MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、JS空集合保护、
会话过期体验优化（403 JSON）、display_errors 关闭、
固定 key 根治 Integrity check failed 等全部改动

注意：config.inc.php/.htaccess/.user.ini 含敏感信息，
通过 .gitignore 排除，勿推送到公开仓库。

lib/MRBS/Session/SessionWordpress.php

@@ -0,0 +1,74 @@
+<?php
+declare(strict_types=1);
+namespace MRBS\Session;
+
+use MRBS\User;
+use function MRBS\auth;
+
+require_once MRBS_ROOT . '/auth/cms/wordpress.inc';
+
+
+class SessionWordpress extends SessionWithLogin
+{
+
+  public function __construct()
+  {
+    $this->checkTypeMatchesSession();
+    parent::__construct();
+  }
+
+
+  public function getCurrentUser() : ?User
+  {
+    if (!is_user_logged_in())
+    {
+      return parent::getCurrentUser();
+    }
+
+    $mrbs_user = wp_get_current_user();
+
+    return auth()->getUser($mrbs_user->user_login);
+  }
+
+
+  // Can only return a valid username.  If the username and password are not valid it will ask for new ones.
+  protected function getValidUser(
+    #[\SensitiveParameter]
+    ?string $username,
+    #[\SensitiveParameter]
+    ?string $password) : string
+  {
+    global $errors; // $errors is a WordPress global
+
+    $credentials = array();
+    $credentials['user_login'] = $username;
+    $credentials['user_password'] = $password;
+    $credentials['remember'] = false;
+    $wp_user = wp_signon($credentials);
+
+    if (is_wp_error($wp_user))
+    {
+      $errors = $wp_user;
+      $error_message = apply_filters('login_errors', $wp_user->get_error_message());
+      // The WordPress error message contains HTML so don't escape it.
+      $this->authGet($this->form['target_url'], $this->form['returl'], $error_message, true);
+      exit(); // unnecessary because authGet() exits, but just included for clarity
+    }
+
+    return $username;
+  }
+
+
+  protected function logonUser(string $username) : void
+  {
+    // Don't need to do anything: the user will have been logged on when the
+    // username and password were validated.
+  }
+
+
+  public function logoffUser() : void
+  {
+    wp_logout();
+  }
+
+}