From: Luigi Pirelli [lui...@gmail.com]
Sent: Thursday, January 25, 2018 10:38 PM
To: Daniel Silk
Cc: qgis-developer@lists.osgeo.org
Subject: Re: [QGIS-Developer] Mitigating security risks of the Official Plugin 
Repository

> as you can see reading the code in
> https://github.com/qgis/QGIS/blob/release-2_18/python/pyplugin_installer/installer_data.py#L316-L326
>
> repos are get from Settings (that you can install a custom one via
> custom post install scripts) and repos are compared with officialRepo
> array that is global scope var that you can and set via python
>
> import pyplugin_installer
> print pyplugin_installer.installer_data.officialRepo
> (u'QGIS Official Plugin Repository',
> 'https://plugins.qgis.org/plugins/plugins.xml',
> 'https://plugins.qgis.org/plugins')
>
> because it's python you can overload/alias almost everithing, also
> that function that have hardcoded params

Thanks Luigi,

If I do:

import pyplugin_installer

pyplugin_installer.installer_data.officialRepo = (
    QCoreApplication.translate(
        'QgsPluginInstaller',
        'QGIS Official Plugin Repository'),
    new_url,
    deprecated_url,
)

and also:

QSettings().setValue('Qgis/plugin-repos/QGIS Official Plugin Repository/url', 
new_url)

in my startup script then the official repository is successfully
replaced by our internal repository. Great!

> btw If you find useful an enhancement, please file a PR with you
> general solution that can be useful to other users.

If I submitted a PR that added a filter for trusted plugins similar to
the filters for experimental and deprecated plugins, could that only
be added to QGIS 3.2 (as a new feature)? Not 2.18?

Cheers
Daniel

________________________________

This message contains information, which may be in confidence and may be 
subject to legal privilege. If you are not the intended recipient, you must not 
peruse, use, disseminate, distribute or copy this message. If you have received 
this message in error, please notify us immediately (Phone 0800 665 463 or 
i...@linz.govt.nz) and destroy the original message. LINZ accepts no 
responsibility for changes to this email, or for any attachments, after its 
transmission from LINZ. Thank You.
_______________________________________________
QGIS-Developer mailing list
QGIS-Developer@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer

Reply via email to