ROBOTSTXT/robotstxt-2fa
Watch
8
0
Fork
You've already forked robotstxt-2fa
 0
Code Issues Pull requests Projects Releases 17 Packages Wiki Activity Actions

v1.6.3

Browse source
This commit is contained in:
Javier Casares 2026-08-24 08:18:14 +00:00
commit 511d2fefae
7 changed files with 103 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

29
readme.txt
View file

@ -4,7 +4,7 @@ Tags: security, two-factor authentication, login, otp
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.6.2
Stable tag: 1.6.3
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html
@ -59,6 +59,18 @@ Yes. Activate the plugin at the network level. Network administrators can set an
== Changelog ==
= 1.6.3 =
_Release date: 2026-08-24_
**Changed**
* Manager detection now uses the ecosystem presence constant (`ROBOTSTXT_MANAGER_NOTICED`, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions.
**Fixed**
* Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check.
= 1.6.2 =
_Release date: 2026-08-17_
@ -81,21 +93,6 @@ _Release date: 2026-08-14_
* Fatal error during editor autosaves: the `[robotstxt_2fa_profile]` shortcode expanded when WordPress applied content filters to a post revision via REST (for example, an article that merely mentions the shortcode in its text). In that context the wp-admin render helpers are not loaded, causing a fatal error. The shortcode now bails out early on REST requests and loads the required wp-admin includes on demand elsewhere.
= 1.6.0 =
_Release date: 2026-08-07_
**Added**
* REST API for administrators (namespace `robotstxt-2fa/v1`, all endpoints require `manage_options`):
* `GET /wp-json/robotstxt-2fa/v1/settings` — read the full 2FA configuration.
* `PUT /wp-json/robotstxt-2fa/v1/settings` — update the configuration (reuses the same validation as the admin settings form).
* `GET /wp-json/robotstxt-2fa/v1/users?role=<slug>&status=<enabled|required|disabled>` — list every user with their 2FA status: enabled, configured methods, role-required methods, forced flag, frequency, preferred method, whether OTP is set up, and unused recovery code count. No secrets are exposed.
**Changed**
* `wp 2fa list` now shows separate **Enabled**, **Methods** (configured), and **Required** (role-enforced) columns, plus a new `--required` filter to list only users whose role enforces 2FA.
= Previous versions =
For the full changelog see the [changelog](https://www.robotstxt.software/plugins/robotstxt-2fa/) page.