refs #4126 for security remove settings in case a user is deleted or …

…a plugin installed, needs to be tested
matomo-org · Oct 22, 2013 · 4af4d04 · 4af4d04
1 parent ea7ef38
commit 4af4d04
Show file tree

Hide file tree

Showing 4 changed files with 55 additions and 8 deletions.
diff --git a/core/Plugin/Manager.php b/core/Plugin/Manager.php
@@ -207,6 +207,7 @@ public function uninstallPlugin($pluginName)
         $this->removePluginFromPluginsInstalledConfig($pluginName);
         $this->removePluginFromTrackerConfig($pluginName);
         PiwikConfig::getInstance()->forceSave();
+        \Piwik\Settings\Manager::cleanupPluginSettings($pluginName);
 
         Filesystem::deleteAllCacheOnUpdate();
 

diff --git a/core/Plugin/Settings.php b/core/Plugin/Settings.php
@@ -146,6 +146,23 @@ public function removeAllPluginSettings()
         Option::delete($this->getOptionKey());
     }
 
+    public function removeAllSettingsForUser($userLogin)
+    {
+        foreach ($this->settingsValues as $name => $value) {
+            $setting = $this->getSetting($name);
+
+            if (!$setting['isUserSetting']) {
+                continue;
+            }
+
+            if ($name == $this->buildUserSettingName($name, $userLogin)) {
+                unset($this->settingsValues[$name]);
+            }
+        }
+
+        $this->save();
+    }
+
     private function getSettingValue($name)
     {
         if (!array_key_exists($name, $this->settingsValues)) {

diff --git a/core/Settings/Manager.php b/core/Settings/Manager.php
@@ -11,8 +11,6 @@
 
 namespace Piwik\Settings;
 
-use Piwik\Piwik;
-
 /**
  * Settings manager
  *
@@ -34,19 +32,31 @@ public static function getAllPluginSettings()
 
             $pluginNames = \Piwik\Plugin\Manager::getInstance()->getLoadedPluginsName();
             foreach ($pluginNames as $pluginName) {
-                $klassName = 'Piwik\\Plugins\\' . $pluginName . '\\Settings';
-
-                if (class_exists($klassName) && is_subclass_of($klassName, 'Piwik\\Plugin\\Settings')) {
-                    $settings[$pluginName] = new $klassName($pluginName);
-                }
+                $settings[$pluginName] = self::getPluginSettingsClass($pluginName);
             }
 
-            static::$settings = $settings;
+            static::$settings = array_filter($settings);
         }
 
         return static::$settings;
     }
 
+    public static function cleanupPluginSettings($pluginName)
+    {
+        $settings = self::getPluginSettingsClass($pluginName);
+
+        if (!empty($settings)) {
+            $settings->removeAllPluginSettings();
+        }
+    }
+
+    public static function cleanupUserSettings($userLogin)
+    {
+        foreach (static::getAllPluginSettings() as $setting) {
+            $setting->removeAllSettingsForUser($userLogin);
+        }
+    }
+
     /**
      * @return bool
      */
@@ -64,4 +74,17 @@ public static function hasPluginSettingsForCurrentUser()
         return false;
     }
 
+    /**
+     * @param $pluginName
+     * @return \Piwik\Plugin\Settings|null
+     */
+    private static function getPluginSettingsClass($pluginName)
+    {
+        $klassName = 'Piwik\\Plugins\\' . $pluginName . '\\Settings';
+
+        if (class_exists($klassName) && is_subclass_of($klassName, 'Piwik\\Plugin\\Settings')) {
+            return new $klassName($pluginName);
+        }
+    }
+
 }
diff --git a/plugins/CoreAdminHome/CoreAdminHome.php b/plugins/CoreAdminHome/CoreAdminHome.php
@@ -36,9 +36,15 @@ public function getListHooksRegistered()
             'AssetManager.getJavaScriptFiles' => 'getJsFiles',
             'Menu.Admin.addItems'             => 'addMenu',
             'TaskScheduler.getScheduledTasks' => 'getScheduledTasks',
+            'UsersManager.deleteUser'         => 'cleanupUser'
         );
     }
 
+    public function cleanupUser($userLogin)
+    {
+        SettingsManager::cleanupUserSettings($userLogin);
+    }
+
     public function getScheduledTasks(&$tasks)
     {
         // general data purge on older archive tables, executed daily