Ticket #43546: 43546.11.diff

src/wp-admin/includes/admin-filters.php

@@ -47 +47 @@
 
 // Privacy tools
 add_action( 'admin_menu', '_wp_privacy_hook_requests_page' );
+add_action( 'admin_init', 'wp_schedule_delete_old_privacy_export_files' );
+add_action( 'wp_privacy_delete_old_export_files', 'wp_privacy_delete_old_export_files' );
+// but will this only run when there's a visit to wp-admin? probalby. can't rely on that
+// need to move to default-filters.php and 'init' hook, but where's a good place for `wp_schedule_delete_old_privacy_export_files` to live?
 
 // Prerendering.
 if ( ! is_customize_preview() ) {

src/wp-admin/includes/file.php

@@ -1999 +1999 @@
  * @param int  $request_id  The export request ID.
  */
 function wp_privacy_generate_personal_data_export_file( $request_id ) {
-        // Maybe make this a cron job instead.
-        wp_privacy_delete_old_export_files();
-
         if ( ! class_exists( 'ZipArchive' ) ) {
                 wp_send_json_error( __( 'Unable to generate export file. ZipArchive not available.' ) );
         }
@@ -2042 +2039 @@
 
         $stripped_email       = str_replace( '@', '-at-', $email_address );
         $stripped_email       = sanitize_title( $stripped_email ); // slugify the email address
-        $obscura              = md5( rand() );
+        $obscura              = wp_generate_password( 32, false, false );
         $file_basename        = 'wp-personal-data-file-' . $stripped_email . '-' . $obscura;
         $html_report_filename = $file_basename . '.html';
         $html_report_pathname = $exports_dir . $html_report_filename;
@@ -2162 +2159 @@
                 return new WP_Error( 'invalid', __( 'Invalid request ID when sending personal data export email.' ) );
         }
 
-/* translators: Do not translate LINK, EMAIL, SITENAME, SITEURL: those are placeholders. */
-$email_text = __(
-'Howdy,
+        /** This filter is documented in wp-admin/includes/file.php */
+        $expiration      = apply_filters( 'wp_privacy_export_expiration', 3 * DAY_IN_SECONDS );
+        $expiration_date = date_i18n( get_option( 'date_format' ), time() + $expiration );
 
-Your request for an export of personal data has been completed. You may
-download your personal data by clicking on the link below. This link is
-good for the next 3 days.
+        // need to write any new tests for stuff you're adding?
+                // were tests added for all existing stuff? if not, add some, or at least mark ticket as needs-unit-tests
 
-###LINK###
+        /* translators: Do not translate EXPIRATION, LINK, EMAIL, SITENAME, SITEURL: those are placeholders. */
+        $email_text = str_replace( "\t", '', __(
+                'Howdy,
 
-This email has been sent to ###EMAIL###.
+                Your request for an export of personal data has been completed. You may
+                download your personal data by clicking on the link below. For privacy
+                and security, we will automatically delete the file on ###EXPIRATION###,
+                so please download it before then.
 
-Regards,
-All at ###SITENAME###
-###SITEURL###'
-);
+                ###LINK###
+
+                This email has been sent to ###EMAIL###.
+
+                Regards,
+                All at ###SITENAME###
+                ###SITEURL###'
+        ) );
 
         /**
          * Filters the text of the email sent with a personal data export file.
@@ -2200 +2205 @@
         $site_name = is_multisite() ? get_site_option( 'site_name' ) : get_option( 'blogname' );
         $site_url = network_home_url();
 
+        $content = str_replace( '###EXPIRATION###', $expiration_date, $content );
         $content = str_replace( '###LINK###', esc_url_raw( $export_file_url ), $content );
         $content = str_replace( '###EMAIL###', $email_address, $content );
         $content = str_replace( '###SITENAME###', wp_specialchars_decode( $site_name, ENT_QUOTES ), $content );
@@ -2345 +2351 @@
         return $response;
 }
 
+/**
+ * Schedule a `WP_Cron` job to delete expired export files.
+ *
+ * @since 4.9.6
+ */
+function wp_schedule_delete_old_privacy_export_files() {
+        if ( ! wp_next_scheduled( 'wp_privacy_delete_old_export_files' ) ) {
+                wp_schedule_event( time(), 'hourly', 'wp_privacy_delete_old_export_files' );
+        }
+}
+
 /**
  * Cleans up export files older than three days old.
  *
+ * The export files are stored in `wp-content/uploads`, and are therefore publicly
+ * accessible. A CSPRN is appended to the filename to mitigate the risk of an
+ * unauthorized person downloading the file, but it is still possible. Deleting
+ * the file after the data subject has had a chance to delete it adds an additional
+ * layer of protection.
+ *
  * @since 4.9.6
  */
 function wp_privacy_delete_old_export_files() {
         $upload_dir   = wp_upload_dir();
         $exports_dir  = trailingslashit( $upload_dir['basedir'] . '/exports' );
-        $export_files = list_files( $exports_dir );
+        $export_files = list_files( $exports_dir, 100, array( 'index.html' ) );
+
+        /**
+         * Filters the lifetime, in seconds, of a personal data export file.
+         *
+         * By default, the lifetime is 3 days. Once the file reaches that age, it will automatically
+         * be deleted by a cron job.
+         *
+         * @since 4.9.6
+         *
+         * @param int $expiration The expiration age of the export, in seconds.
+         */
+        $expiration = apply_filters( 'wp_privacy_export_expiration', 3 * DAY_IN_SECONDS );
 
         foreach( (array) $export_files as $export_file ) {
                 $file_age_in_seconds = time() - filemtime( $export_file );
 
-                if ( 3 * DAY_IN_SECONDS < $file_age_in_seconds ) {
-                        @unlink( $export_file );
+                if ( $expiration < $file_age_in_seconds ) {
+                        unlink( $export_file );
                 }
         }
 }

tests/phpunit/tests/comment.php

@@ -1116 +1116 @@
         /**
          * Testing the `wp_comments_personal_data_exporter()` function.
          *
+         * @group privacy
          * @ticket 43440
          */
         public function test_wp_comments_personal_data_exporter() {
@@ -1130 +1131 @@
                         'comment_content'      => 'Comment',
                 );
 
-                $c = self::factory()->comment->create( $args );
+                $comment_id = self::factory()->comment->create( $args );
 
                 $actual   = wp_comments_personal_data_exporter( $args['comment_author_email'] );
                 $expected = $args;
@@ -1155 +1156 @@
                 $this->assertSame( $expected['comment_agent'], $actual['data'][0]['data'][4]['value'] );
                 $this->assertSame( $expected['comment_date'], $actual['data'][0]['data'][5]['value'] );
                 $this->assertSame( $expected['comment_content'], $actual['data'][0]['data'][6]['value'] );
-                $this->assertSame( get_comment_link( $c ), $actual['data'][0]['data'][7]['value'] );
+                $this->assertSame( get_comment_link( $comment_id ), strip_tags( $actual['data'][0]['data'][7]['value'] ) );
         }
 
         /**
          * Testing the `wp_comments_personal_data_exporter()` function for no comments found.
          *
+         * @group privacy
          * @ticket 43440
          */
         public function test_wp_comments_personal_data_exporter_no_comments_found() {
@@ -1178 +1180 @@
         /**
          * Testing the `wp_comments_personal_data_exporter()` function for an empty comment property.
          *
+         * @group privacy
          * @ticket 43440
          */
         public function test_wp_comments_personal_data_exporter_empty_comment_prop() {
@@ -1208 +1211 @@
         /**
          * Testing the `wp_comments_personal_data_exporter()` function with an empty second page.
          *
+         * @group privacy
          * @ticket 43440
          */
         public function test_wp_comments_personal_data_exporter_empty_second_page() {