← All changes | src/controller/class-two-factor.php +72 -73 5.7.1 → 6.3.0 View file →

		@@ -99,15 +99,8 @@
99	99	/**
100	100	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
101	101	*/
102	102	public function __construct() {
103		- $this->register_page(
104		- esc_html__( '2FA', 'defender-security' ),
105		- $this->slug,
106		- array( $this, 'main_view' ),
107		- $this->parent_slug
108		- );
109		- add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ) );
110	103	$this->register_routes();
111	104	$this->service = wd_di()->get( Two_Fa_Component::class );
112	105	$this->model = wd_di()->get( Two_Fa::class );
113	106	$this->password_protection_service = wd_di()->get( Password_Protection_Service::class );
		@@ -118,9 +111,9 @@
118	111	if ( $this->model->is_active() ) {
119	112	require_once ABSPATH . 'wp-admin/includes/plugin.php';
120	113	$is_jetpack_sso = $this->service->is_jetpack_sso();
121	114	$is_tml = $this->service->is_tml();
122		- add_action( 'admin_init', array( $this->service, 'get_providers' ) );
	115	+ add_action( 'admin_init', array( $this, 'load_providers' ) );
123	116	add_action( 'pre_get_users', array( $this, 'filter_users_by_2fa' ) );
124	117	add_action( 'show_user_profile', array( $this, 'show_user_profile' ) );
125	118	add_action( 'profile_update', array( $this, 'profile_update' ) );
126	119
		@@ -180,8 +173,17 @@
180	173	}
181	174	}
182	175
183	176	/**
	177	+ * Loads the available service providers.
	178	+ *
	179	+ * @return void
	180	+ */
	181	+ public function load_providers(): void {
	182	+ $this->service->get_providers();
	183	+ }
	184	+
	185	+ /**
184	186	* Checks if WooCommerce integration is enabled.
185	187	*
186	188	* @return bool Whether WooCommerce integration is enabled.
187	189	*/
		@@ -336,8 +338,9 @@
336	338	} elseif ( $this->password_protection_service->is_force_reset( $user ) ) {
337	339	$this->password_protection_service->do_force_reset( $user, $password );
338	340	} else {
339	341	$user_id = $user->ID;
	342	+ // For the Webauthn method, the check occurs inside Webauthn_Controller::verify_response().
340	343	// Set active user.
341	344	wp_set_current_user( $user_id, $user->user_login );
342	345	// Todo: add code for 'rememberme'-option.
343	346	wp_set_auth_cookie( $user_id, true );
		@@ -349,9 +352,10 @@
349	352	* @param string $auth_method @since 3.4.0
350	353	*/
351	354	do_action( 'wpmu_2fa_login', $user_id, $auth_method );
352	355
353		- if ( ! empty( defender_get_data_from_request( 'interim-login', 'r' ) ) ) {
	356	+ $interim_login = defender_get_data_from_request( 'interim-login', 'r' );
	357	+ if ( is_string( $interim_login ) && '' !== trim( $interim_login ) ) {
354	358	$params['interim_login'] = 'success';
355	359	$params['message'] = '<p class="message">' . esc_html__( 'You have logged in successfully.', 'defender-security' ) . '</p>';
356	360	$this->render_otp_screen( $params );
357	361	exit;
		@@ -371,9 +375,9 @@
371	375	$lockout_message = $this->service->verify_attempt( $user->ID, Totp::$slug );
372	376
373	377	$params['error'] = new WP_Error(
374	378	'opt_fail',
375		- empty( $lockout_message )
	379	+ '' === trim( $lockout_message )
376	380	? esc_html__( 'Whoops, the passcode you entered was incorrect or expired.', 'defender-security' )
377	381	: $lockout_message
378	382	);
379	383	$this->render_otp_screen( $params );
		@@ -408,12 +412,12 @@
408	412	*/
409	413	public function maybe_show_otp_form( $user, string $username, string $password ) {
410	414	if (
411	415	! is_user_logged_in()
412		- && ! empty( $user ) && ! empty( $password ) && $user instanceof WP_User
	416	+ && '' !== trim( $password ) && $user instanceof WP_User
413	417	&& wp_check_password( $password, $user->data->user_pass, $user->ID )
414	418	&& $this->service->is_auth_enable_for( $user, $this->model->user_roles )
415		- && ! empty( $this->service->get_available_providers_for_user( $user ) )
	419	+ && array() !== $this->service->get_available_providers_for_user( $user )
416	420	) {
417	421	$params = array();
418	422	$cookie = Array_Cache::get( 'auth_cookie', 'two_fa' );
419	423	if ( null !== $cookie ) {
		@@ -429,9 +433,11 @@
429	433	$params['user_id'] = $user->ID;
430	434	// Get default provider.
431	435	$params['default_slug'] = $this->service->get_default_provider_slug_for_user( $user->ID );
432	436	if ( Fallback_Email::$slug === $params['default_slug'] ) {
433		- $result = $this->service->send_otp_to_email( $params['token'], $user->ID );
	437	+ $user_id = isset( $user->ID ) ? $user->ID : 0;
	438	+ $user_id = is_int( $user_id ) ? $user_id : (int) $user_id;
	439	+ $result = $this->service->send_otp_to_email( $params['token'], $user_id );
434	440	if ( is_wp_error( $result ) ) {
435	441	$params['error'] = $result;
436	442	$this->render_otp_screen( $params );
437	443	}
		@@ -459,16 +465,19 @@
459	465	$params['error'] = null;
460	466	}
461	467
462	468	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
463		- $custom_graphic = '';
464		- $custom_graphic_type = '';
465		- if ( $this->is_pro() && $this->model->custom_graphic ) {
466		- $custom_graphic_type = $this->model->custom_graphic_type;
467		- if ( Two_Fa::CUSTOM_GRAPHIC_TYPE_UPLOAD === $custom_graphic_type && ! empty( $this->model->custom_graphic_url ) ) {
468		- $custom_graphic = $this->model->custom_graphic_url;
469		- } elseif ( Two_Fa::CUSTOM_GRAPHIC_TYPE_LINK === $custom_graphic_type && ! empty( $this->model->custom_graphic_link ) ) {
470		- $custom_graphic = $this->model->custom_graphic_link;
	469	+ $params['custom_graphic'] = '';
	470	+ $params['custom_graphic_type'] = $this->model->custom_graphic_type;
	471	+ $custom_graphic = '';
	472	+ $custom_graphic_type = $this->model->custom_graphic_type;
	473	+ $custom_graphic_url = trim( $this->model->custom_graphic_url );
	474	+ $custom_graphic_link = trim( $this->model->custom_graphic_link );
	475	+ if ( $this->model->custom_graphic ) {
	476	+ if ( Two_Fa::CUSTOM_GRAPHIC_TYPE_UPLOAD === $custom_graphic_type && '' !== $custom_graphic_url ) {
	477	+ $custom_graphic = $custom_graphic_url;
	478	+ } elseif ( Two_Fa::CUSTOM_GRAPHIC_TYPE_LINK === $custom_graphic_type && '' !== $custom_graphic_link ) {
	479	+ $custom_graphic = $custom_graphic_link;
471	480	}
472	481	}
473	482
474	483	$params['custom_graphic'] = $custom_graphic;
		@@ -484,9 +493,9 @@
484	493	$user = get_user_by( 'id', $params['user_id'] );
485	494	if ( is_object( $user ) ) {
486	495	$params['providers'] = $this->service->get_available_providers_for_user( $user );
487	496	// Get default provider.
488		- if ( empty( $params['default_slug'] ) ) {
	497	+ if ( ! isset( $params['default_slug'] ) || ! is_string( $params['default_slug'] ) || '' === trim( $params['default_slug'] ) ) {
489	498	$params['default_slug'] = $this->service->get_default_provider_slug_for_user( $user->ID );
490	499	}
491	500	}
492	501	}
		@@ -541,9 +550,9 @@
541	550	array(
542	551	'admin_url' => admin_url( 'admin-ajax.php' ),
543	552	'nonce' => wp_create_nonce( 'wpdef_webauthn' ),
544	553	'i18n' => $webauthn_controller->get_translations(),
545		- 'username' => ! empty( $user->user_login ) ? $user->user_login : '',
	554	+ 'username' => isset( $user->user_login ) && is_string( $user->user_login ) && '' !== trim( $user->user_login ) ? $user->user_login : '',
546	555	'provider_slug' => Webauthn::$slug,
547	556	)
548	557	);
549	558	}
		@@ -554,9 +563,10 @@
554	563	// Add a dummy values to avoid displaying errors, e.g. for the case with null.
555	564	'route' => $this->check_route( $routes['send_backup_code'] ?? 'test' ),
556	565	);
557	566	// If user's session has expired add a new 'interimlogin'-arg.
558		- if ( ! empty( defender_get_data_from_request( 'interim-login', 'r' ) ) ) {
	567	+ $interim_login = defender_get_data_from_request( 'interim-login', 'r' );
	568	+ if ( is_string( $interim_login ) && '' !== trim( $interim_login ) ) {
559	569	$args['interimlogin'] = 'yes';
560	570	}
561	571	$params['action_fallback_email'] = add_query_arg( $args, admin_url( 'admin-ajax.php' ) );
562	572
		@@ -600,9 +610,9 @@
600	610	// Remove new secret key.
601	611	delete_user_meta( $user_id, Totp::TOTP_SODIUM_SECRET_KEY );
602	612	// Remove TOTP from enabled providers.
603	613	$enabled_providers = get_user_meta( $user_id, Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY, true );
604		- if ( ! empty( $enabled_providers ) ) {
	614	+ if ( is_array( $enabled_providers ) && array() !== $enabled_providers ) {
605	615	foreach ( $enabled_providers as $key => $slug ) {
606	616	if ( Totp::$slug === $slug ) {
607	617	unset( $enabled_providers[ $key ] );
608	618	break;
		@@ -613,9 +623,9 @@
613	623	}
614	624	update_user_meta( $user_id, Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY, $enabled_providers );
615	625	// Check the default provider. If it's TOTP then clear the value.
616	626	$default_provider = get_user_meta( $user_id, Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY, true );
617		- if ( ! empty( $default_provider ) && Totp::$slug === $default_provider ) {
	627	+ if ( is_string( $default_provider ) && '' !== trim( $default_provider ) && Totp::$slug === $default_provider ) {
618	628	update_user_meta( $user_id, Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY, '' );
619	629	}
620	630
621	631	return new Response( true, array() );
		@@ -632,9 +642,9 @@
632	642	* @defender_route
633	643	* @is_public
634	644	* @throws SodiumException Exceptions thrown by the sodium functions.
635	645	*/
636		- public function verify_otp_for_enabling( Request $request ) {
	646	+ public function verify_otp_for_enabling( Request $request ): Response {
637	647	if ( is_user_logged_in() ) {
638	648	$data = $request->get_data();
639	649	$otp = isset( $data['otp'] ) ? sanitize_text_field( $data['otp'] ) : false;
640	650	if ( false === $otp || strlen( $otp ) < 6 ) {
		@@ -673,9 +683,9 @@
673	683	$this->service->enable_otp( $user_id );
674	684	$totp_slug = Totp::$slug;
675	685	// Add TOTP to enabled providers.
676	686	$enabled_providers = get_user_meta( $user_id, Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY, true );
677		- if ( isset( $enabled_providers ) && ! empty( $enabled_providers ) ) {
	687	+ if ( is_array( $enabled_providers ) && array() !== $enabled_providers ) {
678	688	// Array of enabled providers is not empty now.
679	689	if ( ! in_array( Totp::$slug, $enabled_providers, true ) ) {
680	690	$enabled_providers[] = $totp_slug;
681	691	update_user_meta( $user_id, Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY, $enabled_providers );
		@@ -685,9 +695,9 @@
685	695	update_user_meta( $user_id, Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY, array( $totp_slug ) );
686	696	}
687	697	// If no default provider then add TOTP as it.
688	698	$default_provider = get_user_meta( $user_id, Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY, true );
689		- if ( empty( $default_provider ) ) {
	699	+ if ( ! is_string( $default_provider ) || '' === trim( $default_provider ) ) {
690	700	update_user_meta( $user_id, Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY, $totp_slug );
691	701	}
692	702
693	703	return new Response( true, array() );
		@@ -697,8 +707,9 @@
697	707	array( 'message' => esc_html__( 'Your OTP code is incorrect. Please try again.', 'defender-security' ) )
698	708	);
699	709	}
700	710	}
	711	+ return new Response( true, array() );
701	712	}
702	713
703	714	/**
704	715	* Clear 2FA providers for the given user.
		@@ -730,9 +741,9 @@
730	741	}
731	742	// Remove empty elements.
732	743	$checked_providers = array_diff( $post_data[ Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY ], array( '' ) );
733	744	// If no option is checked then the values for default provider and enabled providers are cleared.
734		- if ( empty( $checked_providers ) ) {
	745	+ if ( array() === $checked_providers ) {
735	746	$this->clear_providers( $user_id );
736	747
737	748	return;
738	749	}
		@@ -740,9 +751,9 @@
740	751	$providers = $this->service->get_providers();
741	752	// For Fallback-Email method: the email value should be not empty and valid.
742	753	if ( in_array( Fallback_Email::$slug, $checked_providers, true ) ) {
743	754	$email = HTTP::post( 'def_2fa_backup_email' );
744		- if ( ! empty( $email ) && filter_var( $email, FILTER_VALIDATE_EMAIL ) ) {
	755	+ if ( is_string( $email ) && '' !== trim( $email ) && filter_var( $email, FILTER_VALIDATE_EMAIL ) ) {
745	756	update_user_meta( $user_id, Fallback_Email::FALLBACK_EMAIL_KEY, $email );
746	757	} else {
747	758	unset( $checked_providers[ Fallback_Email::$slug ] );
748	759	}
		@@ -756,9 +767,9 @@
756	767	unset( $checked_providers[ $key ] );
757	768	}
758	769	}
759	770	// Case when WebAuthn is checked but no registered devices OR Fallback_Email has an invalid email value.
760		- if ( empty( $checked_providers ) ) {
	771	+ if ( array() === $checked_providers ) {
761	772	$this->clear_providers( $user_id );
762	773
763	774	return;
764	775	}
		@@ -781,9 +792,9 @@
781	792	do_action( 'wd_2fa_enabled_provider_slugs', $enabled_providers );
782	793	// Default provider must be enabled.
783	794	$default_provider = $post_data[ Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY ] ?? '';
784	795	// The case#1 when all 2fa providers were deactivated before.
785		- if ( empty( $default_provider ) ) {
	796	+ if ( ! is_string( $default_provider ) || '' === trim( $default_provider ) ) {
786	797	$default_provider = $enabled_providers[0];
787	798	}
788	799	// The case#2 when prev default provider is deactivated and another one is activated.
789	800	if ( ! in_array( $default_provider, $checked_providers, true ) ) {
		@@ -803,9 +814,9 @@
803	814	*/
804	815	public function show_user_profile( WP_User $user ): void {
805	816	$user_roles = $this->get_roles( $user );
806	817	// This method is better than is_intersected_arrays() because it is flexibly controlled with a nested hook.
807		- if ( ! empty( $user_roles ) && $this->service->is_auth_enable_for( $user, $this->model->user_roles ) ) {
	818	+ if ( is_array( $user_roles ) && array() !== $user_roles && $this->service->is_auth_enable_for( $user, $this->model->user_roles ) ) {
808	819	wp_enqueue_style( 'defender-profile-2fa', defender_asset_url( '/assets/css/two-factor.css' ), array(), DEFENDER_VERSION );
809	820
810	821	$webauthn_controller = wd_di()->get( Webauthn_Controller::class );
811	822	$webauthn_requirements = $this->check_webauthn_requirements();
		@@ -830,8 +841,9 @@
830	841	plugins_url( 'assets/js/webauthn.js', WP_DEFENDER_FILE ),
831	842	array(
832	843	'jquery',
833	844	'wpdef_webauthn_common_script',
	845	+ 'wp-i18n',
834	846	),
835	847	DEFENDER_VERSION,
836	848	true
837	849	);
		@@ -842,9 +854,9 @@
842	854	'admin_url' => admin_url( 'admin-ajax.php' ),
843	855	'nonce' => wp_create_nonce( 'wpdef_webauthn' ),
844	856	'i18n' => $webauthn_controller->get_translations(),
845	857	'registered_auths' => $webauthn_controller->get_current_user_authenticators(),
846		- 'username' => ! empty( $user->user_login ) ? $user->user_login : '',
	858	+ 'username' => isset( $user->user_login ) && is_string( $user->user_login ) ? $user->user_login : '',
847	859	'user_handle_match_failed' => $webauthn_user_handle_match_failed,
848	860	)
849	861	);
850	862
		@@ -853,9 +865,9 @@
853	865	$this->model->force_auth_roles
854	866	);
855	867	$default_values = $this->model->get_default_values();
856	868	$enabled_providers = $this->service->get_available_providers_for_user( $user );
857		- $enabled_provider_slugs = ! empty( $enabled_providers ) ? array_keys( $enabled_providers ) : array();
	869	+ $enabled_provider_slugs = array() !== $enabled_providers ? array_keys( $enabled_providers ) : array();
858	870	$default_provider_slug = $this->service->get_default_provider_slug_for_user( $user->ID );
859	871	$webauthn_enabled = $this->service->is_checked_enabled_provider_by_slug( $user, Webauthn::$slug );
860	872
861	873	$this->render_partial(
		@@ -860,9 +872,9 @@
860	872
861	873	$this->render_partial(
862	874	'two-fa/user-options',
863	875	array(
864		- 'is_force_auth' => $forced_auth && $this->model->force_auth && empty( $enabled_providers ),
	876	+ 'is_force_auth' => $forced_auth && $this->model->force_auth && array() === $enabled_providers,
865	877	'force_auth_message' => $this->model->force_auth_mess,
866	878	'default_message' => $default_values['message'],
867	879	'user' => $user,
868	880	'all_providers' => $this->service->get_providers(),
		@@ -868,9 +880,9 @@
868	880	'all_providers' => $this->service->get_providers(),
869	881	'enabled_providers_key' => Two_Fa_Component::ENABLED_PROVIDERS_USER_KEY,
870	882	'default_provider_key' => Two_Fa_Component::DEFAULT_PROVIDER_USER_KEY,
871	883	'checked_provider_slugs' => $enabled_provider_slugs,
872		- 'checked_def_provider_slug' => ! empty( $default_provider_slug ) ? $default_provider_slug : null,
	884	+ 'checked_def_provider_slug' => is_string( $default_provider_slug ) && '' !== trim( $default_provider_slug ) ? $default_provider_slug : null,
873	885	'webauthn_requirements' => $webauthn_requirements,
874	886	'webauthn_enabled' => $webauthn_enabled,
875	887	'webauthn_slug' => Webauthn::$slug,
876	888	'is_admin' => is_admin(),
		@@ -887,13 +899,24 @@
887	899	* @return Response
888	900	* @defender_route
889	901	*/
890	902	public function save_settings( Request $request ): Response {
891		- $model = $this->model;
892		- $data = $request->get_data();
	903	+ $model = $this->model;
	904	+ $data = $request->get_data();
	905	+ $old_detect_woo = $model->detect_woo;
	906	+
893	907	$model->import( $data );
894	908	if ( $model->validate() ) {
895	909	$model->save();
	910	+
	911	+ if ( $old_detect_woo !== $model->detect_woo ) {
	912	+ if ( $model->detect_woo ) {
	913	+ $this->wp_defender_2fa_endpoint();
	914	+ }
	915	+
	916	+ flush_rewrite_rules();
	917	+ }
	918	+
896	919	Config_Hub_Helper::set_clear_active_flag();
897	920
898	921	return new Response(
899	922	true,
		@@ -913,23 +936,8 @@
913	936	);
914	937	}
915	938
916	939	/**
917		- * Enqueues scripts and styles for this page.
918		- * Only enqueues assets if the page is active.
919		- */
920		- public function enqueue_assets() {
921		- if ( ! $this->is_page_active() ) {
922		- return;
923		- }
924		- wp_enqueue_script( 'clipboard' );
925		- wp_enqueue_media();
926		- wp_localize_script( 'def-2fa', 'two_fa', $this->data_frontend() );
927		- wp_enqueue_script( 'def-2fa' );
928		- $this->enqueue_main_assets();
929		- }
930		-
931		- /**
932	940	* Send test email, use in settings screen.
933	941	*
934	942	* @param Request $request Request object.
935	943	*
		@@ -976,9 +984,9 @@
976	984	$body = str_replace( "{{{$key}}}", $param, $body );
977	985	}
978	986	}
979	987	$headers = array( 'Content-Type: text/html; charset=UTF-8' );
980		- if ( ! empty( $sender ) ) {
	988	+ if ( is_string( $sender ) && '' !== trim( $sender ) ) {
981	989	// Since v5.2.0.
982	990	$from_email = defender_noreply_email( 'wd_two_fa_totp_noreply_email' );
983	991	$headers[] = sprintf( 'From: %s <%s>', $sender, $from_email );
984	992	} else {
		@@ -1030,15 +1038,8 @@
1030	1038	);
1031	1039	}
1032	1040
1033	1041	/**
1034		- * Renders the main view.
1035		- */
1036		- public function main_view(): void {
1037		- $this->render( 'main' );
1038		- }
1039		-
1040		- /**
1041	1042	* Removes settings for all submodules.
1042	1043	*/
1043	1044	public function remove_settings(): void {
1044	1045	( new Two_Fa() )->delete();
		@@ -1126,8 +1127,9 @@
1126	1127	public function data_frontend(): array {
1127	1128	return array_merge(
1128	1129	array(
1129	1130	'model' => $this->model->export(),
	1131	+ 'defaults' => $this->model->get_default_values(),
1130	1132	'all_roles' => $this->get_all_editable_roles(),
1131	1133	'count' => $this->service->count_users_with_enabled_2fa(),
1132	1134	'notices' => $this->compatibility_notices,
1133	1135	'count_checked_roles' => count( $this->model->user_roles ),
		@@ -1175,17 +1177,15 @@
1175	1177	);
1176	1178	}
1177	1179
1178	1180	/**
1179		- * Generates configuration strings based on the provided configuration and
1180		- * whether the product is a pro version.
	1181	+ * Generates configuration strings based on the provided configuration.
1181	1182	*
1182	1183	* @param array $config Configuration data.
1183		- * @param bool $is_pro Indicates if the product is a pro version.
1184	1184	*
1185	1185	* @return array Returns an array of configuration strings.
1186	1186	*/
1187		- public function config_strings( array $config, bool $is_pro ): array {
	1187	+ public function config_strings( array $config ): array {
1188	1188	return array(
1189	1189	$config['enabled'] ? esc_html__( 'Active', 'defender-security' ) : esc_html__( 'Inactive', 'defender-security' ),
1190	1190	);
1191	1191	}
		@@ -1215,9 +1215,9 @@
1215	1215	if ( $this->service->is_force_auth_enable_for( $user->ID, $this->model->force_auth_roles ) ) {
1216	1216	return false;
1217	1217	}
1218	1218	// Is TOTP saved with a passcode?
1219		- if ( ! empty( $this->service->get_available_providers_for_user( $user ) ) ) {
	1219	+ if ( array() !== $this->service->get_available_providers_for_user( $user ) ) {
1220	1220	return $prevent;
1221	1221	}
1222	1222
1223	1223	return $prevent;
		@@ -1267,9 +1267,9 @@
1267	1267	if ( ! $this->service->is_force_auth_enable_for( $user->ID, $this->model->force_auth_roles ) ) {
1268	1268	return $redirect;
1269	1269	}
1270	1270	// Is TOTP saved with a passcode?
1271		- if ( empty( $this->service->get_available_providers_for_user( $user ) ) ) {
	1271	+ if ( array() === $this->service->get_available_providers_for_user( $user ) ) {
1272	1272	return admin_url( 'profile.php' ) . '#defender-security';
1273	1273	}
1274	1274
1275	1275	return $redirect;
		@@ -1353,9 +1353,8 @@
1353	1353	* @return void
1354	1354	*/
1355	1355	public function wp_defender_2fa_endpoint(): void {
1356	1356	add_rewrite_endpoint( $this->slug, EP_PERMALINK | EP_PAGES );
1357		- flush_rewrite_rules();
1358	1357	}
1359	1358
1360	1359	/**
1361	1360	* 2. dds the slug of the current instance to the given array of query variables.
		@@ -1377,9 +1376,9 @@
1377	1376	*
1378	1377	* @return array The updated array of items with the new endpoint inserted.
1379	1378	*/
1380	1379	public function wp_defender_2fa_link_my_account( $items ) {
1381		- $needed_place = is_array( $items ) && ! empty( $items ) ? ( count( $items ) - 1 ) : 0;
	1380	+ $needed_place = is_array( $items ) && array() !== $items ? ( count( $items ) - 1 ) : 0;
1382	1381
1383	1382	return array_slice( $items, 0, $needed_place, true )
1384	1383	+ array( $this->slug => esc_html__( '2FA', 'defender-security' ) )
1385	1384	+ array_slice( $items, $needed_place, null, true );
		@@ -1400,9 +1399,9 @@
1400	1399	* @return void
1401	1400	*/
1402	1401	public function save_2fa_details() {
1403	1402	$action = defender_get_data_from_request( 'action', 'p' );
1404		- if ( empty( $action ) || 'save_def_2fa_user_settings' !== $action ) {
	1403	+ if ( ! is_string( $action ) || '' === trim( $action ) || 'save_def_2fa_user_settings' !== $action ) {
1405	1404	return;
1406	1405	}
1407	1406
1408	1407	wc_nocache_headers();
		@@ -1430,9 +1429,9 @@
1430	1429	* @return void
1431	1430	*/
1432	1431	public function enable_provider_slugs( array $provider_slugs ) {
1433	1432	// Track conditions.
1434		- if ( ! empty( $provider_slugs ) ) {
	1433	+ if ( array() !== $provider_slugs ) {
1435	1434	$methods = array();
1436	1435	foreach ( $this->service->get_providers() as $slug => $object ) {
1437	1436	if ( in_array( $slug, $provider_slugs, true ) ) {
1438	1437	$methods[] = $object->get_label();