Repository navigation
Add ReferenceVerify plugin (OJS 3.3, 3.4, 3.5) - #558
Open
cuneytozdemir wants to merge 1 commit into
Open
cuneytozdemir wants to merge 1 commit into
cuneytozdemir wants to merge 1 commit into
Conversation
…3.5) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
jardakotesovec
added a commit
to jardakotesovec/pkp-e2e
that referenced
this pull request
Oct 12, 2026
…am can ask the bot to review a third-party plugin submitted to PKP's Plugin Gallery (a pkp/plugin-gallery PR) to the bar of the other reviews: it works, it is secure, nothing in it is dodgy. MAINTENANCE "Plugin review": the request (hosts the plugin may reach only when it names them), integrity (bin/plugin-fetch.js: MD5, a listed-before-unpacked archive, the package against its tagged source and the previous gallery release, composer audit on the lock file, a hot-spot map; nothing from the package runs), the read as the gate (briefs/plugin-read.md, the security questions by reference to regression-read step 3), the drive in the sandbox (briefs/plugin-drive.md: install through the app's own gallery path, settings, the main flow, the read's suspicions, the core with it on, removal, snapshots, egress and logs), a private report in pkp-e2e-sec/plugin-reviews posted in the thread, tear-down. harness.md "The plugin sandbox": a rootless Podman pod owned by the credential-less user e2e-plugin (OJS stable-3_5_0 without the overlays, PKP's dataset, Postgres, Mailpit, a resolver that logs and answers no name), every outbound packet of that user logged and dropped by the nft table plugin_sandbox unless plugin-egress allowed the host for a few hours; sandbox/vm/setup.sh is the idempotent root setup (installed on the VM 2026-10-12), sandbox/pod.sh the pod, bin/plugin-sandbox.js the bot's side (stage, allow, up, snapshot, diff, egress, logs, down, purge, canary). The canary plugin tried the bot's files, /etc/shadow, DNS, HTTP by name and address, the host's Postgres, SSH and Mailpit, and a write outside its folder: every wall held. Dry run on the VM with pkp/plugin-gallery#558: integrity clean, installed through the gallery from the pod, the diff showed the plugin's files and versions row, an allowed host reached and another dropped, down withdrew the allowance. dataset.js: cleanDump() split out of loadDump() for the sandbox's load. CLAUDE.md, RUNBOOK "What goes where" and the briefs README point at it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds ReferenceVerify, a generic plugin that lets editors check the references and in-text citations of a submission file from the editorial workflow (fabricated or mismatched references, retracted works, citations missing from the reference list).
1.2.1.0for OJS 3.3 — branchstable-3_3_0, releasev1_2_1-01.2.1.1for OJS 3.4 and 3.5 — branchmain, releasev1_2_1-1External service and data. The plugin talks to referenceverify.com only when an editor clicks one of its buttons; opening the workflow sends nothing. The data sent for each action (the chosen file; the submission ID for "Get results"; title, abstract and author names for reviewer suggestions) is listed in the plugin description, the settings screen and the README. Nothing is written to OJS automatically, and the server address cannot be changed by journal managers (only via
config.inc.phpfor testing). A ReferenceVerify account and a per-journal plugin key are required.The XML validates against
plugins.xsd, and both package URLs resolve with the listed MD5 sums. Happy to make any changes the review asks for.