Plugin Reviews Demystified

(How We Review Plugins)

Created for WordCamp Atlanta 2016

https://slides.halfelf.org/wcatl2016

So You've Submitted a Plugin

Now What?

The Submissions

Yeah, it's messy...

The Rejections...

Name Based

The Rejections...

Trademark Based

The Rejections...

Behavioral Based

Children playing the running of the bulls a bit meanly.

The Rejections...

Subject Matter Based

A grey cat with a hat on, becuase I can't figure out how to illustrate this.

The Rejections...

Seven+ Days Old

The Reviews...

Download the Plugin

That's a zip disk and if you recognize it, you're awesome.

The Reviews...

Check for Headers, License, and Copyright

The Reviews...

Check all the JS and CSS

The Reviews...

Grep for wp-(con|blog|load)

The Reviews...

Grep all the $_\[(post|get|request)\] calls

The Reviews...

Grep for SQL

The Reviews...

Read The Whole Plugin

A dog with granny glasses, reading a magazine

The Reviews...

What's Wrong?

This is hard to explain... Let me read off my list:
file paths instead of functions, collecting user data, debugging/error reporting is forced on, calling remote data without disclosing, including demo folders, allowing direct file access to plugin files, copy of another plugin, asking users to edit files, saving files in the plugin folder, not using wp_enqueue, messing with error reporting (forcing it on or off), calling external services, using fancy box 2, uncredited forks, including geoIP data files, non-gpl code, hardcoded plugin folder names, bad headers, making admin an iframe, remote loading images, installing another plugin, using isotope pre 2.2, including js files that WP already has, hardcoding private keys, license checks, no line breaks, trying to hide code, missing files, leaving in node modules, no nonces, offloading js or css, out of date libraries, using js packer code or other obfuscation, non-unique function, define or class names, not sanitizing data, submitted the same plugin twice, php sessions, php short tags, bad sql calls, tracking users, setting default timezones, too many tags, being trial ware, not calling uninstall safely, using uploadify, including vendor files you're not using, including another plugin inside yours, reinventing something WP already does, including a zip file, including timthumb, having wordpress in your domain name, or forcing credit links on.
Yes. I look for all that. Someone once accused me of 'looking for reasons to reject his plugin' and I replied 'Yes!' But really I'm looking for things you can do better, more safely, and more sanely. Not all of those are 'rejection' reasons, either. Most are 'Hey, please change this...'

The Reviews...

Install the Plugin

The Reviews...

Break-- I mean USE the Plugin

The Reviews...

Approval or Pending?

A guy with one thumb up and one thumb down.

The Reviews...

Rinse and Repeat

Plugin Reviews Demystified

(How We Review Plugins)

Created for WordCamp Atlanta 2016

So You've Submitted a Plugin

Now What?

The Submissions

Yeah, it's messy...

The Rejections...

Name Based

The Rejections...

Trademark Based

The Rejections...

Behavioral Based

The Rejections...

Subject Matter Based

The Rejections...

Seven+ Days Old

The Reviews...

Download the Plugin

The Reviews...

Check for Headers, License, and Copyright

The Reviews...

Check all the JS and CSS

The Reviews...

Grep for wp-(con|blog|load)

The Reviews...

Grep all the $_\[(post|get|request)\] calls

The Reviews...

Grep for SQL

The Reviews...

Read The Whole Plugin

The Reviews...

What's Wrong?

The Reviews...

Install the Plugin

The Reviews...

Break-- I mean USE the Plugin

The Reviews...

Approval or Pending?

The Reviews...

Rinse and Repeat

THE END

Mika "Ipstenu" Epstein

DreamHost WordPress & DreamPress Developer