Added the option for secure_plugins_only

app.json

@@ -34,6 +34,10 @@
         "GITHUB_TOKEN": {
             "description": "A github personal access token with the repo scope.",
             "required": false
+        },
+        "REGISTRY_PLUGINS_ONLY": {
+            "description": "If set to true, only plugins that are in the registry can be loaded.",
+            "required": false
         }
     }
 }

cogs/plugins.py

@@ -302,6 +302,14 @@ async def parse_user_input(self, ctx, plugin_name, check_version=False):
             plugin = Plugin(user, repo, plugin_name, branch)
 
         else:
+            if not self.bot.config.get("registry_plugins_only", False):
+                embed = discord.Embed(
+                    description="This plugin is not in the registry. "
+                    "To install it, you must set `REGISTRY_PLUGINS_ONLY=false` in your .env file or config settings.",
+                    color=self.bot.error_color,
+                )
+                await ctx.send(embed=embed)
+                return
             try:
                 plugin = Plugin.from_string(plugin_name)
             except InvalidPluginError:

core/config.py

@@ -167,6 +167,7 @@ class ConfigManager:
         "connection_uri": None,  # replace mongo uri in the future
         "owners": None,
         "enable_presence_intent": False,
+        "registry_plugins_only": False,
         # bot
         "token": None,
         "enable_plugins": True,
@@ -223,6 +224,7 @@ class ConfigManager:
         "thread_show_join_age",
         "use_hoisted_top_role",
         "enable_presence_intent",
+        "registry_plugins_only",
     }
 
     enums = {