| @@ -100,8 +100,12 @@ | ||
| 100 | 100 | } |
| 101 | 101 | |
| 102 | 102 | // Check temporary access (transient) |
| 103 | 103 | if ($this->has_transient_access()) { |
| 104 | + // Sliding window: renew the access window itself, not just the | |
| 105 | + // decorative activity timestamp, so an admin actively using the | |
| 106 | + // tab is not cut off exactly at grant-time + timeout. | |
| 107 | + set_transient($this->get_transient_key(), 'granted', $this->transient_timeout); | |
| 104 | 108 | // Refresh transient activity |
| 105 | 109 | $this->update_activity(); |
| 106 | 110 | return true; |
| 107 | 111 | } |
| @@ -362,10 +366,14 @@ | ||
| 362 | 366 | if (!is_array($valid_passwords)) { |
| 363 | 367 | $valid_passwords = array($valid_passwords); |
| 364 | 368 | } |
| 365 | 369 | |
| 366 | - // Remove empty passwords | |
| 367 | - $valid_passwords = array_filter($valid_passwords); | |
| 370 | + // Remove unset/empty passwords, but keep the string '0' — a | |
| 371 | + // truthiness filter would silently drop a configured password of | |
| 372 | + // "0" and make it impossible to authenticate with. | |
| 373 | + $valid_passwords = array_filter($valid_passwords, function ($p) { | |
| 374 | + return null !== $p && '' !== $p; | |
| 375 | + }); | |
| 368 | 376 | |
| 369 | 377 | if (empty($valid_passwords)) { |
| 370 | 378 | return false; |
| 371 | 379 | } |
