zZzzZ. — /home2/zrzvbdry/wiredsave.com/wp-content/plugins/limit-login-attempts-reloaded/core/mfa

Editing: MfaValidator.php

<?php

namespace LLAR\Core\Mfa;

use LLAR\Core\MfaConstants;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * MFA validation: capability, block reason (availability), input validation.
 * Single place for "can enable MFA" and rescue hash_id checks.
 */
class MfaValidator {

/**
	 * Whether current user can manage MFA. Multisite: super_admin; else: manage_options.
	 *
	 * @return bool
	 */
	public static function current_user_can_manage() {
		if ( is_multisite() ) {
			return is_super_admin();
		}
		return current_user_can( 'manage_options' );
	}

/**
	 * Reason why MFA cannot be enabled, or null if it can.
	 * Requires OpenSSL (no base64 fallback — do not enable without proper encryption).
	 * SSL is not required but recommended; a warning is shown when MFA is used without HTTPS.
	 * Rescue endpoint rate limit uses global cooldown (no salt required).
	 *
	 * @return string|null One of MfaConstants::MFA_BLOCK_REASON_* or null
	 */
	public static function get_block_reason() {
		if ( ! MfaConstants::is_openssl_available() ) {
			return MfaConstants::MFA_BLOCK_REASON_OPENSSL;
		}
		return null;
	}

/**
	 * Human-readable message for a block reason.
	 *
	 * @param string $block_reason One of MfaConstants::MFA_BLOCK_REASON_*
	 * @return string
	 */
	public static function get_block_message( $block_reason ) {
		if ( MfaConstants::MFA_BLOCK_REASON_SSL === $block_reason ) {
			return __( 'SSL/HTTPS is required for 2FA functionality. Please enable SSL on your site.', 'limit-login-attempts-reloaded' );
		}
		if ( MfaConstants::MFA_BLOCK_REASON_SALT === $block_reason ) {
			return __( '2FA cannot be enabled: WordPress salt (AUTH_SALT or NONCE_SALT) or wp_salt() is required for secure rate limiting. Please define salts in wp-config.php.', 'limit-login-attempts-reloaded' );
		}
		if ( MfaConstants::MFA_BLOCK_REASON_OPENSSL === $block_reason ) {
			return __( 'OpenSSL is required for secure rescue links. Enable the OpenSSL PHP extension. 2FA cannot be enabled without proper encryption.', 'limit-login-attempts-reloaded' );
		}
		return __( '2FA cannot be enabled.', 'limit-login-attempts-reloaded' );
	}

/**
	 * Validate rescue token from URL.
	 * Supports new format (32 chars, base62) and legacy format (64 chars, hex).
	 *
	 * @param string $hash_id Raw token from query.
	 * @return string|false Sanitized token or false if invalid.
	 */
	public static function validate_rescue_hash_id( $hash_id ) {
		$hash_id = is_string( $hash_id ) ? sanitize_text_field( $hash_id ) : '';
		$len     = strlen( $hash_id );

if ( MfaConstants::RESCUE_TOKEN_LENGTH === $len && preg_match( '/^[A-Za-z0-9]{' . MfaConstants::RESCUE_TOKEN_LENGTH . '}$/', $hash_id ) ) {
			return $hash_id;
		}

if ( 64 === $len && preg_match( '/^[a-f0-9]{64}$/i', $hash_id ) ) {
			return strtolower( $hash_id );
		}

return false;
	}
}