fix: decode double-encoded base64 in plugin/INSTALL.md

plugin/INSTALL.md

@@ -1 +1,88 @@
-IyBNUE0gQVBJIEV4dHJhcyDigJQgU2VydmVyIEluc3RhbGxhdGlvbiBHdWlkZQoKKipGb3I6KiogbXBtLnRvIHNlcnZlciBhZG1pbmlzdHJhdG9yICAKKipXaGF0IHRoaXMgZG9lczoqKiBBZGRzIGBkZWxldGVgIGFuZCBgdXBkYXRlYCBhY3Rpb25zIHRvIHRoZSBZT1VSTFMgQVBJIHNvIHRoYXQgc2hvcnQgVVJMIG1hbmFnZW1lbnQgdG9vbHMgY2FuIHBlcmZvcm0gYWxsIG9wZXJhdGlvbnMgdXNpbmcgYW4gQVBJIHNpZ25hdHVyZSB0b2tlbiDigJQgbm8gYWRtaW4gcGFzc3dvcmQgcmVxdWlyZWQuCgotLS0KCiMjIFdoYXQgeW91J3JlIGluc3RhbGxpbmcKCkEgc2luZ2xlIFBIUCBwbHVnaW4gZmlsZTogYG1wbS1hcGktZXh0cmFzLnBocGAKClRoaXMgcGx1Z2luIHJlZ2lzdGVycyB0d28gbmV3IGFjdGlvbnMgb24gdGhlIHN0YW5kYXJkIFlPVVJMUyBBUEkgZW5kcG9pbnQgKGAveW91cmxzLWFwaS5waHBgKToKCi0gYGFjdGlvbj1kZWxldGVgIOKAlCBwZXJtYW5lbnRseSByZW1vdmVzIGEgc2hvcnQgVVJMIGJ5IGtleXdvcmQKLSBgYWN0aW9uPXVwZGF0ZWAg4oCUIGNoYW5nZXMgdGhlIGRlc3RpbmF0aW9uIFVSTCwgc2hvcnQgY29kZSwgb3IgdGl0bGUgb2YgYW4gZXhpc3Rpbmcgc2hvcnQgVVJMCgpCb3RoIGFjdGlvbnMgYXJlIGF1dGhlbnRpY2F0ZWQgdGhlIHNhbWUgd2F5IGFzIGFsbCBvdGhlciBZT1VSTFMgQVBJIGNhbGxzOiB2aWEgYSBzaWduYXR1cmUgdG9rZW4uIE5vIGNoYW5nZXMgYXJlIG1hZGUgdG8gdGhlIGFkbWluIGludGVyZmFjZSBvciBhbnkgZXhpc3RpbmcgZnVuY3Rpb25hbGl0eS4KCi0tLQoKIyMgSW5zdGFsbGF0aW9uIHN0ZXBzCgojIyMgMS4gVXBsb2FkIHRoZSBwbHVnaW4gZmlsZQoKQ29weSBgbXBtLWFwaS1leHRyYXMucGhwYCB0byB0aGUgWU9VUkxTICoqdXNlciBwbHVnaW5zIGRpcmVjdG9yeSoqIG9uIHRoZSBzZXJ2ZXIuCgpUaGUgZGVmYXVsdCBsb2NhdGlvbiBpczoKCmBgYAovcGF0aC90by95b3VybHMvdXNlci1wbHVnaW5zL21wbS1hcGktZXh0cmFzLnBocApgYGAKCklmIHlvdSdyZSB1bnN1cmUgb2YgdGhlIHBhdGgsIGNoZWNrIGBjb25maWcucGhwYCBmb3IgdGhlIGBZT1VSTFNfQUJTUEFUSGAgY29uc3RhbnQg4oCUIHRoZSBwbHVnaW5zIGZvbGRlciBpcyBgdXNlci1wbHVnaW5zL2AgcmVsYXRpdmUgdG8gdGhhdC4KClVzaW5nIFNGVFAsIFNDUCwgb3IgeW91ciBob3N0aW5nIGNvbnRyb2wgcGFuZWwncyBmaWxlIG1hbmFnZXIsIHBsYWNlIHRoZSBmaWxlIHRoZXJlLiBUaGUgZGlyZWN0b3J5IHNob3VsZCBhbHJlYWR5IGV4aXN0OyBpZiBpdCBkb2Vzbid0LCBjcmVhdGUgaXQuCgojIyMgMi4gQWN0aXZhdGUgdGhlIHBsdWdpbgoKMS4gTG9nIGludG8gdGhlIFlPVVJMUyBhZG1pbiBwYW5lbCBhdCBgaHR0cHM6Ly9tcG0udG8vYWRtaW4vYAoyLiBOYXZpZ2F0ZSB0byAqKk1hbmFnZSBQbHVnaW5zKiogKGluIHRoZSB0b3AgbmF2aWdhdGlvbikKMy4gRmluZCAqKk1QTSBBUEkgRXh0cmFzKiogaW4gdGhlIGxpc3QKNC4gQ2xpY2sgKipBY3RpdmF0ZSoqCgpZb3Ugc2hvdWxkIHNlZSBhIGNvbmZpcm1hdGlvbiBtZXNzYWdlIGFuZCB0aGUgcGx1Z2luIHN0YXR1cyB3aWxsIGNoYW5nZSB0byAiQWN0aXZlLiIKCiMjIyAzLiBWZXJpZnkgKG9wdGlvbmFsKQoKVG8gY29uZmlybSB0aGUgcGx1Z2luIGlzIHdvcmtpbmcsIHlvdSBjYW4gdGVzdCB0aGUgZGVsZXRlIGFjdGlvbiB3aXRoIGEgbm9uLWV4aXN0ZW50IGtleXdvcmQg4oCUIGl0IHNob3VsZCByZXR1cm4gYSA0MDQgcmF0aGVyIHRoYW4gYW4gIlVua25vd24gYWN0aW9uIiBlcnJvcjoKCmBgYApodHRwczovL21wbS50by95b3VybHMtYXBpLnBocD9zaWduYXR1cmU9PHRva2VuPiZmb3JtYXQ9anNvbiZhY3Rpb249ZGVsZXRlJmtleXdvcmQ9X190ZXN0X18KYGBgCgpFeHBlY3RlZCByZXNwb25zZSAocGx1Z2luIGFjdGl2ZSk6CmBgYGpzb24KeyJzdGF0dXMiOiJmYWlsIiwibWVzc2FnZSI6IlNob3J0IFVSTCBub3QgZm91bmQ6IF9fdGVzdF9fIiwiZXJyb3JDb2RlIjoiNDA0In0KYGBgCgpSZXNwb25zZSBpZiBwbHVnaW4gaXMgKipub3QqKiBhY3RpdmU6CmBgYGpzb24KeyJzaW1wbGUiOiJVbmtub3duIG9yIG1pc3NpbmcgXCJhY3Rpb25cIiBwYXJhbWV0ZXIiLCJtZXNzYWdlIjoiVW5rbm93biBvciBtaXNzaW5nIFwiYWN0aW9uXCIgcGFyYW1ldGVyIiwiZXJyb3JDb2RlIjoiNDAwIn0KYGBgCgotLS0KCiMjIFVuaW5zdGFsbGluZwoKVG8gcmVtb3ZlIHRoZSBwbHVnaW46CgoxLiBHbyB0byAqKk1hbmFnZSBQbHVnaW5zKiog4oaSIGNsaWNrICoqRGVhY3RpdmF0ZSoqIG5leHQgdG8gTVBNIEFQSSBFeHRyYXMKMi4gRGVsZXRlIGB1c2VyLXBsdWdpbnMvbXBtLWFwaS1leHRyYXMucGhwYCBmcm9tIHRoZSBzZXJ2ZXIKClRoZSBgZGVsZXRlYCBhbmQgYHVwZGF0ZWAgQVBJIGFjdGlvbnMgd2lsbCBzdG9wIGJlaW5nIGF2YWlsYWJsZSBpbW1lZGlhdGVseSBhZnRlciBkZWFjdGl2YXRpb24uIE5vIGRhdGEgaXMgcmVtb3ZlZC4KCi0tLQoKIyMgU2VjdXJpdHkgbm90ZXMKCi0gVGhlIHBsdWdpbiBhZGRzIG5vIG5ldyBhdXRoZW50aWNhdGlvbiBtZWNoYW5pc20g4oCUIGl0IHVzZXMgWU9VUkxTJ3MgZXhpc3Rpbmcgc2lnbmF0dXJlIHRva2VuIHN5c3RlbQotIFRoZSB0b2tlbiBtdXN0IGJlIGtlcHQgY29uZmlkZW50aWFsIChpdCdzIHN0b3JlZCBpbiB0aGUgbWFjT1MgS2V5Y2hhaW4gb24gdGhlIHVzZXIncyBtYWNoaW5lLCBub3QgaW4gYW55IGZpbGUpCi0gT25seSBhdXRoZW50aWNhdGVkIEFQSSBjYWxscyBjYW4gdHJpZ2dlciB0aGVzZSBhY3Rpb25zOyB1bmF1dGhlbnRpY2F0ZWQgcmVxdWVzdHMgYXJlIHJlamVjdGVkIGJ5IFlPVVJMUyBiZWZvcmUgdGhlIHBsdWdpbiBjb2RlIHJ1bnMKLSBUaGUgcGx1Z2luIGRvZXMgbm90IGxvZyByZXF1ZXN0cyBvciBzdG9yZSBhbnkgZGF0YQoKLS0tCgojIyBRdWVzdGlvbnM/CgpDb250YWN0IHRoZSBNUE0gdGVhbSBvciByZWZlciB0byB0aGUgW1lPVVJMUyBwbHVnaW4gZG9jdW1lbnRhdGlvbl0oaHR0cHM6Ly95b3VybHMub3JnL2RvY3MvZGV2ZWxvcG1lbnQvcGx1Z2lucykuCg==
+# MPM API Extras — Server Installation Guide
+
+**For:** mpm.to server administrator  
+**What this does:** Adds `delete` and `update` actions to the YOURLS API so that short URL management tools can perform all operations using an API signature token — no admin password required.
+
+---
+
+## What you're installing
+
+A single PHP plugin file: `mpm-api-extras.php`
+
+This plugin registers two new actions on the standard YOURLS API endpoint (`/yourls-api.php`):
+
+- `action=delete` — permanently removes a short URL by keyword
+- `action=update` — changes the destination URL, short code, or title of an existing short URL
+
+Both actions are authenticated the same way as all other YOURLS API calls: via a signature token. No changes are made to the admin interface or any existing functionality.
+
+---
+
+## Installation steps
+
+### 1. Upload the plugin file
+
+Copy `mpm-api-extras.php` to the YOURLS **user plugins directory** on the server.
+
+The default location is:
+
+```
+/path/to/yourls/user-plugins/mpm-api-extras.php
+```
+
+If you're unsure of the path, check `config.php` for the `YOURLS_ABSPATH` constant — the plugins folder is `user-plugins/` relative to that.
+
+Using SFTP, SCP, or your hosting control panel's file manager, place the file there. The directory should already exist; if it doesn't, create it.
+
+### 2. Activate the plugin
+
+1. Log into the YOURLS admin panel at `https://mpm.to/admin/`
+2. Navigate to **Manage Plugins** (in the top navigation)
+3. Find **MPM API Extras** in the list
+4. Click **Activate**
+
+You should see a confirmation message and the plugin status will change to "Active."
+
+### 3. Verify (optional)
+
+To confirm the plugin is working, you can test the delete action with a non-existent keyword — it should return a 404 rather than an "Unknown action" error:
+
+```
+https://mpm.to/yourls-api.php?signature=<token>&format=json&action=delete&keyword=__test__
+```
+
+Expected response (plugin active):
+```json
+{"status":"fail","message":"Short URL not found: __test__","errorCode":"404"}
+```
+
+Response if plugin is **not** active:
+```json
+{"simple":"Unknown or missing \"action\" parameter","message":"Unknown or missing \"action\" parameter","errorCode":"400"}
+```
+
+---
+
+## Uninstalling
+
+To remove the plugin:
+
+1. Go to **Manage Plugins** → click **Deactivate** next to MPM API Extras
+2. Delete `user-plugins/mpm-api-extras.php` from the server
+
+The `delete` and `update` API actions will stop being available immediately after deactivation. No data is removed.
+
+---
+
+## Security notes
+
+- The plugin adds no new authentication mechanism — it uses YOURLS's existing signature token system
+- The token must be kept confidential (it's stored in the macOS Keychain on the user's machine, not in any file)
+- Only authenticated API calls can trigger these actions; unauthenticated requests are rejected by YOURLS before the plugin code runs
+- The plugin does not log requests or store any data
+
+---
+
+## Questions?
+
+Contact the MPM team or refer to the [YOURLS plugin documentation](https://yourls.org/docs/development/plugins).