Two-Factor Authentication

Fixed

• fix: Allow csrf retrieval for asyncCsrfInputs. Thanks to @Tim-Wils

Fixed

• fix: removed reference to old code

Fixed

• fix: dont allow visits to plugin templates before 2fa

Fixed

• fix: Missing usertoken table on fresh install

Fixed

• fix: Exposure of Sensitive Attributes
• fix: Corrected the single use token time window

Changed

• Deprecate php 8.0
• Updated spomky-labs/otphp
• Updated endroid/qr-code

Fixed

• Remove unneeded getTotp call.
• fix: Exposure of Sensitive Attributes
• fix: Token is now single use within time window

Fixed

• Fixed a post-login vulnerability.

Fixed

• Use isTwoFactorEnabled on settings screen.
• Use two-factor-authentication/settings/turn-on action on settings screen.

Fixed

• Verify screen updated to Craft's new frontend style.
• Verify step wasn't functioning correctly.

Fixed

• Prevent error when lastLoginDate is not set. Thanks to @joepagan

Changed

• Make sure to render CP templates in TEMPLATE_MODE_CP
• AssetBundle improvement to prevent assets not loading during login
• Code cleanup

Fixed

• Fix 500 error in CP for non-admins. Thanks to @mike-moreau

Changes

• Updated froms and controllers to use Craft 4 way of returning data.

Changes

• Code cleanup
• Simplify request check

Fixed

• Init load event now really uses WebApplication

Fixed

• Issuer name is now the system name instead of application name
• Init load event now uses WebApplication::EVENT_INIT

Changed

• Added craft 4 support

Added

• backEndPathAllow config option to allow specific backend paths to bypass 2fa checks.

Fixed

• Verification is now also needed after a second login.

Fixed

• Fixed otphp update. Thanks to @bencroker

Updated

• Updated spomky-labs/otphp requiring php 7.3 and up.

Added

• Use endroid/qr-code for qr code generating instead of google's deprecated chart api.

Fixed

• Fixed getting logged out during 2FA screen on Craft 3.4 and up. Thanks to @goraxan

Fixed

• Fixed composer.json for composer 2

Changed

• Don't do anything until EVENT_AFTER_LOAD_PLUGINS

Fixed

• Make sure not to install the old session table.

Fixed

• Fixed installation errors

Released earlier changes.

Changed

• Move from a custom session table to storing data in the session.

Changed

• Move from a custom session table to storing data in the session.

Changed

• Allow userSessionDuration to be 0

Fixed

• DateTime comparison is now between similar timezones.

Fixed warning of 2.6.0

BREAKING! Use frontEndPathAllow/frontEndPathExclude instead of frontEndPathWhitelist/frontEndPathBlacklist!

Improved

• Use allow/exclude in favor of whitelist/blacklist
• Removed ConfigHelper::localizedValue from config making configs more dependable.

Added

• French translation thanks to @romainpoirier

Fixed

• Removed some old & unused code

Fixed

• userLoginEventHandler now uses verifyBackEnd and verifyFrontEnd options as it is supposed to.

Added

• Add in the ability to add the secure redirect field to the front-end forms. Thanks to @coxeh

Fixed

• Fixed a bug where turning off 2 step on the front end always redirects to the admin cp. Thanks to @coxeh

Added

• Added verifyBackEnd option

Fixed

• Fixed admin redirect issue when using forceBackEnd.

Added

• Added totpDelay config option (gives the user some extra time after code expired)

Fixed

• Disabling 2FA for other users failed

Fixed

• Make sure the User's EVENT_AFTER_LOGIN is triggered thanks to @engram-design

Fixed

• Fix otphp to pull their fix for random_compat on php 7.0 thanks to @mikestecker

Fixed

• Fix otphp to pull their fix for random_compat on php 7.0 thanks to @mikestecker

Fixed

• Support for Craft 3.1

Stable release for Craft 3.

Added

• Blacklist and whitelist can be exact paths or regex.
• isTwoFactorEnabled can be used from twig.

Added

• Added option to disable 2FA when a user is locked out of the account.

Fixed

• Allow 2FA on the front end home.

Fixed

• Fixed link to Google Authenticator

Fixed

• Fixed 2FA CP path detection

Added

• Front end 2FA support
• Allow forcing 2FA

Fixed

• Migrated old code to Craft 3

Improved

• @jlamb1 Fix Deprecation Error "Round"

Improved

• @brandonkelly Fixed the install migration

Changed

• Disabled the plugin for console commands.
• Added support for upgrading from Craft 2.

Improved

• Added Dutch (NL) translation file. Thanks to @RichardFrontwise

Changed

• Changed the translation scope to app.

Changed

• Fixed debug bar support. Debug should be allowed, not trigger logout.

Improved

• Prevent redirect loop for cookieBased login.

Improved

• Fixed user overview with 2FA column enabled.

• Beta release of the Craft 3 plugin.

Changed

• Moved releases to the craft-2 branch.

Improved

• Fixed console support.
• Downgraded otphp to 8.3.2 for better PHP support.

Improved

• rememberedUserSessionDuration is now optional.
• Fixed a DateTime checking issue causing unpredictable behavior.

Improved

• Validation feedback fix.
• Updated otphp to 9.0.2.

Improved

• Make csrf required to turn 2FA off.

Improved

• Fix for login popup on verify screen.

Improved

• Fix for looping back to the verify controller.

Changed

• Added our own vendor code.

Improved

• Fixes for installing through composer

Initial Beta Release