[themihaicircea]

As requested in support ticket 1554756, here are the fixes from the patch I sent there, one commit per fix, on top of v1.2.1.

What changes

1. Delete the new activation when activate() fails
validate_release() runs after the activation is created, and fails, for example, with a key for another product. The catch block then called get() and delete() without an id, so both requests went to v1/public/activations/ and the activation stayed on the license, counting against its limit. It's now deleted by its id. If that request fails, only the id is kept after the options are cleared, so Deactivate License can remove it, and the error says so. A 404 counts as already removed.

2. Deactivate the stored activation, not a posted id
license_form_submit() passed $_POST['activation_id'] to deactivate(). It now calls deactivate() without an id, which already falls back to the stored one.

3. Return on a deactivation error
With deactivated_redirect set, the page redirected and the error never showed. Without it, the error showed next to "This site was successfully deactivated." It now returns after adding the error, as activation already does.

4. Keep the license key and ids out of the license form
The form printed the key as the field's value, the activation id in a hidden field, and with ?debug the license id and activation id. The field is now empty, and an empty field reuses the stored key, so "Click Activate License to reconnect it." still works. The hidden and debug fields are gone: deactivation no longer reads a posted id, and nothing reads a posted license_id. If you rely on ?debug to read the ids, I can bring them back as plain text.

5. Clear cached update data when the license changes
The 3-hour version info cache and the update_plugins (or update_themes) transient both hold the package link, and neither was cleared on activation or deactivation: a deactivated site kept the link, and a newly activated one waited for the next update check. The new Updater::clear_cache() deletes both and runs from activate() and deactivate(). Deleting the whole transient is what core's wp_clean_plugins_cache() and wp_clean_themes_cache() do too, and WordPress rebuilds it on the next admin page load.

6. Keep query args in the settings redirect
redirect() printed esc_url() inside a <script>, which turns & into &, so every arg after the first ended up in the fragment: admin.php?page=my-plugin&tab=license landed on admin.php?page=my-plugin&tab=license. It now prints a JSON string from esc_url_raw().

Testing

• phpcs with the repo's phpcs.xml: no findings in the three changed files, on every commit.
• With WP-CLI on a local WordPress 7.1.3 site (PHP 8.3) and a pre_http_request stub answering the licensing API, I ran 20 cases on this branch and on v1.2.1. On v1.2.1 they reproduce each bug above; on this branch they all pass, with no PHP notices. They cover:
  • a release error, with the undo answering 200, 404 and 500, and a failed activation create
  • activating and deactivating a plugin and a theme, checking both caches, then running wp_update_plugins()
  • a deactivation with a different posted id, and a deactivation error with and without deactivated_redirect
  • the form's HTML with ?debug, while activated and after the activation was removed
  • reconnecting with an empty key field and with a new key
  • the redirect URL, parsed with Node's URL

I haven't added unit tests, since the suite runs in wp-env. Happy to add some to tests/unit if you'd like.

[mzakash]

Thanks a lot @themihaicircea for the quick PR, will look into it.