From 20a1a5e14fde227f515674063129554936e375e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Chris=20=C3=85kerfeldt=20Wendel?= Date: Fri, 4 Sep 2026 08:39:31 +0200 Subject: [PATCH 1/3] security: Fixed authentication to be a bit better than before. BREAKING CHANGE: Might break some convenience logins, but it's for the sake of safety. --- PLUGIN-CHECKSUM | 2 +- class/class-eduadmin-loginhandler.php | 1 + content/template/bookingTemplate/-login-handler.php | 7 ++++++- content/template/myPagesTemplate/login.php | 6 +++++- includes/edu-login-functions.php | 2 ++ 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/PLUGIN-CHECKSUM b/PLUGIN-CHECKSUM index a0a59d12..ce3d4801 100644 --- a/PLUGIN-CHECKSUM +++ b/PLUGIN-CHECKSUM @@ -1 +1 @@ -e0c928c4d26838ef036a5067b4f081b4 +9f3098ac12614862f0e6c0f34cde7087 diff --git a/class/class-eduadmin-loginhandler.php b/class/class-eduadmin-loginhandler.php index 90f4db93..e20ff536 100644 --- a/class/class-eduadmin-loginhandler.php +++ b/class/class-eduadmin-loginhandler.php @@ -42,6 +42,7 @@ public function process_login() { if ( 200 === $login_result['@curl']['http_code'] ) { $user = $this->get_login_user( $login_result['PersonId'], $login_result['CustomerId'] ); + EDU()->session['eduadmin-authenticated'] = true; } } diff --git a/content/template/bookingTemplate/-login-handler.php b/content/template/bookingTemplate/-login-handler.php index 10f96376..e4754d1c 100644 --- a/content/template/bookingTemplate/-login-handler.php +++ b/content/template/bookingTemplate/-login-handler.php @@ -4,6 +4,7 @@ if ( 'checkEmail' === $_POST['eduformloginaction'] && ! empty( $_POST['eduadminloginEmail'] ) ) { $selected_login_field = EDU()->get_option( 'eduadmin-loginField', 'Email' ); $allow_customer_registration = EDU()->is_checked( 'eduadmin-allowCustomerRegistration', true ); + $use_login = EDU()->is_checked( 'eduadmin-useLogin', false ); $login_field = EDU()->get_option( 'eduadmin-loginField', 'Email' ); @@ -13,7 +14,7 @@ 'CustomFields($filter=ShowOnWeb;)' )['value']; - EDU()->session['needsLogin'] = false; + EDU()->session['needsLogin'] = $use_login; EDU()->session['checkEmail'] = true; if ( ! empty( $possible_persons ) ) { foreach ( $possible_persons as $con ) { @@ -39,6 +40,10 @@ return; } else { + if ( $use_login ) { + return; + } + EDU()->session['needsLogin'] = false; } diff --git a/content/template/myPagesTemplate/login.php b/content/template/myPagesTemplate/login.php index 7d5acd02..5bbc5fdf 100644 --- a/content/template/myPagesTemplate/login.php +++ b/content/template/myPagesTemplate/login.php @@ -7,7 +7,11 @@ if ( ! EDU()->api_connection ) { echo esc_html_x( 'EduAdmin Booking could not connect to the API', 'frontend', 'eduadmin-booking' ); } else { - if ( ! empty( EDU()->session['eduadmin-loginUser'] ) && ! empty( EDU()->session['eduadmin-loginUser']->Contact ) && ! empty( EDU()->session['eduadmin-loginUser']->Contact->PersonId ) && 0 !== EDU()->session['eduadmin-loginUser']->Contact->PersonId ) { + if ( ! empty( EDU()->session['eduadmin-loginUser'] ) + && ! empty( EDU()->session['eduadmin-loginUser']->Contact ) + && ! empty( EDU()->session['eduadmin-loginUser']->Contact->PersonId ) + && 0 !== EDU()->session['eduadmin-loginUser']->Contact->PersonId + && isset( EDU()->session['eduadmin-authenticated'] ) ) { if ( isset( $q['edu-login'] ) || isset( $q['edu-profile'] ) ) { require_once 'profile.php'; } elseif ( isset( $q['edu-bookings'] ) ) { diff --git a/includes/edu-login-functions.php b/includes/edu-login-functions.php index 446db62f..4f3f15aa 100644 --- a/includes/edu-login-functions.php +++ b/includes/edu-login-functions.php @@ -40,6 +40,8 @@ function edu_logout_user() { unset( EDU()->session['eduadmin-loginUser'] ); unset( EDU()->session['needsLogin'] ); unset( EDU()->session['checkEmail'] ); + unset( EDU()->session['eduadmin-authenticated'] ); + EDU()->session->regenerate_id( true ); wp_redirect( $base_url . edu_get_query_string() ); EDU()->stop_timer( $t ); From d29978e455081966e130b7499b8709eea23c3f5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Chris=20=C3=85kerfeldt=20Wendel?= Date: Fri, 4 Sep 2026 08:39:47 +0200 Subject: [PATCH 2/3] chore(release): 6.0.0 --- CHANGELOG.md | 11 +++++++++++ package.json | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4a7ff559..f159d45f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. +## [6.0.0](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.3...v6.0.0) (2026-09-04) + + +### ⚠ BREAKING CHANGES + +* Might break some convenience logins, but it's for the sake of safety. + +### Security + +* Fixed authentication to be a bit better than before. ([20a1a5e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/20a1a5e14fde227f515674063129554936e375e6)) + ### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02) diff --git a/package.json b/package.json index 74372e35..29904ae9 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "eduadmin-wordpress-plugin", "private": true, - "version": "5.4.3", + "version": "6.0.0", "repository": "https://github.com/MultinetInteractive/EduAdmin-WordPress.git", "author": "Chris Gårdenberg ", "license": "MIT", From 64783abeeedc3547b071816e90708701086a277a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Chris=20=C3=85kerfeldt=20Wendel?= Date: Fri, 4 Sep 2026 08:39:53 +0200 Subject: [PATCH 3/3] chore: versionbump --- PLUGIN-CHECKSUM | 2 +- eduadmin.php | 2 +- readme.md | 30 ++++++++++++------------------ readme.txt | 30 ++++++++++++------------------ 4 files changed, 26 insertions(+), 38 deletions(-) diff --git a/PLUGIN-CHECKSUM b/PLUGIN-CHECKSUM index ce3d4801..4b5218b6 100644 --- a/PLUGIN-CHECKSUM +++ b/PLUGIN-CHECKSUM @@ -1 +1 @@ -9f3098ac12614862f0e6c0f34cde7087 +188e5f8585cc516db62baaa220f2587a diff --git a/eduadmin.php b/eduadmin.php index 11d753af..7ba2674e 100644 --- a/eduadmin.php +++ b/eduadmin.php @@ -9,7 +9,7 @@ * Plugin URI: https://www.eduadmin.com * Description: EduAdmin plugin to allow visitors to book courses at your website * Tags: booking, participants, courses, events, eduadmin - * Version: 5.4.3 + * Version: 6.0.0 * GitHub Plugin URI: multinetinteractive/eduadmin-wordpress * GitHub Plugin URI: https://github.com/multinetinteractive/eduadmin-wordpress * Requires at least: 6.0 diff --git a/readme.md b/readme.md index f5cbed94..5d36b658 100644 --- a/readme.md +++ b/readme.md @@ -1,7 +1,7 @@ # EduAdmin Booking - Requires at least: 6.0 - Tested up to: 7.0 -- Stable tag: 5.4.3 +- Stable tag: 6.0.0 - Requires PHP: 8.1 - License: GPL3 - License URI: https://www.gnu.org/licenses/gpl-3.0.en.html @@ -44,6 +44,17 @@ If you notice that your API key doesn't work any more, you have to contact us. The full changelog available on [GitHub](https://github.com/MultinetInteractive/EduAdmin-WordPress/blob/production/CHANGELOG.md) +### [6.0.0](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.3...v6.0.0) (2026-09-04) + + +#### ⚠ BREAKING CHANGES + +* Might break some convenience logins, but it's for the sake of safety. + +#### Security + +* Fixed authentication to be a bit better than before. ([20a1a5e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/20a1a5e14fde227f515674063129554936e375e6)) + ### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02) @@ -65,22 +76,5 @@ The full changelog available on [GitHub](https://github.com/MultinetInteractive/ * Update links to EduAdmin from https://www.eduadmin.se to https://www.eduadmin.com instead to cater to the international website instead of the swedish one. ([c58f56e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/c58f56e807f6904360685ba0af4a6316e0f8232d)) -### [5.4.0](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.3.1...v5.4.0) (2025-02-25) - - -#### Features - -* Added VoucherTemplate OData-endpoint ([9a6c631](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/9a6c6310fb4876ab4e1413e83d17491ffc018d6a)) - - -#### Bug Fixes - -* Custom course detail views will no longer require an attribute to show on demand events. ([6f90e87](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/6f90e875845d78a44ab32dda817284ad8b8b82ca)) - - -#### Documentation - -* Remove ondemand-attribute from detailinfo ([dfa3f59](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/dfa3f59c5bea11c8da99d5067e415d6859475a34)) - diff --git a/readme.txt b/readme.txt index 2347194e..46ad11eb 100644 --- a/readme.txt +++ b/readme.txt @@ -3,7 +3,7 @@ Contributors: mnchga Tags: booking, participants, courses, events, eduadmin Requires at least: 6.0 Tested up to: 7.0 -Stable tag: 5.4.3 +Stable tag: 6.0.0 Requires PHP: 8.1 License: GPL3 License URI: https://www.gnu.org/licenses/gpl-3.0.en.html @@ -49,6 +49,17 @@ If you notice that your API key doesn't work any more, you have to contact us. The full changelog available on [GitHub](https://github.com/MultinetInteractive/EduAdmin-WordPress/blob/production/CHANGELOG.md) +### [6.0.0](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.3...v6.0.0) (2026-09-04) + + +#### ⚠ BREAKING CHANGES + +* Might break some convenience logins, but it's for the sake of safety. + +#### Security + +* Fixed authentication to be a bit better than before. ([20a1a5e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/20a1a5e14fde227f515674063129554936e375e6)) + ### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02) @@ -70,22 +81,5 @@ The full changelog available on [GitHub](https://github.com/MultinetInteractive/ * Update links to EduAdmin from https://www.eduadmin.se to https://www.eduadmin.com instead to cater to the international website instead of the swedish one. ([c58f56e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/c58f56e807f6904360685ba0af4a6316e0f8232d)) -### [5.4.0](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.3.1...v5.4.0) (2025-02-25) - - -#### Features - -* Added VoucherTemplate OData-endpoint ([9a6c631](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/9a6c6310fb4876ab4e1413e83d17491ffc018d6a)) - - -#### Bug Fixes - -* Custom course detail views will no longer require an attribute to show on demand events. ([6f90e87](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/6f90e875845d78a44ab32dda817284ad8b8b82ca)) - - -#### Documentation - -* Remove ondemand-attribute from detailinfo ([dfa3f59](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/dfa3f59c5bea11c8da99d5067e415d6859475a34)) -