← All changes | uninstall.php +171 -22 2.9.7 → 2.11.8 View file →

		@@ -4,8 +4,12 @@
4	4	*
5	5	* This file runs when the plugin is deleted via WordPress admin.
6	6	* It removes all plugin data including database tables and options.
7	7	*
	8	+ * On a network it visits every site: tables, options, transients and cron
	9	+ * events are per site, so cleaning only the site that runs the uninstall
	10	+ * left everything else behind until 2.11.0 (S13 of the 28 Aug 2026 audit).
	11	+ *
8	12	* @package Vigilante
9	13	*/
10	14
11	15	// Exit if not called by WordPress
		@@ -29,8 +33,113 @@
29	33	*/
30	34	function vigilante_uninstall() {
31	35	global $wpdb;
32	36
	37	+ /*
	38	+ * Per-site data. switch_to_blog() repoints $wpdb->prefix, $wpdb->options
	39	+ * and the cron option, so the same routine serves every site of a network.
	40	+ * 'number' => 0 lifts the default cap of 100 sites: an uninstall that
	41	+ * cleaned the first hundred sites and left the rest would be the same bug
	42	+ * with a bigger threshold.
	43	+ */
	44	+ if ( is_multisite() ) {
	45	+ $site_ids = get_sites(
	46	+ array(
	47	+ 'fields' => 'ids',
	48	+ 'number' => 0,
	49	+ )
	50	+ );
	51	+
	52	+ foreach ( $site_ids as $site_id ) {
	53	+ switch_to_blog( $site_id );
	54	+ vigilante_uninstall_site();
	55	+ restore_current_blog();
	56	+ }
	57	+ } else {
	58	+ vigilante_uninstall_site();
	59	+ }
	60	+
	61	+ /*
	62	+ * Network options. Since 2.11.3 the baseline of the critical files lives in
	63	+ * a single network option, because both files it watches, wp-config.php and
	64	+ * the root .htaccess, belong to the installation and not to any one site.
	65	+ * It is stored redacted, but it is still a copy of the configuration and it
	66	+ * goes when the plugin goes. Once, not per site.
	67	+ */
	68	+ if ( is_multisite() ) {
	69	+ delete_site_option( 'vigilante_critical_files_baseline' );
	70	+ delete_site_option( 'vigilante_baseline_sweep' );
	71	+ delete_site_option( 'vigilante_owned_blocks' );
	72	+ delete_site_option( 'vigilante_owned_blocks_claim' );
	73	+ delete_site_option( 'vigilante_config_copies_sweep' );
	74	+ delete_site_option( 'vigilante_results_sweep' );
	75	+ }
	76	+
	77	+ // Remove backup directory. WP_CONTENT_DIR is shared by the whole network,
	78	+ // so this happens once.
	79	+ $backup_dir = WP_CONTENT_DIR . '/vigilante-backups/';
	80	+ if ( is_dir( $backup_dir ) ) {
	81	+ vigilante_recursive_rmdir( $backup_dir );
	82	+ }
	83	+
	84	+ // Delete all user meta with vigilante_ prefix. The usermeta table is global
	85	+ // on a network, so this also happens once.
	86	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin's own user meta (prefix vigilante_) swept by pattern at uninstall; no cache to invalidate once the plugin is gone.
	87	+ $wpdb->query(
	88	+ "DELETE FROM {$wpdb->usermeta} WHERE meta_key LIKE 'vigilante\_%'"
	89	+ );
	90	+
	91	+ /*
	92	+ * The plugin is still loaded in the request that runs this file, so
	93	+ * whatever it does later, on shutdown or on a late hook, writes its data
	94	+ * back after the cleanup above has finished. Measured on 22 aug 2026: an
	95	+ * uninstall left 112 rows of plugin status transients and its last check
	96	+ * timestamp behind, all of them written after this file had run. So the
	97	+ * sweep is repeated at the very end of the request. The loaded plugin is
	98	+ * the current site's instance and writes to the current site, which is
	99	+ * why the sweep does not visit the network again.
	100	+ */
	101	+ add_action( 'shutdown', 'vigilante_uninstall_final_sweep', PHP_INT_MAX );
	102	+}
	103	+
	104	+/**
	105	+ * Remove the data of the current site (tables, options, transients, cron)
	106	+ *
	107	+ * Runs once on a single site and once per site on a network, after
	108	+ * switch_to_blog().
	109	+ *
	110	+ * @since 2.11.0 Extracted from vigilante_uninstall() so a network can loop it.
	111	+ */
	112	+function vigilante_uninstall_site() {
	113	+ global $wpdb;
	114	+
	115	+ /*
	116	+ * The scheduled events go first. WordPress can spawn wp-cron in the middle
	117	+ * of an uninstall, and that loopback request runs in its own process with
	118	+ * the plugin still on disk: clearing the events before anything else means
	119	+ * it finds nothing to run.
	120	+ */
	121	+ // Clear scheduled hooks
	122	+ $hooks_to_clear = array(
	123	+ 'vigilante_daily_maintenance',
	124	+ 'vigilante_hourly_check',
	125	+ 'vigilante_hourly_checks',
	126	+ 'vigilante_file_integrity_scan',
	127	+ 'vigilante_cleanup_logs',
	128	+ 'vigilante_password_expiry_reminder',
	129	+ 'vigilante_analyzer_weekly_scan',
	130	+ 'vigilante_under_attack_post_scan',
	131	+ 'vigilante_plugin_status_check',
	132	+ );
	133	+
	134	+ foreach ( $hooks_to_clear as $hook ) {
	135	+ wp_clear_scheduled_hook( $hook );
	136	+ }
	137	+
	138	+ // Post-update verification events are scheduled with per-update arguments,
	139	+ // so clear every instance regardless of args.
	140	+ wp_unschedule_hook( 'vigilante_fi_postupdate_verify' );
	141	+
33	142	// Drop custom tables
34	143	$tables = array(
35	144	$wpdb->prefix . 'vigilante_activity_log',
36	145	$wpdb->prefix . 'vigilante_login_attempts',
		@@ -41,9 +150,9 @@
41	150	$wpdb->prefix . 'vigilante_2fa_totp',
42	151	);
43	152
44	153	foreach ( $tables as $table ) {
45		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.DirectDatabaseQuery.SchemaChange,WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	154	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.DirectDatabaseQuery.SchemaChange,WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Dropping the plugin's own tables at uninstall; the name comes from $wpdb->prefix and a literal, never from input.
46	155	$wpdb->query( "DROP TABLE IF EXISTS {$table}" );
47	156	}
48	157
49	158	// Delete options
		@@ -49,8 +158,12 @@
49	158	// Delete options
50	159	$options_to_delete = array(
51	160	'vigilante_options',
52	161	'vigilante_db_version',
	162	+ 'vigilante_purge_2_11_0_done',
	163	+ 'vigilante_baseline_redaction',
	164	+ 'vigilante_owned_blocks',
	165	+ 'vigilante_owned_blocks_claim',
53	166	'vigilante_backup_timestamp',
54	167	'vigilante_last_integrity_scan',
55	168	'vigilante_last_integrity_results',
56	169	'vigilante_ignored_files',
		@@ -64,8 +177,12 @@
64	177	'vigilante_analyzer_history',
65	178	'vigilante_legacy_backups_cleaned',
66	179	'vigilante_css_exclusion_migrated',
67	180	'vigilante_checksum_cache_flushed_290',
	181	+ 'vigilante_server_software',
	182	+ 'vigilante_server_files_version',
	183	+ 'vigilante_server_files_pending',
	184	+ 'vigilante_server_files_retry_after',
68	185	// Safety copies taken before writing to the site's configuration files.
69	186	// The wp-config.php one holds the database credentials and the
70	187	// authentication salts, so leaving it behind would keep them readable in
71	188	// the options table long after the plugin is gone.
		@@ -70,10 +187,14 @@
70	187	// authentication salts, so leaving it behind would keep them readable in
71	188	// the options table long after the plugin is gone.
72	189	'vigilante_htaccess_backup',
73	190	'vigilante_wpconfig_backup',
	191	+ 'vigilante_config_copies_purged',
	192	+ 'vigilante_config_copies_sweep_lock',
	193	+ 'vigilante_htaccess_write_lock',
74	194	'vigilante_plugin_status_state',
75	195	'vigilante_plugin_status_last_check',
	196	+ 'vigilante_ignored_closed_plugins',
76	197	);
77	198
78	199	foreach ( $options_to_delete as $option ) {
79	200	delete_option( $option );
		@@ -80,29 +201,38 @@
80	201	}
81	202
82	203	// Per-backup records are named after their timestamp
83	204	// (vigilante_backup_info_<Y-m-d_H-i-s>), so a fixed list cannot reach them.
84		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
	205	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin's own options swept by pattern at uninstall; the options API has no LIKE.
85	206	$wpdb->query(
86	207	"DELETE FROM {$wpdb->options} WHERE option_name LIKE 'vigilante_backup_info_%'"
87	208	);
88	209
89	210	// Delete all transients
90		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
	211	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin's own transients swept by pattern at uninstall; the transients API has no LIKE.
91	212	$wpdb->query(
92		- "DELETE FROM {$wpdb->options}
93		- WHERE option_name LIKE '_transient_vigilante_%'
	213	+ "DELETE FROM {$wpdb->options}
	214	+ WHERE option_name LIKE '_transient_vigilante_%'
94	215	OR option_name LIKE '_transient_timeout_vigilante_%'"
95	216	);
	217	+}
96	218
97		- // Remove backup directory
98		- $backup_dir = WP_CONTENT_DIR . '/vigilante-backups/';
99		- if ( is_dir( $backup_dir ) ) {
100		- vigilante_recursive_rmdir( $backup_dir );
101		- }
	219	+/**
	220	+ * Second pass at the end of the request, for anything written after the first one
	221	+ *
	222	+ * Deliberately not a blunt "vigilante%" wildcard: other plugins live under that
	223	+ * name too, the network sync companion among them, and deleting their options
	224	+ * from here would be a fine way to break somebody else's site.
	225	+ *
	226	+ * @since 2.9.9
	227	+ */
	228	+function vigilante_uninstall_final_sweep() {
	229	+ global $wpdb;
102	230
103		- // Clear scheduled hooks
104		- $hooks_to_clear = array(
	231	+ // The scheduled events go too: they are rescheduled by the plugin that is
	232	+ // still loaded in this request, which is how vigilante_plugin_status_check
	233	+ // survived an uninstall until 2.9.9.
	234	+ $hooks = array(
105	235	'vigilante_daily_maintenance',
106	236	'vigilante_hourly_check',
107	237	'vigilante_hourly_checks',
108	238	'vigilante_file_integrity_scan',
		@@ -109,22 +239,41 @@
109	239	'vigilante_cleanup_logs',
110	240	'vigilante_password_expiry_reminder',
111	241	'vigilante_analyzer_weekly_scan',
112	242	'vigilante_under_attack_post_scan',
	243	+ 'vigilante_plugin_status_check',
	244	+ 'vigilante_fi_postupdate_verify',
113	245	);
114	246
115		- foreach ( $hooks_to_clear as $hook ) {
116		- wp_clear_scheduled_hook( $hook );
	247	+ foreach ( $hooks as $hook ) {
	248	+ wp_unschedule_hook( $hook );
117	249	}
118	250
119		- // Post-update verification events are scheduled with per-update arguments,
120		- // so clear every instance regardless of args.
121		- wp_unschedule_hook( 'vigilante_fi_postupdate_verify' );
122		-
123		- // Delete all user meta with vigilante_ prefix
124		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
	251	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Same sweep as vigilante_uninstall_site(), repeated at shutdown for rows the still-loaded plugin wrote back after the first pass.
125	252	$wpdb->query(
126		- "DELETE FROM {$wpdb->usermeta} WHERE meta_key LIKE 'vigilante\_%'"
	253	+ "DELETE FROM {$wpdb->options}
	254	+ WHERE option_name LIKE '_transient_vigilante\_%'
	255	+ OR option_name LIKE '_transient_timeout_vigilante\_%'
	256	+ OR option_name LIKE 'vigilante_plugin_status\_%'
	257	+ OR option_name LIKE 'vigilante_backup_info\_%'
	258	+ OR option_name IN (
	259	+ 'vigilante_options',
	260	+ 'vigilante_db_version',
	261	+ 'vigilante_purge_2_11_0_done',
	262	+ 'vigilante_baseline_redaction',
	263	+ 'vigilante_critical_files_baseline',
	264	+ 'vigilante_owned_blocks',
	265	+ 'vigilante_owned_blocks_claim',
	266	+ 'vigilante_ignored_closed_plugins',
	267	+ 'vigilante_ignored_files',
	268	+ 'vigilante_dismissed_notices',
	269	+ 'vigilante_under_attack_mode',
	270	+ 'vigilante_active_preset',
	271	+ 'vigilante_server_software',
	272	+ 'vigilante_server_files_version',
	273	+ 'vigilante_server_files_pending',
	274	+ 'vigilante_server_files_retry_after'
	275	+ )"
127	276	);
128	277	}
129	278
130	279	/**
		@@ -153,5 +302,5 @@
153	302	return $wp_filesystem->delete( $dir, true );
154	303	}
155	304
156	305	// Run uninstall
157		-vigilante_uninstall();
	306	+vigilante_uninstall();