Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WordfenceLS;

[2] Fix | Delete

[3] Fix | Delete

use WordfenceLS\Crypto\Model_JWT;

[4] Fix | Delete

use WordfenceLS\Crypto\Model_Symmetric;

[5] Fix | Delete

use WordfenceLS\Text\Model_HTML;

[6] Fix | Delete

use WordfenceLS\View\Model_Tab;

[7] Fix | Delete

use WordfenceLS\View\Model_Title;

[8] Fix | Delete

[9] Fix | Delete

class Controller_WordfenceLS {

[10] Fix | Delete

const VERSION_KEY = 'wordfence_ls_version';

[11] Fix | Delete

const USERS_PER_PAGE = 25;

[12] Fix | Delete

const SHORTCODE_2FA_MANAGEMENT = 'wordfence_2fa_management';

[13] Fix | Delete

const WOOCOMMERCE_ENDPOINT = 'wordfence-2fa';

[14] Fix | Delete

[15] Fix | Delete

private $management_assets_registered = false;

[16] Fix | Delete

private $management_assets_enqueued = false;

[17] Fix | Delete

private $use_core_font_awesome_styles = null;

[18] Fix | Delete

[19] Fix | Delete

/**

[20] Fix | Delete

* Returns the singleton Controller_Wordfence2FA.

[21] Fix | Delete

[22] Fix | Delete

* @return Controller_WordfenceLS

[23] Fix | Delete

[24] Fix | Delete

public static function shared() {

[25] Fix | Delete

static $_shared = null;

[26] Fix | Delete

if ($_shared === null) {

[27] Fix | Delete

$_shared = new Controller_WordfenceLS();

[28] Fix | Delete

}

[29] Fix | Delete

return $_shared;

[30] Fix | Delete

}

[31] Fix | Delete

[32] Fix | Delete

public function init() {

[33] Fix | Delete

$this->_init_actions();

[34] Fix | Delete

Controller_AJAX::shared()->init();

[35] Fix | Delete

Controller_Users::shared()->init();

[36] Fix | Delete

Controller_Time::shared()->init();

[37] Fix | Delete

Controller_Permissions::shared()->init();

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

protected function _init_actions() {

[41] Fix | Delete

register_activation_hook(WORDFENCE_LS_FCPATH, array($this, '_install_plugin'));

[42] Fix | Delete

register_deactivation_hook(WORDFENCE_LS_FCPATH, array($this, '_uninstall_plugin'));

[43] Fix | Delete

[44] Fix | Delete

$versionInOptions = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, self::VERSION_KEY, false) : get_option(self::VERSION_KEY, false));

[45] Fix | Delete

if (!$versionInOptions || version_compare(WORDFENCE_LS_VERSION, $versionInOptions, '>')) { //Either there is no version in options or the version in options is greater and we need to run the upgrade

[46] Fix | Delete

$this->_install();

[47] Fix | Delete

}

[48] Fix | Delete

[49] Fix | Delete

if (!Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ALLOW_XML_RPC)) {

[50] Fix | Delete

add_filter('xmlrpc_enabled', array($this, '_block_xml_rpc'));

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

add_action('admin_init', array($this, '_admin_init'));

[54] Fix | Delete

add_action('login_enqueue_scripts', array($this, '_login_enqueue_scripts'));

[55] Fix | Delete

add_filter('authenticate', array($this, '_authenticate'), 25, 3);

[56] Fix | Delete

add_action('set_logged_in_cookie', array($this, '_set_logged_in_cookie'), 25, 4);

[57] Fix | Delete

add_action('wp_login', array($this, '_record_login'), 999, 1);

[58] Fix | Delete

add_action('register_post', array($this, '_register_post'), 25, 3);

[59] Fix | Delete

add_filter('wp_login_errors', array($this, '_wp_login_errors'), 25, 3);

[60] Fix | Delete

if ($this->is_woocommerce_integration_enabled()) {

[61] Fix | Delete

$this->init_woocommerce_actions();

[62] Fix | Delete

}

[63] Fix | Delete

add_action('user_new_form', array($this, '_user_new_form'));

[64] Fix | Delete

add_action('user_register', array($this, '_user_register'));

[65] Fix | Delete

[66] Fix | Delete

$useSubmenu = WORDFENCE_LS_FROM_CORE;

[67] Fix | Delete

if (is_multisite() && !is_network_admin()) {

[68] Fix | Delete

$useSubmenu = false;

[69] Fix | Delete

}

[70] Fix | Delete

[71] Fix | Delete

add_action('admin_menu', array($this, '_admin_menu'), $useSubmenu ? 55 : 10);

[72] Fix | Delete

if (is_multisite()) {

[73] Fix | Delete

add_action('network_admin_menu', array($this, '_admin_menu'), $useSubmenu ? 55 : 10);

[74] Fix | Delete

}

[75] Fix | Delete

add_action('admin_enqueue_scripts', array($this, '_admin_enqueue_scripts'));

[76] Fix | Delete

[77] Fix | Delete

add_action('show_user_profile', array($this, '_edit_user_profile'), 0); //We can't add it to the password section directly -- priority 0 is as close as we can get

[78] Fix | Delete

add_action('edit_user_profile', array($this, '_edit_user_profile'), 0);

[79] Fix | Delete

[80] Fix | Delete

add_action('init', array($this, '_wordpress_init'));

[81] Fix | Delete

if ($this->is_shortcode_enabled())

[82] Fix | Delete

add_action('wp_enqueue_scripts', array($this, '_handle_shortcode_prerequisites'));

[83] Fix | Delete

[84] Fix | Delete

Controller_Permissions::_init_actions();

[85] Fix | Delete

}

[86] Fix | Delete

[87] Fix | Delete

public function _wordpress_init() {

[88] Fix | Delete

if (!WORDFENCE_LS_FROM_CORE)

[89] Fix | Delete

load_plugin_textdomain('wordfence-login-security', false, WORDFENCE_LS_PATH . 'languages');

[90] Fix | Delete

if ($this->is_shortcode_enabled())

[91] Fix | Delete

add_shortcode(self::SHORTCODE_2FA_MANAGEMENT, array($this, '_handle_user_2fa_management_shortcode'));

[92] Fix | Delete

}

[93] Fix | Delete

[94] Fix | Delete

private function init_woocommerce_actions() {

[95] Fix | Delete

add_action('woocommerce_before_customer_login_form', array($this, '_woocommerce_login_enqueue_scripts'));

[96] Fix | Delete

add_action('woocommerce_before_checkout_form', array($this, '_woocommerce_checkout_login_enqueue_scripts'));

[97] Fix | Delete

add_action('wp_loaded', array($this, '_handle_woocommerce_registration'), 10, 0); //Woocommerce uses priority 20

[98] Fix | Delete

[99] Fix | Delete

if ($this->is_woocommerce_account_integration_enabled()) {

[100] Fix | Delete

add_filter('woocommerce_account_menu_items', array($this, '_woocommerce_account_menu_items'));

[101] Fix | Delete

add_filter('woocommerce_account_wordfence-2fa_endpoint', array($this, '_woocommerce_account_menu_content'));

[102] Fix | Delete

add_filter('woocommerce_get_query_vars', array($this, '_woocommerce_get_query_vars'));

[103] Fix | Delete

add_action('wp_enqueue_scripts', array($this, '_woocommerce_account_enqueue_assets'));

[104] Fix | Delete

}

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

public function _admin_init() {

[108] Fix | Delete

if (WORDFENCE_LS_FROM_CORE) {

[109] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-enable-2fa-roles', __('Login Security: Enable 2FA for these roles', 'wordfence'));

[110] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-allow-remember', __('Login Security: Allow remembering device for 30 days', 'wordfence'));

[111] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-require-2fa-xml-rpc', __('Login Security: Require 2FA for XML-RPC call authentication', 'wordfence'));

[112] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-disable-xml-rpc', __('Login Security: Disable XML-RPC authentication', 'wordfence'));

[113] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-whitelist-2fa', __('Login Security: Allowlisted IP addresses that bypass 2FA and reCAPTCHA', 'wordfence'));

[114] Fix | Delete

\wfModuleController::shared()->addOptionIndex('wfls-option-enable-captcha', __('Login Security: Enable reCAPTCHA on the login and user registration pages', 'wordfence'));

[115] Fix | Delete

[116] Fix | Delete

$title = __('Login Security Options', 'wordfence');

[117] Fix | Delete

$description = __('Login Security options are available on the Login Security options page', 'wordfence');

[118] Fix | Delete

$url = esc_url(network_admin_url('admin.php?page=WFLS#top#settings'));

[119] Fix | Delete

$link = __('Login Security Options', 'wordfence');;

[120] Fix | Delete

\wfModuleController::shared()->addOptionBlock(<<<END

[121] Fix | Delete

[122] Fix | Delete

[123] Fix | Delete

[124] Fix | Delete

[125] Fix | Delete

[126] Fix | Delete

[127] Fix | Delete

<strong>{$title}</strong>

[128] Fix | Delete

</div>

[129] Fix | Delete

</div>

[130] Fix | Delete

</div>

[131] Fix | Delete

[132] Fix | Delete

[133] Fix | Delete

<li>

[134] Fix | Delete

[135] Fix | Delete

<li>{$description}</li>

[136] Fix | Delete

[137] Fix | Delete

[138] Fix | Delete

</li>

[139] Fix | Delete

</ul>

[140] Fix | Delete

[141] Fix | Delete

[142] Fix | Delete

[143] Fix | Delete

[144] Fix | Delete

[145] Fix | Delete

[146] Fix | Delete

</li>

[147] Fix | Delete

</ul>

[148] Fix | Delete

</div>

[149] Fix | Delete

</div>

[150] Fix | Delete

</div>

[151] Fix | Delete

</div>

[152] Fix | Delete

END

[153] Fix | Delete

);

[154] Fix | Delete

}

[155] Fix | Delete

[156] Fix | Delete

if (Controller_Permissions::shared()->can_manage_settings()) {

[157] Fix | Delete

if ((is_plugin_active('jetpack/jetpack.php') || (is_multisite() && is_plugin_active_for_network('jetpack/jetpack.php'))) && !Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ALLOW_XML_RPC)) {

[158] Fix | Delete

if (is_multisite()) {

[159] Fix | Delete

add_action('network_admin_notices', array($this, '_jetpack_xml_rpc_notice'));

[160] Fix | Delete

}

[161] Fix | Delete

else {

[162] Fix | Delete

add_action('admin_notices', array($this, '_jetpack_xml_rpc_notice'));

[163] Fix | Delete

}

[164] Fix | Delete

}

[165] Fix | Delete

[166] Fix | Delete

if (Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_CAPTCHA_TEST_MODE) && Controller_CAPTCHA::shared()->enabled()) {

[167] Fix | Delete

if (is_multisite()) {

[168] Fix | Delete

add_action('network_admin_notices', array($this, '_recaptcha_test_notice'));

[169] Fix | Delete

}

[170] Fix | Delete

else {

[171] Fix | Delete

add_action('admin_notices', array($this, '_recaptcha_test_notice'));

[172] Fix | Delete

}

[173] Fix | Delete

}

[174] Fix | Delete

[175] Fix | Delete

if ($this->has_woocommerce() && !Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION)) {

[176] Fix | Delete

if (!Controller_Notices::shared()->is_persistent_notice_dismissed(get_current_user_id(), Controller_Notices::PERSISTENT_NOTICE_WOOCOMMERCE_INTEGRATION)) {

[177] Fix | Delete

Controller_Notices::shared()->register_persistent_notice(Controller_Notices::PERSISTENT_NOTICE_WOOCOMMERCE_INTEGRATION);

[178] Fix | Delete

add_action(is_multisite() ? 'network_admin_notices' : 'admin_notices', array($this, '_woocommerce_integration_notice'));

[179] Fix | Delete

}

[180] Fix | Delete

}

[181] Fix | Delete

}

[182] Fix | Delete

}

[183] Fix | Delete

[184] Fix | Delete

/**

[185] Fix | Delete

* Notices

[186] Fix | Delete

[187] Fix | Delete

[188] Fix | Delete

public function _jetpack_xml_rpc_notice() {

[189] Fix | Delete

echo '<div class="notice notice-warning"><p>' . wp_kses(sprintf(__('XML-RPC authentication is disabled. Jetpack is currently active and requires XML-RPC authentication to work correctly. <a href="%s">Manage Settings</a>', 'wordfence'), esc_url(network_admin_url('admin.php?page=WFLS#top#settings'))), array('a'=>array('href'=>array()))) . '</p></div>';

[190] Fix | Delete

}

[191] Fix | Delete

[192] Fix | Delete

public function _recaptcha_test_notice() {

[193] Fix | Delete

echo '<div class="notice notice-warning"><p>' . wp_kses(sprintf(__('reCAPTCHA test mode is enabled. While enabled, login and registration requests will be checked for their score but will not be blocked if the score is below the minimum score. <a href="%s">Manage Settings</a>', 'wordfence'), esc_url(network_admin_url('admin.php?page=WFLS#top#settings'))), array('a'=>array('href'=>array()))) . '</p></div>';

[194] Fix | Delete

}

[195] Fix | Delete

[196] Fix | Delete

public function _woocommerce_integration_notice() {

[197] Fix | Delete

[198] Fix | Delete

<div id="<?php echo esc_attr(Controller_Notices::PERSISTENT_NOTICE_WOOCOMMERCE_INTEGRATION) ?>" class="notice notice-warning is-dismissible wfls-persistent-notice">

[199] Fix | Delete

<p>

[200] Fix | Delete

<?php esc_html_e('WooCommerce appears to be installed, but the Wordfence Login Security WooCommerce integration is not currently enabled. Without this feature, WooCommerce forms will not support all functionality provided by Wordfence Login Security, including CAPTCHA for the login page and user registration.', 'wordfence'); ?>

[201] Fix | Delete

[202] Fix | Delete

</p>

[203] Fix | Delete

</div>

[204] Fix | Delete

<?php

[205] Fix | Delete

}

[206] Fix | Delete

[207] Fix | Delete

/**

[208] Fix | Delete

* Installation/Uninstallation

[209] Fix | Delete

[210] Fix | Delete

[211] Fix | Delete

public function _install_plugin() {

[212] Fix | Delete

$this->_install();

[213] Fix | Delete

}

[214] Fix | Delete

[215] Fix | Delete

public function _uninstall_plugin() {

[216] Fix | Delete

Controller_Time::shared()->uninstall();

[217] Fix | Delete

Controller_Permissions::shared()->uninstall();

[218] Fix | Delete

[219] Fix | Delete

foreach (array(self::VERSION_KEY) as $opt) {

[220] Fix | Delete

if (is_multisite() && function_exists('delete_network_option')) {

[221] Fix | Delete

delete_network_option(null, $opt);

[222] Fix | Delete

}

[223] Fix | Delete

delete_option($opt);

[224] Fix | Delete

}

[225] Fix | Delete

[226] Fix | Delete

if (Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_DELETE_ON_DEACTIVATION)) {

[227] Fix | Delete

Controller_DB::shared()->uninstall();

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

$this->purge_rewrite_rules();

[231] Fix | Delete

}

[232] Fix | Delete

[233] Fix | Delete

protected function _install() {

[234] Fix | Delete

static $_runInstallCalled = false;

[235] Fix | Delete

if ($_runInstallCalled) { return; }

[236] Fix | Delete

$_runInstallCalled = true;

[237] Fix | Delete

[238] Fix | Delete

if (function_exists('ignore_user_abort')) {

[239] Fix | Delete

@ignore_user_abort(true);

[240] Fix | Delete

}

[241] Fix | Delete

[242] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[243] Fix | Delete

[244] Fix | Delete

$previousVersion = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, self::VERSION_KEY, '0.0.0') : get_option(self::VERSION_KEY, '0.0.0'));

[245] Fix | Delete

if (is_multisite() && function_exists('update_network_option')) {

[246] Fix | Delete

update_network_option(null, self::VERSION_KEY, WORDFENCE_LS_VERSION); //In case we have a fatal error we don't want to keep running install.

[247] Fix | Delete

}

[248] Fix | Delete

else {

[249] Fix | Delete

update_option(self::VERSION_KEY, WORDFENCE_LS_VERSION); //In case we have a fatal error we don't want to keep running install.

[250] Fix | Delete

}

[251] Fix | Delete

[252] Fix | Delete

Controller_DB::shared()->install();

[253] Fix | Delete

Controller_Settings::shared()->set_defaults();

[254] Fix | Delete

[255] Fix | Delete

if (\WordfenceLS\Controller_Time::time() > Controller_Settings::shared()->get_int(Controller_Settings::OPTION_LAST_SECRET_REFRESH) + 180 * 86400) {

[256] Fix | Delete

Model_Crypto::refresh_secrets();

[257] Fix | Delete

}

[258] Fix | Delete

[259] Fix | Delete

Controller_Time::shared()->install();

[260] Fix | Delete

Controller_Permissions::shared()->install();

[261] Fix | Delete

[262] Fix | Delete

$this->purge_rewrite_rules();

[263] Fix | Delete

}

[264] Fix | Delete

[265] Fix | Delete

private function purge_rewrite_rules() {

[266] Fix | Delete

// This is usually done internally in WP_Rewrite::flush_rules, but is followed there by WP_Rewrite::wp_rewrite_rules which repopulates it. This should cause it to be repopulated on the next request.

[267] Fix | Delete

update_option('rewrite_rules', '');

[268] Fix | Delete

}

[269] Fix | Delete

[270] Fix | Delete

/**

[271] Fix | Delete

* In most cases, this will be done internally by WooCommerce since we are using the woocommerce_get_query_vars filter, but when toggling the option on our settings page we must still do this manually

[272] Fix | Delete

[273] Fix | Delete

private function register_rewrite_endpoints() {

[274] Fix | Delete

add_rewrite_endpoint(self::WOOCOMMERCE_ENDPOINT, $this->is_woocommerce_account_integration_enabled() ? EP_PAGES : EP_NONE);

[275] Fix | Delete

}

[276] Fix | Delete

[277] Fix | Delete

public function refresh_rewrite_rules() {

[278] Fix | Delete

$this->register_rewrite_endpoints();

[279] Fix | Delete

flush_rewrite_rules();

[280] Fix | Delete

}

[281] Fix | Delete

[282] Fix | Delete

public function _block_xml_rpc() {

[283] Fix | Delete

/**

[284] Fix | Delete

* Fires just prior to blocking an XML-RPC request. After firing this action hook the XML-RPC request is blocked.

[285] Fix | Delete

[286] Fix | Delete

* @param int $source The source code of the block.

[287] Fix | Delete

[288] Fix | Delete

do_action('wfls_xml_rpc_blocked', 2);

[289] Fix | Delete

return false;

[290] Fix | Delete

}

[291] Fix | Delete

[292] Fix | Delete

private function has_woocommerce() {

[293] Fix | Delete

return class_exists('woocommerce');

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

private function is_woocommerce_integration_enabled() {

[297] Fix | Delete

return Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION);

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

private function is_woocommerce_account_integration_enabled() {

[301] Fix | Delete

return $this->is_woocommerce_integration_enabled() && Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION);

[302] Fix | Delete

}

[303] Fix | Delete

[304] Fix | Delete

private function is_shortcode_enabled() {

[305] Fix | Delete

return Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_SHORTCODE);

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

public function _woocommerce_login_enqueue_scripts() {

[309] Fix | Delete

wp_enqueue_style('dashicons');

[310] Fix | Delete

$this->_login_enqueue_scripts();

[311] Fix | Delete

}

[312] Fix | Delete

[313] Fix | Delete

public function _woocommerce_checkout_login_enqueue_scripts() {

[314] Fix | Delete

/**

[315] Fix | Delete

* This is the same check used in WooCommerce to determine whether or not to display the checkout login form

[316] Fix | Delete

* @see templates/checkout/form-login.php in WooCommerce

[317] Fix | Delete

[318] Fix | Delete

if ( is_user_logged_in() || 'no' === get_option( 'woocommerce_enable_checkout_login_reminder' ) ) {

[319] Fix | Delete

return;

[320] Fix | Delete

}

[321] Fix | Delete

$this->_woocommerce_login_enqueue_scripts();

[322] Fix | Delete

}

[323] Fix | Delete

[324] Fix | Delete

/**

[325] Fix | Delete

* Login Page

[326] Fix | Delete

[327] Fix | Delete

public function _login_enqueue_scripts() {

[328] Fix | Delete

$useCAPTCHA = Controller_CAPTCHA::shared()->enabled();

[329] Fix | Delete

if ($useCAPTCHA) {

[330] Fix | Delete

wp_enqueue_script('wordfence-ls-recaptcha', 'https://www.google.com/recaptcha/api.js?render=' . urlencode(Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SITE_KEY)));

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

if ($useCAPTCHA || Controller_Users::shared()->any_2fa_active()) {

[334] Fix | Delete

$this->validate_email_verification_token(null, $verification);

[335] Fix | Delete

[336] Fix | Delete

Model_Script::create('wordfence-ls-login', Model_Asset::js('login.js'), array('jquery'), WORDFENCE_LS_VERSION)

[337] Fix | Delete

->withTranslations(array(

[338] Fix | Delete

'Message to Support' => __('Message to Support', 'wordfence'),

[339] Fix | Delete

'Send' => __('Send', 'wordfence'),

[340] Fix | Delete

'An error was encountered while trying to send the message. Please try again.' => __('An error was encountered while trying to send the message. Please try again.', 'wordfence'),

[341] Fix | Delete

'<strong>ERROR</strong>: An error was encountered while trying to send the message. Please try again.' => wp_kses(__('<strong>ERROR</strong>: An error was encountered while trying to send the message. Please try again.', 'wordfence'), array('strong' => array())),

[342] Fix | Delete

'Login failed with status code 403. Please contact the site administrator.' => __('Login failed with status code 403. Please contact the site administrator.', 'wordfence'),

[343] Fix | Delete

'<strong>ERROR</strong>: Login failed with status code 403. Please contact the site administrator.' => wp_kses(__('<strong>ERROR</strong>: Login failed with status code 403. Please contact the site administrator.', 'wordfence'), array('strong' => array())),

[344] Fix | Delete

'Login failed with status code 503. Please contact the site administrator.' => __('Login failed with status code 503. Please contact the site administrator.', 'wordfence'),

[345] Fix | Delete

'<strong>ERROR</strong>: Login failed with status code 503. Please contact the site administrator.' => wp_kses(__('<strong>ERROR</strong>: Login failed with status code 503. Please contact the site administrator.', 'wordfence'), array('strong' => array())),

[346] Fix | Delete

'Wordfence 2FA Code' => __('Wordfence 2FA Code', 'wordfence'),

[347] Fix | Delete

'Remember for 30 days' => __('Remember for 30 days', 'wordfence'),

[348] Fix | Delete

'Log In' => __('Log In', 'wordfence'),

[349] Fix | Delete

'<strong>ERROR</strong>: An error was encountered while trying to authenticate. Please try again.' => wp_kses(__('<strong>ERROR</strong>: An error was encountered while trying to authenticate. Please try again.', 'wordfence'), array('strong' => array())),

[350] Fix | Delete

'The Wordfence 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes.' => __('The Wordfence 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes.', 'wordfence')

[351] Fix | Delete

))

[352] Fix | Delete

->setTranslationObjectName('WFLS_LOGIN_TRANSLATIONS')

[353] Fix | Delete

->enqueue();

[354] Fix | Delete

wp_enqueue_style('wordfence-ls-login', Model_Asset::css('login.css'), array(), WORDFENCE_LS_VERSION);

[355] Fix | Delete

wp_localize_script('wordfence-ls-login', 'WFLSVars', array(

[356] Fix | Delete

'ajaxurl' => Utility_URL::relative_admin_url('admin-ajax.php'),

[357] Fix | Delete

'nonce' => wp_create_nonce('wp-ajax'),

[358] Fix | Delete

'recaptchasitekey' => Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SITE_KEY),

[359] Fix | Delete

'useCAPTCHA' => $useCAPTCHA,

[360] Fix | Delete

'allowremember' => Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_REMEMBER_DEVICE_ENABLED),

[361] Fix | Delete

'verification' => $verification,

[362] Fix | Delete

));

[363] Fix | Delete

}

[364] Fix | Delete

}

[365] Fix | Delete

[366] Fix | Delete

private function get_2fa_management_script_data() {

[367] Fix | Delete

return array(

[368] Fix | Delete

'WFLSVars' => array(

[369] Fix | Delete

'ajaxurl' => Utility_URL::relative_admin_url('admin-ajax.php'),

[370] Fix | Delete

'nonce' => wp_create_nonce('wp-ajax'),

[371] Fix | Delete

'modalTemplate' => Model_View::create('common/modal-prompt', array('title' => '${title}', 'message' => '${message}', 'primaryButton' => array('id' => 'wfls-generic-modal-close', 'label' => __('Close', 'wordfence'), 'link' => '#')))->render(),

[372] Fix | Delete

'modalNoButtonsTemplate' => Model_View::create('common/modal-prompt', array('title' => '${title}', 'message' => '${message}'))->render(),

[373] Fix | Delete

'tokenInvalidTemplate' => Model_View::create('common/modal-prompt', array('title' => '${title}', 'message' => '${message}', 'primaryButton' => array('id' => 'wfls-token-invalid-modal-reload', 'label' => __('Reload', 'wordfence'), 'link' => '#')))->render(),

[374] Fix | Delete

'modalHTMLTemplate' => Model_View::create('common/modal-prompt', array('title' => '${title}', 'message' => '{{html message}}', 'primaryButton' => array('id' => 'wfls-generic-modal-close', 'label' => __('Close', 'wordfence'), 'link' => '#')))->render()

[375] Fix | Delete

)

[376] Fix | Delete

);

[377] Fix | Delete

}

[378] Fix | Delete

[379] Fix | Delete

public function should_use_core_font_awesome_styles() {

[380] Fix | Delete

if ($this->use_core_font_awesome_styles === null) {

[381] Fix | Delete

$this->use_core_font_awesome_styles = wp_style_is('wordfence-font-awesome-style');

[382] Fix | Delete

}

[383] Fix | Delete

return $this->use_core_font_awesome_styles;

[384] Fix | Delete

}

[385] Fix | Delete

[386] Fix | Delete

private function get_2fa_management_assets($embedded = false) {

[387] Fix | Delete

$assets = array(

[388] Fix | Delete

Model_Script::create('wordfence-ls-jquery.qrcode', Model_Asset::js('jquery.qrcode.min.js'), array('jquery'), WORDFENCE_LS_VERSION),

[389] Fix | Delete

Model_Script::create('wordfence-ls-jquery.tmpl', Model_Asset::js('jquery.tmpl.min.js'), array('jquery'), WORDFENCE_LS_VERSION),

[390] Fix | Delete

Model_Script::create('wordfence-ls-jquery.colorbox', Model_Asset::js('jquery.colorbox.min.js'), array('jquery'), WORDFENCE_LS_VERSION)

[391] Fix | Delete

);

[392] Fix | Delete

if (Controller_Permissions::shared()->can_manage_settings()) {

[393] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-jquery-ui-css', Model_Asset::css('jquery-ui.min.css'), array(), WORDFENCE_LS_VERSION);

[394] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-jquery-ui-css.structure', Model_Asset::css('jquery-ui.structure.min.css'), array(), WORDFENCE_LS_VERSION);

[395] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-jquery-ui-css.theme', Model_Asset::css('jquery-ui.theme.min.css'), array(), WORDFENCE_LS_VERSION);

[396] Fix | Delete

}

[397] Fix | Delete

$assets[] = Model_Script::create('wordfence-ls-admin', Model_Asset::js('admin.js'), array('jquery'), WORDFENCE_LS_VERSION)

[398] Fix | Delete

->withTranslation('You have unsaved changes to your options. If you leave this page, those changes will be lost.', __('You have unsaved changes to your options. If you leave this page, those changes will be lost.', 'wordfence'))

[399] Fix | Delete

->setTranslationObjectName('WFLS_ADMIN_TRANSLATIONS');

[400] Fix | Delete

$registered = array(

[401] Fix | Delete

Model_Script::create('chart-js', Model_Asset::js('chart.umd.js'), array('jquery'), '4.2.1')->setRegistered(),

[402] Fix | Delete

Model_Script::create('wordfence-select2-js', Model_Asset::js('wfselect2.min.js'), array('jquery'), WORDFENCE_LS_VERSION)->setRegistered(),

[403] Fix | Delete

Model_Style::create('wordfence-select2-css', Model_Asset::css('wfselect2.min.css'), array(), WORDFENCE_LS_VERSION)->setRegistered()

[404] Fix | Delete

);

[405] Fix | Delete

if (!WORDFENCE_LS_FROM_CORE && !$this->management_assets_registered) {

[406] Fix | Delete

foreach ($registered as $asset)

[407] Fix | Delete

$asset->register();

[408] Fix | Delete

$this->management_assets_registered = true;

[409] Fix | Delete

}

[410] Fix | Delete

$assets = array_merge($assets, $registered);

[411] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-admin', Model_Asset::css('admin.css'), array(), WORDFENCE_LS_VERSION);

[412] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-colorbox', Model_Asset::css('colorbox.css'), array(), WORDFENCE_LS_VERSION);

[413] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-ionicons', Model_Asset::css('ionicons.css'), array(), WORDFENCE_LS_VERSION);

[414] Fix | Delete

if ($embedded) {

[415] Fix | Delete

$assets[] = Model_Style::create('dashicons');

[416] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-embedded', Model_Asset::css('embedded.css'), array(), WORDFENCE_LS_VERSION);

[417] Fix | Delete

}

[418] Fix | Delete

if (!$this->should_use_core_font_awesome_styles()) {

[419] Fix | Delete

$assets[] = Model_Style::create('wordfence-ls-font-awesome', Model_Asset::css('font-awesome.css'), array(), WORDFENCE_LS_VERSION);

[420] Fix | Delete

}

[421] Fix | Delete

return $assets;

[422] Fix | Delete

}

[423] Fix | Delete

[424] Fix | Delete

private function enqueue_2fa_management_assets($embedded = false) {

[425] Fix | Delete

if ($this->management_assets_enqueued)

[426] Fix | Delete

return;

[427] Fix | Delete

foreach ($this->get_2fa_management_assets($embedded) as $asset)

[428] Fix | Delete

$asset->enqueue();

[429] Fix | Delete

foreach ($this->get_2fa_management_script_data() as $key => $data)

[430] Fix | Delete

wp_localize_script('wordfence-ls-admin', $key, $data);

[431] Fix | Delete

$this->management_assets_enqueued = true;

[432] Fix | Delete

}

[433] Fix | Delete

[434] Fix | Delete

/**

[435] Fix | Delete

* Admin Pages

[436] Fix | Delete

[437] Fix | Delete

public function _admin_enqueue_scripts($hookSuffix) {

[438] Fix | Delete

if (isset($_GET['page']) && $_GET['page'] == 'WFLS') {

[439] Fix | Delete

$this->enqueue_2fa_management_assets();

[440] Fix | Delete

}

[441] Fix | Delete

else {

[442] Fix | Delete

wp_enqueue_style('wordfence-ls-admin-global', Model_Asset::css('admin-global.css'), array(), WORDFENCE_LS_VERSION);

[443] Fix | Delete

}

[444] Fix | Delete

[445] Fix | Delete

if (Controller_Notices::shared()->has_notice(wp_get_current_user()) || in_array($hookSuffix, array('user-edit.php', 'user-new.php', 'profile.php'))) {

[446] Fix | Delete

wp_enqueue_script('wordfence-ls-admin-global', Model_Asset::js('admin-global.js'), array('jquery'), WORDFENCE_LS_VERSION);

[447] Fix | Delete

[448] Fix | Delete

wp_localize_script('wordfence-ls-admin-global', 'GWFLSVars', array(

[449] Fix | Delete

'ajaxurl' => admin_url('admin-ajax.php'),

[450] Fix | Delete

'nonce' => wp_create_nonce('wp-ajax'),

[451] Fix | Delete

));

[452] Fix | Delete

}

[453] Fix | Delete

[454] Fix | Delete

}

[455] Fix | Delete

[456] Fix | Delete

public function _edit_user_profile($user) {

[457] Fix | Delete

if ($user->ID == get_current_user_id() || !current_user_can(Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {

[458] Fix | Delete

$manageURL = admin_url('admin.php?page=WFLS');

[459] Fix | Delete

}

[460] Fix | Delete

else {

[461] Fix | Delete

$manageURL = admin_url('admin.php?page=WFLS&user=' . ((int) $user->ID));

[462] Fix | Delete

}

[463] Fix | Delete

[464] Fix | Delete

if (is_multisite() && is_super_admin()) {

[465] Fix | Delete

if ($user->ID == get_current_user_id()) {

[466] Fix | Delete

$manageURL = network_admin_url('admin.php?page=WFLS');

[467] Fix | Delete

}

[468] Fix | Delete

else {

[469] Fix | Delete

$manageURL = network_admin_url('admin.php?page=WFLS&user=' . ((int) $user->ID));

[470] Fix | Delete

}

[471] Fix | Delete

}

[472] Fix | Delete

$userAllowed2fa = Controller_Users::shared()->can_activate_2fa($user);

[473] Fix | Delete

$viewerIsUser = $user->ID == get_current_user_id();

[474] Fix | Delete

$viewerCanManage2fa = current_user_can(Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS);

[475] Fix | Delete

$requires2fa = Controller_Users::shared()->requires_2fa($user, $inGracePeriod, $requiredAt);

[476] Fix | Delete

$has2fa = Controller_Users::shared()->has_2fa_active($user);

[477] Fix | Delete

$lockedOut = $requires2fa && !$has2fa;

[478] Fix | Delete

$hasGracePeriod = Controller_Settings::shared()->get_user_2fa_grace_period() > 0;

[479] Fix | Delete

if ($userAllowed2fa && ($viewerIsUser || $viewerCanManage2fa)):

[480] Fix | Delete

[481] Fix | Delete

[482] Fix | Delete

[483] Fix | Delete

[484] Fix | Delete

[485] Fix | Delete

<td>

[486] Fix | Delete

<?php if ($userAllowed2fa): ?>

[487] Fix | Delete

<p>

[488] Fix | Delete

[489] Fix | Delete

<?php echo $lockedOut ?

[490] Fix | Delete

($viewerIsUser ? esc_html__('Two-factor authentication is required for your account, but has not been configured.', 'wordfence') : esc_html__('Two-factor authentication is required for this account, but has not been configured.', 'wordfence'))

[491] Fix | Delete

: ($has2fa ? esc_html__('Wordfence 2FA is active.', 'wordfence') : esc_html__('Wordfence 2FA is inactive.', 'wordfence')); ?>

[492] Fix | Delete

<a href="<?php echo Controller_Support::esc_supportURL(Controller_Support::ITEM_MODULE_LOGIN_SECURITY_2FA); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('Learn More', 'wordfence'); ?></a>

[493] Fix | Delete

</p>

[494] Fix | Delete

<?php if (!$has2fa && $inGracePeriod): ?>

[495] Fix | Delete

<p><strong><?php echo sprintf($viewerIsUser ?

[496] Fix | Delete

esc_html__('Two-factor authentication must be activated for your account prior to %s to avoid losing access.', 'wordfence')

[497] Fix | Delete

: esc_html__('Two-factor authentication must be activated for this account prior to %s.', 'wordfence')

[498] Fix | Delete

, Controller_Time::format_local_time('F j, Y g:i A', $requiredAt)) ?></strong></p>

[499] Fix | Delete

12 3