← All changes | includes/class-database.php +88 -15 2.11.3 → 2.11.8 View file →

		@@ -29,8 +29,18 @@
29	29	*/
30	30	const DB_VERSION_OPTION = 'vigilante_db_version';
31	31
32	32	/**
	33	+ * Records that the destructive part of the 2.11.0 migration already ran.
	34	+ *
	35	+ * A marker of its own, not a point on the version chain, because what it
	36	+ * governs deletes rows. See purge_for_2_11_0().
	37	+ *
	38	+ * @since 2.11.4
	39	+ */
	40	+ const PURGE_2_11_0_OPTION = 'vigilante_purge_2_11_0_done';
	41	+
	42	+ /**
33	43	* Activity log table name (without prefix)
34	44	*
35	45	* @var string
36	46	*/
		@@ -103,18 +113,8 @@
103	113	return $this->wpdb->prefix . $table;
104	114	}
105	115
106	116	/**
107		- * Get escaped table name for use in SQL queries
108		- *
109		- * @param string $table Full table name.
110		- * @return string Escaped table name with backticks.
111		- */
112		- private function esc_table( $table ) {
113		- return '`' . esc_sql( $table ) . '`';
114		- }
115		-
116		- /**
117	117	* Get activity log table name
118	118	*
119	119	* @return string
120	120	*/
		@@ -317,15 +317,49 @@
317	317	) $charset_collate;";
318	318
319	319	dbDelta( $two_factor_totp_sql );
320	320
321		- // Store database version
322		- update_option( self::DB_VERSION_OPTION, self::DB_VERSION );
	321	+ $this->store_schema_version();
323	322
324	323	return $result;
325	324	}
326	325
327	326	/**
	327	+ * Write the schema version, but never walk the stored value backwards
	328	+ *
	329	+ * vigilante_db_version is written on two different scales into the same
	330	+ * option: this class counts in schema versions, currently 1.4.0, and
	331	+ * Vigilante_Admin::run_migrations() counts in plugin versions, currently
	332	+ * 2.11.0. For version_compare, 1.4.0 is LOWER than 1.14.0, so a site whose
	333	+ * option was last written here reads as being behind almost every step of
	334	+ * that chain and runs them all again.
	335	+ *
	336	+ * That was not a corner case. create_tables() is called unconditionally by
	337	+ * the activator, so deactivating and reactivating the plugin on a perfectly
	338	+ * up-to-date site sent it back to 1.4.0 and replayed eleven migrations,
	339	+ * among them the one that empties the trusted devices and the pending
	340	+ * second-factor codes. Every user of that site had to pass the second
	341	+ * factor again, for no reason, every single time somebody toggled the
	342	+ * plugin. Reported by @calzbert, who worked it out from the code after the
	343	+ * 1.4.0 reading turned up on a site here.
	344	+ *
	345	+ * Refusing to go backwards fixes that without touching the two scales,
	346	+ * which is a separate job. A brand new site still starts here, with no
	347	+ * option at all, and that is correct: it has never run the chain.
	348	+ *
	349	+ * @since 2.11.4
	350	+ *
	351	+ * @return void
	352	+ */
	353	+ private function store_schema_version() {
	354	+ $stored = get_option( self::DB_VERSION_OPTION, '0' );
	355	+
	356	+ if ( version_compare( $stored, self::DB_VERSION, '<' ) ) {
	357	+ update_option( self::DB_VERSION_OPTION, self::DB_VERSION );
	358	+ }
	359	+ }
	360	+
	361	+ /**
328	362	* Check if tables need to be updated
329	363	*
330	364	* @return bool True if update needed.
331	365	*/
		@@ -375,10 +409,9 @@
375	409	}
376	410	}
377	411	// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
378	412
379		- // Update stored version
380		- update_option( self::DB_VERSION_OPTION, self::DB_VERSION );
	413	+ $this->store_schema_version();
381	414	}
382	415
383	416	/**
384	417	* Schema changes and purges of the 2.11.0 security release
		@@ -396,10 +429,40 @@
396	429	* hash from now on, so any pending code would fail; they expire in
397	430	* minutes and a new one is a click away.
398	431	*
399	432	* @since 2.11.0
	433	+ *
	434	+ * @return bool True when it ran, false when it had already run.
400	435	*/
401	436	public function purge_for_2_11_0() {
	437	+ /*
	438	+ * Its own one-off marker, and not a point on the version chain.
	439	+ *
	440	+ * This deletes rows, and it hung off a version comparison that could
	441	+ * walk backwards, so every reactivation replayed it. store_schema_version()
	442	+ * closes that particular door, but the lesson is more general than the
	443	+ * door: a migration that deletes rows should not depend on a version
	444	+ * number staying where it was put.
	445	+ *
	446	+ * Both the marker and the tables are per site (get_table_name() builds
	447	+ * on $wpdb->prefix), so the pair travels together and there is no case
	448	+ * where one site's marker stops another site's purge. A subsite created
	449	+ * after a network-wide activation is NOT covered by this marker, and
	450	+ * does not need to be: it has no marker, so it purges, and what it
	451	+ * purges are its own tables, created empty moments earlier.
	452	+ *
	453	+ * Marked AFTER the deletes, unlike the network sweep of the baselines,
	454	+ * and the asymmetry is deliberate. There, repeating the walk is
	455	+ * expensive and not finishing it costs only time. Here, repeating the
	456	+ * deletes costs one more prompt for the second factor, while not doing
	457	+ * them at all would leave the trusted devices that were identified by
	458	+ * User-Agent in place, which is the bypass this purge exists to close.
	459	+ * When in doubt, repeat the harmless one. Marker added in 2.11.4.
	460	+ */
	461	+ if ( get_option( self::PURGE_2_11_0_OPTION ) ) {
	462	+ return false;
	463	+ }
	464	+
402	465	// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- %i placeholder requires WP 6.2+, and the sniff reports inside prepare(). Plugin tables, no cache to invalidate.
403	466	$this->wpdb->query(
404	467	$this->wpdb->prepare( 'DELETE FROM %i', $this->get_2fa_devices_table() )
405	468	);
		@@ -406,8 +469,12 @@
406	469	$this->wpdb->query(
407	470	$this->wpdb->prepare( 'DELETE FROM %i', $this->get_2fa_codes_table() )
408	471	);
409	472	// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	473	+
	474	+ update_option( self::PURGE_2_11_0_OPTION, '1', false );
	475	+
	476	+ return true;
410	477	}
411	478
412	479	/**
413	480	* Drop all plugin tables
		@@ -431,8 +498,9 @@
431	498	}
432	499	// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
433	500
434	501	delete_option( self::DB_VERSION_OPTION );
	502	+ delete_option( self::PURGE_2_11_0_OPTION );
435	503
436	504	return true;
437	505	}
438	506
		@@ -1108,10 +1176,15 @@
1108	1176	'code' => $code,
1109	1177	'expires_at' => $expires_at,
1110	1178	'attempts' => 0,
1111	1179	'used' => 0,
	1180	+ // In UTC, like expires_at. Left to the column default it was the
	1181	+ // MySQL server's local time, and the resend limit compares it with
	1182	+ // time(): on servers behind UTC it never held, and ahead of UTC it
	1183	+ // refused a legitimate resend for hours (rule 19, 2.11.8).
	1184	+ 'created_at' => current_time( 'mysql', true ),
1112	1185	),
1113		- array( '%d', '%s', '%s', '%d', '%d' )
	1186	+ array( '%d', '%s', '%s', '%d', '%d', '%s' )
1114	1187	);
1115	1188
1116	1189	return $result ? $this->wpdb->insert_id : false;
1117	1190	}