Beware feature creep; improved install instructions would be nice
-
So far, this plug-in seems to be working well enough for us on a self-installed/self-managed server.
I am concerned by the inclusion of unrelated functionality, specifically the beta image background removal by sending the file through their servers. (I understand including the core of their thumbnail regeneration… you would of course want a new thumbnail for a replaced image.) Background removal sounds useful, but please make it its own plug-in. The more a plug-in does, the more of an attack surface it has and the more work I have to do to try to figure out whether we can trust it on our server.
I saw a comment in the plugin file saying you can define the EMR_CAPABILITY constant in your own wp-config.php which (if set — they suggest edit_upload_all and/or edit_upload_user) restricts the plugin’s use to users with a specific capability. This is not mentioned in the install instructions and probably should be. It appears that without setting this constant, any user with the upload_file capability will be able to use this plugin.
Not at all saying this is a problem, but it should, I think, be better documented. (Perhaps I will send a PR through GitHub if I need to clone it to get rid of the background removal code.)
- The topic ‘Beware feature creep; improved install instructions would be nice’ is closed to new replies.