[wp-trac] [WordPress Trac] #23197: wp-activate.php, without explanation, does not load site plugins

[WordPress Trac]

#23197: wp-activate.php, without explanation, does not load site plugins
---------------------------------------+-----------------------------
 Reporter:  radiok                     |       Owner:  (none)
     Type:  defect (bug)               |      Status:  reopened
 Priority:  normal                     |   Milestone:  Future Release
Component:  Login and Registration     |     Version:  3.0
 Severity:  normal                     |  Resolution:
 Keywords:  needs-testing needs-patch  |     Focuses:  multisite
---------------------------------------+-----------------------------

Comment (by herregroen):

 I'd like to propose a practical fix to this that while not the prettiest
 should be relatively easy to implement.

 I've based this solution on the following:
 - `WP_INSTALLING` **must** be set before the WordPress environment is
 loaded.
 - `WP_INSTALLING` **must** be set during a multisite activation that
 installs a new blog as this puts WordPress into a state where a lot of
 data and tables do not exist and as such many core functions need to
 behave differently and plugins should not be activated.
 - Determining if an activation requires installing a new blog can only be
 determined after the WordPress environment is loaded.
 - Because we need to set `WP_INSTALLING` before we can determine whether
 or not it needs to be set it is always set so that installations of a new
 blog do not lead to massive issues.

 I would suggest `wp-activate.php` be changed to the following flow:
 - `WP_INSTALLING` is set based on the presence of a query parameter.
 - The WordPress environment is loaded.
 - A new function is called to determine whether the current activation key
 requires the installation of a new blog.
 - If the result of this new function does not match the presence/absence
 of the query parameter the user is redirected to the same URL with the
 query parameter either stripped or added.

 In addition to this when generating activation emails this query parameter
 should be added.

 One important thing to note is that in `wp-signup.php` during the
 `gimmeanotherblog` flow a new blog is installed without `WP_INSTALLING`
 being true before WordPress is loaded. Meaning that in this instance all
 plugins will be loaded during the installation of a new blog with the
 potential risk of those plugins having hooks and filters that may attempt
 to make database queries at a time not all tables potentially exist.

 Either the above flow should also be implemented `wp-signup.php` to
 prevent the above from happening or, if it's completely fine that the
 installation is only toggled later in the request then `WP_INSTALLING`
 should just straight up be removed from `wp-activate.php` with the
 expectation that plugin authors properly check for `wp_installing()` when
 using any hooks and/or filters that may be called during a blog
 installation.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/23197#comment:22>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform