Introducing Plugin Script Modification Permissions

[QuackingDuckQuack (Grace)]

Nice to see how you are preventing virus plugins, this will definitely benefit newer devs.

I have the same question as @TheCarbyneUniverse though.

@TheCarbyneUniverse

Also, does this modal appear for every script modification for every NEW plugin or every studio SESSION? If the user accidentally denies (since the button is initially highlighted), then would users have to reinstall the plugin to change their choice?

[Optikk]

Sure, being able to view the source would be a little helpful combatting malicious plugins, but that only helps developers with a solid scripting background. This also diminishes the idea of paid plugins, because now the source is out there and reuploading paid plugins will be trivial.

[DoctorNO2106 (Doctor)]

@sjr04

Although wouldn’t it be easier to add an easier way to view plugin source from studio so developers can just vet the code themselves?

Although this would be cool. It would open the door to a lot of copy plugins

[iGottic]

@MissingFeature

For example, a plugin could provide a reason as to why it needs to inject scripts.

This can easily be abusable. A plugin should make it’s own functionality to do this.

[sjr04 (uep)]

@Optikk

Sure, being able to view the source would be a little helpful combatting malicious plugins, but that only helps developers with a solid scripting background.

See:

@sjr04

Even if you don’t have experience that doesn’t mean you can’t ask questions, whether it be in #help-and-feedback:scripting-support or asking on Discord or something.

---

@Optikk

This also diminishes the idea of paid plugins, because now the source is out there and reuploading paid plugins will be trivial.

@DoctorNO2106

Although this would be cool. It would open the door to a lot of copy plugins

People are already copying plugins though. I think this is a separate issue not relevant to the OP.

[MissingFeature]

I can see what you mean, however I think that this will not be easy to abuse, and any serious developer should be able to see through whatever the plugin claims. Perhaps an addition of a preview for the scripts would help keep this from happening?

[DoctorNO2106 (Doctor)]

Yes, people are already copying plugins, but making it so you can see all the plugin code would make it even easier for kids to make complete copies.

Either way this is a great step towards better security and less new developers being turned away because their game got ruined by a malicious plugin.

[Optikk]

@sjr04

People are already copying plugins though. I think this is a separate issue not relevant to the OP.

Well, that’s certainly no excuse to enable plugin copycats even more.

This update is about all that’s needed. A building plugin doesn’t need to insert scripts or modify source code. The plugins that do modify source code are almost always open source on github from my experience.

[MissingFeature]

I disagree, as repeatedly updating the plugin would make a change like this quite annoying. I think that most malicious plugins are created maliciously, and I don’t think any plugin is updated to be malicious. There might be a couple exceptions, however I think in the grand scheme, this will not be very useful.

[MissingFeature]

Perhaps along with this could be a script previewer that would allow you to preview the scripts inserted.

[MissingFeature]

I could see this being a concern with plugins creating fake alerts, and I think this is a valid concern. Perhaps one way this could be fixed is that plugins under review could be kept from inserting GUI, which would keep this from happening.

[Reapimus]

If you read the post properly you would’ve seen they mentioned a way to change your choice via the plugin management window

[Optikk]

I think we should be able to choose this behavior ourselves. A checkbox for “Persist after updates” or something would suffice. Those of us concerned about our plugins going rogue won’t have to worry.

[QuackingDuckQuack (Grace)]

Yes, but what I’m wondering is will this allow all the plugins to do everything, or just allow a certain plugin after you accidentally chose a setting you didn’t want.

[MissingFeature]

I agree, a couple of settings in perhaps Studio Settings, or plugin management would be useful for people who want heightened security, and for people who want the security to be lower. This could allow for turning off the update entirely, or resetting all of the allowed/rejected requests.

[Dysche]

You can already see the source of any plugin installed in the InstalledPlugins folder.

[RobloxGameingStudios (RobloxGamingStudios)]

This seems to have broken my own plugins, as the button for them will not open the UI anymore. It also seems to have deleted a lot of the core gui plugin UI storage for no reason at all.

[RobloxGameingStudios (RobloxGamingStudios)]

Uninstalling them and reinstalling them did not work.

[cooasts]

about time! finally the pesky backdoors can go away. (mostly)

[Automationeer (Eleanor)]

For both this permission tool, as well as HTTP permissions, can we get an ‘allow once’ or ‘allow this session’ option? Some plugins only need to do stuff like this rarely (e.g. to pull a cached list); similar to iPhone’s location permission settings and most browser’s permission settings.