Repository navigation
Beta - #759
Merged
Merged
Beta#759
Conversation
Fix. Code. Optimizing the parsing of approved hashes https://app.doboard.com/1/task/57727
# Conflicts: # lib/CleantalkSP/SpbctWP/Scanner/BinaryCheckModule/BinaryCheckModule.php # security-malware-firewall.php
… option is disabled.
Reject unreadable source files and failed regular-expression replacements for both code cure actions, preserving the source and recording a cure error. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix. 2FA. Flow updates. * Fix. 2FA. Keep user rate limiter UA charset-safe. Truncating UA by bytes could split a multibyte character; wpdb rejects queries with invalid text and the limiter fails open, so the per-user 2FA attempts cap could be bypassed. Keep only printable ASCII. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix. 2FA. Atomic step token attempts and claim. Concurrent requests with the same step token could overwrite each other's fail counter and both pass the TOTP replay check. Now each attempt is reserved by compare-and-swap of the token record before the code check, and a correct code logs in only if this request deletes the reserved record. The TOTP time step is marked used after the claim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix. 2FA. Revoke pending challenge on password reset. A step token and e-mail code issued for the old password could still complete the login after the password reset. Revoke both on after_password_reset. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix. 2FA. Keep concurrent login's fresh step token on success. The step record is already consumed by the atomic claim, so deleting user meta again on success could revoke a fresh challenge issued to a password login in another browser. Clear only this browser's cookie. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…or file actions (#762) * Dev. Git. Added the Skills folder to .gitignore * Fix. FSW. Restriction of access to FSW, edits for wpms, restriction for file actions * Fix. FSW. Limitation for actions of oscron and delete-trigger * Dev. Code. Review corrections * Dev. Activator. Switching to the wp_initialize_site hook when adding a new blog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://app.doboard.com/1/task/60268