The plugin sends requests to an external service on its own, namely GitHub. This page describes exactly what happens. It is not a substitute for a legal review of your installation.
api.github.com, path /repos/<owner>/<repo>/releases/latest.url points to a GitHub repository, at most once per cache duration (default 6 hours). If a request fails, it is repeated after one hour at the earliest.| Item | Content |
|---|---|
| IP address | that of the osTicket server, not of the admin's browser |
| URL | owner and name of the repository, as given in the respective plugin's plugin.php |
| User agent | fixed value osTicket-Plugin-UpdateChecker/... |
| Accept header | application/vnd.github.v3+json |
| Authorization header | only if you entered a GitHub token: Bearer <token> |
Not transmitted are ticket data, data of agents or customers, the osTicket URL, the name or version of the osTicket system and the installed version of the plugins. However, GitHub learns from the sequence of requests which plugins a server with this IP address uses and, if a token is entered, which GitHub account the requests belong to.
osticket-update-check: one JSON file per repository with release tag, release URL and expiry time, and the marker none for errors. Personal data and the token are not stored there.[UpdateCheck] GitHub API HTTP 403 for /repos/<owner>/<repo>/releases/latest. The token is not logged.The plugin does not include scripts, fonts or images from third parties. CSS and JavaScript are inline in the page. The browser only connects to GitHub when you click a badge: it opens the release page in a new tab. The plugin sets no cookies and uses no local browser storage.