164 lines
8.2 KiB
Text
164 lines
8.2 KiB
Text
== Changelog ==
|
|
|
|
= 1.1.0 =
|
|
|
|
_Release date: 2026-03-28_
|
|
|
|
**Changed**
|
|
|
|
* Code quality: phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style).
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 6.7, 6.8, 6.9
|
|
* PHP: 8.2, 8.3, 8.4, 8.5
|
|
* MariaDB: 10.6 or newer
|
|
* Multisite: Supported
|
|
* Two-Factor plugin: 0.16 or newer
|
|
* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
|
|
|
|
= 1.0.2 =
|
|
|
|
_Release date: 2026-03-28_
|
|
|
|
**Changed**
|
|
|
|
* Plugin renamed from "Two Factor Extended" to "Two-Factor Extended" (hyphen added for consistency with the Two-Factor plugin naming convention).
|
|
* `get_required_providers_for_user()` now intersects enforcement requirements with Two-Factor's globally-enabled providers list (`two_factor_enabled_providers` option, introduced in Two-Factor 0.16). Providers disabled site-wide by Two-Factor will no longer be enforced.
|
|
* Added Catalan (ca) translation — 145 strings, 100% coverage.
|
|
* Updated Spanish (es_ES) translation to reflect the new plugin name.
|
|
|
|
**Multisite**
|
|
|
|
* Two-Factor (base plugin) has no network-level settings — it is entirely per-site. Two-Factor Extended already provides the network layer on top of this with network-wide enforcement, super admin requirements, and site override controls. No changes required.
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 6.7, 6.8, 6.9
|
|
* PHP: 8.2, 8.3, 8.4, 8.5
|
|
* MariaDB: 10.6 or newer
|
|
* Multisite: Supported
|
|
* Two-Factor plugin: 0.16 or newer
|
|
* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
|
|
|
|
= 1.0.1 =
|
|
|
|
_Release date: 2026-03-28_
|
|
|
|
**Changed**
|
|
|
|
* Settings menu now registered at `admin_menu` priority 20 to always appear after Two Factor plugin's Settings page (Two Factor 0.16+).
|
|
* PHPUnit downgraded from 10.x to 9.6 for compatibility with the WordPress test library.
|
|
* `phpunit.xml.dist` updated: uses PHPUnit 9 schema, `<coverage>` block replaces removed attributes, `suffix=".php"` for test directory discovery.
|
|
* Test files renamed from `test-*.php` to `Test_*.php` to match PHPUnit 10/9 class name mapping (class names unchanged).
|
|
* `yoast/phpunit-polyfills` downgraded to `^1.1` (matches WordPress core requirement).
|
|
|
|
**Fixed**
|
|
|
|
* PHPCS: spacing after parameter type in `robotstxt-updater.php`, `class-enforcement.php`, `class-bulk-actions.php`.
|
|
* PHPCS: `list<int>` docblock type replaced with `int[]` to match `array` PHP type hint in `class-bulk-actions.php`.
|
|
* PHPStan level 9: all errors resolved across all plugin files.
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 6.7, 6.8, 6.9
|
|
* PHP: 8.2, 8.3, 8.4, 8.5
|
|
* MariaDB: 10.6 or newer
|
|
* Multisite: Supported
|
|
* Two-Factor plugin: 0.16 or newer
|
|
* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
|
|
|
|
= 1.0.0 =
|
|
|
|
_Release date: 2026-02-17_
|
|
|
|
**Initial Production Release**
|
|
|
|
This is the first comprehensive release of Two-Factor Extended, implementing enterprise-level two-factor authentication management for WordPress.
|
|
|
|
**Core Features**
|
|
|
|
* **Role-Based 2FA Requirements (Phase 3)** - Require specific 2FA methods for each user role, multiple methods support, custom role support
|
|
* **Provider Visibility Control (Phase 4)** - Control which 2FA methods are visible to each role, required providers always visible, union logic for multiple roles
|
|
* **Grace Period Enforcement (Phase 3)** - Configurable grace period (0-365 days), automatic tracking, user warnings, login blocking after expiration
|
|
* **WordPress Multisite Support (Phase 5)** - Network-wide enforcement, super admin requirements, site override control, inheritance notices
|
|
* **Consolidated Admin Interface** - Single settings page with tabs for Settings, Audit Log, and Compliance
|
|
* **Reset Plugin Functionality** - Complete settings reset with user grace period cleanup and audit logging
|
|
|
|
**Advanced Features**
|
|
|
|
* **Audit Logging (Phase 6)** - Comprehensive event logging (2FA changes, settings changes, login failures), filtering by action/user/date, CSV export, automatic cleanup (1000 logs max, 90-day retention), IP and actor tracking
|
|
* **Compliance Reporting (Phase 6)** - Real-time compliance statistics, by-role breakdown, non-compliant user identification, grace period status tracking, CSV export, network-wide reports, email reporting
|
|
* **Bulk Operations (Phase 7)** - Bulk "Require 2FA Setup" and "Reset Grace Period" actions on Users page with success notifications and audit logging
|
|
* **WP-CLI Commands (Phase 7)** - Complete CLI interface: status, enforce, report, reset (with table, JSON, CSV output formats and progress bars)
|
|
* **REST API Endpoints (Phase 7)** - Full authentication and authorization: GET status, GET users, POST enforce, POST reset, GET report (JSON and CSV formats)
|
|
* **Import/Export Settings (Phase 7)** - Export settings as JSON with timestamp, import with validation/sanitization, confirmation dialogs, file size limits (1MB), audit logging
|
|
|
|
**User Interface**
|
|
|
|
* **Settings Page** - Clean interface with grace period configuration, role requirements matrix, provider visibility matrix, data management section
|
|
* **Admin Notices** - Grace period warnings (yellow), non-compliance errors (red), days remaining countdown, "Configure 2FA Now" buttons
|
|
* **Audit Log Tab** - Recent activity overview, statistics display, filterable log table, export functionality, last 50 logs display
|
|
* **Compliance Tab** - Overview statistics, by-role breakdown table, non-compliant users table, status indicators, export functionality
|
|
|
|
**Security & Quality (Phase 8)**
|
|
|
|
* **Grade A Security Audit** - All capability checks verified, complete nonce verification, comprehensive input validation/sanitization, output escaping
|
|
* **Security Protections** - SQL injection protection (no direct SQL), XSS protection, CSRF protection, file access protection, error handling without information disclosure
|
|
* **Input Constraints** - Form field validation (client & server), file size/type limits, required field indicators, ARIA labels for accessibility
|
|
* **28 Unit Tests** - PHPUnit test coverage for core classes (Role Manager, Enforcement, Audit Log)
|
|
* **WCAG 2.1 Level AA Compliant** - Fully accessible administration interface
|
|
* **WordPress Coding Standards** - 100% PHPCS compliant with WordPress Coding Standards 3.3
|
|
* **Performance Optimized** - Efficient database queries and caching for large user bases
|
|
|
|
**Documentation (Phase 9)**
|
|
|
|
* Comprehensive security audit report (docs/SECURITY-AUDIT.md)
|
|
* Manual testing matrix with 200+ test cases (docs/TESTING-MATRIX.md)
|
|
* WCAG 2.1 Level AA compliance documentation (docs/ACCESSIBILITY.md)
|
|
* Performance testing procedures (docs/PERFORMANCE.md)
|
|
* Plugin compatibility report (docs/COMPATIBILITY.md)
|
|
* User guide with examples (docs/USER-GUIDE.md)
|
|
* Developer guide with API documentation (docs/DEVELOPER-GUIDE.md)
|
|
* Troubleshooting guides and FAQ sections
|
|
|
|
**Core Classes Added**
|
|
|
|
* class-two-factor-extended.php - Main plugin class (singleton)
|
|
* class-dependency-checker.php - Dependency validation
|
|
* class-role-manager.php - Role utilities
|
|
* class-provider-detector.php - Provider detection
|
|
* class-enforcement.php - 2FA enforcement logic
|
|
* class-provider-filter.php - Provider visibility control
|
|
* class-network-settings.php - Multisite support
|
|
* class-settings.php - Settings API implementation with tabbed interface
|
|
* class-audit-log.php - Audit logging
|
|
* class-compliance-report.php - Compliance reporting
|
|
* class-bulk-actions.php - Bulk operations
|
|
* class-rest-api.php - REST API endpoints
|
|
* class-cli-commands.php - WP-CLI commands
|
|
|
|
**Bug Fixes**
|
|
|
|
* Fixed provider visibility filter applying globally (now only applies on user profile pages, not admin settings)
|
|
* Fixed compliance report data structure access for user and email columns
|
|
* Fixed cache issues in role requirements and provider visibility fields by adding direct provider detection
|
|
* Fixed log_event() parameter handling in reset functionality
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 6.7, 6.8, 6.9
|
|
* PHP: 8.2, 8.3, 8.4, 8.5
|
|
* MariaDB: 10.6 or newer
|
|
* Multisite: Supported
|
|
* Two-Factor plugin: 0.15 or newer
|
|
* Tested on WordPress 6.9, PHP 8.2, MariaDB 10.6; plugin detection verified, dependency checks working, PHPCS passing, unit tests passing
|
|
|
|
**Development Tools**
|
|
|
|
* PHP_CodeSniffer: 3.13
|
|
* WordPress Coding Standards: 3.3
|
|
* PHPCompatibility: 9.3
|
|
* PHPCompatibilityWP: 2.1
|
|
* WP-Since: 1.4
|
|
* PHPUnit with WordPress test suite
|