WordPress.org
Get WordPress

Plugin Directory

Changeset 3359559


Ignore:
Timestamp:
09/11/2025 05:13:29 AM (7 months ago)
Author:
melapress
Message:

Uploading 2.9.3

Location:
wp-2fa
Files:
251 added
10 edited

Legend:

Unmodified
Added
Removed

  • wp-2fa/trunk/includes/classes/Admin/Helpers/class-wp-helper.php

    r3337002 r3359559  
    1616namespace WP2FA\Admin\Helpers;
    1717
     18use WP2FA\Utils\Settings_Utils;
     19
    1820defined( 'ABSPATH' ) || exit; // Exit if accessed directly.
    1921
    … …  
    7274            if ( self::is_multisite() ) {
    7375                \add_action( 'network_admin_notices', array( __CLASS__, 'show_critical_admin_notice' ) );
     76                \add_action( 'network_admin_notices', array( __CLASS__, 'show_2025_security_survey_admin_notice' ) );
    7477            } else {
    7578                \add_action( 'admin_notices', array( __CLASS__, 'show_critical_admin_notice' ) );
    76             }
     79                \add_action( 'admin_notices', array( __CLASS__, 'show_2025_security_survey_admin_notice' ) );
     80            }
     81
     82            \add_action( 'wp_ajax_dismiss_survey_notice', array( __CLASS__, 'dismiss_survey_notice' ) );
    7783        }
    7884
    … …  
    137143                \do_action( WP_2FA_PREFIX . 'critical_notice' );
    138144            }
     145        }
     146
     147        /**
     148         * Shows critical notices to the admin.
     149         *
     150         * @return void
     151         *
     152         * @since 2.2.0
     153         */
     154        public static function show_2025_security_survey_admin_notice() {
     155            if ( User_Helper::is_admin() && true === Settings_Utils::string_to_bool(Settings_Utils::get_option( 'wp_2fa_survey_notice_needed', true ))
     156 ) {
     157                global $current_screen;
     158
     159                if ( isset( $current_screen->id ) && in_array(
     160                    $current_screen->id,
     161                    array(
     162                        'wp-2fa_page_wp-2fa-settings',
     163                        'wp-2fa_page_wp-2fa-settings-network',
     164                        'toplevel_page_wp-2fa-policies',
     165                        'toplevel_page_wp-2fa-policies-network',
     166                        'wp-2fa_page_wp-2fa-reports',
     167                        'wp-2fa_page_wp-2fa-reports-network',
     168                        'wp-2fa_page_wp-2fa-help-contact-us',
     169                        'wp-2fa_page_wp-2fa-help-contact-us-network',
     170                        'wp-2fa_page_wp-2fa-premium-features',
     171                        'wp-2fa_page_wp-2fa-premium-features-network',
     172                        'wp-2fa_page_wp-2fa-policies-account',
     173                        'wp-2fa_page_wp-2fa-policies-account-network',
     174                    ),
     175                    true
     176                ) ) {
     177
     178                    ?>
     179                <div style="border-left-color: #3660FF !important;" id="dismiss_survey_notice" class="notice notice-success is-dismissible" data-dismiss-nonce="<?php echo \esc_attr( \wp_create_nonce( 'wp_2fa_dismiss_survey_notice_nonce' ) ); ?>">
     180                    <h4><?php \esc_html_e( 'Want to know what the state of WordPress security is in 2025?', 'wp-2fa' ); ?></h4>
     181                    <p><?php \esc_html_e( 'Discover the latest insights in our 2025 WordPress Security Survey Report.', 'wp-2fa' ); ?></p>
     182                    <button type="button" class="notice-dismiss">
     183                        <span class="screen-reader-text"><?php \esc_html_e( 'Dismiss this notice.', 'wp-2fa' ); ?></span>
     184                    </button>
     185                    <p>
     186                    <?php
     187                    printf(
     188                    /* Translators: survey link */
     189                        esc_html__( '%1$sRead the survey%2$s', 'wp-2fa' ),
     190                        '<a class="button" style="color:white !important;background:#3660FF" href="https://melapress.com/wordpress-security-survey-2025/?&utm_source=plugin&utm_medium=wp2fa&utm_campaign=survey+promo+banner" target="_blank">',
     191                        '</a>'
     192                    );
     193                    ?>
     194                    </p>
     195                    <script type="text/javascript">
     196                        //<![CDATA[
     197                        jQuery(document).ready(function( $ ) {
     198                            jQuery( 'body' ).on( 'click', '#dismiss_survey_notice .notice-dismiss', function ( e ) {
     199                                e.preventDefault();
     200                                var nonce  = jQuery( '#dismiss_survey_notice' ).data( 'dismiss-nonce' );
     201                               
     202                                jQuery.ajax({
     203                                    type: 'POST',
     204                                    url: '<?php echo \esc_url( \admin_url( 'admin-ajax.php' ) ); ?>',
     205                                    data: {
     206                                        action: 'dismiss_survey_notice',
     207                                        nonce : nonce,
     208                                    },
     209                                    success: function ( result ) {     
     210                                        jQuery( '#dismiss_survey_notice' ).slideUp( 300 );
     211                                    }
     212                                });
     213                            });
     214                        });
     215                        //]]>
     216                    </script>
     217
     218                </div>
     219                    <?php
     220                }
     221            }
     222        }
     223
     224
     225        /**
     226         * Handle notice dismissal.
     227         *
     228         * @since 2.9.3
     229         *
     230         * @return void
     231         */
     232        public static function dismiss_survey_notice() {
     233            // Grab POSTed data.
     234            $nonce_check = \check_ajax_referer( 'wp_2fa_dismiss_survey_notice_nonce', 'nonce' );
     235
     236            if ( ! $nonce_check ) {
     237                \wp_send_json_error( esc_html__( 'Nonce Verification Failed.', 'wp-2fa' ) );
     238            }
     239            // $nonce = isset( $_POST['nonce'] ) ? \sanitize_text_field( \wp_unslash( $_POST['nonce'] ) ) : false;
     240            // Check nonce.
     241            if ( ! \current_user_can( 'manage_options' ) ) {
     242                \wp_send_json_error( esc_html__( 'Not enough privileges.', 'wp-2fa' ) );
     243            }
     244
     245            Settings_Utils::update_option( 'wp_2fa_survey_notice_needed', 0 );
     246
     247            \wp_send_json_success( \esc_html__( 'Complete.', 'wp-2fa' ) );
    139248        }
    140249

  • wp-2fa/trunk/includes/classes/Admin/SettingsPages/class-settings-page-general.php

    r3343451 r3359559  
    4343            self::disable_brute_force_settings();
    4444            self::limit_settings_access();
     45            self::disable_rest();
    4546            self::enable_rest();
    4647            self::remove_data_upon_uninstall();
    … …  
    6970                'limit_access',
    7071                'enable_rest',
     72                'disable_rest',
    7173                'brute_force_disable',
    7274                'delete_data_upon_uninstall',
    … …  
    8789                'limit_access',
    8890                'enable_rest',
     91                'disable_rest',
    8992                'brute_force_disable',
    9093                'delete_data_upon_uninstall',
    … …  
    9497                if ( ! in_array( $simple_setting, $settings_to_turn_into_bools, true ) ) {
    9598                    // Is item is not one of our possible settings we want to turn into a bool, process.
    96                     $output[ $simple_setting ] = ( isset( $input[ $simple_setting ] ) && ! empty( $input[ $simple_setting ] ) ) ? trim( (string) sanitize_text_field( $input[ $simple_setting ] ) ) : false;
     99                    $output[ $simple_setting ] = ( isset( $input[ $simple_setting ] ) && ! empty( $input[ $simple_setting ] ) ) ? trim( (string) \sanitize_text_field( $input[ $simple_setting ] ) ) : false;
    97100                } else {
    98101                    // This item is one we treat as a bool, so process correctly.
    99102                    $output[ $simple_setting ] = ( isset( $input[ $simple_setting ] ) && ! empty( $input[ $simple_setting ] ) ) ? true : false;
    100103                }
     104            }
     105
     106            if ( true === $output['disable_rest'] ) {
     107                $output['enable_rest'] = false;
    101108            }
    102109
    … …  
    258265         * @since 2.9.1
    259266         */
     267        private static function disable_rest() {
     268            ?>
     269            <br>
     270            <h3><?php \esc_html_e( 'Disable the REST API endpoints for 2FA', 'wp-2fa' ); ?></h3>
     271            <p class="description">
     272                <?php \esc_html_e( 'The WP 2FA REST API endpoints are enabled by default. They are used for integrations and do not impact your website’s performance, functionality, or security. If you prefer, you can disable these endpoints by using this setting.', 'wp-2fa' ); ?>
     273            </p>
     274            <table class="form-table">
     275                <tbody>
     276                    <tr>
     277                        <th><label for="disable_rest"></label></th>
     278                        <td>
     279                            <fieldset>
     280                                <input type="checkbox" id="disable_rest" name="wp_2fa_settings[disable_rest]" value="disable_rest"
     281                                <?php \checked( true, Settings_Utils::string_to_bool( WP2FA::get_wp2fa_general_setting( 'disable_rest' ) ) ); ?>
     282                                >
     283                                <label for="disable_rest"><?php \esc_html_e( 'disable the REST API endpoints', 'wp-2fa' ); ?></label>
     284                            </fieldset>
     285                        </td>
     286                    </tr>
     287                </tbody>
     288            </table>
     289                    <script type="text/javascript">
     290                        //<![CDATA[
     291                        jQuery(document).ready(function( $ ) {
     292                            jQuery( 'body' ).on( 'click', '#disable_rest', function ( e ) {
     293                                // e.preventDefault();
     294                                if ( jQuery(this).is(":checked"))  {
     295                                    jQuery('#select_verification_method').addClass('disabled');
     296                                } else {
     297                                    jQuery('#select_verification_method').removeClass('disabled');
     298                                }
     299                            });
     300                        });
     301                        //]]>
     302                    </script>
     303
     304            <?php
     305        }
     306
     307        /**
     308         * Enable REST API
     309         *
     310         * @return void
     311         *
     312         * @since 2.9.1
     313         */
    260314        private static function enable_rest() {
    261315            ?>
    262316            <br>
    263             <h3><?php \esc_html_e( 'Enable the REST API endpoints for 2FA', 'wp-2fa' ); ?></h3>
     317            <div id="select_verification_method" class=<?php echo \esc_attr( true === Settings_Utils::string_to_bool( WP2FA::get_wp2fa_general_setting( 'disable_rest' ) ) ? 'disabled' : '' ); ?>>
     318            <h3><?php \esc_html_e( 'Select the 2FA verification mechanism', 'wp-2fa' ); ?></h3>
    264319            <p class="description">
    265320                <?php \esc_html_e( 'Choose how WP 2FA verifies the 2FA by default. The native method works for most setups, but you can switch to REST API verification if needed. Only change this setting if you are experiencing issues with the default method.', 'wp-2fa' ); ?>
    … …  
    285340                </tbody>
    286341            </table>
     342        </div>
    287343            <?php
    288344        }

  • wp-2fa/trunk/includes/classes/Authenticator/class-reset-password.php

    r3343451 r3359559  
    4343         * @var string
    4444         *
    45          * @since 2.9.2
     45         * @since 2.9.3
    4646         */
    4747        private static $logging_attempts_meta_key = WP_2FA_PREFIX . 'api-reset-password-attempts';

  • wp-2fa/trunk/includes/classes/class-wp2fa.php

    r3343451 r3359559  
    213213            self::add_actions();
    214214
    215             Endpoints::init();
     215            if ( false === Settings_Utils::string_to_bool( self::get_wp2fa_general_setting( 'disable_rest' ) ) ) {
     216                Endpoints::init();
     217            }
    216218
    217219            // Inits all the additional free app extensions.

  • wp-2fa/trunk/languages/wp-2fa.pot

    r3343451 r3359559  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: WP 2FA - Two-factor authentication for WordPress 2.9.2\n"
     5"Project-Id-Version: WP 2FA - Two-factor authentication for WordPress 2.9.3\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/wp-2fa\n"
    77"Last-Translator: WP White Security <[email protected]>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2025-08-12T09:20:19+00:00\n"
     12"POT-Creation-Date: 2025-09-10T20:34:17+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.11.0\n"
    … …  
    371371#: extensions/twilio/class-twilio.php:349
    372372#: extensions/yubico/class-yubico.php:299
    373 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:147
     373#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:154
    374374#: includes/classes/Admin/SettingsPages/class-settings-page-policies.php:563
    375375#: includes/classes/Admin/SettingsPages/class-settings-page-white-label.php:37
    … …  
    10001000#: extensions/out-of-band/class-out-of-band.php:638
    10011001#: includes/classes/Admin/class-setup-wizard.php:634
    1002 #: includes/classes/class-wp2fa.php:582
    1003 #: includes/classes/class-wp2fa.php:596
    1004 #: includes/classes/class-wp2fa.php:606
     1002#: includes/classes/class-wp2fa.php:584
     1003#: includes/classes/class-wp2fa.php:598
     1004#: includes/classes/class-wp2fa.php:608
    10051005msgid "Email sent by"
    10061006msgstr ""
    … …  
    10081008#: extensions/out-of-band/class-out-of-band.php:639
    10091009#: includes/classes/Admin/class-setup-wizard.php:635
    1010 #: includes/classes/class-wp2fa.php:583
     1010#: includes/classes/class-wp2fa.php:585
    10111011msgid "WP 2FA plugin."
    10121012msgstr ""
    … …  
    13571357#: extensions/settings-import-export/class-settings-import-export.php:240
    13581358#: includes/classes/Admin/class-plugin-updated-notice.php:130
     1359#: includes/classes/Admin/Helpers/class-wp-helper.php:237
    13591360msgid "Nonce Verification Failed."
    13601361msgstr ""
    … …  
    24982499
    24992500#: includes/classes/Admin/class-plugin-updated-notice.php:135
     2501#: includes/classes/Admin/Helpers/class-wp-helper.php:247
    25002502msgid "Complete."
    25012503msgstr ""
    … …  
    27372739#: includes/classes/Admin/Helpers/class-ajax-helper.php:401
    27382740#: includes/classes/Admin/Helpers/class-ajax-helper.php:417
     2741#: includes/classes/Admin/Helpers/class-wp-helper.php:183
    27392742msgid "Dismiss this notice."
    27402743msgstr ""
    … …  
    31743177msgstr ""
    31753178
     3179#: includes/classes/Admin/Helpers/class-wp-helper.php:180
     3180msgid "Want to know what the state of WordPress security is in 2025?"
     3181msgstr ""
     3182
     3183#: includes/classes/Admin/Helpers/class-wp-helper.php:181
     3184msgid "Discover the latest insights in our 2025 WordPress Security Survey Report."
     3185msgstr ""
     3186
     3187#. Translators: survey link
     3188#: includes/classes/Admin/Helpers/class-wp-helper.php:189
     3189msgid "%1$sRead the survey%2$s"
     3190msgstr ""
     3191
     3192#: includes/classes/Admin/Helpers/class-wp-helper.php:242
     3193msgid "Not enough privileges."
     3194msgstr ""
     3195
    31763196#: includes/classes/Admin/Methods/class-backup-codes.php:181
    31773197#: includes/classes/Authenticator/class-login.php:1032
    … …  
    35183538msgstr ""
    35193539
    3520 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:194
     3540#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:201
    35213541msgid "Do you want to delete the plugin data from the database upon uninstall"
    35223542msgstr ""
    35233543
    3524 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:196
     3544#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:203
    35253545msgid "The plugin saves its settings in the WordPress database. By default the plugin settings are kept in the database so if it is installed again, you do not have to reconfigure the plugin. Enable this setting to delete the plugin settings from the database upon uninstall."
    35263546msgstr ""
    35273547
    3528 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:201
     3548#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:208
    35293549msgid "Delete data"
    35303550msgstr ""
    35313551
    3532 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:207
     3552#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:214
    35333553msgid "Delete data upon uninstall"
    35343554msgstr ""
    35353555
    3536 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:231
     3556#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:238
    35373557msgid "Limit 2FA settings access"
    35383558msgstr ""
    35393559
    3540 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:233
     3560#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:240
    35413561msgid "Use this setting to hide this plugin configuration area from all other admins."
    35423562msgstr ""
    35433563
    3544 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:238
     3564#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:245
    35453565msgid "Limit access to 2FA settings"
    35463566msgstr ""
    35473567
    3548 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:244
     3568#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:251
    35493569msgid "Hide settings from other administrators"
    35503570msgstr ""
    35513571
    3552 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:263
    3553 msgid "Enable the REST API endpoints for 2FA"
    3554 msgstr ""
    3555 
    3556 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:265
     3572#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:270
     3573msgid "Disable the REST API endpoints for 2FA"
     3574msgstr ""
     3575
     3576#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:272
     3577msgid "The WP 2FA REST API endpoints are enabled by default. They are used for integrations and do not impact your website’s performance, functionality, or security. If you prefer, you can disable these endpoints by using this setting."
     3578msgstr ""
     3579
     3580#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:283
     3581msgid "disable the REST API endpoints"
     3582msgstr ""
     3583
     3584#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:318
     3585msgid "Select the 2FA verification mechanism"
     3586msgstr ""
     3587
     3588#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:320
    35573589msgid "Choose how WP 2FA verifies the 2FA by default. The native method works for most setups, but you can switch to REST API verification if needed. Only change this setting if you are experiencing issues with the default method."
    35583590msgstr ""
    35593591
    3560 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:270
     3592#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:325
    35613593msgid "Select the default 2FA verification mechanism"
    35623594msgstr ""
    35633595
    3564 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:276
     3596#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:331
    35653597msgid "Native"
    35663598msgstr ""
    35673599
    3568 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:281
     3600#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:336
    35693601msgid "REST API"
    35703602msgstr ""
    35713603
    3572 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:300
     3604#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:356
    35733605msgid "Disable 2FA code brute force protection"
    35743606msgstr ""
    35753607
    3576 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:302
     3608#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:358
    35773609msgid "When using email and SMS 2FA, the plugin sends the users a new one-time code whenever they enter the wrong code when logging in. This is a security enhancement, a sort of brute force protection. You can disable this feature from the below setting, however, it is not recommended."
    35783610msgstr ""
    35793611
    3580 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:307
     3612#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:363
    35813613msgid "Disable one-time code brute force protection"
    35823614msgstr ""
    35833615
    35843616#. translators: support email.
    3585 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:334
     3617#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:390
    35863618msgid "Use this setting below to configure the properties of the two-factor authentication on your website and how users use it. If you have any questions send us an email at %1$s."
    35873619msgstr ""
    35883620
    3589 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:339
     3621#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:395
    35903622msgid "What should the plugin do if the 2FA method used during a user login is unavailable"
    35913623msgstr ""
    35923624
    3593 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:341
     3625#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:397
    35943626msgid "There may be cases in which the 2FA service is unavailable when a user is trying to log in. For example, the service is unreachable or there are no credits to complete the action. In this case you can configure the plugin to either block the login process, or allow the user to log in without 2FA authentication."
    35953627msgstr ""
    35963628
    3597 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:346
     3629#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:402
    35983630msgid "Select action"
    35993631msgstr ""
    36003632
    3601 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:353
     3633#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:409
    36023634msgid "Block the login."
    36033635msgstr ""
    36043636
    3605 #: includes/classes/Admin/SettingsPages/class-settings-page-general.php:361
     3637#: includes/classes/Admin/SettingsPages/class-settings-page-general.php:417
    36063638msgid "Allow the login without 2FA"
    36073639msgstr ""
    … …  
    40434075msgstr ""
    40444076
    4045 #: includes/classes/class-wp2fa.php:536
     4077#: includes/classes/class-wp2fa.php:538
    40464078msgid "Your login confirmation code for {site_name}"
    40474079msgstr ""
    40484080
    4049 #: includes/classes/class-wp2fa.php:538
    4050 #: includes/classes/class-wp2fa.php:554
     4081#: includes/classes/class-wp2fa.php:540
     4082#: includes/classes/class-wp2fa.php:556
    40514083msgid "Hello {user_display_name},"
    40524084msgstr ""
    40534085
    4054 #: includes/classes/class-wp2fa.php:539
     4086#: includes/classes/class-wp2fa.php:541
    40554087msgid "You are trying to log in to {site_name} using the username {user_login_name}. To complete your login, please enter the following one-time 2FA code:"
    40564088msgstr ""
    40574089
    4058 #: includes/classes/class-wp2fa.php:540
     4090#: includes/classes/class-wp2fa.php:542
    40594091msgid "{login_code}"
    40604092msgstr ""
    40614093
    4062 #: includes/classes/class-wp2fa.php:541
     4094#: includes/classes/class-wp2fa.php:543
    40634095msgid "Enter this code on the login page to finish the authentication process and access your account."
    40644096msgstr ""
    40654097
    4066 #: includes/classes/class-wp2fa.php:542
    4067 #: includes/classes/class-wp2fa.php:563
     4098#: includes/classes/class-wp2fa.php:544
     4099#: includes/classes/class-wp2fa.php:565
    40684100msgid "This request was made from IP address {user_ip_address}. If you did not request this, please contact the site administrator at {admin_email}."
    40694101msgstr ""
    40704102
    4071 #: includes/classes/class-wp2fa.php:543
     4103#: includes/classes/class-wp2fa.php:545
    40724104msgid "If you encounter any other issues logging in, feel free to contact us at {admin_email}."
    40734105msgstr ""
    40744106
    4075 #: includes/classes/class-wp2fa.php:544
     4107#: includes/classes/class-wp2fa.php:546
    40764108msgid ""
    40774109"Kind regards,\n"
    … …  
    40794111msgstr ""
    40804112
    4081 #: includes/classes/class-wp2fa.php:552
     4113#: includes/classes/class-wp2fa.php:554
    40824114msgid "Your 2FA Setup Verification Code for {site_name}"
    40834115msgstr ""
    40844116
    4085 #: includes/classes/class-wp2fa.php:555
     4117#: includes/classes/class-wp2fa.php:557
    40864118msgid "You have requested to set up two-factor authentication for your user {user_login_name} on the website {site_name} ({site_url})."
    40874119msgstr ""
    40884120
    40894121#. translators: The login code provided from the plugin.
    4090 #: includes/classes/class-wp2fa.php:559
     4122#: includes/classes/class-wp2fa.php:561
    40914123msgid "Please enter the following code to complete your setup: %1$1s"
    40924124msgstr ""
    40934125
    4094 #: includes/classes/class-wp2fa.php:564
    4095 #: includes/classes/class-wp2fa.php:581
    4096 #: includes/classes/class-wp2fa.php:596
     4126#: includes/classes/class-wp2fa.php:566
     4127#: includes/classes/class-wp2fa.php:583
     4128#: includes/classes/class-wp2fa.php:598
    40974129msgid "Thank you."
    40984130msgstr ""
    40994131
    4100 #: includes/classes/class-wp2fa.php:565
     4132#: includes/classes/class-wp2fa.php:567
    41014133msgid "The {site_name} Team"
    41024134msgstr ""
    41034135
    4104 #: includes/classes/class-wp2fa.php:569
     4136#: includes/classes/class-wp2fa.php:571
    41054137msgid "Your user on {site_name} has been locked"
    41064138msgstr ""
    41074139
    4108 #: includes/classes/class-wp2fa.php:571
     4140#: includes/classes/class-wp2fa.php:573
    41094141msgid "Hello."
    41104142msgstr ""
    41114143
    41124144#. translators: %2s - the name of the site.
    4113 #: includes/classes/class-wp2fa.php:575
     4145#: includes/classes/class-wp2fa.php:577
    41144146msgid "Since you have not enabled two-factor authentication for the user %1$1s on the website %2$2s within the grace period, your account has been locked."
    41154147msgstr ""
    41164148
    4117 #: includes/classes/class-wp2fa.php:580
     4149#: includes/classes/class-wp2fa.php:582
    41184150msgid "Contact your website administrator to unlock your account."
    41194151msgstr ""
    41204152
    4121 #: includes/classes/class-wp2fa.php:587
     4153#: includes/classes/class-wp2fa.php:589
    41224154msgid "Your user on {site_name} has been unlocked"
    41234155msgstr ""
    41244156
    4125 #: includes/classes/class-wp2fa.php:590
    4126 #: includes/classes/class-wp2fa.php:602
     4157#: includes/classes/class-wp2fa.php:592
     4158#: includes/classes/class-wp2fa.php:604
    41274159msgid "Hello,"
    41284160msgstr ""
    41294161
    4130 #: includes/classes/class-wp2fa.php:590
     4162#: includes/classes/class-wp2fa.php:592
    41314163msgid "Your user"
    41324164msgstr ""
    41334165
    4134 #: includes/classes/class-wp2fa.php:590
    4135 #: includes/classes/class-wp2fa.php:602
     4166#: includes/classes/class-wp2fa.php:592
     4167#: includes/classes/class-wp2fa.php:604
    41364168msgid "on the website"
    41374169msgstr ""
    41384170
    4139 #: includes/classes/class-wp2fa.php:590
     4171#: includes/classes/class-wp2fa.php:592
    41404172msgid "has been unlocked. Please configure two-factor authentication within the grace period, otherwise your account will be locked again."
    41414173msgstr ""
    41424174
    4143 #: includes/classes/class-wp2fa.php:593
     4175#: includes/classes/class-wp2fa.php:595
    41444176msgid "You can configure 2FA from this page:"
    41454177msgstr ""
    41464178
    4147 #: includes/classes/class-wp2fa.php:596
    4148 #: includes/classes/class-wp2fa.php:606
     4179#: includes/classes/class-wp2fa.php:598
     4180#: includes/classes/class-wp2fa.php:608
    41494181msgid "WP 2FA plugin"
    41504182msgstr ""
    41514183
    4152 #: includes/classes/class-wp2fa.php:599
     4184#: includes/classes/class-wp2fa.php:601
    41534185msgid "2FA backup codes for user {user_login_name} on {site_name}"
    41544186msgstr ""
    41554187
    4156 #: includes/classes/class-wp2fa.php:602
     4188#: includes/classes/class-wp2fa.php:604
    41574189msgid "Below please find the 2FA backup codes for your user"
    41584190msgstr ""
    41594191
    4160 #: includes/classes/class-wp2fa.php:602
     4192#: includes/classes/class-wp2fa.php:604
    41614193msgid "The website's URL is"
    41624194msgstr ""
    41634195
    4164 #: includes/classes/class-wp2fa.php:606
     4196#: includes/classes/class-wp2fa.php:608
    41654197msgid "Thank you for enabling 2FA on your account and helping us keeping the website secure."
    41664198msgstr ""
    41674199
    4168 #: includes/classes/class-wp2fa.php:751
     4200#: includes/classes/class-wp2fa.php:753
    41694201msgid "Reconfigure"
    41704202msgstr ""
    41714203
    4172 #: includes/classes/class-wp2fa.php:751
     4204#: includes/classes/class-wp2fa.php:753
    41734205msgid "Configure"
    41744206msgstr ""
    41754207
    41764208#. translators: The username.
    4177 #: includes/classes/class-wp2fa.php:951
     4209#: includes/classes/class-wp2fa.php:953
    41784210msgid "User %1$s logged in without 2FA"
    41794211msgstr ""
    41804212
    41814213#. translators: the site name.
    4182 #: includes/classes/class-wp2fa.php:961
     4214#: includes/classes/class-wp2fa.php:963
    41834215msgid "2FA is enforced on the user %1$s on the website %2$s. However, since the WP 2FA plugin has not been configured properly it cannot enforce the user to configure 2FA, so the user logged in without 2FA."
    41844216msgstr ""
    41854217
    41864218#. translators: the support e-mail.
    4187 #: includes/classes/class-wp2fa.php:971
     4219#: includes/classes/class-wp2fa.php:973
    41884220msgid "To enforce 2FA on users logging in from non default WordPress login pages please configure the %1$s. If you need assistance, please contact us at %2$s."
    41894221msgstr ""
    41904222
    4191 #: includes/classes/class-wp2fa.php:1162
     4223#: includes/classes/class-wp2fa.php:1164
    41924224msgid "For security reasons WP 2FA needs to store the private key in the wp-config.php file. However, it is unable to. This can happen because of restrictive permissions, or the file is not in the default location. To fix this you can:"
    41934225msgstr ""
    41944226
    4195 #: includes/classes/class-wp2fa.php:1163
     4227#: includes/classes/class-wp2fa.php:1165
    41964228msgid "Option A) allow the plugin to write to the wp-config.php file temporarily by changing the wp-config.php permissions to 755. Once ready, click the button to proceed."
    41974229msgstr ""
    41984230
    4199 #: includes/classes/class-wp2fa.php:1164
     4231#: includes/classes/class-wp2fa.php:1166
    42004232msgid "Option B) Add the encryption key to the wp-config.php file yourself by "
    42014233msgstr ""
    42024234
    4203 #: includes/classes/class-wp2fa.php:1165
     4235#: includes/classes/class-wp2fa.php:1167
    42044236msgid "following these instructions."
    42054237msgstr ""
    42064238
    4207 #: includes/classes/class-wp2fa.php:1166
     4239#: includes/classes/class-wp2fa.php:1168
    42084240msgid "Once you complete any of the above, please click the button below."
    42094241msgstr ""
    42104242
    4211 #: includes/classes/class-wp2fa.php:1171
     4243#: includes/classes/class-wp2fa.php:1173
    42124244msgid "Write key to file now / Check for the key in file"
    42134245msgstr ""
    42144246
    4215 #: includes/classes/class-wp2fa.php:1173
     4247#: includes/classes/class-wp2fa.php:1175
    42164248msgid "I am aware of the risks. Please do not alert me again about this."
    42174249msgstr ""
    … …  
    43664398msgstr ""
    43674399
    4368 #: wp-2fa.php:264
     4400#: wp-2fa.php:265
    43694401msgid "This plugin requires OpenSSL. Contact your web host or website administrator so they can enable OpenSSL. Re-activate the plugin once the library has been enabled."
    43704402msgstr ""

  • wp-2fa/trunk/readme.txt

    r3343451 r3359559  
    77Requires at least: 5.5
    88Tested up to: 6.8.2
    9 Stable tag: 2.9.2
     9Stable tag: 2.9.3
    1010Requires PHP: 7.4.0
    1111
    … …  
    136136== Changelog ==
    137137
    138 = 2.9.2 (2025-08-12) =
    139 
    140 * **Plugin & functionality improvements**
    141     * REST API endpoints are now enabled by default.
    142     * Added a new setting to choose how OTP verification is handled — via the legacy (native) method or through REST API.
    143     * Introduced a timeout/limit on the “Resend code” option in the “2FA required on password resets” feature to prevent email abuse.
    144     * Enhanced email templates with more relevant content and improved anti-spam scoring.
    145     * Added default WP 2FA branding to all email templates in the Free edition.
    146     * Refined the help text descriptions in several areas of the plugin.
    147 
    148 * **Bug fixes**
    149     * Removed an email template from the Free edition (reserved for Premium edition).
    150     * Fixed an issue in the “2FA required on password resets” feature where the wrong email template was sent when using the “Resend code” button.
    151 
    152 = 2.9.1 (2025-08-01) =
    153 
    154 * **Plugin & functionality improvements**
    155      * Switched 2FA operations back to native (pre 2.9.0).
    156      * Added a setting to manually enable / disable the REST API endpoints.
    157 
    158  * **Bug fixes**
    159      * Fixed: configured user's 2FA methods not showing in the My Account WooCommerce portal.   
    160 
    161 = 2.9.0 (2025-07-31) =
    162 
    163 * **New features**
    164      * REST API endpoints for 2FA code verification and other operations, thus making it much easier to integrate the plugin in custom processes.
    165      * Option to allow temporary login without 2FA for a specific user or number of users.
    166      * New filter _wp_2fa_oob_redirect_url_ to assist with user redirection post-login when Link via email (OOB) 2FA method is in use.
    167      * Quick Links section with useful inks.
     138= 2.9.3 (2025-09-11) =
    168139
    169140 * **Plugin & functionality improvements**
    170      * Bumped up the minimum supported PHP version from 7.3 to 7.4.
    171      * Bumped up the minimum supported WordPress Core version from  5.0 to 5.5.
    172      * Better support for setups in which access to the wp-login.php file is restricted or denied.
    173      * Plugin no longer supports 2FA enforcement on users without any role, to adhere to the new Wordpress core changes.
    174      * Improved performance: plugin now better loads and handles it's files and scripts .
    175      * Updated the 2FA setup wizard UI – available methods are now displayed vertically for improved readability and layout consistency.
    176      * Changed the default template of the 2FA code email for improved email deliverability (new installs only).
    177      * Tweaked the redirection of users on Woocommerce to cater for latest Woocommerce version, ensuing correct and consistent redirection flow post-login.
    178      * White Labeling - added option to enable help text to assist users during 2FA configuration for all methods.
    179      * White Labeling - Changed the placeholder title on the 2FA code page text to "Verification code" for consistency.
    180      * White Labeling - added a new white labeling option to enable/disable our plugin's signature from the 2FA Frontend configuration page.
    181      * White Labeling - made more wizard elements translatable by assisting with localizing text inside JS elements.
    182      * White Labeling - Tweaked the 2FA page code elements by introducing new unique classes, to make it easier for users to customize their logo with the right size and format.
    183      * Switched the default setting for HOTP to now allow users to use another email address during configuration.
    184      * Removed old links and imagery related to Captcha 4WP plugin.
    185      * Added [Melapress Role Editor](https://melapress.com/wordpress-user-roles-editor/) in the About Us page.
    186      * Reviewed all links in the plugin; fixed few broken links and added UTM parameters.
    187      * Tweaked the UI inside a few wizards and plugin pages to avoid orphaned words or hanging elements.
    188      * When "Log out users after 2FA configuration" is enabled, users are no longer logged out after they configure a backup method only.
    189      * Made the 2FA notice regarding WP 2FA Encrypt key storage in wp-config.php dismissable.
    190      * Authy method was removed from the setup wizard - service is being decommissioned by Twilio.
    191      * Added our own custom libraries for Twilio integration, replacing the official SDK for improved performance and reduced dependencies.
    192      * Removed the "User licensing" tab from the Settings which was redundant (used by the old licensing model).
    193      * Improved the code that retrieves the number of subsites on a multisite network.
    194      * Woocommerce Integration - 2FA Configuration page from My Account dashboard is now correctly positioned above the Log Out button.
    195      * Yubico method will now show up in 2FA method selection wizard even when it's the only method enabled.
    196      * Removed a redundant wizard steps when only one method was active (Yubico) for a smoother process.
    197      * Updated the text and layout of the Yubikey configuration wizard.
    198 
    199  * **Bug fixes**
    200      * Fixed a PHP Notice "Function _load_textdomain_just_in_time" which could constantly occur in certain site setups .
    201      * Translations: Fixed an edge case where Admin settings switch to Dutch once .po files are loaded, preventing the inheritance of actual site language.
    202      * Fixed a bug causing the WordPress logo to be hidden on the 2FA code page in the Premium edition of WP 2FA.
    203      * Fixed a scenario where users could see the "Remove 2FA" button on their profile page even though 2FA was enforced and no grace period was allowed.
    204      * Fixed a handful of user role Inheritance issues which were causing some 2FA policies to not be correctly enforced to certain roles.
    205      * Fixed an error which could occur when redirecting a user to a non-existent URL after configuring 2FA.
    206      * Fixed a variety of PHP warnings related to Yubico, the out of band 2FA method, and the Reports page.
    207      * Fixed a bug which could prevent users with SMS via Clickatell to use a backup code via email to log in.
    208      * Fixed a bug which was causing the "grace period time left" shortcode to always show time in UTC format instead of site's timezone.
    209      * Fixed a bug in which users using Yubico as primary method were unable to configure the email backup method.
    210      * Added a check to avoid the plugin from writing multiple comments inside the wp-config.php file when the file is refreshed by third parties.
    211      * Fixed a PHP deprecation: Function _print_emoji_styles_ which occured on fresh installations.
    212      * Fixed a user reported edge case error involving WP 2FA and Paid Membership plugin when Authy 2FA method was in use.
    213      * Fixed a scenario where the user could get locked out even though the setting to lock users with exceeded grace period was disabled.
    214      * Fixed a user-reported PHP error - Uncaught Error: Call to a member function get_page_permastruct() on null.
    215      * Fixed a some user-reported PHP errors that could occur inside Reports page under very specific circumstances.
    216      * Fixed a UI glitch which could cause users to be prompted with "This page is asking you to confirm that you want to leave - information you've entered may not be saved." when configuring 2FA.
    217      * Fixed a PHP 8.4 Deprecated notice: WP2FA_Vendor\BaconQrCode\Encoder\Encoder::chooseMode().
    218      * Fixed a number of issues on how the 2FA frontend configuration pages are created on each subsite on a multisite nework.
    219      * Fixed a shortcode behavior _{from_email}_ which was pulling the site admin email instead of the actual From email address.
    220      * Fixed a user-reported edge case that could intermittently cause the wrong 2FA method to be selected during configuration, loading OTP via email wizard instead of the Authenticator app.
    221      * Fixed a scenario where users with multiple roles on multiple websites have 2FA removed if "No role for this website" is selected.
     141     * Added a new setting to disable the REST API endpoints.
    222142   
    223143Refer to the complete [plugin changelog](https://melapress.com/support/kb/wp-2fa-plugin-changelog/?utm_source=wordpress.org&utm_medium=referral&utm_campaign=WP2FA&utm_content=plugin+repos+description) for more detailed information about what was new, improved and fixed in previous version updates of WP 2FA.

  • wp-2fa/trunk/vendor/autoload.php

    r3343451 r3359559  
    2020require_once __DIR__ . '/composer/autoload_real.php';
    2121
    22 return ComposerAutoloaderInit23271::getLoader();
     22return ComposerAutoloaderInit28365::getLoader();

  • wp-2fa/trunk/vendor/composer/autoload_real.php

    r3343451 r3359559  
    33// autoload_real.php @generated by Composer
    44
    5 class ComposerAutoloaderInit23271
     5class ComposerAutoloaderInit28365
    66{
    77    private static $loader;
    … …  
    2525        require __DIR__ . '/platform_check.php';
    2626
    27         spl_autoload_register(array('ComposerAutoloaderInit23271', 'loadClassLoader'), true, true);
     27        spl_autoload_register(array('ComposerAutoloaderInit28365', 'loadClassLoader'), true, true);
    2828        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
    29         spl_autoload_unregister(array('ComposerAutoloaderInit23271', 'loadClassLoader'));
     29        spl_autoload_unregister(array('ComposerAutoloaderInit28365', 'loadClassLoader'));
    3030
    3131        require __DIR__ . '/autoload_static.php';
    32         call_user_func(\Composer\Autoload\ComposerStaticInit23271::getInitializer($loader));
     32        call_user_func(\Composer\Autoload\ComposerStaticInit28365::getInitializer($loader));
    3333
    3434        $loader->register(true);

  • wp-2fa/trunk/vendor/composer/autoload_static.php

    r3343451 r3359559  
    55namespace Composer\Autoload;
    66
    7 class ComposerStaticInit23271
     7class ComposerStaticInit28365
    88{
    99    public static $prefixLengthsPsr4 = array (
    … …  
    217217    {
    218218        return \Closure::bind(function () use ($loader) {
    219             $loader->prefixLengthsPsr4 = ComposerStaticInit23271::$prefixLengthsPsr4;
    220             $loader->prefixDirsPsr4 = ComposerStaticInit23271::$prefixDirsPsr4;
    221             $loader->classMap = ComposerStaticInit23271::$classMap;
     219            $loader->prefixLengthsPsr4 = ComposerStaticInit28365::$prefixLengthsPsr4;
     220            $loader->prefixDirsPsr4 = ComposerStaticInit28365::$prefixDirsPsr4;
     221            $loader->classMap = ComposerStaticInit28365::$classMap;
    222222
    223223        }, null, ClassLoader::class);

  • wp-2fa/trunk/wp-2fa.php

    r3343451 r3359559  
    88 * @wordpress-plugin
    99 * Plugin Name: WP 2FA - Two-factor authentication for WordPress
    10  * Version:     2.9.2
     10 * Version:     2.9.3
    1111 * Plugin URI:  https://melapress.com/
    1212 * Description: Easily add an additional layer of security to your WordPress login pages. Enable Two-Factor Authentication for you and all your website users with this easy to use plugin.
    … …  
    5353}
    5454
     55\add_action( 'doing_it_wrong_trigger_error', 'wp_2fa_trigger_error', 10, 4 );
     56\add_action( 'doing_it_wrong_run', 'wp_2fa_action_doing_it_wrong_run', 0, 3 );
     57\add_action( 'doing_it_wrong_run', 'wp_2fa_action_doing_it_wrong_run', 20, 3 );
     58\add_action( 'aadvana_trigger_error_doing_it_wrong', 'wp_2fa_trigger_error', 0, 4 );
     59
    5560// Useful global constants.
    5661if ( ! defined( 'WP_2FA_VERSION' ) ) {
    57     define( 'WP_2FA_VERSION', '2.9.2' );
     62    define( 'WP_2FA_VERSION', '2.9.3' );
    5863    define( 'WP_2FA_BASE', plugin_basename( __FILE__ ) );
    5964    define( 'WP_2FA_URL', plugin_dir_url( __FILE__ ) );
    … …  
    156161);
    157162
    158 \add_action( 'doing_it_wrong_trigger_error', 'wp_2fa_trigger_error', 10, 4 );
    159 \add_action( 'doing_it_wrong_run', 'wp_2fa_action_doing_it_wrong_run', 0, 3 );
    160 \add_action( 'doing_it_wrong_run', 'wp_2fa_action_doing_it_wrong_run', 20, 3 );
    161 
    162163if ( ! function_exists( 'wp_2f_is_just_in_time_for_2fa_domain' ) ) {
    163164    /**
Note: See TracChangeset for help on using the changeset viewer.