Make WordPress.org

Recent Updates Toggle Comment Threads | Keyboard Shortcuts

  • Ian Dunn 11:28 pm on November 23, 2015 Permalink |  

    Planning for the 2015 Summit 

    Hey everyone, the Summit is next week, and there are a few things we need to decide on before we get there.

    Wednesday – Unconference Discussions

    The first day is unconference-style conversations. We need to think about what topics we’d like to discuss, and post them to the forums.

    There’s a few there already:

    Those are mostly about vision and policy, though, rather than technical implementation. Are there things that are more specific to Meta that we could discussion on Wednesday? Ideas to improve our workflow and tools? Ways to get more contributors involved, and to make the process easier for them? Are there any projects that are stalled and could use a discussion to jumpstart them? etc. Please post your ideas to the forums and +1 the ones you think should be discussed.

    Thursday – Work Day

    The second day is for working on projects. We need to create an agenda so that we don’t waste time at the Summit, and also figure out what kind of space we’ll need at the venue.


    We’ve got two large blocks of time to divide up and fill however we want: 9:15 am – 12:00 pm, and 1:30 pm – 4:40 pm.

    What projects do you want to work on? How much time should be devoted to them?

    I’m guessing not everyone will want/need to work on each project, so we can have multiple smaller groups working simultaneously if we want.


    There’ll be lots of open space where teams will be working most of the time, but there are also a few small, private rooms that we can reserve slots for, if we think we’ll need them.

    Does anyone think we’ll need a small private room? If so, for how many people and for how long?


    CC’ing everyone who marked Meta on their Summit registration…

    @drewapicture, @otto42, @nacin, @atimmer, @chriscct7, @dd32, @pento, @jenmylo, @joedolson, @johnjamesjacoby, @jorbin, @ryelle, @kovshenin, @obenland, @BrashRebel, @clorith, @markjaquith, @coffee2code, @stephdau@samuelsidler



  • Ian Dunn 7:47 pm on November 17, 2015 Permalink |
    Tags: Code Review, Security,   

    Security Audit for WordCamp Remote CSS Plugin 

    UPDATE: The plugin has been deployed, so please disclose any vulnerabilities privately, either on Hacker1, or by pinging me privately on Slack.

    The WordCamp Remote CSS plugin is ready to deploy, but before I do that, I want to get some extra eyes on a few potential attack vectors.

    The plugin lets organizers develop their CSS with any tools/environments/platforms they want (rather than in a browser with Jetpack’s CSS editor), and then the plugin will download a copy of the CSS file from a remote server, sanitize it, cache it locally, and enqueue it as an extra stylesheet.

    You can browse the source on GitHub. (It’ll be moved to the Meta repo before it’s deployed.)

    These are what I see as the weakest points, and why I think they’re safe:

    • validate_remote_css_url() – This makes sure the file we’re about to download meets our expectations. If this allowed any URL, it’d be open to SSRF attacks. To avoid that, only specific platforms (like GitHub) are supported. Additionally, only URLs with a .css extension are allowed.
    • output_cached_css() – This outputs the user’s CSS on the front-end, after it’s been sanitized. There’s no escaping, because it’s CSS, but it’s already been sanitized. The correct content-type header is sent, to prevent browsers from interpreting it as HTML. I guess if the database is compromised, the content could be manipulated, but if that happens then there’s probably a hundred different things the attacker could do, so I don’t think there’s really anything to do in that case.
    • webhook_handler() – This listens for notifications from webhooks that a repository has been updated, and refreshes the cache. It doesn’t require any authentication, because the worst an attacker could do would be to force us to unnecessarily refresh the cache. To avoid too many requests, though, it is rate-limited.

    Does anyone see anything I’ve missed there, or anywhere else?

    If you’d like to test it live, you’ll need to cherry pick 2955-jetpack.


    cc @kovshenin

  • Samuel Sidler 3:46 pm on November 17, 2015 Permalink |
    Tags: , , , , ,   

    Weekly i18n Chat Notes – November 17, 2015 

    Howdy again! We’ve actually been meeting the last couple of weeks but someone (aka: me) has been bad about posting meeting notes. If you’re interested in helping with internationalization efforts on WordPress.org, join us on Tuesdays at 12:00 UTC (note the time change for DST).

    Here’s a few things that happened in the i18n world over the last couple of weeks:

    • Translate: A bunch of things have happened!
      • @obenland swooped in with some updates to the project overview for plugins. Here’s an example. But I’ll save you a click: all four sub-projects are now represented on the page in a layout similar to the stats page. We hope to expand that page with other features in the future.
      • Speaking of stats, @dd32 updated the Waiting column on the stats page to list waiting strings from all projects. Numbers grew substantially for many locales.
      • Every time a plugin gets imported into translate.wordpress.org, the status is now displayed in the #meta-language-packs channel on Slack. Plugins that are already in translate.wordpress.org get re-imported every time there’s a commit in their SVN repository. In the future, initial plugin imports will also be shown in this channel.
      • The above item was the last major step to enabling at-will plugin imports into translate.wordpress.org. @ocean90 has fixed a various bugs in the scripts and will be testing the feature (secretly) soon, to see if it will scale. Once he’s comfortable, it’ll roll out to a broader audience and eventually get announced to all plugin authors.
      • One of the ways we can ensure it will scale is by setting up a job system and running all of our jobs through that. @dd32 has worked up some initial code for that, which we’re waiting on systems to deploy.
      • But that’s not all! A filter UI is now available for larger groups of projects (like plugins and themes). You can see it for themes here.
      • Additionally, Dion fixed the issue where themes with \r\n in there strings were appearing incorrectly.
    • Forums: More forum plugins are being ported! @nullbyte has signed up for a few plugins and the table has been updated.

    Finally, at today’s chat we talked about #1388, #1044, and #1162, as well as related GlotPress tickets #100 and #494. Specifically, what is the best way to alert translators and translation editors of projects that strings are ready and available to translate?

    There are a number of things we can do here, but for now the best course of action is adding a list of contributors/PTEs to the plugin overview (that’s #1388 for those following along). Adding this is a good first step towards future solutions.

    While that’s being developed, it’s worth considering the best UX for notifying/contacting translators. The propose GlotPress method is notifications and a notification center, however our use case might be different than the norm – or perhaps we should work with the GlotPress developers on the ideal solution if our use case is normal.

    Lots to think about and discuss with the polyglots team and propose to plugin/theme authors.

  • Ian Dunn 8:46 pm on October 16, 2015 Permalink |

    New Home for the Meta Environment 

    We’ve moved the Meta Environment from github.com/iandunn/wordpress-meta-environment to github.com/wordpress/meta-environment. Links to the old repository will redirect to the new one.

    The goal of the Environment is to make it easy to contribute to the Meta team by giving you a local development environment that’s already setup with the official websites, so you don’t have to manually piece them together.

    If you’ve been wanting to working on a patch for something, please check it out :)


  • Samuel Sidler 4:19 pm on September 22, 2015 Permalink |
    Tags: , , , , , , , ,   

    Weekly i18n Chat Notes – September 22, 2015 

    Earlier today a handful of us gathered to talk about life, the universe, and things that may or may not relate to the meta team and i18n. Here’s a bit of what we talked about:

    • Plugins: Last week imported our first set of plugins into translate.wordpress.org! Hurrah! Huzzah! 🎤⬇️ And because we were feeling good about it, we also sent out emails to the second batch of plugin authors (~200 plugins). That import will start today or tomorrow and we’ll send out emails for the next import soon.
    • Translate: The stats page got some love with the addition of the Waiting column (see #1202) and some improvements to the design (see #1238).
    • Theme Directory: @obenland started work on the Translations section by adding a link to translate any theme to the page. Check out the Twenty Sixteen theme page for an example.
    • WordCamp: Set things up so the WordCamp theme can be translated (see #1076), pending deployment by the WordCamp team.
    • Forums: There was a mention that the Italian forums are not working. @ocean90 will investigate. Additionally, we’ve had a couple of requests for new forums. We think it’s okay to add new ones for testing purposes. For example, an RTL forum would be appropriate.

    For the next week, we’re planning to work on the following:

    • Import and language pack status of plugins sent to a Slack channel.
    • Sorting / Filter UI finished up (or whatever we call it).
    • Streamline the process of adding per-project translation editors (see #1237 which requires #1240).
    • Work on updated design for project pages in Translate.
    • Possibly: More Theme Directory translation section additions.
    • Possibly: Rosetta headers fixed up (see #1201).
    • Possibly: Job system started.

    See y’all next Tuesday at 11:00 UTC!

  • Samuel Sidler 6:01 pm on September 15, 2015 Permalink |
    Tags: , , , , , ,   

    Weekly i18n Chat Notes – September 15, 2015 

    We met today, like normal, at 11:00 UTC and discussed the following things:

    • Translate: Warnings on translate.wordpress.org are now being sent to #polyglots-warnings for more transparency and to catch bad actors. (The channel name may change to #polyglots-notices to cover other usages.) Additionally, the “Waiting” tab now shows the full project name instead of just the sub-project name; e.g., “Plugins – Akismet – Development (trunk)” instead of “Development (trunk)” which was less descriptive.
    • Plugins: Last week, emails went out to the first batch of plugins. We are ready to begin the import into translate.wordpress.org.
    • Forums: @clorith has taken on a plugin! We love new contributors. :)

    There was no update last week (on this blog) but we also improved the design of the stats page.

    Over the next week, we intend to do the following:

    • Plugin import, starting today.
    • Import and language pack status of plugins sent to a Slack channel.
    • Emails for next plugin import batch will go out.
    • Sorting / Filter UI finished up (or whatever we call it).
    • Possibly: Rosetta headers fixed up.
    • Possibly: Jobs system started.

    See y’all next week!

  • Samuel Sidler 5:07 pm on September 7, 2015 Permalink |
    Tags: , , , , ,   

    Weekly i18n Chat Notes – September 1, 2015 

    Howdy! We have our weekly i18n chat tomorrow at 11:00 UTC. Please join us.

    Last week, we discussed the following things:

    • Translate: A stats dashboard has been created. We’ll track the most important projects on this dashboard. We still need to add a couple of features for admins. A bit of time was spent on ways to improve the dashboard and, if you attend tomorrow, you’ll discover that a number of changes were made.
    • Meta Environment: Not a normal topic for us, but a pull request exists that adds translate.wordpress.org to the meta environment so developing for it will be easier.

    What’s up for the next week’s worth of work? Maybe some of the things mentioned here.

    At the end of the chat we mentioned that we’re on track to start importing plugins in ~2 weeks. Since I’m posting this about a week late, that means next week we plan to begin the plugin import.

  • Samuel Sidler 12:32 pm on August 31, 2015 Permalink |
    Tags: , , , , , ,   

    Weekly i18n Chat Notes – August 25, 2015 

    As a reminder, we have a chat tomorrow at 11:00 UTC. The update below is from last week’s chat

    It’s been a while since we last met! I think WordPress 4.3 somewhat distracted us. :) Here’s what’s happened in the last three weeks:

    • Forums: Progress has been made on porting bbPress 1.x plugins! So far, @jmdodd has migrated two plugins to bbPress 2.x. If you’re interested in helping out, be sure to put your name in the “Migrate?” column of the table. (Need access? Just ping me.)
    • Translate: A “Waiting” tab now exists and both it and the themes tab is now sorted by the order previously discussed. Filters are still coming (pending design), but we’re well on our way. Additionally, themes are now in sync with the directory and fully caught up. That means if a theme is approved in the directory, it is automatically imported into translate.wordpress.org.

    And upcoming:

    • Sort orders (and filters) in translate.wordpress.org.
    • Properly log warnings in translate.wordpress.org to a Slack channel so we can keep an eye on them.
    • Fixes to \r in translations.
    • Rosetta header changes.
    • An i18n dashboard to keep track of major products.
    • Automation of Rosetta deploys (pending logging mentioned above).
    • Job / queue system for imports and language pack generation (with systems).

    About a month ago, I made a list of next steps before importing plugins to translate.wordpress.org and we’ve done them all, but run into a few other things needed (as listed above). That said, I think we’re very close to the point where we can import plugins. Of the items above, only the job system is necessary, due to the number of commits plugins receive. More to come on make/plugins.

  • Samuel Sidler 10:01 pm on August 7, 2015 Permalink |
    Tags: ,   

    Translation Project Sorting / Filtering 

    As a follow up for my earlier post on translation project sorting and compiling the comments/thoughts therein, I think we should start with the following things, in order by priority for implementing them.

    1. Waiting Tab: It’s clear that translation editors need a tab just for waiting strings. This tab should be default for translation editors unless there are no waiting strings, in which case WordPress should be the default tab. If a user is only a translation editor for one project, it will show here. If a user is a translation editor for many projects, all will show here using the default priority sorting (see #2). If a user is not a translation editor for any project, they should not have a waiting tab.
    2. Default Priority: With every tab, we need to establish a default priority, however the themes and plugins tabs will need it most. I propose the following default priority: Favorites, strings remaining (“0” goes to the bottom, “1” to the top), and by popularity. That means that your favorites will display at the top of the list, unless they have been fully translated. Further, if 10 plugins have two untranslated strings, all 10 will appear at the top of the plugins tab, in order by popularity, but below your favorites. Once a project is completely translated, it moves to the very bottom of the list, regardless of favorite status.
    3. Filters: Within each tab, we need to ability to filter by the following things:
      1. Favorites
      2. Popularity within the directory
      3. Strings remaining (toggle between most/least; perhaps a “completed” option as well)
      4. Percentage complete (toggle between highest/lowest; perhaps a “completed” option)
      5. Waiting strings present in project
      6. Fuzzy/warning strings present in project
    4. Future Filters: In the future, we should consider the following filters:
      1. Waiting age, especially on “Waiting” tab (aka, projects with strings that have been waiting for two weeks will appear before projects with strings that have been waiting two days)
      2. Release date for themes/plugins (aka, most recently updated first)
      3. Hide/show fully translated projects

    How does that sound to everyone?

    P.S. I’m out for next Tuesday’s weekly chat, but feel free to meet without me!

    • Stephen Edgar 10:21 pm on August 7, 2015 Permalink | Log in to Reply

      Sounds good, thinking about “fuzzy” strings, I’m thinking they may be best also included in the “waiting” tab, fuzzies usual turn up as a result of machine based actions rather than human, there are typically not many of these but I’d weight these fuzzy strings higher in priority than any waiting strings.

    • Caspar Hübinger 10:27 am on August 8, 2015 Permalink | Log in to Reply

      Makes perfect sense imo. +1 what @netweb says.

    • Adrian Pop 3:44 pm on August 10, 2015 Permalink | Log in to Reply

      Excellent! Can’t wait to use them! :)
      @netweb – good point! Translating the fuzzy strings usually decrease the waiting strings remaining to be translated by the same amount. So fuzzy strings must be before the waiting ones.

compose new post
next post/next comment
previous post/previous comment
show/hide comments
go to top
go to login
show/hide help
shift + esc
Skip to toolbar