joomla/joomla-cms — pull request #2769 by shumisha (2014-01-08 15:44:53+00:00)
Title: Improved Joomla! extensions update handling of paid for extensions

Hi,

In starting to use the paid-for extensions updater recently introduced in 3.x (tracker 32684, https://github.com/joomla/joomla-cms/pull/2508), I came across some limitations that make it difficult for us to actually use it.
Therefore I'm proposing the following small contribution to make this feature a bit more universal.

What could be improved:

- cannot use in J! 2.5 (w/o backporting, ie lots of work and maintenance)
- pass all credentials into the url, which means credentials are stored in servers and proxies log files along the way, for all to view
- not easily made dynamic: ie download credentials are "hardcoded" in the update sites DB table, which allow "replaying", ie: once somebody has sniffed credentials, they can use them at will, an unlimited number of times, and pass them along to anyone
- cannot easily share credentials between extensions, ie one main component, controlling updates of various plugins or language files for instance

The proposal is simply to add firing an event at the right time and place, to allow an extension-supplied plugin to alter the url and/or headers on the fly as required by the extension supplier authorization mechanism.

Drawbacks:
- need to add a plugin to respond to the event, easy for larger extension which may already have one or more plugins, more work for those who don't

Benefits:
- simple, backward compatible change (4 lines added in one file)
- same 4 lines and same plugin can be used the same on J! 2.5, providing Joomla update for paid extension on 2.5 as well
- fairly simple plugin, I'll provide sample one
- same plugin can control update for several extensions
- can use urls var or headers to pass credentials, less data stored in log files in the later case
- can use dynamic, time stamped requests to avoid replay

This PR is backward compatible and doesn't touch existing code, it only adds a bit more flexibility.

Also see tracker item: http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=33096&start=0