Possible infinite loop in profile_update hook

[Zae]

Description

When logging in with the auth0 plugin I expect to be able to login, however we've noticed since updating to Auth0 v4, that some users are getting out of memory issues when logging in. It seems that for some users an infinite loops triggers that causes PHP to crash eventually.

Reproduction

I don't know the full details to reproduce yet, however I seem to have fixed it for us by commenting out a bit of code.

It seems that the function wp_auth0_profile_change_email listens to the profile_update hook. Which in turn call the method update_email in the class WP_Auth0_Profile_Change_Email.

This method calls remove_action('profile_update') explicitly to stop infinite loops, however that does not seem to work. I think this might be because there are now 2 functions listening for profile_update, the method in this class listens to it after being called for the first time and the function wp_auth0_profile_change_email I mentioned before.

// Remove this method from profile_update, which is called by wp_update_user, to avoid an infinite loop.
remove_action( 'profile_update', [ $this, __FUNCTION__ ], 100 );

I think this might be a refactoring bug, before this class registered it's own profile_update hook but in v4 that wp_auth0_profile_change_email function was added. The remove_action that should stop infinite loops does not deregister the new wp_auth0_profile_change_email function that calls WP_Auth0_Profile_Change_Email, only it's own function, which I think is wrong.

For now I completely commented out the wp_auth0_profile_change_email function and do an early return in WP_Auth0_Profile_Change_Email::update_email to make sure it doesn't run.

(partial) STACKTRACE

wp-content/plugins/auth0/lib/profile/WP_Auth0_Profile_Change_Email.php:94
wp-content/plugins/auth0/WP_Auth0.php:441
wp-includes/class-wp-hook.php:287
wp-includes/class-wp-hook.php:311
wp-includes/plugin.php:478
wp-includes/user.php:1876
wp-includes/user.php:1995
wp-content/plugins/auth0/lib/profile/WP_Auth0_Profile_Change_Email.php:94

Environment

Wordpress: 5.4.2
Login by Auth0: 4.1.0

[saltukalakus]

This issue is also tracked in a support ticket (SF 00463569). Just FYI.

[saltukalakus]

Hi @joshcanhelp do you think the provided information is sufficient to work on the issue?

[joshcanhelp]

@Zae - Apologies for the long delay here. I think you're spot-on with the root cause here and we'll get that fixed and released as soon as possible.