From b817723e393b135ac9a2fbf59afeb6a2a5319e15 Mon Sep 17 00:00:00 2001
From: Volodymyr Kolesnykov <volodymyr.kolesnykov@automattic.com>
Date: Sat, 21 Feb 2026 14:35:44 +0200
Subject: [PATCH] fix(backup-codes): minor UI issues and JS var leak

---
 providers/class-two-factor-backup-codes.php       | 10 +++++-----
 tests/providers/class-two-factor-backup-codes.php |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/providers/class-two-factor-backup-codes.php b/providers/class-two-factor-backup-codes.php
index ee6ec2e6..1d1faf6f 100644
--- a/providers/class-two-factor-backup-codes.php
+++ b/providers/class-two-factor-backup-codes.php
@@ -106,7 +106,7 @@ public function admin_notices() {
 						array( 'a' => array( 'href' => true ) )
 					);
 					?>
-				<span>
+				</span>
 			</p>
 		</div>
 		<?php
@@ -159,7 +159,7 @@ public function user_options( $user ) {
 
 		$count = self::codes_remaining_for_user( $user );
 		?>
-		<p id="two-factor-backup-codes">
+		<div id="two-factor-backup-codes">
 			<p class="two-factor-backup-codes-count">
 			<?php
 				echo esc_html(
@@ -178,13 +178,13 @@ public function user_options( $user ) {
 
 				<em><?php esc_html_e( 'This invalidates all currently stored codes.', 'two-factor' ); ?></em>
 			</p>
-		</p>
+		</div>
 		<div class="two-factor-backup-codes-wrapper" style="display:none;">
 			<ol class="two-factor-backup-codes-unused-codes"></ol>
 			<p class="description"><?php esc_html_e( 'Write these down! Once you navigate away from this page, you will not be able to view these codes again.', 'two-factor' ); ?></p>
 			<p>
 				<a class="button button-two-factor-backup-codes-download button-secondary hide-if-no-js" href="javascript:void(0);" id="two-factor-backup-codes-download-link" download="two-factor-backup-codes.txt"><?php esc_html_e( 'Download Codes', 'two-factor' ); ?></a>
-			<p>
+			</p>
 		</div>
 		<script type="text/javascript">
 			( function( $ ) {
@@ -202,7 +202,7 @@ public function user_options( $user ) {
 						$codesList.html( '' );
 
 						// Append the codes.
-						for ( i = 0; i < response.codes.length; i++ ) {
+						for ( var i = 0; i < response.codes.length; i++ ) {
 							$codesList.append( '<li>' + response.codes[ i ] + '</li>' );
 						}
 
diff --git a/tests/providers/class-two-factor-backup-codes.php b/tests/providers/class-two-factor-backup-codes.php
index f1b62f57..8d976eca 100644
--- a/tests/providers/class-two-factor-backup-codes.php
+++ b/tests/providers/class-two-factor-backup-codes.php
@@ -163,7 +163,7 @@ public function test_user_options() {
 		$this->provider->user_options( $user );
 		$buffer = ob_get_clean();
 
-		$this->assertStringContainsString( '<p id="two-factor-backup-codes">', $buffer );
+		$this->assertStringContainsString( '<div id="two-factor-backup-codes">', $buffer );
 		$this->assertStringContainsString( '<div class="two-factor-backup-codes-wrapper" style="display:none;">', $buffer );
 		$this->assertStringContainsString( "user_id: {$user->ID}", $buffer );
 	}