From cfd5f4028a554104a413a802dad3e13e01155ce8 Mon Sep 17 00:00:00 2001
From: Pierrick Le Gall <plg@piwigo.org>
Date: Tue, 3 Nov 2026 13:08:15 +0100
Subject: [PATCH] issue #2600 conf_delete_param: optional SQL condition,
 returns the number of deleted rows

The optional $condition is added to the WHERE clause with an AND. It lets
pwg_unique_exec_begins/ends delete a token only if it holds the expected
value, without writing their own DELETE query on the config table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vty6FTwtZ3ezEncagFo2FQ
---
 include/functions.inc.php | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/include/functions.inc.php b/include/functions.inc.php
index 5c4cb38b1..bcf922c7e 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -1562,8 +1562,12 @@ INSERT INTO
  * @since 2.6
  *
  * @param string|string[] $params
+ * @param string $condition (optional, @since 15) SQL condition added to the
+ *   WHERE clause with an AND, for example 'value = "..."'. Not escaped: the
+ *   caller is responsible for its content.
+ * @return int number of deleted rows
  */
-function conf_delete_param($params)
+function conf_delete_param($params, $condition=null)
 {
   global $conf;
 
@@ -1573,19 +1577,30 @@ function conf_delete_param($params)
   }
   if (empty($params))
   {
-    return;
+    return 0;
   }
 
   $query = '
 DELETE FROM '.CONFIG_TABLE.'
-  WHERE param IN(\''. implode('\',\'', $params) .'\')
+  WHERE param IN(\''. implode('\',\'', $params) .'\')';
+  if (!empty($condition))
+  {
+    $query.= '
+    AND '.$condition;
+  }
+  $query.= '
 ;';
   pwg_query($query);
+  $nb_deleted = pwg_db_changes();
 
+  // even when the condition matched nothing, the value we had in $conf is
+  // outdated: the row does not exist anymore or holds another value
   foreach ($params as $param)
   {
     unset($conf[$param]);
   }
+
+  return $nb_deleted;
 }
 
 /**