�PNG  IHDR22?�� pHYs  �� OiCCPPhotoshop ICC profilexڝSgTS�=���BK���KoR RB���&*! J�!��Q�EEȠ�����Q, � ��!���������{�kּ������>���� �H3Q5� �B�������.@� $p�d!s�#�~<<+"��x� �M��0���B�\���t�8K�@z�B�@F���&S�`�cb�P-`'������{[�!�� e�Dh;��V�EX0fK�9�-0IWfH���� � 0Q��){`�##x��F�W<�+��*x��<�$9E�[-qWW.(�I+6aa�@.�y�2�4���������x����6��_-��"bb���ϫp@�t~��,/��;�m��%�h^ �u��f�@����W�p�~<�5�j>{�-�]c�K'Xt����o��(�h���w��?�G�%�fI�q^D$.Tʳ?�D��*�A��,���� �`6�B$��BB d�r`)��B(�Ͱ*`/�@4�Qh��p.�U�=p�a��(�� A�a!ڈb�X#����!�H�$ ɈQ"K�5H1R�T UH�=r9�\F��;�2����G1���Q=� �C��7�F� �dt1�����r�=�6��Ыhڏ>C�0��3�l0.��B�8, �c˱"� ���V����cϱw�E� 6wB aAHXLXN�H� $4� 7 �Q�'"��K�&���b21�XH,#��/{�C�7$�C2'��I��T��F�nR#�,��4H#���dk�9�, +ȅ����3��!�[ �b@q��S�(R�jJ��4�e�2AU��Rݨ�T5�ZB���R�Q��4u�9̓IK�����hh�i��t�ݕN��W���G���w ��Ljg(�gw��L�Ӌ�T071���oUX*�*|�� �J�&�*/T����ު U�U�T��^S}�FU3S� Ԗ�U��P�SSg�;���g�oT?�~Y��Y�L�OC�Q��_�� c�x,!k ��u�5�&���|v*�����=���9C3J3W�R�f?�q��tN �(���~���)�)�4L�1e\k����X�H�Q�G�6������E�Y��A�J'\'Gg����S�Sݧ �M=:��.�k���Dw�n��^��Lo��y���}/�T�m���G X� $� �<�5qo</���QC]�@C�a�a�ᄑ��<��F�F�i�\�$�m�mƣ&&!&KM�M�RM��)�;L;L���͢�֙5�=1�2��כ߷`ZxZ,����eI��Z�Yn�Z9Y�XUZ]�F���%ֻ�����N�N���gð�ɶ�����ۮ�m�}agbg�Ů��}�}��= ���Z~s�r:V:ޚΜ�?}����/gX���3��)�i�S��Ggg�s�󈋉K��.�>.���Ƚ�Jt�q]�z���������ۯ�6�i�ܟ�4�)�Y3s���C�Q��? ��0k߬~OCO�g��#/c/�W�װ��w��a�>�>r��>�<7�2�Y_�7��ȷ�O�o�_��C#�d�z����%g��A�[��z|!��?:�e����A���AA�������!h�쐭!��Α�i�P~���a�a��~ '���W�?�p�X�1�5w��Cs�D�D�Dޛg1O9�-J5*>�.j<�7�4�?�.fY��X�XIlK9.*�6nl������� �{�/�]py�����.,:�@L�N8��A*��%�w%� y��g"/�6ш�C\*N�H*Mz�쑼5y$�3�,幄'���L Lݛ:��v m2=:�1����qB�!M��g�g�fvˬe����n��/��k���Y- �B��TZ(�*�geWf�͉�9���+��̳�ې7�����ᒶ��KW-X潬j9�������(�x��oʿ�ܔ���Ĺd�f�f���-�[����n �ڴ �V����E�/��(ۻ��C���<��e����;?T�T�T�T6��ݵa��n��{��4���[���>ɾ�UUM�f�e�I���?�������m]�Nmq����#�׹���=TR��+�G�����w- 6 U����#pDy��� �� :�v�{���vg/jB��F�S��[b[�O�>����z�G��499�?r����C�d�&����ˮ/~�����јѡ�򗓿m|������������x31^�V���w�w��O�| (�h���SЧ��������c3-� cHRMz%������u0�`:�o�_�F5IDATx��ytUս�?�;���fN$$��@B�!�k��� -*�gE���j�O�kQ�ʠ`U�B_ �AÐ0%�Ȕ�@r3ޛ;߳��$�@��v����^�s����������$��ߢ !�W��5�̱'-٘������4�>�Rƫ$�G��0U�H}�_ _� #��k�MJ/=�9Du *ڲ�k�PQ;0��j|�*�$�^컂脛y���>�z×� B��� ��(�:$�ʔ_�6��C!B����MVx��a��ζyY����j��ƋY2�9�F�{r��r�딟F��Q��hY6��� x��[l��RC��������nt@��;P��3��� F�w��7��:�P���ɋ'���mj���Bƪ�$�Q�L��y��߷g��\���z����v5�p�v$�v櫻�`6~K �Y�X����,�:��"�o�e0II"(��,������l_�C���/4�+f�E�!q��:����u����c��樼.UE�@� �]K�W���$-�h]�JG���Dz)�`��.�A/ ���mᏣc�3jK� �!�>���$�Q�!�_�? \�C2(E �M$Z I{�U���s�ǣ���=��@Բe ޻��W�����@ �w����}�9v,)��.}*|"�s��di���,���G�]W�AC�������|<����[��ߕ������K�*�G nߴ!��‹��J�!��6(L�a)��Am��������;adf��:�xm��nh�;֦I��(���o�C~ډa?�=��s����h��E������xp����)���_���t��W�����´;8���`dz=(��@@�+,�;�`�fhl��XȌ�3,uI�~z(J����� �ZX�A����H'�À�㜦�82|��a�n�z2��I���� ���EY�h�ε<�0�q�{��C��v�˅��?"@��χ�x�WS+��N�~�KQ�J�8ل�� _.W��� !TU{�����,��"�� �;�������HI S� ��))�o�1�H�D� ���� (� ;����"Ҕ��,���� �F=���O��&�Ph>�`���y��߲ &S��P�<��'��1s�1cĂ�N����2)����@�u��tv��<�+�-&�����h��[!FSG���' � z z0��<����8d&�����E0�,��<��"!P�b4��� �{S�����X����.�囤���T��hEF��X�q0"-<����h���]�Py*����F⩍��@v�˂�Y08�� .q��a��s����(!<̫1�3�L�H��7sYW�`��qtu�\7��?�@�Y�� %Ka�x�GZ�*W�P��y�����N0r9��Z�c�%���q,��k�����!!,��>���IB��� �x1�Xu�Y���v-���ֺ��N������JP��a�2`�e5��w��u;�6�i���̃��(K���ťa��(l51��JL��O'%���]���ٖ뿉!��{*�p+f ���i8��D�ȑ���ܩ�M��V��ӟz��x�7Z�1i}�^͜���6e����x��)u�d�ˏ�V�eG�\�X1�����=n�U'�~Y����L�\,�(d!x ,�:�TW8� M`r���@��r+v�Q0��>^;˴�VbF��('����� �*O��i��j�Ӆ����^�S3&� ���{������.ی�� N;��NU%d0�Ce\r"�C�b��&t7N�7��� �ȪD�[%l�۪�$��'m?�A9tI�9>��NVL ��� 6v~M�����ъ�B���0����9$&=ώm��W�0���L���&��E���f�f��'+�9��hv��7,���M��6�D�&�^� �����8 D֮�����o��k^z��O��hP�8q�5d*��YVq3�{��������#LX4�?��jP=3�~�؅c�ݰ�̱�ұ��8̲��2�G�����j��έ�9��w7���U�X�w�85C��?!I&���o&����L���I#�^�eV�,�^t5�k� �xs˛\��U�8��."���{���ǵ�l4��ݼ�;��r"���G�/~���gJV�N糦��ZZ^k+NN�D��I$�=OE�z����|*�*{��%k���G��>�`9��b;�s���8,�qs��c��.b��q�%�>r��n�R�Ƨ�%�,�A��le#�8���}; 21�0�b�&�QX�f���q�00����$>�h�N�'�a3��A���/�r ��L5�8�GԲ'�����w;��c#�q1���h$*��V^�k��QĽ�b:i������� ����H F#�_���,��]g����Ը����`RUU���� ��"�qD���>-��ϤI�~��3�̴�����NZ[[555�eeek7�m����YF#[��Đ��R��i��L�H�r ��@��J-�Pŝ��_|�-��6y��ks�V�U~��6���w.����(��0A� 4��f��� /���C�xŊ�ٳ����z=6�����rg���mKo��o�/����a�g���?'9%9��P��斓��~���L{�� �H��{AW��B��$����v�1b�&Mb�ر��ر#�0`�`xMBp! )Z�Nmo�mZ�g�}�eذaWTVV ���'99��C5��&�&+5�bT>|8��PUUETT����&���t��~TE%��'������b�tEGG;RSS�S�N�v��ѯ��t����u1@�ޚ"f��͈���r'L�Ph��m��ƌ�74o��`�x�q�P���NRSS�X,�����l&&&��MFFA!-��`��ҷ�n��Yuu�����x<I�LB%����KԒ50�!�3�bz�����ʸKL���;---�l6[��`��������Ȏ;�����egg4��!D�T��jWujyZ��������K����%����p�^���X,6��sV=�ܖ����6�3�X ���4ҿ��A2�&����_k�;d�� �VfOIEND�B`�
Warning: session_start(): Session cannot be started after headers have already been sent in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 124

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 130

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 131

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 132

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 133

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 134

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 135

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 547

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 548

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 549

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 550

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 551
add_namespace_command('wordfence', 'WordfenceLS\Controller_CLI_Wordfence_Namespace', 'Manage settings and functionality within Wordfence.'); $this->add_namespace_command('wordfence login-security', 'WordfenceLS\Controller_CLI_Login_Security_Namespace', 'Manage login security settings, permissions, and secondary authentication credentials.'); } $this->add_command('wordfence login-security passkeys', new Controller_CLI_Passkeys(), array( 'shortdesc' => 'Manage passkeys for users.', )); $this->add_command('wordfence login-security passkey-roles', new Controller_CLI_Passkey_Roles(), array( 'shortdesc' => 'Manage role-based passkey availability and requirements.', )); $this->add_command('wordfence login-security grace-period', new Controller_CLI_Grace_Period(), array( 'shortdesc' => 'Manage user grace periods for required login security.', )); } /** * Adds a WP-CLI command when its parent namespace can accept subcommands. * * @param string $path The WP-CLI command path. * @param mixed $command The command callback, object, or class name. * @param array $args Additional WP-CLI command registration arguments. * @return void */ private function add_command($path, $command, $args = array()) { if (!$this->can_register_command_path($path)) { return; } \WP_CLI::add_command($path, $command, $args); } /** * Adds a metadata-only WP-CLI namespace without replacing concrete commands. * * @param string $path The WP-CLI namespace path. * @param string $class The CommandNamespace class name. * @param string $shortdesc The namespace short description. * @return void */ private function add_namespace_command($path, $class, $shortdesc) { if (!$this->can_register_command_path($path)) { return; } $existingCommand = $this->get_registered_command($path); if ($existingCommand !== null && !($existingCommand instanceof \WP_CLI\Dispatcher\CommandNamespace)) { return; } \WP_CLI::add_command($path, $class, array( 'shortdesc' => $shortdesc, )); } /** * Returns whether a command path's existing parents can have subcommands. * * @param string $path The WP-CLI command path. * @return bool */ private function can_register_command_path($path) { if (!method_exists('\WP_CLI', 'get_root_command')) { return true; } $command = \WP_CLI::get_root_command(); $parts = preg_split('/\s+/', trim((string) $path)); if (!is_array($parts)) { return true; } array_pop($parts); foreach ($parts as $part) { if ($part === '') { continue; } if (!is_object($command) || !method_exists($command, 'get_subcommands')) { return false; } $subcommands = $command->get_subcommands(); if (!is_array($subcommands) || !isset($subcommands[$part])) { return true; } $command = $subcommands[$part]; if (method_exists($command, 'can_have_subcommands') && !$command->can_have_subcommands()) { return false; } } return true; } /** * Gets an already registered WP-CLI command for a path. * * @param string $path The WP-CLI command path. * @return object|null */ private function get_registered_command($path) { if (!method_exists('\WP_CLI', 'get_root_command')) { return null; } $command = \WP_CLI::get_root_command(); $parts = preg_split('/\s+/', trim((string) $path)); if (!is_array($parts)) { return null; } foreach ($parts as $part) { if ($part === '') { continue; } if (!is_object($command) || !method_exists($command, 'get_subcommands')) { return null; } $subcommands = $command->get_subcommands(); if (!is_array($subcommands) || !isset($subcommands[$part])) { return null; } $command = $subcommands[$part]; } return is_object($command) ? $command : null; } } if (class_exists('\WP_CLI\Dispatcher\CommandNamespace')) { /** * Manage settings and functionality within Wordfence */ class Controller_CLI_Wordfence_Namespace extends \WP_CLI\Dispatcher\CommandNamespace { } /** * Manage login security settings, permissions, and secondary authentication credentials. */ class Controller_CLI_Login_Security_Namespace extends \WP_CLI\Dispatcher\CommandNamespace { } } /** * Provides shared helpers for Wordfence Login Security WP-CLI commands. */ abstract class Controller_CLI_Command { /** * Resolves a user by ID, login, or email address. * * @param string|int $identifier User ID, login, or email address. * @return \WP_User */ protected function get_user($identifier) { $identifier = (string) $identifier; $user = false; if (ctype_digit($identifier)) { $user = get_user_by('id', (int) $identifier); } if (!$user) { $user = get_user_by('login', $identifier); } if (!$user && is_email($identifier)) { $user = get_user_by('email', $identifier); } if (!($user instanceof \WP_User) || !$user->exists()) { \WP_CLI::error(sprintf('User not found: %s', $identifier)); } return $user; } /** * Formats a user for CLI output. * * @param \WP_User $user The user. * @return string */ protected function user_label($user) { return sprintf('%s (ID %d)', $user->user_login, (int) $user->ID); } /** * Parses a CLI integer value after strict range validation. * * @param mixed $value The value to parse. * @param int $min The minimum allowed value. * @param int|null $max The maximum allowed value, if any. * @param string $message The error message to use for invalid values. * @return int */ protected function parse_integer($value, $min, $max, $message) { if (!Utility_Number::isInteger($value, $min, $max)) { \WP_CLI::error($message); } return (int) $value; } /** * Parses a CLI enabled/disabled state value. * * @param string $value The state value. * @return bool */ protected function parse_enabled_state($value) { $value = strtolower(trim((string) $value)); if (in_array($value, array('1', 'true', 'yes', 'on', 'enable', 'enabled'), true)) { return true; } if (in_array($value, array('0', 'false', 'no', 'off', 'disable', 'disabled'), true)) { return false; } \WP_CLI::error('State must be one of: enabled, disabled.'); } } /** * Manage passkeys for users. */ class Controller_CLI_Passkeys extends Controller_CLI_Command { /** * Lists passkeys registered for a user. * * ## OPTIONS * * * : User ID, login, or email address. * * [--format=] * : Output format. * --- * default: table * options: * - table * - json * - csv * - yaml * - count * --- * * ## EXAMPLES * * wp wordfence login-security passkeys list 123 * wp wordfence login-security passkeys list admin --format=json * * @subcommand list * * @param array $args * @param array $assoc_args * @return void */ public function list_($args, $assoc_args) { if (!isset($args[0])) { \WP_CLI::error('A user ID, login, or email address is required.'); } $user = $this->get_user($args[0]); $items = array(); foreach (Controller_Passkey::shared()->get_passkeys($user) as $passkey) { $items[] = $this->format_passkey($passkey); } $format = isset($assoc_args['format']) && is_string($assoc_args['format']) ? $assoc_args['format'] : 'table'; if (empty($items) && $format === 'table') { \WP_CLI::line(sprintf('No passkeys are registered for %s.', $this->user_label($user))); return; } \WP_CLI\Utils\format_items($format, $items, array( 'id', 'label', 'credential_id', 'transports', 'sign_count', 'created', 'last_used', )); } /** * Removes a passkey from a user. * * ## OPTIONS * * * : User ID, login, or email address. * * * : Passkey ID from the passkey list command. * * [--yes] * : Do not prompt for confirmation. * * ## EXAMPLES * * wp wordfence login-security passkeys remove 123 4 --yes * wp wordfence login-security passkeys remove admin 4 * * @param array $args * @param array $assoc_args * @return void */ public function remove($args, $assoc_args) { if (!isset($args[0])) { \WP_CLI::error('A user ID, login, or email address is required.'); } if (!isset($args[1])) { \WP_CLI::error('A passkey ID is required.'); } $user = $this->get_user($args[0]); $passkeyID = $this->parse_integer($args[1], 1, null, 'A valid passkey ID is required.'); $passkey = $this->get_passkey_by_id($user, $passkeyID); if (!$passkey) { \WP_CLI::error(sprintf('Passkey %d is not registered for %s.', $passkeyID, $this->user_label($user))); } if (!isset($assoc_args['yes'])) { \WP_CLI::confirm(sprintf('Remove passkey %d (%s) from %s?', $passkeyID, $this->passkey_label($passkey), $this->user_label($user))); } $result = Controller_Passkey::shared()->remove_passkey($user, $passkeyID); if (is_wp_error($result)) { \WP_CLI::error($result->get_error_message()); } \WP_CLI::success(sprintf('Removed passkey %d from %s.', $passkeyID, $this->user_label($user))); } /** * Changes whether username/password login is allowed while the user has passkeys. * * ## OPTIONS * * * : User ID, login, or email address. * * * : Password login state. Accepted values: enabled, disabled. * * ## EXAMPLES * * wp wordfence login-security passkeys password-login admin disabled * wp wordfence login-security passkeys password-login 123 enabled * * @subcommand password-login * * @param array $args * @param array $assoc_args * @return void */ public function password_login($args, $assoc_args) { if (!isset($args[0])) { \WP_CLI::error('A user ID, login, or email address is required.'); } if (!isset($args[1])) { \WP_CLI::error('A password login state is required.'); } $user = $this->get_user($args[0]); $enabled = $this->parse_enabled_state($args[1]); $passkeyController = Controller_Passkey::shared(); if (!$passkeyController->can_change_username_password_auth($user)) { \WP_CLI::error('This option cannot be changed because passkeys are required for one or more of this user\'s roles.'); } if (!$passkeyController->set_username_password_auth_enabled($user, $enabled)) { \WP_CLI::error('Unable to save the user-specific passkey options.'); } \WP_CLI::success(sprintf( 'Username/password login is now %s for %s.', $enabled ? 'enabled' : 'disabled', $this->user_label($user) )); } /** * Finds a passkey belonging to a user by its internal database ID. * * @param \WP_User $user The user. * @param int $passkeyID The passkey ID. * @return array|null */ private function get_passkey_by_id($user, $passkeyID) { foreach (Controller_Passkey::shared()->get_passkeys($user) as $passkey) { if (isset($passkey['id']) && (int) $passkey['id'] === (int) $passkeyID) { return $passkey; } } return null; } /** * Formats a stored passkey row for CLI output. * * @param array $passkey The stored passkey. * @return array */ private function format_passkey($passkey) { return array( 'id' => isset($passkey['id']) ? (int) $passkey['id'] : 0, 'label' => $this->passkey_label($passkey), 'credential_id' => isset($passkey['credential_id']) ? bin2hex($passkey['credential_id']) : '', 'transports' => isset($passkey['transports']) ? (string) $passkey['transports'] : '', 'sign_count' => isset($passkey['sign_count']) ? (int) $passkey['sign_count'] : 0, 'created' => $this->format_time(isset($passkey['ctime']) ? $passkey['ctime'] : 0), 'last_used' => $this->format_time(isset($passkey['last_used_at']) ? $passkey['last_used_at'] : 0), ); } /** * Gets the display label for a passkey. * * @param array $passkey The stored passkey. * @return string */ private function passkey_label($passkey) { if (isset($passkey['label']) && is_string($passkey['label']) && $passkey['label'] !== '') { return $passkey['label']; } return 'Passkey'; } /** * Formats a Unix timestamp for CLI output. * * @param int|string $timestamp The timestamp. * @return string */ private function format_time($timestamp) { $timestamp = (int) $timestamp; if ($timestamp <= 0) { return ''; } return Controller_Time::format_local_time('Y-m-d H:i:s', $timestamp); } } /** * Manage role-based passkey availability and requirements. */ class Controller_CLI_Passkey_Roles extends Controller_CLI_Command { /** * Lists passkey settings for roles. * * ## OPTIONS * * [--format=] * : Output format. * --- * default: table * options: * - table * - json * - csv * - yaml * - count * --- * * ## EXAMPLES * * wp wordfence login-security passkey-roles list * wp wordfence login-security passkey-roles list --format=json * * @subcommand list * * @param array $args * @param array $assoc_args * @return void */ public function list_($args, $assoc_args) { $format = isset($assoc_args['format']) && is_string($assoc_args['format']) ? $assoc_args['format'] : 'table'; \WP_CLI\Utils\format_items($format, $this->role_items(), array( 'role', 'name', 'state', 'required_since', )); } /** * Changes a role between passkey disabled, optional, and required. * * ## OPTIONS * * * : Role slug. On multisite, only super-admin is supported. * * * : Passkey state. Accepted values: disabled, optional, required. * * ## EXAMPLES * * wp wordfence login-security passkey-roles set editor optional * wp wordfence login-security passkey-roles set administrator required * * @param array $args * @param array $assoc_args * @return void */ public function set($args, $assoc_args) { if (!isset($args[0])) { \WP_CLI::error('A role is required.'); } if (!isset($args[1])) { \WP_CLI::error('A passkey role state is required.'); } $role = (string) $args[0]; $state = $this->parse_role_state($args[1]); $this->validate_role($role); if (is_multisite() && $role === 'super-admin' && $state === Controller_Settings::STATE_PASSKEY_DISABLED) { \WP_CLI::error('Super Administrator passkeys cannot be disabled on multisite. Use optional or required.'); } $key = 'passkey-enabled-roles.' . $role; if (!Controller_Settings::shared()->set($key, $state)) { \WP_CLI::error(sprintf('Unable to set passkey state for role %s.', $role)); } \WP_CLI::success(sprintf('Passkeys are now %s for role %s.', $this->state_label($state), $role)); } /** * Builds CLI output rows for passkey role settings. * * @return array */ private function role_items() { $wpRoles = new \WP_Roles(); $items = array(); if (is_multisite()) { $items[] = $this->role_item('super-admin', 'Super Administrator'); return $items; } foreach ($wpRoles->role_objects as $name => $role) { $items[] = $this->role_item($name, isset($wpRoles->role_names[$name]) ? $wpRoles->role_names[$name] : $name, $role); } return $items; } /** * Builds a CLI output row for a role's passkey setting. * * @param string $roleName The role slug. * @param string $displayName The role display name. * @param \WP_Role|null $role The role object. * @return array */ private function role_item($roleName, $displayName, $role = null) { $requiredSince = Controller_Settings::shared()->get_required_passkey_role_activation_time($roleName); $state = Controller_Settings::STATE_PASSKEY_DISABLED; if ($requiredSince !== false) { $state = Controller_Settings::STATE_PASSKEY_REQUIRED; } else if ($roleName === 'super-admin' || ($role instanceof \WP_Role && $role->has_cap(Controller_Permissions::CAP_MANAGE_PASSKEY_SELF))) { $state = Controller_Settings::STATE_PASSKEY_OPTIONAL; } return array( 'role' => $roleName, 'name' => $displayName, 'state' => $this->state_label($state), 'required_since' => $requiredSince === false ? '' : Controller_Time::format_local_time('Y-m-d H:i:s', $requiredSince), ); } /** * Validates that a role can be managed by the passkey role command. * * @param string $role The role slug. * @return void */ private function validate_role($role) { if (is_multisite()) { if ($role !== 'super-admin') { \WP_CLI::error('On multisite, passkey role settings are limited to super-admin.'); } return; } $wpRoles = new \WP_Roles(); if (!isset($wpRoles->role_objects[$role])) { \WP_CLI::error(sprintf('Role not found: %s', $role)); } } /** * Parses a CLI passkey role state value. * * @param string $state The state value. * @return string */ private function parse_role_state($state) { $state = strtolower(str_replace('-', '_', trim((string) $state))); switch ($state) { case 'disabled': case 'passkey_disabled': return Controller_Settings::STATE_PASSKEY_DISABLED; case 'optional': case 'passkey_optional': return Controller_Settings::STATE_PASSKEY_OPTIONAL; case 'required': case 'passkey_required': return Controller_Settings::STATE_PASSKEY_REQUIRED; } \WP_CLI::error('State must be one of: disabled, optional, required.'); } /** * Formats a passkey role state for CLI output. * * @param string $state The stored passkey role state. * @return string */ private function state_label($state) { switch ($state) { case Controller_Settings::STATE_PASSKEY_OPTIONAL: return 'optional'; case Controller_Settings::STATE_PASSKEY_REQUIRED: return 'required'; case Controller_Settings::STATE_PASSKEY_DISABLED: default: return 'disabled'; } } } /** * Manage user grace periods for required login security. */ class Controller_CLI_Grace_Period extends Controller_CLI_Command { /** * Resets the additional authentication grace period for a user. * * ## OPTIONS * * * : User ID, login, or email address. * * [--days=] * : Optional grace-period override in days. Must be between 0 and 99. * * ## EXAMPLES * * wp wordfence login-security grace-period reset admin * wp wordfence login-security grace-period reset 123 --days=14 * * @param array $args * @param array $assoc_args * @return void */ public function reset($args, $assoc_args) { if (!isset($args[0])) { \WP_CLI::error('A user ID, login, or email address is required.'); } $user = $this->get_user($args[0]); $override = null; if (array_key_exists('days', $assoc_args)) { $override = $this->parse_integer( $assoc_args['days'], 0, Controller_Settings::MAX_REQUIRE_2FA_USER_GRACE_PERIOD, sprintf('Grace period override must be between 0 and %d days.', Controller_Settings::MAX_REQUIRE_2FA_USER_GRACE_PERIOD) ); } Controller_Users::shared()->allow_grace_period($user->ID); if (!Controller_Users::shared()->reset_grace_period($user, $override)) { \WP_CLI::error('Failed to reset grace period. The user may not be missing required 2FA or passkey authentication.'); } \WP_CLI::success(sprintf('Reset grace period for %s.', $this->user_label($user))); } }