Login Security Solution - Version 0.9.0

Version Description

  • Fix change that prevented users from logging in after using the password reset process with an insecure password. Users can now pick a better password right on the spot.
  • Regenerate translation POT file.
  • Tested under WordPress 3.3.2 and 3.4RC3, both using regular and multisite.
  • Unit tests pass using PHP 5.4.0RC8-dev, 5.3.11-dev, and 5.2.18-dev.
Download this release

Release Info

Developer convissor
Plugin Icon wp plugin Login Security Solution
Version 0.9.0
Comparing to
See all releases

Code changes from version 0.8.0 to 0.9.0

Files changed (7) hide show
  1. languages/login-security-solution.pot +45 -41
  2. login-security-solution.php +9 -7
  3. readme.txt +16 -5
  4. tests/LoginFailTest.php +4 -0
  5. tests/LoginMessageTest.php +1 -7
  6. tests/PasswordChangeTest.php +5 -8
  7. tests/TestCase.php +16 -4
languages/login-security-solution.pot CHANGED
@@ -2,9 +2,9 @@
2
  # This file is distributed under the same license as the Login Security Solution package.
3
  msgid ""
4
  msgstr ""
5
- "Project-Id-Version: Login Security Solution 0.4.0\n"
6
  "Report-Msgid-Bugs-To: http://wordpress.org/tag/login-security-solution\n"
7
- "POT-Creation-Date: 2012-04-17 21:46:55+00:00\n"
8
  "MIME-Version: 1.0\n"
9
  "Content-Type: text/plain; charset=UTF-8\n"
10
  "Content-Transfer-Encoding: 8bit\n"
@@ -12,167 +12,171 @@ msgstr ""
12
  "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
13
  "Language-Team: LANGUAGE <LL@li.org>\n"
14
 
15
- #: login-security-solution.php:431
16
  msgid "Invalid username or password."
17
  msgstr ""
18
 
19
- #: login-security-solution.php:437 tests/LoginErrorsTest.php:117
20
  #: tests/LoginErrorsTest.php:129
21
  msgid "Password reset is not allowed for this user"
22
  msgstr ""
23
 
24
- #: login-security-solution.php:462 tests/LoginMessageTest.php:61
25
  msgid "It has been over %d minutes since your last action."
26
  msgstr ""
27
 
28
- #: login-security-solution.php:463 tests/LoginMessageTest.php:62
29
  msgid "Please log back in."
30
  msgstr ""
31
 
32
- #: login-security-solution.php:466 tests/LoginMessageTest.php:72
33
  msgid "The grace period for changing your password has expired."
34
  msgstr ""
35
 
36
- #: login-security-solution.php:467 tests/LoginMessageTest.php:73
37
  msgid "Please submit this form to reset your password."
38
  msgstr ""
39
 
40
- #: login-security-solution.php:470 tests/LoginMessageTest.php:83
41
  msgid "Your password must be reset."
42
  msgstr ""
43
 
44
- #: login-security-solution.php:471 tests/LoginMessageTest.php:84
45
  msgid "Please submit this form to reset it."
46
  msgstr ""
47
 
48
- #: login-security-solution.php:474 tests/LoginMessageTest.php:94
49
  msgid "Your password has expired. Please log and change it."
50
  msgstr ""
51
 
52
- #: login-security-solution.php:475 tests/LoginMessageTest.php:95
53
  msgid "We provide a %d minute grace period to do so."
54
  msgstr ""
55
 
56
- #: login-security-solution.php:481 tests/LoginMessageTest.php:109
57
- #: tests/LoginMessageTest.php:124
 
 
 
 
58
  msgid "The site is undergoing maintenance."
59
  msgstr ""
60
 
61
- #: login-security-solution.php:482 tests/LoginMessageTest.php:110
62
- #: tests/LoginMessageTest.php:125
63
  msgid "Please try again later."
64
  msgstr ""
65
 
66
- #: login-security-solution.php:541
67
  msgid "Passwords can not be reused."
68
  msgstr ""
69
 
70
- #: login-security-solution.php:686
71
  msgid "ERROR"
72
  msgstr ""
73
 
74
- #: login-security-solution.php:806
75
  msgid "Component Count Value from Current Attempt"
76
  msgstr ""
77
 
78
- #: login-security-solution.php:808
79
  msgid "Network IP %5d %s"
80
  msgstr ""
81
 
82
- #: login-security-solution.php:810
83
  msgid "Username %5d %s"
84
  msgstr ""
85
 
86
- #: login-security-solution.php:812
87
  msgid "Password MD5 %5d %s"
88
  msgstr ""
89
 
90
- #: login-security-solution.php:1593
91
  msgid "Your website, %s, may have been broken in to."
92
  msgstr ""
93
 
94
- #: login-security-solution.php:1596
95
  msgid ""
96
  "Someone just logged in using the following components. Prior to that, some "
97
  "combination of those components were a part of %d failed attempts to log in "
98
  "during the past %d minutes:"
99
  msgstr ""
100
 
101
- #: login-security-solution.php:1601
102
  msgid ""
103
  "The user has been logged out and will be required to confirm their identity "
104
  "via the password reset functionality."
105
  msgstr ""
106
 
107
- #: login-security-solution.php:1630
108
  msgid "Your website, %s, is undergoing a brute force attack."
109
  msgstr ""
110
 
111
- #: login-security-solution.php:1633
112
  msgid ""
113
  "There have been at least %d failed attempts to log in during the past %d "
114
  "minutes that used one or more of the following components:"
115
  msgstr ""
116
 
117
- #: login-security-solution.php:1638
118
  msgid ""
119
  "The %s plugin for WordPress is repelling the attack by making their login "
120
  "failures take a very long time."
121
  msgstr ""
122
 
123
- #: login-security-solution.php:1949
124
  msgid "Password not set."
125
  msgstr ""
126
 
127
- #: login-security-solution.php:1964
128
  msgid "Passwords must be strings."
129
  msgstr ""
130
 
131
- #: login-security-solution.php:1982
132
  msgid "Passwords must use ASCII characters."
133
  msgstr ""
134
 
135
- #: login-security-solution.php:2001
136
  msgid "Password is too short."
137
  msgstr ""
138
 
139
- #: login-security-solution.php:2010
140
  msgid "Passwords must either contain numbers or be %d characters long."
141
  msgstr ""
142
 
143
- #: login-security-solution.php:2019
144
  msgid ""
145
  "Passwords must either contain punctuation marks / symbols or be %d "
146
  "characters long."
147
  msgstr ""
148
 
149
- #: login-security-solution.php:2028
150
  msgid ""
151
  "Passwords must either contain upper-case and lower-case letters or be %d "
152
  "characters long."
153
  msgstr ""
154
 
155
- #: login-security-solution.php:2038
156
  msgid "Passwords can't be sequential keys."
157
  msgstr ""
158
 
159
- #: login-security-solution.php:2047
160
  msgid "Passwords can't have that many sequential characters."
161
  msgstr ""
162
 
163
- #: login-security-solution.php:2063
164
  msgid "Passwords can't contain user data."
165
  msgstr ""
166
 
167
- #: login-security-solution.php:2074
168
  msgid "Passwords can't contain site info."
169
  msgstr ""
170
 
171
- #: login-security-solution.php:2083
172
  msgid "Password is too common."
173
  msgstr ""
174
 
175
- #: login-security-solution.php:2092
176
  msgid "Passwords can't be variations of dictionary words."
177
  msgstr ""
178
 
2
  # This file is distributed under the same license as the Login Security Solution package.
3
  msgid ""
4
  msgstr ""
5
+ "Project-Id-Version: Login Security Solution 0.9.0\n"
6
  "Report-Msgid-Bugs-To: http://wordpress.org/tag/login-security-solution\n"
7
+ "POT-Creation-Date: 2012-06-12 01:40:32+00:00\n"
8
  "MIME-Version: 1.0\n"
9
  "Content-Type: text/plain; charset=UTF-8\n"
10
  "Content-Transfer-Encoding: 8bit\n"
12
  "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
13
  "Language-Team: LANGUAGE <LL@li.org>\n"
14
 
15
+ #: login-security-solution.php:457
16
  msgid "Invalid username or password."
17
  msgstr ""
18
 
19
+ #: login-security-solution.php:463 tests/LoginErrorsTest.php:117
20
  #: tests/LoginErrorsTest.php:129
21
  msgid "Password reset is not allowed for this user"
22
  msgstr ""
23
 
24
+ #: login-security-solution.php:488 tests/LoginMessageTest.php:66
25
  msgid "It has been over %d minutes since your last action."
26
  msgstr ""
27
 
28
+ #: login-security-solution.php:489 tests/LoginMessageTest.php:67
29
  msgid "Please log back in."
30
  msgstr ""
31
 
32
+ #: login-security-solution.php:492 tests/LoginMessageTest.php:77
33
  msgid "The grace period for changing your password has expired."
34
  msgstr ""
35
 
36
+ #: login-security-solution.php:493 tests/LoginMessageTest.php:78
37
  msgid "Please submit this form to reset your password."
38
  msgstr ""
39
 
40
+ #: login-security-solution.php:496 tests/LoginMessageTest.php:88
41
  msgid "Your password must be reset."
42
  msgstr ""
43
 
44
+ #: login-security-solution.php:497 tests/LoginMessageTest.php:89
45
  msgid "Please submit this form to reset it."
46
  msgstr ""
47
 
48
+ #: login-security-solution.php:500 tests/LoginMessageTest.php:104
49
  msgid "Your password has expired. Please log and change it."
50
  msgstr ""
51
 
52
+ #: login-security-solution.php:501 tests/LoginMessageTest.php:105
53
  msgid "We provide a %d minute grace period to do so."
54
  msgstr ""
55
 
56
+ #: login-security-solution.php:504 tests/LoginMessageTest.php:115
57
+ msgid "The password you tried to create is not secure. Please try again."
58
+ msgstr ""
59
+
60
+ #: login-security-solution.php:510 tests/LoginMessageTest.php:129
61
+ #: tests/LoginMessageTest.php:144
62
  msgid "The site is undergoing maintenance."
63
  msgstr ""
64
 
65
+ #: login-security-solution.php:511 tests/LoginMessageTest.php:130
66
+ #: tests/LoginMessageTest.php:145
67
  msgid "Please try again later."
68
  msgstr ""
69
 
70
+ #: login-security-solution.php:578
71
  msgid "Passwords can not be reused."
72
  msgstr ""
73
 
74
+ #: login-security-solution.php:723
75
  msgid "ERROR"
76
  msgstr ""
77
 
78
+ #: login-security-solution.php:843
79
  msgid "Component Count Value from Current Attempt"
80
  msgstr ""
81
 
82
+ #: login-security-solution.php:845
83
  msgid "Network IP %5d %s"
84
  msgstr ""
85
 
86
+ #: login-security-solution.php:847
87
  msgid "Username %5d %s"
88
  msgstr ""
89
 
90
+ #: login-security-solution.php:849
91
  msgid "Password MD5 %5d %s"
92
  msgstr ""
93
 
94
+ #: login-security-solution.php:1630
95
  msgid "Your website, %s, may have been broken in to."
96
  msgstr ""
97
 
98
+ #: login-security-solution.php:1633
99
  msgid ""
100
  "Someone just logged in using the following components. Prior to that, some "
101
  "combination of those components were a part of %d failed attempts to log in "
102
  "during the past %d minutes:"
103
  msgstr ""
104
 
105
+ #: login-security-solution.php:1638
106
  msgid ""
107
  "The user has been logged out and will be required to confirm their identity "
108
  "via the password reset functionality."
109
  msgstr ""
110
 
111
+ #: login-security-solution.php:1667
112
  msgid "Your website, %s, is undergoing a brute force attack."
113
  msgstr ""
114
 
115
+ #: login-security-solution.php:1670
116
  msgid ""
117
  "There have been at least %d failed attempts to log in during the past %d "
118
  "minutes that used one or more of the following components:"
119
  msgstr ""
120
 
121
+ #: login-security-solution.php:1675
122
  msgid ""
123
  "The %s plugin for WordPress is repelling the attack by making their login "
124
  "failures take a very long time."
125
  msgstr ""
126
 
127
+ #: login-security-solution.php:1997
128
  msgid "Password not set."
129
  msgstr ""
130
 
131
+ #: login-security-solution.php:2012
132
  msgid "Passwords must be strings."
133
  msgstr ""
134
 
135
+ #: login-security-solution.php:2030
136
  msgid "Passwords must use ASCII characters."
137
  msgstr ""
138
 
139
+ #: login-security-solution.php:2049
140
  msgid "Password is too short."
141
  msgstr ""
142
 
143
+ #: login-security-solution.php:2058
144
  msgid "Passwords must either contain numbers or be %d characters long."
145
  msgstr ""
146
 
147
+ #: login-security-solution.php:2067
148
  msgid ""
149
  "Passwords must either contain punctuation marks / symbols or be %d "
150
  "characters long."
151
  msgstr ""
152
 
153
+ #: login-security-solution.php:2076
154
  msgid ""
155
  "Passwords must either contain upper-case and lower-case letters or be %d "
156
  "characters long."
157
  msgstr ""
158
 
159
+ #: login-security-solution.php:2086
160
  msgid "Passwords can't be sequential keys."
161
  msgstr ""
162
 
163
+ #: login-security-solution.php:2095
164
  msgid "Passwords can't have that many sequential characters."
165
  msgstr ""
166
 
167
+ #: login-security-solution.php:2111
168
  msgid "Passwords can't contain user data."
169
  msgstr ""
170
 
171
+ #: login-security-solution.php:2122
172
  msgid "Passwords can't contain site info."
173
  msgstr ""
174
 
175
+ #: login-security-solution.php:2131
176
  msgid "Password is too common."
177
  msgstr ""
178
 
179
+ #: login-security-solution.php:2140
180
  msgid "Passwords can't be variations of dictionary words."
181
  msgstr ""
182
 
login-security-solution.php CHANGED
@@ -6,7 +6,7 @@
6
  * Description: Requires very strong passwords, repels brute force login attacks, prevents login information disclosures, expires idle sessions, notifies admins of attacks and breaches, permits administrators to disable logins for maintenance or emergency reasons and reset all passwords.
7
  *
8
  * Plugin URI: http://wordpress.org/extend/plugins/login-security-solution/
9
- * Version: 0.8.0
10
  * Author: Daniel Convissor
11
  * Author URI: http://www.analysisandsolutions.com/
12
  * License: GPLv2
@@ -501,8 +501,7 @@ class login_security_solution {
501
  $ours .= ' ' . sprintf(__('We provide a %d minute grace period to do so.', self::ID), $this->options['pw_change_grace_period_minutes']);
502
  break;
503
  case 'pw_reset_bad':
504
- $ours = __('The password you just created is not secure so must be changed. Use it now to log in then go to your profile page and create a new password.', self::ID);
505
- $ours .= ' ' . sprintf(__('We provide a %d minute grace period to do so.', self::ID), $this->options['pw_change_grace_period_minutes']);
506
  break;
507
  }
508
  }
@@ -540,10 +539,8 @@ class login_security_solution {
540
 
541
  $user->user_pass = $user_pass;
542
  if (!$this->validate_pw($user)) {
543
- $this->process_pw_metadata($user->ID, $user_pass);
544
  $this->set_pw_force_change($user->ID);
545
- $this->set_pw_grace_period($user->ID);
546
- $this->redirect_to_login('pw_reset_bad');
547
  return -1;
548
  }
549
 
@@ -1775,7 +1772,7 @@ class login_security_solution {
1775
  * @param string $login_msg_id the ID representing the message to
1776
  * display above the login form
1777
  * @param bool $use_rt use WP's "redirect_to" on successful login?
1778
- * @param bool $action "login" (default) or "retrievepassword"
1779
  * @return void
1780
  *
1781
  * @uses login_security_solution::$key_login_msg to know which $_GET
@@ -1803,6 +1800,11 @@ class login_security_solution {
1803
  }
1804
  $uri .= 'action=' . urlencode($action);
1805
 
 
 
 
 
 
1806
  if ($login_msg_id) {
1807
  $uri .= '&' . urlencode($this->key_login_msg) . '='
1808
  . urlencode($login_msg_id);
6
  * Description: Requires very strong passwords, repels brute force login attacks, prevents login information disclosures, expires idle sessions, notifies admins of attacks and breaches, permits administrators to disable logins for maintenance or emergency reasons and reset all passwords.
7
  *
8
  * Plugin URI: http://wordpress.org/extend/plugins/login-security-solution/
9
+ * Version: 0.9.0
10
  * Author: Daniel Convissor
11
  * Author URI: http://www.analysisandsolutions.com/
12
  * License: GPLv2
501
  $ours .= ' ' . sprintf(__('We provide a %d minute grace period to do so.', self::ID), $this->options['pw_change_grace_period_minutes']);
502
  break;
503
  case 'pw_reset_bad':
504
+ $ours = __('The password you tried to create is not secure. Please try again.', self::ID);
 
505
  break;
506
  }
507
  }
539
 
540
  $user->user_pass = $user_pass;
541
  if (!$this->validate_pw($user)) {
 
542
  $this->set_pw_force_change($user->ID);
543
+ $this->redirect_to_login('pw_reset_bad', false, 'rp');
 
544
  return -1;
545
  }
546
 
1772
  * @param string $login_msg_id the ID representing the message to
1773
  * display above the login form
1774
  * @param bool $use_rt use WP's "redirect_to" on successful login?
1775
+ * @param bool $action "login" (default), "rp", or "retrievepassword"
1776
  * @return void
1777
  *
1778
  * @uses login_security_solution::$key_login_msg to know which $_GET
1800
  }
1801
  $uri .= 'action=' . urlencode($action);
1802
 
1803
+ if ($action == 'rp') {
1804
+ $uri .= '&key=' . urlencode(@$_GET['key']);
1805
+ $uri .= '&login=' . urlencode(@$_GET['login']);
1806
+ }
1807
+
1808
  if ($login_msg_id) {
1809
  $uri .= '&' . urlencode($this->key_login_msg) . '='
1810
  . urlencode($login_msg_id);
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: convissor
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=danielc%40analysisandsolutions%2ecom&lc=US&item_name=Donate%3a%20Login%20Security%20Solution&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted
4
  Tags: login, password, idle, timeout, maintenance, security, attack, hack, lock, ban
5
  Requires at least: 3.3
6
- Tested up to: 3.4beta2
7
- Stable tag: 0.8.0
8
 
9
  Security against brute force attacks by tracking IP, name, password;
10
  requiring very strong passwords. Idle timeout. Maintenance mode. Multisite
@@ -13,14 +13,16 @@ ready!
13
 
14
  == Description ==
15
 
16
- Locks down login security for multisite and regular WordPress installations.
 
17
 
18
  * Blocks brute force and dictionary attacks without inconveniencing
19
  legitimate users or administrators
20
  + Tracks IP addresses, usernames, and passwords
21
  + If a login failure uses data matching a past failure, the plugin
22
  slows down response times. The more failures, the longer the delay.
23
- This encourages attackers to give up and go find an easier target.
 
24
  + If an account seems breached, the "user" is immediately logged out
25
  and forced to use WordPress' password reset utility. This prevents
26
  any damage from being done and verifies the user's identity. All
@@ -102,7 +104,8 @@ that pushes malware into your readers' browsers.
102
  So if your site does get cracked, not only do you waste hours cleaning up,
103
  your reputation gets sullied, security software flags your site as dangerous,
104
  and worst of all, you've inadvertently helped infect the computers of your
105
- clients and friends.
 
106
 
107
 
108
  == Installation ==
@@ -255,6 +258,14 @@ then `cd` into that directory and run:
255
 
256
  == Changelog ==
257
 
 
 
 
 
 
 
 
 
258
  = 0.8.0 =
259
  * Fix logging user out a second time after WordPress expires cookies.
260
  * It turns out this plugin requires WordPress 3.3, not 3.0.
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=danielc%40analysisandsolutions%2ecom&lc=US&item_name=Donate%3a%20Login%20Security%20Solution&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted
4
  Tags: login, password, idle, timeout, maintenance, security, attack, hack, lock, ban
5
  Requires at least: 3.3
6
+ Tested up to: 3.4RC3
7
+ Stable tag: 0.9.0
8
 
9
  Security against brute force attacks by tracking IP, name, password;
10
  requiring very strong passwords. Idle timeout. Maintenance mode. Multisite
13
 
14
  == Description ==
15
 
16
+ A simple way to lock down login security for multisite and regular
17
+ WordPress installations.
18
 
19
  * Blocks brute force and dictionary attacks without inconveniencing
20
  legitimate users or administrators
21
  + Tracks IP addresses, usernames, and passwords
22
  + If a login failure uses data matching a past failure, the plugin
23
  slows down response times. The more failures, the longer the delay.
24
+ This limits attackers ability to effectively probe your site,
25
+ so they'll give up and go find an easier target.
26
  + If an account seems breached, the "user" is immediately logged out
27
  and forced to use WordPress' password reset utility. This prevents
28
  any damage from being done and verifies the user's identity. All
104
  So if your site does get cracked, not only do you waste hours cleaning up,
105
  your reputation gets sullied, security software flags your site as dangerous,
106
  and worst of all, you've inadvertently helped infect the computers of your
107
+ clients and friends. Oh, and that malware has possibly gotten itself
108
+ into the browser/computer you use for administering your website.
109
 
110
 
111
  == Installation ==
258
 
259
  == Changelog ==
260
 
261
+ = 0.9.0 =
262
+ * Fix change that prevented users from logging in after using the password
263
+ reset process with an insecure password. Users can now pick a better
264
+ password right on the spot.
265
+ * Regenerate translation POT file.
266
+ * Tested under WordPress 3.3.2 and 3.4RC3, both using regular and multisite.
267
+ * Unit tests pass using PHP 5.4.0RC8-dev, 5.3.11-dev, and 5.2.18-dev.
268
+
269
  = 0.8.0 =
270
  * Fix logging user out a second time after WordPress expires cookies.
271
  * It turns out this plugin requires WordPress 3.3, not 3.0.
tests/LoginFailTest.php CHANGED
@@ -37,6 +37,10 @@ class LoginFailTest extends TestCase {
37
  public function setUp() {
38
  parent::setUp();
39
 
 
 
 
 
40
  $this->ip = '1.2.3.4';
41
  $_SERVER['REMOTE_ADDR'] = $this->ip;
42
  $this->network_ip = '1.2.3';
37
  public function setUp() {
38
  parent::setUp();
39
 
40
+ if (!$this->is_fail_table_configured()) {
41
+ $this->markTestSkipped("The " . self::$lss->table_fail . " table doesn't exist or isn't using the InnoDB engine. Probably the plugin hasn't been activated.");
42
+ }
43
+
44
  $this->ip = '1.2.3.4';
45
  $_SERVER['REMOTE_ADDR'] = $this->ip;
46
  $this->network_ip = '1.2.3';
tests/LoginMessageTest.php CHANGED
@@ -112,13 +112,7 @@ class LoginMessageTest extends TestCase {
112
  public function test_login_message__pw_reset_bad() {
113
  $_GET[self::$lss->key_login_msg] = 'pw_reset_bad';
114
 
115
- $value = 8;
116
- $options = self::$lss->options;
117
- $options['pw_change_grace_period_minutes'] = $value;
118
- self::$lss->options = $options;
119
-
120
- $ours = __('The password you just created is not secure so must be changed. Use it now to log in then go to your profile page and create a new password.', self::ID);
121
- $ours .= ' ' . sprintf(__('We provide a %d minute grace period to do so.', self::ID), $value);
122
 
123
  $actual = self::$lss->login_message('input');
124
  $this->assertEquals('input' . $this->ours($ours), $actual,
112
  public function test_login_message__pw_reset_bad() {
113
  $_GET[self::$lss->key_login_msg] = 'pw_reset_bad';
114
 
115
+ $ours = __('The password you tried to create is not secure. Please try again.', self::ID);
 
 
 
 
 
 
116
 
117
  $actual = self::$lss->login_message('input');
118
  $this->assertEquals('input' . $this->ours($ours), $actual,
tests/PasswordChangeTest.php CHANGED
@@ -202,24 +202,21 @@ class PasswordChangeTest extends TestCase {
202
  global $wpdb;
203
 
204
  $bad_pw = 'too simple';
 
 
205
 
206
  $expected_error = 'Cannot modify header information';
207
  $this->expected_errors($expected_error);
208
  self::$location_expected = get_option('siteurl')
209
- . '/wp-login.php?action=login&'
210
  . self::$lss->key_login_msg . '=pw_reset_bad';
211
 
212
  $actual = self::$lss->password_reset($this->user, $bad_pw);
213
  $this->assertEquals(-1, $actual, 'password_reset() return.');
214
 
215
  // Check the outcome.
216
- $actual = self::$lss->get_pw_changed_time($this->user->ID);
217
- $this->assertGreaterThan(0, $actual, 'Changed time should be > 0.');
218
-
219
- $actual = self::$lss->is_pw_reused($bad_pw, $this->user->ID);
220
- $this->assertTrue($actual, 'Password should show up as reused');
221
-
222
- $this->ensure_grace_and_force_are_populated();
223
 
224
  $wpdb->query('ROLLBACK TO empty');
225
 
202
  global $wpdb;
203
 
204
  $bad_pw = 'too simple';
205
+ $_GET['key'] = 'jk';
206
+ $_GET['login'] = 'ab';
207
 
208
  $expected_error = 'Cannot modify header information';
209
  $this->expected_errors($expected_error);
210
  self::$location_expected = get_option('siteurl')
211
+ . '/wp-login.php?action=rp&key=jk&login=ab&'
212
  . self::$lss->key_login_msg . '=pw_reset_bad';
213
 
214
  $actual = self::$lss->password_reset($this->user, $bad_pw);
215
  $this->assertEquals(-1, $actual, 'password_reset() return.');
216
 
217
  // Check the outcome.
218
+ $actual = self::$lss->get_pw_force_change($this->user->ID);
219
+ $this->assertTrue($actual, 'Force change should not be cleared.');
 
 
 
 
 
220
 
221
  $wpdb->query('ROLLBACK TO empty');
222
 
tests/TestCase.php CHANGED
@@ -258,14 +258,10 @@ abstract class TestCase extends PHPUnit_Framework_TestCase {
258
 
259
  $opt = $wpdb->get_row("SHOW CREATE TABLE `$wpdb->options`", ARRAY_N);
260
  $usr = $wpdb->get_row("SHOW CREATE TABLE `$wpdb->usermeta`", ARRAY_N);
261
- $fail = $wpdb->get_row("SHOW CREATE TABLE `"
262
- . self::$lss->table_fail . "`", ARRAY_N);
263
 
264
  return (
265
  strpos($opt[1], 'ENGINE=InnoDB')
266
  && strpos($usr[1], 'ENGINE=InnoDB')
267
- && !empty($fail)
268
- && strpos($fail[1], 'ENGINE=InnoDB')
269
  );
270
  }
271
 
@@ -311,6 +307,22 @@ abstract class TestCase extends PHPUnit_Framework_TestCase {
311
  set_error_handler(array(&$this, 'expected_errors_handler'));
312
  }
313
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
314
  /**
315
  * @see TestCase::expected_errors()
316
  */
258
 
259
  $opt = $wpdb->get_row("SHOW CREATE TABLE `$wpdb->options`", ARRAY_N);
260
  $usr = $wpdb->get_row("SHOW CREATE TABLE `$wpdb->usermeta`", ARRAY_N);
 
 
261
 
262
  return (
263
  strpos($opt[1], 'ENGINE=InnoDB')
264
  && strpos($usr[1], 'ENGINE=InnoDB')
 
 
265
  );
266
  }
267
 
307
  set_error_handler(array(&$this, 'expected_errors_handler'));
308
  }
309
 
310
+ /**
311
+ * Determines if the fail tabe exists and uses InnoDB
312
+ * @return bool
313
+ */
314
+ protected static function is_fail_table_configured() {
315
+ global $wpdb;
316
+
317
+ $fail = $wpdb->get_row("SHOW CREATE TABLE `"
318
+ . self::$lss->table_fail . "`", ARRAY_N);
319
+
320
+ return (
321
+ !empty($fail)
322
+ && strpos($fail[1], 'ENGINE=InnoDB')
323
+ );
324
+ }
325
+
326
  /**
327
  * @see TestCase::expected_errors()
328
  */