<?php endif ?>

[500] Fix | Delete

<?php if ($has2fa || $viewerIsUser): ?><p><a href="<?php echo esc_url($manageURL); ?>" class="button"><?php echo (Controller_Users::shared()->has_2fa_active($user) ? esc_html__('Manage 2FA', 'wordfence') : esc_html__('Activate 2FA', 'wordfence')); ?></a></p><?php endif ?>

[501] Fix | Delete

<?php endif ?>

[502] Fix | Delete

<?php if ($viewerCanManage2fa): ?>

[503] Fix | Delete

<?php if (!$userAllowed2fa): ?>

[504] Fix | Delete

<p><strong><?php esc_html_e('Disabled', 'wordfence'); ?>:</strong> <?php esc_html_e('Two-factor authentication is not currently enabled for this account type. To enable it, visit the Wordfence 2FA Settings page.', 'wordfence'); ?> <a href="#"><?php esc_html_e('Learn More', 'wordfence'); ?></a></p>

[505] Fix | Delete

<?php endif ?>

[506] Fix | Delete

<?php if ($lockedOut): ?>

[507] Fix | Delete

<?php echo Model_View::create(

[508] Fix | Delete

'common/reset-grace-period',

[509] Fix | Delete

array(

[510] Fix | Delete

'user' => $user,

[511] Fix | Delete

'gracePeriod' => $inGracePeriod

[512] Fix | Delete

))->render() ?>

[513] Fix | Delete

<?php elseif ($inGracePeriod && Controller_Users::shared()->has_revokable_grace_period($user)): ?>

[514] Fix | Delete

<?php echo Model_View::create(

[515] Fix | Delete

'common/revoke-grace-period',

[516] Fix | Delete

array(

[517] Fix | Delete

'user' => $user

[518] Fix | Delete

))->render() ?>

[519] Fix | Delete

<?php endif ?>

[520] Fix | Delete

<p>

[521] Fix | Delete

<a href="<?php echo esc_url(is_multisite() ? network_admin_url('admin.php?page=WFLS#top#settings') : admin_url('admin.php?page=WFLS#top#settings')); ?>" class="button"><?php esc_html_e('Manage 2FA Settings', 'wordfence'); ?></a>

[522] Fix | Delete

</p>

[523] Fix | Delete

<?php endif ?>

[524] Fix | Delete

</td>

[525] Fix | Delete

</tr>

[526] Fix | Delete

</table>

[527] Fix | Delete

<?php

[528] Fix | Delete

endif;

[529] Fix | Delete

}

[530] Fix | Delete

[531] Fix | Delete

/**

[532] Fix | Delete

* Authentication

[533] Fix | Delete

*/

[534] Fix | Delete

[535] Fix | Delete

private function _is_woocommerce_login() {

[536] Fix | Delete

if (!$this->has_woocommerce())

[537] Fix | Delete

return false;

[538] Fix | Delete

$nonceValue = '';

[539] Fix | Delete

foreach (array('woocommerce-login-nonce', '_wpnonce') as $key) {

[540] Fix | Delete

if (array_key_exists($key, $_REQUEST)) {

[541] Fix | Delete

$nonceValue = $_REQUEST[$key];

[542] Fix | Delete

break;

[543] Fix | Delete

}

[544] Fix | Delete

}

[545] Fix | Delete

[546] Fix | Delete

return ( isset( $_POST['login'], $_POST['username'], $_POST['password'] ) && is_string($nonceValue) && wp_verify_nonce( $nonceValue, 'woocommerce-login' ) );

[547] Fix | Delete

}

[548] Fix | Delete

[549] Fix | Delete

public function _authenticate($user, $username, $password) {

[550] Fix | Delete

if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST && !Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_XMLRPC_ENABLED)) { //XML-RPC call and we're not enforcing 2FA on it

[551] Fix | Delete

return $user;

[552] Fix | Delete

}

[553] Fix | Delete

[554] Fix | Delete

if (Controller_Whitelist::shared()->is_whitelisted(Model_Request::current()->ip())) { //Whitelisted, so we're not enforcing 2FA

[555] Fix | Delete

return $user;

[556] Fix | Delete

}

[557] Fix | Delete

[558] Fix | Delete

$isLogin = !(defined('WORDFENCE_LS_AUTHENTICATION_CHECK') && WORDFENCE_LS_AUTHENTICATION_CHECK); //Checking for the purpose of prompting for 2FA, don't enforce it here

[559] Fix | Delete

$isCombinedCheck = (defined('WORDFENCE_LS_CHECKING_COMBINED') && WORDFENCE_LS_CHECKING_COMBINED);

[560] Fix | Delete

$combinedTwoFactor = false;

[561] Fix | Delete

[562] Fix | Delete

/*

[563] Fix | Delete

* If we don't have a valid $user at this point, it means the $username/$password combo is invalid. We'll check

[564] Fix | Delete

* to see if the user has provided a combined password in the format `<password><code>`, populating $user from

[565] Fix | Delete

* that if so.

[566] Fix | Delete

*/

[567] Fix | Delete

if (!defined('WORDFENCE_LS_CHECKING_COMBINED') && (!isset($_POST['wfls-token']) || !is_string($_POST['wfls-token'])) && (!is_object($user) || !($user instanceof \WP_User))) {

[568] Fix | Delete

//Compatibility with WF legacy 2FA

[569] Fix | Delete

$combinedTOTPRegex = '/((?:[0-9]{3}\s*){2})$/i';

[570] Fix | Delete

$combinedRecoveryRegex = '/((?:[a-f0-9]{4}\s*){4})$/i';

[571] Fix | Delete

if ($this->legacy_2fa_active()) {

[572] Fix | Delete

$combinedTOTPRegex = '/(?<! wf)((?:[0-9]{3}\s*){2})$/i';

[573] Fix | Delete

$combinedRecoveryRegex = '/(?<! wf)((?:[a-f0-9]{4}\s*){4})$/i';

[574] Fix | Delete

}

[575] Fix | Delete

[576] Fix | Delete

if (preg_match($combinedTOTPRegex, $password, $matches)) { //Possible TOTP code

[577] Fix | Delete

if (strlen($password) > strlen($matches[1])) {

[578] Fix | Delete

$revisedPassword = substr($password, 0, strlen($password) - strlen($matches[1]));

[579] Fix | Delete

$code = $matches[1];

[580] Fix | Delete

}

[581] Fix | Delete

}

[582] Fix | Delete

else if (preg_match($combinedRecoveryRegex, $password, $matches)) { //Possible recovery code

[583] Fix | Delete

if (strlen($password) > strlen($matches[1])) {

[584] Fix | Delete

$revisedPassword = substr($password, 0, strlen($password) - strlen($matches[1]));

[585] Fix | Delete

$code = $matches[1];

[586] Fix | Delete

}

[587] Fix | Delete

}

[588] Fix | Delete

[589] Fix | Delete

if (isset($revisedPassword)) {

[590] Fix | Delete

define('WORDFENCE_LS_CHECKING_COMBINED', true); //Avoid recursing into this block

[591] Fix | Delete

if (!defined('WORDFENCE_LS_AUTHENTICATION_CHECK')) { define('WORDFENCE_LS_AUTHENTICATION_CHECK', true); }

[592] Fix | Delete

$revisedUser = wp_authenticate($username, $revisedPassword);

[593] Fix | Delete

if (is_object($revisedUser) && ($revisedUser instanceof \WP_User) && Controller_TOTP::shared()->validate_2fa($revisedUser, $code, $isLogin)) {

[594] Fix | Delete

define('WORDFENCE_LS_COMBINED_IS_VALID', true); //This will cause the front-end to skip the 2FA prompt

[595] Fix | Delete

$user = $revisedUser;

[596] Fix | Delete

$combinedTwoFactor = true;

[597] Fix | Delete

}

[598] Fix | Delete

}

[599] Fix | Delete

}

[600] Fix | Delete

[601] Fix | Delete

/*

[602] Fix | Delete

* CAPTCHA Check

[603] Fix | Delete

*

[604] Fix | Delete

* It will be enforced so long as:

[605] Fix | Delete

*

[606] Fix | Delete

* 1. It's enabled and keys are set.

[607] Fix | Delete

* 2. This is not an XML-RPC request. An XML-RPC request is de facto an automated request, so a CAPTCHA makes

[608] Fix | Delete

* no sense.

[609] Fix | Delete

* 3. A filter does not override it. This is to allow plugins with REST endpoints that handle authentication

[610] Fix | Delete

* themselves to opt out of the requirement.

[611] Fix | Delete

* 4. The user is not providing a combined credentials + 2FA authentication login request.

[612] Fix | Delete

* 5. The request is not a WooCommerce login while WC integration is disabled

[613] Fix | Delete

*/

[614] Fix | Delete

if (!$combinedTwoFactor && !$isCombinedCheck && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load

[615] Fix | Delete

[616] Fix | Delete

$requireCAPTCHA = Controller_CAPTCHA::shared()->is_captcha_required();

[617] Fix | Delete

$performVerification = false;

[618] Fix | Delete

[619] Fix | Delete

$token = Controller_CAPTCHA::shared()->get_token();

[620] Fix | Delete

if ($requireCAPTCHA && empty($token) && !Controller_CAPTCHA::shared()->test_mode()) { //No CAPTCHA token means forced additional verification (if neither 2FA nor test mode are active)

[621] Fix | Delete

$performVerification = true;

[622] Fix | Delete

}

[623] Fix | Delete

[624] Fix | Delete

if (is_object($user) && $user instanceof \WP_User && $this->validate_email_verification_token($user)) { //Skip the CAPTCHA check if the email address was verified

[625] Fix | Delete

$requireCAPTCHA = false;

[626] Fix | Delete

$performVerification = false;

[627] Fix | Delete

[628] Fix | Delete

//Reset token rate limit

[629] Fix | Delete

$identifier = sprintf('wfls-captcha-%d', $user->ID);

[630] Fix | Delete

$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period

[631] Fix | Delete

$tokenBucket->reset();

[632] Fix | Delete

}

[633] Fix | Delete

[634] Fix | Delete

$score = false;

[635] Fix | Delete

if ($requireCAPTCHA && !$performVerification) {

[636] Fix | Delete

$expired = false;

[637] Fix | Delete

if (is_object($user) && $user instanceof \WP_User) {

[638] Fix | Delete

$score = Controller_Users::shared()->cached_captcha_score($token, $user, $expired);

[639] Fix | Delete

}

[640] Fix | Delete

[641] Fix | Delete

if ($score === false) {

[642] Fix | Delete

if ($expired) {

[643] Fix | Delete

return new \WP_Error('wfls_captcha_expired', wp_kses(__('<strong>CAPTCHA EXPIRED</strong>: The CAPTCHA verification for this login attempt has expired. Please try again.', 'wordfence'), array('strong'=>array())));

[644] Fix | Delete

}

[645] Fix | Delete

[646] Fix | Delete

$score = Controller_CAPTCHA::shared()->score($token);

[647] Fix | Delete

[648] Fix | Delete

if ($score !== false && is_object($user) && $user instanceof \WP_User) {

[649] Fix | Delete

Controller_Users::shared()->cache_captcha_score($token, $score, $user);

[650] Fix | Delete

Controller_Users::shared()->record_captcha_score($user, $score);

[651] Fix | Delete

}

[652] Fix | Delete

}

[653] Fix | Delete

[654] Fix | Delete

if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if test mode is not active)

[655] Fix | Delete

$performVerification = true;

[656] Fix | Delete

}

[657] Fix | Delete

}

[658] Fix | Delete

[659] Fix | Delete

if ($requireCAPTCHA) {

[660] Fix | Delete

if ($performVerification || !Controller_CAPTCHA::shared()->is_human($score)) {

[661] Fix | Delete

if (is_object($user) && $user instanceof \WP_User) {

[662] Fix | Delete

$identifier = sprintf('wfls-captcha-%d', $user->ID);

[663] Fix | Delete

$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period

[664] Fix | Delete

if ($tokenBucket->consume(1)) {

[665] Fix | Delete

if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {

[666] Fix | Delete

$loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));

[667] Fix | Delete

}

[668] Fix | Delete

else {

[669] Fix | Delete

$loginUrl = wp_login_url();

[670] Fix | Delete

}

[671] Fix | Delete

$verificationUrl = add_query_arg(

[672] Fix | Delete

array(

[673] Fix | Delete

'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))

[674] Fix | Delete

),

[675] Fix | Delete

$loginUrl

[676] Fix | Delete

);

[677] Fix | Delete

$view = new Model_View('email/login-verification', array(

[678] Fix | Delete

'siteName' => get_bloginfo('name', 'raw'),

[679] Fix | Delete

'verificationURL' => $verificationUrl,

[680] Fix | Delete

'ip' => Model_Request::current()->ip(),

[681] Fix | Delete

'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),

[682] Fix | Delete

));

[683] Fix | Delete

wp_mail($user->user_email, __('Login Verification Required', 'wordfence'), $view->render(), "Content-Type: text/html");

[684] Fix | Delete

}

[685] Fix | Delete

}

[686] Fix | Delete

[687] Fix | Delete

Utility_Sleep::sleep(Model_Crypto::random_int(0, 2000) / 1000);

[688] Fix | Delete

return new \WP_Error('wfls_captcha_verify', wp_kses(__('<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in.', 'wordfence'), array('strong' => array())));

[689] Fix | Delete

}

[690] Fix | Delete

}

[691] Fix | Delete

}

[692] Fix | Delete

[693] Fix | Delete

if (!$combinedTwoFactor) {

[694] Fix | Delete

if ($isLogin && $user instanceof \WP_User) {

[695] Fix | Delete

if (Controller_Users::shared()->has_2fa_active($user)) {

[696] Fix | Delete

if (Controller_Users::shared()->has_remembered_2fa($user)) {

[697] Fix | Delete

return $user;

[698] Fix | Delete

}

[699] Fix | Delete

elseif (array_key_exists('wfls-token', $_POST)) {

[700] Fix | Delete

if (is_string($_POST['wfls-token']) && Controller_TOTP::shared()->validate_2fa($user, $_POST['wfls-token'])) {

[701] Fix | Delete

return $user;

[702] Fix | Delete

}

[703] Fix | Delete

else {

[704] Fix | Delete

return new \WP_Error('wfls_twofactor_failed', wp_kses(__('<strong>CODE INVALID</strong>: The 2FA code provided is either expired or invalid. Please try again.', 'wordfence'), array('strong'=>array())));

[705] Fix | Delete

}

[706] Fix | Delete

}

[707] Fix | Delete

}

[708] Fix | Delete

$in2faGracePeriod = false;

[709] Fix | Delete

$time2faRequired = null;

[710] Fix | Delete

if (Controller_Users::shared()->has_2fa_active($user)) {

[711] Fix | Delete

$legacy2FAActive = Controller_WordfenceLS::shared()->legacy_2fa_active();

[712] Fix | Delete

if ($legacy2FAActive) {

[713] Fix | Delete

return new \WP_Error('wfls_twofactor_required', wp_kses(__('<strong>CODE REQUIRED</strong>: Please enter your 2FA code immediately after your password in the same field.', 'wordfence'), array('strong'=>array())));

[714] Fix | Delete

}

[715] Fix | Delete

return new \WP_Error('wfls_twofactor_required', wp_kses(__('<strong>CODE REQUIRED</strong>: Please provide your 2FA code when prompted.', 'wordfence'), array('strong'=>array())));

[716] Fix | Delete

}

[717] Fix | Delete

else if (Controller_Users::shared()->requires_2fa($user, $in2faGracePeriod, $time2faRequired)) {

[718] Fix | Delete

return new \WP_Error('wfls_twofactor_blocked', wp_kses(__('<strong>LOGIN BLOCKED</strong>: 2FA is required to be active on your account. Please contact the site administrator.', 'wordfence'), array('strong'=>array())));

[719] Fix | Delete

}

[720] Fix | Delete

else if ($in2faGracePeriod) {

[721] Fix | Delete

Controller_Notices::shared()->add_notice(Model_Notice::SEVERITY_CRITICAL, new Model_HTML(wp_kses(sprintf(__('You do not currently have two-factor authentication active on your account, which will be required beginning %s. <a href="%s">Configure 2FA</a>', 'wordfence'), Controller_Time::format_local_time('F j, Y g:i A', $time2faRequired), esc_url((is_multisite() && is_super_admin($user->ID)) ? network_admin_url('admin.php?page=WFLS') : admin_url('admin.php?page=WFLS'))), array('a'=>array('href'=>array())))), 'wfls-will-be-required', $user);

[722] Fix | Delete

}

[723] Fix | Delete

}

[724] Fix | Delete

[725] Fix | Delete

}

[726] Fix | Delete

[727] Fix | Delete

return $user;

[728] Fix | Delete

}

[729] Fix | Delete

[730] Fix | Delete

public function _set_logged_in_cookie($logged_in_cookie, $expire, $expiration, $user_id) {

[731] Fix | Delete

$user = new \WP_User($user_id);

[732] Fix | Delete

if (Controller_Users::shared()->has_2fa_active($user) && isset($_POST['wfls-remember-device']) && $_POST['wfls-remember-device']) {

[733] Fix | Delete

Controller_Users::shared()->remember_2fa($user);

[734] Fix | Delete

}

[735] Fix | Delete

delete_user_meta($user_id, 'wfls-captcha-nonce');

[736] Fix | Delete

}

[737] Fix | Delete

[738] Fix | Delete

public function _record_login($user_login/*, $user -- we'd like to use the second parameter instead, but too many plugins call this hook and only provide one of the two required parameters*/) {

[739] Fix | Delete

$user = get_user_by('login', $user_login);

[740] Fix | Delete

if (is_object($user) && $user instanceof \WP_User && $user->exists()) {

[741] Fix | Delete

update_user_meta($user->ID, 'wfls-last-login', Controller_Time::time());

[742] Fix | Delete

}

[743] Fix | Delete

}

[744] Fix | Delete

[745] Fix | Delete

public function _register_post($sanitized_user_login, $user_email, $errors) {

[746] Fix | Delete

if (!empty($sanitized_user_login)) {

[747] Fix | Delete

$captchaResult = $this->process_registration_captcha_with_hooks();

[748] Fix | Delete

if ($captchaResult !== true) {

[749] Fix | Delete

$errors->add($captchaResult['category'], $captchaResult['message']);

[750] Fix | Delete

}

[751] Fix | Delete

}

[752] Fix | Delete

}

[753] Fix | Delete

[754] Fix | Delete

private function validate_email_verification_token($user = null, &$token = null) {

[755] Fix | Delete

$token = isset($_REQUEST['wfls-email-verification']) ? $_REQUEST['wfls-email-verification'] : null;

[756] Fix | Delete

if (empty($token))

[757] Fix | Delete

return null;

[758] Fix | Delete

return is_string($token) && Controller_Users::shared()->validate_verification_token($token, $user);

[759] Fix | Delete

}

[760] Fix | Delete

[761] Fix | Delete

/**

[762] Fix | Delete

* @param \WP_Error $errors

[763] Fix | Delete

* @param string $redirect_to

[764] Fix | Delete

* @return \WP_Error

[765] Fix | Delete

*/

[766] Fix | Delete

public function _wp_login_errors($errors, $redirect_to) {

[767] Fix | Delete

$has_errors = (method_exists($errors, 'has_errors') ? $errors->has_errors() : !empty($errors->errors)); //has_errors was added in WP 5.1

[768] Fix | Delete

$emailVerificationTokenValid = $this->validate_email_verification_token();

[769] Fix | Delete

if (!$has_errors && $emailVerificationTokenValid !== null) {

[770] Fix | Delete

if ($emailVerificationTokenValid) {

[771] Fix | Delete

$errors->add('wfls_email_verified', esc_html__('Email verification succeeded. Please continue logging in.', 'wordfence'), 'message');

[772] Fix | Delete

}

[773] Fix | Delete

else {

[774] Fix | Delete

$errors->add('wfls_email_not_verified', esc_html__('Email verification invalid or expired. Please try again.', 'wordfence'), 'message');

[775] Fix | Delete

}

[776] Fix | Delete

}

[777] Fix | Delete

return $errors;

[778] Fix | Delete

}

[779] Fix | Delete

[780] Fix | Delete

public function legacy_2fa_active() {

[781] Fix | Delete

$wfLegacy2FAActive = false;

[782] Fix | Delete

if (class_exists('wfConfig') && \wfConfig::get('isPaid')) {

[783] Fix | Delete

$twoFactorUsers = \wfConfig::get_ser('twoFactorUsers', array());

[784] Fix | Delete

if (is_array($twoFactorUsers) && count($twoFactorUsers) > 0) {

[785] Fix | Delete

foreach ($twoFactorUsers as $t) {

[786] Fix | Delete

if ($t[3] == 'activated') {

[787] Fix | Delete

$testUser = get_user_by('ID', $t[0]);

[788] Fix | Delete

if (is_object($testUser) && $testUser instanceof \WP_User && \wfUtils::isAdmin($testUser)) {

[789] Fix | Delete

$wfLegacy2FAActive = true;

[790] Fix | Delete

break;

[791] Fix | Delete

}

[792] Fix | Delete

}

[793] Fix | Delete

}

[794] Fix | Delete

}

[795] Fix | Delete

[796] Fix | Delete

if ($wfLegacy2FAActive && class_exists('wfCredentialsController') && method_exists('wfCredentialsController', 'useLegacy2FA') && !\wfCredentialsController::useLegacy2FA()) {

[797] Fix | Delete

$wfLegacy2FAActive = false;

[798] Fix | Delete

}

[799] Fix | Delete

}

[800] Fix | Delete

return $wfLegacy2FAActive;

[801] Fix | Delete

}

[802] Fix | Delete

[803] Fix | Delete

/**

[804] Fix | Delete

* Menu

[805] Fix | Delete

*/

[806] Fix | Delete

[807] Fix | Delete

public function _admin_menu() {

[808] Fix | Delete

$user = wp_get_current_user();

[809] Fix | Delete

if (Controller_Notices::shared()->has_notice($user)) {

[810] Fix | Delete

Controller_Users::shared()->requires_2fa($user, $gracePeriod);

[811] Fix | Delete

if (!$gracePeriod) {

[812] Fix | Delete

Controller_Notices::shared()->remove_notice(false, 'wfls-will-be-required', $user);

[813] Fix | Delete

}

[814] Fix | Delete

}

[815] Fix | Delete

[816] Fix | Delete

Controller_Notices::shared()->enqueue_notices();

[817] Fix | Delete

[818] Fix | Delete

$useSubmenu = WORDFENCE_LS_FROM_CORE && current_user_can('activate_plugins');

[819] Fix | Delete

if (is_multisite() && !is_network_admin()) {

[820] Fix | Delete

$useSubmenu = false;

[821] Fix | Delete

[822] Fix | Delete

if (is_super_admin()) {

[823] Fix | Delete

return;

[824] Fix | Delete

}

[825] Fix | Delete

}

[826] Fix | Delete

[827] Fix | Delete

if ($useSubmenu) {

[828] Fix | Delete

add_submenu_page('Wordfence', __('Login Security', 'wordfence'), __('Login Security', 'wordfence'), Controller_Permissions::CAP_ACTIVATE_2FA_SELF, 'WFLS', array($this, '_menu'));

[829] Fix | Delete

}

[830] Fix | Delete

else {

[831] Fix | Delete

add_menu_page(__('Login Security', 'wordfence'), __('Login Security', 'wordfence'), Controller_Permissions::CAP_ACTIVATE_2FA_SELF, 'WFLS', array($this, '_menu'), Model_Asset::img('menu.svg'));

[832] Fix | Delete

}

[833] Fix | Delete

}

[834] Fix | Delete

[835] Fix | Delete

public function _menu() {

[836] Fix | Delete

$user = wp_get_current_user();

[837] Fix | Delete

$administrator = false;

[838] Fix | Delete

$canEditUsers = false;

[839] Fix | Delete

if (Controller_Permissions::shared()->can_manage_settings($user)) {

[840] Fix | Delete

$administrator = true;

[841] Fix | Delete

}

[842] Fix | Delete

[843] Fix | Delete

if (user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {

[844] Fix | Delete

$canEditUsers = true;

[845] Fix | Delete

if (isset($_GET['user'])) {

[846] Fix | Delete

$user = new \WP_User((int) $_GET['user']);

[847] Fix | Delete

if (!$user->exists()) {

[848] Fix | Delete

$user = wp_get_current_user();

[849] Fix | Delete

}

[850] Fix | Delete

}

[851] Fix | Delete

}

[852] Fix | Delete

[853] Fix | Delete

$sections = array();

[854] Fix | Delete

[855] Fix | Delete

if (isset($_GET['role']) && $canEditUsers) {

[856] Fix | Delete

$roleKey = $_GET['role'];

[857] Fix | Delete

$roles = new \WP_Roles();

[858] Fix | Delete

$role = $roles->get_role($roleKey);

[859] Fix | Delete

$roleTitle = $roleKey === 'super-admin' ? __('Super Administrator', 'wordfence') : $roles->role_names[$roleKey];

[860] Fix | Delete

$requiredAt = Controller_Settings::shared()->get_required_2fa_role_activation_time($roleKey);

[861] Fix | Delete

$states = array(

[862] Fix | Delete

'grace_period' => array(

[863] Fix | Delete

'title' => __('Grace Period', 'wordfence'),

[864] Fix | Delete

'gracePeriod' => true

[865] Fix | Delete

),

[866] Fix | Delete

'locked_out' => array(

[867] Fix | Delete

'title' => __('Locked Out', 'wordfence'),

[868] Fix | Delete

'gracePeriod' => false

[869] Fix | Delete

)

[870] Fix | Delete

);

[871] Fix | Delete

foreach ($states as $key => $state) {

[872] Fix | Delete

$pageKey = "page_$key";

[873] Fix | Delete

$page = isset($_GET[$pageKey]) ? max((int) $_GET[$pageKey], 1) : 1;

[874] Fix | Delete

$title = $state['title'];

[875] Fix | Delete

$lastPage = true;

[876] Fix | Delete

if ($requiredAt === false)

[877] Fix | Delete

$users = array();

[878] Fix | Delete

else

[879] Fix | Delete

$users = Controller_Users::shared()->get_inactive_2fa_users($roleKey, $state['gracePeriod'], $page, self::USERS_PER_PAGE, $lastPage);

[880] Fix | Delete

$sections[] = array(

[881] Fix | Delete

'tab' => new Model_Tab($key, $key, $title, $title),

[882] Fix | Delete

'title' => new Model_Title($key, sprintf(__('Users without 2FA active (%s)', 'wordfence'), $title) . ' - ' . $roleTitle),

[883] Fix | Delete

'content' => new Model_View('page/role', array(

[884] Fix | Delete

'role' => $role,

[885] Fix | Delete

'roleTitle' => $roleTitle,

[886] Fix | Delete

'stateTitle' => $title,

[887] Fix | Delete

'requiredAt' => $requiredAt,

[888] Fix | Delete

'state' => $state,

[889] Fix | Delete

'users' => $users,

[890] Fix | Delete

'page' => $page,

[891] Fix | Delete

'lastPage' => $lastPage,

[892] Fix | Delete

'pageKey' => $pageKey,

[893] Fix | Delete

'stateKey' => $key

[894] Fix | Delete

)),

[895] Fix | Delete

);

[896] Fix | Delete

}

[897] Fix | Delete

}

[898] Fix | Delete

else {

[899] Fix | Delete

$sections[] = array(

[900] Fix | Delete

'tab' => new Model_Tab('manage', 'manage', __('Two-Factor Authentication', 'wordfence'), __('Two-Factor Authentication', 'wordfence')),

[901] Fix | Delete

'title' => new Model_Title('manage', __('Two-Factor Authentication', 'wordfence'), Controller_Support::supportURL(Controller_Support::ITEM_MODULE_LOGIN_SECURITY_2FA), new Model_HTML(wp_kses(__('Learn more<span class="wfls-hidden-xs"> about Two-Factor Authentication</span>', 'wordfence'), array('span'=>array('class'=>array()))))),

[902] Fix | Delete

'content' => new Model_View('page/manage', array(

[903] Fix | Delete

'user' => $user,

[904] Fix | Delete

'canEditUsers' => $canEditUsers,

[905] Fix | Delete

)),

[906] Fix | Delete

);

[907] Fix | Delete

[908] Fix | Delete

if ($administrator) {

[909] Fix | Delete

$sections[] = array(

[910] Fix | Delete

'tab' => new Model_Tab('settings', 'settings', __('Settings', 'wordfence'), __('Settings', 'wordfence')),

[911] Fix | Delete

'title' => new Model_Title('settings', __('Login Security Settings', 'wordfence'), Controller_Support::supportURL(Controller_Support::ITEM_MODULE_LOGIN_SECURITY), new Model_HTML(wp_kses(__('Learn more<span class="wfls-hidden-xs"> about Login Security</span>', 'wordfence'), array('span'=>array('class'=>array()))))),

[912] Fix | Delete

'content' => new Model_View('page/settings', array(

[913] Fix | Delete

'hasWoocommerce' => $this->has_woocommerce()

[914] Fix | Delete

)),

[915] Fix | Delete

);

[916] Fix | Delete

}

[917] Fix | Delete

}

[918] Fix | Delete

[919] Fix | Delete

$view = new Model_View('page/page', array(

[920] Fix | Delete

'sections' => $sections,

[921] Fix | Delete

));

[922] Fix | Delete

echo $view->render();

[923] Fix | Delete

}

[924] Fix | Delete

[925] Fix | Delete

private function process_registration_captcha() {

[926] Fix | Delete

if (Controller_Whitelist::shared()->is_whitelisted(Model_Request::current()->ip())) { //Whitelisted, so we're not enforcing 2FA

[927] Fix | Delete

return true;

[928] Fix | Delete

}

[929] Fix | Delete

[930] Fix | Delete

$captchaController = Controller_CAPTCHA::shared();

[931] Fix | Delete

$requireCaptcha = $captchaController->is_captcha_required();

[932] Fix | Delete

$token = $captchaController->get_token();

[933] Fix | Delete

[934] Fix | Delete

if ($requireCaptcha) {

[935] Fix | Delete

if ($token === null && !$captchaController->test_mode()) {

[936] Fix | Delete

return array(

[937] Fix | Delete

'message' => wp_kses(__('<strong>REGISTRATION ATTEMPT BLOCKED</strong>: This site requires a security token created when the page loads for all registration attempts. Please ensure JavaScript is enabled and try again.', 'wordfence'), array('strong'=>array())),

[938] Fix | Delete

'category' => 'wfls_captcha_required'

[939] Fix | Delete

);

[940] Fix | Delete

}

[941] Fix | Delete

$score = $captchaController->score($token);

[942] Fix | Delete

if ($score === false && !$captchaController->test_mode()) {

[943] Fix | Delete

return array(

[944] Fix | Delete

'message' => wp_kses(__('<strong>REGISTRATION ATTEMPT BLOCKED</strong>: The security token for the login attempt was invalid or expired. Please reload the page and try again.', 'wordfence'), array('strong'=>array())),

[945] Fix | Delete

'category' => 'wfls_captcha_required'

[946] Fix | Delete

);

[947] Fix | Delete

}

[948] Fix | Delete

Controller_Users::shared()->record_captcha_score(null, $score);

[949] Fix | Delete

if (!$captchaController->is_human($score)) {

[950] Fix | Delete

$encryptedIP = Model_Symmetric::encrypt(Model_Request::current()->ip());

[951] Fix | Delete

$encryptedScore = Model_Symmetric::encrypt($score);

[952] Fix | Delete

$result = array(

[953] Fix | Delete

'category' => 'wfls_registration_blocked'

[954] Fix | Delete

);

[955] Fix | Delete

if ($encryptedIP && $encryptedScore && filter_var(get_site_option('admin_email'), FILTER_VALIDATE_EMAIL)) {

[956] Fix | Delete

$jwt = new Model_JWT(array('ip' => $encryptedIP, 'score' => $encryptedScore), Controller_Time::time() + 600);

[957] Fix | Delete

$result['message'] = wp_kses(sprintf(__('<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or <a href="#" class="wfls-registration-captcha-contact" data-token="%s">contact the site owner</a> for help.', 'wordfence'), esc_attr((string)$jwt)), array('strong'=>array(), 'a'=>array('href'=>array(), 'class'=>array(), 'data-token'=>array())));

[958] Fix | Delete

}

[959] Fix | Delete

else {

[960] Fix | Delete

$result['message'] = wp_kses(__('<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or contact the site owner for help.', 'wordfence'), array('strong'=>array()));

[961] Fix | Delete

}

[962] Fix | Delete

return $result;

[963] Fix | Delete

}

[964] Fix | Delete

}

[965] Fix | Delete

return true;

[966] Fix | Delete

}

[967] Fix | Delete

[968] Fix | Delete

/**

[969] Fix | Delete

* @param int $endpointType the type of endpoint being processed

[970] Fix | Delete

* The default value of 1 corresponds to a regular login

[971] Fix | Delete

* @see wordfence::wfsnEndpointType()

[972] Fix | Delete

*/

[973] Fix | Delete

private function process_registration_captcha_with_hooks($endpointType = 1) {

[974] Fix | Delete

$result = $this->process_registration_captcha();

[975] Fix | Delete

if ($result !== true) {

[976] Fix | Delete

if ($result['category'] === 'wfls_registration_blocked') {

[977] Fix | Delete

/**

[978] Fix | Delete

* Fires just prior to blocking user registration due to a failed CAPTCHA. After firing this action hook

[979] Fix | Delete

* the registration attempt is blocked.

[980] Fix | Delete

*

[981] Fix | Delete

* @param int $source The source code of the block.

[982] Fix | Delete

*/

[983] Fix | Delete

do_action('wfls_registration_blocked', $endpointType);

[984] Fix | Delete

[985] Fix | Delete

/**

[986] Fix | Delete

* Filters the message to show if registration is blocked due to a captcha rejection.

[987] Fix | Delete

*

[988] Fix | Delete

* @since 1.0.0

[989] Fix | Delete

*

[990] Fix | Delete

* @param string $message The message to display, HTML allowed.

[991] Fix | Delete

*/

[992] Fix | Delete

$result['message'] = apply_filters('wfls_registration_blocked_message', $result['message']);

[993] Fix | Delete

}

[994] Fix | Delete

}

[995] Fix | Delete

return $result;

[996] Fix | Delete

}

[997] Fix | Delete

[998] Fix | Delete

private function disable_woocommerce_registration($message) {

[999] Fix | Delete