TGM Plugin Activation is a PHP library that allows you to easily require or recommend plugins for your WordPress themes (and plugins). It allows your users to install, update and even automatically activate plugins in singular or bulk fashion using native WordPress classes, functions and interfaces. You can reference bundled plugins, plugins from the WordPress Plugin Repository or even plugins hosted elsewhere on the internet.
Since mid-February we offer a "Custom TGMPA Generator". From now on, that is the preferred way for downloading your copy of TGMPA for use in a theme or plugin. If you download TGMPA using the Custom TGMPA Generator and indicate that it is for a theme which will be published on wordpress.org, you will receive a copy which will pass the Theme Check review.
You can find the Custom TGMPA Generator on the download page of the website. For more information, read the related blog post.
publish_posts
(=Author) capability. This capability is however filterable using the new tgmpa_show_admin_notice_capability
filter. Thanks Stanislav Khromov, Gary Jones, Mickey Kay, Ollie Treend for suggesting. #190, #414, #489, #507
Improved some text strings and translator messages. Props Rami. #516
Added translator messages for all strings with variable replacement.#563
Added load_textdomain()
calls. #521
Added translations for Brazilian Portuguese, Croatian, Czech, Dutch, French, German, Russian and Swedish #450, #574, #570, #465, #524, #528, #543, #561 with grateful thanks to Elvis Henrique Pereira, Denis Žoljom, Karolína Vyskočilová, geoclaps, Hedi Chaibi, Marciel Bartzik, Vladislav Burlak and Lewis Porter. Additionally translations for Australian English, Canadian English, British English, Esperanto, Spanish, Hebrew, Italian, Romanian and Serbian were added based on existing translations available in GlotPress. #564
Altogether, this means that for the first version of TGMPA which ships with translation files, we're covering 17 locales, which is awesome! More translations are of course welcome, so please send the .po file(s) in as a pull request.
Please note: If you download TGMPA using the custom generator and indicate it's for a theme to be hosted on wordpress.org, you will receive a version without the load_textdomain()
calls or the translation files.
Theme check rules dictate that you should only use one textdomain in your theme and the localization calls will be adjusted to use your theme's textdomain.
As most TGMPA strings have a lot of translations available in GlotPress already, this should not cause any real issues.
Fatal error: Call to protected TGM_Plugin_Activation::__construct()
error and other compatibility issues when both TGMPA 2.5+ as well as TGMPA 2.3.6- would be loaded by different themes and plugins.Take note: We do NOT support 2.3.6 anymore and highly discourage its use. Any themes and plugins still using TGMPA 2.3.6 or less should upgrade as soon as possible. All the same, the end-user should not be confronted with white screens because of it, so this hot fix should prevent just that.
Fixes potential Fatal error: Call to undefined method TGM_Utils::validate_bool()
errors caused by a conflict with the Soliloquy plugin.
This is a major update which brings some interesting new features and fixes tons of bugs. This version of TGMPA is brought to you by Thomas Griffin with graceful thanks to Gary Jones and our new core-team member Juliette Reinders Folmer for the majority of the changes.
With this release the TGMPA library has moved to its own organisation on GitHub. From now on you can find it at TGMPA/TGM-Plugin-Activation.
The website has also been given some love. You can now find detailed information about the configuration options, FAQs and more at: http://tgmpluginactivation.com/
TGMPA will start providing localized text strings soon. If you already have translations of our standard strings available, please help us make TGMPA even better by giving us access to these translations or by sending in a pull-request with .po file(s) with the translations. A .pot file to get you started is now available in the GitHub repository.
Enhancement: Full support for update work-flow.
true
for a plugin.#381, #192, #197 Props Zauan/Hogash Studio, Christian, Franklin Gitonga, Jason Xie, swiderski for their preliminary work on this which inspired this full-fledged implementation.
Enhancement: Better support for GitHub hosted plugins.
Previously using standard GitHub packaged zips as download source would not work as, even though the plugin would be installed, it would not be recognized as such by TGMPA because of the non-standard directory name which would be created for the plugin, i.e. my-plugin-master
instead of my-plugin
. A work-around for this has been implemented and you can now use GitHub-packaged master
branch or release zips to install plugins. Have a look at the example.php
file for a working example.
One caveat: this presumes that the plugin is based in the root of the GitHub repo and not in a /src
or other subdirectory.
#327, #280, #283 Thanks Dan Fisher and Luis Martins for reporting/requesting this enhancement.
Enhancement: New optional plugin parameter is_callable
.
Some plugins may have a free and a premium version using different slugs. Using the is_callable
plugin parameter allows for the premium version to be recognized, even though the slug is set to the free version slug. Have a look at the example.php
file for a working example.
For more information on what is considered a callable
, please refer to the Codex on callbacks.
Admin Page improvements:
WP_List_Table
#227. Props Shiva Poudel.Admin notices improvements:
switch_theme
was only applied for the current user, not for all users. #246
Bulk Installer:
Theme Check compatibility:
add_theme_page()
function. See the theme review meeting notes for further information on this decision. #315
Miscellaneous fixes:
is_admin() returns true
). #357 Also most TGMPA actions will now only be hooked in if there's actually something to do for TGMPA. #381
self_admin_url()
instead of admin_url()
or network_admin_url()
. #255, #171
I18N improvements:
New action and filter hooks for TGMPA:
tgmpa_load
- filter can be used to overrule whether TGMPA should load. Defaults to loading only when on the WP back-end when not DOING_AJAX
. Typical use: add_filter( 'tgmpa_load', '__return_true' );
.tgmpa_admin_menu_args
- filter can be used to filter the arguments passed to the function call adding the TGMPA (sub) menu page.tgmpa_notice_rendered_action_links
- filter can be used to filter the complete html output for the admin notice action links. This is in addition to the tgmpa_notice_action_links
filter which already existed and allows for filtering of the individual action links.tgmpa_table_data_item
- filter can be used to modify plugin data for a single plugin which is ready for the TGMPA table output.tgmpa_table_data_items
- filter can be used to modify plugin data for all plugins which is ready for the TGMPA table output. Example use: changing the sort order of the plugins.tgmpa_table_columns
- filter can be used to add/remove table columns from the TGMPA table view.tgmpa_{$prefix}plugin_action_links
- filter mirrors the WP core {$prefix}plugin_action_links filter but for the TGMPA page.tgmpa_update_bulk_plugins_complete_actions
- filter mirrors the WP core update_bulk_plugins_complete_actions filter but for TGMPA bulk actions.tgmpa_after_plugin_row_{$item['slug']}
- action similar (but not the same) as the WP core after_plugin_row_{$plugin_file} action. Can be used to add information to a plugin row in the TGMPA table.#188, #226, #300, #357, #362, #381, #388, #389, #390 Props Zack Katz and the TGMPA team.
Housekeeping:
default_path
for local prep-packaged plugins. #203, #332 Props @jrfnl. Thanks @pavot and @djcowan for reporting.screen_icon()
function which was deprecated in WP 3.8. #244, #224, #234. Props @NateWr. Thanks @hamdan-mahran and @InsertCart for reporting.Security release to improve escaping for URLs and attributes.
https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/ explains how plugins were susceptible to potential XSS attacks. The announcement regards add_query_arg()
and remove_query_arg()
when the optional second argument is not given, resulting in a default of $_SERVER['REQUEST_URI']
.
TGMPA used the second argument for most instances, most often with an admin URL. While the admin URL functions are filterable, taking advantage of the lack of escaping means being able to apply a filter (by editing a theme or plugin) to form a malicious URL, and not just sending a crafted GET request.
We did have at least one instance where the second arg was not provided, and the resulting URL was not being escaped. This has been fixed in 2.4.1.
tgmpa
and remove all notices dealing with textdomain and translation issues._get_plugin_basename_from_slug
method now checks for exact slug matches to prevent issues with plugins that start with the same slug.Private Repository
in the list table output.add_submenu_page
has been changed to add_theme_page
for better theme check compatibility.parent_menu_slug
and parent_menu_url
for $config options (see above).dismissable
config property. When set to false, nag cannot be dismissed.dismiss_msg
used in conjunction with dismissable
. If dismissable
is false, then if dismiss_msg
is not empty, it will be output at the top of the nag message.class_exists
check for TGMPA).admin_url
to network_admin_url
to add better support for MultiSite (falls back gracefully for non-MultiSite installs).