Feature/plugins poc 4 by henryjonathanquispe · Pull Request #9113 · ProcessMaker/processmaker

henryjonathanquispe · 2026-10-26T16:08:00Z

Related Tickets & Packages

Link to any related FOUR tickets, PRDs, or packages

Code Review Checklist

I have pulled this code locally and tested it on my instance, along with any associated packages.
This code adheres to ProcessMaker Coding Guidelines.
This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
This solution fixes the bug reported in the original ticket.
This solution does not alter the expected output of a component in a way that would break existing Processes.
This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy

commit b84543b Author: AugustoLopezProcess <augusto.lopez+github@processmaker.com> Date: Tue Apr 21 08:27:15 2026 -0400 Adding plugin admin ui commit ca8a863 Author: Nolan Ehrstrom <github@nolanpro.com> Date: Mon Mar 9 11:01:46 2026 -0700 Add controllers and routes for plugin UI Copied from feature/plugins-poc-vite-ui (just without the vite/Vue3 integration) commit 3cc89bc Merge: 9e9b4aa 5da27ce Author: Nolan Ehrstrom <github@nolanpro.com> Date: Mon Mar 9 10:58:27 2026 -0700 Merge branch 'task/FOUR-28803' into feature/plugins-poc commit 9e9b4aa Author: Nolan Ehrstrom <github@nolanpro.com> Date: Mon Jan 19 12:30:54 2026 -0800 Add install command and cached routes commit 4a5df14 Author: Nolan Ehrstrom <github@nolanpro.com> Date: Wed Dec 10 09:29:20 2025 -0800 Start on plugins

Updating feature/plugins-poc-4 with last changes in develop

FOUR-32722 Some adjustments in plugins installation

…the command: php artisan horizon:terminate

FOUR-32760 After install/enable/disable a plugin, should be executed the command: php artisan horizon:terminate

cursor · 2026-10-26T16:08:12Z

PR Summary

High Risk
Plugin install runs git/composer and loads third-party code with route-cache and worker restarts; admin APIs accept repository URLs and zip uploads under a single permission gate.

Overview
This PR adds storage-based plugin lifecycle management (install from Git URL, local path, or zip; uninstall; enable/disable via folder rename) plus an admin Plugins UI and API that queue long-running work and stream progress over PluginLog on the operator’s private Echo channel. PluginManager validates composer.json, runs composer install and optional {name}:install / :uninstall artisan hooks, then rebuilds tenant route cache and restarts Horizon so new code loads; PluginServiceProvider registers enabled plugins under storage/plugins after tenant resolution. Multitenancy updates set per-tenant APP_ROUTES_CACHE, reload cached routes in Octane/console, and extend broadcasting for tenant-scoped channels. Screen builder also picks up published JS from enabled storage plugins. New manage-plugins (and related) permissions, menu entry, routes, and plugin:* CLI commands round out the surface.

In parallel, it introduces the cross-project manage-requirements agent skill: JSON schemas, validate-requirements / check-requirements npm scripts (schema + Python heuristic QC), templates, and a Python quality harness (optional Laya). ai-docs/processmaker/requirements catalogs document the plugin manager component and admin screen.

^{Reviewed by Cursor Bugbot for commit 5bbed5d. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-10-26T16:15:17Z

+            $pluginPath = $pluginDisabledPath;
+        } elseif (!is_dir($pluginPath)) {
+            throw new RuntimeException("Plugin not found: {$pluginName}");
+        }


Plugin name allows path traversal

High Severity

uninstall and toggle join the route {name} onto storage/plugins with no basename or allowlist check. A name of .. resolves to the tenant storage root, so delete or rename can wipe or move the entire storage tree.

Additional Locations (2)

ProcessMaker/Managers/PluginManager.php#L314-L327

ProcessMaker/Http/Controllers/Api/PluginController.php#L48-L52

^{Reviewed by Cursor Bugbot for commit a96f564. Configure here.}

cursor · 2026-10-26T16:15:17Z

+
+        try {
+            $zip->extractTo($tmpExtractDir);
+            $zip->close();


Zip extract allows path traversal

High Severity

installFromZip calls ZipArchive::extractTo on the uploaded archive without checking entry names. Entries with .. or absolute paths write outside the temp directory as the application user before validation or copy.

^{Reviewed by Cursor Bugbot for commit a96f564. Configure here.}

cursor · 2026-10-26T16:15:17Z

+        // Extend BroadcastManager to our custom implementation that prefixes the channel names with the tenant id.
+        $app->extend(BroadcastManager::class, function ($manager, $app) use ($tenant) {
+            return new TenantAwareBroadcastManager($app, $tenant->id);
+        });


Tenant switch crashes on broadcast extend

High Severity

makeCurrent extends BroadcastManager by constructing TenantAwareBroadcastManager with a tenant id. Those names resolve in ProcessMaker\Multitenancy, and the real class only accepts the app instance. Every tenant switch fatals. BroadcastServiceProvider already installs the tenant-aware manager.

^{Reviewed by Cursor Bugbot for commit a96f564. Configure here.}

cursor · 2026-10-26T16:15:17Z

+            }
+        } else {
+            $this->logRunning("Plugin {$command} command output:\n\n{$result->output()}", $pluginName, $userId);
+        }


Failed plugin commands still report success

Medium Severity

runCommand logs {plugin}:install, route:cache, and horizon:terminate failures and returns. Install still calls logDone and the API responds with success, so a failed plugin setup or stale route cache looks like a completed install.

Additional Locations (2)

ProcessMaker/Managers/PluginManager.php#L88-L97

ProcessMaker/Http/Controllers/Api/PluginController.php#L42-L43

^{Reviewed by Cursor Bugbot for commit a96f564. Configure here.}

cursor · 2026-10-26T16:15:17Z

+            throw new RuntimeException(
+                "Invalid JSON in composer.json at {$composerJsonPath}: " . json_last_error_msg()
+            );
+        }


Invalid plugin composer.json crashes tenant

High Severity

loadPlugins rethrows on invalid composer.json or a missing PSR-4 path during TenantResolved. One leftover or corrupt folder under storage/plugins then 500s every request for that tenant. PluginManager::list already skips invalid plugins.

Additional Locations (1)

ProcessMaker/Providers/PluginServiceProvider.php#L107-L110

^{Reviewed by Cursor Bugbot for commit a96f564. Configure here.}

cursor

Stale Bugbot comment from a previous run.

cursor

Stale Bugbot comment from a previous run.

…ink, add load screen-builder-form.js files from plugin

cursor

Stale Bugbot comment from a previous run.

…ink, add load screen-builder-form.js files from plugin

decisions-sonarqube · 2026-10-29T15:55:00Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 6 total unresolved issues (including 5 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5bbed5d. Configure here.}

julceslauhub and others added 8 commits July 31, 2026 16:54

Merge pull request #8983 from ProcessMaker/develop

9f07823

Updating feature/plugins-poc-4 with last changes in develop

FOUR-32722 Some adjustments in plugins installation

75c359e

FOUR-32722 Some adjustments in plugins installation

34ae7ca

Merge pull request #8993 from ProcessMaker/FOUR-32722

0ac5c82

FOUR-32722 Some adjustments in plugins installation

FOUR-32760 After install/enable/disable a plugin, should be executed …

5cf0368

…the command: php artisan horizon:terminate

Merge pull request #8999 from ProcessMaker/FOUR-32760

2d599f4

FOUR-32760 After install/enable/disable a plugin, should be executed the command: php artisan horizon:terminate

Update with develop

a96f564

cursor Bot reviewed Oct 26, 2026

View reviewed changes

henryjonathanquispe and others added 2 commits October 26, 2026 12:37

update blade with vite

2998dab

plugins in jobs

f6b4c56

cursor Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread ProcessMaker/Jobs/InstallPlugin.php Resolved

Comment thread resources/js/admin/plugins/Plugins.vue Resolved

Comment thread resources/js/admin/plugins/Plugins.vue Resolved

Update remove modal

af00fc7

cursor Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread resources/js/admin/plugins/Plugins.vue Resolved

Comment thread resources/js/admin/plugins/Plugins.vue Resolved

henryjonathanquispe added 2 commits October 27, 2026 14:29

PLUGINS POC 4: Upload from local path, remove directory, remove symnl…

6fc992e

…ink, add load screen-builder-form.js files from plugin

PLUGINS POC 4: Upload from local path, remove directory, remove symnl…

b733752

…ink, add load screen-builder-form.js files from plugin

cursor Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread ProcessMaker/Managers/PluginManager.php Resolved

henryjonathanquispe added 2 commits October 27, 2026 15:49

PLUGINS POC 4: Upload from local path, remove directory, remove symnl…

2418729

…ink, add load screen-builder-form.js files from plugin

PLUGINS POC 4: Upload from local path, remove directory, remove symnl…

5bbed5d

…ink, add load screen-builder-form.js files from plugin

cursor Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread ProcessMaker/Managers/PluginManager.php Resolved

Conversation

henryjonathanquispe commented Oct 26, 2026

Related Tickets & Packages

Code Review Checklist

Uh oh!

cursor Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Oct 26, 2026

Choose a reason for hiding this comment

Plugin name allows path traversal

Uh oh!

cursor Bot Oct 26, 2026

Choose a reason for hiding this comment

Zip extract allows path traversal

Uh oh!

Uh oh!

cursor Bot Oct 26, 2026

Choose a reason for hiding this comment

Tenant switch crashes on broadcast extend

Uh oh!

Uh oh!

cursor Bot Oct 26, 2026

Choose a reason for hiding this comment

Failed plugin commands still report success

Uh oh!

cursor Bot Oct 26, 2026

Choose a reason for hiding this comment

Invalid plugin composer.json crashes tenant

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

decisions-sonarqube Bot commented Oct 29, 2026

Quality Gate passed

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cursor Bot commented Oct 26, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading