Possible Security Issue - Private Theme Repos about git-updater HOT 7 CLOSED

Actually this is for themes or plugins. GitHub's token providing read access shouldn't cause any issues as it's only read access and you control who gets the theme or plugin. Plus you can revoke it at any time.

Bitbucket private repos currently do not download and install correctly based upon Basic Authentication. At this time there's no other easy way to do this in Bitbucket. Any other solution providing read only access to the repo using some sort of token endpoint would be welcome.

from git-updater.

In answer to last question, not without disabling updating.

from git-updater.

I had the same question in my mind. I use bitbucket private rep too. It is too risky to leave these credentials information in the file. If i invite another account to the rep with read only access will it work?

thank you for this great work.... i really appreciate.

from git-updater.

Bitbucket doesn't seem to provide a simple way do this. OAuth requires the user to login to Bitbucket.org and basic authentication seems to be the only way to access a private repo. Unfortunately the bigger problem is that I can't seem to download and install an update from a Bitbucket private repo. See issue #59

Ideally if Bitbucket used some sort of access token like GitHub has it would be better. In the plugin's current state it will notice that a private repo had an update but can install it.

Yes, it is a security issue but what other way is there to access a private repo's data from the command line?

from git-updater.

you want username and password parameter to access private repository on bitbucket. But, why you require to place this configuration on style.css?

Other way to securing password, i think you can make rules such as create variable in function.php that containing username and password. like a define( 'BITBUCKET_PASSWORD', 'secreet_password' ); it's look more secure. Correct me if I'm wrong.

thanks for this great plugin...

from git-updater.

The problem is that even with the user/pass, Basic Authentication, Bitbucket throws an error and will not allow the download. See #59

Recent comments by Bitbucket devs are the following. https://bitbucket.org/site/master/issue/1087/private-repository-public-downloads-bb-733

changed status to wontfix
We have decided that we will not be implementing public downloads for repos with private source. Our goal is to build a product where folks collaborate around writing source code and not build a distribution platform for binary files. There are several low cost services that are optimized for distributing binary files, such as Amazon S3 or Rackspace which we recommend.
Respectfully, Justen -- Bitbucket product manager

Given this it doesn't look like support for Bitbucket private repos will ever be available. Sorry.

from git-updater.

See #112 for a Settings Page. Hopefully this will put an end to potential security issues.

from git-updater.