From f9c073a582ec5726350944d465b73174dc6582cf Mon Sep 17 00:00:00 2001 From: Javier Casares Date: Thu, 17 Sep 2026 10:58:22 +0000 Subject: [PATCH] v1.6.6 --- changelog.txt | 20 ++++++++ includes/user/class-profile-settings.php | 60 ++++++++++++++++++++++++ readme.txt | 22 ++++----- robotstxt-2fa.php | 4 +- vendor/composer/installed.php | 4 +- 5 files changed, 93 insertions(+), 17 deletions(-) diff --git a/changelog.txt b/changelog.txt index 1e0e2bf..0c678d8 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,25 @@ == Changelog == += 1.6.6 = + +_Release date: 2026-09-17_ + +**Added** + +* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days. + +**Compatibility** + +* WordPress: 5.6 – 7.1 +* PHP: 8.0 – 8.5 + +**Tests** + +* PHP Coding Standards: PHP_CodeSniffer 3.13.6 / WPCS 3.4.1 — 0 errors +* PHPStan: level 9 — 0 errors +* PHPCompatibility: 8.0–8.5 — 0 issues +* PHPUnit: 9.6.36 — 93 tests, 189 assertions + = 1.6.5 = _Release date: 2026-09-17_ diff --git a/includes/user/class-profile-settings.php b/includes/user/class-profile-settings.php index ff2ceb8..f136ca0 100644 --- a/includes/user/class-profile-settings.php +++ b/includes/user/class-profile-settings.php @@ -97,6 +97,13 @@ class Profile_Settings { */ private Trusted_Devices $trusted_devices; + /** + * Grace period manager. + * + * @var Grace_Period + */ + private Grace_Period $grace_period; + /** * Whether the post-save redirect should focus the 2FA section. * @@ -113,6 +120,7 @@ class Profile_Settings { $this->otp_manager = new OTP_Manager(); $this->recovery_codes = new Recovery_Codes(); $this->trusted_devices = new Trusted_Devices(); + $this->grace_period = new Grace_Period(); } /** @@ -170,6 +178,57 @@ class Profile_Settings { } + /** + * Render the forced-enrollment warning on the profile 2FA section. + * + * Shown when the user's role enforces 2FA but no verification method is + * configured yet, so the requirement is visible before the login flow + * (grace notice, setup wizard, or login block) kicks in. When a grace + * period is active, the number of remaining days is appended. + * + * @since 1.6.6 + * + * @param \WP_User $user User whose profile section is being rendered. + * + * @return void + */ + public function render_forced_enrollment_warning( \WP_User $user ): void { + $user_settings = $this->user_settings_repository->get_user_settings( $user->ID ); + + if ( empty( $this->config->get_required_methods_for_user( $user ) ) || ! empty( $user_settings['methods'] ) ) { + return; + } + + $grace_note = ''; + $grace_days = $this->config->get_grace_period_days(); + + if ( $grace_days > 0 && $this->grace_period->is_active( $user, $grace_days ) ) { + $remaining = $this->grace_period->get_days_remaining( $user, $grace_days ); + + /* translators: %d: number of days remaining to complete the setup. */ + $grace_note = sprintf( + _n( + 'You have %d day left to complete the setup.', + 'You have %d days left to complete the setup.', + $remaining, + 'robotstxt-2fa' + ), + $remaining + ); + } + ?> +
+

+ + + + + +

+
+

+ render_forced_enrollment_warning( $user ); ?> diff --git a/readme.txt b/readme.txt index 9526647..c42cca4 100644 --- a/readme.txt +++ b/readme.txt @@ -4,7 +4,7 @@ Tags: security, two-factor authentication, login, otp Requires at least: 5.6 Tested up to: 7.0 Requires PHP: 8.0 -Stable tag: 1.6.5 +Stable tag: 1.6.6 License: GPLv3 or later License URI: https://www.gnu.org/licenses/gpl-3.0.html @@ -59,6 +59,14 @@ Yes. Activate the plugin at the network level. Network administrators can set an == Changelog == += 1.6.6 = + +_Release date: 2026-09-17_ + +**Added** + +* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days. + = 1.6.5 = _Release date: 2026-09-17_ @@ -76,18 +84,6 @@ _Release date: 2026-09-11_ * Compatibility with Restrict Content Pro's "Hijack Login URL" option: RCP's `login_url` filter made every `wp_login_url()` call return a membership page, so the 2FA verification redirect landed on a restricted page where the verification form cannot render, and the visitor was bounced to the registration page. Verification-stage URLs are now built from the canonical `wp-login.php`, mirroring WordPress core's URL construction before the filterable output. The "Back to login" link keeps the site-configured login URL. -= 1.6.3 = - -_Release date: 2026-08-24_ - -**Changed** - -* Manager detection now uses the ecosystem presence constant (`ROBOTSTXT_MANAGER_NOTICED`, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions. - -**Fixed** - -* Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check. - = Previous versions = For the full changelog see the [changelog](https://www.robotstxt.software/plugins/robotstxt-2fa/) page. diff --git a/robotstxt-2fa.php b/robotstxt-2fa.php index 3c1d9a4..8ff56f1 100644 --- a/robotstxt-2fa.php +++ b/robotstxt-2fa.php @@ -4,7 +4,7 @@ * Plugin URI: https://www.robotstxt.software/plugins/robotstxt-2fa/ * Update URI: https://www.robotstxt.software/plugins/robotstxt-2fa/ * Description: Adds two-factor authentication to the WordPress login flow. - * Version: 1.6.5 + * Version: 1.6.6 * Author: ROBOTSTXT * Author URI: https://www.robotstxt.software/ * Text Domain: robotstxt-2fa @@ -25,7 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) { } if ( ! defined( 'ROBOTSTXT_2FA_VERSION' ) ) { - define( 'ROBOTSTXT_2FA_VERSION', '1.6.5' ); + define( 'ROBOTSTXT_2FA_VERSION', '1.6.6' ); } if ( ! defined( 'ROBOTSTXT_2FA_FILE' ) ) { diff --git a/vendor/composer/installed.php b/vendor/composer/installed.php index 292a775..7328496 100644 --- a/vendor/composer/installed.php +++ b/vendor/composer/installed.php @@ -3,7 +3,7 @@ 'name' => 'robotstxt/robotstxt-2fa', 'pretty_version' => 'dev-main', 'version' => 'dev-main', - 'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5', + 'reference' => 'f1d493aefc9da797d99b3b635736b6c627166ddf', 'type' => 'wordpress-plugin', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), @@ -40,7 +40,7 @@ 'robotstxt/robotstxt-2fa' => array( 'pretty_version' => 'dev-main', 'version' => 'dev-main', - 'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5', + 'reference' => 'f1d493aefc9da797d99b3b635736b6c627166ddf', 'type' => 'wordpress-plugin', 'install_path' => __DIR__ . '/../../', 'aliases' => array(),