WordPress.org
Get WordPress

Plugin Directory

Changeset 3049221


Ignore:
Timestamp:
03/11/2024 03:26:35 PM (21 months ago)
Author:
wfryan
Message:

1.1.10 - March 11, 2024

  • Change: Removed the extra site link from the CAPTCHA verification email message to avoid confusion with the verify link
  • Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)
Location:
wordfence-login-security
Files:
44 added
42 deleted
20 edited
1 copied

Legend:

Unmodified
Added
Removed

  • wordfence-login-security/tags/1.1.10/classes/controller/captcha.php

    r2560586 r3049221  
    5757     */
    5858    public function threshold() {
    59         return Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5);
     59        return max(0.1, Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5));
    6060    }
    6161

  • wordfence-login-security/tags/1.1.10/classes/controller/settings.php

    r2937680 r3049221  
    218218                return is_numeric($value) && $value > 0;
    219219            case self::OPTION_RECAPTCHA_THRESHOLD:
    220                 return is_numeric($value) && $value >= 0 && $value <= 1;
     220                return is_numeric($value) && $value > 0 && $value <= 1;
    221221            case self::OPTION_RECAPTCHA_SITE_KEY:
    222222                if (empty($value)) {

  • wordfence-login-security/tags/1.1.10/classes/controller/users.php

    r2982696 r3049221  
    318318    public function record_captcha_score($user, $score) {
    319319        if (!Controller_CAPTCHA::shared()->enabled()) { return; }
    320         if ($this->has_2fa_active($user)) { return; } //2FA activated users do not retrieve a score
    321320       
    322321        if ($user) { update_user_meta($user->ID, 'wfls-last-captcha-score', $score); }

  • wordfence-login-security/tags/1.1.10/classes/controller/wordfencels.php

    r3016540 r3049221  
    559559
    560560        $isLogin = !(defined('WORDFENCE_LS_AUTHENTICATION_CHECK') && WORDFENCE_LS_AUTHENTICATION_CHECK); //Checking for the purpose of prompting for 2FA, don't enforce it here
     561        $isCombinedCheck = (defined('WORDFENCE_LS_CHECKING_COMBINED') && WORDFENCE_LS_CHECKING_COMBINED);
    561562        $combinedTwoFactor = false;
    562563
    … …  
    610611         * 3. A filter does not override it. This is to allow plugins with REST endpoints that handle authentication
    611612         *    themselves to opt out of the requirement.
    612          * 4. The user does not have 2FA enabled. 2FA exempts the user from requiring email verification if the score is
    613          *    below the threshold.
     613         * 4. The user is not providing a combined credentials + 2FA authentication login request.
    614614         * 5. The request is not a WooCommerce login while WC integration is disabled
    615615         */
    616         if ($isLogin && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load
     616        if (!$combinedTwoFactor && !$isCombinedCheck && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load
    617617
    618618            $requireCAPTCHA = Controller_CAPTCHA::shared()->is_captcha_required();
     619            $performVerification = false;
    619620           
    620             $performVerification = false;
    621621            $token = Controller_CAPTCHA::shared()->get_token();
    622622            if ($requireCAPTCHA && empty($token) && !Controller_CAPTCHA::shared()->test_mode()) { //No CAPTCHA token means forced additional verification (if neither 2FA nor test mode are active)
    … …  
    624624            }
    625625           
     626            if (is_object($user) && $user instanceof \WP_User && $this->validate_email_verification_token($user)) { //Skip the CAPTCHA check if the email address was verified
     627                $requireCAPTCHA = false;
     628                $performVerification = false;
     629               
     630                //Reset token rate limit
     631                $identifier = sprintf('wfls-captcha-%d', $user->ID);
     632                $tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
     633                $tokenBucket->reset();
     634            }
     635           
     636            $score = false;
    626637            if ($requireCAPTCHA && !$performVerification) {
    627638                $score = Controller_CAPTCHA::shared()->score($token);
    628                 if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if neither 2FA nor test mode are active)
     639                if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if test mode is not active)
    629640                    $performVerification = true;
    630641                }
    631             }
    632 
    633             if (!isset($score)) { $score = false; }
     642                else if (is_object($user) && $user instanceof \WP_User) {
     643                    Controller_Users::shared()->record_captcha_score($user, $score);
     644                }
     645            }
    634646           
    635             if (is_object($user) && $user instanceof \WP_User) {
    636                 if (Controller_Users::shared()->has_2fa_active($user)) { //CAPTCHA enforcement skipped for users with 2FA active
    637                     $requireCAPTCHA = false;
    638                     $performVerification = false;
    639                 }
    640                
    641                 Controller_Users::shared()->record_captcha_score($user, $score);
    642 
    643                 //Skip the CAPTCHA check if the email address was verified
    644                 if ($this->validate_email_verification_token($user)) {
    645                     $requireCAPTCHA = false;
    646                     $performVerification = false;
    647                 }
    648                
    649                 if ($requireCAPTCHA && ($performVerification || !Controller_CAPTCHA::shared()->is_human($score))) {
    650                     if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {
    651                         $loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));
     647            if ($requireCAPTCHA) {
     648                if ($performVerification || !Controller_CAPTCHA::shared()->is_human($score)) {
     649                    if (is_object($user) && $user instanceof \WP_User) {
     650                        $identifier = sprintf('wfls-captcha-%d', $user->ID);
     651                        $tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
     652                        if ($tokenBucket->consume(1)) {
     653                            if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {
     654                                $loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));
     655                            }
     656                            else {
     657                                $loginUrl = wp_login_url();
     658                            }
     659                            $verificationUrl = add_query_arg(
     660                                array(
     661                                    'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))
     662                                ),
     663                                $loginUrl
     664                            );
     665                            $view = new Model_View('email/login-verification', array(
     666                                'siteName' => get_bloginfo('name', 'raw'),
     667                                'verificationURL' => $verificationUrl,
     668                                'ip' => Model_Request::current()->ip(),
     669                                'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),
     670                            ));
     671                            wp_mail($user->user_email, __('Login Verification Required', 'wordfence-login-security'), $view->render(), "Content-Type: text/html");
     672                        }
    652673                    }
    653                     else {
    654                         $loginUrl = wp_login_url();
    655                     }
    656                     $verificationUrl = add_query_arg(
    657                         array(
    658                             'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))
    659                         ),
    660                         $loginUrl
    661                     );
    662                     $view = new Model_View('email/login-verification', array(
    663                         'siteName' => get_bloginfo('name', 'raw'),
    664                         'siteURL' => rtrim(site_url(), '/') . '/',
    665                         'verificationURL' => $verificationUrl,
    666                         'ip' => Model_Request::current()->ip(),
    667                         'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),
    668                     ));
    669                     wp_mail($user->user_email, __('Login Verification Required', 'wordfence-login-security'), $view->render(), "Content-Type: text/html");
    670 
    671                     return new \WP_Error('wfls_captcha_verify', wp_kses(__('<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. Please check the email address associated with the account for a verification link.', 'wordfence-login-security'), array('strong'=>array())));
    672                 }
    673 
     674
     675                    Utility_Sleep::sleep(Model_Crypto::random_int(0, 2000) / 1000);
     676                    return new \WP_Error('wfls_captcha_verify', wp_kses(__('<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in.', 'wordfence-login-security'), array('strong' => array())));
     677                }
    674678            }
    675679        }
    676680
    677681        if (!$combinedTwoFactor) {
    678 
    679682            if ($isLogin && $user instanceof \WP_User) {
    680683                if (Controller_Users::shared()->has_2fa_active($user)) {

  • wordfence-login-security/tags/1.1.10/classes/model/tokenbucket.php

    r2098090 r3049221  
    140140        }
    141141        else {
     142            $this->_unlock();
    142143            return false;
    143144        }
    … …  
    171172    }
    172173   
     174    public function reset() {
     175        if (!$this->_lock()) { return false; }
     176       
     177        if ($this->_backing == self::BACKING_WP_OPTIONS) {
     178            delete_transient('wflsbucket:' . $this->_identifier);
     179        }
     180        else if ($this->_backing == self::BACKING_REDIS) {
     181            $this->_redis->del('bucket:' . $this->_identifier);
     182        }
     183       
     184        $this->_unlock();
     185    }
     186   
    173187    /**
    174188     * Creates an initial record with the given number of tokens.

  • wordfence-login-security/tags/1.1.10/languages/wordfence-login-security.pot

    r3035804 r3049221  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Wordfence Login Security 1.1.9\n"
    6 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/wordfence-login-security-zip-zYfqhi7Al\n"
     5"Project-Id-Version: Wordfence Login Security 1.1.10\n"
     6"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/wordfence-login-security-zip-Cjy0sfiYR\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    88"Language-Team: LANGUAGE <[email protected]>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2024-02-14T15:58:26+00:00\n"
     12"POT-Creation-Date: 2024-03-11T15:20:44+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.7.1\n"
    … …  
    2626
    2727#. Author URI of the plugin
    28 msgid "http://www.wordfence.com/"
     28msgid "https://www.wordfence.com/"
    2929msgstr ""
    3030
    … …  
    265265msgstr ""
    266266
    267 #: classes/controller/users.php:518
     267#: classes/controller/users.php:517
    268268#: classes/controller/wordfencels.php:486
    269269msgid "2FA Status"
    270270msgstr ""
    271271
    272 #: classes/controller/users.php:522
     272#: classes/controller/users.php:521
    273273msgid "Last Login"
    274274msgstr ""
    275275
    276 #: classes/controller/users.php:524
     276#: classes/controller/users.php:523
    277277msgid "Last CAPTCHA"
    278278msgstr ""
    279279
    280 #: classes/controller/users.php:534
     280#: classes/controller/users.php:533
    281281msgid "Not Allowed"
    282282msgstr ""
    283283
    284 #: classes/controller/users.php:539
     284#: classes/controller/users.php:538
    285285#: classes/controller/wordfencels.php:490
    286286msgid "Active"
    287287msgstr ""
    288288
    289 #: classes/controller/users.php:542
     289#: classes/controller/users.php:541
    290290msgid "Inactive<small class=\"wfls-sub-status\">(Grace Period)</small>"
    291291msgstr ""
    292292
    293 #: classes/controller/users.php:545
     293#: classes/controller/users.php:544
    294294msgid "Locked Out<small class=\"wfls-sub-status\">(Grace Period Disabled)</small>"
    295295msgstr ""
    296296
    297 #: classes/controller/users.php:545
     297#: classes/controller/users.php:544
    298298msgid "Locked Out<small class=\"wfls-sub-status\">(Grace Period Exceeded)</small>"
    299299msgstr ""
    300300
    301 #: classes/controller/users.php:548
     301#: classes/controller/users.php:547
    302302#: classes/controller/wordfencels.php:490
    303303msgid "Inactive"
    304304msgstr ""
    305305
    306 #: classes/controller/users.php:561
     306#: classes/controller/users.php:560
    307307msgid "(not required)"
    308308msgstr ""
    309309
    310 #: classes/controller/users.php:655
     310#: classes/controller/users.php:654
    311311msgid "Edit two-factor authentication for %s"
    312312msgstr ""
    313313
    314 #: classes/controller/users.php:655
     314#: classes/controller/users.php:654
    315315#: views/settings/options.php:9
    316316msgid "2FA"
    317317msgstr ""
    318318
    319 #: classes/controller/users.php:666
     319#: classes/controller/users.php:665
    320320#: views/settings/user-stats.php:25
    321321msgid "2FA Active"
    322322msgstr ""
    323323
    324 #: classes/controller/users.php:667
     324#: classes/controller/users.php:666
    325325#: views/settings/user-stats.php:26
    326326msgid "2FA Inactive"
    … …  
    442442
    443443#: classes/controller/wordfencels.php:490
    444 #: classes/controller/wordfencels.php:852
     444#: classes/controller/wordfencels.php:855
    445445#: views/manage/grace-period.php:22
    446446msgid "Locked Out"
    … …  
    500500msgstr ""
    501501
    502 #: classes/controller/wordfencels.php:669
     502#: classes/controller/wordfencels.php:671
    503503msgid "Login Verification Required"
    504504msgstr ""
    505505
    506 #: classes/controller/wordfencels.php:671
    507 msgid "<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. Please check the email address associated with the account for a verification link."
    508 msgstr ""
    509 
    510 #: classes/controller/wordfencels.php:689
     506#: classes/controller/wordfencels.php:676
     507msgid "<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in."
     508msgstr ""
     509
     510#: classes/controller/wordfencels.php:692
    511511msgid "<strong>CODE INVALID</strong>: The 2FA code provided is either expired or invalid. Please try again."
    512512msgstr ""
    513513
    514 #: classes/controller/wordfencels.php:698
     514#: classes/controller/wordfencels.php:701
    515515msgid "<strong>CODE REQUIRED</strong>: Please enter your 2FA code immediately after your password in the same field."
    516516msgstr ""
    517517
    518 #: classes/controller/wordfencels.php:700
     518#: classes/controller/wordfencels.php:703
    519519msgid "<strong>CODE REQUIRED</strong>: Please provide your 2FA code when prompted."
    520520msgstr ""
    521521
    522 #: classes/controller/wordfencels.php:703
     522#: classes/controller/wordfencels.php:706
    523523msgid "<strong>LOGIN BLOCKED</strong>: 2FA is required to be active on your account. Please contact the site administrator."
    524524msgstr ""
    525525
    526 #: classes/controller/wordfencels.php:706
     526#: classes/controller/wordfencels.php:709
    527527msgid "You do not currently have two-factor authentication active on your account, which will be required beginning %s. <a href=\"%s\">Configure 2FA</a>"
    528528msgstr ""
    529529
    530 #: classes/controller/wordfencels.php:756
     530#: classes/controller/wordfencels.php:759
    531531msgid "Email verification succeeded. Please continue logging in."
    532532msgstr ""
    533533
    534 #: classes/controller/wordfencels.php:759
     534#: classes/controller/wordfencels.php:762
    535535msgid "Email verification invalid or expired. Please try again."
    536536msgstr ""
    537537
    538 #: classes/controller/wordfencels.php:813
    539538#: classes/controller/wordfencels.php:816
     539#: classes/controller/wordfencels.php:819
    540540msgid "Login Security"
    541541msgstr ""
    542542
    543 #: classes/controller/wordfencels.php:844
     543#: classes/controller/wordfencels.php:847
    544544#: views/settings/options.php:23
    545545#: views/settings/user-stats.php:33
    … …  
    547547msgstr ""
    548548
    549 #: classes/controller/wordfencels.php:848
     549#: classes/controller/wordfencels.php:851
    550550#: views/manage/grace-period.php:22
    551551#: views/options/option-roles.php:57
    … …  
    553553msgstr ""
    554554
    555 #: classes/controller/wordfencels.php:867
     555#: classes/controller/wordfencels.php:870
    556556msgid "Users without 2FA active (%s)"
    557557msgstr ""
    558558
    559 #: classes/controller/wordfencels.php:885
    560 #: classes/controller/wordfencels.php:886
     559#: classes/controller/wordfencels.php:888
     560#: classes/controller/wordfencels.php:889
    561561msgid "Two-Factor Authentication"
    562562msgstr ""
    563563
    564 #: classes/controller/wordfencels.php:886
     564#: classes/controller/wordfencels.php:889
    565565msgid "Learn more<span class=\"wfls-hidden-xs\"> about Two-Factor Authentication</span>"
    566566msgstr ""
    567567
    568 #: classes/controller/wordfencels.php:895
     568#: classes/controller/wordfencels.php:898
    569569msgid "Settings"
    570570msgstr ""
    571571
    572 #: classes/controller/wordfencels.php:896
     572#: classes/controller/wordfencels.php:899
    573573msgid "Login Security Settings"
    574574msgstr ""
    575575
    576 #: classes/controller/wordfencels.php:896
     576#: classes/controller/wordfencels.php:899
    577577msgid "Learn more<span class=\"wfls-hidden-xs\"> about Login Security</span>"
    578578msgstr ""
    579579
    580 #: classes/controller/wordfencels.php:922
     580#: classes/controller/wordfencels.php:925
    581581msgid "<strong>REGISTRATION ATTEMPT BLOCKED</strong>: This site requires a security token created when the page loads for all registration attempts. Please ensure JavaScript is enabled and try again."
    582582msgstr ""
    583583
    584 #: classes/controller/wordfencels.php:929
     584#: classes/controller/wordfencels.php:932
    585585msgid "<strong>REGISTRATION ATTEMPT BLOCKED</strong>: The security token for the login attempt was invalid or expired. Please reload the page and try again."
    586586msgstr ""
    587587
    588 #: classes/controller/wordfencels.php:942
     588#: classes/controller/wordfencels.php:945
    589589msgid "<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or <a href=\"#\" class=\"wfls-registration-captcha-contact\" data-token=\"%s\">contact the site owner</a> for help."
    590590msgstr ""
    591591
    592 #: classes/controller/wordfencels.php:945
     592#: classes/controller/wordfencels.php:948
    593593msgid "<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or contact the site owner for help."
    594594msgstr ""
    595595
    596 #: classes/controller/wordfencels.php:1015
     596#: classes/controller/wordfencels.php:1018
    597597msgid "Wordfence 2FA"
    598598msgstr ""
    … …  
    647647msgstr ""
    648648
    649 #: views/email/login-verification.php:11
    650 msgid "Please verify a login attempt for your account on <a href=\"%s\"><strong>%s</strong></a>."
     649#: views/email/login-verification.php:10
     650msgid "Please verify a login attempt for your account on: %s"
     651msgstr ""
     652
     653#: views/email/login-verification.php:12
     654msgid "Request Time:"
    651655msgstr ""
    652656
    653657#: views/email/login-verification.php:13
    654 msgid "Request Time:"
    655 msgstr ""
    656 
    657 #: views/email/login-verification.php:14
    658658msgid "IP:"
    659659msgstr ""
    660660
    661 #: views/email/login-verification.php:16
     661#: views/email/login-verification.php:15
    662662msgid "The request was flagged as suspicious, and we need verification that you attempted to log in to allow it to proceed. This verification link <b>will be valid for 15 minutes</b> from the time it was sent. If you did not attempt this login, please change your password immediately."
    663663msgstr ""
    664664
    665 #: views/email/login-verification.php:19
    666 msgid "You may bypass this verification step permanently by enabling two-factor authentication on your account."
    667 msgstr ""
    668 
    669 #: views/email/login-verification.php:22
    670 msgid "<a href=\"%s\"><b>Verify and Log In</b></a>"
     665#: views/email/login-verification.php:17
     666msgid "If you were attempting to log in to this site, <a href=\"%s\"><strong>Verify and Log In</strong></a>"
    671667msgstr ""
    672668
    … …  
    872868
    873869#: views/options/option-captcha-threshold.php:16
    874 msgid "0.1"
    875 msgstr ""
    876 
    877 #: views/options/option-captcha-threshold.php:17
    878 msgid "0.0 (definitely a bot)"
     870msgid "0.1 (probably a bot)"
     871msgstr ""
     872
     873#: views/options/option-captcha-threshold.php:27
     874msgid "reCAPTCHA human/bot threshold score"
    879875msgstr ""
    880876
    881877#: views/options/option-captcha-threshold.php:28
    882 msgid "reCAPTCHA human/bot threshold score"
    883 msgstr ""
    884 
    885 #: views/options/option-captcha-threshold.php:29
    886878msgid "A reCAPTCHA score equal to or higher than this value will be considered human. Anything lower will be treated as a bot and require additional verification for login and registration."
    887879msgstr ""
    888880
    889 #: views/options/option-captcha-threshold.php:51
     881#: views/options/option-captcha-threshold.php:50
    890882msgid "Reset Score Statistics"
    891883msgstr ""
    892884
    893 #: views/options/option-captcha-threshold.php:88
     885#: views/options/option-captcha-threshold.php:87
    894886msgid "Requests"
    895887msgstr ""
    896888
    897 #: views/options/option-captcha-threshold.php:106
     889#: views/options/option-captcha-threshold.php:105
    898890msgid "reCAPTCHA Score History"
    899891msgstr ""
    900892
    901 #: views/options/option-captcha-threshold.php:113
     893#: views/options/option-captcha-threshold.php:112
    902894msgid "Count"
    903895msgstr ""

  • wordfence-login-security/tags/1.1.10/readme.txt

    r3035812 r3049221  
    55Requires PHP: 5.5
    66Tested up to: 6.4
    7 Stable tag: 1.1.9
     7Stable tag: 1.1.10
    88
    99Secure your website with Wordfence Login Security, providing two-factor authentication, login and registration CAPTCHA, and XML-RPC protection.
    … …  
    5858
    5959== Changelog ==
     60
     61= 1.1.10 - March 11, 2024 =
     62* Change: Removed the extra site link from the CAPTCHA verification email message to avoid confusion with the verify link
     63* Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)
    6064
    6165= 1.1.9 - February 14, 2024 =

  • wordfence-login-security/tags/1.1.10/views/email/login-verification.php

    r2937680 r3049221  
    44 * @var string $ip The requesting IP. Required.
    55 * @var string $siteName The site name. Required.
    6  * @var string $siteURL The site URL. Required.
    76 * @var string $verificationURL The verification URL. Required.
    87 * @var bool $canEnable2FA Whether or not the user this is being sent to can enable 2FA. Optional
    98 */
    109?>
    11 <strong><?php echo wp_kses(sprintf(__('Please verify a login attempt for your account on <a href="%s"><strong>%s</strong></a>.', 'wordfence-login-security'), esc_url($siteURL), $siteName), array('a'=>array('href'=>array()), 'strong'=>array())); ?></strong>
     10<strong><?php echo wp_kses(sprintf(__('Please verify a login attempt for your account on: %s', 'wordfence-login-security'), $siteName), array('strong'=>array())); ?></strong>
    1211<br><br>
    1312<?php echo '<strong>' . esc_html__('Request Time:', 'wordfence-login-security') . '</strong> ' . esc_html(\WordfenceLS\Controller_Time::format_local_time('F j, Y h:i:s A')); ?><br>
    … …  
    1615<?php echo wp_kses(__('The request was flagged as suspicious, and we need verification that you attempted to log in to allow it to proceed. This verification link <b>will be valid for 15 minutes</b> from the time it was sent. If you did not attempt this login, please change your password immediately.', 'wordfence-login-security'), array('b'=>array())); ?>
    1716<br><br>
    18 <?php if (isset($canEnable2FA) && $canEnable2FA): ?>
    19 <?php esc_html_e('You may bypass this verification step permanently by enabling two-factor authentication on your account.', 'wordfence-login-security'); ?>
    20 <br><br>
    21 <?php endif; ?>
    22 <?php echo wp_kses(sprintf(__('<a href="%s"><b>Verify and Log In</b></a>', 'wordfence-login-security'), esc_url($verificationURL)), array('a'=>array('href'=>array()), 'b'=>array())); ?>
     17<?php echo wp_kses(sprintf(__('If you were attempting to log in to this site, <a href="%s"><strong>Verify and Log In</strong></a>', 'wordfence-login-security'), esc_url($verificationURL)), array('a' => array('href' => array()), 'strong' => array())); ?>

  • wordfence-login-security/tags/1.1.10/views/options/option-captcha-threshold.php

    r2937680 r3049221  
    55$currentValue = \WordfenceLS\Controller_Settings::shared()->get_float($optionName, 0.5);
    66$selectOptions = array(
    7     array('label' => __('1.0 (definitely a human)', 'wordfence-login-security'), 'value' => 1.0),
    8     array('label' => __('0.9', 'wordfence-login-security'), 'value' => 0.9),
    9     array('label' => __('0.8', 'wordfence-login-security'), 'value' => 0.8),
    10     array('label' => __('0.7', 'wordfence-login-security'), 'value' => 0.7),
    11     array('label' => __('0.6', 'wordfence-login-security'), 'value' => 0.6),
    12     array('label' => __('0.5 (probably a human)', 'wordfence-login-security'), 'value' => 0.5),
    13     array('label' => __('0.4', 'wordfence-login-security'), 'value' => 0.4),
    14     array('label' => __('0.3', 'wordfence-login-security'), 'value' => 0.3),
    15     array('label' => __('0.2', 'wordfence-login-security'), 'value' => 0.2),
    16     array('label' => __('0.1', 'wordfence-login-security'), 'value' => 0.1),
    17     array('label' => __('0.0 (definitely a bot)', 'wordfence-login-security'), 'value' => 0.0),
     7    array('label' => __('1.0 (definitely a human)', 'wordfence-login-security'), 'value' => 1.0, 'selected' => ((int) ($currentValue * 10)) == 10),
     8    array('label' => __('0.9', 'wordfence-login-security'), 'value' => 0.9, 'selected' => ((int) ($currentValue * 10)) == 9),
     9    array('label' => __('0.8', 'wordfence-login-security'), 'value' => 0.8, 'selected' => ((int) ($currentValue * 10)) == 8),
     10    array('label' => __('0.7', 'wordfence-login-security'), 'value' => 0.7, 'selected' => ((int) ($currentValue * 10)) == 7),
     11    array('label' => __('0.6', 'wordfence-login-security'), 'value' => 0.6, 'selected' => ((int) ($currentValue * 10)) == 6),
     12    array('label' => __('0.5 (probably a human)', 'wordfence-login-security'), 'value' => 0.5, 'selected' => ((int) ($currentValue * 10)) == 5),
     13    array('label' => __('0.4', 'wordfence-login-security'), 'value' => 0.4, 'selected' => ((int) ($currentValue * 10)) == 4),
     14    array('label' => __('0.3', 'wordfence-login-security'), 'value' => 0.3, 'selected' => ((int) ($currentValue * 10)) == 3),
     15    array('label' => __('0.2', 'wordfence-login-security'), 'value' => 0.2, 'selected' => ((int) ($currentValue * 10)) == 2),
     16    array('label' => __('0.1 (probably a bot)', 'wordfence-login-security'), 'value' => 0.1, 'selected' => ((int) ($currentValue * 10)) <= 1),
    1817);
    1918?>
    … …  
    3332                        <select aria-labelledby="wfls-option-recaptcha-threshold-label">
    3433                            <?php foreach ($selectOptions as $o): ?>
    35                                 <option class="wfls-option-select-option" value="<?php echo esc_attr($o['value']); ?>"<?php if (((int) ($o['value'] * 10)) == ((int) ($currentValue * 10))) { echo ' selected'; } ?>><?php echo esc_html($o['label']); ?></option>
     34                                <option class="wfls-option-select-option" value="<?php echo esc_attr($o['value']); ?>"<?php if ($o['selected']) { echo ' selected'; } ?>><?php echo esc_html($o['label']); ?></option>
    3635                            <?php endforeach; ?>
    3736                        </select>

  • wordfence-login-security/tags/1.1.10/wordfence-login-security.php

    r3035804 r3049221  
    44Description: Wordfence Login Security
    55Author: Wordfence
    6 Author URI: http://www.wordfence.com/
    7 Version: 1.1.9
     6Author URI: https://www.wordfence.com/
     7Version: 1.1.10
    88Network: true
    99Requires at least: 4.5
    … …  
    3939    define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
    4040   
    41     define('WORDFENCE_LS_VERSION', '1.1.9');
    42     define('WORDFENCE_LS_BUILD_NUMBER', '1707926306');
     41    define('WORDFENCE_LS_VERSION', '1.1.10');
     42    define('WORDFENCE_LS_BUILD_NUMBER', '1710170444');
    4343
    4444    define('WORDFENCE_LS_PLUGIN_BASENAME', plugin_basename(__FILE__));

  • wordfence-login-security/trunk/classes/controller/captcha.php

    r2560586 r3049221  
    5757     */
    5858    public function threshold() {
    59         return Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5);
     59        return max(0.1, Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5));
    6060    }
    6161

  • wordfence-login-security/trunk/classes/controller/settings.php

    r2937680 r3049221  
    218218                return is_numeric($value) && $value > 0;
    219219            case self::OPTION_RECAPTCHA_THRESHOLD:
    220                 return is_numeric($value) && $value >= 0 && $value <= 1;
     220                return is_numeric($value) && $value > 0 && $value <= 1;
    221221            case self::OPTION_RECAPTCHA_SITE_KEY:
    222222                if (empty($value)) {

  • wordfence-login-security/trunk/classes/controller/users.php

    r2982696 r3049221  
    318318    public function record_captcha_score($user, $score) {
    319319        if (!Controller_CAPTCHA::shared()->enabled()) { return; }
    320         if ($this->has_2fa_active($user)) { return; } //2FA activated users do not retrieve a score
    321320       
    322321        if ($user) { update_user_meta($user->ID, 'wfls-last-captcha-score', $score); }

  • wordfence-login-security/trunk/classes/controller/wordfencels.php

    r3016540 r3049221  
    559559
    560560        $isLogin = !(defined('WORDFENCE_LS_AUTHENTICATION_CHECK') && WORDFENCE_LS_AUTHENTICATION_CHECK); //Checking for the purpose of prompting for 2FA, don't enforce it here
     561        $isCombinedCheck = (defined('WORDFENCE_LS_CHECKING_COMBINED') && WORDFENCE_LS_CHECKING_COMBINED);
    561562        $combinedTwoFactor = false;
    562563
    … …  
    610611         * 3. A filter does not override it. This is to allow plugins with REST endpoints that handle authentication
    611612         *    themselves to opt out of the requirement.
    612          * 4. The user does not have 2FA enabled. 2FA exempts the user from requiring email verification if the score is
    613          *    below the threshold.
     613         * 4. The user is not providing a combined credentials + 2FA authentication login request.
    614614         * 5. The request is not a WooCommerce login while WC integration is disabled
    615615         */
    616         if ($isLogin && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load
     616        if (!$combinedTwoFactor && !$isCombinedCheck && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load
    617617
    618618            $requireCAPTCHA = Controller_CAPTCHA::shared()->is_captcha_required();
     619            $performVerification = false;
    619620           
    620             $performVerification = false;
    621621            $token = Controller_CAPTCHA::shared()->get_token();
    622622            if ($requireCAPTCHA && empty($token) && !Controller_CAPTCHA::shared()->test_mode()) { //No CAPTCHA token means forced additional verification (if neither 2FA nor test mode are active)
    … …  
    624624            }
    625625           
     626            if (is_object($user) && $user instanceof \WP_User && $this->validate_email_verification_token($user)) { //Skip the CAPTCHA check if the email address was verified
     627                $requireCAPTCHA = false;
     628                $performVerification = false;
     629               
     630                //Reset token rate limit
     631                $identifier = sprintf('wfls-captcha-%d', $user->ID);
     632                $tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
     633                $tokenBucket->reset();
     634            }
     635           
     636            $score = false;
    626637            if ($requireCAPTCHA && !$performVerification) {
    627638                $score = Controller_CAPTCHA::shared()->score($token);
    628                 if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if neither 2FA nor test mode are active)
     639                if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if test mode is not active)
    629640                    $performVerification = true;
    630641                }
    631             }
    632 
    633             if (!isset($score)) { $score = false; }
     642                else if (is_object($user) && $user instanceof \WP_User) {
     643                    Controller_Users::shared()->record_captcha_score($user, $score);
     644                }
     645            }
    634646           
    635             if (is_object($user) && $user instanceof \WP_User) {
    636                 if (Controller_Users::shared()->has_2fa_active($user)) { //CAPTCHA enforcement skipped for users with 2FA active
    637                     $requireCAPTCHA = false;
    638                     $performVerification = false;
    639                 }
    640                
    641                 Controller_Users::shared()->record_captcha_score($user, $score);
    642 
    643                 //Skip the CAPTCHA check if the email address was verified
    644                 if ($this->validate_email_verification_token($user)) {
    645                     $requireCAPTCHA = false;
    646                     $performVerification = false;
    647                 }
    648                
    649                 if ($requireCAPTCHA && ($performVerification || !Controller_CAPTCHA::shared()->is_human($score))) {
    650                     if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {
    651                         $loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));
     647            if ($requireCAPTCHA) {
     648                if ($performVerification || !Controller_CAPTCHA::shared()->is_human($score)) {
     649                    if (is_object($user) && $user instanceof \WP_User) {
     650                        $identifier = sprintf('wfls-captcha-%d', $user->ID);
     651                        $tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
     652                        if ($tokenBucket->consume(1)) {
     653                            if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {
     654                                $loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));
     655                            }
     656                            else {
     657                                $loginUrl = wp_login_url();
     658                            }
     659                            $verificationUrl = add_query_arg(
     660                                array(
     661                                    'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))
     662                                ),
     663                                $loginUrl
     664                            );
     665                            $view = new Model_View('email/login-verification', array(
     666                                'siteName' => get_bloginfo('name', 'raw'),
     667                                'verificationURL' => $verificationUrl,
     668                                'ip' => Model_Request::current()->ip(),
     669                                'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),
     670                            ));
     671                            wp_mail($user->user_email, __('Login Verification Required', 'wordfence-login-security'), $view->render(), "Content-Type: text/html");
     672                        }
    652673                    }
    653                     else {
    654                         $loginUrl = wp_login_url();
    655                     }
    656                     $verificationUrl = add_query_arg(
    657                         array(
    658                             'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))
    659                         ),
    660                         $loginUrl
    661                     );
    662                     $view = new Model_View('email/login-verification', array(
    663                         'siteName' => get_bloginfo('name', 'raw'),
    664                         'siteURL' => rtrim(site_url(), '/') . '/',
    665                         'verificationURL' => $verificationUrl,
    666                         'ip' => Model_Request::current()->ip(),
    667                         'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),
    668                     ));
    669                     wp_mail($user->user_email, __('Login Verification Required', 'wordfence-login-security'), $view->render(), "Content-Type: text/html");
    670 
    671                     return new \WP_Error('wfls_captcha_verify', wp_kses(__('<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. Please check the email address associated with the account for a verification link.', 'wordfence-login-security'), array('strong'=>array())));
    672                 }
    673 
     674
     675                    Utility_Sleep::sleep(Model_Crypto::random_int(0, 2000) / 1000);
     676                    return new \WP_Error('wfls_captcha_verify', wp_kses(__('<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in.', 'wordfence-login-security'), array('strong' => array())));
     677                }
    674678            }
    675679        }
    676680
    677681        if (!$combinedTwoFactor) {
    678 
    679682            if ($isLogin && $user instanceof \WP_User) {
    680683                if (Controller_Users::shared()->has_2fa_active($user)) {

  • wordfence-login-security/trunk/classes/model/tokenbucket.php

    r2098090 r3049221  
    140140        }
    141141        else {
     142            $this->_unlock();
    142143            return false;
    143144        }
    … …  
    171172    }
    172173   
     174    public function reset() {
     175        if (!$this->_lock()) { return false; }
     176       
     177        if ($this->_backing == self::BACKING_WP_OPTIONS) {
     178            delete_transient('wflsbucket:' . $this->_identifier);
     179        }
     180        else if ($this->_backing == self::BACKING_REDIS) {
     181            $this->_redis->del('bucket:' . $this->_identifier);
     182        }
     183       
     184        $this->_unlock();
     185    }
     186   
    173187    /**
    174188     * Creates an initial record with the given number of tokens.

  • wordfence-login-security/trunk/languages/wordfence-login-security.pot

    r3035804 r3049221  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Wordfence Login Security 1.1.9\n"
    6 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/wordfence-login-security-zip-zYfqhi7Al\n"
     5"Project-Id-Version: Wordfence Login Security 1.1.10\n"
     6"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/wordfence-login-security-zip-Cjy0sfiYR\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    88"Language-Team: LANGUAGE <[email protected]>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2024-02-14T15:58:26+00:00\n"
     12"POT-Creation-Date: 2024-03-11T15:20:44+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.7.1\n"
    … …  
    2626
    2727#. Author URI of the plugin
    28 msgid "http://www.wordfence.com/"
     28msgid "https://www.wordfence.com/"
    2929msgstr ""
    3030
    … …  
    265265msgstr ""
    266266
    267 #: classes/controller/users.php:518
     267#: classes/controller/users.php:517
    268268#: classes/controller/wordfencels.php:486
    269269msgid "2FA Status"
    270270msgstr ""
    271271
    272 #: classes/controller/users.php:522
     272#: classes/controller/users.php:521
    273273msgid "Last Login"
    274274msgstr ""
    275275
    276 #: classes/controller/users.php:524
     276#: classes/controller/users.php:523
    277277msgid "Last CAPTCHA"
    278278msgstr ""
    279279
    280 #: classes/controller/users.php:534
     280#: classes/controller/users.php:533
    281281msgid "Not Allowed"
    282282msgstr ""
    283283
    284 #: classes/controller/users.php:539
     284#: classes/controller/users.php:538
    285285#: classes/controller/wordfencels.php:490
    286286msgid "Active"
    287287msgstr ""
    288288
    289 #: classes/controller/users.php:542
     289#: classes/controller/users.php:541
    290290msgid "Inactive<small class=\"wfls-sub-status\">(Grace Period)</small>"
    291291msgstr ""
    292292
    293 #: classes/controller/users.php:545
     293#: classes/controller/users.php:544
    294294msgid "Locked Out<small class=\"wfls-sub-status\">(Grace Period Disabled)</small>"
    295295msgstr ""
    296296
    297 #: classes/controller/users.php:545
     297#: classes/controller/users.php:544
    298298msgid "Locked Out<small class=\"wfls-sub-status\">(Grace Period Exceeded)</small>"
    299299msgstr ""
    300300
    301 #: classes/controller/users.php:548
     301#: classes/controller/users.php:547
    302302#: classes/controller/wordfencels.php:490
    303303msgid "Inactive"
    304304msgstr ""
    305305
    306 #: classes/controller/users.php:561
     306#: classes/controller/users.php:560
    307307msgid "(not required)"
    308308msgstr ""
    309309
    310 #: classes/controller/users.php:655
     310#: classes/controller/users.php:654
    311311msgid "Edit two-factor authentication for %s"
    312312msgstr ""
    313313
    314 #: classes/controller/users.php:655
     314#: classes/controller/users.php:654
    315315#: views/settings/options.php:9
    316316msgid "2FA"
    317317msgstr ""
    318318
    319 #: classes/controller/users.php:666
     319#: classes/controller/users.php:665
    320320#: views/settings/user-stats.php:25
    321321msgid "2FA Active"
    322322msgstr ""
    323323
    324 #: classes/controller/users.php:667
     324#: classes/controller/users.php:666
    325325#: views/settings/user-stats.php:26
    326326msgid "2FA Inactive"
    … …  
    442442
    443443#: classes/controller/wordfencels.php:490
    444 #: classes/controller/wordfencels.php:852
     444#: classes/controller/wordfencels.php:855
    445445#: views/manage/grace-period.php:22
    446446msgid "Locked Out"
    … …  
    500500msgstr ""
    501501
    502 #: classes/controller/wordfencels.php:669
     502#: classes/controller/wordfencels.php:671
    503503msgid "Login Verification Required"
    504504msgstr ""
    505505
    506 #: classes/controller/wordfencels.php:671
    507 msgid "<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. Please check the email address associated with the account for a verification link."
    508 msgstr ""
    509 
    510 #: classes/controller/wordfencels.php:689
     506#: classes/controller/wordfencels.php:676
     507msgid "<strong>VERIFICATION REQUIRED</strong>: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in."
     508msgstr ""
     509
     510#: classes/controller/wordfencels.php:692
    511511msgid "<strong>CODE INVALID</strong>: The 2FA code provided is either expired or invalid. Please try again."
    512512msgstr ""
    513513
    514 #: classes/controller/wordfencels.php:698
     514#: classes/controller/wordfencels.php:701
    515515msgid "<strong>CODE REQUIRED</strong>: Please enter your 2FA code immediately after your password in the same field."
    516516msgstr ""
    517517
    518 #: classes/controller/wordfencels.php:700
     518#: classes/controller/wordfencels.php:703
    519519msgid "<strong>CODE REQUIRED</strong>: Please provide your 2FA code when prompted."
    520520msgstr ""
    521521
    522 #: classes/controller/wordfencels.php:703
     522#: classes/controller/wordfencels.php:706
    523523msgid "<strong>LOGIN BLOCKED</strong>: 2FA is required to be active on your account. Please contact the site administrator."
    524524msgstr ""
    525525
    526 #: classes/controller/wordfencels.php:706
     526#: classes/controller/wordfencels.php:709
    527527msgid "You do not currently have two-factor authentication active on your account, which will be required beginning %s. <a href=\"%s\">Configure 2FA</a>"
    528528msgstr ""
    529529
    530 #: classes/controller/wordfencels.php:756
     530#: classes/controller/wordfencels.php:759
    531531msgid "Email verification succeeded. Please continue logging in."
    532532msgstr ""
    533533
    534 #: classes/controller/wordfencels.php:759
     534#: classes/controller/wordfencels.php:762
    535535msgid "Email verification invalid or expired. Please try again."
    536536msgstr ""
    537537
    538 #: classes/controller/wordfencels.php:813
    539538#: classes/controller/wordfencels.php:816
     539#: classes/controller/wordfencels.php:819
    540540msgid "Login Security"
    541541msgstr ""
    542542
    543 #: classes/controller/wordfencels.php:844
     543#: classes/controller/wordfencels.php:847
    544544#: views/settings/options.php:23
    545545#: views/settings/user-stats.php:33
    … …  
    547547msgstr ""
    548548
    549 #: classes/controller/wordfencels.php:848
     549#: classes/controller/wordfencels.php:851
    550550#: views/manage/grace-period.php:22
    551551#: views/options/option-roles.php:57
    … …  
    553553msgstr ""
    554554
    555 #: classes/controller/wordfencels.php:867
     555#: classes/controller/wordfencels.php:870
    556556msgid "Users without 2FA active (%s)"
    557557msgstr ""
    558558
    559 #: classes/controller/wordfencels.php:885
    560 #: classes/controller/wordfencels.php:886
     559#: classes/controller/wordfencels.php:888
     560#: classes/controller/wordfencels.php:889
    561561msgid "Two-Factor Authentication"
    562562msgstr ""
    563563
    564 #: classes/controller/wordfencels.php:886
     564#: classes/controller/wordfencels.php:889
    565565msgid "Learn more<span class=\"wfls-hidden-xs\"> about Two-Factor Authentication</span>"
    566566msgstr ""
    567567
    568 #: classes/controller/wordfencels.php:895
     568#: classes/controller/wordfencels.php:898
    569569msgid "Settings"
    570570msgstr ""
    571571
    572 #: classes/controller/wordfencels.php:896
     572#: classes/controller/wordfencels.php:899
    573573msgid "Login Security Settings"
    574574msgstr ""
    575575
    576 #: classes/controller/wordfencels.php:896
     576#: classes/controller/wordfencels.php:899
    577577msgid "Learn more<span class=\"wfls-hidden-xs\"> about Login Security</span>"
    578578msgstr ""
    579579
    580 #: classes/controller/wordfencels.php:922
     580#: classes/controller/wordfencels.php:925
    581581msgid "<strong>REGISTRATION ATTEMPT BLOCKED</strong>: This site requires a security token created when the page loads for all registration attempts. Please ensure JavaScript is enabled and try again."
    582582msgstr ""
    583583
    584 #: classes/controller/wordfencels.php:929
     584#: classes/controller/wordfencels.php:932
    585585msgid "<strong>REGISTRATION ATTEMPT BLOCKED</strong>: The security token for the login attempt was invalid or expired. Please reload the page and try again."
    586586msgstr ""
    587587
    588 #: classes/controller/wordfencels.php:942
     588#: classes/controller/wordfencels.php:945
    589589msgid "<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or <a href=\"#\" class=\"wfls-registration-captcha-contact\" data-token=\"%s\">contact the site owner</a> for help."
    590590msgstr ""
    591591
    592 #: classes/controller/wordfencels.php:945
     592#: classes/controller/wordfencels.php:948
    593593msgid "<strong>REGISTRATION BLOCKED</strong>: The registration request was blocked because it was flagged as spam. Please try again or contact the site owner for help."
    594594msgstr ""
    595595
    596 #: classes/controller/wordfencels.php:1015
     596#: classes/controller/wordfencels.php:1018
    597597msgid "Wordfence 2FA"
    598598msgstr ""
    … …  
    647647msgstr ""
    648648
    649 #: views/email/login-verification.php:11
    650 msgid "Please verify a login attempt for your account on <a href=\"%s\"><strong>%s</strong></a>."
     649#: views/email/login-verification.php:10
     650msgid "Please verify a login attempt for your account on: %s"
     651msgstr ""
     652
     653#: views/email/login-verification.php:12
     654msgid "Request Time:"
    651655msgstr ""
    652656
    653657#: views/email/login-verification.php:13
    654 msgid "Request Time:"
    655 msgstr ""
    656 
    657 #: views/email/login-verification.php:14
    658658msgid "IP:"
    659659msgstr ""
    660660
    661 #: views/email/login-verification.php:16
     661#: views/email/login-verification.php:15
    662662msgid "The request was flagged as suspicious, and we need verification that you attempted to log in to allow it to proceed. This verification link <b>will be valid for 15 minutes</b> from the time it was sent. If you did not attempt this login, please change your password immediately."
    663663msgstr ""
    664664
    665 #: views/email/login-verification.php:19
    666 msgid "You may bypass this verification step permanently by enabling two-factor authentication on your account."
    667 msgstr ""
    668 
    669 #: views/email/login-verification.php:22
    670 msgid "<a href=\"%s\"><b>Verify and Log In</b></a>"
     665#: views/email/login-verification.php:17
     666msgid "If you were attempting to log in to this site, <a href=\"%s\"><strong>Verify and Log In</strong></a>"
    671667msgstr ""
    672668
    … …  
    872868
    873869#: views/options/option-captcha-threshold.php:16
    874 msgid "0.1"
    875 msgstr ""
    876 
    877 #: views/options/option-captcha-threshold.php:17
    878 msgid "0.0 (definitely a bot)"
     870msgid "0.1 (probably a bot)"
     871msgstr ""
     872
     873#: views/options/option-captcha-threshold.php:27
     874msgid "reCAPTCHA human/bot threshold score"
    879875msgstr ""
    880876
    881877#: views/options/option-captcha-threshold.php:28
    882 msgid "reCAPTCHA human/bot threshold score"
    883 msgstr ""
    884 
    885 #: views/options/option-captcha-threshold.php:29
    886878msgid "A reCAPTCHA score equal to or higher than this value will be considered human. Anything lower will be treated as a bot and require additional verification for login and registration."
    887879msgstr ""
    888880
    889 #: views/options/option-captcha-threshold.php:51
     881#: views/options/option-captcha-threshold.php:50
    890882msgid "Reset Score Statistics"
    891883msgstr ""
    892884
    893 #: views/options/option-captcha-threshold.php:88
     885#: views/options/option-captcha-threshold.php:87
    894886msgid "Requests"
    895887msgstr ""
    896888
    897 #: views/options/option-captcha-threshold.php:106
     889#: views/options/option-captcha-threshold.php:105
    898890msgid "reCAPTCHA Score History"
    899891msgstr ""
    900892
    901 #: views/options/option-captcha-threshold.php:113
     893#: views/options/option-captcha-threshold.php:112
    902894msgid "Count"
    903895msgstr ""

  • wordfence-login-security/trunk/readme.txt

    r3035812 r3049221  
    5858
    5959== Changelog ==
     60
     61= 1.1.10 - March 11, 2024 =
     62* Change: Removed the extra site link from the CAPTCHA verification email message to avoid confusion with the verify link
     63* Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)
    6064
    6165= 1.1.9 - February 14, 2024 =

  • wordfence-login-security/trunk/views/email/login-verification.php

    r2937680 r3049221  
    44 * @var string $ip The requesting IP. Required.
    55 * @var string $siteName The site name. Required.
    6  * @var string $siteURL The site URL. Required.
    76 * @var string $verificationURL The verification URL. Required.
    87 * @var bool $canEnable2FA Whether or not the user this is being sent to can enable 2FA. Optional
    98 */
    109?>
    11 <strong><?php echo wp_kses(sprintf(__('Please verify a login attempt for your account on <a href="%s"><strong>%s</strong></a>.', 'wordfence-login-security'), esc_url($siteURL), $siteName), array('a'=>array('href'=>array()), 'strong'=>array())); ?></strong>
     10<strong><?php echo wp_kses(sprintf(__('Please verify a login attempt for your account on: %s', 'wordfence-login-security'), $siteName), array('strong'=>array())); ?></strong>
    1211<br><br>
    1312<?php echo '<strong>' . esc_html__('Request Time:', 'wordfence-login-security') . '</strong> ' . esc_html(\WordfenceLS\Controller_Time::format_local_time('F j, Y h:i:s A')); ?><br>
    … …  
    1615<?php echo wp_kses(__('The request was flagged as suspicious, and we need verification that you attempted to log in to allow it to proceed. This verification link <b>will be valid for 15 minutes</b> from the time it was sent. If you did not attempt this login, please change your password immediately.', 'wordfence-login-security'), array('b'=>array())); ?>
    1716<br><br>
    18 <?php if (isset($canEnable2FA) && $canEnable2FA): ?>
    19 <?php esc_html_e('You may bypass this verification step permanently by enabling two-factor authentication on your account.', 'wordfence-login-security'); ?>
    20 <br><br>
    21 <?php endif; ?>
    22 <?php echo wp_kses(sprintf(__('<a href="%s"><b>Verify and Log In</b></a>', 'wordfence-login-security'), esc_url($verificationURL)), array('a'=>array('href'=>array()), 'b'=>array())); ?>
     17<?php echo wp_kses(sprintf(__('If you were attempting to log in to this site, <a href="%s"><strong>Verify and Log In</strong></a>', 'wordfence-login-security'), esc_url($verificationURL)), array('a' => array('href' => array()), 'strong' => array())); ?>

  • wordfence-login-security/trunk/views/options/option-captcha-threshold.php

    r2937680 r3049221  
    55$currentValue = \WordfenceLS\Controller_Settings::shared()->get_float($optionName, 0.5);
    66$selectOptions = array(
    7     array('label' => __('1.0 (definitely a human)', 'wordfence-login-security'), 'value' => 1.0),
    8     array('label' => __('0.9', 'wordfence-login-security'), 'value' => 0.9),
    9     array('label' => __('0.8', 'wordfence-login-security'), 'value' => 0.8),
    10     array('label' => __('0.7', 'wordfence-login-security'), 'value' => 0.7),
    11     array('label' => __('0.6', 'wordfence-login-security'), 'value' => 0.6),
    12     array('label' => __('0.5 (probably a human)', 'wordfence-login-security'), 'value' => 0.5),
    13     array('label' => __('0.4', 'wordfence-login-security'), 'value' => 0.4),
    14     array('label' => __('0.3', 'wordfence-login-security'), 'value' => 0.3),
    15     array('label' => __('0.2', 'wordfence-login-security'), 'value' => 0.2),
    16     array('label' => __('0.1', 'wordfence-login-security'), 'value' => 0.1),
    17     array('label' => __('0.0 (definitely a bot)', 'wordfence-login-security'), 'value' => 0.0),
     7    array('label' => __('1.0 (definitely a human)', 'wordfence-login-security'), 'value' => 1.0, 'selected' => ((int) ($currentValue * 10)) == 10),
     8    array('label' => __('0.9', 'wordfence-login-security'), 'value' => 0.9, 'selected' => ((int) ($currentValue * 10)) == 9),
     9    array('label' => __('0.8', 'wordfence-login-security'), 'value' => 0.8, 'selected' => ((int) ($currentValue * 10)) == 8),
     10    array('label' => __('0.7', 'wordfence-login-security'), 'value' => 0.7, 'selected' => ((int) ($currentValue * 10)) == 7),
     11    array('label' => __('0.6', 'wordfence-login-security'), 'value' => 0.6, 'selected' => ((int) ($currentValue * 10)) == 6),
     12    array('label' => __('0.5 (probably a human)', 'wordfence-login-security'), 'value' => 0.5, 'selected' => ((int) ($currentValue * 10)) == 5),
     13    array('label' => __('0.4', 'wordfence-login-security'), 'value' => 0.4, 'selected' => ((int) ($currentValue * 10)) == 4),
     14    array('label' => __('0.3', 'wordfence-login-security'), 'value' => 0.3, 'selected' => ((int) ($currentValue * 10)) == 3),
     15    array('label' => __('0.2', 'wordfence-login-security'), 'value' => 0.2, 'selected' => ((int) ($currentValue * 10)) == 2),
     16    array('label' => __('0.1 (probably a bot)', 'wordfence-login-security'), 'value' => 0.1, 'selected' => ((int) ($currentValue * 10)) <= 1),
    1817);
    1918?>
    … …  
    3332                        <select aria-labelledby="wfls-option-recaptcha-threshold-label">
    3433                            <?php foreach ($selectOptions as $o): ?>
    35                                 <option class="wfls-option-select-option" value="<?php echo esc_attr($o['value']); ?>"<?php if (((int) ($o['value'] * 10)) == ((int) ($currentValue * 10))) { echo ' selected'; } ?>><?php echo esc_html($o['label']); ?></option>
     34                                <option class="wfls-option-select-option" value="<?php echo esc_attr($o['value']); ?>"<?php if ($o['selected']) { echo ' selected'; } ?>><?php echo esc_html($o['label']); ?></option>
    3635                            <?php endforeach; ?>
    3736                        </select>

  • wordfence-login-security/trunk/wordfence-login-security.php

    r3035804 r3049221  
    44Description: Wordfence Login Security
    55Author: Wordfence
    6 Author URI: http://www.wordfence.com/
    7 Version: 1.1.9
     6Author URI: https://www.wordfence.com/
     7Version: 1.1.10
    88Network: true
    99Requires at least: 4.5
    … …  
    3939    define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
    4040   
    41     define('WORDFENCE_LS_VERSION', '1.1.9');
    42     define('WORDFENCE_LS_BUILD_NUMBER', '1707926306');
     41    define('WORDFENCE_LS_VERSION', '1.1.10');
     42    define('WORDFENCE_LS_BUILD_NUMBER', '1710170444');
    4343
    4444    define('WORDFENCE_LS_PLUGIN_BASENAME', plugin_basename(__FILE__));
Note: See TracChangeset for help on using the changeset viewer.