Plugin Update Checker: Privacy
Privacy of the Plugin Update Checker: which requests go to GitHub, which data is transmitted, what is stored locally and where the optional token is kept.
Plugin Update Checker: Privacy
The plugin sends requests to an external service on its own, namely GitHub. This page describes exactly what happens. It is not a substitute for a legal review of your installation.
External requests
- Target: only
api.github.com, path/repos/<owner>/<repo>/releases/latest. - Trigger: An admin opens the plugin list in the Admin Panel and no valid cache entry exists for a plugin. On all other pages and on AJAX requests the plugin sends nothing.
- Number: One request per installed plugin whose
urlpoints to a GitHub repository, at most once per cache duration (default 6 hours). If a request fails, it is repeated after one hour at the earliest. - No background process: The plugin has no cron job and no daemon. It only queries when the plugin list is loaded.
What is transmitted to GitHub
| Item | Content |
|---|---|
| IP address | that of the osTicket server, not of the admin's browser |
| URL | owner and name of the repository, as given in the respective plugin's plugin.php |
| User agent | fixed value osTicket-Plugin-UpdateChecker/... |
| Accept header | application/vnd.github.v3+json |
| Authorization header | only if you entered a GitHub token: Bearer <token> |
Not transmitted are ticket data, data of agents or customers, the osTicket URL, the name or version of the osTicket system and the installed version of the plugins. However, GitHub learns from the sequence of requests which plugins a server with this IP address uses and, if a token is entered, which GitHub account the requests belong to.
What is stored locally
- Cache files in the server's temp directory, folder
osticket-update-check: one JSON file per repository with release tag, release URL and expiry time, and the markernonefor errors. Personal data and the token are not stored there. - GitHub token in osTicket's plugin configuration in the database, as an ordinary text field.
- Error messages in the PHP error log, for example
[UpdateCheck] GitHub API HTTP 403 for /repos/<owner>/<repo>/releases/latest. The token is not logged.
In the browser
The plugin does not include scripts, fonts or images from third parties. CSS and JavaScript are inline in the page. The browser only connects to GitHub when you click a badge: it opens the release page in a new tab. The plugin sets no cookies and uses no local browser storage.
Switching it off
- Disable the plugin: no more requests are sent.
- Block outgoing connections from the server to GitHub: the plugin then shows no badges. Each blocked request can delay the plugin list by up to 5 seconds, after which the failure is remembered for one hour.
- Remove the token: clear the GitHub Token (optional) field or revoke the token at GitHub.