← All changes | admin/class-admin.php +1438 -71 2.10.3 → 3.0.0 View file →

		@@ -107,8 +107,11 @@
107	107	add_action( 'admin_init', array( $this, 'redirect_submenu_shortcuts' ) );
108	108	add_action( 'admin_init', array( $this, 'register_settings' ) );
109	109	add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );
110	110	add_action( 'admin_notices', array( $this, 'show_admin_notices' ) );
	111	+ // Self-protection speaks in the network admin too: on a network its
	112	+ // files are shared, and the super administrator is who can repair them.
	113	+ add_action( 'network_admin_notices', array( $this, 'maybe_show_self_protection_notice' ) );
111	114
112	115	// Highlight correct submenu based on active tab
113	116	add_filter( 'submenu_file', array( $this, 'highlight_submenu_tab' ) );
114	117
		@@ -199,8 +202,26 @@
199	202	/**
200	203	* Run database migrations based on stored version
201	204	*/
202	205	public function run_migrations() {
	206	+ /*
	207	+ * admin-ajax.php fires admin_init before it decides who is asking
	208	+ * (wp-admin/admin-ajax.php:45), so until 2.11.10 an anonymous POST to
	209	+ * admin-ajax.php with any action ran every pending migration. That is
	210	+ * not a read: the migrations rewrite wp-config.php through
	211	+ * apply_security_constants(), rewrite the root .htaccess, move user meta
	212	+ * of the whole network and can rebuild the file integrity baseline,
	213	+ * taking whatever is on disk as approved. Reproduced on 12 sep 2026 with
	214	+ * curl and no cookies, and found by the file-by-file review of 2.11.10.
	215	+ *
	216	+ * Migrations are maintenance for whoever administers the site, so they
	217	+ * wait for an administrator to load a screen. Nothing is lost by
	218	+ * waiting: every migration is idempotent and version gated.
	219	+ */
	220	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	221	+ return;
	222	+ }
	223	+
203	224	$db_version = get_option( 'vigilante_db_version', '0' );
204	225
205	226	// 1.2.3: Fix IP lists corrupted by sanitize_text_field stripping newlines
206	227	if ( version_compare( $db_version, '1.2.3', '<' ) ) {
		@@ -273,9 +294,29 @@
273	294	if ( ! class_exists( 'Vigilante_File_Integrity' ) ) {
274	295	require_once VIGILANTE_INCLUDES_DIR . 'class-file-integrity.php';
275	296	}
276	297	$fi = new Vigilante_File_Integrity( $this->settings, $this->database, $this->activity_log );
277		- $fi->regenerate_all_baselines();
	298	+
	299	+ /*
	300	+ * Only when there is nothing on record. This migration exists to
	301	+ * create the baseline that did not exist, never to discard the one
	302	+ * the owner approved: rebuilding it from the files takes whatever
	303	+ * is on disk right now as approved, so a wp-config.php modified and
	304	+ * awaiting review would be blessed in silence.
	305	+ *
	306	+ * And this is not theory. vigilante_db_version is written on two
	307	+ * different scales into the same option: this file counts in plugin
	308	+ * versions (2.11.0) and Vigilante_Database counts in schema
	309	+ * versions, currently 1.4.0 (class-database.php:322 and :380). For
	310	+ * version_compare, 1.4.0 is LOWER than 1.14.0, so any site whose
	311	+ * option was last written by the schema runs this migration again.
	312	+ * Measured on the Multisite install on 10 sep 2026: one of the three
	313	+ * sites was sitting on 1.4.0.
	314	+ */
	315	+ if ( ! $fi->get_critical_files_baseline() ) {
	316	+ $fi->regenerate_all_baselines();
	317	+ }
	318	+
278	319	update_option( 'vigilante_db_version', '1.14.0' );
279	320	}
280	321
281	322	// 2.0.0: Move hide_server_signature and remove_fingerprinting_headers
		@@ -425,11 +466,232 @@
425	466	}
426	467
427	468	update_option( 'vigilante_db_version', '2.9.9' );
428	469	}
	470	+
	471	+ /*
	472	+ * 2.11.0: security release (audit of 28 Aug 2026). Runs here and not
	473	+ * from Vigilante_Database::needs_update(): this option is shared with
	474	+ * that class, and on any updated site it already holds a plugin version
	475	+ * (2.9.9 or later), so a bump of DB_VERSION would never fire.
	476	+ * create_tables() widens the email code column through dbDelta (varchar
	477	+ * 6 to 64, the code is stored hashed since 2.11.0) and purge_for_2_11_0()
	478	+ * does what dbDelta cannot: it empties the trusted devices, which were
	479	+ * identified by User-Agent until now (S1), and the pending email codes,
	480	+ * stored in clear until now (S11). Every remembered device asks for the
	481	+ * second factor once more after this update, and the changelog says so.
	482	+ */
	483	+ if ( version_compare( $db_version, '2.11.0', '<' ) ) {
	484	+ $this->database->create_tables();
	485	+ $this->database->purge_for_2_11_0();
	486	+
	487	+ update_option( 'vigilante_db_version', '2.11.0' );
	488	+ }
	489	+
	490	+ /*
	491	+ * 2.11.9: clear the raw .htaccess copies that older versions left in
	492	+ * options, on the first admin load after the update. Uninstall already
	493	+ * removes them, but that only fires when the plugin is deleted, so a
	494	+ * site that keeps the plugin carried them until now. Three stores, each
	495	+ * a copy of a file that can hold secrets (a SetEnv token, an
	496	+ * Authorization header): the same exposure the wp.org review flagged as
	497	+ * 4.4, on the paths its fix did not reach.
	498	+ *
	499	+ * - vigilante_htaccess_history: up to five raw copies, by design, until
	500	+ * 2.11.8. The writer is gone, nothing reads it, so it is deleted.
	501	+ * - vigilante_htaccess_backup: the single rollback buffer, normally
	502	+ * cleared in the finally of each write; a copy only lingers if a write
	503	+ * crashed mid-operation. Nothing outside one write reads it, so a
	504	+ * leftover is deleted.
	505	+ * - vigilante_htaccess_pre_migration: still read by the header recovery,
	506	+ * but older versions stored the whole file where only our own block is
	507	+ * ever used. Truncated to that block, so the feature keeps working and
	508	+ * nothing outside our markers stays in the option.
	509	+ */
	510	+ if ( version_compare( $db_version, '2.11.9', '<' ) ) {
	511	+ delete_option( 'vigilante_htaccess_history' );
	512	+ delete_option( 'vigilante_htaccess_backup' );
	513	+
	514	+ $snapshot = get_option( 'vigilante_htaccess_pre_migration' );
	515	+ if ( is_array( $snapshot ) && isset( $snapshot['content'] ) && '' !== (string) $snapshot['content'] ) {
	516	+ require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-recovery.php';
	517	+ $block = Vigilante_Htaccess_Recovery::get_raw_block();
	518	+
	519	+ if ( '' === $block ) {
	520	+ delete_option( 'vigilante_htaccess_pre_migration' );
	521	+ } elseif ( $block !== $snapshot['content'] ) {
	522	+ $snapshot['content'] = $block;
	523	+ update_option( 'vigilante_htaccess_pre_migration', $snapshot, false );
	524	+ }
	525	+ }
	526	+
	527	+ update_option( 'vigilante_db_version', '2.11.9' );
	528	+ }
	529	+
	530	+ /*
	531	+ * 2.11.10: the pending-approval flag becomes one per site on a network.
	532	+ * Until 2.11.9 it was a single global user meta, so the queue was shared
	533	+ * across the whole network. Moving the key is not enough: the accounts
	534	+ * already waiting carry the old key, and reading only the new one would
	535	+ * let them log in. So they are moved here, each to the site it belongs
	536	+ * to, and the old key is removed only once the new one is written.
	537	+ */
	538	+ if ( version_compare( $db_version, '2.11.10', '<' ) ) {
	539	+ $this->migrate_pending_approval_per_site();
	540	+
	541	+ update_option( 'vigilante_db_version', '2.11.10' );
	542	+ }
	543	+
	544	+ /*
	545	+ * 3.0.0: self-protection package. This block must stay the LAST one of
	546	+ * run_migrations(): every block compares against the same $db_version
	547	+ * captured at the top, so the last update_option() that runs is the
	548	+ * one that sticks, and on a jump from any older version it has to be
	549	+ * this one.
	550	+ *
	551	+ * 1. Capture the self-integrity anchor (the manifest fingerprint) and
	552	+ * run an inline self-check. It covers every update the old code never
	553	+ * saw through the upgrader hook: from any 2.x, and manual or FTP
	554	+ * uploads. A plain new is enough, the constructor registers no hooks.
	555	+ * 2. Drop the cached Security Check report: the Internal category grows
	556	+ * from 30 to 33 points (the self_integrity check), and the cached
	557	+ * report would keep the old denominator until the next full scan.
	558	+ * Same reason and same background refresh as the 2.6.1 block above.
	559	+ * 3. Remove Vigilant's own files from the ignore list before that check.
	560	+ * Until 2.11.11 the generic scan listed them like any plugin, and any
	561	+ * administrator could ignore one (after a false alarm while
	562	+ * WordPress.org published new checksums, for example). Kept, those
	563	+ * entries would silence the self-check of those files for good,
	564	+ * PHP included.
	565	+ */
	566	+ if ( version_compare( $db_version, '3.0.0', '<' ) ) {
	567	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	568	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	569	+ }
	570	+ $ignored_files = get_option( 'vigilante_ignored_files', array() );
	571	+ if ( is_array( $ignored_files ) && $ignored_files ) {
	572	+ $kept_files = array_values(
	573	+ array_filter(
	574	+ $ignored_files,
	575	+ function ( $ignored_file ) {
	576	+ return ! Vigilante_Self_Integrity::is_own_file_path( (string) $ignored_file );
	577	+ }
	578	+ )
	579	+ );
	580	+ if ( count( $kept_files ) !== count( $ignored_files ) ) {
	581	+ update_option( 'vigilante_ignored_files', $kept_files );
	582	+ if ( $this->activity_log ) {
	583	+ $this->activity_log->log(
	584	+ 'system',
	585	+ 'self_ignored_files_removed',
	586	+ __( 'Vigilant files were removed from the File Integrity ignore list: self-protection checks them now.', 'vigilante' ),
	587	+ array( 'removed' => count( $ignored_files ) - count( $kept_files ) ),
	588	+ 'info'
	589	+ );
	590	+ }
	591	+ }
	592	+ }
	593	+ $self_integrity = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	594	+ $self_integrity->run_check( 'migration' );
	595	+
	596	+ delete_option( 'vigilante_analyzer_last_scan' );
	597	+ if ( ! wp_next_scheduled( 'vigilante_under_attack_post_scan' ) ) {
	598	+ wp_schedule_single_event( time() + 5, 'vigilante_under_attack_post_scan' );
	599	+ }
	600	+
	601	+ update_option( 'vigilante_db_version', '3.0.0' );
	602	+ }
429	603	}
430	604
431	605	/**
	606	+ * Move the pending-approval flag of a network to a key per site
	607	+ *
	608	+ * Runs once for the whole network, not once per site: the data it moves is
	609	+ * global, so the guard is a network option and any site may be the one that
	610	+ * does it. On a single site the key does not change and there is nothing to
	611	+ * do.
	612	+ *
	613	+ * Each waiting account goes to its primary site, or to the only site it
	614	+ * belongs to; one that belongs to none goes to the main site rather than
	615	+ * nowhere, because losing the flag would silently approve it.
	616	+ *
	617	+ * @since 2.11.10
	618	+ */
	619	+ private function migrate_pending_approval_per_site() {
	620	+ global $wpdb;
	621	+
	622	+ if ( ! is_multisite() ) {
	623	+ return;
	624	+ }
	625	+
	626	+ if ( get_site_option( 'vigilante_pending_per_site_done' ) ) {
	627	+ return;
	628	+ }
	629	+
	630	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- One-off migration of the plugin's own user meta; the meta API has no "list every user with this key".
	631	+ $user_ids = $wpdb->get_col(
	632	+ $wpdb->prepare( "SELECT DISTINCT user_id FROM {$wpdb->usermeta} WHERE meta_key = %s", 'vigilante_pending_approval' )
	633	+ );
	634	+
	635	+ foreach ( (array) $user_ids as $user_id ) {
	636	+ $user_id = (int) $user_id;
	637	+ if ( ! $user_id ) {
	638	+ continue;
	639	+ }
	640	+
	641	+ $pending = get_user_meta( $user_id, 'vigilante_pending_approval', true );
	642	+ $since = get_user_meta( $user_id, 'vigilante_pending_since', true );
	643	+
	644	+ /*
	645	+ * Every site the account belongs to, not its primary one. The global
	646	+ * flag does not say where the registration happened, and the first
	647	+ * version of this guessed the primary blog: an account that
	648	+ * registered on B while its primary was A came out pending on A and
	649	+ * free to log in on B, which is the very site it had never been
	650	+ * approved on. Found by the cross review of 2.11.10.
	651	+ *
	652	+ * Marking every site it belongs to fails closed instead: the account
	653	+ * stays blocked wherever it can log in, and shows up in the queue of
	654	+ * each of those sites so somebody can actually act on it. An account
	655	+ * that belongs to no site goes to the main one rather than nowhere,
	656	+ * because losing the flag would silently approve it.
	657	+ */
	658	+ /*
	659	+ * With $all true, because the default leaves out archived, spam and
	660	+ * deleted sites (wp-includes/user.php:1113-1117): a site archived on
	661	+ * the day this runs would lose the flag, and the account would walk
	662	+ * in unapproved the moment it was brought back. Found by the second
	663	+ * cross review of 2.11.10.
	664	+ */
	665	+ $blog_ids = array();
	666	+
	667	+ foreach ( get_blogs_of_user( $user_id, true ) as $blog ) {
	668	+ if ( ! empty( $blog->userblog_id ) ) {
	669	+ $blog_ids[] = (int) $blog->userblog_id;
	670	+ }
	671	+ }
	672	+
	673	+ if ( empty( $blog_ids ) ) {
	674	+ $blog_ids[] = (int) get_main_site_id();
	675	+ }
	676	+
	677	+ foreach ( array_unique( $blog_ids ) as $blog_id ) {
	678	+ $prefix = $wpdb->get_blog_prefix( $blog_id );
	679	+
	680	+ update_user_meta( $user_id, $prefix . 'vigilante_pending_approval', $pending );
	681	+ if ( '' !== $since && false !== $since ) {
	682	+ update_user_meta( $user_id, $prefix . 'vigilante_pending_since', $since );
	683	+ }
	684	+ }
	685	+
	686	+ delete_user_meta( $user_id, 'vigilante_pending_approval' );
	687	+ delete_user_meta( $user_id, 'vigilante_pending_since' );
	688	+ }
	689	+
	690	+ update_site_option( 'vigilante_pending_per_site_done', 1 );
	691	+ }
	692	+
	693	+ /**
432	694	* Migration: Remove orphaned email fields from saved options
433	695	*
434	696	* v1.10.0 centralized notification recipients into email section.
435	697	* Old per-module notify_email fields and dead email section fields
		@@ -525,17 +787,30 @@
525	787	$pending_count = $this->get_pending_approvals_count();
526	788
527	789	// Get security issues with severity
528	790	$security_status = $this->get_security_status_for_badge();
529		-
	791	+
	792	+ /*
	793	+ * Self-protection: a change to Vigilant own files is the one finding
	794	+ * that has to be visible from any screen of WordPress, so it adds to
	795	+ * the counter and paints it red. A verified state, a state with fewer
	796	+ * references than usual and the check turned off add nothing: a counter
	797	+ * that is always on is a counter nobody reads.
	798	+ */
	799	+ $self_tone = Vigilante_Self_Integrity::tone(
	800	+ Vigilante_Self_Integrity::display_state(),
	801	+ Vigilante_Self_Integrity::is_on()
	802	+ );
	803	+ $self_badge = in_array( $self_tone, array( 'critical', 'off', 'warning' ), true ) ? 1 : 0;
	804	+
530	805	// Total count for badge
531		- $total_badge = $pending_count + $security_status['count'];
532		-
	806	+ $total_badge = $pending_count + $security_status['count'] + $self_badge;
	807	+
533	808	if ( $total_badge > 0 ) {
534	809	// Determine badge color:
535	810	// - Red (awaiting-mod): pending approvals OR critical modules disabled
536	811	// - Orange (update-plugins): only non-critical modules disabled
537		- if ( $pending_count > 0 || $security_status['has_critical'] ) {
	812	+ if ( $pending_count > 0 || $security_status['has_critical'] || in_array( $self_tone, array( 'critical', 'off' ), true ) ) {
538	813	$badge_class = 'awaiting-mod';
539	814	} else {
540	815	$badge_class = 'update-plugins vigilante-badge-warning';
541	816	}
		@@ -577,13 +852,21 @@
577	852	'vigilante-activity-log',
578	853	array( $this, 'redirect_to_tab' )
579	854	);
580	855
581		- // File Integrity shortcut
	856	+ // File Integrity shortcut, with its own counter when the self-check has
	857	+ // something to say: that is the screen that explains it.
	858	+ $fi_menu_title = __( 'File Integrity', 'vigilante' );
	859	+ if ( $self_badge > 0 ) {
	860	+ $fi_menu_title .= sprintf(
	861	+ ' <span class="%s count-1"><span class="pending-count">1</span></span>',
	862	+ in_array( $self_tone, array( 'critical', 'off' ), true ) ? 'awaiting-mod' : 'update-plugins vigilante-badge-warning'
	863	+ );
	864	+ }
582	865	add_submenu_page(
583	866	'vigilante',
584	867	__( 'File Integrity', 'vigilante' ),
585		- __( 'File Integrity', 'vigilante' ),
	868	+ $fi_menu_title,
586	869	'manage_options',
587	870	'vigilante-file-integrity',
588	871	array( $this, 'redirect_to_tab' )
589	872	);
		@@ -697,23 +980,32 @@
697	980	if ( ! did_action( 'plugins_loaded' ) ) {
698	981	return 0;
699	982	}
700	983
701		- $registration_approval = $this->settings->get_section( 'user_security' );
702		- $approval_settings = $registration_approval['registration_approval'] ?? array();
703		-
704		- if ( empty( $approval_settings['enabled'] ) ) {
705		- return 0;
706		- }
	984	+ /*
	985	+ * Counted whether the feature is on or off. An account already waiting
	986	+ * stays blocked when it is switched off (see init_enforcement_hooks()),
	987	+ * so reporting zero there hid people who cannot log in and whom nobody
	988	+ * could see to approve. Found by the cross review of 2.11.10.
	989	+ */
707	990
708	991	// phpcs:disable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Limited results in admin context.
709		- $pending_users = get_users( array(
710		- 'meta_key' => 'vigilante_pending_approval',
	992	+ $args = array(
	993	+ 'meta_key' => Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_approval' ),
711	994	'meta_value' => '1',
712	995	'fields' => 'ID',
713		- ) );
	996	+ );
714	997	// phpcs:enable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value
715	998
	999	+ // Same query as Vigilante_User_Security::get_pending_users(), and for the
	1000	+ // same reason: the meta key already scopes this to the site, and adding
	1001	+ // core's membership filter on top hid the accounts that have no role yet.
	1002	+ if ( is_multisite() ) {
	1003	+ $args['blog_id'] = 0;
	1004	+ }
	1005	+
	1006	+ $pending_users = get_users( $args );
	1007	+
716	1008	return count( $pending_users );
717	1009	}
718	1010
719	1011	/**
		@@ -837,8 +1129,28 @@
837	1129	$score += 3;
838	1130	}
839	1131	}
840	1132
	1133	+ /*
	1134	+ * Self-protection (15 points). Having it on is configuration, which is
	1135	+ * what this card measures; the state of the last check caps the card,
	1136	+ * because a plugin whose own files were changed is not well configured
	1137	+ * in any useful sense, whatever the rest of the settings say. The
	1138	+ * environment block below already mixes measured state into this score
	1139	+ * (WP_DEBUG, insecure usernames), so the card keeps its meaning.
	1140	+ */
	1141	+ $max_score += 15;
	1142	+ $self_enabled = Vigilante_Self_Integrity::is_on();
	1143	+ $self_tone = Vigilante_Self_Integrity::tone( Vigilante_Self_Integrity::display_state(), $self_enabled );
	1144	+ if ( $self_enabled ) {
	1145	+ $score += 10;
	1146	+ // The five points are for a check that ran and came out clean: a
	1147	+ // site that has never checked itself has not earned them.
	1148	+ if ( in_array( $self_tone, array( 'ok', 'info' ), true ) ) {
	1149	+ $score += 5;
	1150	+ }
	1151	+ }
	1152	+
841	1153	// Environment checks (8 points) - penalize insecure server configuration
842	1154	$max_score += 8;
843	1155	$env_score = 8;
844	1156
		@@ -854,9 +1166,14 @@
854	1166	}
855	1167
856	1168	$score += max( 0, $env_score );
857	1169
858		- return $max_score > 0 ? round( ( $score / $max_score ) * 100 ) : 0;
	1170	+ $percent = $max_score > 0 ? (int) round( ( $score / $max_score ) * 100 ) : 0;
	1171	+ if ( in_array( $self_tone, array( 'critical', 'off' ), true ) ) {
	1172	+ // Same cap and same reason as the Security Check score.
	1173	+ $percent = min( $percent, Vigilante_Security_Analyzer::SCORE_CAP_ON_TAMPER );
	1174	+ }
	1175	+ return $percent;
859	1176	}
860	1177
861	1178	/**
862	1179	* Get security recommendations based on current settings
		@@ -866,8 +1183,51 @@
866	1183	*/
867	1184	private function get_security_recommendations( $options ) {
868	1185	$recommendations = array();
869	1186
	1187	+ // Self-protection first: if Vigilant itself cannot be trusted, nothing
	1188	+ // else on this card means much.
	1189	+ $vg_self_enabled = Vigilante_Self_Integrity::is_on();
	1190	+ $vg_self_tone = Vigilante_Self_Integrity::tone( Vigilante_Self_Integrity::display_state(), $vg_self_enabled );
	1191	+ if ( ! $vg_self_enabled ) {
	1192	+ $recommendations[] = array(
	1193	+ 'icon' => 'shield',
	1194	+ 'priority' => 'high',
	1195	+ 'tab' => 'file-integrity',
	1196	+ 'message' => __( 'Turn Vigilant self-protection on, so a change to Vigilant own files does not go unnoticed.', 'vigilante' ),
	1197	+ );
	1198	+ } elseif ( 'off' === $vg_self_tone ) {
	1199	+ $recommendations[] = array(
	1200	+ 'icon' => 'warning',
	1201	+ 'priority' => 'critical',
	1202	+ 'tab' => 'file-integrity',
	1203	+ 'message' => __( 'Something on this site switched Vigilant self-protection off: File Integrity says which file does it.', 'vigilante' ),
	1204	+ );
	1205	+ } elseif ( 'critical' === $vg_self_tone ) {
	1206	+ $recommendations[] = array(
	1207	+ 'icon' => 'warning',
	1208	+ 'priority' => 'critical',
	1209	+ 'tab' => 'file-integrity',
	1210	+ 'message' => __( 'Vigilant own files have been changed: repair Vigilant from File Integrity before anything else.', 'vigilante' ),
	1211	+ );
	1212	+ } elseif ( 'warning' === $vg_self_tone ) {
	1213	+ $recommendations[] = array(
	1214	+ 'icon' => 'shield',
	1215	+ 'priority' => 'high',
	1216	+ 'tab' => 'file-integrity',
	1217	+ 'message' => __( 'Vigilant self-protection needs your attention: File Integrity says what it found and what to do.', 'vigilante' ),
	1218	+ );
	1219	+ } elseif ( 'none' === $vg_self_tone ) {
	1220	+ // The score holds back the points of a check that has not run yet,
	1221	+ // so the card has to say why instead of just showing a lower number.
	1222	+ $recommendations[] = array(
	1223	+ 'icon' => 'shield',
	1224	+ 'priority' => 'high',
	1225	+ 'tab' => 'file-integrity',
	1226	+ 'message' => __( 'Vigilant has not checked its own files yet: run a scan from File Integrity.', 'vigilante' ),
	1227	+ );
	1228	+ }
	1229	+
870	1230	// Critical: Firewall disabled
871	1231	if ( empty( $options['modules']['firewall'] ) ) {
872	1232	$recommendations[] = array(
873	1233	'icon' => 'warning',
		@@ -1270,8 +1630,9 @@
1270	1630	// File Integrity
1271	1631	array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'File Integrity Monitoring', 'vigilante' ), 'label_en' => 'File Integrity Monitoring', 'keywords' => _x( 'file integrity monitoring files checksum checksums tamper', 'settings search keywords', 'vigilante' ) ),
1272	1632	array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Scan schedule', 'vigilante' ), 'label_en' => 'Scan schedule', 'keywords' => _x( 'scan schedule scans scanning check cron', 'settings search keywords', 'vigilante' ) ),
1273	1633	array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Instant alert', 'vigilante' ), 'label_en' => 'Instant alert', 'keywords' => _x( 'instant alert alerts notification warning email', 'settings search keywords', 'vigilante' ) ),
	1634	+ array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'Vigilant self-protection', 'vigilante' ), 'anchor' => 'vigilante-section-fi-self', 'label' => __( 'Vigilant self-protection', 'vigilante' ), 'label_en' => 'Vigilant self-protection', 'keywords' => _x( 'self protection selfprotection self-check autoproteccion manifest sha256 checksums tampering tampered repair reinstall own files guardian integrity of the plugin', 'settings search keywords', 'vigilante' ) ),
1274	1635	array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'Ignored Files', 'vigilante' ), 'anchor' => 'vigilante-section-fi-ignored', 'label' => __( 'Ignored Files', 'vigilante' ), 'label_en' => 'Ignored Files', 'keywords' => _x( 'ignored files file exclude', 'settings search keywords', 'vigilante' ) ),
1275	1636	// Security Audit
1276	1637	array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Retention', 'vigilante' ), 'label_en' => 'Retention', 'keywords' => _x( 'retention keep days storage log', 'settings search keywords', 'vigilante' ) ),
1277	1638	array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Events to Log', 'vigilante' ), 'label_en' => 'Events to Log', 'keywords' => _x( 'events to log', 'settings search keywords', 'vigilante' ) ),
		@@ -1424,13 +1785,17 @@
1424	1785	);
1425	1786
1426	1787	wp_localize_script( 'vigilante-admin', 'vigilanteAdmin', array(
1427	1788	'ajaxUrl' => admin_url( 'admin-ajax.php' ),
	1789	+ 'selfBoxUrl' => esc_url( admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-self' ) ),
1428	1790	'nonce' => wp_create_nonce( 'vigilante_admin_nonce' ),
1429	1791	'currentUserId' => get_current_user_id(),
1430	1792	'logoutUrl' => wp_logout_url( wp_login_url() ),
1431	1793	'adminUrl' => admin_url( 'admin.php?page=vigilante' ),
1432	1794	'searchIndex' => $this->get_search_index(),
	1795	+ // The scan repaints this table from JavaScript, so the same gate
	1796	+ // has to travel with it or half the screen keeps the dead button.
	1797	+ 'approvalLocked' => $this->critical_approval_locked(),
1433	1798	'underAttack' => array(
1434	1799	'active' => ( new Vigilante_Under_Attack( $this->settings, $this->activity_log ) )->is_active(),
1435	1800	'remaining' => ( new Vigilante_Under_Attack( $this->settings, $this->activity_log ) )->get_remaining_time(),
1436	1801	),
		@@ -1470,8 +1835,13 @@
1470	1835	'file' => __( 'File', 'vigilante' ),
1471	1836	'reason' => __( 'Reason', 'vigilante' ),
1472	1837	'type' => __( 'Type', 'vigilante' ),
1473	1838	'unknown' => __( 'Unknown', 'vigilante' ),
	1839	+ 'selfType' => __( 'Vigilant (self)', 'vigilante' ),
	1840	+ 'logWhatHappened' => __( 'What happened', 'vigilante' ),
	1841	+ 'logWhatItMeans' => __( 'What it means', 'vigilante' ),
	1842	+ 'logWhatToDo' => __( 'What to do', 'vigilante' ),
	1843	+ 'logSelfSeeDetails' => __( 'Open File Integrity for the full detail', 'vigilante' ),
1474	1844	'modifiedFiles' => __( 'Modified Files', 'vigilante' ),
1475	1845	'modifiedDescription' => __( 'These files (apparently) differ from the original WordPress or plugin versions.', 'vigilante' ),
1476	1846	'extraFiles' => __( 'Extra Files', 'vigilante' ),
1477	1847	'extra' => __( 'Extra', 'vigilante' ),
		@@ -1497,13 +1867,17 @@
1497	1867	'criticalConfigTitle' => __( 'Critical config files modified', 'vigilante' ),
1498	1868	'criticalConfigDesc' => __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate. Vigilant\'s own blocks are excluded from this check.', 'vigilante' ),
1499	1869	'approve' => __( 'Approve', 'vigilante' ),
1500	1870	'approving' => __( 'Approving...', 'vigilante' ),
	1871	+ 'approvalLockedNotice' => $this->critical_approval_notice(),
1501	1872	'criticalApproved' => __( 'Change approved. Next scan will use the current state as baseline.', 'vigilante' ),
1502	1873	'reviewChanges' => __( 'Review changes', 'vigilante' ),
1503	1874	'hideChanges' => __( 'Hide changes', 'vigilante' ),
1504	1875	'changes' => __( 'Changes', 'vigilante' ),
1505	1876	'diffUnavailable' => __( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ),
	1877	+ 'diffNetwork' => __( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ),
	1878	+ 'diffRescan' => __( 'Run a new scan to see the line changes of this file.', 'vigilante' ),
	1879	+ 'diffRedaction' => __( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ),
1506	1880	'diffEmpty' => __( 'No line-level changes detected (may be whitespace or reordering).', 'vigilante' ),
1507	1881	'diffLines' => __( 'lines', 'vigilante' ),
1508	1882	// Under Attack mode strings
1509	1883	'underAttackConfirmActivate' => __( 'Activate Under Attack mode? All visitors will see a verification page for the next 4 hours.', 'vigilante' ),
		@@ -1719,9 +2093,89 @@
1719	2093
1720	2094	/**
1721	2095	* Show admin notices
1722	2096	*/
	2097	+ /**
	2098	+ * Self-protection notice.
	2099	+ *
	2100	+ * A change to Vigilant own files is shown on every admin screen, because
	2101	+ * waiting for someone to open the plugin is exactly what an attacker who
	2102	+ * patched it would want. A warning is shown only on Vigilant screens, so
	2103	+ * the notice that matters is not diluted. Neither is dismissible, both are
	2104	+ * for administrators only, and on a network the steps depend on whether
	2105	+ * the person can install plugins at all.
	2106	+ */
	2107	+ public function maybe_show_self_protection_notice() {
	2108	+ if ( ! current_user_can( 'manage_options' ) ) {
	2109	+ return;
	2110	+ }
	2111	+ $summary = $this->self_integrity_summary();
	2112	+ $tone = $summary['tone'];
	2113	+ if ( ! in_array( $tone, array( 'critical', 'off', 'warning' ), true ) ) {
	2114	+ return;
	2115	+ }
	2116	+
	2117	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading the screen slug to decide where a notice is shown; no action taken.
	2118	+ $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
	2119	+ $on_vigilante = ( 0 === strpos( $page, 'vigilante' ) );
	2120	+ if ( 'warning' === $tone && ! $on_vigilante ) {
	2121	+ return;
	2122	+ }
	2123	+ $alarma = in_array( $tone, array( 'critical', 'off' ), true );
	2124	+
	2125	+ $link = admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-self' );
	2126	+ $network = is_multisite() && ! current_user_can( 'update_plugins' );
	2127	+ ?>
	2128	+ <div class="notice notice-<?php echo $alarma ? 'error' : 'warning'; ?> vigilante-self-notice">
	2129	+ <p class="vigilante-self-notice-title">
	2130	+ <span class="dashicons dashicons-shield" aria-hidden="true"></span>
	2131	+ <strong>
	2132	+ <?php
	2133	+ if ( 'critical' === $tone ) {
	2134	+ esc_html_e( 'Vigilant detected changes in its own files', 'vigilante' );
	2135	+ } elseif ( 'off' === $tone ) {
	2136	+ esc_html_e( 'Vigilant self-protection is switched off by code', 'vigilante' );
	2137	+ } else {
	2138	+ echo esc_html( $this->self_integrity_headline( $tone, $summary['state'] ) );
	2139	+ }
	2140	+ ?>
	2141	+ </strong>
	2142	+ </p>
	2143	+ <p class="vigilante-self-notice-text">
	2144	+ <span>
	2145	+ <?php
	2146	+ if ( 'critical' === $tone ) {
	2147	+ esc_html_e( 'Your security plugin may have been tampered with, and while that is true nothing it reports can be trusted.', 'vigilante' );
	2148	+ } elseif ( 'off' === $tone ) {
	2149	+ esc_html_e( 'Nothing is checking that Vigilant own files are intact. File Integrity says which file switches it off.', 'vigilante' );
	2150	+ } else {
	2151	+ esc_html_e( 'File Integrity says what was found, what it means and what to do about it.', 'vigilante' );
	2152	+ }
	2153	+ if ( $network ) {
	2154	+ echo ' ' . esc_html__( 'Only your network administrator can repair Vigilant, because its files are shared by every site in the network. Let them know.', 'vigilante' );
	2155	+ }
	2156	+ ?>
	2157	+ </span>
	2158	+ <?php
	2159	+ /*
	2160	+ * One button, on the same line as the text it belongs to, and it
	2161	+ * leads to the whole story. Repairing from a notice, without
	2162	+ * seeing which files, what it means and what it will do, is
	2163	+ * asking someone to fix what they have not read: the repair
	2164	+ * button lives in the card, after all that.
	2165	+ */
	2166	+ ?>
	2167	+ <a class="button button-primary button-small" href="<?php echo esc_url( $link ); ?>">
	2168	+ <?php esc_html_e( 'See what to do', 'vigilante' ); ?>
	2169	+ </a>
	2170	+ </p>
	2171	+ </div>
	2172	+ <?php
	2173	+ }
	2174	+
1723	2175	public function show_admin_notices() {
	2176	+ $this->maybe_show_self_protection_notice();
	2177	+
1724	2178	// Activation notice
1725	2179	if ( get_transient( 'vigilante_activated' ) ) {
1726	2180	?>
1727	2181	<div class="notice notice-success is-dismissible vigilante-activation-notice">
		@@ -1766,8 +2220,21 @@
1766	2220	</p>
1767	2221	<p>
1768	2222	<em><?php esc_html_e( 'Vigilant has applied the Maximum preset plus extra hardening on top of your previous configuration. Any changes you make to Vigilant settings while this mode is active will be reverted when it ends.', 'vigilante' ); ?></em>
1769	2223	</p>
	2224	+ <?php
	2225	+ // The cache-bypass rules could not be written (a host where
	2226	+ // WordPress cannot write files by itself, a held lock, a
	2227	+ // failed read-back): show them, so they can be added by hand.
	2228	+ $ua_instance = new Vigilante_Under_Attack( $this->settings, $this->activity_log );
	2229	+ if ( $ua_instance->cache_rules_missing() ) :
	2230	+ ?>
	2231	+ <p>
	2232	+ <strong><?php esc_html_e( 'The cache-bypass rules could not be written to your .htaccess.', 'vigilante' ); ?></strong>
	2233	+ <?php esc_html_e( 'Without them a page cache may keep serving stored pages during the attack. Add this block at the top of the .htaccess in your site root (the activity log records why it was not written):', 'vigilante' ); ?>
	2234	+ </p>
	2235	+ <textarea readonly rows="9" class="large-text code" onclick="this.select();"><?php echo esc_textarea( Vigilante_Under_Attack::get_cache_bypass_block() ); ?></textarea>
	2236	+ <?php endif; ?>
1770	2237	</div>
1771	2238	<?php
1772	2239	}
1773	2240	}
		@@ -1999,8 +2466,41 @@
1999	2466	return ! Vigilante_Settings::can_write_shared_files();
2000	2467	}
2001	2468
2002	2469	/**
	2470	+ * Whether this is the main site and the user cannot change what it builds the shared files from
	2471	+ *
	2472	+ * See Vigilante_Settings::get_main_site_file_settings(). On a subsite those
	2473	+ * settings only act on that site, so they are never locked there.
	2474	+ *
	2475	+ * @since 2.11.6
	2476	+ *
	2477	+ * @return bool
	2478	+ */
	2479	+ private function main_site_files_locked() {
	2480	+ return $this->shared_files_locked() && Vigilante_Settings::owns_shared_files();
	2481	+ }
	2482	+
	2483	+ /**
	2484	+ * Sentence added to a bulk change when some settings were left as they were
	2485	+ *
	2486	+ * Importing a file, applying a preset and restoring the defaults touch every
	2487	+ * section at once, so the user is told that the shared file settings did
	2488	+ * not move.
	2489	+ *
	2490	+ * @since 2.11.6
	2491	+ *
	2492	+ * @return string Empty when the user can change every setting.
	2493	+ */
	2494	+ private function locked_file_settings_message() {
	2495	+ if ( ! Vigilante_Settings::get_locked_file_settings() ) {
	2496	+ return '';
	2497	+ }
	2498	+
	2499	+ return ' ' . __( 'The settings that end up in wp-config.php or .htaccess were left as they were.', 'vigilante' ) . ' ' . Vigilante_Settings::get_shared_files_notice();
	2500	+ }
	2501	+
	2502	+ /**
2003	2503	* Print the shared-files notice for a section that cannot be edited here
2004	2504	*
2005	2505	* @since 2.9.8
2006	2506	*/
		@@ -2015,8 +2515,109 @@
2015	2515	<?php
2016	2516	}
2017	2517
2018	2518	/**
	2519	+ * Acting on another user's account needs permission over that user
	2520	+ *
	2521	+ * Since 2.10.3 the handlers behind these tools ask for edit_user over the
	2522	+ * target, which is the rule WordPress itself applies. On a network the core
	2523	+ * grants edit_user only to network administrators, so for anybody else these
	2524	+ * controls do nothing. Better to say so than to paint a button that silently
	2525	+ * skips every user.
	2526	+ *
	2527	+ * @since 2.10.4
	2528	+ * @return bool
	2529	+ */
	2530	+ private function forwarded_chain_readings() {
	2531	+ // Shown, not decided on: the firewall resolves the address elsewhere.
	2532	+ $chain = Vigilante_IP_Utils::trusted_forwarded_for();
	2533	+
	2534	+ if ( '' === $chain ) {
	2535	+ return array();
	2536	+ }
	2537	+
	2538	+ $public = array();
	2539	+
	2540	+ foreach ( explode( ',', $chain ) as $entry ) {
	2541	+ $address = Vigilante_IP_Utils::unmap_ipv4( trim( $entry ) );
	2542	+
	2543	+ if ( filter_var( $address, FILTER_VALIDATE_IP ) && ! Vigilante_IP_Utils::is_own_network( $address ) ) {
	2544	+ $public[] = $address;
	2545	+ }
	2546	+ }
	2547	+
	2548	+ if ( count( $public ) < 2 ) {
	2549	+ return array();
	2550	+ }
	2551	+
	2552	+ return array(
	2553	+ 'now' => Vigilante_IP_Utils::client_from_chain( $chain ),
	2554	+ 'before' => $public[0],
	2555	+ );
	2556	+ }
	2557	+
	2558	+ /**
	2559	+ * Whether the user tools of this screen are out of reach for this user
	2560	+ *
	2561	+ * @return bool
	2562	+ */
	2563	+ private function user_actions_locked() {
	2564	+ // On a single site edit_user maps to edit_users, which a custom role with
	2565	+ // manage_options may lack: since 2.11.8 approving and rejecting a pending
	2566	+ // registration ask for it, so the buttons have to say so there too.
	2567	+ return is_multisite() ? ! current_user_can( 'manage_network_users' ) : ! current_user_can( 'edit_users' );
	2568	+ }
	2569	+
	2570	+ /**
	2571	+ * Print the notice for user tools that cannot be used from this site
	2572	+ *
	2573	+ * @since 2.10.4
	2574	+ */
	2575	+ private function render_user_actions_notice() {
	2576	+ if ( ! $this->user_actions_locked() ) {
	2577	+ return;
	2578	+ }
	2579	+ ?>
	2580	+ <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
	2581	+ <?php if ( is_multisite() ) : ?>
	2582	+ <p style="margin:0;"><?php esc_html_e( 'These tools act on user accounts, which on a network belong to the whole network rather than to one site. WordPress reserves that to network administrators, so they are managed from the network admin.', 'vigilante' ); ?></p>
	2583	+ <?php else : ?>
	2584	+ <p style="margin:0;"><?php esc_html_e( 'These tools act on other user accounts, and your role cannot edit users, so they are not available to you.', 'vigilante' ); ?></p>
	2585	+ <?php endif; ?>
	2586	+ </div>
	2587	+ <?php
	2588	+ }
	2589	+
	2590	+ /**
	2591	+ * Approving a change to the shared config files needs the network
	2592	+ *
	2593	+ * Since 2.11.3 the handler behind the Approve button asks for
	2594	+ * manage_network_options, because the two files it approves, wp-config.php
	2595	+ * and the root .htaccess, belong to the installation, and so does the
	2596	+ * record of them. The button, though, went on being painted for everybody,
	2597	+ * so the administrator of a subsite saw the warning, saw the button,
	2598	+ * pressed it and got "Permission denied" with no explanation. That is
	2599	+ * exactly what user_actions_locked() above exists to avoid, one release
	2600	+ * later and one screen over. Flagged by @calzbert.
	2601	+ *
	2602	+ * @since 2.11.4
	2603	+ * @return bool
	2604	+ */
	2605	+ private function critical_approval_locked() {
	2606	+ return is_multisite() && ! current_user_can( 'manage_network_options' );
	2607	+ }
	2608	+
	2609	+ /**
	2610	+ * The line that replaces the Approve button where it cannot be used
	2611	+ *
	2612	+ * @since 2.11.4
	2613	+ * @return string
	2614	+ */
	2615	+ private function critical_approval_notice() {
	2616	+ return __( 'These files belong to the whole network rather than to this site, so a change to them is approved from the network admin.', 'vigilante' );
	2617	+ }
	2618	+
	2619	+ /**
2019	2620	* Check if module is disabled and render warning
2020	2621	*
2021	2622	* @param string $module_key Module key.
2022	2623	* @return bool True if disabled.
		@@ -2077,8 +2678,22 @@
2077	2678	$categories = isset( $last_scan['categories'] ) && is_array( $last_scan['categories'] ) ? $last_scan['categories'] : array();
2078	2679	$weekly_enabled = ! isset( $analyzer_settings['weekly_scan_enabled'] ) || ! empty( $analyzer_settings['weekly_scan_enabled'] );
2079	2680	$email_enabled = ! empty( $analyzer_settings['email_on_regression'] );
2080	2681
	2682	+ /*
	2683	+ * Self-protection caps the score, and it does so here and not only in
	2684	+ * the stored report: the report is reused until the next Security
	2685	+ * Check, so tampering found after it ran would otherwise be shown next
	2686	+ * to the score the site earned before it happened.
	2687	+ */
	2688	+ $self_summary = $this->self_integrity_summary();
	2689	+ $self_capped = in_array( $self_summary['tone'], array( 'critical', 'off' ), true )
	2690	+ || ( 'self_integrity' === ( isset( $last_scan['capped_by'] ) ? $last_scan['capped_by'] : '' ) );
	2691	+ if ( $self_capped && $has_data && $score > Vigilante_Security_Analyzer::SCORE_CAP_ON_TAMPER ) {
	2692	+ $score = Vigilante_Security_Analyzer::SCORE_CAP_ON_TAMPER;
	2693	+ $grade = 'E';
	2694	+ }
	2695	+
2081	2696	$quality = self::analyzer_quality_tag( $score );
2082	2697	?>
2083	2698	<div class="vigilante-analyzer" id="vigilante-analyzer"
2084	2699	data-has-data="<?php echo $has_data ? '1' : '0'; ?>">
		@@ -2103,8 +2718,19 @@
2103	2718	</button>
2104	2719	</div>
2105	2720	</div>
2106	2721
	2722	+ <?php if ( $self_capped ) : ?>
	2723	+ <p class="vigilante-analyzer-capped">
	2724	+ <span class="dashicons dashicons-shield" aria-hidden="true"></span>
	2725	+ <strong><?php esc_html_e( 'This score is not reliable right now.', 'vigilante' ); ?></strong>
	2726	+ <?php esc_html_e( 'Vigilant own files have been changed, and every other result on this page is produced by that same code. The score is held at the bottom of the scale until the files verify clean again.', 'vigilante' ); ?>
	2727	+ <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-self' ) ); ?>">
	2728	+ <?php esc_html_e( 'See what to do', 'vigilante' ); ?>
	2729	+ </a>
	2730	+ </p>
	2731	+ <?php endif; ?>
	2732	+
2107	2733	<div class="vigilante-analyzer-summary">
2108	2734	<div class="vigilante-analyzer-score-card">
2109	2735	<?php if ( $has_data && $grade ) : ?>
2110	2736	<div class="vigilante-score-circle vigilante-grade-<?php echo esc_attr( strtolower( $grade ) ); ?>">
		@@ -2478,8 +3104,58 @@
2478	3104
2479	3105	/**
2480	3106	* Render dashboard tab
2481	3107	*/
	3108	+ /**
	3109	+ * One line strip at the top of the Dashboard tab: the state of Vigilant own
	3110	+ * files, above the Configuration Score and the Security Check, because
	3111	+ * nothing else on this screen means much while it is red.
	3112	+ */
	3113	+ private function render_self_protection_strip() {
	3114	+ $summary = $this->self_integrity_summary();
	3115	+ $tone = $summary['tone'];
	3116	+ $state = $summary['state'];
	3117	+ $count = count( $summary['findings'] );
	3118	+ $link = admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-self' );
	3119	+ ?>
	3120	+ <div class="vigilante-self-strip vigilante-self-strip--<?php echo esc_attr( $tone ); ?>">
	3121	+ <span class="dashicons dashicons-shield" aria-hidden="true"></span>
	3122	+ <strong><?php esc_html_e( 'Vigilant self-protection', 'vigilante' ); ?></strong>
	3123	+ <span class="vigilante-self-strip-state"><?php echo esc_html( $this->self_integrity_headline( $tone, $state ) ); ?></span>
	3124	+ <?php if ( $count > 0 ) : ?>
	3125	+ <span class="vigilante-self-strip-count">
	3126	+ <?php
	3127	+ printf(
	3128	+ /* translators: %d: number of findings about Vigilant own files */
	3129	+ esc_html( _n( '%d finding', '%d findings', $count, 'vigilante' ) ),
	3130	+ (int) $count
	3131	+ );
	3132	+ ?>
	3133	+ </span>
	3134	+ <?php elseif ( ! empty( $state['last_check'] ) && 'off' !== $tone ) : ?>
	3135	+ <span class="vigilante-self-strip-count">
	3136	+ <?php
	3137	+ printf(
	3138	+ /* translators: %s: human time difference, like "2 hours" */
	3139	+ esc_html__( 'checked %s ago', 'vigilante' ),
	3140	+ esc_html( human_time_diff( (int) $state['last_check'], time() ) )
	3141	+ );
	3142	+ ?>
	3143	+ </span>
	3144	+ <?php endif; ?>
	3145	+ <a href="<?php echo esc_url( $link ); ?>">
	3146	+ <?php
	3147	+ if ( in_array( $tone, array( 'critical', 'off', 'warning' ), true ) ) {
	3148	+ esc_html_e( 'See what to do', 'vigilante' );
	3149	+ } else {
	3150	+ esc_html_e( 'See details', 'vigilante' );
	3151	+ }
	3152	+ ?>
	3153	+ </a>
	3154	+ </div>
	3155	+ <?php
	3156	+ }
	3157	+
2482	3158	private function render_tab_dashboard() {
2483	3159	$options = $this->settings->get_all_options();
2484	3160	$module_labels = $this->settings->get_module_labels();
2485	3161	$module_descriptions = $this->settings->get_module_descriptions();
		@@ -2499,8 +3175,9 @@
2499	3175	$analyzer_categories_def = Vigilante_Security_Analyzer::get_categories();
2500	3176	$analyzer_settings = isset( $options['security_analyzer'] ) ? $options['security_analyzer'] : array();
2501	3177	?>
2502	3178	<div class="vigilante-dashboard">
	3179	+ <?php $this->render_self_protection_strip(); ?>
2503	3180	<div class="vigilante-status-card">
2504	3181	<h2><?php esc_html_e( 'Configuration Score', 'vigilante' ); ?></h2>
2505	3182	<p class="vigilante-score-kind description">
2506	3183	<?php esc_html_e( 'How well Vigilante is configured right now. Pair it with the Security Check below to see the real-world result.', 'vigilante' ); ?>
		@@ -2560,14 +3237,15 @@
2560	3237
2561	3238	<?php $this->render_analyzer_widget( $analyzer_last_scan, $analyzer_history, $analyzer_categories_def, $analyzer_settings ); ?>
2562	3239
2563	3240	<div class="vigilante-modules-grid">
2564		- <h2><?php esc_html_e( 'Security Modules', 'vigilante' ); ?></h2>
	3241	+ <h2 id="vigilante-section-dashboard-modules"><?php esc_html_e( 'Security Modules', 'vigilante' ); ?></h2>
2565	3242	<p class="description"><?php esc_html_e( 'Enable or disable security modules. Each module controls a tab with detailed settings.', 'vigilante' ); ?></p>
2566	3243	<div class="vigilante-modules-list">
2567	3244	<?php foreach ( $options['modules'] as $module => $enabled ) :
2568	3245	$label = isset( $module_labels[ $module ] ) ? $module_labels[ $module ] : ucwords( str_replace( '_', ' ', $module ) );
2569	3246	$description = isset( $module_descriptions[ $module ] ) ? $module_descriptions[ $module ] : '';
	3247	+ $vg_module_locked = $this->main_site_files_locked() && in_array( $module, Vigilante_Settings::get_main_site_file_settings()['modules'], true );
2570	3248	?>
2571	3249	<div class="vigilante-module-item <?php echo $enabled ? 'enabled' : 'disabled'; ?>">
2572	3250	<div class="vigilante-module-header">
2573	3251	<span class="vigilante-module-status"></span>
		@@ -2580,8 +3258,9 @@
2580	3258	<input type="checkbox"
2581	3259	name="modules[<?php echo esc_attr( $module ); ?>]"
2582	3260	value="1"
2583	3261	<?php checked( $enabled ); ?>
	3262	+ <?php disabled( $vg_module_locked ); ?>
2584	3263	aria-label="<?php echo esc_attr( $toggle_label ); ?>"
2585	3264	data-module="<?php echo esc_attr( $module ); ?>">
2586	3265	<span class="vigilante-toggle-slider"></span>
2587	3266	</label>
		@@ -2588,8 +3267,11 @@
2588	3267	</div>
2589	3268	<?php if ( $description ) : ?>
2590	3269	<p class="vigilante-module-desc"><?php echo esc_html( $description ); ?></p>
2591	3270	<?php endif; ?>
	3271	+ <?php if ( $vg_module_locked ) : ?>
	3272	+ <p class="vigilante-module-desc"><?php esc_html_e( 'On the main site of a network this module also writes files every site shares, so only a network administrator can switch it.', 'vigilante' ); ?></p>
	3273	+ <?php endif; ?>
2592	3274	</div>
2593	3275	<?php endforeach; ?>
2594	3276	</div>
2595	3277	</div>
		@@ -2621,9 +3303,9 @@
2621	3303	$ua_remaining_hours = floor( $ua_remaining / 3600 );
2622	3304	$ua_remaining_mins = floor( ( $ua_remaining % 3600 ) / 60 );
2623	3305	?>
2624	3306	<div class="vigilante-preset-card vigilante-under-attack-card <?php echo $ua_active ? 'vigilante-under-attack-active' : ''; ?>">
2625		- <h3>
	3307	+ <h3 id="vigilante-section-dashboard-under-attack">
2626	3308	<span class="dashicons dashicons-shield"></span>
2627	3309	<?php esc_html_e( 'Under Attack', 'vigilante' ); ?>
2628	3310	</h3>
2629	3311	<p><?php esc_html_e( 'Emergency mode. JavaScript challenge for all visitors, aggressive rate limiting, and restricted access. Auto-deactivates after 4 hours.', 'vigilante' ); ?></p>
		@@ -2979,14 +3661,21 @@
2979	3661	<?php esc_html_e( 'Full page caching systems that serve cached pages before PHP executes (Varnish, LiteSpeed Cache, NGINX FastCGI Cache, Cloudflare APO) may bypass PHP-level firewall rules for cached requests. The .htaccess rules will still apply on Apache/LiteSpeed servers.', 'vigilante' ); ?>
2980	3662	</p>
2981	3663	</div>
2982	3664
	3665	+ <?php $vg_main_locked = $this->main_site_files_locked(); ?>
	3666	+ <?php if ( $vg_main_locked ) : ?>
	3667	+ <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
	3668	+ <p style="margin:0;"><?php esc_html_e( 'On the main site of a network, blocking bad bots and bad query strings, the visitor IP detection and the two whitelists also build the .htaccess rules every site shares, so only a network administrator can change them.', 'vigilante' ); ?></p>
	3669	+ </div>
	3670	+ <?php endif; ?>
	3671	+
2983	3672	<table class="form-table">
2984	3673	<tr>
2985	3674	<th scope="row"><?php esc_html_e( 'Block Bad Query Strings', 'vigilante' ); ?></th>
2986	3675	<td>
2987	3676	<label>
2988		- <input type="checkbox" name="firewall[block_bad_query_strings]" value="1" <?php checked( ! empty( $options['block_bad_query_strings'] ) ); ?>>
	3677	+ <input type="checkbox" name="firewall[block_bad_query_strings]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( ! empty( $options['block_bad_query_strings'] ) ); ?>>
2989	3678	<?php esc_html_e( 'Block malicious query string patterns', 'vigilante' ); ?>
2990	3679	</label>
2991	3680	</td>
2992	3681	</tr>
		@@ -3029,9 +3718,9 @@
3029	3718	<tr>
3030	3719	<th scope="row"><?php esc_html_e( 'Block Bad Bots', 'vigilante' ); ?></th>
3031	3720	<td>
3032	3721	<label>
3033		- <input type="checkbox" name="firewall[block_bad_bots]" value="1" <?php checked( ! empty( $options['block_bad_bots'] ) ); ?>>
	3722	+ <input type="checkbox" name="firewall[block_bad_bots]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( ! empty( $options['block_bad_bots'] ) ); ?>>
3034	3723	<?php esc_html_e( 'Block known malicious bots and scanners', 'vigilante' ); ?>
3035	3724	</label>
3036	3725	</td>
3037	3726	</tr>
		@@ -3145,8 +3834,29 @@
3145	3834	</table>
3146	3835	</div>
3147	3836	<?php endif; ?>
3148	3837
	3838	+ <?php
	3839	+ // Since 2.11.8 X-Forwarded-For is read from its end, where the proxy
	3840	+ // writes. The administrator's own request shows whether that end is
	3841	+ // a CDN or a balancer for everybody here. Cross review of 2.11.8.
	3842	+ $xff_readings = $this->forwarded_chain_readings();
	3843	+ if ( $xff_readings ) :
	3844	+ ?>
	3845	+ <div id="vigilante-xff-chain-notice" class="notice notice-warning inline" style="margin:10px 0 16px;padding:8px 12px;">
	3846	+ <p style="margin:0;">
	3847	+ <?php
	3848	+ printf(
	3849	+ /* translators: 1: last address in the header, the one Vigilant reads, 2: first address in the header, which a visitor can write */
	3850	+ esc_html__( 'Your own request reaches the site with more than one public address in X-Forwarded-For. Vigilant reads the last one, %1$s, which is the one your proxy added, and not the first one, %2$s, which a visitor can write. If %1$s belongs to a CDN or a load balancer rather than to you, every visitor shares it for rate limiting, login lockouts and the IP lists: choose the header of that CDN in Visitor IP detection, such as CF-Connecting-IP for Cloudflare.', 'vigilante' ),
	3851	+ esc_html( $xff_readings['now'] ),
	3852	+ esc_html( $xff_readings['before'] )
	3853	+ );
	3854	+ ?>
	3855	+ </p>
	3856	+ </div>
	3857	+ <?php endif; ?>
	3858	+
3149	3859	<h3><?php esc_html_e( 'IP Lists', 'vigilante' ); ?></h3>
3150	3860	<p class="description">
3151	3861	<?php
3152	3862	printf(
		@@ -3160,9 +3870,9 @@
3160	3870	<tr>
3161	3871	<th scope="row"><label for="vigilante-f-firewall-trusted-proxy-header"><?php esc_html_e( 'Visitor IP detection', 'vigilante' ); ?></label></th>
3162	3872	<td>
3163	3873	<?php $proxy_header = $options['trusted_proxy_header'] ?? ''; ?>
3164		- <select id="vigilante-f-firewall-trusted-proxy-header" name="firewall[trusted_proxy_header]">
	3874	+ <select id="vigilante-f-firewall-trusted-proxy-header" name="firewall[trusted_proxy_header]" <?php disabled( $vg_main_locked ); ?>>
3165	3875	<option value="" <?php selected( $proxy_header, '' ); ?>><?php esc_html_e( 'Direct connection, only REMOTE_ADDR (recommended)', 'vigilante' ); ?></option>
3166	3876	<option value="cf-connecting-ip" <?php selected( $proxy_header, 'cf-connecting-ip' ); ?>><?php esc_html_e( 'Behind Cloudflare (CF-Connecting-IP)', 'vigilante' ); ?></option>
3167	3877	<option value="x-forwarded-for" <?php selected( $proxy_header, 'x-forwarded-for' ); ?>><?php esc_html_e( 'Behind a reverse proxy or load balancer (X-Forwarded-For)', 'vigilante' ); ?></option>
3168	3878	<option value="x-real-ip" <?php selected( $proxy_header, 'x-real-ip' ); ?>><?php esc_html_e( 'Behind an nginx proxy (X-Real-IP)', 'vigilante' ); ?></option>
		@@ -3172,11 +3882,23 @@
3172	3882	</p>
3173	3883	</td>
3174	3884	</tr>
3175	3885	<tr>
	3886	+ <th scope="row"><label for="vigilante-f-firewall-trusted-proxies"><?php esc_html_e( 'Trusted proxy IPs', 'vigilante' ); ?></label></th>
	3887	+ <td>
	3888	+ <textarea id="vigilante-f-firewall-trusted-proxies" name="firewall[trusted_proxies]" rows="3" class="large-text code" placeholder="10.0.0.0/8&#10;192.168.1.1" <?php disabled( $vg_main_locked ); ?>><?php echo esc_textarea( implode( "\n", $options['trusted_proxies'] ?? array() ) ); ?></textarea>
	3889	+ <p class="description">
	3890	+ <?php esc_html_e( 'Only used with a forwarded header selected above. One IP or CIDR range per line: the addresses your proxy or load balancer connects from. The forwarded header is accepted only from these. Left empty, Vigilant accepts it from your own private network, and for Cloudflare from Cloudflare\'s own ranges automatically.', 'vigilante' ); ?>
	3891	+ <?php if ( in_array( $proxy_header, array( 'x-forwarded-for', 'x-real-ip' ), true ) && empty( $options['trusted_proxies'] ) ) : ?>
	3892	+ <br><strong><?php esc_html_e( 'The header above is trusted but no proxy IPs are set. If your proxy or load balancer connects from a public address, add it here, or the header is ignored for safety and every visitor is seen as that proxy.', 'vigilante' ); ?></strong>
	3893	+ <?php endif; ?>
	3894	+ </p>
	3895	+ </td>
	3896	+ </tr>
	3897	+ <tr>
3176	3898	<th scope="row"><label for="vigilante-f-firewall-ip-whitelist"><?php esc_html_e( 'IP Whitelist', 'vigilante' ); ?></label></th>
3177	3899	<td>
3178		- <textarea id="vigilante-f-firewall-ip-whitelist" name="firewall[ip_whitelist]" rows="4" class="large-text code" placeholder="192.168.1.50&#10;192.168.1.0/24&#10;192.168.1.*"><?php echo esc_textarea( implode( "\n", $options['ip_whitelist'] ?? array() ) ); ?></textarea>
	3900	+ <textarea id="vigilante-f-firewall-ip-whitelist" name="firewall[ip_whitelist]" <?php disabled( $vg_main_locked ); ?> rows="4" class="large-text code" placeholder="192.168.1.50&#10;192.168.1.0/24&#10;192.168.1.*"><?php echo esc_textarea( implode( "\n", $options['ip_whitelist'] ?? array() ) ); ?></textarea>
3179	3901	<p class="description">
3180	3902	<?php esc_html_e( 'One IP per line. These IPs bypass the firewall checks, and they also reach wp-admin when the login URL is hidden, so remote managers such as MainWP or ManageWP are not turned away with a 404. The hidden login form itself stays hidden for every IP, this one included.', 'vigilante' ); ?>
3181	3903	<br>
3182	3904	<?php
		@@ -3215,9 +3937,9 @@
3215	3937	<table class="form-table">
3216	3938	<tr>
3217	3939	<th scope="row"><label for="vigilante-f-firewall-ua-whitelist"><?php esc_html_e( 'User-Agent Whitelist', 'vigilante' ); ?></label></th>
3218	3940	<td>
3219		- <textarea id="vigilante-f-firewall-ua-whitelist" name="firewall[ua_whitelist]" rows="4" class="large-text code"><?php echo esc_textarea( implode( "\n", $options['ua_whitelist'] ?? array() ) ); ?></textarea>
	3941	+ <textarea id="vigilante-f-firewall-ua-whitelist" name="firewall[ua_whitelist]" <?php disabled( $vg_main_locked ); ?> rows="4" class="large-text code"><?php echo esc_textarea( implode( "\n", $options['ua_whitelist'] ?? array() ) ); ?></textarea>
3220	3942	<p class="description"><?php esc_html_e( 'One User-Agent per line. These will bypass all firewall checks. Example: ManageWP, MainWP, UptimeRobot.', 'vigilante' ); ?></p>
3221	3943	</td>
3222	3944	</tr>
3223	3945	<tr>
		@@ -3505,9 +4227,9 @@
3505	4227	$two_factor = $options['two_factor'] ?? array();
3506	4228	$two_factor_enabled = ! empty( $two_factor['enabled'] );
3507	4229	?>
3508	4230	<div class="vigilante-settings-section vigilante-lockout-section">
3509		- <h2><?php esc_html_e( 'Login Protection Status', 'vigilante' ); ?></h2>
	4231	+ <h2 id="vigilante-section-login-status"><?php esc_html_e( 'Login Protection Status', 'vigilante' ); ?></h2>
3510	4232
3511	4233	<table class="form-table">
3512	4234	<tr>
3513	4235	<th scope="row"><?php esc_html_e( 'Current settings', 'vigilante' ); ?></th>
		@@ -3667,9 +4389,9 @@
3667	4389	$excluded = $two_factor['excluded_users'] ?? array();
3668	4390	$method = $two_factor['method'] ?? 'email';
3669	4391	$grace_days = $two_factor['grace_period_days'] ?? 3;
3670	4392	?>
3671		- <h3>
	4393	+ <h3 id="vigilante-section-login-2fa">
3672	4394	<?php esc_html_e( 'Two-Factor Authentication (2FA)', 'vigilante' ); ?>
3673	4395	<span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
3674	4396	<span class="vigilante-method-badge database"><?php esc_html_e( 'Database', 'vigilante' ); ?></span>
3675	4397	</h3>
		@@ -3926,9 +4648,9 @@
3926	4648	?>
3927	4649	<div class="vigilante-settings-section" id="vigilante-headers-recovery">
3928	4650	<h2><?php esc_html_e( 'Recover your previous header settings', 'vigilante' ); ?></h2>
3929	4651	<p>
3930		- <?php esc_html_e( 'Updating to 2.9.8 reset this tab to factory values: the migration replaced the whole section instead of merging into it. Your server kept sending the right headers, because the .htaccess had not been rewritten yet, so Vigilant saved a copy of that file before touching it. These are the settings it found in that copy.', 'vigilante' ); ?>
	4652	+ <?php esc_html_e( 'An earlier update reset this tab to factory values: the migration replaced the whole section instead of merging into it. Your server kept sending the right headers, because the .htaccess had not been rewritten yet, so Vigilant saved a copy of that file before touching it. These are the settings it found in that copy.', 'vigilante' ); ?>
3931	4653	</p>
3932	4654	<?php if ( $taken ) : ?>
3933	4655	<p class="description">
3934	4656	<?php
		@@ -4040,9 +4762,9 @@
4040	4762	</td>
4041	4763	</tr>
4042	4764	</table>
4043	4765
4044		- <h3><?php esc_html_e( 'Content Security Policy', 'vigilante' ); ?></h3>
	4766	+ <h3 id="vigilante-section-headers-csp"><?php esc_html_e( 'Content Security Policy', 'vigilante' ); ?></h3>
4045	4767	<table class="form-table">
4046	4768	<tr>
4047	4769	<th scope="row"><?php esc_html_e( 'Enable CSP', 'vigilante' ); ?></th>
4048	4770	<td>
		@@ -4062,9 +4784,9 @@
4062	4784	</td>
4063	4785	</tr>
4064	4786	</table>
4065	4787
4066		- <h3><?php esc_html_e( 'HTTPS', 'vigilante' ); ?></h3>
	4788	+ <h3 id="vigilante-section-headers-force-https"><?php esc_html_e( 'HTTPS', 'vigilante' ); ?></h3>
4067	4789	<p class="description"><?php esc_html_e( 'HTTPS is strongly recommended, but Vigilant will not impose it. Enable only what your site already supports.', 'vigilante' ); ?></p>
4068	4790	<table class="form-table">
4069	4791	<tr>
4070	4792	<th scope="row"><?php esc_html_e( 'Redirect HTTP to HTTPS', 'vigilante' ); ?></th>
		@@ -4107,9 +4829,9 @@
4107	4829	</td>
4108	4830	</tr>
4109	4831	</table>
4110	4832
4111		- <h3><?php esc_html_e( 'HSTS (HTTP Strict Transport Security)', 'vigilante' ); ?></h3>
	4833	+ <h3 id="vigilante-section-headers-hsts"><?php esc_html_e( 'HSTS (HTTP Strict Transport Security)', 'vigilante' ); ?></h3>
4112	4834	<?php $vig_home_https = ( 0 === strpos( (string) get_option( 'home' ), 'https://' ) ); ?>
4113	4835	<p class="description"><?php esc_html_e( 'Tells browsers to reach this site over HTTPS and never over HTTP, for as long as the max age below.', 'vigilante' ); ?></p>
4114	4836	<?php if ( ! $vig_home_https ) : ?>
4115	4837	<p class="description" style="color:#b32d2e"><strong><?php esc_html_e( 'Unavailable: the site address still starts with http://. Enabling HSTS on a site not published over HTTPS would make it unreachable in any browser that honours it.', 'vigilante' ); ?></strong></p>
		@@ -4150,9 +4872,9 @@
4150	4872	</td>
4151	4873	</tr>
4152	4874	</table>
4153	4875
4154		- <h3><?php esc_html_e( 'Server Identity', 'vigilante' ); ?></h3>
	4876	+ <h3 id="vigilante-section-headers-fingerprint"><?php esc_html_e( 'Server Identity', 'vigilante' ); ?></h3>
4155	4877	<p class="description"><?php esc_html_e( 'Hide identifying information that servers expose in responses.', 'vigilante' ); ?></p>
4156	4878	<table class="form-table">
4157	4879	<tr>
4158	4880	<th scope="row"><?php esc_html_e( 'Server Signature', 'vigilante' ); ?></th>
		@@ -4537,8 +5259,16 @@
4537	5259	<span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
4538	5260	</h2>
4539	5261	<p><?php esc_html_e( 'Limit the number of simultaneous sessions per user.', 'vigilante' ); ?></p>
4540	5262
	5263	+ <?php if ( Vigilante_User_Security::session_limit_is_network_wide() ) : ?>
	5264	+ <div class="notice notice-warning inline">
	5265	+ <p>
	5266	+ <?php esc_html_e( 'This limit does not apply on a network. WordPress keeps the sessions of an account for the whole network, not per site, so a limit set here would count and close the sessions that person opened on other sites, including an administrator session elsewhere. A network-wide session policy is planned; until then these settings are saved but not enforced.', 'vigilante' ); ?>
	5267	+ </p>
	5268	+ </div>
	5269	+ <?php endif; ?>
	5270	+
4541	5271	<table class="form-table">
4542	5272	<tr>
4543	5273	<th scope="row"><?php esc_html_e( 'Enable Session Limits', 'vigilante' ); ?></th>
4544	5274	<td>
		@@ -4741,8 +5471,11 @@
4741	5471	<h2 class="vigilante-tools-header">
4742	5472	<?php esc_html_e( 'User security tools', 'vigilante' ); ?>
4743	5473	</h2>
4744	5474
	5475	+ <?php $this->render_user_actions_notice(); ?>
	5476	+ <?php if ( ! $this->user_actions_locked() ) : ?>
	5477	+
4745	5478	<!-- Force Password Reset -->
4746	5479	<div class="vigilante-tool-box">
4747	5480	<h3><?php esc_html_e( 'Force password reset', 'vigilante' ); ?></h3>
4748	5481	<p class="description"><?php esc_html_e( 'Force users to reset their password. Useful after a security incident. Users will receive an email with a reset link.', 'vigilante' ); ?></p>
		@@ -4875,12 +5608,20 @@
4875	5608	</div>
4876	5609
4877	5610	<!-- Pending Registrations -->
4878	5611	<?php
4879		- $user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
	5612	+ // Enforcement-only: this instance exists to read the queue, and the
	5613	+ // flag keeps it from registering the module's own hooks a second
	5614	+ // time. It is not inert, and saying it was would be a false comment:
	5615	+ // init_enforcement_hooks() does add its three filters again, on top
	5616	+ // of the ones already registered. They are idempotent (the same
	5617	+ // methods of an equivalent instance, deciding on the same user meta),
	5618	+ // so running them twice in an admin request changes nothing, which is
	5619	+ // why this is accepted rather than worked around.
	5620	+ $user_security = new Vigilante_User_Security( $this->settings, $this->activity_log, true );
4880	5621	$pending_users = $user_security->get_pending_users();
4881	5622	?>
4882		- <div class="vigilante-tool-box vigilante-pending-users-section">
	5623	+ <div id="vigilante-section-users-pending" class="vigilante-tool-box vigilante-pending-users-section">
4883	5624	<h3>
4884	5625	<?php esc_html_e( 'Pending registrations', 'vigilante' ); ?>
4885	5626	<?php if ( count( $pending_users ) > 0 ) : ?>
4886	5627	<span class="vigilante-badge vigilante-badge-warning"><?php echo esc_html( count( $pending_users ) ); ?></span>
		@@ -4886,9 +5627,20 @@
4886	5627	<span class="vigilante-badge vigilante-badge-warning"><?php echo esc_html( count( $pending_users ) ); ?></span>
4887	5628	<?php endif; ?>
4888	5629	</h3>
4889	5630
4890		- <?php if ( empty( $registration['enabled'] ) ) : ?>
	5631	+ <?php
	5632	+ /*
	5633	+ * The queue is shown whenever there is somebody in it, even with
	5634	+ * the feature off. Since 2.11.10 an account already waiting stays
	5635	+ * blocked when the feature is switched off, which is the point:
	5636	+ * turning a setting off must not quietly let in people an
	5637	+ * administrator decided not to approve. But hiding the table then
	5638	+ * left them locked out with no button anywhere to approve or
	5639	+ * reject them. Found by the cross review of 2.11.10.
	5640	+ */
	5641	+ ?>
	5642	+ <?php if ( empty( $registration['enabled'] ) && empty( $pending_users ) ) : ?>
4891	5643	<p class="description">
4892	5644	<span class="dashicons dashicons-info" style="color: #72aee6;"></span>
4893	5645	<?php esc_html_e( 'Registration approval is disabled. Enable it in the settings above to require manual approval for new users.', 'vigilante' ); ?>
4894	5646	</p>
		@@ -4897,8 +5649,9 @@
4897	5649	<span class="dashicons dashicons-yes-alt"></span>
4898	5650	<p><?php esc_html_e( 'No pending registrations.', 'vigilante' ); ?></p>
4899	5651	</div>
4900	5652	<?php else : ?>
	5653	+ <?php $this->render_user_actions_notice(); ?>
4901	5654	<table class="wp-list-table widefat fixed striped vigilante-pending-users-table">
4902	5655	<thead>
4903	5656	<tr>
4904	5657	<th><?php esc_html_e( 'User', 'vigilante' ); ?></th>
		@@ -4908,9 +5661,9 @@
4908	5661	</tr>
4909	5662	</thead>
4910	5663	<tbody>
4911	5664	<?php foreach ( $pending_users as $pending_user ) :
4912		- $pending_since = get_user_meta( $pending_user->ID, 'vigilante_pending_since', true );
	5665	+ $pending_since = get_user_meta( $pending_user->ID, Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_since' ), true );
4913	5666	?>
4914	5667	<tr data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>">
4915	5668	<td>
4916	5669	<?php echo get_avatar( $pending_user->ID, 32 ); ?>
		@@ -4927,12 +5680,12 @@
4927	5680	}
4928	5681	?>
4929	5682	</td>
4930	5683	<td>
4931		- <button type="button" class="button button-small vigilante-approve-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>">
	5684	+ <button type="button" class="button button-small vigilante-approve-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" <?php disabled( $this->user_actions_locked() ); ?>>
4932	5685	<?php esc_html_e( 'Approve', 'vigilante' ); ?>
4933	5686	</button>
4934		- <button type="button" class="button button-small vigilante-reject-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" style="color: #d63638;">
	5687	+ <button type="button" class="button button-small vigilante-reject-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" style="color: #d63638;" <?php disabled( $this->user_actions_locked() ); ?>>
4935	5688	<?php esc_html_e( 'Reject', 'vigilante' ); ?>
4936	5689	</button>
4937	5690	</td>
4938	5691	</tr>
		@@ -5054,8 +5807,10 @@
5054	5807	</button>
5055	5808	</p>
5056	5809	</div>
5057	5810	</div>
	5811	+
	5812	+ <?php endif; ?>
5058	5813	</div>
5059	5814	<?php
5060	5815	}
5061	5816
		@@ -5777,8 +6532,19 @@
5777	6532	'is_ip_blacklisted' => ( '' !== $ip_val && in_array( $ip_val, $ip_blacklist, true ) ),
5778	6533	'is_ua_whitelisted' => ( '' !== $ua_val && in_array( $ua_val, $ua_whitelist, true ) ),
5779	6534	'is_ua_blacklisted' => ( '' !== $ua_val && in_array( $ua_val, $ua_blacklist, true ) ),
5780	6535	);
	6536	+ // Self-protection entries carry what happened, what
	6537	+ // it means and what to do, from the same catalogue
	6538	+ // the File Integrity box uses.
	6539	+ $vg_self_event = Vigilante_Self_Integrity_Guidance::for_log_event(
	6540	+ (string) ( $log->event_action ?? '' ),
	6541	+ $log->extra_data ?? '',
	6542	+ (string) ( $log->severity ?? 'info' )
	6543	+ );
	6544	+ if ( null !== $vg_self_event ) {
	6545	+ $details['self'] = $vg_self_event;
	6546	+ }
5781	6547	$display_type = isset( $type_labels[ $log->event_type ] ) ? $type_labels[ $log->event_type ] : $log->event_type;
5782	6548	$display_severity = isset( $severity_labels[ $log->severity ] ) ? $severity_labels[ $log->severity ] : $log->severity;
5783	6549	?>
5784	6550	<tr class="vigilante-severity-<?php echo esc_attr( $log->severity ); ?>">
		@@ -5821,15 +6587,439 @@
5821	6587
5822	6588	/**
5823	6589	* Render File Integrity tab
5824	6590	*/
	6591	+ /**
	6592	+ * Findings of the self-check grouped by the case that explains them, worst
	6593	+ * first: ten modified files are one case with ten paths, not ten copies of
	6594	+ * the same explanation.
	6595	+ *
	6596	+ * @param array $findings Findings from the state.
	6597	+ * @return array
	6598	+ */
	6599	+ private function self_findings_by_case( $findings ) {
	6600	+ $groups = array();
	6601	+ foreach ( (array) $findings as $finding ) {
	6602	+ if ( ! is_array( $finding ) || 'info' === ( $finding['severity'] ?? '' ) ) {
	6603	+ continue;
	6604	+ }
	6605	+ $guidance = Vigilante_Self_Integrity_Guidance::for_finding( $finding );
	6606	+ $key = $guidance['key'];
	6607	+ if ( ! isset( $groups[ $key ] ) ) {
	6608	+ $guidance['files'] = array();
	6609	+ $guidance['severity'] = 'warning';
	6610	+ $groups[ $key ] = $guidance;
	6611	+ }
	6612	+ $file = isset( $finding['file'] ) ? (string) $finding['file'] : '';
	6613	+ if ( '' !== $file && ! in_array( $file, $groups[ $key ]['files'], true ) ) {
	6614	+ $groups[ $key ]['files'][] = $file;
	6615	+ }
	6616	+ if ( 'critical' === ( $finding['severity'] ?? '' ) ) {
	6617	+ $groups[ $key ]['severity'] = 'critical';
	6618	+ }
	6619	+ }
	6620	+ uasort(
	6621	+ $groups,
	6622	+ function ( $a, $b ) {
	6623	+ $rank = array( 'critical' => 0, 'warning' => 1 );
	6624	+ $ra = isset( $rank[ $a['severity'] ] ) ? $rank[ $a['severity'] ] : 2;
	6625	+ $rb = isset( $rank[ $b['severity'] ] ) ? $rank[ $b['severity'] ] : 2;
	6626	+ return $ra - $rb;
	6627	+ }
	6628	+ );
	6629	+ return $groups;
	6630	+ }
	6631	+
	6632	+ /**
	6633	+ * Human label for the context that ran the last self-check.
	6634	+ *
	6635	+ * @param string $context Stored context.
	6636	+ * @return string
	6637	+ */
	6638	+ private function self_context_label( $context ) {
	6639	+ switch ( (string) $context ) {
	6640	+ case 'scan':
	6641	+ return __( 'during a file integrity scan', 'vigilante' );
	6642	+ case 'upgrader':
	6643	+ return __( 'right after updating Vigilant', 'vigilante' );
	6644	+ case 'version_change':
	6645	+ return __( 'after a version change made outside the updater', 'vigilante' );
	6646	+ case 'migration':
	6647	+ return __( 'while updating to this version', 'vigilante' );
	6648	+ case 'activation':
	6649	+ return __( 'when Vigilant was activated', 'vigilante' );
	6650	+ case 'watchdog':
	6651	+ return __( 'from the scheduled task watchdog', 'vigilante' );
	6652	+ }
	6653	+ return '';
	6654	+ }
	6655	+
	6656	+ /**
	6657	+ * Short line for the badge of the box, the notices and the Dashboard strip.
	6658	+ *
	6659	+ * @param string $tone Tone from Vigilante_Self_Integrity::tone().
	6660	+ * @param array $state State.
	6661	+ * @return string
	6662	+ */
	6663	+ private function self_integrity_headline( $tone, $state ) {
	6664	+ $files = isset( $state['files_checked'] ) ? (int) $state['files_checked'] : 0;
	6665	+ $anchors = ( isset( $state['anchors'] ) && is_array( $state['anchors'] ) ) ? $state['anchors'] : array();
	6666	+ switch ( $tone ) {
	6667	+ case 'critical':
	6668	+ return __( 'Changes detected in Vigilant own files', 'vigilante' );
	6669	+ case 'warning':
	6670	+ return ( $files < 1 )
	6671	+ ? __( 'Vigilant could not check its own files', 'vigilante' )
	6672	+ : __( 'Vigilant self-protection needs your attention', 'vigilante' );
	6673	+ case 'off':
	6674	+ return __( 'Self-protection is switched off by code', 'vigilante' );
	6675	+ case 'none':
	6676	+ return __( 'Vigilant has not checked its own files yet', 'vigilante' );
	6677	+ }
	6678	+ return sprintf(
	6679	+ /* translators: 1: number of files verified, 2: number of references available, out of three */
	6680	+ __( 'Verified: %1$d files, %2$d of 3 references', 'vigilante' ),
	6681	+ $files,
	6682	+ count( array_filter( $anchors ) )
	6683	+ );
	6684	+ }
	6685	+
	6686	+ /**
	6687	+ * Vigilant self-protection box: the first block of the File Integrity
	6688	+ * results, with its own colour by severity, what each finding means and
	6689	+ * how to fix it.
	6690	+ *
	6691	+ * It renders whether or not a scan has been stored, because the self-check
	6692	+ * also runs after every update and once a day: before 3.0.0 this lived in
	6693	+ * a line above the numeric cards of the last scan, where it was invisible
	6694	+ * and, without a stored scan, absent.
	6695	+ *
	6696	+ * @param array $fi_options File Integrity settings section.
	6697	+ */
	6698	+ /**
	6699	+ * Everything the screens need to say about self-protection, read once:
	6700	+ * the state, its findings grouped by case, and the tone that colours the
	6701	+ * box, the menu counter and the notices.
	6702	+ *
	6703	+ * @param array|null $fi_options File Integrity settings, read if not given.
	6704	+ * @return array { state, findings, groups, tone, enabled }
	6705	+ */
	6706	+ private function self_integrity_summary( $fi_options = null ) {
	6707	+ // Four to six screens ask for this in the same page load (menu, notice,
	6708	+ // box, strip, both scores). The option is cached by the core options
	6709	+ // layer, but the grouping and the tone are not: memoize per request.
	6710	+ static $cached = null;
	6711	+ if ( null !== $cached && ! is_array( $fi_options ) ) {
	6712	+ return $cached;
	6713	+ }
	6714	+ if ( ! is_array( $fi_options ) ) {
	6715	+ $fi_options = (array) $this->settings->get_section( 'file_integrity' );
	6716	+ }
	6717	+ $enabled = Vigilante_Self_Integrity::is_on();
	6718	+ $state = Vigilante_Self_Integrity::display_state();
	6719	+ $findings = Vigilante_Self_Integrity::state_findings( $state, $enabled );
	6720	+ $summary = array(
	6721	+ 'state' => $state,
	6722	+ 'findings' => $findings,
	6723	+ 'groups' => $this->self_findings_by_case( $findings ),
	6724	+ 'tone' => Vigilante_Self_Integrity::tone( $state, $enabled ),
	6725	+ 'enabled' => $enabled,
	6726	+ );
	6727	+ $cached = $summary;
	6728	+ return $summary;
	6729	+ }
	6730	+
	6731	+ private function render_self_protection_box( $fi_options ) {
	6732	+ $summary = $this->self_integrity_summary( $fi_options );
	6733	+ $enabled = $summary['enabled'];
	6734	+ $state = $summary['state'];
	6735	+ $findings = $summary['findings'];
	6736	+ $groups = $summary['groups'];
	6737	+ $tone = $summary['tone'];
	6738	+ $total = isset( $state['last_findings_total'] ) ? (int) $state['last_findings_total'] : count( $findings );
	6739	+ $status = array(
	6740	+ 'status' => isset( $state['last_status'] ) ? (string) $state['last_status'] : '',
	6741	+ 'files' => isset( $state['files_checked'] ) ? (int) $state['files_checked'] : 0,
	6742	+ 'anchors' => ( isset( $state['anchors'] ) && is_array( $state['anchors'] ) ) ? $state['anchors'] : array(),
	6743	+ 'enabled' => $enabled,
	6744	+ 'has_run' => ! empty( $state['last_check'] ),
	6745	+ );
	6746	+
	6747	+ /*
	6748	+ * Nothing to do, nothing to open: one line. A card with a big icon and
	6749	+ * folded sections for "everything is fine" is furniture, and furniture
	6750	+ * is what made the previous version of this invisible.
	6751	+ */
	6752	+ if ( empty( $groups ) ) {
	6753	+ $this->render_self_line( $tone, $state, $status );
	6754	+ return;
	6755	+ }
	6756	+
	6757	+ $datetime_format = get_option( 'date_format' ) . ' ' . get_option( 'time_format' );
	6758	+ $context_label = $this->self_context_label( isset( $state['last_context'] ) ? $state['last_context'] : '' );
	6759	+ $icon = ( 'critical' === $tone ) ? 'dashicons-shield' : 'dashicons-warning';
	6760	+ ?>
	6761	+ <div id="vigilante-section-fi-self" class="vigilante-settings-section vigilante-self-box vigilante-self-box--<?php echo esc_attr( $tone ); ?>">
	6762	+ <div class="vigilante-self-card">
	6763	+ <div class="vigilante-self-head">
	6764	+ <span class="vigilante-self-icon"><span class="dashicons <?php echo esc_attr( $icon ); ?>" aria-hidden="true"></span></span>
	6765	+ <div class="vigilante-self-head-text">
	6766	+ <h2><?php echo esc_html( $this->self_integrity_headline( $tone, $state ) ); ?></h2>
	6767	+ <p class="vigilante-self-meta">
	6768	+ <?php
	6769	+ printf(
	6770	+ /* translators: %s: date and time of the last self-check */
	6771	+ esc_html__( 'Checked on %s', 'vigilante' ),
	6772	+ esc_html( wp_date( $datetime_format, (int) $state['last_check'] ) )
	6773	+ );
	6774	+ if ( '' !== $context_label ) {
	6775	+ echo ', ' . esc_html( $context_label );
	6776	+ }
	6777	+ if ( $status['files'] > 0 ) {
	6778	+ echo ', ';
	6779	+ printf(
	6780	+ /* translators: 1: number of files checked, 2: number of references available, out of three */
	6781	+ esc_html__( '%1$d files against %2$d of 3 references', 'vigilante' ),
	6782	+ (int) $status['files'],
	6783	+ (int) count( array_filter( $status['anchors'] ) )
	6784	+ );
	6785	+ }
	6786	+ ?>
	6787	+ </p>
	6788	+ </div>
	6789	+ </div>
	6790	+
	6791	+ <div class="vigilante-self-cases">
	6792	+ <?php
	6793	+ $first = true;
	6794	+ foreach ( $groups as $group ) {
	6795	+ $this->render_self_case( $group, $group['files'], $group['severity'], $first );
	6796	+ $first = false;
	6797	+ }
	6798	+
	6799	+ if ( in_array( $tone, array( 'critical', 'warning' ), true ) ) {
	6800	+ $can_repair = class_exists( 'Vigilante_Self_Repair' ) && Vigilante_Self_Repair::can_repair();
	6801	+ if ( ! $can_repair ) {
	6802	+ if ( class_exists( 'Vigilante_Self_Repair' ) && ! Vigilante_Self_Repair::folder_is_the_distributed_one() ) {
	6803	+ $vg_reason = 'renamed';
	6804	+ } elseif ( ! wp_is_file_mod_allowed( 'capability_update_core' ) ) {
	6805	+ // With DISALLOW_FILE_MODS nobody can do it from the admin,
	6806	+ // not even a network administrator: telling a subsite admin
	6807	+ // to ask theirs would send them to someone equally blocked.
	6808	+ $vg_reason = 'no_caps';
	6809	+ } elseif ( is_multisite() && ! current_user_can( 'update_plugins' ) ) {
	6810	+ $vg_reason = 'network';
	6811	+ } else {
	6812	+ $vg_reason = 'no_caps';
	6813	+ }
	6814	+ $this->render_self_case(
	6815	+ array(
	6816	+ 'title' => __( 'How to repair it here', 'vigilante' ),
	6817	+ 'meaning' => __( 'This site does not let Vigilant replace its own files from this screen.', 'vigilante' ),
	6818	+ 'steps' => Vigilante_Self_Integrity_Guidance::manual_steps( $vg_reason ),
	6819	+ ),
	6820	+ array(),
	6821	+ '',
	6822	+ false
	6823	+ );
	6824	+ }
	6825	+ }
	6826	+ ?>
	6827	+ </div>
	6828	+
	6829	+ <?php if ( $total > count( $findings ) ) : ?>
	6830	+ <p class="description">
	6831	+ <?php
	6832	+ printf(
	6833	+ /* translators: 1: findings shown, 2: findings found in total */
	6834	+ esc_html__( 'Showing %1$d of %2$d findings: the rest are of the same kind.', 'vigilante' ),
	6835	+ (int) count( $findings ),
	6836	+ (int) $total
	6837	+ );
	6838	+ ?>
	6839	+ </p>
	6840	+ <?php endif; ?>
	6841	+
	6842	+ <?php
	6843	+ /*
	6844	+ * Reinstalling fixes files, not a filter someone wrote or a hook
	6845	+ * someone removed: the button only appears when at least one of the
	6846	+ * cases on screen is one a clean copy solves. Offering it next to
	6847	+ * "switched off by code" was telling the person to fix something
	6848	+ * else.
	6849	+ */
	6850	+ $vg_offer_repair = false;
	6851	+ foreach ( $groups as $vg_group ) {
	6852	+ if ( ! empty( $vg_group['repair'] ) ) {
	6853	+ $vg_offer_repair = true;
	6854	+ break;
	6855	+ }
	6856	+ }
	6857	+ ?>
	6858	+ <p class="vigilante-self-actions">
	6859	+ <?php if ( $vg_offer_repair && class_exists( 'Vigilante_Self_Repair' ) && Vigilante_Self_Repair::can_repair() ) : ?>
	6860	+ <a class="button button-primary" href="<?php echo esc_url( Vigilante_Self_Repair::action_url() ); ?>">
	6861	+ <?php esc_html_e( 'Repair Vigilant', 'vigilante' ); ?>
	6862	+ </a>
	6863	+ <span class="description">
	6864	+ <?php esc_html_e( 'It downloads a clean copy from WordPress.org, asks before changing anything, and keeps your settings and log.', 'vigilante' ); ?>
	6865	+ </span>
	6866	+ <?php else : ?>
	6867	+ <span class="description">
	6868	+ <?php esc_html_e( 'After fixing it, run a new scan with the Run Scan Now button above.', 'vigilante' ); ?>
	6869	+ </span>
	6870	+ <?php endif; ?>
	6871	+ </p>
	6872	+ </div>
	6873	+ </div>
	6874	+ <?php
	6875	+ }
	6876	+
	6877	+ /**
	6878	+ * The same state when there is nothing to act on: one line inside the same
	6879	+ * card, so the first block of the results is always the same object.
	6880	+ *
	6881	+ * @param string $tone Tone from Vigilante_Self_Integrity::tone().
	6882	+ * @param array $state State.
	6883	+ * @param array $status Arguments for the guidance catalogue.
	6884	+ */
	6885	+ private function render_self_line( $tone, $state, $status ) {
	6886	+ $guidance = Vigilante_Self_Integrity_Guidance::for_status( $status );
	6887	+ $icon = ( 'ok' === $tone ) ? 'dashicons-yes-alt' : 'dashicons-shield';
	6888	+ ?>
	6889	+ <div id="vigilante-section-fi-self" class="vigilante-settings-section vigilante-self-box vigilante-self-box--<?php echo esc_attr( $tone ); ?> vigilante-self-box--quiet">
	6890	+ <div class="vigilante-self-card vigilante-self-card--quiet">
	6891	+ <p class="vigilante-self-line">
	6892	+ <span class="dashicons <?php echo esc_attr( $icon ); ?>" aria-hidden="true"></span>
	6893	+ <strong><?php esc_html_e( 'Vigilant self-protection:', 'vigilante' ); ?></strong>
	6894	+ <span class="vigilante-self-line-state"><?php echo esc_html( $this->self_integrity_headline( $tone, $state ) ); ?></span>
	6895	+ <?php if ( ! empty( $state['last_check'] ) ) : ?>
	6896	+ <span class="vigilante-self-line-meta">
	6897	+ <?php
	6898	+ printf(
	6899	+ /* translators: %s: human time difference, like "2 hours" */
	6900	+ esc_html__( 'checked %s ago', 'vigilante' ),
	6901	+ esc_html( human_time_diff( (int) $state['last_check'], time() ) )
	6902	+ );
	6903	+ ?>
	6904	+ </span>
	6905	+ <?php endif; ?>
	6906	+ </p>
	6907	+ <?php if ( ! empty( $guidance['steps'] ) && 'none' === $tone ) : ?>
	6908	+ <p class="description vigilante-self-line-help"><?php echo esc_html( $guidance['steps'][0] ); ?></p>
	6909	+ <?php endif; ?>
	6910	+ </div>
	6911	+ </div>
	6912	+ <?php
	6913	+ }
	6914	+
	6915	+ /**
	6916	+ * One case of the self-protection box, as a row that opens: what it is, how
	6917	+ * many files, its severity, and inside, the files, what it means and what to
	6918	+ * do. Plain HTML details, so there is no JavaScript between a finding about
	6919	+ * the security plugin and the person reading it.
	6920	+ *
	6921	+ * @param array $guidance Guidance entry (title, meaning, steps).
	6922	+ * @param array $files Paths this case was found in.
	6923	+ * @param string $severity critical|warning, empty for the how-to-repair row.
	6924	+ * @param bool $open Whether the row starts open.
	6925	+ */
	6926	+ private function render_self_case( $guidance, $files = array(), $severity = '', $open = false ) {
	6927	+ $shown = array_slice( (array) $files, 0, 20 );
	6928	+ $hidden = count( (array) $files ) - count( $shown );
	6929	+ ?>
	6930	+ <details class="vigilante-self-case vigilante-self-case--<?php echo esc_attr( '' !== $severity ? $severity : 'plain' ); ?>"<?php echo $open ? ' open' : ''; ?>>
	6931	+ <summary>
	6932	+ <span class="vigilante-self-case-title"><?php echo esc_html( $guidance['title'] ); ?></span>
	6933	+ <?php if ( ! empty( $files ) ) : ?>
	6934	+ <span class="vigilante-self-case-count">
	6935	+ <?php
	6936	+ printf(
	6937	+ /* translators: %d: number of files of this finding */
	6938	+ esc_html( _n( '%d file', '%d files', count( (array) $files ), 'vigilante' ) ),
	6939	+ (int) count( (array) $files )
	6940	+ );
	6941	+ ?>
	6942	+ </span>
	6943	+ <?php endif; ?>
	6944	+ <?php if ( '' !== $severity ) : ?>
	6945	+ <span class="vigilante-self-case-severity">
	6946	+ <?php echo esc_html( 'critical' === $severity ? __( 'critical', 'vigilante' ) : __( 'warning', 'vigilante' ) ); ?>
	6947	+ </span>
	6948	+ <?php endif; ?>
	6949	+ </summary>
	6950	+ <div class="vigilante-self-case-body">
	6951	+ <?php if ( ! empty( $shown ) ) : ?>
	6952	+ <ul class="vigilante-self-paths">
	6953	+ <?php foreach ( $shown as $file ) : ?>
	6954	+ <li><code><?php echo esc_html( $file ); ?></code></li>
	6955	+ <?php endforeach; ?>
	6956	+ <?php if ( $hidden > 0 ) : ?>
	6957	+ <li>
	6958	+ <?php
	6959	+ printf(
	6960	+ /* translators: %d: number of additional files */
	6961	+ esc_html__( 'and %d more', 'vigilante' ),
	6962	+ (int) $hidden
	6963	+ );
	6964	+ ?>
	6965	+ </li>
	6966	+ <?php endif; ?>
	6967	+ </ul>
	6968	+ <?php endif; ?>
	6969	+ <p class="vigilante-self-meaning">
	6970	+ <strong><?php esc_html_e( 'What it means:', 'vigilante' ); ?></strong>
	6971	+ <?php echo esc_html( $guidance['meaning'] ); ?>
	6972	+ </p>
	6973	+ <?php if ( ! empty( $guidance['steps'] ) ) : ?>
	6974	+ <p class="vigilante-self-todo"><strong><?php esc_html_e( 'What to do:', 'vigilante' ); ?></strong></p>
	6975	+ <ol class="vigilante-self-steps">
	6976	+ <?php foreach ( $guidance['steps'] as $step ) : ?>
	6977	+ <li><?php echo esc_html( $step ); ?></li>
	6978	+ <?php endforeach; ?>
	6979	+ </ol>
	6980	+ <?php endif; ?>
	6981	+ </div>
	6982	+ </details>
	6983	+ <?php
	6984	+ }
	6985	+
5825	6986	private function render_tab_file_integrity() {
5826	6987	$is_disabled = $this->render_module_disabled_notice( 'file_integrity' );
5827	6988	$options = $this->settings->get_section( 'file_integrity' );
	6989	+ // On the main site of a network the critical-file scan is the network's
	6990	+ // canary for a change to wp-config.php or the root .htaccess, so a
	6991	+ // main-site admin without network rights cannot turn it off. Since
	6992	+ // 2.11.8; see Vigilante_Settings::get_main_site_file_settings().
	6993	+ $vg_main_locked = $this->main_site_files_locked();
5828	6994	$last_scan = get_option( 'vigilante_last_integrity_scan' );
5829	6995	$last_results = get_option( 'vigilante_last_integrity_results' );
5830	6996	$ignored_files = get_option( 'vigilante_ignored_files', array() );
5831	6997
	6998	+ /*
	6999	+ * Vigilant own findings are shown in their own box, the first of the
	7000	+ * results, with what each one means and how to fix it. They are taken
	7001	+ * out of the generic tables here (and out of the counters above them)
	7002	+ * so the same finding is not reported twice and so no row of the
	7003	+ * security plugin's own files offers an Ignore button. The stored
	7004	+ * results keep them: the scan email reads its own section from there.
	7005	+ */
	7006	+ if ( is_array( $last_results ) ) {
	7007	+ foreach ( array( 'modified', 'suspicious', 'extra', 'missing' ) as $vg_bucket ) {
	7008	+ if ( empty( $last_results[ $vg_bucket ] ) || ! is_array( $last_results[ $vg_bucket ] ) ) {
	7009	+ continue;
	7010	+ }
	7011	+ $last_results[ $vg_bucket ] = array_values(
	7012	+ array_filter(
	7013	+ $last_results[ $vg_bucket ],
	7014	+ function ( $vg_item ) {
	7015	+ return ! ( is_array( $vg_item ) && 'vigilante_self' === ( $vg_item['type'] ?? '' ) );
	7016	+ }
	7017	+ )
	7018	+ );
	7019	+ }
	7020	+ }
	7021	+
5832	7022	// Backward compat: convert old notify_on_changes to notify_level
5833	7023	$notify_level = $options['notify_level'] ?? '';
5834	7024	if ( empty( $notify_level ) ) {
5835	7025	$notify_level = ! empty( $options['notify_on_changes'] ) ? 'all' : 'disabled';
		@@ -5951,10 +7141,13 @@
5951	7141	<?php esc_html_e( 'Uploads directory (detect PHP files, double extensions, .htaccess)', 'vigilante' ); ?>
5952	7142	</label>
5953	7143	<br>
5954	7144	<label>
5955		- <input type="checkbox" name="file_integrity[scan_critical_config]" value="1" <?php checked( $options['scan_critical_config'] ?? true ); ?>>
	7145	+ <input type="checkbox" name="file_integrity[scan_critical_config]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( $options['scan_critical_config'] ?? true ); ?>>
5956	7146	<?php esc_html_e( 'Critical config files (wp-config.php, .htaccess baseline monitoring)', 'vigilante' ); ?>
	7147	+ <?php if ( $vg_main_locked ) : ?>
	7148	+ <span class="description" style="display:block;margin-left:24px;"><?php echo esc_html( Vigilante_Settings::get_shared_files_notice() ); ?></span>
	7149	+ <?php endif; ?>
5957	7150	</label>
5958	7151	<br>
5959	7152	<label>
5960	7153	<input type="checkbox" name="file_integrity[check_closed_plugins]" value="1" <?php checked( $options['check_closed_plugins'] ?? true ); ?>>
		@@ -6009,8 +7202,10 @@
6009	7202	</form>
6010	7203
6011	7204	<div id="vigilante-scan-results" class="vigilante-settings-section" style="display:none;"></div>
6012	7205
	7206	+ <?php $this->render_self_protection_box( $options ); ?>
	7207	+
6013	7208	<?php if ( $last_scan || $has_closed || $closed_last_check > 0 ) : ?>
6014	7209	<div id="vigilante-section-fi-last-scan" class="vigilante-settings-section">
6015	7210	<h2><?php esc_html_e( 'Last Scan Results', 'vigilante' ); ?></h2>
6016	7211	<?php if ( $last_scan ) : ?>
		@@ -6135,8 +7330,11 @@
6135	7330	}
6136	7331	} else {
6137	7332	$file_path = (string) $item;
6138	7333	}
	7334	+ if ( 'vigilante_self' === $file_type ) {
	7335	+ $file_type = __( 'Vigilant (self)', 'vigilante' );
	7336	+ }
6139	7337	?>
6140	7338	<tr>
6141	7339	<th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
6142	7340	<td><code style="color: #d63638;"><?php echo esc_html( $file_path ); ?></code></td>
		@@ -6176,8 +7374,11 @@
6176	7374	foreach ( $last_results['extra'] as $item ) {
6177	7375	$file_path = is_array( $item ) ? ( $item['file'] ?? '' ) : (string) $item;
6178	7376	$file_reason = is_array( $item ) ? ( $item['reason'] ?? __( 'Unknown', 'vigilante' ) ) : __( 'Unknown', 'vigilante' );
6179	7377	$file_type = is_array( $item ) ? ( $item['type'] ?? 'unknown' ) : 'unknown';
	7378	+ if ( 'vigilante_self' === $file_type ) {
	7379	+ $file_type = __( 'Vigilant (self)', 'vigilante' );
	7380	+ }
6180	7381	?>
6181	7382	<tr>
6182	7383	<th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
6183	7384	<td><code style="color: #b32d2e;"><?php echo esc_html( $file_path ); ?></code></td>
		@@ -6208,8 +7409,19 @@
6208	7409	$regular_modified[] = $item;
6209	7410	}
6210	7411	}
6211	7412	}
	7413	+ // A missing file of Vigilant is critical, and the missing
	7414	+ // files of the generic scan have no table: it is listed with
	7415	+ // the modified files, or the tab said "All files passed" with
	7416	+ // a module deleted.
	7417	+ if ( $last_results && ! empty( $last_results['missing'] ) && is_array( $last_results['missing'] ) ) {
	7418	+ foreach ( $last_results['missing'] as $item ) {
	7419	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) ) {
	7420	+ $regular_modified[] = $item;
	7421	+ }
	7422	+ }
	7423	+ }
6212	7424	?>
6213	7425
6214	7426	<?php if ( ! empty( $critical_modified ) ) : ?>
6215	7427	<div class="vigilante-file-list vigilante-critical-config-files">
		@@ -6233,9 +7445,15 @@
6233	7445	$crit_diff = $crit_item['diff'] ?? array();
6234	7446	$crit_id = sanitize_html_class( $crit_file );
6235	7447	$added_count = is_array( $crit_diff ) ? count( $crit_diff['added'] ?? array() ) : 0;
6236	7448	$removed_count = is_array( $crit_diff ) ? count( $crit_diff['removed'] ?? array() ) : 0;
6237		- $diff_unavailable = is_array( $crit_diff ) && ! empty( $crit_diff['unavailable'] );
	7449	+ // The lines of a shared file are for whoever approves it. Results
	7450	+ // stored before 2.11.8 on the main site still carry them, so the
	7451	+ // screen asks too, not only the scan that wrote them.
	7452	+ $diff_network = ( is_array( $crit_diff ) && ! empty( $crit_diff['network'] ) ) || $this->critical_approval_locked();
	7453	+ $diff_rescan = is_array( $crit_diff ) && ! empty( $crit_diff['rescan'] );
	7454	+ $diff_redaction = is_array( $crit_diff ) && ! empty( $crit_diff['redaction'] );
	7455	+ $diff_unavailable = $diff_network || ( is_array( $crit_diff ) && ! empty( $crit_diff['unavailable'] ) );
6238	7456	?>
6239	7457	<tr>
6240	7458	<td><code style="color: #e36210;"><?php echo esc_html( $crit_file ); ?></code></td>
6241	7459	<td>
		@@ -6258,18 +7476,36 @@
6258	7476	<td>
6259	7477	<button type="button" class="button button-small vigilante-toggle-critical-content" data-target="vigilante-critical-content-<?php echo esc_attr( $crit_id ); ?>" data-label-show="<?php esc_attr_e( 'Review changes', 'vigilante' ); ?>" data-label-hide="<?php esc_attr_e( 'Hide changes', 'vigilante' ); ?>">
6260	7478	<?php esc_html_e( 'Review changes', 'vigilante' ); ?>
6261	7479	</button>
6262		- <button type="button" class="button button-small button-primary vigilante-approve-critical-file" data-file="<?php echo esc_attr( $crit_file ); ?>">
6263		- <?php esc_html_e( 'Approve', 'vigilante' ); ?>
6264		- </button>
	7480	+ <?php if ( $this->critical_approval_locked() ) : ?>
	7481	+ <span class="description" style="display:block;margin-top:4px;">
	7482	+ <?php echo esc_html( $this->critical_approval_notice() ); ?>
	7483	+ </span>
	7484	+ <?php else : ?>
	7485	+ <button type="button" class="button button-small button-primary vigilante-approve-critical-file" data-file="<?php echo esc_attr( $crit_file ); ?>">
	7486	+ <?php esc_html_e( 'Approve', 'vigilante' ); ?>
	7487	+ </button>
	7488	+ <?php endif; ?>
6265	7489	</td>
6266	7490	</tr>
6267	7491	<tr id="vigilante-critical-content-<?php echo esc_attr( $crit_id ); ?>" class="vigilante-critical-content-row" style="display:none;">
6268	7492	<td colspan="3" style="padding: 0;">
6269	7493	<div class="vigilante-critical-content" style="max-height: 400px; overflow: auto; background: #fff; padding: 10px; font-size: 12px; line-height: 1.5; font-family: Consolas, Monaco, monospace; border-top: 1px solid #c3c4c7;">
6270		- <?php if ( $diff_unavailable ) : ?>
	7494	+ <?php if ( $diff_network ) : ?>
6271	7495	<p style="color: #50575e; font-style: italic; margin: 0;">
	7496	+ <?php esc_html_e( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ); ?>
	7497	+ </p>
	7498	+ <?php elseif ( $diff_rescan ) : ?>
	7499	+ <p style="color: #50575e; font-style: italic; margin: 0;">
	7500	+ <?php esc_html_e( 'Run a new scan to see the line changes of this file.', 'vigilante' ); ?>
	7501	+ </p>
	7502	+ <?php elseif ( $diff_redaction ) : ?>
	7503	+ <p style="color: #50575e; font-style: italic; margin: 0;">
	7504	+ <?php esc_html_e( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ); ?>
	7505	+ </p>
	7506	+ <?php elseif ( $diff_unavailable ) : ?>
	7507	+ <p style="color: #50575e; font-style: italic; margin: 0;">
6272	7508	<?php esc_html_e( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ); ?>
6273	7509	</p>
6274	7510	<?php elseif ( empty( $crit_diff['added'] ) && empty( $crit_diff['removed'] ) ) : ?>
6275	7511	<p style="color: #50575e; font-style: italic; margin: 0;">
		@@ -6297,9 +7533,9 @@
6297	7533	<?php endif; ?>
6298	7534
6299	7535	<?php if ( $has_closed ) : ?>
6300	7536	<div class="vigilante-file-list vigilante-closed-plugins">
6301		- <h3 style="color: #d63638;"><?php esc_html_e( 'Closed + Removed Plugins', 'vigilante' ); ?></h3>
	7537	+ <h3 id="vigilante-section-fi-closed-plugins" style="color: #d63638;"><?php esc_html_e( 'Closed + Removed Plugins', 'vigilante' ); ?></h3>
6302	7538	<p class="description" style="color: #d63638;">
6303	7539	<?php esc_html_e( '&#9888; Warning: These plugins have been closed in the WordPress.org repository. Closures usually indicate malware, security issues, guideline violations, or supply chain attacks. Uninstall and replace as soon as possible.', 'vigilante' ); ?>
6304	7540	</p>
6305	7541	<table class="wp-list-table widefat striped">
		@@ -6384,8 +7620,11 @@
6384	7620	}
6385	7621	} else {
6386	7622	$file_path = (string) $item;
6387	7623	}
	7624	+ if ( 'vigilante_self' === $file_type ) {
	7625	+ $file_type = __( 'Vigilant (self)', 'vigilante' );
	7626	+ }
6388	7627	?>
6389	7628	<tr>
6390	7629	<th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
6391	7630	<td><code><?php echo esc_html( $file_path ); ?></code></td>
		@@ -6399,9 +7638,16 @@
6399	7638	</table>
6400	7639	</div>
6401	7640	<?php endif; ?>
6402	7641
6403		- <?php if ( $last_results && empty( $last_results['modified'] ) && empty( $last_results['suspicious'] ) && empty( $last_results['extra'] ) && ! $has_closed ) : ?>
	7642	+ <?php
	7643	+ // "All files passed" is about every file, and Vigilant's own
	7644	+ // are files too: with the self-protection box in red or amber
	7645	+ // above, this line contradicted it (its findings no longer
	7646	+ // travel in the tables below).
	7647	+ $vg_self_alarm = in_array( $this->self_integrity_summary( $options )['tone'], array( 'critical', 'off', 'warning' ), true );
	7648	+ ?>
	7649	+ <?php if ( $last_results && ! $vg_self_alarm && empty( $critical_modified ) && empty( $regular_modified ) && empty( $last_results['suspicious'] ) && empty( $last_results['extra'] ) && ! $has_closed ) : ?>
6404	7650	<p class="vigilante-all-clear" style="color: #00a32a; font-weight: bold;">
6405	7651	<?php esc_html_e( 'Good Job! All files passed integrity check. No issues found.', 'vigilante' ); ?>
6406	7652	</p>
6407	7653	<?php endif; ?>
		@@ -6605,10 +7851,30 @@
6605	7851
6606	7852	// Read ONLY saved options from database (not merged with defaults)
6607	7853	$saved_options = get_option( Vigilante_Settings::OPTION_NAME, array() );
6608	7854
6609		- $rejected_ips = array();
	7855	+ // What is stored before this request changes anything: the shared file
	7856	+ // settings this user may not change are put back from here (2.11.6).
	7857	+ $stored_options = $saved_options;
	7858	+ $locked = Vigilante_Settings::get_locked_file_settings();
6610	7859
	7860	+ if ( isset( $locked[ $section ] ) && true === $locked[ $section ] ) {
	7861	+ wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
	7862	+ }
	7863	+
	7864	+ // A module switch is a single key, so refusing says more than a success
	7865	+ // that changed nothing, and the dashboard puts the toggle back.
	7866	+ if ( 'modules' === $section && isset( $locked['modules'], $data['modules'] ) && is_array( $locked['modules'] ) && is_array( $data['modules'] ) ) {
	7867	+ foreach ( array_keys( $data['modules'] ) as $vg_module ) {
	7868	+ if ( in_array( sanitize_key( $vg_module ), $locked['modules'], true ) ) {
	7869	+ wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
	7870	+ }
	7871	+ }
	7872	+ }
	7873	+
	7874	+ $rejected_ips = array();
	7875	+ $rejected_proxies = array();
	7876	+
6611	7877	// Handle modules
6612	7878	if ( 'modules' === $section && isset( $data['modules'] ) ) {
6613	7879	if ( ! isset( $saved_options['modules'] ) ) {
6614	7880	$saved_options['modules'] = array();
		@@ -6632,9 +7898,9 @@
6632	7898	// went straight into the option. An entry the matcher can never
6633	7899	// match still sits in a security list looking like protection,
6634	7900	// so the ones that cannot match are dropped and reported back
6635	7901	// instead of being stored in silence.
6636		- $rejected_ips = $this->filter_ip_lists( $section, $processed );
	7902	+ $rejected_ips = $this->filter_ip_lists( $section, $processed, $rejected_proxies );
6637	7903
6638	7904	// Save the processed section
6639	7905	$saved_options[ $section ] = $processed;
6640	7906
		@@ -6645,8 +7911,10 @@
6645	7911
6646	7912	// Clear cache before saving
6647	7913	wp_cache_delete( Vigilante_Settings::OPTION_NAME, 'options' );
6648	7914
	7915	+ $saved_options = Vigilante_Settings::keep_locked_file_settings( $saved_options, $stored_options );
	7916	+
6649	7917	// Save to database
6650	7918	update_option( Vigilante_Settings::OPTION_NAME, $saved_options );
6651	7919
6652	7920	// Clear the settings cache
		@@ -6708,8 +7976,21 @@
6708	7976	implode( ', ', array_map( 'esc_html', $rejected_ips ) )
6709	7977	);
6710	7978	}
6711	7979
	7980	+ if ( ! empty( $rejected_proxies ) ) {
	7981	+ $message .= ' ' . sprintf(
	7982	+ /* translators: %s: comma separated list of the trusted proxy entries that were not saved. */
	7983	+ _n(
	7984	+ 'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so this entry was not saved: %s',
	7985	+ 'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so these entries were not saved: %s',
	7986	+ count( $rejected_proxies ),
	7987	+ 'vigilante'
	7988	+ ),
	7989	+ implode( ', ', array_map( 'esc_html', $rejected_proxies ) )
	7990	+ );
	7991	+ }
	7992	+
6712	7993	wp_send_json_success( $message );
6713	7994	}
6714	7995
6715	7996	/**
		@@ -6720,9 +8001,21 @@
6720	8001	* @param string $section Section being saved.
6721	8002	* @param array $processed Section data, edited in place.
6722	8003	* @return array Entries that were dropped, for the message back to the user.
6723	8004	*/
6724		- private function filter_ip_lists( $section, &$processed ) {
	8005	+ private function filter_ip_lists( $section, &$processed, &$rejected_proxies = array() ) {
	8006	+ $rejected_proxies = array();
	8007	+
	8008	+ // Trusted proxies feed an identity decision, so only exact addresses and
	8009	+ // CIDR ranges belong there: a wildcard is stripped with its own message,
	8010	+ // never stored looking effective. The matcher ignores it anyway (see
	8011	+ // Vigilante_IP_Utils::in_list_ip_or_cidr), this stops it persisting.
	8012	+ if ( 'firewall' === $section && isset( $processed['trusted_proxies'] ) && is_array( $processed['trusted_proxies'] ) ) {
	8013	+ $split = Vigilante_IP_Utils::split_list_ip_or_cidr( $processed['trusted_proxies'] );
	8014	+ $processed['trusted_proxies'] = $split['valid'];
	8015	+ $rejected_proxies = $split['rejected'];
	8016	+ }
	8017	+
6725	8018	$lists = array(
6726	8019	'firewall' => array( 'ip_whitelist', 'ip_blacklist' ),
6727	8020	'login_security' => array( 'ip_whitelist' ),
6728	8021	);
		@@ -7069,13 +8362,27 @@
7069	8362
7070	8363	// Sanitize imported data recursively
7071	8364	$imported = map_deep( $imported, 'sanitize_text_field' );
7072	8365
7073		- // Validate structure
7074		- $defaults = $this->settings->get_default_options();
7075		- $merged = array_replace_recursive( $defaults, $imported );
	8366	+ // Validate structure: only sections and keys of the schema survive, and
	8367	+ // every value takes the type of its default. Until 2.11.0 this was an
	8368	+ // array_replace_recursive() of the file over the defaults, so any key in
	8369	+ // the file, known or not, landed in vigilante_options (S7). Sections
	8370	+ // the file does not carry keep their defaults; a section it does carry
	8371	+ // replaces the default one whole, because validate_options() has
	8372	+ // already filled in whatever the file left out.
	8373	+ $defaults = $this->settings->get_default_options();
	8374	+ $validated = $this->settings->validate_options( $imported );
	8375	+ $merged = $defaults;
7076	8376
	8377	+ foreach ( $validated as $section => $data ) {
	8378	+ if ( is_array( $data ) ) {
	8379	+ $merged[ $section ] = $data;
	8380	+ }
	8381	+ }
	8382	+
7077	8383	// Save
	8384	+ $merged = Vigilante_Settings::keep_locked_file_settings( $merged, get_option( Vigilante_Settings::OPTION_NAME, array() ) );
7078	8385	update_option( Vigilante_Settings::OPTION_NAME, $merged );
7079	8386	$this->settings->clear_cache();
7080	8387
7081	8388	// Re-evaluate the active preset marker. The imported config may match
		@@ -7098,9 +8405,9 @@
7098	8405	if ( ! wp_next_scheduled( 'vigilante_under_attack_post_scan' ) ) {
7099	8406	wp_schedule_single_event( time() + 5, 'vigilante_under_attack_post_scan' );
7100	8407	}
7101	8408
7102		- wp_send_json_success( __( 'Settings imported successfully.', 'vigilante' ) );
	8409	+ wp_send_json_success( __( 'Settings imported successfully.', 'vigilante' ) . $this->locked_file_settings_message() );
7103	8410	}
7104	8411
7105	8412	/**
7106	8413	* Detect whether a vigilante_options array matches a known preset.
		@@ -7203,9 +8510,11 @@
7203	8510	$preset = isset( $_POST['preset'] ) ? sanitize_key( $_POST['preset'] ) : '';
7204	8511
7205	8512	// Handle reset to defaults
7206	8513	if ( 'reset' === $preset ) {
7207		- $defaults = Vigilante_Settings::get_defaults_preserving_user_data( get_option( Vigilante_Settings::OPTION_NAME, array() ) );
	8514	+ $stored_options = get_option( Vigilante_Settings::OPTION_NAME, array() );
	8515	+ $defaults = Vigilante_Settings::get_defaults_preserving_user_data( $stored_options );
	8516	+ $defaults = Vigilante_Settings::keep_locked_file_settings( $defaults, $stored_options );
7208	8517	update_option( Vigilante_Settings::OPTION_NAME, $defaults );
7209	8518	$this->settings->clear_cache();
7210	8519
7211	8520	// Clear active preset
		@@ -7213,9 +8522,9 @@
7213	8522
7214	8523	// Apply file changes after reset
7215	8524	$this->apply_all_file_changes( $defaults );
7216	8525
7217		- wp_send_json_success( __( 'Settings reset to defaults.', 'vigilante' ) );
	8526	+ wp_send_json_success( __( 'Settings reset to defaults.', 'vigilante' ) . $this->locked_file_settings_message() );
7218	8527	return;
7219	8528	}
7220	8529
7221	8530	$presets = $this->settings->get_presets();
		@@ -7241,8 +8550,9 @@
7241	8550	// invent keys that are missing on both sides.
7242	8551	$current = Vigilante_Settings::merge_preset( $this->settings->get_default_options(), $current );
7243	8552
7244	8553	$merged = Vigilante_Settings::merge_preset( $current, $preset_options );
	8554	+ $merged = Vigilante_Settings::keep_locked_file_settings( $merged, get_option( Vigilante_Settings::OPTION_NAME, array() ) );
7245	8555
7246	8556	update_option( Vigilante_Settings::OPTION_NAME, $merged );
7247	8557	$this->settings->clear_cache();
7248	8558
		@@ -7251,9 +8561,9 @@
7251	8561
7252	8562	// Apply file changes after preset
7253	8563	$this->apply_all_file_changes( $merged );
7254	8564
7255		- wp_send_json_success( __( 'Preset applied successfully.', 'vigilante' ) );
	8565	+ wp_send_json_success( __( 'Preset applied successfully.', 'vigilante' ) . $this->locked_file_settings_message() );
7256	8566	}
7257	8567
7258	8568	/**
7259	8569	* AJAX: Reset a specific section to defaults
		@@ -7288,27 +8598,19 @@
7288	8598	* On a subsite, the settings written to wp-config.php and .htaccess are
7289	8599	* the main site's business. Resetting the local copy of those would only
7290	8600	* make this screen disagree with the file, so they are carried over
7291	8601	* untouched, and a section that is nothing but shared settings is not
7292		- * reset at all.
	8602	+ * reset at all. On the main site, a user without network rights keeps
	8603	+ * the ones the shared files are built from as well (2.11.6).
7293	8604	*/
7294		- if ( ! Vigilante_Settings::can_write_shared_files() ) {
7295		- $shared = Vigilante_Settings::get_shared_file_settings();
	8605	+ $locked = Vigilante_Settings::get_locked_file_settings();
7296	8606
7297		- if ( isset( $shared[ $section ] ) ) {
7298		- if ( true === $shared[ $section ] ) {
7299		- wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
7300		- }
7301		-
7302		- foreach ( $shared[ $section ] as $shared_key ) {
7303		- if ( array_key_exists( $shared_key, (array) $current_options[ $section ] ) ) {
7304		- $new_values[ $shared_key ] = $current_options[ $section ][ $shared_key ];
7305		- }
7306		- }
7307		- }
	8607	+ if ( isset( $locked[ $section ] ) && true === $locked[ $section ] ) {
	8608	+ wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
7308	8609	}
7309	8610
7310	8611	$current_options[ $section ] = $new_values;
	8612	+ $current_options = Vigilante_Settings::keep_locked_file_settings( $current_options, get_option( Vigilante_Settings::OPTION_NAME, array() ) );
7311	8613
7312	8614	// Save
7313	8615	update_option( Vigilante_Settings::OPTION_NAME, $current_options );
7314	8616	$this->settings->clear_cache();
		@@ -7391,8 +8693,19 @@
7391	8693	// Save new results
7392	8694	update_option( 'vigilante_last_integrity_scan', time() );
7393	8695	update_option( 'vigilante_last_integrity_results', $results );
7394	8696
	8697	+ // On the main site the scan does compute the lines of wp-config.php and
	8698	+ // .htaccess, for the network administrator. Somebody without network
	8699	+ // rights gets the change and its sizes, not the lines.
	8700	+ if ( $this->critical_approval_locked() && ! empty( $results['modified'] ) && is_array( $results['modified'] ) ) {
	8701	+ foreach ( $results['modified'] as $index => $item ) {
	8702	+ if ( is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	8703	+ $results['modified'][ $index ]['diff'] = Vigilante_File_Integrity::network_only_diff();
	8704	+ }
	8705	+ }
	8706	+ }
	8707	+
7395	8708	wp_send_json_success( array(
7396	8709	'message' => __( 'Scan completed.', 'vigilante' ),
7397	8710	'results' => $results,
7398	8711	'ignored_count' => count( get_option( 'vigilante_ignored_files', array() ) ),
		@@ -7426,11 +8739,46 @@
7426	8739	if ( ! current_user_can( 'manage_options' ) ) {
7427	8740	wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
7428	8741	}
7429	8742
	8743	+ $results = get_option( 'vigilante_last_integrity_results' );
	8744	+ $scanned_at = get_option( 'vigilante_last_integrity_scan' );
	8745	+
7430	8746	delete_option( 'vigilante_last_integrity_results' );
7431	8747	delete_option( 'vigilante_last_integrity_scan' );
7432	8748
	8749	+ /*
	8750	+ * A pending change to wp-config.php or the root .htaccess is closed by
	8751	+ * approving it, which takes the network. Clearing the results was one
	8752	+ * more way to close it without, until the next scan: the ignore list was
	8753	+ * shut in 2.11.8 and this button was left open, found by the cross
	8754	+ * review of 2.11.8. So for somebody who cannot approve, those entries
	8755	+ * stay and everything else goes.
	8756	+ */
	8757	+ // The findings about Vigilant's own files stay too: they report for the
	8758	+ // whole network, and ignoring them already takes network rights.
	8759	+ if ( $this->critical_approval_locked() && is_array( $results ) ) {
	8760	+ $kept = array();
	8761	+ $found = false;
	8762	+ foreach ( array( 'modified', 'missing', 'suspicious', 'extra' ) as $bucket ) {
	8763	+ $kept[ $bucket ] = array_values(
	8764	+ array_filter(
	8765	+ isset( $results[ $bucket ] ) && is_array( $results[ $bucket ] ) ? $results[ $bucket ] : array(),
	8766	+ function ( $item ) {
	8767	+ return is_array( $item ) && in_array( $item['type'] ?? '', array( 'critical_config', 'vigilante_self' ), true );
	8768	+ }
	8769	+ )
	8770	+ );
	8771	+ $found = $found || ! empty( $kept[ $bucket ] );
	8772	+ }
	8773	+
	8774	+ if ( $found ) {
	8775	+ $results = array_merge( $results, $kept );
	8776	+ update_option( 'vigilante_last_integrity_results', $results );
	8777	+ update_option( 'vigilante_last_integrity_scan', $scanned_at ? $scanned_at : time() );
	8778	+ }
	8779	+ }
	8780	+
7433	8781	if ( $this->database ) {
7434	8782	$this->database->clear_file_hashes();
7435	8783	}
7436	8784
		@@ -7456,8 +8804,23 @@
7456	8804	if ( empty( $file ) ) {
7457	8805	wp_send_json_error( __( 'No file specified.', 'vigilante' ) );
7458	8806	}
7459	8807
	8808	+ // A change to a shared file is closed by approving it, and approving it
	8809	+ // takes the network. Ignoring it would close the same warning without.
	8810	+ if ( $this->critical_approval_locked() && in_array( $file, array( 'wp-config.php', '.htaccess' ), true ) ) {
	8811	+ wp_send_json_error( $this->critical_approval_notice() );
	8812	+ }
	8813	+
	8814	+ // Vigilant's own files are never ignored, on any site: silencing the
	8815	+ // check that says the security plugin was changed is the one button
	8816	+ // an attacker would want on this screen. Since 3.0.0 those findings
	8817	+ // are not rows of these tables either, so nothing in the interface
	8818	+ // sends them here; this is the door, not the label.
	8819	+ if ( Vigilante_Self_Integrity::is_own_file_path( $file ) ) {
	8820	+ wp_send_json_error( __( 'Findings about Vigilant own files cannot be ignored. File Integrity explains what each one means and how to repair it.', 'vigilante' ) );
	8821	+ }
	8822	+
7460	8823	$file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
7461	8824	$file_integrity->ignore_file( $file );
7462	8825
7463	8826	// Also remove the file from stored scan results so UI updates
		@@ -7521,12 +8884,16 @@
7521	8884	if ( ! is_array( $raw_files ) ) {
7522	8885	wp_send_json_error( __( 'Invalid request.', 'vigilante' ) );
7523	8886	}
7524	8887
7525		- $files = array();
	8888	+ $files = array();
	8889	+ $locked = $this->critical_approval_locked();
	8890	+ $shared = $locked ? array( 'wp-config.php', '.htaccess' ) : array();
7526	8891	foreach ( $raw_files as $f ) {
7527	8892	$clean = sanitize_text_field( $f );
7528		- if ( '' !== $clean ) {
	8893	+ // Same rule as ajax_ignore_file(): the two shared files when the
	8894	+ // network locks them, and Vigilant's own files always.
	8895	+ if ( '' !== $clean && ! in_array( $clean, $shared, true ) && ! Vigilante_Self_Integrity::is_own_file_path( $clean ) ) {
7529	8896	$files[] = $clean;
7530	8897	}
7531	8898	}
7532	8899