looks like they are already blocked in the WPCOM REST API:

modules/private.php

modules/private/private.php

…css file.

matticbot · 2019-05-24T05:11:33Z

scruffian, Your synced wpcom patch D27234-code has been updated.

mdawaffe

I left a few nitpicks inline.

The "At a Glance" dashboard widget is confusing in one state:

Make sure your site is public.
Go to wp-admin/ → Settings → Reading.
For "Site Visibility", check "Discourage search engines from indexing this site".
Click "Save Changes".
Go to wp-admin/ → Jetpack → Settings → Security.
For "Private site", check "Make your site private"
Go to wp-admin/ (→ Dashboard)
Look at the "At a Glance" widget. See:

This site is set to private. Make public.
Search Engines Discouraged

modules/private/private.php

modules/private/class-jetpack-private.php

… to WP_Error error code

…essage from At a glance dashboard 2. Adds a line break preceeding the 'Search engines are discouraged message'

niranjan-uma-shankar · 2019-05-27T08:33:59Z

Thanks for the input @mdawaffe .

The "At a Glance" dashboard widget is confusing in one state:

This is now fixed in ee9ac54. For a private site, the 'At a glance' dashboard widget will no longer show the "Search engines are discouraged" message.

Feedback was addressed

jeherve

This tests well for me, looks good. Let's merge this and get Beta testers to take a crack at it!

* Kick off the changelog * Add 7.3.1 * Update date and post link * changelog: add #12219 * changelog: add #12170 * changelog: add #12184 * Changelog: add #12268 * Changelog: add #12081 * Changelog: add #12323 * Changelog: add #12204 * Changelog: add #12269 * Changelog: add #12332 * changelog: add #12339 * changelog: add #12209 * Changelog: add #12319 * Changelog: add #12357 * Changelog: add #12124 * Changelog: add #12373 * Changelog: add #12252 * Changelog: add #12383 * Changelog: add #12372 * changelog: add #12337 * Changelog: add #12290 * Changelog: add #12301 * Changelog: add #12061 * Testing list: add instructions for #12061 * Changelog: add #12393 * Update minimum supported version See #12287 * Changelog: add #12406 * Testing list: add #12406 * Changelog: add #12277 * Changelog: add #12412 * Changelog: add #11318 * Changelog: add #12328 * Changelog: add #12425 * Changelog: add #12380 * Changelog: add #12428 * Changelog: add #12414 * Changelog: add #12395 * Changelog & Testing list: add #12416, #12417, #12418, and #12348 * changelog: add #12379 * Changelog: add #12341 * changelog: add #12444 * Changelog: add #12434 * Changelog: add #12454 * Changelog: add #12460 * Changelog: add #12463 * Changelog: add #12457 * Changelog / testing list: add #10333 * Changelog: add #12467 Co-authored-by: Jeremy Herve <jeremy@jeremy.hu>

scruffian requested a review from a team as a code owner October 16, 2018 16:40

scruffian self-assigned this Oct 16, 2018

scruffian force-pushed the add/private-sites branch from e87aa1c to c7139f9 Compare October 16, 2018 16:52

jeherve added [Status] In Progress [Feature] Private Sites [Pri] High labels Oct 16, 2018

jeherve added this to the 6.7 milestone Oct 16, 2018

jeherve removed this from the 6.7 milestone Oct 26, 2018

matticbot added the [Status] Needs GDPR Review label Nov 20, 2018

scruffian force-pushed the add/private-sites branch from 4275a3a to ed26f64 Compare November 20, 2018 14:45

scruffian added [Status] Needs Review To request a review from Crew. Label will be renamed soon. and removed [Status] In Progress labels Nov 20, 2018

scruffian force-pushed the add/private-sites branch from ed26f64 to d03b99c Compare November 20, 2018 15:42

jeherve added [Status] In Progress and removed [Status] Needs Review To request a review from Crew. Label will be renamed soon. labels Nov 20, 2018

scruffian force-pushed the add/private-sites branch from d03b99c to c345142 Compare November 20, 2018 16:58

jeherve reviewed Nov 21, 2018

View reviewed changes

jeherve added the [Pri] Normal label Nov 21, 2018

niranjan-uma-shankar added 5 commits May 24, 2019 10:37

Readability change

702f30f

1. Moved css to file 2. Added doc block for at a glance callback

309a031

Moved the css styling from the css file to inline style; deleted the …

65f11d3

…css file.

Post rebase, fixing conflicts

820c6eb

Rebase

7b6a5cf

niranjan-uma-shankar dismissed jeherve’s stale review via 7b6a5cf May 24, 2019 05:11

niranjan-uma-shankar force-pushed the add/private-sites branch from b6781b0 to 7b6a5cf Compare May 24, 2019 05:11

Add inline css only in the main admin page

3e9cf40

mdawaffe previously requested changes May 27, 2019

View reviewed changes

modules/private/private.php Outdated Show resolved Hide resolved

modules/private/private.php Outdated Show resolved Hide resolved

modules/private/class-jetpack-private.php Outdated Show resolved Hide resolved

modules/private/class-jetpack-private.php Outdated Show resolved Hide resolved

niranjan-uma-shankar added 2 commits May 27, 2019 13:20

1. Replace esc_attr with esc_url 2. Copy change 3. Added 'status' key…

11bd70d

… to WP_Error error code

1. For a private site, removes the 'Search engines are discouraged' m…

ee9ac54

…essage from At a glance dashboard 2. Adds a line break preceeding the 'Search engines are discouraged message'

jeherve approved these changes May 27, 2019

View reviewed changes

jeherve added [Status] Ready to Merge Go ahead, you can push that green button! and removed [Status] Needs Review To request a review from Crew. Label will be renamed soon. labels May 27, 2019

jeherve merged commit 2316b87 into master May 27, 2019

matticbot added the [Status] Needs Changelog label May 27, 2019

jeherve deleted the add/private-sites branch May 27, 2019 14:24

matticbot removed the [Status] Ready to Merge Go ahead, you can push that green button! label May 27, 2019

jeherve added [Status] Needs Testing We need to add this change to the testing call for this month's release [Status] Has Changelog and removed [Status] Needs Changelog [Status] Needs Testing We need to add this change to the testing call for this month's release labels May 27, 2019

jeherve added a commit that referenced this pull request May 27, 2019

Changelog / testing list: add #10333

de42bae

jeherve restored the add/private-sites branch June 3, 2019 13:59

scruffian deleted the add/private-sites branch June 3, 2019 17:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add private sites module #10333

Add private sites module #10333

scruffian commented Oct 16, 2018 •

edited by niranjan-uma-shankar

Loading

jetpackbot commented Oct 16, 2018 •

edited

Loading

mdawaffe commented Oct 16, 2018

kraftbj commented Oct 17, 2018

matticbot commented Nov 20, 2018

matticbot commented Nov 20, 2018

matticbot commented Nov 20, 2018

brbrr commented Nov 20, 2018

jeherve commented Nov 20, 2018

matticbot commented Nov 20, 2018

scruffian commented Nov 20, 2018

matticbot commented Nov 21, 2018

scruffian commented Nov 21, 2018

jeherve left a comment

jeherve Nov 21, 2018

scruffian Nov 23, 2018

jeherve Nov 23, 2018

scruffian Nov 26, 2018 •

edited

Loading

matticbot commented May 24, 2019

mdawaffe left a comment

niranjan-uma-shankar commented May 27, 2019

jeherve left a comment

Add private sites module #10333

Add private sites module #10333

Conversation

scruffian commented Oct 16, 2018 • edited by niranjan-uma-shankar Loading

Changes proposed in this Pull Request:

Testing instructions:

jetpackbot commented Oct 16, 2018 • edited Loading

mdawaffe commented Oct 16, 2018

kraftbj commented Oct 17, 2018

matticbot commented Nov 20, 2018

matticbot commented Nov 20, 2018

matticbot commented Nov 20, 2018

brbrr commented Nov 20, 2018

jeherve commented Nov 20, 2018

matticbot commented Nov 20, 2018

scruffian commented Nov 20, 2018

matticbot commented Nov 21, 2018

scruffian commented Nov 21, 2018

jeherve left a comment

Choose a reason for hiding this comment

jeherve Nov 21, 2018

Choose a reason for hiding this comment

scruffian Nov 23, 2018

Choose a reason for hiding this comment

jeherve Nov 23, 2018

Choose a reason for hiding this comment

scruffian Nov 26, 2018 • edited Loading

Choose a reason for hiding this comment

matticbot commented May 24, 2019

mdawaffe left a comment

Choose a reason for hiding this comment

niranjan-uma-shankar commented May 27, 2019

jeherve left a comment

Choose a reason for hiding this comment

scruffian commented Oct 16, 2018 •

edited by niranjan-uma-shankar

Loading

jetpackbot commented Oct 16, 2018 •

edited

Loading

scruffian Nov 26, 2018 •

edited

Loading