|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to this project will be documented in this file, per [the Keep a Changelog standard](http://keepachangelog.com/), and will adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). |
| 4 | + |
| 5 | +## [Unreleased] - TBD |
| 6 | + |
| 7 | +## [0.14.2] - 2025-12-11 |
| 8 | +### New Features |
| 9 | +- Add filter for rest_api_can_edit_user_and_update_two_factor_options by @gutobenn in #689 |
| 10 | + |
| 11 | +### Development Updates |
| 12 | +- Remove Coveralls tooling and add inline coverage report by @kasparsd in #717 |
| 13 | +- Update blueprint path to pull from main branch instead of a deleted f… by @georgestephanis in #719 |
| 14 | +- Fix blueprint and wporg asset deploys by @kasparsd in #734 |
| 15 | +- Upload release only on tag releases by @kasparsd in #735 |
| 16 | +- Bump playwright and @playwright/test by @dependabot[bot] in #721 |
| 17 | +- Bump tar-fs from 3.1.0 to 3.1.1 by @dependabot[bot] in #720 |
| 18 | +- Bump node-forge from 1.3.1 to 1.3.2 by @dependabot[bot] in #724 |
| 19 | +- Bump js-yaml by @dependabot[bot] in #725 |
| 20 | +- Mark as tested with the latest WP core version by @kasparsd in #730 |
| 21 | + |
| 22 | +## [0.14.1] - 2025-09-05 |
| 23 | +- Don't URI encode the TOTP url for display. by @dd32 in #711 |
| 24 | +- Removed the duplicate Security.md by @slvignesh05 in #712 |
| 25 | +- Fixed linting issues by @sudar in #707 |
| 26 | +- Update development dependencies and fix failing QR unit test by @kasparsd in #714 |
| 27 | +- Trigger checkbox js change event by @gedeminas in #688 |
| 28 | + |
| 29 | +## [0.14.0] - 2025-07-03 |
| 30 | +### Features |
| 31 | +- Enable Application Passwords for REST API and XML-RPC authentication (by default) by @joostdekeijzer in #697 and #698. Previously this required two_factor_user_api_login_enable filter to be set to true which is now the default during application password auth. XML-RPC login is still disabled for regular user passwords. |
| 32 | +- Label recommended methods to simplify the configuration by @kasparsd in #676 and #675 |
| 33 | + |
| 34 | +### Documentation |
| 35 | +- Add WP.org plugin demo by @kasparsd in #667 |
| 36 | +- Document supported versions of WP core and PHP by @jeffpaul in #695 |
| 37 | +- Document the release process by @jeffpaul in #684 |
| 38 | + |
| 39 | +### Tooling |
| 40 | +- Remove duplicate WP.org screenshots and graphics from SVN trunk by @jeffpaul in #683 |
| 41 | + |
| 42 | +## [0.13.0] - 2025-04-02 |
| 43 | +- Add two_factor_providers_for_user filter to limit two-factor providers available to each user by @kasparsd in #669 |
| 44 | +- Update automated testing to cover PHP 8.4 and default to PHP 8.3 by @BrookeDot in #665 |
| 45 | + |
| 46 | +## [0.12.0] - 2025-02-14 |
| 47 | +- Simplify the Two Factor settings in user profile by @kasparsd in #654 |
| 48 | +- Fix PHP 8.4 Implicitly marking parameter $previous as nullable is deprecated by @BrookeDot in #664 |
| 49 | + |
| 50 | +## [0.11.0] - 2025-01-09 |
| 51 | +- Remove duplicate two_factor_providers filter calls to allow disabling core providers by @kasparsd in #651 |
| 52 | +- Encourage setting up a second recovery method by @kasparsd in #642 |
| 53 | +- Focus in code input when totp is checked by @thrijith in #645 |
| 54 | +- Add autocomplete "one-time-code" attribute by @stefanmomm in #657 |
| 55 | +- Add filters for email token and backup code length by @kasparsd in #653 |
| 56 | +- Enable TOTP method when method is configured by @kasparsd in #643 |
| 57 | + |
| 58 | +## [0.10.0] - 2024-12-02 |
| 59 | +- Bump minimum WP to 6.3, minimum PHP to 7.2. by @dd32 in #625 |
| 60 | +- Rely on just-in-time translation loading by @swissspidy in #608 |
| 61 | +- Update/headers by @jeffpaul in #610 |
| 62 | +- Update short description by @jeffpaul in #612 |
| 63 | +- Fix typos by @szepeviktor in #617 |
| 64 | +- Bump tested upto version to WP 6.6 by @mehul0810 in #616 |
| 65 | +- Fire an action when a user revalites their 2FA session. by @dd32 in #620 |
| 66 | +- Remove old grunt deploy related code. See #543 by @dd32 in #627 |
| 67 | +- Fix Action unit testing by @dd32 in #624 |
| 68 | +- Update two factor options layout by @thrijith in #623 |
| 69 | +- Bump send and express by @dependabot in #634 |
| 70 | +- Accessibility for options page by @dd32 in #632 |
| 71 | +- Fix errors reported by PHPStan by @szepeviktor in #619 |
| 72 | +- Fix failing unit test by @kasparsd in #639 |
| 73 | +- Add basic PHPStan linter by @kasparsd in #638 |
| 74 | +- Update screenshots to match the current UI by @kasparsd in #636 |
| 75 | +- Improve discoverability by @kasparsd in #635 |
| 76 | +- Delete user meta on plugin uninstall by @kasparsd in #637 |
| 77 | +- Bump axios from 1.6.8 to 1.7.4 by @dependabot in #626 |
| 78 | +- Bump braces from 3.0.2 to 3.0.3 by @dependabot in #613 |
| 79 | +- Bump webpack from 5.91.0 to 5.94.0 by @dependabot in #628 |
| 80 | +- Bump symfony/process from 5.4.40 to 5.4.46 by @dependabot in #649 |
| 81 | + |
| 82 | +## [0.9.1] - 2024-04-25 |
| 83 | +- Remove trailing commas in parameters to avoid syntax error with some PHP versions (ex. 7.2.x) by @KZeni in #604 |
| 84 | +- Ensure PHP 5.6+ support during CI to avoid breaking changes by @kasparsd in #605 |
| 85 | + |
| 86 | +## [0.9.0] - 2024-04-25 |
| 87 | +- Users are now asked to re-authenticate with their two-factor before making changes to their two-factor settings #529. This builds on #528 which associates each login session with the two-factor login meta data for improved handling of that session. |
| 88 | +- Fix typo by @pkevan in #551 |
| 89 | +- Add a filter to filter the classname used for a provider by @dd32 in #546 |
| 90 | +- Bump tested up to version by @av3nger in #552 |
| 91 | +- Store the two-factor details in the user session at login time by @dd32 in #528 |
| 92 | +- Bump guzzlehttp/psr7 from 2.4.3 to 2.5.0 by @dependabot in #555 |
| 93 | +- Use simpler/less-technical wording and UI. by @dd32 in #521 |
| 94 | +- Fixing bug where Super Admins cannot setup Time Based One-Time Password as first Two Factor option on WP VIP by @spenserhale in #560 |
| 95 | +- Enqueue jQuery and wp.apiRequest for use within callbacks. by @dd32 in #561 |
| 96 | +- Revalidate two factor settings prior to allowing any two-factor changes to an account. by @dd32 in #529 |
| 97 | +- ReAuth: resolve fatal, code cleanup by @dd32 in #567 |
| 98 | +- Sync two-factor session meta to newly created sessions by @dd32 in #574 |
| 99 | +- Require a nonce be present for revalidate POST requests. by @dd32 in #575 |
| 100 | +- Bump tough-cookie from 4.1.2 to 4.1.3 by @dependabot in #579 |
| 101 | +- Destroy existing sessions when activating 2FA. by @dd32 in #578 |
| 102 | +- Bump version identifier by @iandunn in #588 |
| 103 | +- Add method to disable an individual provider by @iandunn in #587 |
| 104 | +- Prefer "require_once" in a few spots. by @JJJ in #595 |
| 105 | +- Update readme.txt by @bph in #597 |
| 106 | +- Bump postcss from 8.4.17 to 8.4.31 by @dependabot in #589 |
| 107 | +- Bump word-wrap from 1.2.3 to 1.2.4 by @dependabot in #582 |
| 108 | + |
| 109 | +## [0.8.2] - 2023-09-04 |
| 110 | +- Improved error handling in WP_Two_Factor_Email::generate_code() by ensuring $user_id is a valid WP_User object. Props @apokalyptique. See #560. |
| 111 | +- Fixed a bug that could cause a fatal error when using non-object values in wp_get_current_user() by adding type checks. Props @apokalyptique. See #561. |
| 112 | +- Fixed "Call to a member function is_locked()" fatal by checking if $provider is an object before method access. Props @apokalyptique. See #578. |
| 113 | +- Prevented Call to a member function exists() fatal error by verifying $provider is an object before invoking method calls. Props @apokalyptique. See #552. |
| 114 | + |
| 115 | +## [0.8.1] - 2023-03-27 |
| 116 | +- Remove unnecessary comma to fix fatal error on PHP 7.2 #547 |
| 117 | + |
| 118 | +## [0.8.0] - 2023-03-27 |
| 119 | +- Reduce the login nonce expiration from 60 minutes to 10 minutes by default, and include user ID in the login nonce to make them unique #473. |
| 120 | +- Replace QR generation for TOTP secrets with local Javascript tooling instead of Google Charts API #487 and #495. |
| 121 | +- Fix Backup code download with quotes in translations #494. |
| 122 | +- Block sending authentication cookies upon 2FA login #502. |
| 123 | +- Backup Codes: Always generate 10 codes via REST #514. |
| 124 | +- TOTP: Enforce single-use of TOTP one-time passwords #517. |
| 125 | +- Add rate limiting to two factor attempts #510. |
| 126 | +- Core: Reset compromised passwords after 2FA failures #482. |
| 127 | +- Document the TOTP Filters, add Issuer filter #530. |
| 128 | +- Support login-by-email in maybe_show_reset_password_notice() #532. |
| 129 | +- Be more tolerant of user input for auth codes #518. |
| 130 | +- Standardise on int|WP_User input to the "for user" functions #535. |
| 131 | + |
| 132 | +## [0.7.3] - 2022-10-17 |
| 133 | +- Make wp_login_failed action call compatible with the WP core argument count and types. Reported in #471 by @dziudek and fixed in #478 by @dd32. |
| 134 | +- Use hash_equals() for nonce comparison to improve security. Reported in #458 and fixed in #458 by @calvinalkan. |
| 135 | +- Improve compatibility with PHP 8.1 by replacing all instances of FILTER_SANITIZE_STRING usage. Reported and fixed in #428 by @sjinks. |
| 136 | +- Add automated checks for PHP 8 compatibility in #465 and #466 by @kasparsd. |
| 137 | +- Improve accessibility of two-factor settings in the user profile by introducing a label that links the method names with the associated checkboxes. Reported and fixed in #387 by @r-a-y. |
| 138 | +- Improve TOTP autocomplete behaviour by setting the autocomplete attribute to one-time-code. Reported and fixed in #420 by @squaredpx. |
| 139 | + |
| 140 | +## [0.7.2] - 2022-09-12 |
| 141 | +- Security improvement: Store the second factor authentication step nonce hashed to prevent leaking it via database read access #453. Props to @calvinalkan for reporting the issue. |
| 142 | +- Fix: Add wp_specialchars_decode() to escape the HTML entity on the Email Subject line (#412), props @nbwpuk. |
| 143 | +- Fix: Use hash_equals() when comparing the email token (#425), props @Mati02K. |
| 144 | +- Tooling: Introduce @wordpress/env for development tooling and move to GitHub actions for CI (#436). |
| 145 | + |
| 146 | +## [0.7.1] - 2021-09-07 |
| 147 | +- Update the login_header() and login_footer() methods to match the WP core (see #407), props @cfaria. |
| 148 | +- Mark as compatible with WordPress 5.8. |
| 149 | + |
| 150 | +## [0.7.0] - 2020-08-26 |
| 151 | +- Fix: improve time-based one-time (TOTP) autofill when using password managers like 1Password, see #373. Props @omelhus. |
| 152 | +- Fix: allow spaces in email code input and strip them away before processing, see #379. Props @shay1383. |
| 153 | +- Fix: remove references to Google Authenticator app since there are a lot more TOTP authenticators these days, see #367. Props @r-a-y. |
| 154 | +- Fix: register FIDO U2F related scripts during the suggested action hooks to avoid PHP noticed, see #356 and #368. Props @cojennin. |
| 155 | +- Rename and deprecate action and filter names two-factor-user-options- and two-factor-totp-time-step-allowance that don't following the WP coding standards. Use two_factor_user_options_ and two_factor_totp_time_step_allowance now. See #363. Props @paulschreiber. |
| 156 | +- Update codebase to match the WordPress coding standards, see #340. Props @paulschreiber. |
| 157 | +- Add tooling to run PHPUnit tests locally during development, see #355. Props @kasparsd. |
| 158 | + |
| 159 | +## [0.6.0] - 2020-05-06 |
| 160 | +- Security fix: escape the U2F key value when doing the key lookup in database during login. Props @mjangda from WordPress VIP. See #351. |
| 161 | +- New feature: invalidate email tokens 15 minutes after they were generated. Use the two_factor_token_ttl filter to override this time-to-live interval. See #352. |
| 162 | +- Document some of the available filters. |
| 163 | + |
| 164 | +## [0.5.2] - 2020-04-30 |
| 165 | +- Bugfix: saving standard user profile fields no longer resets the time-based-password key, see #341. |
| 166 | +- Bugfix: remove spaces around authentication codes before verifying them, see #339 (props @paulschreiber). |
| 167 | +- Bugfix: allow admins to configure FIDO U2F keys for other users, see #349. |
| 168 | +- Enable the "Dummy" authenticator method only when WP_DEBUG is set since we don't want regular users using it. |
| 169 | +- New: Add an two_factor_user_authenticated action when the user is logged-in after the second factor has been verified, see #324 (props @Kubitomakita). |
| 170 | +- New: Add two_factor_token_email_subject and two_factor_token_email_message filters to customize the email code subject and body, see #345 (props @christianc1). |
| 171 | +- Update the reference article URL in the readme files to account for domain change, see #332 (props @todeveni). |
| 172 | + |
| 173 | +## [0.5.1] - 2020-02-05 |
| 174 | +- Security fix: invalidate the session token used for the first password-based authentication, props @aapost0l. |
| 175 | +- Typo fixes in code comments, props @akkspros. |
| 176 | + |
| 177 | +## [0.5.0] - 2020-01-11 |
| 178 | +- Add a compatibility layer for Jetpack Secure Sign On to support longer session cookies, see #276. Props @pyronaur. |
| 179 | +- Fix spelling errors in code comments, see #318. Props @akkspros. |
| 180 | +- Add license file, #313. Props @axelsimon. |
| 181 | +- Bump the supported version of PHP to 5.6 to match the WordPress core. |
| 182 | + |
| 183 | +## [0.4.8] - 2019-12-26 |
| 184 | +- Mark as tested with WordPress 5.3. |
| 185 | +- Add a screenshot with email code authentication prompt. |
| 186 | +- Update development tooling versions. |
| 187 | + |
| 188 | +## [0.4.7] - 2019-05-08 |
| 189 | +- Introduce a two_factor_totp_title filter to allow TOTP title to be changed, see #294 (props @BrookeDot). |
| 190 | +- Mark as tested with WordPress 5.2. |
| 191 | + |
| 192 | +## [0.4.6] - 2019-04-26 |
| 193 | +- Add a unique ID for the two-factor options section, see #286 (props @joshbetz). |
| 194 | +- Add usage instructions and plugin screenshots, fixes #272. |
| 195 | + |
| 196 | +## [0.4.5] - 2019-04-22 |
| 197 | +- Add the missing two-factor textdomains, see #281 (props @Sonic853). |
| 198 | +- Fix U2F feature detection in Firefox, see #285. |
| 199 | + |
| 200 | +## [0.4.4] - 2019-04-15 |
| 201 | +- Add the closing </div> to match the WP core login form structure, see #274 (props @claytoncollie). |
| 202 | + |
| 203 | +## [0.4.3] - 2019-04-12 |
| 204 | +- Bump the actual version in the plugin header. That's what you get for deploying on Fridays. |
| 205 | + |
| 206 | +## [0.4.2] - 2019-04-12 |
| 207 | +- Developer tooling update, see #277. |
| 208 | + |
| 209 | +## [0.4.1] - 2019-04-12 |
| 210 | +- Redirect to admin_url() instead of $_SERVER['REQUEST_URI'] if $_REQUEST['redirect_to'] is not set, see #276 (props @joshbetz). |
| 211 | + |
| 212 | +## [0.4.0] - 2019-03-19 |
| 213 | +- Disable authentication via REST and XML-RPC endpoints for users with any of the two-factor methods enabled, see #271. |
| 214 | +- Mark as tested with WordPress 5.1. |
| 215 | + |
| 216 | +## [0.3.0] - 2018-11-06 |
| 217 | +- Mark as tested with WordPress 5.0. |
| 218 | +- Always post the two-factor login form to wp-login.php which runs all the required hooks for processing. Fixes login issues on WP Engine #257 and when a custom login URL is used #256. |
| 219 | + |
| 220 | +## [0.2.0] - 2018-10-16 |
| 221 | +- Add developer tools for deploying to WP.org manually. |
| 222 | + |
| 223 | +[Unreleased]: https://github.com/WordPress/two-factor/compare/master...develop |
| 224 | +[0.14.0]: https://github.com/WordPress/two-factor/compare/0.14.1...0.14.2 |
| 225 | +[0.14.0]: https://github.com/WordPress/two-factor/compare/0.14.0...0.14.1 |
| 226 | +[0.14.0]: https://github.com/WordPress/two-factor/compare/0.13.0...0.14.0 |
| 227 | +[0.13.0]: https://github.com/WordPress/two-factor/compare/0.12.0...0.13.0 |
| 228 | +[0.12.0]: https://github.com/WordPress/two-factor/compare/0.11.0...0.12.0 |
| 229 | +[0.11.0]: https://github.com/WordPress/two-factor/compare/0.10.0...0.11.0 |
| 230 | +[0.10.0]: https://github.com/WordPress/two-factor/compare/0.9.1...0.10.0 |
| 231 | +[0.9.1]: https://github.com/WordPress/two-factor/compare/0.9.0...0.9.1 |
| 232 | +[0.9.0]: https://github.com/WordPress/two-factor/compare/0.8.2...0.9.0 |
| 233 | +[0.8.2]: https://github.com/WordPress/two-factor/compare/0.8.1...0.8.2 |
| 234 | +[0.8.1]: https://github.com/WordPress/two-factor/compare/0.8.0...0.8.1 |
| 235 | +[0.8.0]: https://github.com/WordPress/two-factor/compare/0.7.3...0.8.0 |
| 236 | +[0.7.3]: https://github.com/WordPress/two-factor/compare/0.7.2...0.7.3 |
| 237 | +[0.7.2]: https://github.com/WordPress/two-factor/compare/0.7.1...0.7.2 |
| 238 | +[0.7.1]: https://github.com/WordPress/two-factor/compare/0.7.0...0.7.1 |
| 239 | +[0.7.0]: https://github.com/WordPress/two-factor/compare/0.6.0...0.7.0 |
| 240 | +[0.6.0]: https://github.com/WordPress/two-factor/compare/0.5.2...0.6.0 |
| 241 | +[0.5.2]: https://github.com/WordPress/two-factor/compare/0.5.1...0.5.2 |
| 242 | +[0.5.1]: https://github.com/WordPress/two-factor/compare/0.5.0...0.5.1 |
| 243 | +[0.5.0]: https://github.com/WordPress/two-factor/compare/0.4.8...0.5.0 |
| 244 | +[0.4.8]: https://github.com/WordPress/two-factor/compare/0.4.7...0.4.8 |
| 245 | +[0.4.7]: https://github.com/WordPress/two-factor/compare/0.4.6...0.4.7 |
| 246 | +[0.4.6]: https://github.com/WordPress/two-factor/compare/0.4.5...0.4.6 |
| 247 | +[0.4.5]: https://github.com/WordPress/two-factor/compare/0.4.4...0.4.5 |
| 248 | +[0.4.4]: https://github.com/WordPress/two-factor/compare/0.4.3...0.4.4 |
| 249 | +[0.4.3]: https://github.com/WordPress/two-factor/compare/0.4.2...0.4.3 |
| 250 | +[0.4.2]: https://github.com/WordPress/two-factor/compare/0.4.1...0.4.2 |
| 251 | +[0.4.1]: https://github.com/WordPress/two-factor/compare/0.4.0...0.4.1 |
| 252 | +[0.4.0]: https://github.com/WordPress/two-factor/compare/0.3.0...0.4.0 |
| 253 | +[0.3.0]: https://github.com/WordPress/two-factor/compare/0.2.0...0.3.0 |
| 254 | +[0.2.0]: https://github.com/WordPress/two-factor/tree/0.2.0 |
0 commit comments