Skip to content

Prevent plugin installs from clearing unrelated plugins - #311

Open
chubes4 wants to merge 1 commit into
WordPress:trunkfrom
chubes4:fix/310-safe-plugin-zip-target
Open

Prevent plugin installs from clearing unrelated plugins#311
chubes4 wants to merge 1 commit into
WordPress:trunkfrom
chubes4:fix/310-safe-plugin-zip-target

Conversation

@chubes4

@chubes4 chubes4 commented Aug 18, 2026

Copy link
Copy Markdown

Summary

Remove InstallPluginStep first-ZIP-entry slug inference and manual recursive destination deletion. Plugin_Upgrader already derives and clears the package destination when overwrite_package is enabled, while also protecting the plugins root.

A valid ZIP created from the current directory may begin with ./. The old inference treated that as slug ., then deleted WP_PLUGIN_DIR/. before WordPress core could apply its protected-directory checks.

Changes

  • Delegate destination selection and overwrite handling entirely to Plugin_Upgrader.
  • Read the installed folder from the upgrader result for activation.
  • Add a regression ZIP beginning with ./ and assert that an existing unrelated plugin survives while the new plugin installs.

Testing

  • vendor/bin/phpunit components/Blueprints/Tests/Unit/Steps/InstallPluginStepTest.php (6 tests, 17 assertions)
  • vendor/bin/phpunit components/Blueprints/Tests/Unit/Steps (77 tests, 184 assertions)
  • vendor/bin/phpcs -d memory_limit=1G components/Blueprints/Steps/class-installpluginstep.php components/Blueprints/Tests/Unit/Steps/InstallPluginStepTest.php
  • Confirmed the new regression fails before the source change and passes afterward.

Closes #310

AI assistance

OpenCode with openai/gpt-5.6-sol was used to trace the failure through PHP Toolkit and WordPress core, implement the minimal removal of redundant destination handling, and run the regression and component checks. Chris Huber reviewed and remains responsible for every line.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blueprint installPlugin can delete the entire plugins directory for ZIPs rooted at ./

1 participant