Repository navigation
Technical Plugin LoginControl
Controls configured account-login restrictions and related administration.
Audience: developers, advanced administrators and AI-assisted diagnosis. Plugin catalog.
- Review date: 2026-10-29. Method: static source analysis; runtime/provider behavior was not exercised.
- Code ownership: AVideo Streamer repository.
- Reported version:
3.0. - Source revision:
7d48f2dfc0289236718a3f9fba7c5ffecff4a37f. - Entry class file: LoginControl.php.
Confirm the installed plugin version independently of the Streamer version. Configuration defaults below are not a dump of this installation's saved settings.
No literal dependency declaration was extracted. This does not prove the plugin is standalone.
Literal runtime plugin references: User_Location. These calls do not mean every referenced plugin is mandatory.
| Override | Implementation |
|---|---|
getTags() |
LoginControl.php:10 |
getPluginMenu() |
LoginControl.php:70 |
onUserSignIn($users_id) |
LoginControl.php:77 |
getStart() |
LoginControl.php:307 |
getMyAccount($users_id) |
LoginControl.php:431 |
profileTabName($users_id) |
LoginControl.php:469 |
profileTabContent($users_id) |
LoginControl.php:474 |
onUserSocketConnect() |
LoginControl.php:479 |
updateScript() |
LoginControl.php:496 |
getUsersManagerListButton() |
LoginControl.php:625 |
These are direct assignments inside getEmptyDataObject(), not evaluated effective defaults. Stored plugins.object_data, globals, structured values and conditional branches may alter runtime behavior. Private/default credential values are omitted.
| Field | Literal default or expression type | Literal source label/help | Evidence |
|---|---|---|---|
singleDeviceLogin |
false |
Allow login from a single device only: When a user logs in from a new device/browser, any other active session for that user is automatically logged out (except admin users). The disconnected user sees which device/IP/location triggered it. | source |
enable2FA |
false |
Enable e-mail 2FA: Require users to confirm a new device via a confirmation link sent to their e-mail before they can finish logging in. | source |
textFor2FASubject |
Computed/structured; inspect source | — | source |
textFor2FABody |
Computed/structured; inspect source | — | source |
enablePGP2FA |
false |
Enable PGP 2FA, please read this: 2-Factor-Authentication with a Pretty Good Privacy (PGP) challenge | source |
This inventory distinguishes implementation files from an API specification. Includes, templates, callbacks and CLI workers are not interchangeable HTTP endpoints. Request-field names below are direct source references, not a complete schema or permission declaration.
| File | Source role | Direct request fields observed |
|---|---|---|
| LoginControl.php | plugin entry class | confirmation |
| Objects/logincontrol_history.php | class/helper implementation | — |
| View/Users_login_history/add.json.php | JSON entry point; inspect caller and guard |
confirmation_code, id, ip, status, uniqidV4, user_agent, users_id
|
| View/Users_login_history/delete.json.php | JSON entry point; inspect caller and guard | id |
| View/Users_login_history/index.php | PHP page/include/worker; inspect caller | — |
| View/Users_login_history/index_body.php | PHP page/include/worker; inspect caller | — |
| View/Users_login_history/index_head.php | PHP page/include/worker; inspect caller | — |
| View/Users_login_history/list.json.php | JSON entry point; inspect caller and guard | — |
| View/editor.php | PHP page/include/worker; inspect caller | — |
| confirm.php | PHP page/include/worker; inspect caller |
confirmation, confirmation_code
|
| install/install.sql | schema/migration SQL | — |
| install/updateV2.0.sql | schema/migration SQL | — |
| listLastLogins.json.php | JSON entry point; inspect caller and guard | users_id |
| loginHistory.php | PHP page/include/worker; inspect caller | users_id |
| pgp/challenge.php | PHP page/include/worker; inspect caller | — |
| pgp/decryptMessage.json.php | JSON entry point; inspect caller and guard |
keyPassword, privateKeyToDecryptMsg, textToDecrypt
|
| pgp/decryptMessage.php | PHP page/include/worker; inspect caller | — |
| pgp/deletePublicKey.json.php | JSON entry point; inspect caller and guard | users_id |
| pgp/encryptMessage.json.php | JSON entry point; inspect caller and guard |
publicKeyToEncryptMsg, textToEncrypt
|
| pgp/encryptMessage.php | PHP page/include/worker; inspect caller | — |
| pgp/functions.php | PHP page/include/worker; inspect caller | — |
| pgp/generateKeys.json.php | JSON entry point; inspect caller and guard |
keyEmail, keyName, keyPassword
|
| pgp/generateKeys.php | PHP page/include/worker; inspect caller | — |
| pgp/keys.php | PHP page/include/worker; inspect caller | — |
| pgp/savePublicKey.json.php | JSON entry point; inspect caller and guard |
publicKey, users_id
|
| pgp/test.php | PHP page/include/worker; inspect caller | — |
| pgp/verifyChallenge.json.php | JSON entry point; inspect caller and guard | response |
| profileTabContent.php | PHP page/include/worker; inspect caller | users_id |
| profileTabName.php | PHP page/include/worker; inspect caller | — |
| set.json.php | JSON entry point; inspect caller and guard |
type, value
|
| switchUser2FA.php | PHP page/include/worker; inspect caller | — |
Tables named in available CREATE TABLE statements: logincontrol_history.
Apply installation/update behavior through the owning plugin; this reference is not a script for running historical migrations manually.
Visibility and implementation semantics must be checked in source. Nonempty string defaults are represented as . This is a symbol reference, not a stable public API promise.
| Function or method | Source |
|---|---|
getTags() |
10 |
getDescription() |
18 |
getName() |
29 |
getUUID() |
33 |
getPluginVersion() |
37 |
getEmptyDataObject() |
41 |
getPluginMenu() |
70 |
onUserSignIn($users_id) |
77 |
ignore2FA($users_id = "") |
121 |
getHiddenEmail($email) |
129 |
createLog($users_id) |
150 |
getConfirmationCode($users_id, $uniqidV4) |
169 |
is2FAEnabled($users_id) |
187 |
is2FAConfirmed($users_id) |
197 |
getLastLoginOnDevice($users_id, $uniqidV4 = "", $refreshCache = false) |
201 |
send2FAEmail($users_id) |
212 |
getConfirmationCodeHash($users_id) |
265 |
validateConfirmationCodeHash($code) |
288 |
getStart() |
307 |
getSingleDeviceLogoutMessage($users_id) |
347 |
getLastLogin($users_id) |
375 |
getPreviewsLogin($users_id) |
379 |
getLastConfirmedLogin($users_id) |
387 |
isLoggedFromSameDevice() |
391 |
isSameDeviceAsLastLogin($users_id, $uniqidV4) |
398 |
confirmCode($users_id, $code, $uniqidV4 = "") |
415 |
getMyAccount($users_id) |
431 |
isUser2FAEnabled($users_id) |
445 |
setUser2FA($users_id, $value = true) |
455 |
getConfirmationLink($confirmation) |
464 |
profileTabName($users_id) |
469 |
profileTabContent($users_id) |
474 |
onUserSocketConnect() |
479 |
updateScript() |
496 |
setPGPKey($users_id, $key) |
509 |
getPGPKey($users_id) |
517 |
encryptPGPMessage($users_id, $message) |
525 |
getChallenge() |
533 |
verifyChallenge($response) |
546 |
isChallengeComplete() |
559 |
userHasPGPActive($users_id) |
563 |
userNeedsToChallengePGP() |
573 |
challengeThisPage() |
584 |
getUsersManagerListButton() |
625 |
These symbols are grouped by source file; inspect the class declaration and visibility before calling them.
Declared classes: logincontrol_history, logincontrol_history_status.
| Named symbol | Source |
|---|---|
getSearchFieldsNames() |
15 |
getTableName() |
20 |
getAllUsers() |
25 |
setId($id) |
45 |
setUsers_id($users_id) |
50 |
setUniqidV4($uniqidV4) |
55 |
setIp($ip) |
60 |
setUser_agent($user_agent) |
65 |
setConfirmation_code($confirmation_code) |
71 |
setStatus($status) |
76 |
getId() |
82 |
getUsers_id() |
87 |
getUniqidV4() |
92 |
getIp() |
97 |
getUser_agent() |
102 |
getConfirmation_code() |
107 |
getStatus() |
112 |
getLastLogins($users_id, $limit=50) |
118 |
getDeviceName($user_agent) |
140 |
getLastLogin($users_id) |
146 |
getPreviewsLogin($users_id) |
171 |
getPreviewsConfirmedLogin($users_id) |
194 |
getLastConfirmedLogin($users_id) |
217 |
is2FAConfirmed($users_id, $uniqidV4) |
240 |
getLastLoginAttempt($users_id, $uniqidV4, $refreshCache = false) |
257 |
| Named symbol | Source |
|---|---|
createKeys($UserIDPacket = '<string>', $password = '') |
10 |
encryptMessage($message, $publicKey) |
63 |
decryptMessage($encryptedMessage, $privatekey, $password = '') |
74 |
- Check the installed/enabled version and the dependencies/settings above.
- Identify the actual failing page, request, callback or worker and correlate its timestamp with the AVideo log.
- Follow the linked method and caller. Check business-state changes and output artifacts as well as HTTP status.
- Reproduce the relevant workflow in a test environment. External provider, Encoder, live-server, storage, payment and authenticated flows require their real integrations.
Shared diagnostic workflow. This page is not a security audit or a claim of end-to-end validation.
