The function twitter_account_delete() truncates authmap, twitter_account and twitter table.

It should be fixed asap, before anyone tries to use it some hook like hook_user_delete
the code is using
$query->conditions('twitter_uid', $twitter_uid);
instead of
$query->condition('twitter_uid', $twitter_uid);
Which is doing a delete over the entire table.

Current Version:

function twitter_account_delete($twitter_uid) {
  $account = twitter_account_load($twitter_uid);

  // Delete from {twitter_account}.
  $query = db_delete('twitter_account');
  $query->conditions('twitter_uid', $twitter_uid);
  $query->execute();

  // Delete from {twitter}.
  $query = db_delete('twitter');
  $query->conditions('screen_name', $account->screen_name);
  $query->execute();

  // Delete from {twitter_account}.
  $query = db_delete('authmap');
  $query->conditions('authname', $twitter_uid);
  $query->conditions('module', 'twitter');
  $query->execute();
}

Here is the fixed version

function twitter_account_delete($twitter_uid) {
  $account = twitter_account_load($twitter_uid);

  // Delete from {twitter_account}.
  $query = db_delete('twitter_account');
  $query->condition('twitter_uid', $twitter_uid);
  $query->execute();

  // Delete from {twitter}.
  $query = db_delete('twitter');
  $query->condition('screen_name', $account->screen_name);
  $query->execute();

  // Delete from {twitter_account}.
  $query = db_delete('authmap');
  $query->condition('authname', $twitter_uid);
  $query->condition('module', 'twitter');
  $query->execute();
}

Comments

tebb’s picture

Priority: Normal » Critical

Surely if this is dangerous, it should be 'critical' priority?

InTheLyonsDen’s picture

This may be related to an issue I experienced. Upon removing a Twitter account from an admin user using the UI in /user/#/edit/twitter selecting the 'Delete' checkbox and clicking 'Save Changes' all of the records of the twitter_account table were deleted (6k+ of them). Upon doing a restore and retesting it was the delete function of the single account which is accessible to all users. This is a significant issue.

juampynr’s picture

Waiting for a patch to release a new version.

juampynr’s picture

Title: Danger!!! function twitter_account_delete should never be used » Wrong use of conditions method on twitter_account_delete().
Status: Active » Fixed
tebb’s picture

Just noticed a 'paste-o'. The following comment is used twice. The second one should refer to authmap.

// Delete from {twitter_account}.

Not a big issue of course.

juampynr’s picture

Fixed comment and hook's doc block. Good catch!

http://drupalcode.org/project/twitter.git/commitdiff/c69db79

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

Issue summary: View changes

Highlighting query