v1.1.1

changelog.txt

@@ -1,5 +1,24 @@
 == Changelog ==
 
+= 1.1.1 =
+
+_Release date: 2026-03-28_
+
+**Fixed**
+
+* Version constant mismatch: `TWO_FACTOR_EXTENDED_VERSION` was `1.0.2` instead of `1.1.0`.
+* Replaced `current_time('timestamp')` with `time()` in audit log and settings export to ensure UTC-correct timestamps.
+* Added `wp_unslash()` before sanitizing `$_GET['tab']` in the settings page renderer.
+
+**Compatibility**
+
+* WordPress: 6.8, 6.9, 7.0
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+* Tested on WordPress 7.0, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
+
 = 1.1.0 =
 
 _Release date: 2026-03-28_

includes/class-audit-log.php

@@ -86,7 +86,7 @@ class Two_Factor_Extended_Audit_Log {
 		$logs = $this->get_logs();
 
 		$log_entry = array(
-			'timestamp'   => current_time( 'timestamp' ),
+			'timestamp'   => time(),
 			'action'      => sanitize_key( $action ),
 			'description' => sanitize_text_field( $description ),
 			'user_id'     => $user_id,
@@ -302,7 +302,7 @@ class Two_Factor_Extended_Audit_Log {
 	 */
 	public function cleanup_old_logs(): void {
 		$logs        = $this->get_logs();
-		$cutoff_time = current_time( 'timestamp' ) - ( self::RETENTION_DAYS * DAY_IN_SECONDS );
+		$cutoff_time = time() - ( self::RETENTION_DAYS * DAY_IN_SECONDS );
 
 		$filtered_logs = array_filter(
 			$logs,
@@ -429,7 +429,7 @@ class Two_Factor_Extended_Audit_Log {
 			'recent_count' => 0,
 		);
 
-		$recent_cutoff = current_time( 'timestamp' ) - ( 7 * DAY_IN_SECONDS );
+		$recent_cutoff = time() - ( 7 * DAY_IN_SECONDS );
 
 		foreach ( $logs as $log ) {
 			$action = isset( $log['action'] ) && is_string( $log['action'] ) ? $log['action'] : '';

includes/class-settings.php

@@ -769,7 +769,7 @@ class Two_Factor_Extended_Settings {
 
 			$export_data = array(
 				'version'   => TWO_FACTOR_EXTENDED_VERSION,
-				'timestamp' => current_time( 'timestamp' ),
+				'timestamp' => time(),
 				'settings'  => $settings,
 			);
 
@@ -968,9 +968,8 @@ class Two_Factor_Extended_Settings {
 		}
 
 		// Get current tab.
-		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tab parameter for UI navigation
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tab parameter for UI navigation; no state change
-		$tab_param   = isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) ? $_GET['tab'] : '';
+		$current_tab = isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'settings';
-		$current_tab = $tab_param ? sanitize_key( $tab_param ) : 'settings';
 
 		// Define tabs.
 		$tabs = array(

install-wp-tests.sh

@@ -0,0 +1,314 @@
+#!/usr/bin/env bash
+
+# See https://raw.githubusercontent.com/wp-cli/scaffold-command/master/templates/install-wp-tests.sh
+
+# Set up colors for output
+RED="\033[0;31m"
+GREEN="\033[0;32m"
+YELLOW="\033[0;33m"
+CYAN="\033[0;36m"
+RESET="\033[0m"
+
+if [ $# -lt 3 ]; then
+	echo -e "${YELLOW}Usage:${RESET} $0 <db-name> <db-user> <db-pass> [db-host] [wp-version] [skip-database-creation]"
+	exit 1
+fi
+
+DB_NAME=$1
+DB_USER=$2
+DB_PASS=$3
+DB_HOST=${4-localhost}
+WP_VERSION=${5-latest}
+SKIP_DB_CREATE=${6-false}
+
+TMPDIR=${TMPDIR-/tmp}
+TMPDIR=$(echo $TMPDIR | sed -e "s/\/$//")
+WP_TESTS_DIR=${WP_TESTS_DIR-$TMPDIR/wordpress-tests-lib}
+WP_TESTS_FILE="$WP_TESTS_DIR"/includes/functions.php
+WP_CORE_DIR=${WP_CORE_DIR-$TMPDIR/wordpress}
+WP_CORE_FILE="$WP_CORE_DIR"/wp-settings.php
+
+download() {
+    if command -v curl > /dev/null 2>&1; then
+        curl -L -s "$1" > "$2";
+        return $?
+    elif command -v wget > /dev/null 2>&1; then
+        wget -nv -O "$2" "$1"
+        return $?
+    else
+        echo -e "${RED}Error: Neither curl nor wget is installed.${RESET}"
+        exit 1
+    fi
+}
+
+check_for_updates() {
+	local remote_url="https://raw.githubusercontent.com/wp-cli/scaffold-command/main/templates/install-wp-tests.sh"
+	local tmp_script="$TMPDIR/install-wp-tests.sh.latest"
+
+	if ! download "$remote_url" "$tmp_script"; then
+		echo -e "${YELLOW}Warning: Failed to download the latest version of the script for update check.${RESET}"
+		return
+	fi
+
+	if [ ! -f "$tmp_script" ] || [ ! -s "$tmp_script" ]; then
+		echo -e "${YELLOW}Warning: Downloaded script is missing or empty, cannot check for updates.${RESET}"
+		rm -f "$tmp_script"
+		return
+	fi
+
+	local local_hash=""
+	local remote_hash=""
+
+	if command -v shasum > /dev/null; then
+		local_hash=$(shasum -a 256 "$0" | awk '{print $1}')
+		remote_hash=$(shasum -a 256 "$tmp_script" | awk '{print $1}')
+	elif command -v sha256sum > /dev/null; then
+		local_hash=$(sha256sum "$0" | awk '{print $1}')
+		remote_hash=$(sha256sum "$tmp_script" | awk '{print $1}')
+	else
+		echo -e "${YELLOW}Warning: Could not find shasum or sha256sum to check for script updates.${RESET}"
+		rm "$tmp_script"
+		return
+	fi
+
+	rm "$tmp_script"
+
+	if [ "$local_hash" != "$remote_hash" ]; then
+		echo -e "${YELLOW}Warning: A newer version of this script is available at $remote_url${RESET}"
+	fi
+}
+# Allow disabling the update check by setting WP_INSTALL_TESTS_SKIP_UPDATE_CHECK=true in the environment.
+if [ "${WP_INSTALL_TESTS_SKIP_UPDATE_CHECK:-false}" != "true" ]; then
+	check_for_updates
+fi
+
+if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then
+	WP_BRANCH=${WP_VERSION%\-*}
+	WP_TESTS_TAG="branches/$WP_BRANCH"
+elif [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then
+	WP_TESTS_TAG="branches/$WP_VERSION"
+elif [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0-9]+ ]]; then
+	if [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0] ]]; then
+		# version x.x.0 means the first release of the major version, so strip off the .0 and download version x.x
+		WP_TESTS_TAG="tags/${WP_VERSION%??}"
+	else
+		WP_TESTS_TAG="tags/$WP_VERSION"
+	fi
+elif [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
+	WP_TESTS_TAG="trunk"
+else
+	# http serves a single offer, whereas https serves multiple. we only want one
+	download http://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
+	LATEST_VERSION=$(grep -oE '"version":"[^"]*' /tmp/wp-latest.json | head -n 1 | sed 's/"version":"//')
+	if [[ -z "$LATEST_VERSION" ]]; then
+		echo -e "${RED}Error: Latest WordPress version could not be found.${RESET}"
+		exit 1
+	fi
+	# The version-check endpoint returns major.minor (e.g., 6.9), but GitHub tags include the patch version (e.g., 6.9.0)
+	if [[ $LATEST_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then
+		LATEST_VERSION="${LATEST_VERSION}.0"
+	fi
+	WP_TESTS_TAG="tags/$LATEST_VERSION"
+fi
+
+set -ex
+
+install_wp() {
+
+	if [ -f $WP_CORE_FILE ]; then
+		echo -e "${CYAN}WordPress is already installed.${RESET}"
+		return;
+	fi
+
+	echo -e "${CYAN}Installing WordPress...${RESET}"
+
+	rm -rf $WP_CORE_DIR
+	mkdir -p $WP_CORE_DIR
+
+	if [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
+		download https://github.com/WordPress/wordpress/archive/refs/heads/master.tar.gz $TMPDIR/wordpress.tar.gz
+		tar --strip-components=1 -zxmf $TMPDIR/wordpress.tar.gz -C $WP_CORE_DIR
+	else
+		if [ $WP_VERSION == 'latest' ]; then
+			local ARCHIVE_NAME='latest'
+		elif [[ $WP_VERSION =~ [0-9]+\.[0-9]+ ]]; then
+			# https serves multiple offers, whereas http serves single.
+			download https://api.wordpress.org/core/version-check/1.7/ $TMPDIR/wp-latest.json
+			if [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0] ]]; then
+				# version x.x.0 means the first release of the major version, so strip off the .0 and download version x.x
+				LATEST_VERSION=${WP_VERSION%??}
+			else
+				# otherwise, scan the releases and get the most up to date minor version of the major release
+				local VERSION_ESCAPED=`echo $WP_VERSION | sed 's/\./\\\\./g'`
+				LATEST_VERSION=$(grep -o '"version":"'$VERSION_ESCAPED'[^"]*' $TMPDIR/wp-latest.json | sed 's/"version":"//' | head -1)
+			fi
+			if [[ -z "$LATEST_VERSION" ]]; then
+				local ARCHIVE_NAME="wordpress-$WP_VERSION"
+			else
+				local ARCHIVE_NAME="wordpress-$LATEST_VERSION"
+			fi
+		else
+			local ARCHIVE_NAME="wordpress-$WP_VERSION"
+		fi
+		download https://wordpress.org/${ARCHIVE_NAME}.tar.gz  $TMPDIR/wordpress.tar.gz
+		tar --strip-components=1 -zxmf $TMPDIR/wordpress.tar.gz -C $WP_CORE_DIR
+	fi
+	echo -e "${GREEN}WordPress installed successfully.${RESET}"
+}
+
+install_test_suite() {
+	# portable in-place argument for both GNU sed and Mac OSX sed
+	if [[ $(uname -s) == 'Darwin' ]]; then
+		local ioption='-i.bak'
+	else
+		local ioption='-i'
+	fi
+
+	# set up testing suite if it doesn't yet exist or only partially exists
+	if [ ! -f $WP_TESTS_FILE ]; then
+		echo -e "${CYAN}Installing test suite...${RESET}"
+		# set up testing suite
+		rm -rf $WP_TESTS_DIR
+		mkdir -p $WP_TESTS_DIR
+
+		if [[ $WP_TESTS_TAG == 'trunk' ]]; then
+			ref=trunk
+			archive_url="https://github.com/WordPress/wordpress-develop/archive/refs/heads/${ref}.tar.gz"
+		elif [[ $WP_TESTS_TAG == branches/* ]]; then
+			ref=${WP_TESTS_TAG#branches/}
+			archive_url="https://github.com/WordPress/wordpress-develop/archive/refs/heads/${ref}.tar.gz"
+		else
+			ref=${WP_TESTS_TAG#tags/}
+			archive_url="https://github.com/WordPress/wordpress-develop/archive/refs/tags/${ref}.tar.gz"
+		fi
+
+		if [ -z "$ref" ]; then
+			echo -e "${RED}Error:${RESET} Unable to determine git reference from WP_TESTS_TAG: $WP_TESTS_TAG"
+			exit 1
+		fi
+
+		download "${archive_url}" "$TMPDIR/wordpress-develop.tar.gz"
+
+		# Validate that the tarball was downloaded correctly before extracting
+		if [ ! -s "$TMPDIR/wordpress-develop.tar.gz" ]; then
+			echo -e "${RED}Error:${RESET} Downloaded test suite archive is missing or empty: $TMPDIR/wordpress-develop.tar.gz"
+			exit 1
+		fi
+
+		if ! tar -tzf "$TMPDIR/wordpress-develop.tar.gz" >/dev/null 2>&1; then
+			echo -e "${RED}Error:${RESET} Downloaded test suite archive is not a valid tar.gz file: $TMPDIR/wordpress-develop.tar.gz"
+			exit 1
+		fi
+
+		tar -zxmf "$TMPDIR/wordpress-develop.tar.gz" -C "$TMPDIR"
+		mv "$TMPDIR/wordpress-develop-${ref}/tests/phpunit/includes" "$WP_TESTS_DIR"/
+		mv "$TMPDIR/wordpress-develop-${ref}/tests/phpunit/data" "$WP_TESTS_DIR"/
+		rm -rf "$TMPDIR/wordpress-develop-${ref}"
+		rm "$TMPDIR/wordpress-develop.tar.gz"
+		echo -e "${GREEN}Test suite installed.${RESET}"
+	else
+		echo -e "${CYAN}Test suite is already installed.${RESET}"
+	fi
+
+	if [ ! -f "$WP_TESTS_DIR"/wp-tests-config.php ]; then
+		echo -e "${CYAN}Configuring test suite...${RESET}"
+		if [[ $WP_TESTS_TAG == 'trunk' ]]; then
+			ref=trunk
+		elif [[ $WP_TESTS_TAG == branches/* ]]; then
+			ref=${WP_TESTS_TAG#branches/}
+		else
+			ref=${WP_TESTS_TAG#tags/}
+		fi
+
+		if [ -z "$ref" ]; then
+			echo -e "${RED}Error:${RESET} Unable to determine git reference from WP_TESTS_TAG: $WP_TESTS_TAG"
+			exit 1
+		fi
+
+		download https://raw.githubusercontent.com/WordPress/wordpress-develop/${ref}/wp-tests-config-sample.php "$WP_TESTS_DIR"/wp-tests-config.php
+		# remove all forward slashes in the end
+		WP_CORE_DIR=$(echo $WP_CORE_DIR | sed "s:/\+$::")
+		sed $ioption "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed $ioption "s:__DIR__ . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed $ioption "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed $ioption "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed $ioption "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed $ioption "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR"/wp-tests-config.php
+		echo -e "${GREEN}Test suite configured.${RESET}"
+	else
+		echo -e "${CYAN}Test suite is already configured.${RESET}"
+	fi
+
+}
+
+recreate_db() {
+	shopt -s nocasematch
+	if [[ $1 =~ ^(y|yes)$ ]]
+	then
+		echo -e "${CYAN}Recreating the database ($DB_NAME)...${RESET}"
+		if command -v mariadb-admin > /dev/null 2>&1; then
+			mariadb-admin drop $DB_NAME -f --user="$DB_USER" --password="$DB_PASS"$EXTRA
+		else
+			mysqladmin drop $DB_NAME -f --user="$DB_USER" --password="$DB_PASS"$EXTRA
+		fi
+		create_db
+		echo -e "${GREEN}Database ($DB_NAME) recreated.${RESET}"
+	else
+		echo -e "${YELLOW}Leaving the existing database ($DB_NAME) in place.${RESET}"
+	fi
+	shopt -u nocasematch
+}
+
+create_db() {
+	if command -v mariadb-admin > /dev/null 2>&1; then
+		mariadb-admin create $DB_NAME --user="$DB_USER" --password="$DB_PASS"$EXTRA
+	else
+		mysqladmin create $DB_NAME --user="$DB_USER" --password="$DB_PASS"$EXTRA
+	fi
+}
+
+install_db() {
+
+	if [ ${SKIP_DB_CREATE} = "true" ]; then
+		echo -e "${YELLOW}Skipping database creation.${RESET}"
+		return 0
+	fi
+
+	# parse DB_HOST for port or socket references
+	local PARTS=(${DB_HOST//\:/ })
+	local DB_HOSTNAME=${PARTS[0]};
+	local DB_SOCK_OR_PORT=${PARTS[1]};
+	local EXTRA=""
+
+	if ! [ -z $DB_HOSTNAME ] ; then
+		if [ $(echo $DB_SOCK_OR_PORT | grep -e '^[0-9]\{1,\}$') ]; then
+			EXTRA=" --host=$DB_HOSTNAME --port=$DB_SOCK_OR_PORT --protocol=tcp"
+		elif ! [ -z $DB_SOCK_OR_PORT ] ; then
+			EXTRA=" --socket=$DB_SOCK_OR_PORT"
+		elif ! [ -z $DB_HOSTNAME ] ; then
+			EXTRA=" --host=$DB_HOSTNAME --protocol=tcp"
+		fi
+	fi
+
+	# create database
+	if command -v mariadb > /dev/null 2>&1; then
+		local DB_CLIENT='mariadb'
+	else
+		local DB_CLIENT='mysql'
+	fi
+	if $DB_CLIENT --user="$DB_USER" --password="$DB_PASS"$EXTRA --execute='show databases;' | grep -q "^$DB_NAME$";
+	then
+		echo -e "${YELLOW}Reinstalling will delete the existing test database ($DB_NAME)${RESET}"
+		read -p 'Are you sure you want to proceed? [y/N]: ' DELETE_EXISTING_DB
+		recreate_db $DELETE_EXISTING_DB
+	else
+		echo -e "${CYAN}Creating database ($DB_NAME)...${RESET}"
+		create_db
+		echo -e "${GREEN}Database ($DB_NAME) created.${RESET}"
+	fi
+}
+
+install_wp
+install_test_suite
+install_db
+echo -e "${GREEN}Done.${RESET}"

readme.txt

@@ -1,11 +1,11 @@
 === Two-Factor Extended ===
 Contributors: javiercasares, robotstxt
 Tags: two-factor, 2fa, authentication, security
-Requires at least: 6.7
+Requires at least: 6.8
-Tested up to: 6.9
+Tested up to: 7.0
-Stable tag: 1.1.0
+Stable tag: 1.1.1
 Requires PHP: 8.2
-Version: 1.1.0
+Version: 1.1.1
 License: GPL-3.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-3.0.txt
 
@@ -117,6 +117,25 @@ We take security seriously and will respond promptly to all security reports.
 
 == Changelog ==
 
+= 1.1.1 =
+
+_Release date: 2026-03-28_
+
+**Fixed**
+
+* Version constant mismatch: `TWO_FACTOR_EXTENDED_VERSION` was `1.0.2` instead of `1.1.0`.
+* Replaced `current_time('timestamp')` with `time()` in audit log and settings export to ensure UTC-correct timestamps.
+* Added `wp_unslash()` before sanitizing `$_GET['tab']` in the settings page renderer.
+
+**Compatibility**
+
+* WordPress: 6.8, 6.9, 7.0
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+* Tested on WordPress 7.0, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
+
 = 1.1.0 =
 
 _Release date: 2026-03-28_

two-factor-extended.php

@@ -3,8 +3,8 @@
  * Plugin Name: Two-Factor Extended
  * Plugin URI: https://git.robotstxt.es/ROBOTSTXT/two-factor-extended
  * Description: Extends the WordPress Two Factor plugin with advanced role-based controls, forced 2FA methods, and enhanced administrative features for single-site and Multisite installations.
- * Version: 1.1.0
+ * Version: 1.1.1
- * Requires at least: 6.7
+ * Requires at least: 6.8
  * Requires PHP: 8.2
  * Requires Plugins: two-factor
  * Author: ROBOTSTXT
@@ -18,7 +18,7 @@
  * Primary Branch: main
  *
  * @package TwoFactorExtended
- * @version 1.1.0
+ * @version 1.1.1
  */
 
 // Prevent direct access.
@@ -27,7 +27,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 // Define plugin constants.
-define( 'TWO_FACTOR_EXTENDED_VERSION', '1.0.2' );
+define( 'TWO_FACTOR_EXTENDED_VERSION', '1.1.1' );
 define( 'TWO_FACTOR_EXTENDED_PLUGIN_FILE', __FILE__ );
 define( 'TWO_FACTOR_EXTENDED_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'TWO_FACTOR_EXTENDED_PLUGIN_URL', plugin_dir_url( __FILE__ ) );

update.json

@@ -1,20 +1,20 @@
 {
   "name": "Two-Factor Extended",
   "slug": "two-factor-extended",
-  "version": "1.1.0",
+  "version": "1.1.1",
-  "download_url": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended/releases/download/1.1.0/two-factor-extended-1.1.0.zip",
+  "download_url": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended/releases/download/1.1.1/two-factor-extended-1.1.1.zip",
-  "requires": "6.7",
+  "requires": "6.8",
   "requires_php": "8.2",
-  "tested": "6.9",
+  "tested": "7.0",
   "last_updated": "2026-03-28",
   "author": "javiercasares, ROBOTSTXT",
   "author_profile": "https://www.robotstxt.es/",
   "homepage": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended",
   "description": "Extends the WordPress Two Factor plugin with advanced role-based controls, forced 2FA methods, and enhanced administrative features for single-site and Multisite installations.",
-  "changelog": "<h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
+  "changelog": "<h3>1.1.1 - 2026-03-28</h3><ul><li><strong>Fixed:</strong> Version constant mismatch — <code>TWO_FACTOR_EXTENDED_VERSION</code> was <code>1.0.2</code> instead of <code>1.1.0</code></li><li><strong>Fixed:</strong> Replaced <code>current_time('timestamp')</code> with <code>time()</code> for UTC-correct timestamps</li><li><strong>Fixed:</strong> Added <code>wp_unslash()</code> before sanitizing <code>$_GET['tab']</code></li><li><strong>Compatibility:</strong> WordPress 6.8-7.0, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
   "sections": {
     "description": "Two-Factor Extended is a comprehensive extension for the WordPress Two Factor plugin that provides administrators with enterprise-level controls over two-factor authentication across their site.<br><br><strong>Core Features:</strong><ul><li>Role-Based 2FA Requirements</li><li>Provider Visibility Control</li><li>Grace Period Enforcement (0-365 days)</li><li>WordPress Multisite Support</li><li>Compliance Reporting</li><li>Audit Logging</li><li>Bulk Operations</li><li>WP-CLI Commands</li><li>REST API Endpoints</li><li>Import/Export Settings</li></ul><strong>Security:</strong> Grade A security audit, comprehensive security hardening, CSRF protection, XSS prevention, SQL injection protection.<br><br><strong>Quality Assurance:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, WordPress Coding Standards compliant, PHP 8.2-8.5 compatible.",
-    "changelog": "<h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
+    "changelog": "<h3>1.1.1 - 2026-03-28</h3><ul><li><strong>Fixed:</strong> Version constant mismatch — <code>TWO_FACTOR_EXTENDED_VERSION</code> was <code>1.0.2</code> instead of <code>1.1.0</code></li><li><strong>Fixed:</strong> Replaced <code>current_time('timestamp')</code> with <code>time()</code> for UTC-correct timestamps</li><li><strong>Fixed:</strong> Added <code>wp_unslash()</code> before sanitizing <code>$_GET['tab']</code></li><li><strong>Compatibility:</strong> WordPress 6.8-7.0, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
     "installation": "<ol><li>Install the Two Factor plugin (required dependency)</li><li>Upload and activate Two-Factor Extended plugin</li><li>Go to Settings → Two-Factor Extended</li><li>Configure grace period (7-14 days recommended)</li><li>Set role-based 2FA requirements</li><li>Configure provider visibility per role</li><li>Monitor compliance via Compliance tab</li><li>Review audit logs via Audit Log tab</li></ol>",
     "faq": "<h4>Does this plugin replace the Two Factor plugin?</h4><p>No, Two-Factor Extended is an extension that works alongside the Two Factor plugin. Both plugins must be installed and activated.</p><h4>Is this compatible with WordPress Multisite?</h4><p>Yes! Two-Factor Extended fully supports WordPress Multisite with network-wide settings and site-level overrides.</p><h4>Which PHP versions are supported?</h4><p>Two-Factor Extended requires PHP 8.2 or higher.</p><h4>Can users bypass the 2FA requirements?</h4><p>No. When a 2FA method is marked as required for a user's role, they cannot disable or remove it.</p>"
   },