wp plugin delete <plugin-name> not working if path has a space or & in it

[swiftavl]

If the path to a WordPress install has ' ' or '&' in the pathname, then the command 'wp plugin delete ' does not work. Note that list, install, activate, deactivate all work as expected. Delete says it deletes it, but it doesn't. Not sure if other characters and/or commands have the same issue.

example
using a fresh install of WordPress
if ABSPATH defined: '/Users/userName/development sites/myTestSite/'
the following command will fail to delete the plugin.

wp plugin delete akismet

I can reproduce it using a ' ' or a '&'. I'm sure there are others.
commands that work:

wp plugin list
wp plugin install hello-dolly
wp plugin activate hello-dolly
wp plugin deactivate hello-dolly
but this one does not work if ' ' or '&'
wp plugin delete hello-dolly

Command Line Log
wpBugTest.txt

[schlessera]

I have looked into the code to see how this is done.

Strangely, while wp theme delete uses the WordPress function delete_theme(), wp plugin delete does not use the WordPress function delete_plugins() and directly uses the shell rm command instead.

@danielbachhuber Looking through the file history I fail to find a reason why this diverging behavior exists other than for historical reasons. Do you have additional insight here?

[schlessera]

Note: Fixing the above bug is very probably only a matter of properly quoting the folder. However, I'd like to find out first whether we shouldn't rather move to using the Core's built-in delete_plugins() function instead.

[danielbachhuber]

@schlessera The delete_plugins() WordPress function makes an external request for filesystem access: https://developer.wordpress.org/reference/functions/delete_plugins/#source

It looks like this was originally changed in wp-cli/wp-cli@86416ae

[schlessera]

Ah, thanks, this linked to the missing piece: wp-cli/wp-cli#109 (delete_plugins() also runs uninstall_plugins())!

[schlessera]

Proposed solution is to pass the $path through escapeshellarg() here: https://github.com/wp-cli/extension-command/blob/v2.0.2/src/Plugin_Command.php#L1135

return ! WP_CLI::launch( $command . escapeshellarg( $path ) );