Re: [Tiki-devel] Composer allowed plugin list ?

Indeed is new security stuff that came with Composer 2.2.0
https://getcomposer.org/doc/06-config.md#allow-plugins <https://getcomposer.org/doc/06-config.md#allow-plugins>

That needs to be added to the composer .json

> On 23 Dec 2021, at 18:22, Jorge Sá Pereira <jorge.pereira-NHSG37FGo5wS/6/[email protected]> wrote:
> 
> Hi Bernard,
> 
> I just added a package (on my side) and these lines were added… probably they are missing in the vendor_bundled/composer.json
> 
> "allow-plugins": {
>     "composer/installers": true,
>     "oomphinc/composer-installers-extender": true,
>     "cweagans/composer-patches": true
> }
> I’ll test this, and if that not occurs when running the setup.sh, probably it should be committed in the code.
> 
> 
> Thanks
> Jorge (Xorti)
> 
>> On 23 Dec 2021, at 12:58, Bernard Sfez via TikiWiki-devel <[email protected] <mailto:[email protected]>> wrote:
>> 
>> Hello dev,
>> 
>> On a Tik23 I updated 5 days ago I see n new error / prompt about Composer alleged plugins...
>> 
>> First time I see…
>> Someone know what this is about ?
>> 
>> Bernard
>> 
>> =====
>> 
>> Local PHP version 74 >= to required PHP version 74 - good
>> Upgrading to version 2.2.1 (2.x channel).
>> 
>> Use composer self-update --rollback to return to version 2.1.14
>> composer/installers contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins <https://getcomposer.org/allow-plugins>
>> 
>> Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y - add package to allow-plugins in composer.json and let it run immediately
>> n - add package (as disallowed) to allow-plugins in composer.json to suppress further prompts
>> d - discard this, do not change composer.json and do not allow the plugin to run
>> ? - print help
>> y
>> Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] oomphinc/composer-installers-extender contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins <https://getcomposer.org/allow-plugins>
>> y
>> Do you trust "oomphinc/composer-installers-extender" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] cweagans/composer-patches contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins <https://getcomposer.org/allow-plugins>
>> y
>> Do you trust "cweagans/composer-patches" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] Gathering patches from patch file.
>>> Tiki\Composer\RestoreVendors::restore
>>> Tiki\Composer\CleanVendorAfterVendorBundledMigration::cleanLinks
>> Installing dependencies from lock file
>> 
>> 
>> 
>> _______________________________________________
>> TikiWiki-devel mailing list
>> [email protected] <mailto:[email protected]>
>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel