Repository navigation
Technical Plugin UserOTPLogin
Adds TOTP enrollment and verification to supported login flows.
Audience: developers, advanced administrators and AI-assisted diagnosis. Plugin catalog.
- Review date: 2026-10-29. Method: static source analysis; runtime/provider behavior was not exercised.
- Code ownership: independently versioned plugin repository.
- Reported version:
1.8. - Source revision:
226c438bf5d94e6b6dcfc1479be88ac22dce0edf. - Entry class file: UserOTPLogin.php.
Confirm the installed plugin version independently of the Streamer version. Configuration defaults below are not a dump of this installation's saved settings.
No literal dependency declaration was extracted. This does not prove the plugin is standalone.
| Override | Implementation |
|---|---|
updateScript() |
UserOTPLogin.php:39 |
getPluginMenu() |
UserOTPLogin.php:73 |
getStart() |
UserOTPLogin.php:263 |
profileTabName($users_id) |
UserOTPLogin.php:284 |
profileTabContent($users_id) |
UserOTPLogin.php:291 |
These are direct assignments inside getEmptyDataObject(), not evaluated effective defaults. Stored plugins.object_data, globals, structured values and conditional branches may alter runtime behavior. Private/default credential values are omitted.
No direct $obj->field assignments were extracted. Inspect inherited defaults, getCustomizeAdvancedOptions() and the plugin-specific settings page.
This inventory distinguishes implementation files from an API specification. Includes, templates, callbacks and CLI workers are not interchangeable HTTP endpoints. Request-field names below are direct source references, not a complete schema or permission declaration.
| File | Source role | Direct request fields observed |
|---|---|---|
| Objects/User_otp.php | class/helper implementation | — |
| UserOTPLogin.php | plugin entry class | — |
| View/User_otp/add.json.php | JSON entry point; inspect caller and guard |
created_php_time, id, modified_php_time, otp_secret, users_id
|
| View/User_otp/delete.json.php | JSON entry point; inspect caller and guard | id |
| View/User_otp/index.php | PHP page/include/worker; inspect caller | — |
| View/User_otp/index_body.php | PHP page/include/worker; inspect caller | — |
| View/User_otp/list.json.php | JSON entry point; inspect caller and guard | draw |
| View/editor.php | PHP page/include/worker; inspect caller | — |
| View/profileTabContent.php | PHP page/include/worker; inspect caller | — |
| actions/invalidate.php | PHP page/include/worker; inspect caller | — |
| actions/invalidate_session.json.php | JSON entry point; inspect caller and guard | — |
| actions/qrcode.php | PHP page/include/worker; inspect caller | — |
| actions/reset.php | PHP page/include/worker; inspect caller | — |
| actions/reset_otp_secret.json.php | JSON entry point; inspect caller and guard | — |
| actions/skip.php | PHP page/include/worker; inspect caller | — |
| actions/skip_otp_setup.json.php | JSON entry point; inspect caller and guard | — |
| actions/validate.php | PHP page/include/worker; inspect caller | — |
| actions/validate_otp.json.php | JSON entry point; inspect caller and guard | otp_code |
| install/install.sql | schema/migration SQL | — |
| qrcode.php | PHP page/include/worker; inspect caller | — |
| verify.php | PHP page/include/worker; inspect caller | — |
Tables named in available CREATE TABLE statements: user_otp.
Apply installation/update behavior through the owning plugin; this reference is not a script for running historical migrations manually.
Visibility and implementation semantics must be checked in source. Nonempty string defaults are represented as . This is a symbol reference, not a stable public API promise.
| Function or method | Source |
|---|---|
getDescription() |
16 |
getName() |
24 |
getUUID() |
29 |
getPluginVersion() |
34 |
updateScript() |
39 |
getEmptyDataObject() |
51 |
getPluginMenu() |
73 |
getNewSecret($users_id) |
79 |
getOrCreateFromUsers_id($users_id) |
91 |
getSecret($users_id) |
111 |
getTOTP($users_id) |
119 |
getCurrentPass($users_id) |
127 |
getQrcode($users_id) |
133 |
validate($otp_code, $users_id) |
151 |
skipOTP($users_id) |
177 |
resetOTP($users_id) |
189 |
invalidateSessions() |
204 |
isSessionValid($users_id) |
210 |
doesTheUserSkipOTP($users_id) |
226 |
doesTheUserVerifyOTP($users_id) |
231 |
ignoreOTP() |
236 |
getStart() |
263 |
profileTabName($users_id) |
284 |
profileTabContent($users_id) |
291 |
These symbols are grouped by source file; inspect the class declaration and visibility before calling them.
Declared classes: User_otp.
| Named symbol | Source |
|---|---|
getSearchFieldsNames() |
9 |
getTableName() |
13 |
getAllUsers() |
17 |
setId($id) |
43 |
setOtp_secret($otp_secret) |
47 |
setCreated_php_time($created_php_time) |
51 |
setModified_php_time($modified_php_time) |
55 |
setUsers_id($users_id) |
59 |
getId() |
64 |
getOtp_secret() |
68 |
getCreated_php_time() |
72 |
getModified_php_time() |
76 |
getUsers_id() |
80 |
setVerified($verified) |
84 |
getVerified() |
87 |
setStatus($status) |
91 |
getStatus() |
94 |
getFromUsers_id($users_id, $refreshCache = false) |
98 |
- Check the installed/enabled version and the dependencies/settings above.
- Identify the actual failing page, request, callback or worker and correlate its timestamp with the AVideo log.
- Follow the linked method and caller. Check business-state changes and output artifacts as well as HTTP status.
- Reproduce the relevant workflow in a test environment. External provider, Encoder, live-server, storage, payment and authenticated flows require their real integrations.
Shared diagnostic workflow. This page is not a security audit or a claim of end-to-end validation.
