Plugin Installation: Better guard the installation flow

[cpapazoglou]

During our demo it was suggested that we should better guard our plugin installation direct url so that we avoid malicious users getting WordPress.com users to visit it and thus install a malicious wporg plugin in their site.

[cpapazoglou]

Suggestion, saving in the state that User has indeed initiated the plugin installation.

[WBerredo]

Considering we'll be able to identify that a plugin installation was not initiated by the customer(#58493), I think we can give the customer the chance to proceed with the installation, giving the idea of successful operation instead of an error.

This way the installation link could be used directly but in a safe manner.

Ex:

[cpapazoglou]

Considering we'll be able to identify that a plugin installation was not initiated by the customer(#58493), I think we can give the customer the chance to proceed with the installation, giving the idea of successful operation instead of an error.

This way the installation link could be used directly but in a safe manner.

Ex:

I like this idea @WBerredo, cc @gcsecsey

[gcsecsey]

I think this is a brilliant idea @WBerredo! 🎉

To make the implementation more straightforward, I think we should add this as a follow-up PR, after we've handled plugin icons in #58281 (comment)