Uninstalled Plugins Are Accessible Via Url

[Blesta Addons]

if the plugin is not installed in the plugin manager, it should not be accessible via direct url .

normally blesta should redirect any request to un-installed pluging to the dashboard (client/admin/staff)

[Michael]

Could be a caching issue?

[Blesta Addons]

not a caching issue .

let say you have un-installed the empty cache plugin , you can use it by the direct link .

also the support manager or client document ,they show a mysql error becaus the tables is not created , normally it should not show it , it should verify if the plugin installed or not before serve it .

[Michael]

Oh they've always had a oh no error maybe a feature request for them to not work at all and redirect to the index.

[Blesta Addons]

that what should be in normal .

this is Bug OR Feature Request ?!!!

[Paul]

Good question, will discuss with Cody. This could be an issue best left to the extension to gracefully handle.

[Alk]

I was also bemused by this when I came across this today. I uninstalled the Emptycache plugin, but as the link was still cached in the navigation bar, I could still access it via the URL, as if it was still installed. Suppose there was a vulnerability in a plugin and it was uninstalled; as it is currently, would it still in effect be active even though it was uninstalled?

[Tyson]

This is scheduled as an improvement in CORE-1344 for v3.4 of Blesta. I'll move this thread to the Support forum.