Skip to content

#831 Fix nonce verification in 2FA flow #833

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masteradhoc merged 3 commits into from
Jun 29, 2026
Merged

#831 Fix nonce verification in 2FA flow #833

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
09bb677
Fix nonce verification in 2FA flow
Mar 12, 2026
498eb6d
Harden nonce/request handling, fix phpcs comments, add reset notice n…
Mar 12, 2026
6a1ac8e
use !empty() for rememberme check and simplify rememberme()
Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
use !empty() for rememberme check and simplify rememberme()
  • Loading branch information
Pratik Nawkar
Pratik Nawkar committed Mar 13, 2026
commit 6a1ac8e649f3af2bd3ddab769968f394721e6784
8 changes: 2 additions & 6 deletions class-two-factor-core.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1565,7 +1565,7 @@ public static function _login_form_validate_2fa( $user, $nonce = '', $provider =
delete_user_meta( $user->ID, self::USER_FAILED_LOGIN_ATTEMPTS_KEY );

$rememberme = false;
if ( isset( $_REQUEST['rememberme'] ) && $_REQUEST['rememberme'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Request read only after successful verify_login_nonce() in this request.
if ( ! empty( $_REQUEST['rememberme'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Request read only after successful verify_login_nonce() in this request.
$rememberme = true;
}

Expand Down Expand Up @@ -2396,11 +2396,7 @@ public static function get_current_user_session() {
* @return boolean
*/
public static function rememberme() {
$rememberme = false;

if ( ! empty( $_REQUEST['rememberme'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Non-destructive display/flow flag; value normalized to bool below.
$rememberme = true;
}
$rememberme = ! empty( $_REQUEST['rememberme'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Non-destructive display/flow flag; value normalized to bool below.

/**
* Filters whether the login session should persist between browser sessions.
Expand Down
Loading