Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Plugins: Improve messaging for Jetpack Scan detected errors #61068

Merged
merged 4 commits into from Feb 15, 2022

Conversation

epeicher
Copy link
Contributor

@epeicher epeicher commented Feb 14, 2022

When uploading a plugin, it is scanned using Jetpack. The previous message
was unclear, so it has been improved to a more explicit message.

Depends on D74922-code

Changes proposed in this Pull Request

  • Change the error message when Jetpack Scan reports a failure from

    Upload problem: Invalid plugin.

    to

    The uploaded file is identified as malicious.

Additionally, the displayed page offers a workaround that reads:

This plugin is identified as malicious. If you want to install the plugin, please continue by uploading the plugin again from WP Admin.

Before After
image image

Pinging to @emmnyc85 and @cavalierlife to check if the suggested message is fine 馃檪

Testing instructions

  • Apply D74922-code
  • In an Atomic site, go to https://wordpress.com/plugins/upload
  • Upload a plugin that fails, for example, this one pdh6GB-6h-p2#comment-698
  • The notification message should display The uploaded file is identified as malicious. and the displayed page should contain the message This plugin is identified as malicious. If you want to install the plugin, please continue by uploading the plugin again from WP Admin.. That page will contain two action buttons:
    • Back that will navigate to previous page
    • Continue that will re-direct to the upload plugin from the wp-admin page.

Fixes #58942

When uploading a plugin, it is scanned using Jetpack. The previous message
was unclear so it has been improved to a clearer message.
@matticbot
Copy link
Contributor

matticbot commented Feb 14, 2022

Here is how your PR affects size of JS and CSS bundles shipped to the user's browser:

Sections (~160 bytes added 馃搱 [gzipped])

name                                 parsed_size           gzip_size
marketplace                               +501 B  (+0.1%)      +86 B  (+0.0%)
woocommerce-installation                   +75 B  (+0.0%)      +24 B  (+0.0%)
themes                                     +75 B  (+0.0%)      +24 B  (+0.0%)
settings-performance                       +75 B  (+0.0%)      +24 B  (+0.0%)
settings                                   +75 B  (+0.0%)      +22 B  (+0.0%)
scan                                       +75 B  (+0.0%)      +24 B  (+0.0%)
plugins                                    +75 B  (+0.0%)      +24 B  (+0.0%)
hosting                                    +75 B  (+0.0%)      +24 B  (+0.0%)
home                                       +75 B  (+0.0%)      +27 B  (+0.0%)
backup                                     +75 B  (+0.0%)      +24 B  (+0.0%)
automated-transfer-state-middleware        +75 B  (+0.4%)      +25 B  (+0.4%)

Sections contain code specific for a given set of routes. Is downloaded and parsed only when a particular route is navigated to.

Async-loaded Components (~24 bytes added 馃搱 [gzipped])

name                                                 parsed_size           gzip_size
async-load-signup-steps-woocommerce-install-confirm        +75 B  (+0.1%)      +24 B  (+0.1%)

React components that are loaded lazily, when a certain part of UI is displayed for the first time.

Legend

What is parsed and gzip size?

Parsed Size: Uncompressed size of the JS and CSS files. This much code needs to be parsed and stored in memory.
Gzip Size: Compressed size of the JS and CSS files. This much data needs to be downloaded over network.

Generated by performance advisor bot at iscalypsofastyet.com.

Copy link
Contributor

@cpapazoglou cpapazoglou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested this and works as advertised.

Can we also do the extra mile here by changing the error message in the main content and providing the user an alternative for uploading the plugin through WP Admin?

Prior art here

if ( pluginExists ) {
return (
<EmptyContent
illustration="/calypso/images/illustrations/error.svg"
title={ null }
line={ translate(
'This plugin already exists on your site. If you want to upgrade or downgrade the plugin, please continue by uploading the plugin again from WP Admin.'
) }
secondaryAction={ translate( 'Back' ) }
secondaryActionURL={ `/plugins/upload/${ selectedSiteSlug }` }
action={ translate( 'Continue' ) }
actionURL={ `https://${ selectedSiteSlug }/wp-admin/plugin-install.php?tab=upload` }
/>
);
}

Describes a workaround to upload malicious plugins using wp-admin
@matticbot matticbot added the [Status] Needs Review The PR is ready for review. This also triggers e2e canary tests and wp-desktop tests automatically. label Feb 14, 2022
Copy link
Contributor

@cpapazoglou cpapazoglou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the feedback! That's a great improvement in UX!

Just left a minor comment regarding copy.

Co-authored-by: Harris Papazoglou <hrrsppzgl@gmail.com>
@epeicher epeicher merged commit 5c3c336 into trunk Feb 15, 2022
@epeicher epeicher deleted the update/upload-plugin-message branch February 15, 2022 09:00
@github-actions github-actions bot removed the [Status] Needs Review The PR is ready for review. This also triggers e2e canary tests and wp-desktop tests automatically. label Feb 15, 2022
@a8ci18n
Copy link

a8ci18n commented Feb 15, 2022

This Pull Request is now available for translation here: https://translate.wordpress.com/deliverables/7141787

Thank you @epeicher for including a screenshot in the description! This is really helpful for our translators.

@a8ci18n
Copy link

a8ci18n commented Feb 25, 2022

Translation for this Pull Request has now been finished.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve messaging for plugin upload failures that are due to Jetpack Scan
4 participants