Ask for password confirmation before installing all plugins (#17285)

1 files changed, 71 insertions, 61 deletions

diff --git a/plugins/Marketplace/Controller.php b/plugins/Marketplace/Controller.php
index aae329640c..3df8b04252 100644
--- a/plugins/Marketplace/Controller.php
+++ b/plugins/Marketplace/Controller.php
@@ -301,92 +301,102 @@ class Controller extends \Piwik\Plugin\ControllerAdmin
         $this->dieIfPluginsAdminIsDisabled();
         Plugin\ControllerAdmin::displayWarningIfConfigFileNotWritable();
 
-        Nonce::checkNonce(static::INSTALL_NONCE);
+        $params = array(
+            'module' => 'Marketplace',
+            'action' => 'installAllPaidPlugins',
+            'nonce' => Common::getRequestVar('nonce')
+        );
+        if ($this->passwordVerify->requirePasswordVerifiedRecently($params)) {
+            Nonce::checkNonce(static::INSTALL_NONCE);
 
-        $paidPlugins = $this->plugins->getAllPaidPlugins();
+            $paidPlugins = $this->plugins->getAllPaidPlugins();
 
-        $hasErrors = false;
-        foreach ($paidPlugins as $paidPlugin) {
-            if (!$this->canPluginBeInstalled($paidPlugin)) {
-                continue;
-            }
+            $hasErrors = false;
+            foreach ($paidPlugins as $paidPlugin) {
+                if (!$this->canPluginBeInstalled($paidPlugin)) {
+                    continue;
+                }
+
+                $pluginName = $paidPlugin['name'];
 
-            $pluginName = $paidPlugin['name'];
+                try {
 
-            try {
+                    $this->pluginInstaller->installOrUpdatePluginFromMarketplace($pluginName);
 
-                $this->pluginInstaller->installOrUpdatePluginFromMarketplace($pluginName);
+                } catch (\Exception $e) {
 
-            } catch (\Exception $e) {
+                    $notification          = new Notification($e->getMessage());
+                    $notification->context = Notification::CONTEXT_ERROR;
+                    if (method_exists($e, 'isHtmlMessage') && $e->isHtmlMessage()) {
+                        $notification->raw = true;
+                    }
+                    Notification\Manager::notify('Marketplace_Install' . $pluginName, $notification);
 
-                $notification = new Notification($e->getMessage());
-                $notification->context = Notification::CONTEXT_ERROR;
-                if (method_exists($e, 'isHtmlMessage') && $e->isHtmlMessage()) {
-                    $notification->raw = true;
+                    $hasErrors = true;
                 }
-                Notification\Manager::notify('Marketplace_Install' . $pluginName, $notification);
-
-                $hasErrors = true;
             }
-        }
 
-        if ($hasErrors) {
-            Url::redirectToReferrer();
-            return;
-        }
+            if ($hasErrors) {
+                Url::redirectToReferrer();
+                return;
+            }
 
-        $dependency = new Plugin\Dependency();
+            $dependency = new Plugin\Dependency();
 
-        for ($i = 0; $i <= 10; $i++) {
-            foreach ($paidPlugins as $index => $paidPlugin) {
-                if (empty($paidPlugin)) {
-                    continue;
-                }
+            for ($i = 0; $i <= 10; $i++) {
+                foreach ($paidPlugins as $index => $paidPlugin) {
+                    if (empty($paidPlugin)) {
+                        continue;
+                    }
 
-                $pluginName = $paidPlugin['name'];
+                    $pluginName = $paidPlugin['name'];
 
-                if ($this->pluginManager->isPluginActivated($pluginName)) {
-                    // we do not use unset since it might skip a plugin afterwards when removing index
-                    $paidPlugins[$index] = null;
-                    continue;
-                }
+                    if ($this->pluginManager->isPluginActivated($pluginName)) {
+                        // we do not use unset since it might skip a plugin afterwards when removing index
+                        $paidPlugins[$index] = null;
+                        continue;
+                    }
 
-                if (!$this->pluginManager->isPluginInFilesystem($pluginName)) {
-                    $paidPlugins[$index] = null;
-                    continue;
-                }
+                    if (!$this->pluginManager->isPluginInFilesystem($pluginName)) {
+                        $paidPlugins[$index] = null;
+                        continue;
+                    }
 
-                if (empty($paidPlugin['require'])
-                    || !$dependency->hasDependencyToDisabledPlugin($paidPlugin['require'])) {
+                    if (empty($paidPlugin['require'])
+                        || !$dependency->hasDependencyToDisabledPlugin($paidPlugin['require'])) {
 
-                    $paidPlugins[$index] = null;
+                        $paidPlugins[$index] = null;
 
-                    try {
-                        $this->pluginManager->activatePlugin($pluginName);
-                    } catch (Exception $e) {
+                        try {
+                            $this->pluginManager->activatePlugin($pluginName);
+                        } catch (Exception $e) {
 
-                        $hasErrors = true;
-                        $notification = new Notification($e->getMessage());
-                        $notification->context = Notification::CONTEXT_ERROR;
-                        Notification\Manager::notify('Marketplace_Install' . $pluginName, $notification);
+                            $hasErrors             = true;
+                            $notification          = new Notification($e->getMessage());
+                            $notification->context = Notification::CONTEXT_ERROR;
+                            Notification\Manager::notify('Marketplace_Install' . $pluginName, $notification);
+                        }
                     }
                 }
-            }
 
-            $paidPlugins = array_filter($paidPlugins);
-        }
+                $paidPlugins = array_filter($paidPlugins);
+            }
 
-        if ($hasErrors) {
-            $notification = new Notification(Piwik::translate('Marketplace_OnlySomePaidPluginsInstalledAndActivated'));
-            $notification->context = Notification::CONTEXT_INFO;
-        } else {
-            $notification = new Notification(Piwik::translate('Marketplace_AllPaidPluginsInstalledAndActivated'));
-            $notification->context = Notification::CONTEXT_SUCCESS;
-        }
+            if ($hasErrors) {
+                $notification          = new Notification(Piwik::translate('Marketplace_OnlySomePaidPluginsInstalledAndActivated'));
+                $notification->context = Notification::CONTEXT_INFO;
+            } else {
+                $notification          = new Notification(Piwik::translate('Marketplace_AllPaidPluginsInstalledAndActivated'));
+                $notification->context = Notification::CONTEXT_SUCCESS;
+            }
 
-        Notification\Manager::notify('Marketplace_InstallAll', $notification);
+            Notification\Manager::notify('Marketplace_InstallAll', $notification);
 
-        Url::redirectToReferrer();
+            Url::redirectToUrl(Url::getCurrentUrlWithoutQueryString() . Url::getCurrentQueryStringWithParametersModified([
+                    'action' => 'overview',
+                    'nonce' => null,
+                ]));
+        }
     }
 
     public function updatePlugin()