Skip to content

Support installing plugins from single PHP file URLs #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Copilot wants to merge 19 commits into
base: main
Choose a base branch
from
Open

Support installing plugins from single PHP file URLs #486

Copilot wants to merge 19 commits into from
+371 −3

Conversation

Copy link
Contributor

Copilot AI commented Jan 19, 2026 •
edited
Loading

Implementation Plan for Single PHP Plugin File Installation

  • Understand current implementation and test structure
  • Add detection for single PHP file URLs in CommandWithUpgrade.php
  • Add logic to download and save single PHP files to plugins directory
  • Handle plugin naming from single PHP files
  • Add Behat tests for single PHP plugin file installation
  • Add test for --force flag with PHP files
  • Update documentation in Plugin_Command
  • Address code review feedback (extract helper method, sanitize URLs, validate extension)
  • Add security validations (path traversal protection, early filename validation)
  • Improve UX (show download message before downloading)
  • Fix security issues (proper path validation, require valid plugin headers)
  • Ensure plugin directory exists before validation
  • All static analysis checks pass
  • Add support for GitHub Gist page URLs (gist.github.com format)
    • Detect gist.github.com URLs and extract gist ID
    • Fetch gist metadata from GitHub API
    • Find first PHP file in the gist
    • Convert to raw URL and proceed with installation
    • Add test for gist page URL format
  • Improve error handling and validation
    • Add specific error handling for HTTP codes (401, 500, 503)
    • Add null check before calling build_rate_limiting_error_message()
    • Verify directory creation after wp_mkdir_p()
    • Fix regex to properly match uppercase hex digits in gist IDs
  • Support anonymous gists
    • Make username optional in gist URL regex to support anonymous gists
  • Case-insensitive extension checks
    • Convert extensions to lowercase in all PHP extension validations
  • Ready for final review
Original prompt

This section details on the original issue you should resolve

<issue_title>Links to single plugin PHP file should work with plugin install</issue_title>
<issue_description>When using wp plugin install <URL>, WP-CLI currently assumes that the URL is pointing to a ZIP file of a plugin.

This command should also work with a URL to a single PHP plugin file, so that it can for example directly install plugins from GitHub Gists:

Example of such a command that should just work:

wp plugin install --activate https://gist.githubusercontent.com/westonruter/dec7d190060732e29a09751ab99cc549/raw/d55866c2fc82ab16f8909ce73fc89986ab28d727/pwa-manifest-short-name.php

/cc @westonruter (whose numerous Gist plugins make me want to implement the above)</issue_description>

Comments on the Issue (you are @copilot in this section)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI and others added 6 commits January 19, 2026 10:08
@swissspidy
Add support for installing plugins from single PHP file URLs
da838b3 
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
@swissspidy
Add documentation and additional tests for PHP file installation
1f1924d 
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
@swissspidy
Address code review feedback: add validation and improve code structure
075cb79 
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
@swissspidy
Add security validations for path traversal and improve UX with downl…
0b4d7aa 
…oad message timing

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
@swissspidy
Fix security validations: properly check path traversal and validate …
78e54f7 
…plugin headers

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
@swissspidy
Optimize: check file existence before download and simplify path vali…
82f7819 
…dation

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Copilot AI changed the title [WIP] Add support for installing plugins from PHP file URLs Support installing plugins from single PHP file URLs Jan 19, 2026
Copilot AI requested a review from swissspidy January 19, 2026 10:20
@github-actions github-actions bot added command:plugin-install Related to 'plugin install' command scope:testing Related to testing labels Jan 19, 2026
@swissspidy
Copy link
Member

swissspidy commented Jan 19, 2026

@copilot Make sure wp plugin install --activate https://gist.github.com/westonruter/dec7d190060732e29a09751ab99cc549 works too and add a test for that

@codecov
Copy link

codecov bot commented Jan 19, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 61.90476% with 48 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/WP_CLI/CommandWithUpgrade.php 61.90% 48 Missing ⚠️

📢 Thoughts on this report? Let us know!

@swissspidy

This comment was marked as resolved.

Sign in to view
@swissspidy

This comment was marked as resolved.

Sign in to view
@swissspidy
Add support for GitHub Gist page URLs (gist.github.com)
551fe3e 
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

This comment was marked as resolved.

Sign in to view
@swissspidy swissspidy requested a review from Copilot January 19, 2026 16:09

This comment was marked as resolved.

Sign in to view

swissspidy and others added 3 commits January 19, 2026 17:18
@swissspidy
Update src/WP_CLI/CommandWithUpgrade.php
3a4d190 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@swissspidy
Update src/WP_CLI/CommandWithUpgrade.php
584d505 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@swissspidy
Update src/WP_CLI/CommandWithUpgrade.php
9f699f1 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@swissspidy swissspidy requested a review from Copilot January 19, 2026 17:05
@swissspidy

This comment was marked as resolved.

Sign in to view
gemini-code-assist[bot]

This comment was marked as resolved.

Sign in to view

This comment was marked as resolved.

Sign in to view

@swissspidy
Update src/WP_CLI/CommandWithUpgrade.php
232e96b 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@swissspidy
Improve error handling and validation in gist URL processing
881032e 
- Add specific error handling for HTTP codes 401, 500, 503
- Add fallback for malformed rate limit responses
- Verify plugin directory creation after wp_mkdir_p()
- Fix regex pattern to properly match uppercase hex in gist IDs
- Add catch-all for unexpected HTTP status codes

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
swissspidy
swissspidy reviewed Jan 22, 2026
View reviewed changes
swissspidy
swissspidy reviewed Jan 22, 2026
View reviewed changes
swissspidy
swissspidy reviewed Jan 22, 2026
View reviewed changes
@swissspidy
Support anonymous gists by making username optional in regex
aa00d38 
Anonymous gists don't have a username in the URL path (e.g.,
gist.github.com/1234567890abcdef). Updated regex to make the username
segment optional using non-capturing group (?:[^/]+/)? so both
user-owned and anonymous gists are supported.

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Copilot AI requested a review from swissspidy January 22, 2026 11:43
@swissspidy
Make PHP extension checks case-insensitive
aadf613 
Convert extension to lowercase before comparison in all PHP extension
checks to handle files with uppercase extensions (e.g., .PHP, .Php).
This makes the validation more robust and consistent across:
- Sanitized filename validation
- URL path detection
- Gist file filtering

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
wojsmol
wojsmol reviewed Jan 22, 2026
View reviewed changes
src/WP_CLI/CommandWithUpgrade.php
}

// Find PHP files in the gist
$php_files = [];
Copy link
Contributor

@wojsmol wojsmol Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we use short array syntax in WP-CLI?

Copy link
Member

@swissspidy swissspidy Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes!

@swissspidy swissspidy marked this pull request as ready for review January 22, 2026 12:44
@swissspidy swissspidy requested a review from a team as a code owner January 22, 2026 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@swissspidy swissspidy Awaiting requested review from swissspidy

+2 more reviewers

@wojsmol wojsmol wojsmol left review comments

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

@swissspidy swissspidy

Copilot code review Copilot

Labels

command:plugin-install Related to 'plugin install' command scope:testing Related to testing

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Links to single plugin PHP file should work with plugin install

3 participants

@swissspidy @wojsmol