Skip to content

fix(backup-codes): minor UI issues and JS var leak #801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masteradhoc merged 1 commit into from
Feb 24, 2026
Merged

fix(backup-codes): minor UI issues and JS var leak #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions providers/class-two-factor-backup-codes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ public function admin_notices() {
array( 'a' => array( 'href' => true ) )
);
?>
<span>
</span>
</p>
</div>
<?php
Expand Down Expand Up @@ -159,7 +159,7 @@ public function user_options( $user ) {

$count = self::codes_remaining_for_user( $user );
?>
<p id="two-factor-backup-codes">
<div id="two-factor-backup-codes">
<p class="two-factor-backup-codes-count">
Comment on lines -162 to 163
Copy link
Copy Markdown
Contributor Author

@sjinks sjinks Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

<p> tags cannot be nested; <p> allows only for phrasing content.

<?php
echo esc_html(
Expand All @@ -178,13 +178,13 @@ public function user_options( $user ) {

<em><?php esc_html_e( 'This invalidates all currently stored codes.', 'two-factor' ); ?></em>
</p>
</p>
</div>
<div class="two-factor-backup-codes-wrapper" style="display:none;">
<ol class="two-factor-backup-codes-unused-codes"></ol>
<p class="description"><?php esc_html_e( 'Write these down! Once you navigate away from this page, you will not be able to view these codes again.', 'two-factor' ); ?></p>
<p>
<a class="button button-two-factor-backup-codes-download button-secondary hide-if-no-js" href="javascript:void(0);" id="two-factor-backup-codes-download-link" download="two-factor-backup-codes.txt"><?php esc_html_e( 'Download Codes', 'two-factor' ); ?></a>
<p>
</p>
</div>
<script type="text/javascript">
( function( $ ) {
Expand All @@ -202,7 +202,7 @@ public function user_options( $user ) {
$codesList.html( '' );

// Append the codes.
for ( i = 0; i < response.codes.length; i++ ) {
for ( var i = 0; i < response.codes.length; i++ ) {
Copy link
Copy Markdown
Contributor Author

@sjinks sjinks Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This leaked i into the global scope.

$codesList.append( '<li>' + response.codes[ i ] + '</li>' );
}

Expand Down
2 changes: 1 addition & 1 deletion tests/providers/class-two-factor-backup-codes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ public function test_user_options() {
$this->provider->user_options( $user );
$buffer = ob_get_clean();

$this->assertStringContainsString( '<p id="two-factor-backup-codes">', $buffer );
$this->assertStringContainsString( '<div id="two-factor-backup-codes">', $buffer );
$this->assertStringContainsString( '<div class="two-factor-backup-codes-wrapper" style="display:none;">', $buffer );
$this->assertStringContainsString( "user_id: {$user->ID}", $buffer );
}
Expand Down
Loading