Skip to content

v1.1.0

Choose a tag to compare

View all tags
@guilamu guilamu released this 03 Apr 07:27
· 21 commits to main since this release
v1.1.0
5b8656b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • Security: Tokens now stored as SHA-256 hashes — raw token never persists in DB
  • Security: Switched token generation to random_bytes(32) (256-bit CSPRNG)
  • Security: Verification codes stored hashed with wp_hash_password()
  • Security: Replaced all rand() calls with random_int() (CSPRNG)
  • Security: Server-side rate limiting via transients (per-IP + per-token) — PHP sessions removed
  • Security: Email flood protection on code resend (max 5 per 10 min per address)
  • Security: wp_clear_auth_cookie() called before wp_set_auth_cookie() (session fixation fix)
  • Security: Auth cookie set as session-only (no persistent 14-day "remember me")
  • Security: do_action('wp_login', ...) fired for audit-trail compatibility
  • Security: Generic error message for all invalid/expired/used token states
  • Security: Referrer-Policy: no-referrer + Cache-Control: no-store on verification page
  • Security: textContent instead of innerHTML in admin JS notifications (XSS fix)
  • Security: WP-Cron scheduled cleanup of expired tokens (twice daily)
  • Security: Prepared LIKE queries in uninstall.php
Assets 3
Loading