Allow disabling only local or global plugins internally to fix #10935 without side-effects

src/Composer/Command/CreateProjectCommand.php

@@ -403,15 +403,7 @@ EOT
             throw new \InvalidArgumentException('Invalid stability provided ('.$stability.'), must be one of: '.implode(', ', array_keys(BasePackage::$stabilities)));
         }
 
-        $composerJson = array_merge(
+        $composer = Factory::create($io, $config->all(), $disablePlugins === true ? true : 'local', $disableScripts);
-            // prevent version guessing from happening
-            array('version' => '1.0.0'),
-            $config->all(),
-            // ensure the vendor dir and its plugins does not get loaded if CWD/vendor has plugins in it
-            array('config' => array('vendor-dir' => Platform::getDevNull()))
-        );
-        $factory = new Factory;
-        $composer = $factory->createComposer($io, $composerJson, $disablePlugins, Platform::getDevNull(), true, $disableScripts);
         $config = $composer->getConfig();
         $rm = $composer->getRepositoryManager();
 

src/Composer/Factory.php

@@ -293,7 +293,7 @@ class Factory
      * @param  IOInterface                       $io             IO instance
      * @param  array<string, mixed>|string|null  $localConfig    either a configuration array or a filename to read from, if null it will
      *                                                           read from the default filename
-     * @param  bool                              $disablePlugins Whether plugins should not be loaded
+     * @param  bool|'local'|'global'             $disablePlugins Whether plugins should not be loaded, can be set to local or global to only disable local/global plugins
      * @param  bool                              $disableScripts Whether scripts should not be run
      * @param  string|null                       $cwd
      * @param  bool                              $fullLoad       Whether to initialize everything or only main project stuff (used when loading the global composer)
@@ -500,6 +500,9 @@ class Factory
      */
     protected function createGlobalComposer(IOInterface $io, Config $config, $disablePlugins, $disableScripts, $fullLoad = false)
     {
+        // make sure if disable plugins was 'local' it is now turned off
+        $disablePlugins = $disablePlugins === 'global' || $disablePlugins === true;
+
         $composer = null;
         try {
             $composer = $this->createComposer($io, $config->get('home') . '/composer.json', $disablePlugins, $config->get('home'), $fullLoad, $disableScripts);
@@ -579,7 +582,7 @@ class Factory
      * @param  IOInterface          $io
      * @param  Composer             $composer
      * @param  Composer             $globalComposer
-     * @param  bool                 $disablePlugins
+     * @param  bool|'local'|'global' $disablePlugins Whether plugins should not be loaded, can be set to local or global to only disable local/global plugins
      * @return Plugin\PluginManager
      */
     protected function createPluginManager(IOInterface $io, Composer $composer, Composer $globalComposer = null, $disablePlugins = false)
@@ -635,7 +638,7 @@ class Factory
      * @param  IOInterface $io             IO instance
      * @param  mixed       $config         either a configuration array or a filename to read from, if null it will read from
      *                                     the default filename
-     * @param  bool        $disablePlugins Whether plugins should not be loaded
+     * @param  bool|'local'|'global' $disablePlugins Whether plugins should not be loaded, can be set to local or global to only disable local/global plugins
      * @param  bool        $disableScripts Whether scripts should not be run
      * @return Composer
      */

src/Composer/Installer/PluginInstaller.php

@@ -53,7 +53,7 @@ class PluginInstaller extends LibraryInstaller
     public function prepare($type, PackageInterface $package, PackageInterface $prevPackage = null)
     {
         // fail install process early if it is going to fail due to a plugin not being allowed
-        if (($type === 'install' || $type === 'update') && !$this->composer->getPluginManager()->arePluginsDisabled()) {
+        if (($type === 'install' || $type === 'update') && !$this->composer->getPluginManager()->arePluginsDisabled('local')) {
             $this->composer->getPluginManager()->isPluginAllowed($package->getName(), false);
         }
 

src/Composer/Plugin/PluginManager.php

@@ -47,7 +47,7 @@ class PluginManager
     protected $globalComposer;
     /** @var VersionParser */
     protected $versionParser;
-    /** @var bool */
+    /** @var bool|'local'|'global' */
     protected $disablePlugins = false;
 
     /** @var array<PluginInterface> */
@@ -74,7 +74,7 @@ class PluginManager
      * @param IOInterface $io
      * @param Composer    $composer
      * @param Composer    $globalComposer
-     * @param bool        $disablePlugins
+     * @param bool|'local'|'global' $disablePlugins Whether plugins should not be loaded, can be set to local or global to only disable local/global plugins
      */
     public function __construct(IOInterface $io, Composer $composer, Composer $globalComposer = null, $disablePlugins = false)
     {
@@ -94,17 +94,18 @@ class PluginManager
      */
     public function loadInstalledPlugins()
     {
-        if ($this->disablePlugins) {
+        if (!$this->arePluginsDisabled('local')) {
-            return;
+            $repo = $this->composer->getRepositoryManager()->getLocalRepository();
+            $this->loadRepository($repo, false);
         }
 
-        $repo = $this->composer->getRepositoryManager()->getLocalRepository();
+        if (!$this->arePluginsDisabled('global')) {
             $globalRepo = $this->globalComposer !== null ? $this->globalComposer->getRepositoryManager()->getLocalRepository() : null;
-        $this->loadRepository($repo, false);
+            if ($globalRepo !== null) {
-        if ($globalRepo) {
                 $this->loadRepository($globalRepo, true);
             }
         }
+    }
 
     /**
      * Deactivate all plugins from currently installed plugin packages
@@ -113,17 +114,18 @@ class PluginManager
      */
     public function deactivateInstalledPlugins()
     {
-        if ($this->disablePlugins) {
+        if (!$this->arePluginsDisabled('local')) {
-            return;
+            $repo = $this->composer->getRepositoryManager()->getLocalRepository();
+            $this->deactivateRepository($repo, false);
         }
 
-        $repo = $this->composer->getRepositoryManager()->getLocalRepository();
+        if (!$this->arePluginsDisabled('global')) {
             $globalRepo = $this->globalComposer ? $this->globalComposer->getRepositoryManager()->getLocalRepository() : null;
-        $this->deactivateRepository($repo, false);
+            if ($globalRepo !== null) {
-        if ($globalRepo) {
                 $this->deactivateRepository($globalRepo, true);
             }
         }
+    }
 
     /**
      * Gets all currently active plugin instances
@@ -161,7 +163,7 @@ class PluginManager
      */
     public function registerPackage(PackageInterface $package, $failOnMissingClasses = false, $isGlobalPlugin = false)
     {
-        if ($this->disablePlugins) {
+        if ($this->arePluginsDisabled($isGlobalPlugin ? 'global' : 'local')) {
             return;
         }
 
@@ -320,10 +322,6 @@ class PluginManager
      */
     public function deactivatePackage(PackageInterface $package)
     {
-        if ($this->disablePlugins) {
-            return;
-        }
-
         if (!isset($this->registeredPlugins[$package->getName()])) {
             return;
         }
@@ -351,10 +349,6 @@ class PluginManager
      */
     public function uninstallPackage(PackageInterface $package)
     {
-        if ($this->disablePlugins) {
-            return;
-        }
-
         if (!isset($this->registeredPlugins[$package->getName()])) {
             return;
         }
@@ -394,6 +388,10 @@ class PluginManager
      */
     public function addPlugin(PluginInterface $plugin, $isGlobalPlugin = false, PackageInterface $sourcePackage = null)
     {
+        if ($this->arePluginsDisabled($isGlobalPlugin ? 'global' : 'local')) {
+            return;
+        }
+
         if ($sourcePackage === null) {
             trigger_error('Calling PluginManager::addPlugin without $sourcePackage is deprecated, if you are using this please get in touch with us to explain the use case', E_USER_DEPRECATED);
         } elseif (!$this->isPluginAllowed($sourcePackage->getName(), $isGlobalPlugin)) {
@@ -682,11 +680,12 @@ class PluginManager
     /**
      * @internal
      *
+     * @param 'local'|'global' $type
      * @return bool
      */
-    public function arePluginsDisabled()
+    public function arePluginsDisabled($type)
     {
-        return $this->disablePlugins;
+        return $this->disablePlugins === true || $this->disablePlugins === $type;
     }
 
     /**