Skip to content

Commit 6a95e7f

Browse files
kasparsdkasparsd
authored
Merge pull request #637 from WordPress/630-fix-uninstall
Delete user meta on plugin uninstall
2 parents 642f665 + c152d19 commit 6a95e7f

8 files changed

+221
-23
lines changed

‎class-two-factor-core.php

+124-23
Original file line numberDiff line numberDiff line change
@@ -132,13 +132,67 @@ public static function add_hooks( $compat ) {
132132
}
133133

134134
/**
135-
* For each provider, include it and then instantiate it.
135+
* Delete all plugin data on uninstall.
136136
*
137-
* @since 0.1-dev
137+
* @return void
138+
*/
139+
public static function uninstall() {
140+
// Keep this updated as user meta keys are added or removed.
141+
$user_meta_keys = array(
142+
self::PROVIDER_USER_META_KEY,
143+
self::ENABLED_PROVIDERS_USER_META_KEY,
144+
self::USER_META_NONCE_KEY,
145+
self::USER_RATE_LIMIT_KEY,
146+
self::USER_FAILED_LOGIN_ATTEMPTS_KEY,
147+
self::USER_PASSWORD_WAS_RESET_KEY,
148+
);
149+
150+
$option_keys = array();
151+
152+
foreach ( self::get_providers_classes() as $provider_class ) {
153+
// Merge with provider-specific user meta keys.
154+
if ( method_exists( $provider_class, 'uninstall_user_meta_keys' ) ) {
155+
try {
156+
$user_meta_keys = array_merge(
157+
$user_meta_keys,
158+
call_user_func( array( $provider_class, 'uninstall_user_meta_keys' ) )
159+
);
160+
} catch ( Exception $e ) {
161+
// Do nothing.
162+
}
163+
}
164+
165+
// Merge with provider-specific option keys.
166+
if ( method_exists( $provider_class, 'uninstall_options' ) ) {
167+
try {
168+
$option_keys = array_merge(
169+
$option_keys,
170+
call_user_func( array( $provider_class, 'uninstall_options' ) )
171+
);
172+
} catch ( Exception $e ) {
173+
// Do nothing.
174+
}
175+
}
176+
}
177+
178+
// Delete options first since that is faster.
179+
if ( ! empty( $option_keys ) ) {
180+
foreach ( $option_keys as $option_key ) {
181+
delete_option( $option_key );
182+
}
183+
}
184+
185+
foreach ( $user_meta_keys as $meta_key ) {
186+
delete_metadata( 'user', null, $meta_key, null, true );
187+
}
188+
}
189+
190+
/**
191+
* Get the registered providers of which some might not be enabled.
138192
*
139-
* @return array
193+
* @return array List of provider keys and paths to class files.
140194
*/
141-
public static function get_providers() {
195+
public static function get_providers_registered() {
142196
$providers = array(
143197
'Two_Factor_Email' => TWO_FACTOR_DIR . 'providers/class-two-factor-email.php',
144198
'Two_Factor_Totp' => TWO_FACTOR_DIR . 'providers/class-two-factor-totp.php',
@@ -150,29 +204,29 @@ public static function get_providers() {
150204
/**
151205
* Filter the supplied providers.
152206
*
153-
* This lets third-parties either remove providers (such as Email), or
154-
* add their own providers (such as text message or Clef).
155-
*
156207
* @param array $providers A key-value array where the key is the class name, and
157208
* the value is the path to the file containing the class.
158209
*/
159-
$providers = apply_filters( 'two_factor_providers', $providers );
210+
$additional_providers = apply_filters( 'two_factor_providers', $providers );
160211

161-
// FIDO U2F is PHP 5.3+ only.
162-
if ( isset( $providers['Two_Factor_FIDO_U2F'] ) && version_compare( PHP_VERSION, '5.3.0', '<' ) ) {
163-
unset( $providers['Two_Factor_FIDO_U2F'] );
164-
trigger_error( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_trigger_error
165-
sprintf(
166-
/* translators: %s: version number */
167-
__( 'FIDO U2F is not available because you are using PHP %s. (Requires 5.3 or greater)', 'two-factor' ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
168-
PHP_VERSION
169-
)
170-
);
212+
// Merge them with the default providers.
213+
if ( ! empty( $additional_providers ) ) {
214+
return array_merge( $providers, $additional_providers );
171215
}
172216

173-
/**
174-
* For each filtered provider,
175-
*/
217+
return $providers;
218+
}
219+
220+
/**
221+
* Get the classnames for all registered providers.
222+
*
223+
* Note some of these providers might not be enabled.
224+
*
225+
* @return array List of provider keys and classnames.
226+
*/
227+
private static function get_providers_classes() {
228+
$providers = self::get_providers_registered();
229+
176230
foreach ( $providers as $provider_key => $path ) {
177231
require_once $path;
178232

@@ -189,9 +243,56 @@ public static function get_providers() {
189243
/**
190244
* Confirm that it's been successfully included before instantiating.
191245
*/
192-
if ( class_exists( $class ) ) {
246+
if ( method_exists( $class, 'get_instance' ) ) {
247+
$providers[ $provider_key ] = $class;
248+
} else {
249+
unset( $providers[ $provider_key ] );
250+
}
251+
}
252+
253+
return $providers;
254+
}
255+
256+
/**
257+
* Get all enabled two-factor providers.
258+
*
259+
* @since 0.1-dev
260+
*
261+
* @return array
262+
*/
263+
public static function get_providers() {
264+
$providers = self::get_providers_registered();
265+
266+
/**
267+
* Filter the supplied providers.
268+
*
269+
* This lets third-parties either remove providers (such as Email), or
270+
* add their own providers (such as text message or Clef).
271+
*
272+
* @param array $providers A key-value array where the key is the class name, and
273+
* the value is the path to the file containing the class.
274+
*/
275+
$providers = apply_filters( 'two_factor_providers', $providers );
276+
277+
// FIDO U2F is PHP 5.3+ only.
278+
if ( isset( $providers['Two_Factor_FIDO_U2F'] ) && version_compare( PHP_VERSION, '5.3.0', '<' ) ) {
279+
unset( $providers['Two_Factor_FIDO_U2F'] );
280+
trigger_error( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_trigger_error
281+
sprintf(
282+
/* translators: %s: version number */
283+
__( 'FIDO U2F is not available because you are using PHP %s. (Requires 5.3 or greater)', 'two-factor' ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
284+
PHP_VERSION
285+
)
286+
);
287+
}
288+
289+
// Map provider keys to classes so that we can instantiate them.
290+
$providers = array_intersect_key( self::get_providers_classes(), $providers );
291+
292+
foreach ( $providers as $provider_key => $provider_class ) {
293+
if ( method_exists( $provider_class, 'get_instance' ) ) {
193294
try {
194-
$providers[ $provider_key ] = call_user_func( array( $class, 'get_instance' ) );
295+
$providers[ $provider_key ] = call_user_func( array( $provider_class, 'get_instance' ) );
195296
} catch ( Exception $e ) {
196297
unset( $providers[ $provider_key ] );
197298
}

‎providers/class-two-factor-backup-codes.php

+11
Original file line numberDiff line numberDiff line change
@@ -399,4 +399,15 @@ public function delete_code( $user, $code_hashed ) {
399399
// Update the backup code master list.
400400
update_user_meta( $user->ID, self::BACKUP_CODES_META_KEY, $backup_codes );
401401
}
402+
403+
/**
404+
* Return user meta keys to delete during plugin uninstall.
405+
*
406+
* @return array
407+
*/
408+
public static function uninstall_user_meta_keys() {
409+
return array(
410+
self::BACKUP_CODES_META_KEY,
411+
);
412+
}
402413
}

‎providers/class-two-factor-email.php

+12
Original file line numberDiff line numberDiff line change
@@ -351,4 +351,16 @@ public function user_options( $user ) {
351351
</div>
352352
<?php
353353
}
354+
355+
/**
356+
* Return user meta keys to delete during plugin uninstall.
357+
*
358+
* @return array
359+
*/
360+
public static function uninstall_user_meta_keys() {
361+
return array(
362+
self::TOKEN_META_KEY,
363+
self::TOKEN_META_KEY_TIMESTAMP,
364+
);
365+
}
354366
}

‎providers/class-two-factor-fido-u2f.php

+13
Original file line numberDiff line numberDiff line change
@@ -388,4 +388,17 @@ public static function delete_security_key( $user_id, $keyHandle = null ) { // p
388388

389389
return true;
390390
}
391+
392+
/**
393+
* Return user meta keys to delete during plugin uninstall.
394+
*
395+
* @return array
396+
*/
397+
public static function uninstall_user_meta_keys() {
398+
return array(
399+
self::REGISTERED_KEY_USER_META_KEY,
400+
self::AUTH_DATA_USER_META_KEY,
401+
'_two_factor_fido_u2f_register_request', // From Two_Factor_FIDO_U2F_Admin which is not loaded during uninstall.
402+
);
403+
}
391404
}

‎providers/class-two-factor-provider.php

+20
Original file line numberDiff line numberDiff line change
@@ -165,4 +165,24 @@ public static function sanitize_code_from_request( $field, $length = 0 ) {
165165

166166
return (string) $code;
167167
}
168+
169+
/**
170+
* Return the user meta keys that need to be deletated on plugin uninstall.
171+
*
172+
* @return array
173+
*/
174+
public static function uninstall_user_meta_keys() {
175+
return array();
176+
}
177+
178+
/**
179+
* Return the option keys that need to be deleted on plugin uninstall.
180+
*
181+
* Note: this method doesn't have access to the instantiated provider object.
182+
*
183+
* @return array
184+
*/
185+
public static function uninstall_options() {
186+
return array();
187+
}
168188
}

‎providers/class-two-factor-totp.php

+12
Original file line numberDiff line numberDiff line change
@@ -771,4 +771,16 @@ private static function abssort( $a, $b ) {
771771
}
772772
return ( $a < $b ) ? -1 : 1;
773773
}
774+
775+
/**
776+
* Return user meta keys to delete during plugin uninstall.
777+
*
778+
* @return array
779+
*/
780+
public static function uninstall_user_meta_keys() {
781+
return array(
782+
self::SECRET_META_KEY,
783+
self::LAST_SUCCESSFUL_LOGIN_META_KEY,
784+
);
785+
}
774786
}

‎tests/class-two-factor-core.php

+26
Original file line numberDiff line numberDiff line change
@@ -1555,4 +1555,30 @@ public function test_all_sessions_destroyed_when_enabling_2fa_by_admin() {
15551555
// Validate that the Admin still has a session.
15561556
$this->assertCount( 1, $admin_session_manager->get_all(), 'No admin sessions are present first' );
15571557
}
1558+
1559+
/**
1560+
* Plugin uninstall removes all user meta.
1561+
*
1562+
* @covers Two_Factor_Core::uninstall
1563+
*/
1564+
public function test_uninstall_removes_user_meta() {
1565+
$user = self::factory()->user->create_and_get();
1566+
1567+
// Enable a provider for the user.
1568+
Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
1569+
1570+
$this->assertContains(
1571+
'Two_Factor_Totp',
1572+
Two_Factor_Core::get_enabled_providers_for_user( $user->ID ),
1573+
'Sample provider was enabled'
1574+
);
1575+
1576+
Two_Factor_Core::uninstall();
1577+
1578+
$this->assertNotContains(
1579+
'Two_Factor_Totp',
1580+
Two_Factor_Core::get_enabled_providers_for_user( $user->ID ),
1581+
'Provider was disabled due to uninstall'
1582+
);
1583+
}
15581584
}

‎two-factor.php

+3
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,6 @@
5050
$two_factor_compat = new Two_Factor_Compat();
5151

5252
Two_Factor_Core::add_hooks( $two_factor_compat );
53+
54+
// Delete our options and user meta during uninstall.
55+
register_uninstall_hook( __FILE__, array( Two_Factor_Core::class, 'uninstall' ) );

0 commit comments

Comments
 (0)