WordPress.org
Get WordPress

Plugin Directory

Changeset 3402233


Ignore:
Timestamp:
11/25/2025 06:38:28 AM (4 months ago)
Author:
themepaste
Message:

Update to version 1.1.3 from GitHub

Location:
admin-safety-guard
Files:
6 edited
1 copied

Legend:

Unmodified
Added
Removed

  • admin-safety-guard/tags/1.1.3/admin-safety-guard.php

    r3401254 r3402233  
    44Plugin URI: http://themepaste.com/product/themepaste-secure-admin-pro/
    55Description: Secure your WordPress login with Admin safety guard to ensure secured access with limit login attempts, 2FA, reCaptcha, IP Blocking, Disable XML-RPC and activity tracking.
    6 Version: 1.1.2
     6Version: 1.1.3
    77Author: Themepaste Team
    88Author URI: http://themepaste.com/
    … …  
    3939        define( 'TPSA_PLUGIN_FILE', __FILE__ );
    4040        define( 'TPSA_PREFIX', 'tpsa' );
    41         define( 'TPSA_PLUGIN_VERSION', '1.1.2' );
     41        define( 'TPSA_PLUGIN_VERSION', '1.1.3' );
    4242        define( 'TPSA_PLUGIN_DIRNAME', dirname( TPSA_PLUGIN_FILE ) );
    4343        define( 'TPSA_PLUGIN_BASENAME', plugin_basename( TPSA_PLUGIN_FILE ) );

  • admin-safety-guard/tags/1.1.3/app/Classes/Features/TwoFactorAuth.php

    r3401251 r3402233  
    4646
    4747        if ( $this->is_enabled( $settings, 'otp-email' ) ) {
    48             $this->action( 'login_form', [$this, 'check_otp_submission'] );
     48            // Process OTP submission as early as possible (before HTML output).
     49            $this->action( 'login_init', [$this, 'check_otp_submission'] );
     50
     51            // Render OTP UI on the login form.
    4952            $this->action( 'login_form', [$this, 'render_otp_input'] );
     53
     54            // Intercept username/password login to send OTP first.
    5055            $this->filter( 'authenticate', [$this, 'intercept_login_with_otp'], 30, 3 );
    5156        }
    … …  
    125130}
    126131</style>
     132
    127133<div id="tpsa_otp_wrap">
    128     <label for="tpsa_otp_field"><?php echo esc_html__( 'One Time Password', 'tp-secure-plugin' ); ?></label>
     134    <label for="tpsa_otp_field">
     135        <?php echo esc_html__( 'One Time Password', 'tp-secure-plugin' ); ?>
     136    </label>
    129137    <input type="hidden" name="tpsa_user_id" value="<?php echo esc_attr( $user_id ); ?>">
    130138    <input type="hidden" name="tpsa_otp_verify" value="1">
    … …  
    133141    <?php $this->sent_email_message( $user ); ?>
    134142</div>
    135 <button type="submit" id="tpsa_verify_btn"><?php echo esc_html__( 'Verify OTP', 'tp-secure-plugin' ); ?></button>
     143<button type="submit" id="tpsa_verify_btn">
     144    <?php echo esc_html__( 'Verify OTP', 'tp-secure-plugin' ); ?>
     145</button>
    136146<?php
    137147}
    138148
    139149    /**
    140      * Check OTP submission on login form.
     150     * Check OTP submission on login (runs on login_init).
    141151     *
    142152     * @return void
    … …  
    156166        $stored_data = get_user_meta( $user_id, '_tpsa_otp_code', true );
    157167        $stored_otp = isset( $stored_data['otp'] ) ? $stored_data['otp'] : '';
     168
     169        if ( $otp_input !== $stored_otp ) {
     170            // Display error message above the form.
     171            add_action(
     172                'login_message',
     173                function () {
     174                    echo '<div style="color:red; margin-bottom:10px;">' .
     175                    esc_html__( 'Invalid OTP. Please try again.', 'tp-secure-plugin' ) .
     176                        '</div>';
     177                }
     178            );
     179            return;
     180        }
     181
     182        // OTP is correct – now perform a proper WordPress login using wp_signon().
     183        $username = isset( $stored_data['username'] ) ? $stored_data['username'] : '';
     184        $password = isset( $stored_data['password'] ) ? $stored_data['password'] : '';
    158185        $remember = !empty( $stored_data['remember'] );
    159186
    160         if ( $otp_input === $stored_otp ) {
    161             // Clean up OTP data.
    162             delete_user_meta( $user_id, '_tpsa_otp_code' );
    163 
    164             // Log user in with correct persistence.
    165             wp_set_auth_cookie( $user_id, $remember );
    166             wp_set_current_user( $user_id );
    167 
    168             wp_redirect( admin_url() );
    169             exit;
    170         } else {
    171             // Display error message above the form.
    172             add_action( 'login_message', function () {
    173                 echo '<div style="color:red; margin-bottom:10px;">' . esc_html__( 'Invalid OTP. Please try again.', 'tp-secure-plugin' ) . '</div>';
    174             } );
    175         }
     187        // Clean up OTP data.
     188        delete_user_meta( $user_id, '_tpsa_otp_code' );
     189
     190        if ( empty( $username ) || empty( $password ) ) {
     191            add_action(
     192                'login_message',
     193                function () {
     194                    echo '<div style="color:red; margin-bottom:10px;">' .
     195                    esc_html__( 'Login data missing. Please try logging in again.', 'tp-secure-plugin' ) .
     196                        '</div>';
     197                }
     198            );
     199            return;
     200        }
     201
     202        $creds = [
     203            'user_login'    => $username,
     204            'user_password' => $password,
     205            'remember'      => $remember,
     206        ];
     207
     208        // Let WordPress handle auth, cookies, tokens, Remember Me, etc.
     209        $secure_cookie = is_ssl();
     210        $user = wp_signon( $creds, $secure_cookie );
     211
     212        if ( is_wp_error( $user ) ) {
     213            add_action(
     214                'login_message',
     215                function () {
     216                    echo '<div style="color:red; margin-bottom:10px;">' .
     217                    esc_html__( 'Login failed after OTP verification. Please try again.', 'tp-secure-plugin' ) .
     218                        '</div>';
     219                }
     220            );
     221            return;
     222        }
     223
     224        // Successful login, redirect to admin.
     225        wp_safe_redirect( admin_url() );
     226        exit;
    176227    }
    177228

  • admin-safety-guard/tags/1.1.3/readme.txt

    r3401254 r3402233  
    55Tested up to: 6.8
    66Requires PHP: 7.0
    7 Stable tag: 1.1.2
     7Stable tag: 1.1.3
    88License: GPLv3 or later
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    150150== Changelog ==
    151151
     152= 1.1.3 =
     153* Fixed an issue where OTP-verified logins could result in session cookies instead of persistent cookies.
     154* Refactored OTP verification to run earlier in the login flow via `login_init`.
     155* Updated the authentication process to use `wp_signon()` so WordPress handles Remember Me cookies correctly.
     156* Tested across multiple environments and browsers to confirm expected cookie expiration behavior.
     157* Minor improvements and stability adjustments.
     158
     159= 1.1.3 =
     160* [fix] - Resolved persistent login cookie issue after OTP verification in certain environments.
     161* [fix] - OTP validation now runs earlier (`login_init`) to prevent headers already sent & session cookie fallback.
     162* [Improved] - Login is now completed through `wp_signon()` to let WordPress handle full cookie generation reliably.
     163* [Improved] - Tested across multiple environments and browsers for consistent persistent cookie behavior.
     164
     165
    152166= 1.1.2 =
    153167* [fix] - 2FA login cookie session issue when OTP verification completed.

  • admin-safety-guard/trunk/admin-safety-guard.php

    r3401254 r3402233  
    44Plugin URI: http://themepaste.com/product/themepaste-secure-admin-pro/
    55Description: Secure your WordPress login with Admin safety guard to ensure secured access with limit login attempts, 2FA, reCaptcha, IP Blocking, Disable XML-RPC and activity tracking.
    6 Version: 1.1.2
     6Version: 1.1.3
    77Author: Themepaste Team
    88Author URI: http://themepaste.com/
    … …  
    3939        define( 'TPSA_PLUGIN_FILE', __FILE__ );
    4040        define( 'TPSA_PREFIX', 'tpsa' );
    41         define( 'TPSA_PLUGIN_VERSION', '1.1.2' );
     41        define( 'TPSA_PLUGIN_VERSION', '1.1.3' );
    4242        define( 'TPSA_PLUGIN_DIRNAME', dirname( TPSA_PLUGIN_FILE ) );
    4343        define( 'TPSA_PLUGIN_BASENAME', plugin_basename( TPSA_PLUGIN_FILE ) );

  • admin-safety-guard/trunk/app/Classes/Features/TwoFactorAuth.php

    r3401251 r3402233  
    4646
    4747        if ( $this->is_enabled( $settings, 'otp-email' ) ) {
    48             $this->action( 'login_form', [$this, 'check_otp_submission'] );
     48            // Process OTP submission as early as possible (before HTML output).
     49            $this->action( 'login_init', [$this, 'check_otp_submission'] );
     50
     51            // Render OTP UI on the login form.
    4952            $this->action( 'login_form', [$this, 'render_otp_input'] );
     53
     54            // Intercept username/password login to send OTP first.
    5055            $this->filter( 'authenticate', [$this, 'intercept_login_with_otp'], 30, 3 );
    5156        }
    … …  
    125130}
    126131</style>
     132
    127133<div id="tpsa_otp_wrap">
    128     <label for="tpsa_otp_field"><?php echo esc_html__( 'One Time Password', 'tp-secure-plugin' ); ?></label>
     134    <label for="tpsa_otp_field">
     135        <?php echo esc_html__( 'One Time Password', 'tp-secure-plugin' ); ?>
     136    </label>
    129137    <input type="hidden" name="tpsa_user_id" value="<?php echo esc_attr( $user_id ); ?>">
    130138    <input type="hidden" name="tpsa_otp_verify" value="1">
    … …  
    133141    <?php $this->sent_email_message( $user ); ?>
    134142</div>
    135 <button type="submit" id="tpsa_verify_btn"><?php echo esc_html__( 'Verify OTP', 'tp-secure-plugin' ); ?></button>
     143<button type="submit" id="tpsa_verify_btn">
     144    <?php echo esc_html__( 'Verify OTP', 'tp-secure-plugin' ); ?>
     145</button>
    136146<?php
    137147}
    138148
    139149    /**
    140      * Check OTP submission on login form.
     150     * Check OTP submission on login (runs on login_init).
    141151     *
    142152     * @return void
    … …  
    156166        $stored_data = get_user_meta( $user_id, '_tpsa_otp_code', true );
    157167        $stored_otp = isset( $stored_data['otp'] ) ? $stored_data['otp'] : '';
     168
     169        if ( $otp_input !== $stored_otp ) {
     170            // Display error message above the form.
     171            add_action(
     172                'login_message',
     173                function () {
     174                    echo '<div style="color:red; margin-bottom:10px;">' .
     175                    esc_html__( 'Invalid OTP. Please try again.', 'tp-secure-plugin' ) .
     176                        '</div>';
     177                }
     178            );
     179            return;
     180        }
     181
     182        // OTP is correct – now perform a proper WordPress login using wp_signon().
     183        $username = isset( $stored_data['username'] ) ? $stored_data['username'] : '';
     184        $password = isset( $stored_data['password'] ) ? $stored_data['password'] : '';
    158185        $remember = !empty( $stored_data['remember'] );
    159186
    160         if ( $otp_input === $stored_otp ) {
    161             // Clean up OTP data.
    162             delete_user_meta( $user_id, '_tpsa_otp_code' );
    163 
    164             // Log user in with correct persistence.
    165             wp_set_auth_cookie( $user_id, $remember );
    166             wp_set_current_user( $user_id );
    167 
    168             wp_redirect( admin_url() );
    169             exit;
    170         } else {
    171             // Display error message above the form.
    172             add_action( 'login_message', function () {
    173                 echo '<div style="color:red; margin-bottom:10px;">' . esc_html__( 'Invalid OTP. Please try again.', 'tp-secure-plugin' ) . '</div>';
    174             } );
    175         }
     187        // Clean up OTP data.
     188        delete_user_meta( $user_id, '_tpsa_otp_code' );
     189
     190        if ( empty( $username ) || empty( $password ) ) {
     191            add_action(
     192                'login_message',
     193                function () {
     194                    echo '<div style="color:red; margin-bottom:10px;">' .
     195                    esc_html__( 'Login data missing. Please try logging in again.', 'tp-secure-plugin' ) .
     196                        '</div>';
     197                }
     198            );
     199            return;
     200        }
     201
     202        $creds = [
     203            'user_login'    => $username,
     204            'user_password' => $password,
     205            'remember'      => $remember,
     206        ];
     207
     208        // Let WordPress handle auth, cookies, tokens, Remember Me, etc.
     209        $secure_cookie = is_ssl();
     210        $user = wp_signon( $creds, $secure_cookie );
     211
     212        if ( is_wp_error( $user ) ) {
     213            add_action(
     214                'login_message',
     215                function () {
     216                    echo '<div style="color:red; margin-bottom:10px;">' .
     217                    esc_html__( 'Login failed after OTP verification. Please try again.', 'tp-secure-plugin' ) .
     218                        '</div>';
     219                }
     220            );
     221            return;
     222        }
     223
     224        // Successful login, redirect to admin.
     225        wp_safe_redirect( admin_url() );
     226        exit;
    176227    }
    177228

  • admin-safety-guard/trunk/readme.txt

    r3401254 r3402233  
    55Tested up to: 6.8
    66Requires PHP: 7.0
    7 Stable tag: 1.1.2
     7Stable tag: 1.1.3
    88License: GPLv3 or later
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    150150== Changelog ==
    151151
     152= 1.1.3 =
     153* Fixed an issue where OTP-verified logins could result in session cookies instead of persistent cookies.
     154* Refactored OTP verification to run earlier in the login flow via `login_init`.
     155* Updated the authentication process to use `wp_signon()` so WordPress handles Remember Me cookies correctly.
     156* Tested across multiple environments and browsers to confirm expected cookie expiration behavior.
     157* Minor improvements and stability adjustments.
     158
     159= 1.1.3 =
     160* [fix] - Resolved persistent login cookie issue after OTP verification in certain environments.
     161* [fix] - OTP validation now runs earlier (`login_init`) to prevent headers already sent & session cookie fallback.
     162* [Improved] - Login is now completed through `wp_signon()` to let WordPress handle full cookie generation reliably.
     163* [Improved] - Tested across multiple environments and browsers for consistent persistent cookie behavior.
     164
     165
    152166= 1.1.2 =
    153167* [fix] - 2FA login cookie session issue when OTP verification completed.
Note: See TracChangeset for help on using the changeset viewer.