Join GitHub today
Add option to disable plugin upload #11329
It could be good to have an option to disable plugin upload, maybe it could be even disabled by default (to be decided). Most users likely will never need it so good to make UI simpler etc. We would also need to update some FAQs.
It can be already disabled via
FYI: Only logged in super users can upload plugins, nothing will change there.
Will be good to decide on this soon. Administrators of a Piwik server would likely not expect Super Users to be able to execute code on servers. I think it would make a lot of sense to prevent RCE (remote code execution) by default for Super users, as it would be consistent with our high security standards and overall practises.