Login Security: Javascript Error in login.js:62

Hi @alexanderaltendorfer, thanks for reaching out to us!

Can I just ask the circumstances where this is showing? Does it always display for your site or is it only presenting on your custom login page?

To rule out a Javascript conflict with another plugin or library on your site, do you also see this when Wordfence is the only plugin enabled?

Thanks,

Peter.

Hi Peter, thank you for your reply.
I noticed the error only on our custom login page, because on the native wp-login screen, a different code is executed. alert(message) is only executed when the login message cannot be appended into the login form.
Please have a look at the showLoginMessage function in modules/login-security/js/login.1629122067.js:62. Unless I am completely mistaken, you will see that the variable message is undefined in the scope of this function and will always produce an error, regardless of other plugins or libraries.

I’m seeing this error as well in Wordfence v7.5.5 on a custom login page (from the Theme My Login plugin).

The problem is pretty obvious. Line 43 of this Wordfence JS file is:

showLoginMessage(messageHtml, type)

but line 62 says:

alert(message);

It should be:

alert(messageHtml);

The problem is that the user never sees the message; nothing happens when they press the “Login” button. So they press it over and over again and get themselves locked out without even knowing it.

• This reply was modified 3 years, 6 months ago by Larry Daniele. Reason: Added impact of problem

I would refine my answer to say that the message parameter to alert() should not be HTML, so messageHtml would need to be stripped of tags perhaps.