WordPress.org
Get WordPress

Plugin Directory

Changeset 3452630


Ignore:
Timestamp:
02/03/2026 07:33:19 AM (5 weeks ago)
Author:
basecloud
Message:

Update to version 1.2.8 from GitHub

Location:
basecloud-shield
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • basecloud-shield/tags/1.2.8/CHANGELOG.md

    r3452601 r3452630  
    22
    33All notable changes to BaseCloud Shield will be documented in this file.
     4
     5## [1.2.8] - 2026-02-03
     6
     7### 🔥 Critical Hotfix
     8- **FIXED**: "Suspicious session detected" error blocking legitimate logins
     9- **FIXED**: Session token validation now works correctly
     10- Session token generation now uses consistent secret instead of time-based
     11- Users can successfully complete login flow without false security alerts
     12
     13### ✨ Improvements
     14- Enhanced OTP lock mechanism to prevent unnecessary duplicate OTP generation
     15- Existing valid OTP is reused if user attempts login multiple times
     16- Better handling of page refreshes during OTP verification process
     17- Reduced false positive security alerts for legitimate users
     18
     19### 🐛 Bug Fixes
     20- Session token mismatch that was flagging all logins as suspicious
     21- OTP lock mechanism now properly redirects to verification page
    422
    523## [1.2.7] - 2026-02-03

  • basecloud-shield/tags/1.2.8/basecloud-shield.php

    r3452601 r3452630  
    33 * Plugin Name:       BaseCloud Shield
    44 * Description:       Enterprise-grade 2FA security. Supports Central Manager Notifications, WP Email, SendGrid, WhatsApp, SMS, and Webhooks.
    5  * Version:           1.2.7
     5 * Version:           1.2.8
    66 * Author:            BaseCloud Team
    77 * Author URI:        https://www.basecloudglobal.com/
    … …  
    1515if (!defined('ABSPATH')) { exit; }
    1616
    17 define('BCSHIELD_VERSION', '1.2.7');
     17define('BCSHIELD_VERSION', '1.2.8');
    1818define('BCSHIELD_MAX_ATTEMPTS', 5);
    1919define('BCSHIELD_LOCKOUT_DURATION', 900);
    … …  
    142142        // Prevent duplicate OTP generation (lock mechanism)
    143143        $lock_key = 'bcshield_otp_lock_' . $user->ID;
    144         if (get_transient($lock_key)) {
    145             // OTP already generated recently, skip duplicate
    146             return $user;
     144        $existing_otp = get_transient('bcshield_otp_' . $user->ID);
     145       
     146        // If OTP already exists and is valid, redirect to verification page without generating new OTP
     147        if ($existing_otp && get_transient($lock_key)) {
     148            $session_token = $this->generate_session_token($user->ID, $client_ip, $user_agent);
     149            setcookie('bcshield_pending_user', $user->ID, time() + ($opts['otp_validity'] ?? 10) * 60, '/', '', true, true);
     150            setcookie('bcshield_session', $session_token, time() + ($opts['otp_validity'] ?? 10) * 60, '/', '', true, true);
     151           
     152            $base_url = site_url();
     153            $redirect = add_query_arg('bcshield_action', 'verify_otp', $base_url);
     154            wp_redirect($redirect);
     155            exit;
    147156        }
    148157       
    … …  
    301310   
    302311    private function generate_session_token($user_id, $ip, $user_agent) {
    303         $secret = wp_salt('nonce') . time();
     312        // Use a consistent secret (not time-based) so token remains valid during OTP entry
     313        $secret = wp_salt('nonce') . BCSHIELD_VERSION;
    304314        return hash_hmac('sha256', $user_id . $ip . $user_agent, $secret);
    305315    }

  • basecloud-shield/tags/1.2.8/package.json

    r3452601 r3452630  
    11{
    22  "name": "basecloud-shield",
    3   "version": "1.2.7",
     3  "version": "1.2.8",
    44  "description": "WordPress 2FA Security Plugin - Build and deployment scripts",
    55  "scripts": {

  • basecloud-shield/tags/1.2.8/readme.txt

    r3452601 r3452630  
    44Requires at least: 5.0
    55Tested up to: 6.9
    6 Stable tag: 1.2.7
     6Stable tag: 1.2.8
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    118118
    119119== Changelog ==
     120
     121= 1.2.8 =
     122**Critical Hotfix - Login Issue Resolved**
     123
     124**CRITICAL FIX:**
     125• Fixed "Suspicious session detected" blocking legitimate logins
     126• Session token now uses consistent secret (not time-based)
     127• Users can now successfully complete login with OTP
     128
     129**Improvements:**
     130• Enhanced OTP lock mechanism to prevent duplicate generation
     131• Existing valid OTP reused if login attempted multiple times
     132• Better handling of page refreshes during OTP verification
     133• Reduced false positive security alerts
    120134
    121135= 1.2.7 =

  • basecloud-shield/trunk/CHANGELOG.md

    r3452601 r3452630  
    22
    33All notable changes to BaseCloud Shield will be documented in this file.
     4
     5## [1.2.8] - 2026-02-03
     6
     7### 🔥 Critical Hotfix
     8- **FIXED**: "Suspicious session detected" error blocking legitimate logins
     9- **FIXED**: Session token validation now works correctly
     10- Session token generation now uses consistent secret instead of time-based
     11- Users can successfully complete login flow without false security alerts
     12
     13### ✨ Improvements
     14- Enhanced OTP lock mechanism to prevent unnecessary duplicate OTP generation
     15- Existing valid OTP is reused if user attempts login multiple times
     16- Better handling of page refreshes during OTP verification process
     17- Reduced false positive security alerts for legitimate users
     18
     19### 🐛 Bug Fixes
     20- Session token mismatch that was flagging all logins as suspicious
     21- OTP lock mechanism now properly redirects to verification page
    422
    523## [1.2.7] - 2026-02-03

  • basecloud-shield/trunk/basecloud-shield.php

    r3452601 r3452630  
    33 * Plugin Name:       BaseCloud Shield
    44 * Description:       Enterprise-grade 2FA security. Supports Central Manager Notifications, WP Email, SendGrid, WhatsApp, SMS, and Webhooks.
    5  * Version:           1.2.7
     5 * Version:           1.2.8
    66 * Author:            BaseCloud Team
    77 * Author URI:        https://www.basecloudglobal.com/
    … …  
    1515if (!defined('ABSPATH')) { exit; }
    1616
    17 define('BCSHIELD_VERSION', '1.2.7');
     17define('BCSHIELD_VERSION', '1.2.8');
    1818define('BCSHIELD_MAX_ATTEMPTS', 5);
    1919define('BCSHIELD_LOCKOUT_DURATION', 900);
    … …  
    142142        // Prevent duplicate OTP generation (lock mechanism)
    143143        $lock_key = 'bcshield_otp_lock_' . $user->ID;
    144         if (get_transient($lock_key)) {
    145             // OTP already generated recently, skip duplicate
    146             return $user;
     144        $existing_otp = get_transient('bcshield_otp_' . $user->ID);
     145       
     146        // If OTP already exists and is valid, redirect to verification page without generating new OTP
     147        if ($existing_otp && get_transient($lock_key)) {
     148            $session_token = $this->generate_session_token($user->ID, $client_ip, $user_agent);
     149            setcookie('bcshield_pending_user', $user->ID, time() + ($opts['otp_validity'] ?? 10) * 60, '/', '', true, true);
     150            setcookie('bcshield_session', $session_token, time() + ($opts['otp_validity'] ?? 10) * 60, '/', '', true, true);
     151           
     152            $base_url = site_url();
     153            $redirect = add_query_arg('bcshield_action', 'verify_otp', $base_url);
     154            wp_redirect($redirect);
     155            exit;
    147156        }
    148157       
    … …  
    301310   
    302311    private function generate_session_token($user_id, $ip, $user_agent) {
    303         $secret = wp_salt('nonce') . time();
     312        // Use a consistent secret (not time-based) so token remains valid during OTP entry
     313        $secret = wp_salt('nonce') . BCSHIELD_VERSION;
    304314        return hash_hmac('sha256', $user_id . $ip . $user_agent, $secret);
    305315    }

  • basecloud-shield/trunk/package.json

    r3452601 r3452630  
    11{
    22  "name": "basecloud-shield",
    3   "version": "1.2.7",
     3  "version": "1.2.8",
    44  "description": "WordPress 2FA Security Plugin - Build and deployment scripts",
    55  "scripts": {

  • basecloud-shield/trunk/readme.txt

    r3452601 r3452630  
    44Requires at least: 5.0
    55Tested up to: 6.9
    6 Stable tag: 1.2.7
     6Stable tag: 1.2.8
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    118118
    119119== Changelog ==
     120
     121= 1.2.8 =
     122**Critical Hotfix - Login Issue Resolved**
     123
     124**CRITICAL FIX:**
     125• Fixed "Suspicious session detected" blocking legitimate logins
     126• Session token now uses consistent secret (not time-based)
     127• Users can now successfully complete login with OTP
     128
     129**Improvements:**
     130• Enhanced OTP lock mechanism to prevent duplicate generation
     131• Existing valid OTP reused if login attempted multiple times
     132• Better handling of page refreshes during OTP verification
     133• Reduced false positive security alerts
    120134
    121135= 1.2.7 =
Note: See TracChangeset for help on using the changeset viewer.