Security Vulnerability Affecting WordPress Plugins and Themes

Hi All,

Sorry for the delay - there’s a lot going on at the moment. I know the situation must be frustrating.

I’ve just gotten back to Gary (Gamajo) with a possible plan for a 2.4.2 release. Hopefully that will make sense. I’ll keep you updated.

@rayoflightt - the 2.5.0-alpha is just that - an alpha version that’s not ready for production yet and is likely to change. I wouldn’t recommend it at this point.

@UXbarn - the current version of TGM PA doesn’t support updates. On the previous page, Gary responded to @KrownThemes about this issue and said if someone submits a pull request to their develop branch they’ll consider it.

To all those asking whether we accept modified versions of TGM PA - we prefer people to use the official version. It’s generally a far better result (for everyone), if everyone were to use the official version and to contribute changes back to that.

That said, we do accept the modified versions that are already being used by authors. If you are using one of these, you just need to make sure that it’s secure.

@KrownThemes - regarding @bitfade’s solution: Once again, we prefer people to use TGM PA. We may possibly accept @bitfade’s solution, but we’d need to review it extensively before confirming that. We’re a little stretched right now, so we need to ask people to stick with their current solutions for the moment - but it’s something we can consider in future. (I’ll comment over there as well).

Sorry for the brief responses, everyone… I’ll get back to you when I have more news. Thanks.

Cheers,
Stephen

Anyone else notice with the recent TGM activation plug-in update v2.4.1 notice that there is an issue with using it too install plug-ins in bulk? Nothing installs just blank page. It works fine only if installing one by one just not in bulk

@senorthemes that’s old news. :slight_smile:

Newest official update 2.5.0-alpha (4 hours ago) has this error again (at least on local host):

Fatal error: Call to undefined function TGM_Bulk_Installer_Skin()

before that it was working fine.

rayoflightt said

@senorthemes that’s old news. :slight_smile:

Newest official update 2.5.0-alpha (4 hours ago) has this error again (at least on local host):

Fatal error: Call to undefined function TGM_Bulk_Installer_Skin()

before that it was working fine.

Are you sure? I also tested this version and it’s working fine for me.

rayoflightt said

@senorthemes that’s old news. :slight_smile:

Newest official update 2.5.0-alpha (4 hours ago) has this error again (at least on local host):

Fatal error: Call to undefined function TGM_Bulk_Installer_Skin()

before that it was working fine.

If you think there’s a bug, please report it on GitHub repo, so that all of the TGMPA developers will see it.

StephenCronin said

Hi All,

Sorry for the delay - there’s a lot going on at the moment. I know the situation must be frustrating.

I’ve just gotten back to Gary (Gamajo) with a possible plan for a 2.4.2 release. Hopefully that will make sense. I’ll keep you updated.

Sorry for the brief responses, everyone… I’ll get back to you when I have more news. Thanks.

Cheers,
Stephen

Totally lost, so what version do we download? Or are we waiting for a release (i.e. v2.4.2)?

Thanks,

Leo

UXbarn said

@Gamajo

Would it be possible for you to add the “update” feature for TGMPA? I have been using the modified version from this thread: Envato Forums and it works great.

Anyway, since it is required to use the latest version of TGMPA, I have downloaded the official version from : GitHub - TGMPA/TGM-Plugin-Activation: TGM Plugin Activation is a PHP library that allows you to easily require or recommend plugins for your WordPress themes (and plugins). It allows your users to install, update and even automatically activate plugins in singular or bulk fashion using native WordPress classes, functions and interfaces. You can reference bundled plugins, plugins from the WordPress Plugin Repository or even plugins hosted elsewhere on the internet. , but it looks like the official one does not have the “update” feature, does it?

Do you have any plan about this feature?

Thanks. :slight_smile:

Juliette has looked at the pull requests that folks have opened for the update feature, and once integrated, there’s still some bugs that need to be addressed:

  • bulk update on installed plugin without update will re-install
  • pre-packaged update via link, says the plugin has updated, but in reality it hasn’t
  • repo found updates are not shown nor taken into account.

So, yes, the plan is to get this into develop branch for release in 2.5.0, but more work needs to be done on it first.

Gamajo said

For those of you who have been kind enough to test, and have been running 2.4.1, please give the 2.4.2 (pre-release) branch a try: The class file is at TGM-Plugin-Activation/class-tgm-plugin-activation.php at 2.4.2 · TGMPA/TGM-Plugin-Activation · GitHub .

If the early signs are it fixes the bulk installing for the majority of people, we’ll put this out later today or tomorrow as a tagged 2.4.2 final.

The changes, with whitespace changes ignored, can be found here: Comparing 2.4.1...2.4.2 · TGMPA/TGM-Plugin-Activation · GitHub

It removes the call to the deprecated screen_icon() function (Theme Check flags this), fixes a couple of bulk installer bugs (bulk installer class not found and the bulk installer issue with bundled plugins that emerged in 2.4.1), and also applies a fix for honouring the default path.

Please leave any bug reports at Issues · TGMPA/TGM-Plugin-Activation · GitHub .

Works for me.

Gamajo said

For those of you who have been kind enough to test, and have been running 2.4.1, please give the 2.4.2 (pre-release) branch a try: The class file is at TGM-Plugin-Activation/class-tgm-plugin-activation.php at 2.4.2 · TGMPA/TGM-Plugin-Activation · GitHub .

This version works for me too. No bulk installation issue.

Thanks folks. I’ve had others test it too, and they agree that this version seems to work.

Consequently, and as promised, I’ve tagged and released version 2.4.2:

Thanks Gary,

That’s great! It gives us clear version for everyone to use. I’ve gone ahead and updated the original post to say the following for TGM PA:

TGM Plugin Activation class

If you use the TGM Plugin Activation class, then you need to update your item to include version 2.4.2. Previous advice was to use 2.4.1, which addressed the security concerns, but which had a problem with the bulk installer. This has been fixed in 2.4.2.

I can confirm that v2.4.2 bulk plugin install works 100% for me :slight_smile:

Thanks for the update!

i really do not understand why bulk installation from TGM 2.4.2 doesn’t work for me and works fine for all. anybody, could you share some peace of code how you’re using TGM library. I follow an example from official website and getting

Fatal error: Class ‘TGM_Bulk_Installer’ not found in class-tgm-plugin-activation.php on line 1590

only with bulk installer. Tried locally and on live hosting. PHP 5.4, WP 4.2, trying to install VisualComposer, WooCommerce and LayerSlider.

i’m hating this bug

wplab said

i really do not understand why bulk installation from TGM 2.4.2 doesn’t work for me and works fine for all. anybody, could you share some peace of code how you’re using TGM library. I follow an example from official website and getting

Fatal error: Class ‘TGM_Bulk_Installer’ not found in class-tgm-plugin-activation.php on line 1590

only with bulk installer. Tried locally and on live hosting. PHP 5.4, WP 4.2, trying to install VisualComposer, WooCommerce and LayerSlider.

i’m hating this bug

Please report it on the repo, along with the exact registration code you’re using. If you can narrow it down to it being a specific plugin, or bundled vs WPORG repo, that would be even better.

@Gamajo and all other, i’ve found a solution for me, i’ve changed line #1699

if ( ! class_exists( ‘WP_Upgrader’ ) && ( isset( $_GET[‘page’] ) && TGM_Plugin_Activation::$instance->menu === $_GET[‘page’] ) ) {

to

if ( isset( $_GET[‘page’] ) && TGM_Plugin_Activation::$instance->menu === $_GET[‘page’] ) {

now bulk installation works fine

wplab said

@Gamajo and all other, i’ve found a solution for me, i’ve changed line #1699

if ( ! class_exists( ‘WP_Upgrader’ ) && ( isset( $_GET[‘page’] ) && TGM_Plugin_Activation::$instance->menu === $_GET[‘page’] ) ) {

to

if ( isset( $_GET[‘page’] ) && TGM_Plugin_Activation::$instance->menu === $_GET[‘page’] ) {

now bulk installation works fine

Thanks for debugging, that’s really appreciated. I’ll take a look into it more.

@Gamajo was glad to help you. Sorry but i don’t have a time to use github discussions and make commits.

Thanks

@Gamajo: Thanks so much!

Hello,

I have downloaded the latest update its working fine with Bulk Installation

Regards

Adeel Abbas