← All changes | src/component/class-two-fa.php +10 -3 5.8.0 → 6.3.0 View file →

		@@ -74,9 +74,10 @@
74	74	* @return int
75	75	* @since 3.3.0
76	76	*/
77	77	public function get_attempt_limit(): int {
78		- return (int) apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	78	+ $limit = apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	79	+ return is_int( $limit ) ? $limit : (int) $limit;
79	80	}
80	81
81	82	/**
82	83	* Get the limit of time.
		@@ -83,9 +84,10 @@
83	84	*
84	85	* @return int
85	86	*/
86	87	public function get_time_limit() {
87		- return (int) apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	88	+ $limit = apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	89	+ return is_int( $limit ) ? $limit : (int) $limit;
88	90	}
89	91
90	92	/**
91	93	* Enable OTP for a user.
		@@ -786,9 +788,14 @@
786	788	public function admin_notices() {
787	789	$screen = get_current_screen();
788	790	$screen_id = is_multisite() ? 'users-network' : 'users';
789	791
790		- if ( $screen_id !== $screen->id || ! current_user_can( 'edit_users' ) ) {
	792	+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
	793	+ if ( $screen_id !== $screen->id || ! current_user_can( $cap ) ) {
	794	+ return;
	795	+ }
	796	+ $nonce = defender_get_data_from_request( '_wpnonce', 'g' );
	797	+ if ( ! is_string( $nonce ) || false === wp_verify_nonce( $nonce, 'bulk-users' ) ) {
791	798	return;
792	799	}
793	800	$action = defender_get_data_from_request( 'action', 'g' );
794	801	$user_id = defender_get_data_from_request( 'user', 'g' );