�PNG  IHDR22?�� pHYs  �� OiCCPPhotoshop ICC profilexڝSgTS�=���BK���KoR RB���&*! J�!��Q�EEȠ�����Q, � ��!���������{�kּ������>���� �H3Q5� �B�������.@� $p�d!s�#�~<<+"��x� �M��0���B�\���t�8K�@z�B�@F���&S�`�cb�P-`'������{[�!�� e�Dh;��V�EX0fK�9�-0IWfH���� � 0Q��){`�##x��F�W<�+��*x��<�$9E�[-qWW.(�I+6aa�@.�y�2�4���������x����6��_-��"bb���ϫp@�t~��,/��;�m��%�h^ �u��f�@����W�p�~<�5�j>{�-�]c�K'Xt����o��(�h���w��?�G�%�fI�q^D$.Tʳ?�D��*�A��,���� �`6�B$��BB d�r`)��B(�Ͱ*`/�@4�Qh��p.�U�=p�a��(�� A�a!ڈb�X#����!�H�$ ɈQ"K�5H1R�T UH�=r9�\F��;�2����G1���Q=� �C��7�F� �dt1�����r�=�6��Ыhڏ>C�0��3�l0.��B�8, �c˱"� ���V����cϱw�E� 6wB aAHXLXN�H� $4� 7 �Q�'"��K�&���b21�XH,#��/{�C�7$�C2'��I��T��F�nR#�,��4H#���dk�9�, +ȅ����3��!�[ �b@q��S�(R�jJ��4�e�2AU��Rݨ�T5�ZB���R�Q��4u�9̓IK�����hh�i��t�ݕN��W���G���w ��Ljg(�gw��L�Ӌ�T071���oUX*�*|�� �J�&�*/T����ު U�U�T��^S}�FU3S� Ԗ�U��P�SSg�;���g�oT?�~Y��Y�L�OC�Q��_�� c�x,!k ��u�5�&���|v*�����=���9C3J3W�R�f?�q��tN �(���~���)�)�4L�1e\k����X�H�Q�G�6������E�Y��A�J'\'Gg����S�Sݧ �M=:��.�k���Dw�n��^��Lo��y���}/�T�m���G X� $� �<�5qo</���QC]�@C�a�a�ᄑ��<��F�F�i�\�$�m�mƣ&&!&KM�M�RM��)�;L;L���͢�֙5�=1�2��כ߷`ZxZ,����eI��Z�Yn�Z9Y�XUZ]�F���%ֻ�����N�N���gð�ɶ�����ۮ�m�}agbg�Ů��}�}��= ���Z~s�r:V:ޚΜ�?}����/gX���3��)�i�S��Ggg�s�󈋉K��.�>.���Ƚ�Jt�q]�z���������ۯ�6�i�ܟ�4�)�Y3s���C�Q��? ��0k߬~OCO�g��#/c/�W�װ��w��a�>�>r��>�<7�2�Y_�7��ȷ�O�o�_��C#�d�z����%g��A�[��z|!��?:�e����A���AA�������!h�쐭!��Α�i�P~���a�a��~ '���W�?�p�X�1�5w��Cs�D�D�Dޛg1O9�-J5*>�.j<�7�4�?�.fY��X�XIlK9.*�6nl������� �{�/�]py�����.,:�@L�N8��A*��%�w%� y��g"/�6ш�C\*N�H*Mz�쑼5y$�3�,幄'���L Lݛ:��v m2=:�1����qB�!M��g�g�fvˬe����n��/��k���Y- �B��TZ(�*�geWf�͉�9���+��̳�ې7�����ᒶ��KW-X潬j9�������(�x��oʿ�ܔ���Ĺd�f�f���-�[����n �ڴ �V����E�/��(ۻ��C���<��e����;?T�T�T�T6��ݵa��n��{��4���[���>ɾ�UUM�f�e�I���?�������m]�Nmq����#�׹���=TR��+�G�����w- 6 U����#pDy��� �� :�v�{���vg/jB��F�S��[b[�O�>����z�G��499�?r����C�d�&����ˮ/~�����јѡ�򗓿m|������������x31^�V���w�w��O�| (�h���SЧ��������c3-� cHRMz%������u0�`:�o�_�F5IDATx��ytUս�?�;���fN$$��@B�!�k��� -*�gE���j�O�kQ�ʠ`U�B_ �AÐ0%�Ȕ�@r3ޛ;߳��$�@��v����^�s����������$��ߢ !�W��5�̱'-٘������4�>�Rƫ$�G��0U�H}�_ _� #��k�MJ/=�9Du *ڲ�k�PQ;0��j|�*�$�^컂脛y���>�z×� B��� ��(�:$�ʔ_�6��C!B����MVx��a��ζyY����j��ƋY2�9�F�{r��r�딟F��Q��hY6��� x��[l��RC��������nt@��;P��3��� F�w��7��:�P���ɋ'���mj���Bƪ�$�Q�L��y��߷g��\���z����v5�p�v$�v櫻�`6~K �Y�X����,�:��"�o�e0II"(��,������l_�C���/4�+f�E�!q��:����u����c��樼.UE�@� �]K�W���$-�h]�JG���Dz)�`��.�A/ ���mᏣc�3jK� �!�>���$�Q�!�_�? \�C2(E �M$Z I{�U���s�ǣ���=��@Բe ޻��W�����@ �w����}�9v,)��.}*|"�s��di���,���G�]W�AC�������|<����[��ߕ������K�*�G nߴ!��‹��J�!��6(L�a)��Am��������;adf��:�xm��nh�;֦I��(���o�C~ډa?�=��s����h��E������xp����)���_���t��W�����´;8���`dz=(��@@�+,�;�`�fhl��XȌ�3,uI�~z(J����� �ZX�A����H'�À�㜦�82|��a�n�z2��I���� ���EY�h�ε<�0�q�{��C��v�˅��?"@��χ�x�WS+��N�~�KQ�J�8ل�� _.W��� !TU{�����,��"�� �;�������HI S� ��))�o�1�H�D� ���� (� ;����"Ҕ��,���� �F=���O��&�Ph>�`���y��߲ &S��P�<��'��1s�1cĂ�N����2)����@�u��tv��<�+�-&�����h��[!FSG���' � z z0��<����8d&�����E0�,��<��"!P�b4��� �{S�����X����.�囤���T��hEF��X�q0"-<����h���]�Py*����F⩍��@v�˂�Y08�� .q��a��s����(!<̫1�3�L�H��7sYW�`��qtu�\7��?�@�Y�� %Ka�x�GZ�*W�P��y�����N0r9��Z�c�%���q,��k�����!!,��>���IB��� �x1�Xu�Y���v-���ֺ��N������JP��a�2`�e5��w��u;�6�i���̃��(K���ťa��(l51��JL��O'%���]���ٖ뿉!��{*�p+f ���i8��D�ȑ���ܩ�M��V��ӟz��x�7Z�1i}�^͜���6e����x��)u�d�ˏ�V�eG�\�X1�����=n�U'�~Y����L�\,�(d!x ,�:�TW8� M`r���@��r+v�Q0��>^;˴�VbF��('����� �*O��i��j�Ӆ����^�S3&� ���{������.ی�� N;��NU%d0�Ce\r"�C�b��&t7N�7��� �ȪD�[%l�۪�$��'m?�A9tI�9>��NVL ��� 6v~M�����ъ�B���0����9$&=ώm��W�0���L���&��E���f�f��'+�9��hv��7,���M��6�D�&�^� �����8 D֮�����o��k^z��O��hP�8q�5d*��YVq3�{��������#LX4�?��jP=3�~�؅c�ݰ�̱�ұ��8̲��2�G�����j��έ�9��w7���U�X�w�85C��?!I&���o&����L���I#�^�eV�,�^t5�k� �xs˛\��U�8��."���{���ǵ�l4��ݼ�;��r"���G�/~���gJV�N糦��ZZ^k+NN�D��I$�=OE�z����|*�*{��%k���G��>�`9��b;�s���8,�qs��c��.b��q�%�>r��n�R�Ƨ�%�,�A��le#�8���}; 21�0�b�&�QX�f���q�00����$>�h�N�'�a3��A���/�r ��L5�8�GԲ'�����w;��c#�q1���h$*��V^�k��QĽ�b:i������� ����H F#�_���,��]g����Ը����`RUU���� ��"�qD���>-��ϤI�~��3�̴�����NZ[[555�eeek7�m����YF#[��Đ��R��i��L�H�r ��@��J-�Pŝ��_|�-��6y��ks�V�U~��6���w.����(��0A� 4��f��� /���C�xŊ�ٳ����z=6�����rg���mKo��o�/����a�g���?'9%9��P��斓��~���L{�� �H��{AW��B��$����v�1b�&Mb�ر��ر#�0`�`xMBp! )Z�Nmo�mZ�g�}�eذaWTVV ���'99��C5��&�&+5�bT>|8��PUUETT����&���t��~TE%��'������b�tEGG;RSS�S�N�v��ѯ��t����u1@�ޚ"f��͈���r'L�Ph��m��ƌ�74o��`�x�q�P���NRSS�X,�����l&&&��MFFA!-��`��ҷ�n��Yuu�����x<I�LB%����KԒ50�!�3�bz�����ʸKL���;---�l6[��`��������Ȏ;�����egg4��!D�T��jWujyZ��������K����%����p�^���X,6��sV=�ܖ����6�3�X ���4ҿ��A2�&����_k�;d�� �VfOIEND�B`�
Warning: session_start(): Session cannot be started after headers have already been sent in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 124

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 130

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 131

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 132

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 133

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 134

Warning: Cannot modify header information - headers already sent by (output started at /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php:1) in /home/mciraet/www/wp-includes/php-ai-client/src/Providers/Enums/Documentsoliders.php on line 135
0x0x
0x0x
PHP 8.2.31
Preview: cli.php Size: 19.24 KB
/home/m/c/i/mciraet/www/wp-content/plugins/wordfence/modules/login-security/classes/controller/cli.php
<?php

namespace WordfenceLS;

/**
 * Registers Wordfence Login Security WP-CLI namespaces and commands.
 */
class Controller_CLI {
	/**
	 * Returns the singleton Controller_CLI.
	 *
	 * @return Controller_CLI
	 */
	public static function shared() {
		static $_shared = null;
		if ($_shared === null) {
			$_shared = new Controller_CLI();
		}
		return $_shared;
	}

	/**
	 * Registers WP-CLI commands when WP-CLI is available.
	 *
	 * @return void
	 */
	public function init() {
		if (!defined('WP_CLI') || !WP_CLI || !class_exists('\WP_CLI')) {
			return;
		}

		if (class_exists('\WP_CLI\Dispatcher\CommandNamespace')) {
			$this->add_namespace_command('wordfence', 'WordfenceLS\Controller_CLI_Wordfence_Namespace', 'Manage settings and functionality within Wordfence.');
			$this->add_namespace_command('wordfence login-security', 'WordfenceLS\Controller_CLI_Login_Security_Namespace', 'Manage login security settings, permissions, and secondary authentication credentials.');
		}

		$this->add_command('wordfence login-security passkeys', new Controller_CLI_Passkeys(), array(
			'shortdesc' => 'Manage passkeys for users.',
		));
		$this->add_command('wordfence login-security passkey-roles', new Controller_CLI_Passkey_Roles(), array(
			'shortdesc' => 'Manage role-based passkey availability and requirements.',
		));
		$this->add_command('wordfence login-security grace-period', new Controller_CLI_Grace_Period(), array(
			'shortdesc' => 'Manage user grace periods for required login security.',
		));
	}

	/**
	 * Adds a WP-CLI command when its parent namespace can accept subcommands.
	 *
	 * @param string $path The WP-CLI command path.
	 * @param mixed $command The command callback, object, or class name.
	 * @param array $args Additional WP-CLI command registration arguments.
	 * @return void
	 */
	private function add_command($path, $command, $args = array()) {
		if (!$this->can_register_command_path($path)) {
			return;
		}

		\WP_CLI::add_command($path, $command, $args);
	}

	/**
	 * Adds a metadata-only WP-CLI namespace without replacing concrete commands.
	 *
	 * @param string $path The WP-CLI namespace path.
	 * @param string $class The CommandNamespace class name.
	 * @param string $shortdesc The namespace short description.
	 * @return void
	 */
	private function add_namespace_command($path, $class, $shortdesc) {
		if (!$this->can_register_command_path($path)) {
			return;
		}

		$existingCommand = $this->get_registered_command($path);
		if ($existingCommand !== null && !($existingCommand instanceof \WP_CLI\Dispatcher\CommandNamespace)) {
			return;
		}

		\WP_CLI::add_command($path, $class, array(
			'shortdesc' => $shortdesc,
		));
	}

	/**
	 * Returns whether a command path's existing parents can have subcommands.
	 *
	 * @param string $path The WP-CLI command path.
	 * @return bool
	 */
	private function can_register_command_path($path) {
		if (!method_exists('\WP_CLI', 'get_root_command')) {
			return true;
		}

		$command = \WP_CLI::get_root_command();
		$parts = preg_split('/\s+/', trim((string) $path));
		if (!is_array($parts)) {
			return true;
		}
		array_pop($parts);

		foreach ($parts as $part) {
			if ($part === '') {
				continue;
			}
			if (!is_object($command) || !method_exists($command, 'get_subcommands')) {
				return false;
			}
			$subcommands = $command->get_subcommands();
			if (!is_array($subcommands) || !isset($subcommands[$part])) {
				return true;
			}
			$command = $subcommands[$part];
			if (method_exists($command, 'can_have_subcommands') && !$command->can_have_subcommands()) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Gets an already registered WP-CLI command for a path.
	 *
	 * @param string $path The WP-CLI command path.
	 * @return object|null
	 */
	private function get_registered_command($path) {
		if (!method_exists('\WP_CLI', 'get_root_command')) {
			return null;
		}

		$command = \WP_CLI::get_root_command();
		$parts = preg_split('/\s+/', trim((string) $path));
		if (!is_array($parts)) {
			return null;
		}

		foreach ($parts as $part) {
			if ($part === '') {
				continue;
			}
			if (!is_object($command) || !method_exists($command, 'get_subcommands')) {
				return null;
			}
			$subcommands = $command->get_subcommands();
			if (!is_array($subcommands) || !isset($subcommands[$part])) {
				return null;
			}
			$command = $subcommands[$part];
		}

		return is_object($command) ? $command : null;
	}
}

if (class_exists('\WP_CLI\Dispatcher\CommandNamespace')) {
	/**
	 * Manage settings and functionality within Wordfence
	 */
	class Controller_CLI_Wordfence_Namespace extends \WP_CLI\Dispatcher\CommandNamespace {
	}

	/**
	 * Manage login security settings, permissions, and secondary authentication credentials.
	 */
	class Controller_CLI_Login_Security_Namespace extends \WP_CLI\Dispatcher\CommandNamespace {
	}
}

/**
 * Provides shared helpers for Wordfence Login Security WP-CLI commands.
 */
abstract class Controller_CLI_Command {
	/**
	 * Resolves a user by ID, login, or email address.
	 *
	 * @param string|int $identifier User ID, login, or email address.
	 * @return \WP_User
	 */
	protected function get_user($identifier) {
		$identifier = (string) $identifier;
		$user = false;

		if (ctype_digit($identifier)) {
			$user = get_user_by('id', (int) $identifier);
		}
		if (!$user) {
			$user = get_user_by('login', $identifier);
		}
		if (!$user && is_email($identifier)) {
			$user = get_user_by('email', $identifier);
		}

		if (!($user instanceof \WP_User) || !$user->exists()) {
			\WP_CLI::error(sprintf('User not found: %s', $identifier));
		}

		return $user;
	}

	/**
	 * Formats a user for CLI output.
	 *
	 * @param \WP_User $user The user.
	 * @return string
	 */
	protected function user_label($user) {
		return sprintf('%s (ID %d)', $user->user_login, (int) $user->ID);
	}

	/**
	 * Parses a CLI integer value after strict range validation.
	 *
	 * @param mixed $value The value to parse.
	 * @param int $min The minimum allowed value.
	 * @param int|null $max The maximum allowed value, if any.
	 * @param string $message The error message to use for invalid values.
	 * @return int
	 */
	protected function parse_integer($value, $min, $max, $message) {
		if (!Utility_Number::isInteger($value, $min, $max)) {
			\WP_CLI::error($message);
		}

		return (int) $value;
	}

	/**
	 * Parses a CLI enabled/disabled state value.
	 *
	 * @param string $value The state value.
	 * @return bool
	 */
	protected function parse_enabled_state($value) {
		$value = strtolower(trim((string) $value));
		if (in_array($value, array('1', 'true', 'yes', 'on', 'enable', 'enabled'), true)) {
			return true;
		}
		if (in_array($value, array('0', 'false', 'no', 'off', 'disable', 'disabled'), true)) {
			return false;
		}

		\WP_CLI::error('State must be one of: enabled, disabled.');
	}
}

/**
 * Manage passkeys for users.
 */
class Controller_CLI_Passkeys extends Controller_CLI_Command {
	/**
	 * Lists passkeys registered for a user.
	 *
	 * ## OPTIONS
	 *
	 * <user>
	 * : User ID, login, or email address.
	 *
	 * [--format=<format>]
	 * : Output format.
	 * ---
	 * default: table
	 * options:
	 *   - table
	 *   - json
	 *   - csv
	 *   - yaml
	 *   - count
	 * ---
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security passkeys list 123
	 *     wp wordfence login-security passkeys list admin --format=json
	 *
	 * @subcommand list
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function list_($args, $assoc_args) {
		if (!isset($args[0])) {
			\WP_CLI::error('A user ID, login, or email address is required.');
		}

		$user = $this->get_user($args[0]);
		$items = array();

		foreach (Controller_Passkey::shared()->get_passkeys($user) as $passkey) {
			$items[] = $this->format_passkey($passkey);
		}

		$format = isset($assoc_args['format']) && is_string($assoc_args['format']) ? $assoc_args['format'] : 'table';
		if (empty($items) && $format === 'table') {
			\WP_CLI::line(sprintf('No passkeys are registered for %s.', $this->user_label($user)));
			return;
		}

		\WP_CLI\Utils\format_items($format, $items, array(
			'id',
			'label',
			'credential_id',
			'transports',
			'sign_count',
			'created',
			'last_used',
		));
	}

	/**
	 * Removes a passkey from a user.
	 *
	 * ## OPTIONS
	 *
	 * <user>
	 * : User ID, login, or email address.
	 *
	 * <passkey-id>
	 * : Passkey ID from the passkey list command.
	 *
	 * [--yes]
	 * : Do not prompt for confirmation.
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security passkeys remove 123 4 --yes
	 *     wp wordfence login-security passkeys remove admin 4
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function remove($args, $assoc_args) {
		if (!isset($args[0])) {
			\WP_CLI::error('A user ID, login, or email address is required.');
		}
		if (!isset($args[1])) {
			\WP_CLI::error('A passkey ID is required.');
		}

		$user = $this->get_user($args[0]);
		$passkeyID = $this->parse_integer($args[1], 1, null, 'A valid passkey ID is required.');

		$passkey = $this->get_passkey_by_id($user, $passkeyID);
		if (!$passkey) {
			\WP_CLI::error(sprintf('Passkey %d is not registered for %s.', $passkeyID, $this->user_label($user)));
		}

		if (!isset($assoc_args['yes'])) {
			\WP_CLI::confirm(sprintf('Remove passkey %d (%s) from %s?', $passkeyID, $this->passkey_label($passkey), $this->user_label($user)));
		}

		$result = Controller_Passkey::shared()->remove_passkey($user, $passkeyID);
		if (is_wp_error($result)) {
			\WP_CLI::error($result->get_error_message());
		}

		\WP_CLI::success(sprintf('Removed passkey %d from %s.', $passkeyID, $this->user_label($user)));
	}

	/**
	 * Changes whether username/password login is allowed while the user has passkeys.
	 *
	 * ## OPTIONS
	 *
	 * <user>
	 * : User ID, login, or email address.
	 *
	 * <state>
	 * : Password login state. Accepted values: enabled, disabled.
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security passkeys password-login admin disabled
	 *     wp wordfence login-security passkeys password-login 123 enabled
	 *
	 * @subcommand password-login
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function password_login($args, $assoc_args) {
		if (!isset($args[0])) {
			\WP_CLI::error('A user ID, login, or email address is required.');
		}
		if (!isset($args[1])) {
			\WP_CLI::error('A password login state is required.');
		}

		$user = $this->get_user($args[0]);
		$enabled = $this->parse_enabled_state($args[1]);
		$passkeyController = Controller_Passkey::shared();
		if (!$passkeyController->can_change_username_password_auth($user)) {
			\WP_CLI::error('This option cannot be changed because passkeys are required for one or more of this user\'s roles.');
		}
		if (!$passkeyController->set_username_password_auth_enabled($user, $enabled)) {
			\WP_CLI::error('Unable to save the user-specific passkey options.');
		}

		\WP_CLI::success(sprintf(
			'Username/password login is now %s for %s.',
			$enabled ? 'enabled' : 'disabled',
			$this->user_label($user)
		));
	}

	/**
	 * Finds a passkey belonging to a user by its internal database ID.
	 *
	 * @param \WP_User $user The user.
	 * @param int $passkeyID The passkey ID.
	 * @return array|null
	 */
	private function get_passkey_by_id($user, $passkeyID) {
		foreach (Controller_Passkey::shared()->get_passkeys($user) as $passkey) {
			if (isset($passkey['id']) && (int) $passkey['id'] === (int) $passkeyID) {
				return $passkey;
			}
		}
		return null;
	}

	/**
	 * Formats a stored passkey row for CLI output.
	 *
	 * @param array $passkey The stored passkey.
	 * @return array
	 */
	private function format_passkey($passkey) {
		return array(
			'id' => isset($passkey['id']) ? (int) $passkey['id'] : 0,
			'label' => $this->passkey_label($passkey),
			'credential_id' => isset($passkey['credential_id']) ? bin2hex($passkey['credential_id']) : '',
			'transports' => isset($passkey['transports']) ? (string) $passkey['transports'] : '',
			'sign_count' => isset($passkey['sign_count']) ? (int) $passkey['sign_count'] : 0,
			'created' => $this->format_time(isset($passkey['ctime']) ? $passkey['ctime'] : 0),
			'last_used' => $this->format_time(isset($passkey['last_used_at']) ? $passkey['last_used_at'] : 0),
		);
	}

	/**
	 * Gets the display label for a passkey.
	 *
	 * @param array $passkey The stored passkey.
	 * @return string
	 */
	private function passkey_label($passkey) {
		if (isset($passkey['label']) && is_string($passkey['label']) && $passkey['label'] !== '') {
			return $passkey['label'];
		}
		return 'Passkey';
	}

	/**
	 * Formats a Unix timestamp for CLI output.
	 *
	 * @param int|string $timestamp The timestamp.
	 * @return string
	 */
	private function format_time($timestamp) {
		$timestamp = (int) $timestamp;
		if ($timestamp <= 0) {
			return '';
		}
		return Controller_Time::format_local_time('Y-m-d H:i:s', $timestamp);
	}
}

/**
 * Manage role-based passkey availability and requirements.
 */
class Controller_CLI_Passkey_Roles extends Controller_CLI_Command {
	/**
	 * Lists passkey settings for roles.
	 *
	 * ## OPTIONS
	 *
	 * [--format=<format>]
	 * : Output format.
	 * ---
	 * default: table
	 * options:
	 *   - table
	 *   - json
	 *   - csv
	 *   - yaml
	 *   - count
	 * ---
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security passkey-roles list
	 *     wp wordfence login-security passkey-roles list --format=json
	 *
	 * @subcommand list
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function list_($args, $assoc_args) {
		$format = isset($assoc_args['format']) && is_string($assoc_args['format']) ? $assoc_args['format'] : 'table';
		\WP_CLI\Utils\format_items($format, $this->role_items(), array(
			'role',
			'name',
			'state',
			'required_since',
		));
	}

	/**
	 * Changes a role between passkey disabled, optional, and required.
	 *
	 * ## OPTIONS
	 *
	 * <role>
	 * : Role slug. On multisite, only super-admin is supported.
	 *
	 * <state>
	 * : Passkey state. Accepted values: disabled, optional, required.
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security passkey-roles set editor optional
	 *     wp wordfence login-security passkey-roles set administrator required
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function set($args, $assoc_args) {
		if (!isset($args[0])) {
			\WP_CLI::error('A role is required.');
		}
		if (!isset($args[1])) {
			\WP_CLI::error('A passkey role state is required.');
		}

		$role = (string) $args[0];
		$state = $this->parse_role_state($args[1]);
		$this->validate_role($role);
		if (is_multisite() && $role === 'super-admin' && $state === Controller_Settings::STATE_PASSKEY_DISABLED) {
			\WP_CLI::error('Super Administrator passkeys cannot be disabled on multisite. Use optional or required.');
		}

		$key = 'passkey-enabled-roles.' . $role;
		if (!Controller_Settings::shared()->set($key, $state)) {
			\WP_CLI::error(sprintf('Unable to set passkey state for role %s.', $role));
		}

		\WP_CLI::success(sprintf('Passkeys are now %s for role %s.', $this->state_label($state), $role));
	}

	/**
	 * Builds CLI output rows for passkey role settings.
	 *
	 * @return array
	 */
	private function role_items() {
		$wpRoles = new \WP_Roles();
		$items = array();
		if (is_multisite()) {
			$items[] = $this->role_item('super-admin', 'Super Administrator');
			return $items;
		}

		foreach ($wpRoles->role_objects as $name => $role) {
			$items[] = $this->role_item($name, isset($wpRoles->role_names[$name]) ? $wpRoles->role_names[$name] : $name, $role);
		}
		return $items;
	}

	/**
	 * Builds a CLI output row for a role's passkey setting.
	 *
	 * @param string $roleName The role slug.
	 * @param string $displayName The role display name.
	 * @param \WP_Role|null $role The role object.
	 * @return array
	 */
	private function role_item($roleName, $displayName, $role = null) {
		$requiredSince = Controller_Settings::shared()->get_required_passkey_role_activation_time($roleName);
		$state = Controller_Settings::STATE_PASSKEY_DISABLED;
		if ($requiredSince !== false) {
			$state = Controller_Settings::STATE_PASSKEY_REQUIRED;
		}
		else if ($roleName === 'super-admin' || ($role instanceof \WP_Role && $role->has_cap(Controller_Permissions::CAP_MANAGE_PASSKEY_SELF))) {
			$state = Controller_Settings::STATE_PASSKEY_OPTIONAL;
		}

		return array(
			'role' => $roleName,
			'name' => $displayName,
			'state' => $this->state_label($state),
			'required_since' => $requiredSince === false ? '' : Controller_Time::format_local_time('Y-m-d H:i:s', $requiredSince),
		);
	}

	/**
	 * Validates that a role can be managed by the passkey role command.
	 *
	 * @param string $role The role slug.
	 * @return void
	 */
	private function validate_role($role) {
		if (is_multisite()) {
			if ($role !== 'super-admin') {
				\WP_CLI::error('On multisite, passkey role settings are limited to super-admin.');
			}
			return;
		}

		$wpRoles = new \WP_Roles();
		if (!isset($wpRoles->role_objects[$role])) {
			\WP_CLI::error(sprintf('Role not found: %s', $role));
		}
	}

	/**
	 * Parses a CLI passkey role state value.
	 *
	 * @param string $state The state value.
	 * @return string
	 */
	private function parse_role_state($state) {
		$state = strtolower(str_replace('-', '_', trim((string) $state)));
		switch ($state) {
			case 'disabled':
			case 'passkey_disabled':
				return Controller_Settings::STATE_PASSKEY_DISABLED;
			case 'optional':
			case 'passkey_optional':
				return Controller_Settings::STATE_PASSKEY_OPTIONAL;
			case 'required':
			case 'passkey_required':
				return Controller_Settings::STATE_PASSKEY_REQUIRED;
		}

		\WP_CLI::error('State must be one of: disabled, optional, required.');
	}

	/**
	 * Formats a passkey role state for CLI output.
	 *
	 * @param string $state The stored passkey role state.
	 * @return string
	 */
	private function state_label($state) {
		switch ($state) {
			case Controller_Settings::STATE_PASSKEY_OPTIONAL:
				return 'optional';
			case Controller_Settings::STATE_PASSKEY_REQUIRED:
				return 'required';
			case Controller_Settings::STATE_PASSKEY_DISABLED:
			default:
				return 'disabled';
		}
	}
}

/**
 * Manage user grace periods for required login security.
 */
class Controller_CLI_Grace_Period extends Controller_CLI_Command {
	/**
	 * Resets the additional authentication grace period for a user.
	 *
	 * ## OPTIONS
	 *
	 * <user>
	 * : User ID, login, or email address.
	 *
	 * [--days=<days>]
	 * : Optional grace-period override in days. Must be between 0 and 99.
	 *
	 * ## EXAMPLES
	 *
	 *     wp wordfence login-security grace-period reset admin
	 *     wp wordfence login-security grace-period reset 123 --days=14
	 *
	 * @param array $args
	 * @param array $assoc_args
	 * @return void
	 */
	public function reset($args, $assoc_args) {
		if (!isset($args[0])) {
			\WP_CLI::error('A user ID, login, or email address is required.');
		}

		$user = $this->get_user($args[0]);
		$override = null;
		if (array_key_exists('days', $assoc_args)) {
			$override = $this->parse_integer(
				$assoc_args['days'],
				0,
				Controller_Settings::MAX_REQUIRE_2FA_USER_GRACE_PERIOD,
				sprintf('Grace period override must be between 0 and %d days.', Controller_Settings::MAX_REQUIRE_2FA_USER_GRACE_PERIOD)
			);
		}

		Controller_Users::shared()->allow_grace_period($user->ID);
		if (!Controller_Users::shared()->reset_grace_period($user, $override)) {
			\WP_CLI::error('Failed to reset grace period. The user may not be missing required 2FA or passkey authentication.');
		}

		\WP_CLI::success(sprintf('Reset grace period for %s.', $this->user_label($user)));
	}
}

Directory Contents

Dirs: 0 × Files: 16
Name Size Perms Modified Actions
ajax.php
41.08 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
captcha.php
4.08 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
cli.php
19.24 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
db.php
9.19 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
javascript.php
42.77 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
notices.php
5.59 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
passkey.php
94.25 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
permissions.php
18.07 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
rest.php
32.12 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
settings.php
44.29 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
support.php
3.17 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
time.php
8.95 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
totp.php
7.11 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
users.php
55.51 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
whitelist.php
9.16 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
wordfencels.php
92.67 KB lrw-r--r-- 2026-08-11 10:23:26
Edit Download
If ZipArchive is unavailable, a .tar will be created (no compression).
© 2026 0xNothings — Secure File Manager. All rights reserved. Built with ❤️ & Tailwind x Dark UI