WordPress.org
Get WordPress

Plugin Directory

Changeset 3382345


Ignore:
Timestamp:
10/22/2025 06:30:24 AM (5 months ago)
Author:
chrmrtns
Message:

Release v3.0.2 - Critical 2FA fixes

Fixed four critical issues affecting 2FA magic link authentication:

  1. CRITICAL: Fixed fatal error in 2FA magic link login flow (Core::get_instance() namespace confusion)
    • Changed Core::get_instance() to TwoFACore::get_instance() in includes/Core/Core.php
  1. CRITICAL: Fixed incorrect get_redirect_url() method call (Admin vs OptionsPage class reference)
    • Added OptionsPage import and fixed two instances of Admin::get_redirect_url() to OptionsPage::get_redirect_url()
  1. WOOCOMMERCE FIX: Changed 2FA verification hook from 'init' to 'template_redirect' to prevent cart warnings
    • Updated includes/Security/TwoFA/Core.php hook timing for better plugin compatibility
  1. DATABASE FIX: Fixed wpdb::prepare() called without placeholder in get_2fa_users()
    • Removed unnecessary prepare() call when no search term present in includes/Core/Database.php

Files modified in trunk:

  • includes/Core/Core.php
  • includes/Core/Database.php
  • includes/Security/TwoFA/Core.php
  • keyless-auth.php (version bump to 3.0.2)
  • readme.txt (updated stable tag and changelog)

Tagged as 3.0.2

Location:
keyless-auth
Files:
65 added
5 edited

Legend:

Unmodified
Added
Removed

  • keyless-auth/trunk/includes/Core/Core.php

    r3380037 r3382345  
    1818use Chrmrtns\KeylessAuth\Email\Templates;
    1919use Chrmrtns\KeylessAuth\Admin\Admin;
     20use Chrmrtns\KeylessAuth\Admin\Pages\OptionsPage;
    2021
    2122
    … …  
    596597        $user = get_user_by('ID', $user_id);
    597598        if ($user && class_exists('Chrmrtns\\KeylessAuth\\Security\\TwoFA\\Core')) {
    598             $tfa_core = Core::get_instance();
     599            $tfa_core = TwoFACore::get_instance();
    599600
    600601            // Check if 2FA is enabled and required for this user
    … …  
    615616                    } else {
    616617                        // Get redirect URL (custom or default)
    617                         $redirect_url = class_exists('Chrmrtns\\KeylessAuth\\Admin\\Admin') ? Admin::get_redirect_url($user_id) : admin_url();
     618                        $redirect_url = class_exists('Chrmrtns\\KeylessAuth\\Admin\\Pages\\OptionsPage') ? OptionsPage::get_redirect_url($user_id) : admin_url();
    618619                    }
    619620                    $redirect_url = apply_filters('chrmrtns_kla_after_login_redirect', $redirect_url, $user_id);
    … …  
    687688        } else {
    688689            // Get redirect URL (custom or default)
    689             $redirect_url = class_exists('Chrmrtns\\KeylessAuth\\Admin\\Admin') ? Admin::get_redirect_url($user_id) : admin_url();
     690            $redirect_url = class_exists('Chrmrtns\\KeylessAuth\\Admin\\Pages\\OptionsPage') ? OptionsPage::get_redirect_url($user_id) : admin_url();
    690691        }
    691692

  • keyless-auth/trunk/includes/Core/Database.php

    r3380037 r3382345  
    781781            $query = $base_query . " ORDER BY u.user_login ASC";
    782782
    783             // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Querying custom devices table for admin interface, query properly prepared
    784             $prepared_query = $wpdb->prepare($query);
    785             // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query already prepared above
    786             $results = $wpdb->get_results($prepared_query);
     783            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Querying custom devices table for admin interface, no placeholders needed
     784            $results = $wpdb->get_results($query);
    787785        }
    788786

  • keyless-auth/trunk/includes/Security/TwoFA/Core.php

    r3380037 r3382345  
    100100        }
    101101
    102         // Handle 2FA verification page
    103         add_action('init', array($this, 'handle_2fa_verification'));
     102        // Handle 2FA verification page (use template_redirect to ensure WooCommerce cart is ready)
     103        add_action('template_redirect', array($this, 'handle_2fa_verification'));
    104104
    105105        // Add grace period notices

  • keyless-auth/trunk/keyless-auth.php

    r3380025 r3382345  
    44* Plugin URI: https://github.com/chrmrtns/keyless-auth
    55* Description: Enhanced passwordless authentication allowing users to login securely without passwords via email magic links. Fork of Passwordless Login by Cozmoslabs with additional security features.
    6 * Version: 3.0.1
     6* Version: 3.0.2
    77* Author: Chris Martens
    88* Author URI: https://github.com/chrmrtns
    … …  
    3838
    3939// Define plugin constants
    40 define('CHRMRTNS_KLA_VERSION', '3.0.1');
     40define('CHRMRTNS_KLA_VERSION', '3.0.2');
    4141define('CHRMRTNS_KLA_PLUGIN_DIR', plugin_dir_path(__FILE__));
    4242define('CHRMRTNS_KLA_PLUGIN_URL', plugin_dir_url(__FILE__));

  • keyless-auth/trunk/readme.txt

    r3380025 r3382345  
    66Requires at least: 3.9
    77Tested up to: 6.8
    8 Stable tag: 3.0.1
     8Stable tag: 3.0.2
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    305305
    306306== Changelog ==
     307
     308= 3.0.2 =
     309* FIX: Critical - Fixed fatal error in 2FA magic link login flow (Core::get_instance() namespace confusion)
     310* FIX: Critical - Fixed incorrect get_redirect_url() method call (Admin vs OptionsPage class reference)
     311* FIX: WooCommerce compatibility - Changed 2FA verification hook from 'init' to 'template_redirect' to prevent cart warnings
     312* FIX: Database query - Fixed wpdb::prepare() called without placeholder in get_2fa_users() causing PHP notice
     313* IMPROVEMENT: Better timing for 2FA verification page rendering to ensure compatibility with WooCommerce and other plugins
     314* TECHNICAL: Added OptionsPage import to Core class for proper redirect URL handling
     315* TECHNICAL: Updated TwoFA Core class to use template_redirect hook for proper WordPress hook sequence
     316
    307317= 3.0.1 =
    308318* ACCESSIBILITY: Full WCAG 2.1 Level AA compliance achieved
Note: See TracChangeset for help on using the changeset viewer.