Ticket #43546: 43546.12.diff

src/wp-admin/includes/file.php

@@ -1959 +1959 @@
  */
 function wp_privacy_generate_personal_data_export_group_html( $group_data ) {
         $allowed_tags      = array(
-                'a' => array(
+                'a'  => array(
                         'href'   => array(),
-                        'target' => array()
+                        'target' => array(),
                 ),
-                'br' => array()
+                'br' => array(),
         );
         $allowed_protocols = array( 'http', 'https' );
         $group_html        = '';
@@ -1999 +1999 @@
  * @param int  $request_id  The export request ID.
  */
 function wp_privacy_generate_personal_data_export_file( $request_id ) {
-        // Maybe make this a cron job instead.
-        wp_privacy_delete_old_export_files();
-
         if ( ! class_exists( 'ZipArchive' ) ) {
                 wp_send_json_error( __( 'Unable to generate export file. ZipArchive not available.' ) );
         }
@@ -2042 +2039 @@
 
         $stripped_email       = str_replace( '@', '-at-', $email_address );
         $stripped_email       = sanitize_title( $stripped_email ); // slugify the email address
-        $obscura              = md5( rand() );
+        $obscura              = wp_generate_password( 32, false, false );
         $file_basename        = 'wp-personal-data-file-' . $stripped_email . '-' . $obscura;
         $html_report_filename = $file_basename . '.html';
         $html_report_pathname = $exports_dir . $html_report_filename;
-        $file = fopen( $html_report_pathname, 'w' );
+        $file                 = fopen( $html_report_pathname, 'w' );
+
         if ( false === $file ) {
                 wp_send_json_error( __( 'Unable to open export file (HTML report) for writing' ) );
         }
@@ -2125 +2123 @@
         fclose( $file );
 
         // Now, generate the ZIP.
+        $error            = false;
         $archive_filename = $file_basename . '.zip';
         $archive_pathname = $exports_dir . $archive_filename;
         $archive_url      = $exports_url . $archive_filename;
+        $zip              = new ZipArchive;
 
-        $zip = new ZipArchive;
+        if ( true === $zip->open( $archive_pathname, ZipArchive::CREATE ) ) {
+                if ( ! $zip->addFile( $html_report_pathname, 'index.html' ) ) {
+                        $error = __( 'Unable to add data to export file.' );
+                }
 
-        if ( TRUE === $zip->open( $archive_pathname, ZipArchive::CREATE ) ) {
-                $zip->addFile( $html_report_pathname, 'index.html' );
                 $zip->close();
+
+                if ( ! $error ) {
+                        /**
+                         * Fires right after all personal data has been written to the export file.
+                         *
+                         * @since 4.9.6
+                         *
+                         * @param string $archive_pathname     The full path to the export file on the filesystem.
+                         * @param string $archive_url          The URL of the archive file.
+                         * @param string $html_report_pathname The full path to the personal data report on the filesystem.
+                         */
+                        do_action( 'wp_privacy_personal_data_export_file_created', $archive_pathname, $archive_url, $html_report_pathname );
+                }
         } else {
-                wp_send_json_error( __( 'Unable to open export file (archive) for writing' ) );
+                $error = __( 'Unable to open export file (archive) for writing.' );
         }
 
         // And remove the HTML file.
         unlink( $html_report_pathname );
 
+        if ( $error ) {
+                wp_send_json_error( $error );
+        }
+
         // Save the export file in the request.
         update_post_meta( $request_id, '_export_file_url', $archive_url );
         update_post_meta( $request_id, '_export_file_path', $archive_pathname );
@@ -2162 +2180 @@
                 return new WP_Error( 'invalid', __( 'Invalid request ID when sending personal data export email.' ) );
         }
 
-/* translators: Do not translate LINK, EMAIL, SITENAME, SITEURL: those are placeholders. */
-$email_text = __(
-'Howdy,
+        /** This filter is documented in wp-admin/includes/file.php */
+        $expiration      = apply_filters( 'wp_privacy_export_expiration', 3 * DAY_IN_SECONDS );
+        $expiration_date = date_i18n( get_option( 'date_format' ), time() + $expiration );
 
-Your request for an export of personal data has been completed. You may
-download your personal data by clicking on the link below. This link is
-good for the next 3 days.
+        /* translators: Do not translate EXPIRATION, LINK, EMAIL, SITENAME, SITEURL: those are placeholders. */
+        $email_text = str_replace( "\t", '', __(
+                'Howdy,
 
-###LINK###
+                Your request for an export of personal data has been completed. You may
+                download your personal data by clicking on the link below. For privacy
+                and security, we will automatically delete the file on ###EXPIRATION###,
+                so please download it before then.
 
-This email has been sent to ###EMAIL###.
+                ###LINK###
 
-Regards,
-All at ###SITENAME###
-###SITEURL###'
-);
+                This email has been sent to ###EMAIL###.
+
+                Regards,
+                All at ###SITENAME###
+                ###SITEURL###'
+        ) );
 
         /**
          * Filters the text of the email sent with a personal data export file.
@@ -2193 +2216 @@
          * @param string $email_text     Text in the email.
          * @param int    $request_id     The request ID for this personal data export.
          */
-        $content = apply_filters( 'wp_privacy_personal_data_email_content', $email_text, $request_id );
-
-        $email_address = $request->email;
+        $content         = apply_filters( 'wp_privacy_personal_data_email_content', $email_text, $request_id );
+        $email_address   = $request->email;
         $export_file_url = get_post_meta( $request_id, '_export_file_url', true );
-        $site_name = is_multisite() ? get_site_option( 'site_name' ) : get_option( 'blogname' );
-        $site_url = network_home_url();
+        $site_name       = is_multisite() ? get_site_option( 'site_name' ) : get_option( 'blogname' );
+        $site_url        = network_home_url();
 
+        $content = str_replace( '###EXPIRATION###', $expiration_date, $content );
         $content = str_replace( '###LINK###', esc_url_raw( $export_file_url ), $content );
         $content = str_replace( '###EMAIL###', $email_address, $content );
         $content = str_replace( '###SITENAME###', wp_specialchars_decode( $site_name, ENT_QUOTES ), $content );
@@ -2208 +2231 @@
         $mail_success = wp_mail(
                 $email_address,
                 sprintf(
+                        // translators: %s is the name of the site.
                         __( '[%s] Personal Data Export' ),
                         wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES )
                 ),
@@ -2223 +2247 @@
 
 /**
  * Intercept personal data exporter page ajax responses in order to assemble the personal data export file.
- * @see wp_privacy_personal_data_export_page
+ *
  * @since 4.9.6
  *
+ * @see wp_privacy_personal_data_export_page
+ *
  * @param array  $response        The response from the personal data exporter for the given page.
  * @param int    $exporter_index  The index of the personal data exporter. Begins at 1.
  * @param string $email_address   The email address of the user whose personal data this is.
@@ -2276 +2302 @@
         update_post_meta( $request_id, '_export_data_raw', $export_data );
 
         // If we are not yet on the last page of the last exporter, return now.
-        $exporters = apply_filters( 'wp_privacy_personal_data_exporters', array() );
-        $is_last_exporter = $exporter_index === count( $exporters );
-        $exporter_done = $response['done'];
+        $exporters        = apply_filters( 'wp_privacy_personal_data_exporters', array() );
+        $is_last_exporter = count( $exporters ) === $exporter_index;
+        $exporter_done    = $response['done'];
+
         if ( ! $is_last_exporter || ! $exporter_done ) {
                 return $response;
         }
@@ -2302 +2329 @@
                         $groups[ $group_id ]['items'][ $item_id ] = array();
                 }
 
-                $old_item_data = $groups[ $group_id ]['items'][ $item_id ];
-                $merged_item_data = array_merge( $export_datum['data'], $old_item_data );
+                $old_item_data                            = $groups[ $group_id ]['items'][ $item_id ];
+                $merged_item_data                         = array_merge( $export_datum['data'], $old_item_data );
                 $groups[ $group_id ]['items'][ $item_id ] = $merged_item_data;
         }
 
@@ -2344 +2371 @@
 
         return $response;
 }
-
-/**
- * Cleans up export files older than three days old.
- *
- * @since 4.9.6
- */
-function wp_privacy_delete_old_export_files() {
-        $upload_dir   = wp_upload_dir();
-        $exports_dir  = trailingslashit( $upload_dir['basedir'] . '/exports' );
-        $export_files = list_files( $exports_dir );
-
-        foreach( (array) $export_files as $export_file ) {
-                $file_age_in_seconds = time() - filemtime( $export_file );
-
-                if ( 3 * DAY_IN_SECONDS < $file_age_in_seconds ) {
-                        @unlink( $export_file );
-                }
-        }
-}

src/wp-includes/default-filters.php

@@ -352 +352 @@
 add_filter( 'user_request_action_confirmed_message', '_wp_privacy_account_request_confirmed_message', 10, 2 );
 add_filter( 'wp_privacy_personal_data_exporters', 'wp_register_comment_personal_data_exporter' );
 add_filter( 'wp_privacy_personal_data_erasers', 'wp_register_comment_personal_data_eraser' );
+add_action( 'init', 'wp_schedule_delete_old_privacy_export_files' );
+add_action( 'wp_privacy_delete_old_export_files', 'wp_privacy_delete_old_export_files' );
 
 // Cron tasks
 add_action( 'wp_scheduled_delete', 'wp_scheduled_delete' );

src/wp-includes/functions.php

@@ -6257 +6257 @@
 function _wp_privacy_active_plugins_change() {
         update_option( '_wp_privacy_text_change_check', 'check' );
 }
+
+/**
+ * Schedule a `WP_Cron` job to delete expired export files.
+ *
+ * @since 4.9.6
+ */
+function wp_schedule_delete_old_privacy_export_files() {
+        if ( ! wp_next_scheduled( 'wp_privacy_delete_old_export_files' ) ) {
+                wp_schedule_event( time(), 'hourly', 'wp_privacy_delete_old_export_files' );
+        }
+}
+
+/**
+ * Cleans up export files older than three days old.
+ *
+ * The export files are stored in `wp-content/uploads`, and are therefore publicly
+ * accessible. A CSPRN is appended to the filename to mitigate the risk of an
+ * unauthorized person downloading the file, but it is still possible. Deleting
+ * the file after the data subject has had a chance to delete it adds an additional
+ * layer of protection.
+ *
+ * @since 4.9.6
+ */
+function wp_privacy_delete_old_export_files() {
+        $upload_dir   = wp_upload_dir();
+        $exports_dir  = trailingslashit( $upload_dir['basedir'] . '/exports' );
+        $export_files = list_files( $exports_dir, 100, array( 'index.html' ) );
+
+        /**
+         * Filters the lifetime, in seconds, of a personal data export file.
+         *
+         * By default, the lifetime is 3 days. Once the file reaches that age, it will automatically
+         * be deleted by a cron job.
+         *
+         * @since 4.9.6
+         *
+         * @param int $expiration The expiration age of the export, in seconds.
+         */
+        $expiration = apply_filters( 'wp_privacy_export_expiration', 3 * DAY_IN_SECONDS );
+
+        foreach ( (array) $export_files as $export_file ) {
+                $file_age_in_seconds = time() - filemtime( $export_file );
+
+                if ( $expiration < $file_age_in_seconds ) {
+                        unlink( $export_file );
+                }
+        }
+}

new file tests/phpunit/tests/privacy/Tests_Privacy_wpPrivacyDeleteOldExportFiles.php

@@ +1 @@
+<?php
+/**
+ * Define a class to test `wp_privacy_delete_old_export_files()`.
+ *
+ * @package WordPress
+ * @subpackage UnitTests
+ * @since 4.9.6
+ */
+
+/**
+ * Test cases for `wp_privacy_delete_old_export_files()`.
+ *
+ * @group privacy
+ * @covers wp_privacy_delete_old_export_files
+ *
+ * @since 4.9.6
+ */
+class Tests_Privacy_wpPrivacyDeleteOldExportFiles extends WP_UnitTestCase {
+        /**
+         * Create fixtures that are shared by multiple test cases.
+         *
+         * @param WP_UnitTest_Factory $factory The base factory object.
+         */
+        public static function wpSetUpBeforeClass( $factory ) {
+
+        }
+
+        /*
+        todo cases:
+        ?
+        */
+}

new file tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php

@@ +1 @@
+<?php
+/**
+ * Define a class to test `wp_privacy_generate_personal_data_export_file()`.
+ *
+ * @package WordPress
+ * @subpackage UnitTests
+ * @since 4.9.6
+ */
+
+/**
+ * Test cases for `wp_privacy_generate_personal_data_export_file()`.
+ *
+ * @group privacy
+ * @covers wp_privacy_generate_personal_data_export_file
+ *
+ * @since 4.9.6
+ */
+class Tests_Privacy_wpPrivacyGeneratePersonalDataExportFile extends WP_UnitTestCase {
+        /**
+         * Create fixtures that are shared by multiple test cases.
+         *
+         * @param WP_UnitTest_Factory $factory The base factory object.
+         */
+        public static function wpSetUpBeforeClass( $factory ) {
+
+        }
+
+        /*
+        todo cases:
+        ziparchive not available
+        invalid request id
+        invalid email addr
+        mkdir_p fails
+        index.html created in export folder - silence is golden
+        unable to protect error if can't create index.html file
+        unable to open export file error if can't write
+        report file exists, has starts with <html> and ends with </html>
+        unable to add data error if can't add file to export
+        error if can't open archive file
+        report file removed, even if errors
+        */
+}

new file tests/phpunit/tests/privacy/wpPrivacyProcessPersonalDataExportPage.php

@@ +1 @@
+<?php
+/**
+ * Define a class to test `wp_privacy_process_personal_data_export_page()`.
+ *
+ * @package WordPress
+ * @subpackage UnitTests
+ * @since 4.9.6
+ */
+
+/**
+ * Test cases for `wp_privacy_process_personal_data_export_page()`.
+ *
+ * @group privacy
+ * @covers wp_privacy_process_personal_data_export_page
+ *
+ * @since 4.9.6
+ */
+class Tests_Privacy_wpPrivacyProcessPersonalDataExportPage extends WP_UnitTestCase {
+        /**
+         * Create fixtures that are shared by multiple test cases.
+         *
+         * @param WP_UnitTest_Factory $factory The base factory object.
+         */
+        public static function wpSetUpBeforeClass( $factory ) {
+
+        }
+
+        /*
+        todo cases:
+        ?
+        */
+}

new file tests/phpunit/tests/privacy/wpPrivacySendPersonalDataExportEmail.php

@@ +1 @@
+<?php
+/**
+ * Define a class to test `wp_privacy_send_personal_data_export_email()`.
+ *
+ * @package WordPress
+ * @subpackage UnitTests
+ * @since 4.9.6
+ */
+
+/**
+ * Test cases for `wp_privacy_send_personal_data_export_email()`.
+ *
+ * @group privacy
+ * @covers wp_privacy_send_personal_data_export_email
+ *
+ * @since 4.9.6
+ */
+class Tests_Privacy_wpPrivacySendPersonalDataExportEmail extends WP_UnitTestCase {
+        /**
+         * Create fixtures that are shared by multiple test cases.
+         *
+         * @param WP_UnitTest_Factory $factory The base factory object.
+         */
+        public static function wpSetUpBeforeClass( $factory ) {
+
+        }
+
+        /*
+        todo cases:
+        ?
+        */
+}