: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
add_filter('manage_users-network_columns', array($this, '_manage_users_columns'));
add_filter('manage_users-network_custom_column', array($this, '_manage_users_custom_column'), 10, 3);
add_filter('manage_users-network_sortable_columns', array($this, '_manage_users_sortable_columns'), 10, 1);
add_filter('ms_user_row_actions', array($this, '_user_row_actions'), 10, 2);
add_filter('views_users-network', array($this, '_views_users'));
public function _deleted_user($id) {
$user = new \WP_User($id);
if ($user instanceof \WP_User && !$user->exists()) {
$table = Controller_DB::shared()->secrets;
$wpdb->query($wpdb->prepare("DELETE FROM `{$table}` WHERE `user_id` = %d", $id));
public function _manage_users_columns($columns = array()) {
if (user_can(wp_get_current_user(), Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {
$columns['wfls_2fa_status'] = esc_html__('2FA Status', 'wordfence');
if (Controller_Settings::shared()->are_login_history_columns_enabled() && Controller_Permissions::shared()->can_manage_settings(wp_get_current_user())) {
$columns['wfls_last_login'] = esc_html__('Last Login', 'wordfence');
if (Controller_CAPTCHA::shared()->enabled()) {
$columns['wfls_last_captcha'] = esc_html__('Last CAPTCHA', 'wordfence');
public function _manage_users_custom_column($value = '', $column_name = '', $user_id = 0) {
$user = new \WP_User($user_id);
$value = __('Not Allowed', 'wordfence');
if (Controller_Users::shared()->can_activate_2fa($user)) {
$has2fa = Controller_Users::shared()->has_2fa_active($user);
$requires2fa = $this->requires_2fa($user, $inGracePeriod);
$value = esc_html__('Active', 'wordfence');
elseif ($inGracePeriod) {
$value = wp_kses(__('Inactive<small class="wfls-sub-status">(Grace Period)</small>', 'wordfence'), array('small'=>array('class'=>array())));
elseif (($requires2fa && !$has2fa)) {
$value = wp_kses($inGracePeriod === null ? __('Locked Out<small class="wfls-sub-status">(Grace Period Disabled)</small>', 'wordfence') : __('Locked Out<small class="wfls-sub-status">(Grace Period Exceeded)</small>', 'wordfence'), array('small'=>array('class'=>array())));
$value = esc_html__('Inactive', 'wordfence');
if (($last = get_user_meta($user_id, 'wfls-last-login', true)) && Utility_Number::isUnixTimestamp($last)) {
$value = Controller_Time::format_local_time(get_option('date_format') . ' ' . get_option('time_format'), $last);
case 'wfls_last_captcha':
$user = new \WP_User($user_id);
if (($last = get_user_meta($user_id, 'wfls-last-captcha-score', true))) {
$value = number_format($last, 1);
public function _manage_users_sortable_columns($sortable_columns) {
return array_merge($sortable_columns, array(
'wfls_last_login' => 'wfls-lastlogin',
'wfls_last_captcha' => 'wfls-lastcaptcha',
protected function _user_ids_with_2fa_active() {
$table = Controller_DB::shared()->secrets;
return $wpdb->get_col("SELECT DISTINCT `user_id` FROM {$table}");
public function _users_list_table_query_args($args) {
if (isset($_REQUEST['wf2fa']) && preg_match('/^(?:in)?active$/i', $_REQUEST['wf2fa'])) {
$mode = strtolower($_REQUEST['wf2fa']);
$args['include'] = $this->_user_ids_with_2fa_active();
else if ($mode == 'inactive') {
$args['exclude'] = $this->_user_ids_with_2fa_active();
if (isset($args['orderby'])) {
if (is_string($args['orderby'])) {
if ($args['orderby'] == 'wfls-lastlogin') {
$args['meta_key'] = 'wfls-last-login';
$args['orderby'] = 'meta_value';
else if ($args['orderby'] == 'wfls-lastcaptcha') {
$args['meta_key'] = 'wfls-last-captcha-score';
$args['orderby'] = 'meta_value';
if (array_key_exists('wfls-lastlogin', $args['orderby'])) {
$args['meta_key'] = 'wfls-last-login';
$args['orderby']['meta_value'] = $args['orderby']['wfls-lastlogin'];
unset($args['orderby']['wfls-lastlogin']);
if (array_key_exists('wfls-lastcaptcha', $args['orderby'])) {
if (!$has_one) { //We have to discard one if both are set to sort by because $meta_key can only be a single value rather than an array
$args['meta_key'] = 'wfls-last-captcha-score';
$args['orderby']['meta_value'] = $args['orderby']['wfls-lastcaptcha'];
unset($args['orderby']['wfls-lastcaptcha']);
if (in_array('wfls-lastlogin', $args['orderby'])) {
if (!$has_one) { //We have to discard one if both are set to sort by because $meta_key can only be a single value rather than an array
$args['meta_key'] = 'wfls-last-login';
$args['orderby'][] = 'meta_value';
unset($args['orderby'][array_search('wfls-lastlogin', $args['orderby'])]);
if (in_array('wfls-lastcaptcha', $args['orderby'])) {
if (!$has_one) { //We have to discard one if both are set to sort by because $meta_key can only be a single value rather than an array
$args['meta_key'] = 'wfls-last-captcha-score';
$args['orderby'][] = 'meta_value';
unset($args['orderby'][array_search('wfls-lastcaptcha', $args['orderby'])]);
public function _user_row_actions($actions, $user) {
//Format is 'view' => '<a href="https://wfpremium.dev1.ryanbritton.com/author/ryan/" aria-label="View posts by ryan">View</a>'
if (user_can(wp_get_current_user(), Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS) && (Controller_Users::shared()->can_activate_2fa($user) || Controller_Users::shared()->has_2fa_active($user))) {
$url = (is_multisite() ? network_admin_url('admin.php?page=WFLS&user=' . $user->ID) : admin_url('admin.php?page=WFLS&user=' . $user->ID));
$actions['wf2fa'] = '<a href="' . esc_url($url) . '" aria-label="' . esc_attr(sprintf(__('Edit two-factor authentication for %s', 'wordfence'), $user->user_login)) . '">' . esc_html__('2FA', 'wordfence') . '</a>';
public function _views_users($views) {
//Format is 'subscriber' => '<a href=\\'users.php?role=subscriber\\'>Subscriber <span class="count">(40,002)</span></a>',
include(ABSPATH . WPINC . '/version.php'); /** @var string $wp_version */
if (user_can(wp_get_current_user(), Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS) && version_compare($wp_version, '4.4.0', '>=')) {
$counts = $this->user_counts();
$views['all'] = str_replace(' class="current" aria-current="page"', '', $views['all']);
$views['wfls-active'] = '<a href="' . esc_url(add_query_arg('wf2fa', 'active', 'users.php')) . '"' . (isset($_GET['wf2fa']) && $_GET['wf2fa'] == 'active' ? ' class="current" aria-current="page"' : '') . '>' . esc_html__('2FA Active', 'wordfence') . ' <span class="count">(' . number_format($counts['active_users']) . ')</span></a>';
$views['wfls-inactive'] = '<a href="' . esc_url(add_query_arg('wf2fa', 'inactive', 'users.php')) . '"' . (isset($_GET['wf2fa']) && $_GET['wf2fa'] == 'inactive' ? ' class="current" aria-current="page"' : '') . '>' . esc_html__('2FA Inactive', 'wordfence') . ' <span class="count">(' . number_format($counts['inactive_users']) . ')</span></a>';
private function get_grace_period_reset_time($user) {
$time = get_user_option(self::META_KEY_GRACE_PERIOD_RESET, $user->ID);
public function get_grace_period_override($user) {
$override = get_user_option(self::META_KEY_GRACE_PERIOD_OVERRIDE, $user->ID);
private function does_user_role_require_2fa($user, &$inGracePeriod = null, &$requiredAt = null) {
$is2faAdmin = Controller_Permissions::shared()->can_manage_settings($user);
$userDate = self::get_grace_period_reset_time($user);
$userDate = self::get_registration_date($user);
if ($is2faAdmin && !$this->get_grace_period_allowed_flag($user->ID)) {
$gracePeriod = self::get_grace_period_override($user);
if ($gracePeriod === null)
$gracePeriod = Controller_Settings::shared()->get_user_2fa_grace_period();
$gracePeriod *= self::SECONDS_PER_DAY;
foreach (Controller_Permissions::shared()->get_all_roles($user) as $role) {
$roleDate = Controller_Settings::shared()->get_required_2fa_role_activation_time($role);
$effectiveDate = max($userDate, $roleDate) + $gracePeriod;
if ($requiredAt === null || $effectiveDate < $requiredAt)
$requiredAt = $effectiveDate;
if ($effectiveDate <= $now && (!$is2faAdmin || $this->has_admin_with_2fa_active())) {
else if ($inGracePeriod !== null) {
private static function get_registration_date($user) {
return strtotime($user->user_registered);
public function reset_2fa_grace_period($user, $override = null) {
if (!$this->can_activate_2fa($user) || $this->has_2fa_active($user))
update_user_option($user->ID, self::META_KEY_GRACE_PERIOD_RESET, time(), true);
update_user_option($user->ID, self::META_KEY_GRACE_PERIOD_OVERRIDE, (int) $override, true);
public function revoke_grace_period($user) {
self::META_KEY_GRACE_PERIOD_RESET,
self::META_KEY_GRACE_PERIOD_OVERRIDE,
self::META_KEY_ALLOW_GRACE_PERIOD
delete_user_option($user->ID, $option, true);
public function allow_grace_period($userId) {
update_user_option($userId, self::META_KEY_ALLOW_GRACE_PERIOD, true, true);
public function get_grace_period_allowed_flag($userId) {
return (bool) get_user_option(self::META_KEY_ALLOW_GRACE_PERIOD, $userId);
public function has_revokable_grace_period($user) {
return $this->get_grace_period_allowed_flag($user->ID) || $this->get_grace_period_reset_time($user) !== null;
private function get_inactive_2fa_super_admins($gracePeriod = false) {
foreach(get_super_admins() as $username) {
$user = new \WP_User($username);
if (!$this->has_2fa_active($user)) {
$this->requires_2fa($user, $inGracePeriod, $requiredAt);
if ($gracePeriod === null || $gracePeriod == $inGracePeriod) {
$current = new \StdClass();
$current->user_id = $user->ID;
$current->user_login = $username;
$current->required_at = $requiredAt;
private function generate_inactive_2fa_user_query($roleKey, $gracePeriod = null, $page = null, $perPage = null) {
$secondsPerDay = (int) self::SECONDS_PER_DAY;
$gracePeriodSeconds = (int) (Controller_Settings::shared()->get_user_2fa_grace_period() * self::SECONDS_PER_DAY);
$roleTime = (int) (Controller_Settings::shared()->get_required_2fa_role_activation_time($roleKey));
$siteId = get_current_blog_id();
$blogPrefix = $wpdb->get_blog_prefix($siteId);
$usermeta = $wpdb->usermeta;
$secrets = Controller_DB::shared()->secrets;
$admin = Controller_Permissions::shared()->can_role_manage_settings($roleKey);
self::META_KEY_GRACE_PERIOD_RESET,
self::META_KEY_GRACE_PERIOD_OVERRIDE
$gracePeriodClause = "IF(overrides.days IS NULL, $gracePeriodSeconds, overrides.days * $secondsPerDay)";
$registeredTimestampClause = "UNIX_TIMESTAMP(CONVERT_TZ($users.user_registered, '+00:00', @@time_zone))";
) allowances ON allowances.user_id = $usermeta.user_id
$parameters[] = self::META_KEY_ALLOW_GRACE_PERIOD;
$allowedClause = 'IFNULL(allowances.allowed, 0)';
$gracePeriodClause = "IF($allowedClause = 0, 0, $gracePeriodClause)";
$timeClause = "GREATEST($roleTime, $registeredTimestampClause, IFNULL(resets.time, 0)) + $gracePeriodClause";
$timeClause AS required_at
JOIN $users ON $users.ID = $usermeta.user_id
) resets ON resets.user_id = $usermeta.user_id
) overrides ON overrides.user_id = $usermeta.user_id
meta_key = '{$blogPrefix}capabilities'
AND NOT $usermeta.user_id IN(SELECT user_id FROM {$secrets})
if ($gracePeriod !== null) {
$conditions[] = "$timeClause > $now";
$conditions[] = "$timeClause <= $now";
$conditions[] = $allowedClause . ' = ' . ($gracePeriod ? 1 : 0);
$query .= ' AND (' . implode(" $operator ", $conditions). ')';
if ($page !== null && $perPage !== null) {
$offset = (int) (($page - 1) * $perPage);
$limit = (int) ($perPage + 1);
if ($offset >= 0 && $perPage > 0)
$query .= " LIMIT $offset, $limit";
$serializedRoleKey = serialize($roleKey);
$roleMatch = '%' . (method_exists($wpdb, 'esc_like') ? $wpdb->esc_like($serializedRoleKey) : addcslashes($serializedRoleKey, '_%\\')). '%';
$parameters[] = $roleMatch;
public function get_inactive_2fa_users($roleKey, $gracePeriod = null, $page = null, $perPage = null, &$lastPage = null) {
if (is_multisite() && $roleKey === 'super-admin') {
$superAdmins = $this->get_inactive_2fa_super_admins($gracePeriod);
if ($page !== null && $perPage !== null) {
$start = ($page - 1) * $perPage;
$end = $start + $perPage;
$lastPage = $end >= count($superAdmins);
$superAdmins = array_slice($superAdmins, $start, $perPage);
$query = $this->generate_inactive_2fa_user_query($roleKey, $gracePeriod, $page, $perPage);
$results = $wpdb->get_results($query);
if (count($results) > $perPage) {
private function get_verification_token_transient_key($hash) {
return self::VERIFICATION_TOKEN_TRANSIENT_PREFIX . $hash;
private function load_verification_token($hash) {
$key = $this->get_verification_token_transient_key($hash);
$userId = get_transient($key);
private function load_verification_tokens($user) {
$storedHashes = get_user_meta($user->ID, self::META_KEY_VERIFICATION_TOKENS, true);
if (is_array($storedHashes)) {
foreach ($storedHashes as $hash) {
$userId = $this->load_verification_token($hash);
if ($userId === $user->ID)
private function hash_verification_token($token) {
public function generate_verification_token($user) {
$token = Model_Crypto::random_bytes(self::VERIFICATION_TOKEN_BYTES);
$hash = $this->hash_verification_token($token);
$tokens = $this->load_verification_tokens($user);
array_unshift($tokens, $hash);
while (count($tokens) > self::VERIFICATION_TOKEN_LIMIT) {
$excessHash = array_pop($tokens);
delete_transient($this->get_verification_token_transient_key($excessHash));
$key = $this->get_verification_token_transient_key($hash);
set_transient($key, $user->ID, WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * 60);
update_user_meta($user->ID, self::META_KEY_VERIFICATION_TOKENS, $tokens);
return base64_encode($token);
public function validate_verification_token($token, $user = null) {
$hash = $this->hash_verification_token(base64_decode($token));
$userId = $this->load_verification_token($hash);
return $userId !== null && ($user === null || $userId === $user->ID);
* Returns the key used to store a captcha score transient.
private function get_captcha_score_transient_key($hash) {
return self::CAPTCHA_SCORE_TRANSIENT_PREFIX . $hash;
* Attempts to look up a stored captcha score for the given hash and user. If found, returns the score. If not,
private function load_captcha_score($hash, $user) {
$key = $this->get_captcha_score_transient_key($hash);
$data = get_transient($key);
if (!$user->exists() || $data['user'] !== $user->ID) {
return floatval($data['score']);
* Deletes the stored captcha score if present for the given hash.
private function clear_captcha_score($token, $user) {
$hash = $this->hash_captcha_token($token);
$key = $this->get_captcha_score_transient_key($hash);
$storedHashes = get_user_meta($user->ID, self::META_KEY_CAPTCHA_SCORES, true);
if (is_array($storedHashes)) {
foreach ($storedHashes as $hash) {
$storedScore = $this->load_captcha_score($hash, $user);
if ($storedScore !== false) {
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
