Changeset 11628

Timestamp:

03/03/2022 06:54:00 AM (4 years ago)

Author:

dd32

Message:

Plugin Directory: Release confirmation: Expire/cleanup the access token cookie on the template_redirect hook, rather than on can_access() which is called during the pageload.

This previously worked, but with the new WordPress.org header/footer we no longer have a full-page output buffer to handle this for us.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -266 +266 @@
                 }
 
-                setcookie( self::COOKIE, false, time() - DAY_IN_SECONDS );
-
                 return false;
         }
@@ -302 +300 @@
                 if ( isset( $_REQUEST[ self::URL_PARAM ] ) ) {
                         setcookie( self::COOKIE, $_REQUEST[ self::URL_PARAM ], time() + DAY_IN_SECONDS, '/plugins/', 'wordpress.org', true, true );
+                }
+
+                // Expire the cookie when needed. This is not for security, only performance / cleanliness.
+                if ( isset( $_COOKIE[ self::COOKIE ] ) && ! self::can_access() ) {
+                        unset( $_COOKIE[ self::COOKIE ] );
+                        setcookie( self::COOKIE, false, time() - DAY_IN_SECONDS );
                 }