Beta to master to update to 2.190

changelog.txt

@@ -1,5 +1,17 @@
 == Changelog ==
 
+= 2.190 Oct 09 2026 =
+* New. Security. Lost-password interface is under rate limit. (#755)
+* Upd. BFP. Lost password interface protected. (#743)
+* Upd. Scan. Switch to react scan accordions. (#756)
+* Fix. Scanner. Cure. Fixed stub gluing.
+* Fix. Code. Added the wp-element dependency
+* Upd. Scan. Improve file system analysis. (#744)
+* New. Plugins page. Show changelog in the update notice. https://app.doboard.com/1/task/46119
+* Fix. Scanner. Cloud Analysis. Prevent infinite status polling. https://app.doboard.com/1/task/55892
+* Fix. FW. Blocking the launch of parallel updates with Direct Upd https://app.doboard.com/1/task/58028
+* Fix. HeuristicAnalyser. Remove is_callable check
+
 = 2.189 Sep 25 2026 =
 * Fix. Code. Re-minify JS.
 * Fix. UI. Plugin tabs wrap to fit the screen. (#746)

css/src/spbc-settings.css

@@ -95,6 +95,8 @@
 	left: 0;
 	top: 0;
 	text-align: center;
+	z-index: 1;
+	pointer-events: none;
 }
 	.spbc_progressbar_counter span{
 		vertical-align: sub;

inc/fw-update.php

@@ -30,6 +30,11 @@ function spbc_security_firewall_update__init($delay = null)
 
     sleep((int)$delay);
 
+    // A direct update lives longer than the cron task lock, so it has to be checked before anything is wiped
+    if ( spbc_security_firewall_update_direct_lock__is_active() ) {
+        return true;
+    }
+
     $spbc->update_logger::clearStorage();
     $spbc->update_logger->writeLog('UPDATE INIT START');
 
@@ -584,7 +589,8 @@ static function ($hash) {
         SPBC_TBL_FIREWALL_DATA . '_temp', // Write to the main table for daughter blogs
         SPBC_TBL_FIREWALL_DATA__IPS . '_temp',
         SPBC_TBL_FIREWALL_DATA__COUNTRIES . '_temp',
-        $path
+        $path,
+        $current_file_content
     );
 
     $single_file_result = empty($result['error'])
@@ -844,13 +850,67 @@ function spbc_security_firewall_update__checker()
     return true;
 }
 
+/**
+ * Heartbeat option name of a running direct Security FireWall update.
+ */
+if ( ! defined('SPBC_SECFW_DIRECT_UPDATE_LOCK_OPTION') ) {
+    define('SPBC_SECFW_DIRECT_UPDATE_LOCK_OPTION', 'spbc_secfw_direct_update_lock');
+}
+
+/**
+ * Seconds without a heartbeat after which a direct update is considered dead.
+ */
+if ( ! defined('SPBC_SECFW_DIRECT_UPDATE_LOCK_TTL') ) {
+    define('SPBC_SECFW_DIRECT_UPDATE_LOCK_TTL', 120);
+}
+
+/**
+ * @return bool
+ */
+function spbc_security_firewall_update_direct_lock__is_active()
+{
+    $heartbeat = (int)get_option(SPBC_SECFW_DIRECT_UPDATE_LOCK_OPTION, 0);
+
+    return $heartbeat > 0 && time() - $heartbeat < SPBC_SECFW_DIRECT_UPDATE_LOCK_TTL;
+}
+
+function spbc_security_firewall_update_direct_lock__touch()
+{
+    update_option(SPBC_SECFW_DIRECT_UPDATE_LOCK_OPTION, time(), false);
+}
+
+function spbc_security_firewall_update_direct_lock__release()
+{
+    update_option(SPBC_SECFW_DIRECT_UPDATE_LOCK_OPTION, 0, false);
+}
+
 /**
  * Update security firewall in single thread
  *
  * @return bool|string[]|array[]
  * @throws Exception
  */
 function spbc_security_firewall_update_direct()
+{
+    spbc_security_firewall_update_direct_lock__touch();
+
+    try {
+        $result = spbc_security_firewall_update_direct__run();
+    } catch ( Exception $e ) {
+        spbc_security_firewall_update_direct_lock__release();
+        throw $e;
+    }
+
+    spbc_security_firewall_update_direct_lock__release();
+
+    return $result;
+}
+
+/**
+ * @return bool|string[]|array[]
+ * @throws Exception
+ */
+function spbc_security_firewall_update_direct__run()
 {
     global $spbc;
 
@@ -873,6 +933,7 @@ function spbc_security_firewall_update_direct()
 
     // process_file
     foreach ( $urls as $url ) {
+        spbc_security_firewall_update_direct_lock__touch();
         $result_process_file = spbc_security_firewall_update__process_file($url, true);
         if ( ! empty($result_process_file['error']) ) {
             $spbc->update_logger->writeLog('DIRECT UPDATE ERROR: processing file: ' . @json_encode($result_process_file['error']));

inc/spbc-admin.php

@@ -27,6 +27,7 @@
 use CleantalkSP\SpbctWP\UsersPassCheckModule\UsersPassCheckHandler;
 use CleantalkSP\SpbctWP\Scanner\ScannerAjaxEndpoints;
 use CleantalkSP\SpbctWP\Scanner\ScannerActions\BackupsActions;
+use CleantalkSP\SpbctWP\UpdateChangelogNotice;
 
 // Prevent direct call
 if ( ! defined('ABSPATH') ) {
@@ -98,6 +99,8 @@ function spbc_admin_init()
     add_action('wp_ajax_spbc_scanner__pause', 'spbc_scanner__pause');
     add_action('wp_ajax_spbc_scanner__resume', 'spbc_scanner__resume');
     add_action('wp_ajax_spbc_scanner__getScannerStatus', 'spbc_scanner__getScannerStatus');
+    add_action('wp_ajax_spbc_scanner__ackRuntimeError', 'spbc_scanner__ackRuntimeError');
+    add_action('wp_ajax_spbc_scanner__debug_log', 'spbc_scanner__debug_log');
     add_action('wp_ajax_spbc_scanner__last_scan_info', array(ScannerAjaxEndpoints::class, 'getLastScanInfo'));
 
     // Scanner buttons
@@ -115,6 +118,7 @@ function spbc_admin_init()
     // Settings
     add_action('wp_ajax_spbc_settings__draw_elements', 'spbc_settings__draw_elements');
     add_action('wp_ajax_spbc_scanner_tab__reload_accordion', 'spbc_field_scanner__show_accordion');
+    add_action('wp_ajax_spbc_scanner__get_accordions', 'spbc_scanner__get_accordions');
 
     // Tabs requests handlers (React)
     add_action('wp_ajax_spbct_get_tab_data', 'spbct_get_tab_data');
@@ -300,6 +304,8 @@ function spbc_plugin_action_links($links)
     return $links;
 }
 
+UpdateChangelogNotice::register();
+
 add_action('after_plugin_row', 'spbc_plugin_list_show_vulnerability', 20, 3);
 function spbc_plugin_list_show_vulnerability($plugin_file, $plugin_data, $_status)
 {
@@ -762,10 +768,11 @@ function spbc_get_secure_cookies()
 {
     $secure_cookies = array();
 
-    if (Cookie::getString('spbc_cookies_test')) {
-        $cookie_test = Cookie::getString('spbc_cookies_test');
+    if (Cookie::get('spbc_cookies_test')) {
+        // Cookie::get() JSON-decodes the value, so getString() would return ''.
+        $cookie_test = Cookie::getArray('spbc_cookies_test');
 
-        if (!is_array($cookie_test)) {
+        if (empty($cookie_test['cookies_names']) || !is_array($cookie_test['cookies_names']) || !isset($cookie_test['check_value'])) {
             throw new Exception('SPBC: Secure cookies does not get (there are not cookies).');
         }
 

inc/spbc-auth.php

@@ -22,7 +22,8 @@
     die('Not allowed!');
 }
 
-add_filter('authenticate', 'spbc_authenticate', 20, 2); // Hooks for authentificate
+add_filter('authenticate', 'spbc_authenticate', 20, 2); // Hooks for authenticate
+add_action('lostpassword_post', 'spbc_lostpassword_rate_limit', 20, 2); // Hooks for lost password request checking
 
 // Hook for token-based logins (plugins like "Temporary Login Without Password")
 add_action('set_logged_in_cookie', 'spbc_detect_token_login', 10, 6);
@@ -266,6 +267,30 @@ function spbc_authenticate($user, $username)
     return $user;
 }
 
+function spbc_lostpassword_rate_limit($error)
+{
+    global $spbc;
+    $limit = !empty($spbc->settings['bfp__allowed_wrong_auths'])
+            ? (int) $spbc->settings['bfp__allowed_wrong_auths']
+            : 5;
+    $period = !empty($spbc->settings['bfp__block_period__5_fails'])
+        ? (int) $spbc->settings['bfp__block_period__5_fails']
+        : 3600;
+    $config = new RateLimiterConfig('lostpassword_rate_limit', $limit, $period);
+    $rate_limiter = new SpbcRateLimiter($config);
+    $rate_limiter_check = $rate_limiter->checkPassed();
+    if ( ! $rate_limiter_check ) {
+        $limit_message = esc_html__('Current route access denied. (Security by CleanTalk)', 'security-malware-firewall');
+        add_filter('lostpassword_errors', function ($_errors, $_user) use ($limit_message) {
+            return new WP_Error(403, $limit_message);
+        }, 20, 2);
+        if (function_exists('wc_add_notice')) {
+            wp_die($limit_message, '', ['response' => 403]);
+        }
+    }
+    return $error;
+}
+
 /**
  * Detecting new device
  *