Skip to content

Logging out in one browser releases post locks held in another #890

Description

@huzaifaalmesbah

wp_presence_on_logout() calls wp_remove_user_presence(), which deletes every row for the user, including the reserved _lock rows that hold _edit_lock since the post-lock bridge moved it out of post meta, so logging out on one device releases every lock that person still holds in another browser.

Checked on main (ce76757) with two editors:

Step wp_check_post_lock() as Bob
Alice opens the post, wp_set_post_lock() Alice's ID
wp_logout fires for Alice, as from her phone false

Alice is still editing in the other browser, but Bob can now open the post and take the lock before her next tick, which can be up to 120s away on an unfocused tab. Core left _edit_lock alone on logout and let it age out after 150s. Her row in Who's Online also disappears until that browser's next tick.

Tasks

  • Leave _lock rows alone in the logout path, or remove only the rows written by the session that logged out
  • Test: a lock taken with wp_set_post_lock() still reads back from wp_check_post_lock() after wp_logout fires for its holder

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions