Repository navigation
Name the table prefix collision in the uninstall limitations - #69
Merged
Merged
Conversation
WordPress names each user's roles on a site and the site's role
definitions after the table prefix, as {prefix}capabilities in user
meta and {prefix}user_roles in the options. The option_prefixes and
user_meta_global_prefixes sweeps match names with no site prefix, so a
footprint prefix that heads the table prefix, as a plugin prefix of wp
would on a default install, deletes every user's roles and the role
definitions.
The row runs the engine under a table prefix that a footprint prefix
heads and checks that the rows WordPress names after it survive, while
the plugin's own rows go, those under a longer prefix that starts with
the table prefix included.
Assisted-by: Claude Code:claude-opus-5-5
The option_prefixes and user_meta_global_prefixes sweeps deleted every
name under a footprint prefix, so where that prefix heads the table
prefix they also deleted {table prefix}user_roles and every user's
{table prefix}capabilities, locking every user out of the site.
When a footprint prefix heads the table prefix, those two sweeps leave
out every name that starts with the table prefix; a prefix that does
not head it, such as one longer than the table prefix that starts with
it, sweeps as before. Limitation 3 names the rows that stay.
Assisted-by: Claude Code:claude-opus-5-5
ahegyes
changed the title
The guard kept WordPress's roles and capabilities out of the option and global user meta prefix sweeps when a footprint prefix heads the table prefix, which takes a plugin prefix of wp on the default wp_ table prefix, reserved by WordPress, or one that heads a randomized or hand-picked table prefix. That is a consumer's misconfiguration, not a fault under normal use, so the engine carries no code for it. The guard and its row go, and limitation 3 names the hazard: such an entry also deletes the site's roles and every user's capabilities. Assisted-by: Claude Code:claude-opus-5-5
ahegyes
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Limitation 3 names a hazard of the uninstall engine: an
option_prefixesoruser_meta_global_prefixesentry that the table prefix starts with, such aswp_on a default install, also deletes the site's roles and every user's capabilities, which WordPress names after the table prefix. The branch first guarded the two sweeps against it, but the collision takes a plugin prefix WordPress reserves, or one that heads a randomized or hand-picked table prefix, so the guard and its row are removed and only the sentence remains.Affected packages
wp-framework-bootstrapwp-framework-sharedwp-framework-corewp-framework-settingswp-framework-woocommerceAGENTS.md only; the packages are as on
trunk.Checklist
composer quality-checkpasses locally (PHPCS, PHPStan and the tests) (Unit suite on the final commit; the code is identical totrunk)README.md(none)