[wp-trac] [WordPress Trac] #59631: Despite using Update URI Plugin header, WP still tries to fetch the Update notes from WP org

[WordPress Trac]

#59631: Despite using Update URI Plugin header, WP still tries to fetch the Update
notes from WP org
--------------------------+------------------------------
 Reporter:  bedas         |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  General       |     Version:  6.3.3
 Severity:  normal        |  Resolution:
 Keywords:  2nd-opinion   |     Focuses:  administration
--------------------------+------------------------------

Old description:

> Despite setting a Plugin Header
> [https://make.wordpress.org/core/2021/06/29/introducing-update-uri-
> plugin-header-in-wordpress-5-8/ `Update URI` directive WP still will try
> to fetch the Update information (changelog) from a  WP Org plugin.
>
> And when filtering the `url` with
> [https://developer.wordpress.org/reference/hooks/update_plugins_hostname/
> `update_plugins_{hostname}`] , it will simply load an instance of the
> `Add new` plugin screen in the ThickBox loaded when clicking `View
> version vx.x.x details`
>
> I am quite sure I do not miss anything, as I read through all the
> (undocumented) new feature announcements.
>
> This is a minimal code you need to replicate the issue:
>
> 1. Update plugin header directive to use `Update URI: https://domain.tld`
> 2. Either hook into `update_plugins_{hostname}` and pass a `version`
> higher than your currently installed one, or
> 2a. Hook into `pre_set_site_transient_update_plugins` and pass a new
> `new_version` higher than your currently installed one
> 3. Of course make sure you do actually have a remote update
> ==> You could also just edit the database entry of
> `_site_transient_update_plugins` to trigger the "has update" alert in the
> plugins list...
>
> All this makes the Update URI pretty much dysfunctional (in the sense
> that it is not really useful at all) and the developer still needs to
> manually filter the ThickBox content for the "View update details" or
> even for the "Plugin details"
> And the documentation about all this is either inexistent or very limited
> (opened a separate issue about ''that'' [here

New description:

 Despite setting a [https://make.wordpress.org/core/2021/06/29/introducing-
 update-uri-plugin-header-in-wordpress-5-8/ Plugin Header] Update URI
 directive WP still will try to fetch the Update information (changelog)
 from a WP Org plugin.

 And when filtering the url with
 [https://developer.wordpress.org/reference/hooks/update_plugins_hostname/
 update_plugins_{hostname}] , it will simply load an instance of the "Add
 new plugin" screen in the ThickBox loaded when clicking "View version
 vx.x.x details"

 I am quite sure I do not miss anything, as I read through all the
 (undocumented) new feature announcements.

 This is a minimal approach you need to replicate the issue:

 - Update plugin header directive to use `Update URI: https://domain.tld`
 - Either hook into `update_plugins_{hostname}` and pass a version higher
 than your currently installed one, **or**
 - Hook into `pre_set_site_transient_update_plugins` and pass a new
 `new_version` higher than your currently installed one

 Of course make sure you do actually have a remote update to be shown.
 ==> You could also just edit the database entry of
 `_site_transient_update_plugins` to trigger the "has update" alert in the
 plugins list...

 All this makes the `Update URI` pretty much dysfunctional (in the sense
 that it is not really useful at all) and the developer still needs to
 manually filter the ThickBox content for the "View update details" or even
 for the "Plugin details".
 And the documentation about all this is either inexistent or very limited
 (opened a separate issue about that [https://github.com/WordPress
 /Documentation-Issue-Tracker/issues/1194 here]

 IMO, passing a custom Update URI should completely unhook all Callisto the
 WP Org Api and either not allow to "view details" at all, or at least
 provide some ways to populate that window with custom details (or at least
 read from the plugin data, which it does not: it reads from remote).

--

Comment (by alexstine):

 Updated description per request here:
 https://wordpress.slack.com/archives/C02QB8GMM/p1698662803176509?thread_ts=1697671642.297739&cid=C02QB8GMM

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/59631#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform