PHPSTAN: validate against version 3,4 & 5

class-two-factor-compat.php

@@ -58,6 +58,12 @@ public function jetpack_rememberme( $rememberme ) {
 	 * @return boolean
 	 */
 	public function jetpack_is_sso_active() {
-		return ( class_exists( 'Jetpack' ) && method_exists( 'Jetpack', 'is_module_active' ) && Jetpack::is_module_active( 'sso' ) );
+		if ( ! class_exists( 'Jetpack' ) ) {
+			return false;
+		}
+
+		$jetpack_is_module_active = array( 'Jetpack', 'is_module_active' );
+
+		return is_callable( $jetpack_is_module_active ) && (bool) call_user_func( $jetpack_is_module_active, 'sso' );
 	}
 }

class-two-factor-core.php

@@ -244,7 +244,7 @@ public static function uninstall() {
 		}
 
 		foreach ( $user_meta_keys as $meta_key ) {
-			delete_metadata( 'user', null, $meta_key, null, true );
+			delete_metadata( 'user', 0, $meta_key, '', true );
 		}
 	}
 
@@ -1152,14 +1152,14 @@ public static function login_html( $user, $login_nonce, $redirect_to, $error_msg
 
 		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off">
 				<input type="hidden" name="provider"      id="provider"      value="<?php echo esc_attr( $provider_key ); ?>" />
-				<input type="hidden" name="wp-auth-id"    id="wp-auth-id"    value="<?php echo esc_attr( $user->ID ); ?>" />
+				<input type="hidden" name="wp-auth-id"    id="wp-auth-id"    value="<?php echo esc_attr( (string) $user->ID ); ?>" />
 				<input type="hidden" name="wp-auth-nonce" id="wp-auth-nonce" value="<?php echo esc_attr( $login_nonce ); ?>" />
 				<?php if ( $interim_login ) { ?>
 					<input type="hidden" name="interim-login" value="1" />
 				<?php } else { ?>
 					<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
 				<?php } ?>
-				<input type="hidden" name="rememberme"    id="rememberme"    value="<?php echo esc_attr( $rememberme ); ?>" />
+				<input type="hidden" name="rememberme"    id="rememberme"    value="<?php echo esc_attr( (string) $rememberme ); ?>" />
 
 				<?php $provider->authentication_page( $user ); ?>
 		</form>

phpstan.dist.neon

@@ -1,7 +1,7 @@
 includes:
 	- vendor/szepeviktor/phpstan-wordpress/extension.neon
 parameters:
-	level: 2
+	level: 5
 	paths:
 		- includes
 		- providers

providers/class-two-factor-backup-codes.php

@@ -441,7 +441,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Recovery Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" data-digits="<?php echo esc_attr( $code_length ); ?>" />
+			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" data-digits="<?php echo esc_attr( (string) $code_length ); ?>" />
 		</p>
 		<?php
 		/**
@@ -484,7 +484,7 @@ public function validate_authentication( $user ) {
 	 * @since 0.1-dev
 	 *
 	 * @param WP_User $user WP_User object of the logged-in user.
-	 * @param int     $code The backup code.
+	 * @param string  $code The backup code.
 	 * @return boolean
 	 */
 	public function validate_code( $user, $code ) {

providers/class-two-factor-email.php

@@ -364,7 +364,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Verification Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="two-factor-email-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" autocomplete="one-time-code" placeholder="<?php echo esc_attr( $token_placeholder ); ?>" data-digits="<?php echo esc_attr( $token_length ); ?>" />
+			<input type="text" inputmode="numeric" name="two-factor-email-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" autocomplete="one-time-code" placeholder="<?php echo esc_attr( $token_placeholder ); ?>" data-digits="<?php echo esc_attr( (string) $token_length ); ?>" />
 		</p>
 		<?php
 		/** This action is documented in providers/class-two-factor-backup-codes.php */

providers/class-two-factor-totp.php

@@ -532,7 +532,7 @@ public function validate_authentication( $user ) {
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user WP_User object of the logged-in user.
-	 * @param int     $code The TOTP token to validate.
+	 * @param string  $code The TOTP token to validate.
 	 *
 	 * @return bool Whether the code is valid for the user and a newer code has not been used.
 	 */
@@ -643,7 +643,7 @@ public static function get_authcode_valid_ticktime( $key, $authcode, $hash = sel
 	 */
 	public static function generate_key( $bitsize = self::DEFAULT_KEY_BIT_SIZE ) {
 		$bytes  = ceil( $bitsize / 8 );
-		$secret = wp_generate_password( $bytes, true, true );
+		$secret = wp_generate_password( (int) $bytes, true, true );
 
 		return self::base32_encode( $secret );
 	}
@@ -745,7 +745,7 @@ public static function calc_totp( $key, $step_count = false, $digits = self::DEF
 				( ord( $hash[ $offset + 3 ] ) & 0xff )
 			) % pow( 10, $digits );
 
-		return str_pad( $code, $digits, '0', STR_PAD_LEFT );
+		return str_pad( (string) $code, $digits, '0', STR_PAD_LEFT );
 	}
 
 	/**
@@ -789,7 +789,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Authentication Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( self::DEFAULT_DIGIT_COUNT ); ?>" />
+			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( (string) self::DEFAULT_DIGIT_COUNT ); ?>" />
 		</p>
 		<?php
 		/** This action is documented in providers/class-two-factor-backup-codes.php */
@@ -818,7 +818,7 @@ public static function base32_encode( $input ) {
 		$binary_string = '';
 
 		foreach ( str_split( $input ) as $character ) {
-			$binary_string .= str_pad( base_convert( ord( $character ), 10, 2 ), 8, '0', STR_PAD_LEFT );
+			$binary_string .= str_pad( base_convert( (string) ord( $character ), 10, 2 ), 8, '0', STR_PAD_LEFT );
 		}
 
 		$five_bit_sections = str_split( $binary_string, 5 );

settings/class-two-factor-settings.php

@@ -37,7 +37,14 @@ public static function render_settings_page() {
 			// Sanitize posted values immediately.
 			$posted = array_map( 'sanitize_text_field', (array) $posted );
 			// Remove empty values.
-			$enabled = array_values( array_filter( $posted, 'strlen' ) );
+			$enabled = array_values(
+				array_filter(
+					$posted,
+					static function ( $value ) {
+						return '' !== $value;
+					}
+				)
+			);
 
 			update_option( Two_Factor_Core::ENABLED_PROVIDERS_OPTION_KEY, array_values( array_unique( $enabled ) ) );
 

two-factor.php

@@ -106,7 +106,7 @@ function two_factor_render_settings_page() {
 	}
 
 	// Prefer new settings class (keeps main file small).
-	if ( class_exists( 'Two_Factor_Settings' ) && is_callable( array( 'Two_Factor_Settings', 'render_settings_page' ) ) ) {
+	if ( class_exists( 'Two_Factor_Settings' ) ) {
 		Two_Factor_Settings::render_settings_page();
 		return;
 	}