Comments on: WordPress 2.7 Plugin Uninstall Methods

By: Jacob Santos

Jacob Santos — Mon, 18 Aug 2008 12:23:16 +0000

@wesley

I added some code to prevent uninstall.php for that method. If you look for those two and add current_user_can() capability check for whether the user can delete plugins, you should be protected against something happening like that.

By: wesley

wesley — Mon, 18 Aug 2008 09:47:24 +0000

So, could a user simply access bla.com/wp-plugins/myplugin/uninstall.php to start the uninstallation? You did not provide a sample uninstall file. Could you do so?

Even if it’s only the admin, it could still be executed if he visits a page that iframes the uninstall.php or whatever.

By: Jacob Santos

Jacob Santos — Tue, 12 Aug 2008 02:02:36 +0000

It was a very good idea and while I was developing the patch, I realized that the uninstall.php idea was better than my own idea of having a hook. It doesn’t work to well, when the functionality you depend on isn’t loaded or the hook you are trying to test for. The uninstall.php, you just test to see if the file exists and you’re done.

I wondering what will win out, the hook or the uninstall.php? I’m guessing the uninstall.php, but I seriously help developers keep security in mind.

I think Andrew really needs some credit in that his original idea was kick ass, but a little more than what is needed. I hope that it is revisited later and an Plugin Administration API is created with many ideas that Andrew and this other guy had for creating an easy to use API for creating Plugin Adminstration panels, installation, and uninstallation scripts.

WordPress 2.7 is going to be so awesome! When it is released, not now. Sucks being on trunk and I’m partly to blame, but I mostly blame all of the experimental features that are going into 2.7. At least they are early, so they have time to become stable.

By: Stephen R

Stephen R — Mon, 11 Aug 2008 16:33:57 +0000

Heh. No doubt a false positive; still funny…

Glad this was committed to core. This is the closest I’ve come to having something I wrote added to WP Core. (That is, my idea for uninstall.php, but you wrote it. I’ll take it! )

By: Flick

Flick — Sat, 09 Aug 2008 22:34:33 +0000

I had a quick look at the Scoop link and it seems to be linking to a normal article which mentions Jacob Santos’ article

I’m just hoping by the time 2.7 comes round, I’ll have learnt enough PHP to start being able to write simple plugins! ^^ I like articles with actual examples ~~ Thanks!

By: WordPress: Automatisches AufrÃ¤umen fÃ¼r Plugins

WordPress: Automatisches AufrÃ¤umen fÃ¼r Plugins — Sat, 09 Aug 2008 09:02:06 +0000

[...] Tools Collection wurde schon im Juli darÃ¼ber diskutiert, eine ausfÃ¼hrliche Beschreibung hat Jacob Santos [...]

By: links for 2008-08-08 [delicious.com] at So It’s Come To This:

links for 2008-08-08 [delicious.com] at So It’s Come To This: — Sat, 09 Aug 2008 05:35:08 +0000

[...] Jacob Santos Â· WordPress 2.7 Plugin Uninstall Methods (tags: WordPress Plugins howto) [...]

By: Jacob Santos

Jacob Santos — Sat, 09 Aug 2008 03:07:23 +0000

@Stephen R,

I’m not following you, I clicked on it and it works fine for me. It is highly possible that his plugin may well just plain suck or you just got caught on the false positive statistic. Sorry.

By: Stephen R

Stephen R — Sat, 09 Aug 2008 02:36:09 +0000

That pingback from "Scoop’s Views" leads to a page that reads:

"Congratulations! You’ve made the All-Star Ban List

"Making the All-Star Ban list is quite an accomplishment. Now that you have something to be really proud about having achieved in life, be sure to write home and tell Mom all about it!"

Wow. If you’re gonna be snarky, be sure you’re not aiming it at your (potential) readers.

By: Time for WordPress plugin developers to take note of changes | Scoop's Views

Fri, 08 Aug 2008 23:04:42 +0000

[...] Santos has written a cool tutorial for plugin developers about the WordPress 2.7 Plugin Uninstall Methods, which will be changing, and most notably on the developer end rather than the user/admin [...]