Knock Knock

Fixed

• Fixed an error on the password prompt when the Invalid Login Window Duration setting was empty or invalid. It now falls back to the default of one hour.

Added

• Added the enableStaticCaching and staticCacheCookieName settings, which allow the password prompt and protected pages to be statically cached (e.g. by Craft Cloud), using an access cookie that’s included in the cache keys. (#86)

Fixed

• Fixed protected pages missing no-cache headers after successful access when static caching is disabled.

Changed

• Updated the minimum required Craft version to 5.9.12.
• Updated the frontend build toolchain to Vite 8.3.4.

Fixed

• Fixed a high-severity access control vulnerability.
• Fixed a medium-severity access control vulnerability affecting protected URL rules.
• Fixed a medium-severity access control vulnerability affecting URL aliases.
• Fixed a low-severity access control vulnerability affecting regular-expression URL rules.

Changed

• Updated Craft API usage to avoid deprecated calls.

Changed

• Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3)

Changed

• Updated the required version of verbb/base to 3.0.19.
• Replaced the CodeKit stylesheet build with Vite and moved web assets to src/web.

Fixed

• Fixed a high-severity access control vulnerability.
• Fixed a medium-severity cross-site request forgery vulnerability affecting password-gate lockouts.
• Fixed a medium-severity access control vulnerability affecting regular-expression URL rules.
• Fixed a medium-severity open redirect vulnerability.
• Fixed a medium-severity access control vulnerability affecting protected URL matching.
• Fixed a medium-severity access control vulnerability affecting access cookies.
• Fixed a low-severity access control vulnerability.
• Fixed a low-severity access control vulnerability affecting denied IP addresses with access cookies.
• Fixed a low-severity access control vulnerability affecting zero-prefix CIDR rules.
• Fixed a low-severity sensitive data storage vulnerability.
• Fixed a low-severity resource exhaustion vulnerability affecting invalid-login records.

Changed

• Route plugin settings through the plugin’s authorized settings controller.

Fixed

• Fixed a high-severity access control vulnerability.

Fixed

• Fix saving one settings page resetting settings on the other pages. (#84).

Changed

• Updated documentation for clearer, more consistent guidance.

Changed

• Normalize plugin settings.

Added

• Add cookieDuration setting to control how long a visitor stays logged in for before being asked for the password again. Previously hard-coded to one hour.

Fixed

• Fix enabled callback functions in config files no longer working after environment variable support was added in 3.0.6. (#83).

Added

• Add support for environment variables in password and enabled settings, including Control Panel autosuggestions.

Fixed

• Fix password comparison timing vulnerability.

Changed

• Ensure rendering templates set a no-cache header for Craft Cloud.

Fixed

• Fix normalization of multi-line settings like URLs and IPs.

Fixed

• Fix layout in Craft 5.6 and match new front-end login theme.

Added

• Allow enabled to be set using a callback function in config files.

Changed

• Update English translations.

Fixed

• Fix multi-site protected/unprotected URLs not being honoured.
• Fix an error when trying to determine multi-site plugin settings for installs where no primary site exists yet.

Changed

• Now requires PHP 8.2.0+.
• Now requires Craft 5.0.0+.

Changed

• Ensure rendering templates set a no-cache header for Craft Cloud.

Changed

• Update English translations.

Added

• Allow enabled to be set using a callback function in config files.

Changed

• Update English translations.

Fixed

• Fix multi-site protected/unprotected URLs not being honoured.

Changed

• Action request endpoints are now no longer protected.

Fixed

• Fix too-early call on User::getIdentity() when plugin is disabled, for better performance.

Fixed

• Fix an error when checking the enabled state of the plugin.

Added

• Add Cache-Control headers when redirecting.

Fixed

• Fix an incorrect check for enabled state for multi-site installs.

Fixed

• Fix unprotectedUrls as a config option not working correctly.

Changed

• Only admins are now allowed to access plugin settings.

Fixed

• Fix Protected URLs/Unprotected URLs not working correctly for multiple values when set via the control panel.

Added

• Add enableCpProtection plugin setting.

Fixed

• Fix login challenge when accessing the control panel.

Fixed

• Fix an error introduced in 2.0.4.

Added

• Add support for Cloudflare remote IP checking.
• Add support to block CP-based pages, not just site-based requests.

Fixed

• Fix an issue with live preview checks for access control.

Fixed

• Fix protectedUrls, and unprotectedUrls URLs partial-matching incorrectly due to Regex rules.
• Better normalising of allowIps, denyIps, protectedUrls, and unprotectedUrls settings.
• Revert infinite loop check, which results in incorrect redirect URLs.

Fixed

• Fix an error when installing the plugin.

Added

• Add resave console command for elements.
• Add checks for registering events for performance.
• Add archiveTableIfExists() to install migration.

Changed

• Now requires PHP 8.0.2+.
• Now requires Craft 4.0.0+.
• Now requires Knock Knock 1.2.16 in order to update from Craft 3.
• Rename service classes.
• Rename base plugin methods.
• Use Application::EVENT_INIT to test access to ensure Craft is initialized properly.

Added

• Allow arrays in config settings for allowIps, denyIps, protectedUrls, unprotectedUrls. (thanks @Diewy).

Fixed

• Fix a potential infinite redirect loop if changing from http to https.

Fixed

• Fix site-based custom templates not working correctly.

Added

• Add support for custom CP-based templates. (thanks @seibert-io).
• Add support for IPv4 and IPv6 CIDR blocks in allowIps and denyIps config. (thanks @onstuimig).

Changed

• Deny access to settings for non-admins.

Fixed

• Fix redirect URL not using the referrer URL after logging in.

Fixed

• Fix potential error redirecting to non-site URLs after login. In some cases, this caused redirecting to a cpresources asset.
• Fix cookie not respecting the Craft defaultCookieDomain config setting.

Fixed

• Fix incorrect loginUrl route, causing issues on some site setups (subdirectory installs).

Added

• Allow env variables to be used in allow/deny IPs.

Fixed

• Fix login path not resolving correctly for some multi-site installs.

Fixed

• Fix challenge URL not being correct for nested URLs.

Added

• Add useRemoteIp to opt-in to more stricter IP checks if security is your concern.

Fixed

• Revert behaviour of using remote IP for checking user IP. Too many issues and edge-cases.

Fixed

• Fix potential issue splitting multi-line settings (allowIps, denyIps, protectedUrls).

Fixed

• Fix error introduced in 1.2.9.

Deprecated

• Deprecate whitelistIps. Use allowIps instead.
• Deprecate blacklistIps. Use denyIps instead.

Fixed

• Fix fetching the IP for a user that could allow spoofing via headers. Vulnerability IP Whitelist bypass reported by Paweł Hałdrzyński.
• Ensure redirect param is validated to prevent malicious redirection. For custom forms, please update the redirect input to use {{ redirect | hash }} otherwise logins will not work. Vulnerability Open-redirect reported by Paweł Hałdrzyński.

Added

• Add forcedRedirect to force a redirected URL once logging in.

Fixed

• Fix logging error Call to undefined method setFileLogging().

Changed

• File logging now checks if the overall Craft app uses file logging.
• Log files now only include GET and POST additional variables.

Fixed

• Realllly fix live preview from cross-domains.

Fixed

• Fix error thrown for console requests.

Fixed

• Re-organise access testing code, and support cross-domain live preview (properly, through tokens).

Fixed

• Exclude live preview requests from blocking access.

Fixed

• Fix asset bundles causing style issues in the CP.

Added

• Add support for Regex in protected URLs.

Fixed

• Fix protected URL comparison taking into account query strings, when it shouldn't.

Added

• Add Craft 3.4 compatibility.

Fixed

• Fix yii\base\InvalidConfigException error thrown in some instances.

Added

• Added Custom login path. Thanks @X-Tender.
• Allow IPs to be whitelisted from login protection.
• Add Protected URLs to set specific URLs (and only those) for password protection.

Fixed

• Update redirect input. = Fix redirection after login.

Added

• Add lock-out and security behaviour.
• Add multi-site settings.
• Add custom template setting.
• New icon.
• Add override notice for settings fields.

Fixed

• Fix console requests throwing an error.

Changed

• Downgrade requirement to Craft 3.0.x.

Fixed

• Fix settings not saving.

Added

• Added enabled setting.

• Initial release.