CUNY Academic Commons

Here's the URL - https://wircuny.commons.gc.cuny.edu/getting-stared/

Just an FYI, the user just replied

"FYI: I did find WPForms as an option on AC, and it was live for a time on our site. But then it disappeared. I believe it was public - other colleagues tested, etc. In any case, it sounds like Gravity Forms is a better bet, so I’ll try that one instead."

Boone, can you double-check and see if the WPForms plugin was ever installed on the Commons? I'm quite sure it wasn't, but I might be overlooking something.

I looked through the git history in a few different ways and I also didn't see anything.

Looks like the WPForms plugin was installed by either the basic or zerif-lite themes.

• kirki - date modified is August 15th. Looks like this one was installed via the Airi theme's Customizer:

access.log.2025_08_15.87:"146.111.30.210 - - [[15/Aug/2025:20:56:06 +0000]] "GET /wp-admin/update.php?_wpnonce=98b5f793a9&action=install-plugin&plugin=kirki HTTP/2" 200 15319 "https://creatures2.commons.gc.cuny.edu/wp-admin/customize.php?theme=airi&return=https%3A%2F%2Fcreatures2.commons.gc.cuny.edu%2Fwp-admin%2Fthemes.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "creatures2.commons.gc.cuny.edu"" 

• one-time-login - date modified is January 17th. Cannot find a reference to this one in our codebase or in the access logs.

When we were still hosted at the GC, we locked down the filesystem to prevent unintended plugin installs, but it looks like Reclaim's set up allows for these types of plugin installs. Do we want to allow themes to install plugins?

Aha, that's it. Once or twice I have noticed these rogue plugins during a deployment, and I've deleted them.

I would prefer not to allow themes to install plugins. We could potentially set this up using restrictive file permissions, but perhaps there's also a way to do this using WP itself? Ray, can you think of a way we could short-circuit it?

Here's an easy way to short-circuit installing plugins:

/**
 * Do not allow installing any content if not using WP-CLI.
 */
add_filter(
    'upgrader_pre_download',
    function( $retval ) {
        if ( defined( 'WP_CLI' ) ) {
            return $retval;
        }

        return new WP_Error( 'no_install', 'Installing plugins is not allowed on the Commons. If you need a specific plugin, please <a href="mailto:commonshelpsite@gmail.com">contact our help desk</a> and make a request.' );
    },
    99
);

I've added an error message for installation screens that support displaying a message. Let me know if the message needs to be tweaked.

I love this - thanks, Ray!