* Plugins administration panel.
* @subpackage Administration
/** WordPress Administration Bootstrap */
require_once __DIR__ . '/admin.php';
if ( ! current_user_can( 'activate_plugins' ) ) {
wp_die( __( 'Sorry, you are not allowed to manage plugins for this site.' ) );
$wp_list_table = _get_list_table( 'WP_Plugins_List_Table' );
$pagenum = $wp_list_table->get_pagenum();
$action = $wp_list_table->current_action();
$plugin = isset( $_REQUEST['plugin'] ) ? wp_unslash( $_REQUEST['plugin'] ) : '';
$s = isset( $_REQUEST['s'] ) ? urlencode( wp_unslash( $_REQUEST['s'] ) ) : '';
// Clean up request URI from temporary args for screen options/paging uri's to work as expected.
$query_args_to_remove = array(
'enabled-auto-update-multi',
'disabled-auto-update-multi',
$_SERVER['REQUEST_URI'] = remove_query_arg( $query_args_to_remove, $_SERVER['REQUEST_URI'] );
wp_enqueue_script( 'updates' );
if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
wp_die( __( 'Sorry, you are not allowed to activate this plugin.' ) );
if ( is_multisite() && ! is_network_admin() && is_network_only_plugin( $plugin ) ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
check_admin_referer( 'activate-plugin_' . $plugin );
$result = activate_plugin( $plugin, self_admin_url( 'plugins.php?error=true&plugin=' . urlencode( $plugin ) ), is_network_admin() );
if ( is_wp_error( $result ) ) {
if ( 'unexpected_output' === $result->get_error_code() ) {
$redirect = self_admin_url( 'plugins.php?error=true&charsout=' . strlen( $result->get_error_data() ) . '&plugin=' . urlencode( $plugin ) . "&plugin_status=$status&paged=$page&s=$s" );
wp_redirect( add_query_arg( '_error_nonce', wp_create_nonce( 'plugin-activation-error_' . $plugin ), $redirect ) );
if ( ! is_network_admin() ) {
$recent = (array) get_option( 'recently_activated' );
unset( $recent[ $plugin ] );
update_option( 'recently_activated', $recent );
$recent = (array) get_site_option( 'recently_activated' );
unset( $recent[ $plugin ] );
update_site_option( 'recently_activated', $recent );
if ( isset( $_GET['from'] ) && 'import' === $_GET['from'] ) {
// Overrides the ?error=true one above and redirects to the Imports page, stripping the -importer suffix.
wp_redirect( self_admin_url( 'import.php?import=' . str_replace( '-importer', '', dirname( $plugin ) ) ) );
} elseif ( isset( $_GET['from'] ) && 'press-this' === $_GET['from'] ) {
wp_redirect( self_admin_url( 'press-this.php' ) );
// Overrides the ?error=true one above.
wp_redirect( self_admin_url( "plugins.php?activate=true&plugin_status=$status&paged=$page&s=$s" ) );
case 'activate-selected':
if ( ! current_user_can( 'activate_plugins' ) ) {
wp_die( __( 'Sorry, you are not allowed to activate plugins for this site.' ) );
check_admin_referer( 'bulk-plugins' );
$plugins = isset( $_POST['checked'] ) ? (array) wp_unslash( $_POST['checked'] ) : array();
if ( is_network_admin() ) {
foreach ( $plugins as $i => $plugin ) {
// Only activate plugins which are not already network activated.
if ( is_plugin_active_for_network( $plugin ) ) {
foreach ( $plugins as $i => $plugin ) {
// Only activate plugins which are not already active and are not network-only when on Multisite.
if ( is_plugin_active( $plugin ) || ( is_multisite() && is_network_only_plugin( $plugin ) ) ) {
// Only activate plugins which the user can activate.
if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
if ( empty( $plugins ) ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
activate_plugins( $plugins, self_admin_url( 'plugins.php?error=true' ), is_network_admin() );
if ( ! is_network_admin() ) {
$recent = (array) get_option( 'recently_activated' );
$recent = (array) get_site_option( 'recently_activated' );
foreach ( $plugins as $plugin ) {
unset( $recent[ $plugin ] );
if ( ! is_network_admin() ) {
update_option( 'recently_activated', $recent );
update_site_option( 'recently_activated', $recent );
wp_redirect( self_admin_url( "plugins.php?activate-multi=true&plugin_status=$status&paged=$page&s=$s" ) );
check_admin_referer( 'bulk-plugins' );
if ( isset( $_GET['plugins'] ) ) {
$plugins = explode( ',', wp_unslash( $_GET['plugins'] ) );
} elseif ( isset( $_POST['checked'] ) ) {
$plugins = (array) wp_unslash( $_POST['checked'] );
$title = __( 'Update Plugins' );
$parent_file = 'plugins.php';
wp_enqueue_script( 'updates' );
require_once ABSPATH . 'wp-admin/admin-header.php';
echo '<div class="wrap">';
echo '<h1>' . esc_html( $title ) . '</h1>';
$url = self_admin_url( 'update.php?action=update-selected&plugins=' . urlencode( implode( ',', $plugins ) ) );
$url = wp_nonce_url( $url, 'bulk-update-plugins' );
echo "<iframe src='$url' style='width: 100%; height:100%; min-height:850px;'></iframe>";
require_once ABSPATH . 'wp-admin/admin-footer.php';
if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
wp_die( __( 'Sorry, you are not allowed to activate this plugin.' ) );
check_admin_referer( 'plugin-activation-error_' . $plugin );
$valid = validate_plugin( $plugin );
if ( is_wp_error( $valid ) ) {
error_reporting( E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_ERROR | E_WARNING | E_PARSE | E_USER_ERROR | E_USER_WARNING | E_RECOVERABLE_ERROR );
ini_set( 'display_errors', true ); // Ensure that fatal errors are displayed.
// Go back to "sandbox" scope so we get the same errors as before.
plugin_sandbox_scrape( $plugin );
/** This action is documented in wp-admin/includes/plugin.php */
do_action( "activate_{$plugin}" );
if ( ! current_user_can( 'deactivate_plugin', $plugin ) ) {
wp_die( __( 'Sorry, you are not allowed to deactivate this plugin.' ) );
check_admin_referer( 'deactivate-plugin_' . $plugin );
if ( ! is_network_admin() && is_plugin_active_for_network( $plugin ) ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
deactivate_plugins( $plugin, false, is_network_admin() );
if ( ! is_network_admin() ) {
update_option( 'recently_activated', array( $plugin => time() ) + (array) get_option( 'recently_activated' ) );
update_site_option( 'recently_activated', array( $plugin => time() ) + (array) get_site_option( 'recently_activated' ) );
echo "<meta http-equiv='refresh' content='" . esc_attr( "0;url=plugins.php?deactivate=true&plugin_status=$status&paged=$page&s=$s" ) . "' />";
wp_redirect( self_admin_url( "plugins.php?deactivate=true&plugin_status=$status&paged=$page&s=$s" ) );
case 'deactivate-selected':
if ( ! current_user_can( 'deactivate_plugins' ) ) {
wp_die( __( 'Sorry, you are not allowed to deactivate plugins for this site.' ) );
check_admin_referer( 'bulk-plugins' );
$plugins = isset( $_POST['checked'] ) ? (array) wp_unslash( $_POST['checked'] ) : array();
// Do not deactivate plugins which are already deactivated.
if ( is_network_admin() ) {
$plugins = array_filter( $plugins, 'is_plugin_active_for_network' );
$plugins = array_filter( $plugins, 'is_plugin_active' );
$plugins = array_diff( $plugins, array_filter( $plugins, 'is_plugin_active_for_network' ) );
foreach ( $plugins as $i => $plugin ) {
// Only deactivate plugins which the user can deactivate.
if ( ! current_user_can( 'deactivate_plugin', $plugin ) ) {
if ( empty( $plugins ) ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
deactivate_plugins( $plugins, false, is_network_admin() );
foreach ( $plugins as $plugin ) {
$deactivated[ $plugin ] = time();
if ( ! is_network_admin() ) {
update_option( 'recently_activated', $deactivated + (array) get_option( 'recently_activated' ) );
update_site_option( 'recently_activated', $deactivated + (array) get_site_option( 'recently_activated' ) );
wp_redirect( self_admin_url( "plugins.php?deactivate-multi=true&plugin_status=$status&paged=$page&s=$s" ) );
if ( ! current_user_can( 'delete_plugins' ) ) {
wp_die( __( 'Sorry, you are not allowed to delete plugins for this site.' ) );
check_admin_referer( 'bulk-plugins' );
// $_POST = from the plugin form; $_GET = from the FTP details screen.
$plugins = isset( $_REQUEST['checked'] ) ? (array) wp_unslash( $_REQUEST['checked'] ) : array();
if ( empty( $plugins ) ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
$plugins = array_filter( $plugins, 'is_plugin_inactive' ); // Do not allow to delete activated plugins.
if ( empty( $plugins ) ) {
wp_redirect( self_admin_url( "plugins.php?error=true&main=true&plugin_status=$status&paged=$page&s=$s" ) );
// Bail on all if any paths are invalid.
// validate_file() returns truthy for invalid files.
$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
if ( $invalid_plugin_files ) {
wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
require ABSPATH . 'wp-admin/update.php';
$parent_file = 'plugins.php';
if ( ! isset( $_REQUEST['verify-delete'] ) ) {
wp_enqueue_script( 'jquery' );
require_once ABSPATH . 'wp-admin/admin-header.php';
$have_non_network_plugins = false;
foreach ( (array) $plugins as $plugin ) {
$plugin_slug = dirname( $plugin );
if ( '.' === $plugin_slug ) {
$data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
$plugin_info[ $plugin ] = $data;
$plugin_info[ $plugin ]['is_uninstallable'] = is_uninstallable_plugin( $plugin );
if ( ! $plugin_info[ $plugin ]['Network'] ) {
$have_non_network_plugins = true;
// Get plugins list from that folder.
$folder_plugins = get_plugins( '/' . $plugin_slug );
foreach ( $folder_plugins as $plugin_file => $data ) {
$plugin_info[ $plugin_file ] = _get_plugin_data_markup_translate( $plugin_file, $data );
$plugin_info[ $plugin_file ]['is_uninstallable'] = is_uninstallable_plugin( $plugin );
if ( ! $plugin_info[ $plugin_file ]['Network'] ) {
$have_non_network_plugins = true;
$plugins_to_delete = count( $plugin_info );
<?php if ( 1 === $plugins_to_delete ) : ?>
<h1><?php _e( 'Delete Plugin' ); ?></h1>
<?php if ( $have_non_network_plugins && is_network_admin() ) : ?>
<div class="error"><p><strong><?php _e( 'Caution:' ); ?></strong> <?php _e( 'This plugin may be active on other sites in the network.' ); ?></p></div>
<p><?php _e( 'You are about to remove the following plugin:' ); ?></p>
<h1><?php _e( 'Delete Plugins' ); ?></h1>
<?php if ( $have_non_network_plugins && is_network_admin() ) : ?>
<div class="error"><p><strong><?php _e( 'Caution:' ); ?></strong> <?php _e( 'These plugins may be active on other sites in the network.' ); ?></p></div>
<p><?php _e( 'You are about to remove the following plugins:' ); ?></p>
foreach ( $plugin_info as $plugin ) {
if ( $plugin['is_uninstallable'] ) {
/* translators: 1: Plugin name, 2: Plugin author. */
echo '<li>', sprintf( __( '%1$s by %2$s (will also <strong>delete its data</strong>)' ), '<strong>' . $plugin['Name'] . '</strong>', '<em>' . $plugin['AuthorName'] . '</em>' ), '</li>';
/* translators: 1: Plugin name, 2: Plugin author. */
echo '<li>', sprintf( _x( '%1$s by %2$s', 'plugin' ), '<strong>' . $plugin['Name'] . '</strong>', '<em>' . $plugin['AuthorName'] ) . '</em>', '</li>';
_e( 'Are you sure you want to delete these files and data?' );
_e( 'Are you sure you want to delete these files?' );
<form method="post" action="<?php echo esc_url( $_SERVER['REQUEST_URI'] ); ?>" style="display:inline;">
<input type="hidden" name="verify-delete" value="1" />
<input type="hidden" name="action" value="delete-selected" />
foreach ( (array) $plugins as $plugin ) {
echo '<input type="hidden" name="checked[]" value="' . esc_attr( $plugin ) . '" />';
<?php wp_nonce_field( 'bulk-plugins' ); ?>
<?php submit_button( $data_to_delete ? __( 'Yes, delete these files and data' ) : __( 'Yes, delete these files' ), '', 'submit', false ); ?>
$referer = wp_get_referer();
<form method="post" action="<?php echo $referer ? esc_url( $referer ) : ''; ?>" style="display:inline;">
<?php submit_button( __( 'No, return me to the plugin list' ), '', 'submit', false ); ?>
require_once ABSPATH . 'wp-admin/admin-footer.php';
$plugins_to_delete = count( $plugins );
} // End if verify-delete.
$delete_result = delete_plugins( $plugins );
// Store the result in a cache rather than a URL param due to object type & length.
set_transient( 'plugins_delete_result_' . $user_ID, $delete_result );
wp_redirect( self_admin_url( "plugins.php?deleted=$plugins_to_delete&plugin_status=$status&paged=$page&s=$s" ) );
case 'clear-recent-list':
if ( ! is_network_admin() ) {
update_option( 'recently_activated', array() );
update_site_option( 'recently_activated', array() );
if ( ! current_user_can( 'resume_plugin', $plugin ) ) {
wp_die( __( 'Sorry, you are not allowed to resume this plugin.' ) );
check_admin_referer( 'resume-plugin_' . $plugin );
$result = resume_plugin( $plugin, self_admin_url( "plugins.php?error=resuming&plugin_status=$status&paged=$page&s=$s" ) );
if ( is_wp_error( $result ) ) {
wp_redirect( self_admin_url( "plugins.php?resume=true&plugin_status=$status&paged=$page&s=$s" ) );
case 'enable-auto-update':
case 'disable-auto-update':
case 'enable-auto-update-selected':
case 'disable-auto-update-selected':
if ( ! current_user_can( 'update_plugins' ) || ! wp_is_auto_update_enabled_for_type( 'plugin' ) ) {
wp_die( __( 'Sorry, you are not allowed to manage plugins automatic updates.' ) );
if ( is_multisite() && ! is_network_admin() ) {
wp_die( __( 'Please connect to your network admin to manage plugins automatic updates.' ) );
$redirect = self_admin_url( "plugins.php?plugin_status={$status}&paged={$page}&s={$s}" );
if ( 'enable-auto-update' === $action || 'disable-auto-update' === $action ) {
if ( empty( $plugin ) ) {
wp_redirect( $redirect );
check_admin_referer( 'updates' );
if ( empty( $_POST['checked'] ) ) {
wp_redirect( $redirect );
check_admin_referer( 'bulk-plugins' );
$auto_updates = (array) get_site_option( 'auto_update_plugins', array() );
if ( 'enable-auto-update' === $action ) {
$auto_updates[] = $plugin;
$auto_updates = array_unique( $auto_updates );
$redirect = add_query_arg( array( 'enabled-auto-update' => 'true' ), $redirect );
} elseif ( 'disable-auto-update' === $action ) {
$auto_updates = array_diff( $auto_updates, array( $plugin ) );
$redirect = add_query_arg( array( 'disabled-auto-update' => 'true' ), $redirect );
$plugins = (array) wp_unslash( $_POST['checked'] );
if ( 'enable-auto-update-selected' === $action ) {
$new_auto_updates = array_merge( $auto_updates, $plugins );
$new_auto_updates = array_unique( $new_auto_updates );
$query_args = array( 'enabled-auto-update-multi' => 'true' );
$new_auto_updates = array_diff( $auto_updates, $plugins );
$query_args = array( 'disabled-auto-update-multi' => 'true' );
// Return early if all selected plugins already have auto-updates enabled or disabled.
// Must use non-strict comparison, so that array order is not treated as significant.
if ( $new_auto_updates == $auto_updates ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
wp_redirect( $redirect );