fix: ensure execution stops after redirects.

sjinks · sjinks · commit 1be422d54fa9 · 2026-02-09T22:59:33.000+02:00
diff --git a/class-two-factor-core.php b/class-two-factor-core.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Two Factore Core Class.
+ * Two Factor Core Class.
  *
  * @package Two_Factor
  */
@@ -1479,7 +1479,7 @@ public static function _login_form_validate_2fa( $user, $nonce = '', $provider =
 		// Validate the request.
 		if ( true !== self::verify_login_nonce( $user->ID, $nonce ) ) {
 			wp_safe_redirect( home_url() );
-			return;
+			exit();
 		}
 
 		$provider = self::get_provider_for_user( $user, $provider );
@@ -1567,6 +1567,7 @@ public static function _login_form_validate_2fa( $user, $nonce = '', $provider =
 
 		$redirect_to = apply_filters( 'login_redirect', $redirect_to, $redirect_to, $user ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Core WordPress filter.
 		wp_safe_redirect( $redirect_to );
+		exit();
 	}
 
 
@@ -1602,15 +1603,15 @@ public static function login_form_revalidate_2fa() {
 	public static function _login_form_revalidate_2fa( $nonce = '', $provider = '', $redirect_to = '', $is_post_request = false ) {
 		if ( ! is_user_logged_in() ) {
 			wp_safe_redirect( home_url() );
-			return;
+			exit();
 		}
 
 		$user = wp_get_current_user();
 
 		// Validate the nonce for POST requests. GET requests do not perform actions, and such do not require the nonce (such as the initial request).
 		if ( $is_post_request && ! wp_verify_nonce( $nonce, 'two_factor_revalidate_' . $user->ID ) ) {
 			wp_safe_redirect( home_url() );
-			return;
+			exit();
 		}
 
 		$provider = self::get_provider_for_user( $user, $provider );
@@ -1665,7 +1666,7 @@ public static function _login_form_revalidate_2fa( $nonce = '', $provider = '',
 
 		$redirect_to = apply_filters( 'login_redirect', $redirect_to, $redirect_to, $user ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Core WordPress filter.
 		wp_safe_redirect( $redirect_to );
-		return;
+		exit();
 	}
 
 	/**
