Changelog do Wordfence

Correção

• PHP 8.6 compatibility fixes
• Better validation of cached real-time IP blocklist data
• Improved WAF compatibility with hosts that disable ini_set
• Improved WAF handling of nested request arrays
• The scan activity log now uses the site's timezone and displays the UTC offset
• Improved handling of canceled requests to avoid unnecessary errors and stuck controls
• Fixed the layout and dismissal of the satisfaction survey notice
• Corrected Live Traffic descriptions for requests without a referrer
• Prevented passkey availability checks from causing errors when database setup is incomplete or broken

Correção

• Compatibility fixes for WordPress 6.8

Correção

• Normalized all wordfence.com links to be https
• Fixed a rare error that could occur on the diagnostics page when displaying a list of error logs
• Removed the "back to top" button and related script block from emailed diagnostics
• Fixed some UI coloring that did not correctly reflect the license type in use

Correção

• Addressed an error with mail hooks and the audit log when third party plugins send unexpected value types

Correção

• Improved audit log compatibility with some plugins that would cause excessive noise due to their behaviors around setting up user roles and capabilities
• Fixed a log notice that could occur when deactivating Wordfence with audit log events still pending and a broken Wordfence Central link

Correção

• Added translation support for "Page not found" string when viewing recent traffic

Correção

• Fixed an issue where multisite installations using the WAF mysqli storage engine could repeatedly attempt to update WAF rules when not in optimized mode
• Fixed the last captcha column in the users page so it no longer displays "(not required)" on 2FA users since that no longer applies
• Added a check in wflogs/rules.php to only run when within the WAF's bootstrap stage when hosted behind nginx

Correção

• Revised the behavior of the reCAPTCHA verification to use the documented expiration period of the token and response to avoid sending verification requests too frequently, which could artificially lower scores in some circumstances
• Addressed PHP 8 deprecation notices in the file differ used by file changed scan results
• Reduced the frequency of Wordfence Central status update callbacks in sections of the scan that occur quickly in sequence

Correção

• Addressed a potential PHP 8 notice in the human/bot detection AJAX call
• Addressed a potential PHP 8 notice when requesting a lockout unlock verification email
• Fixed the emailed diagnostics view not showing the missing table information when applicable
• Improved quick scan logic to base timing on regular scans so they're more evenly distributed

Correção

• Fixed an issue with sites containing invalid Wordfence Central site data where they could throw an error when viewing Wordfence pages

Correção

• Added detection for a site being linked to a non-matching Wordfence Central record (e.g., when cloning the database to a staging site)
• Streamlined the license and terms of use installation flow to avoid unnecessary prompting
• Fixed an issue where user profiles with a selected locale different from the site itself could end up loading the site's locale instead

Correção

• Fixed an issue where a login lockout on a WooCommerce login form could fail silently
• The scan result for abandoned plugins no longer states it has been removed from wordpress.org if it is still listed
• Addressed an exception parsing date information in non-repo plugins that have a bad last_updated value
• The URL scanner no longer generates a log warning when matching a potential URL fragment that ends up not being a valid URL

Correção

• Removed uses of SQL_CALC_FOUND_ROWS, which is deprecated as of MySQL 8.0.17
• Fixed an issue where final scan summary counts in some instances were not sent to Central
• Fixed a deprecation notice for get_class in PHP 8.3.0
• Corrected an output error in the connectivity section of Diagnostics in text mode

Correção

• Compatibility fix for WordPress 6.4 on the login page styling

Correção

• Addressed an issue with multisite installations when the wp_options tables had different encodings/collations

Correção

• Added handling for the pending WordPress 6.4 change that removes $wpdb->use_mysqli
• The WAF MySQLi storage engine will now work correctly when either DB_COLLATE or DB_CHARSET are not defined
• Added additional error handling to Central calls to better handle request failures or conflicts
• Addressed a warning that would occur if a non-repo plugin update hook did not provide a last updated date
• Fixed an error in PHP 8 that could occur if the time correction offset was not numeric
• 2FA AJAX calls now use an absolute path rather than a full URL to avoid CORS issues on sites that do not canonicalize www and non-www requests
• Addressed a race condition where multiple concurrent hits on multisite could trigger overlapping role sync tasks
• Improved performance when viewing the user list on large multisites
• Fixed a UI bug where an invalid code on 2FA activation would leave the activate button disabled
• Reverted a change on error modals to bring back the additional close button for better accessibility

Correção

• Suppress PHP notices related to rule loading when running WP-CLI
• Fixed an issue with the scan monitor cron that could leave it running unnecessarily

Correção

• Added missing text domain to translation function call
• Corrected inconsistent styling of switch controls

Correção

• Prevented bundled sodium_compat library from conflicting with versions included with older WordPress versions

Correção

• Prevented deprecation warning caused by dynamic property creation
• Added translation support for additional strings

Correção

• Corrected IPv6 address expansion
• Ensured long request payloads for malicious requests are recorded in live traffic
• Prevented "commands out of sync" database error messages when the database connection has failed
• Prevented rare JSON encoding issues from breaking free license registration
• Prevented PHP notice from being logged when request parameter is missing
• Prevented deprecation warning in PHP 8.1

Correção

• Corrected error caused by method call on null in WAF

Correção

• Fixed an error on PHP 8 that could occur when checking for plugin updates and another plugin has a broken hook
• Added a check for disabled functions when generating support diagnostics to avoid an error on PHP 8
• Prevent double-clicking when activating 2FA to avoid an "already set up" error

Correção

• Adjusted style inclusion and usage to prevent missing icons
• Avoided using the ctype extension as it may not be enabled
• Prevented fatal errors caused by malformed Central keys

Correção

• Ensured Captcha and 2FA scripts load on WooCommerce when activated on a sub-site in multisite
• Prevented reCAPTCHA logo from being obscured by some themes
• Enabled wfls_registration_blocked_message filter support for WooCommerce integration

Correção

• Releasing same changes as 7.8.1, due to wordpress.org error