wordpress

WordPress Plugin for Auth0 Authentication

MIT License

Downloads
6.3K
Stars
153
Committers
46
View Code on GitHub Visit Website
Ecosystems: Wordpress, Auth0

Bot releases are hidden (Show)

wordpress - 3.7.3

Published by joshcanhelp almost 5 years ago

Full Changelog

Fixed

  • Cast user ID to integer to fix reflected XSS
wordpress - 3.11.1

Published by joshcanhelp about 5 years ago

Full Changelog

Fixed

wordpress - 3.11.0

Published by joshcanhelp over 5 years ago

Full Changelog

Notes on this release

  • Lock was updated from 11.15 to 11.16. The option to display social connections in small styled buttons is no longer available due to branding compliance reasons with third party identity providers. All the social connections will now be displayed as large styled buttons.
  • New installs using user migration will now have a namespaced user ID returned to Auth0 on first login. If you have or plan on having multiple custom databases, please see the User Migration documentation for more information. New installs will also use configuration variables instead of hard-coded values for the URL, migration token, and user namespace.
  • The WordPress core login override has been refactored to improve the user experience and overall security.
  • Added more complete ID token validation during login.
  • Sites using VIP Go are now able to use MFA.
  • Fixed a bug that prevented sites using user migration from changing the WordPress user's email.

Closed issues

  • WordPress.com VIP Go MFA incompatibility #687

Added

Changed

Deprecated

Fixed

Security

wordpress - 3.10.0

Published by joshcanhelp over 5 years ago

Release Notes
Full Changelog

Closed issues

  • Sign in with OTP MFA doesn't work unless "Remember this browser" is enabled #667
  • WP_Auth0_Routes::migration_ws_login, 401 Invalid Credentials #633
  • OpenSSL error in WP_Auth0_Api_Client_Credentials::call #631
  • 1Password Compatibility #627
  • User Migration set as PHP constant causes token to not be generated #620

Added

Changed

Deprecated

Removed

Fixed

wordpress - 3.9.0

Published by joshcanhelp almost 6 years ago

Full Changelog

Notes on this release

  • Added a complete Spanish translation!
  • Email changes for WordPress users now work properly and are rejected clearly if Auth0 rejects the change. This does not affect the email verification process in WordPress; the email is changed only after the verification happens. A current API token is not required but your Application does need to allow for a Client Credentials grant with the Management API (this configured for you by default, more information here).
  • Sibling sub-domains are now allowed for the Login Redirect URL. Anything within the same domain name as the site URL can now be saved.
  • Default Auth0 IP addresses are now allowed by default on the user migration endpoints. Adding or changing the IP addresses for the "Migration IPs Whitelist" field will not affect default IPs.
  • User migration endpoints were improved to provide better errors when requests are rejected and more clear custom database scripts that can be used as an example when setting up the migration manually. Switching this setting on or off does not make any changes in the Auth0 dashboard or to the existing token, it only makes the endpoints available or not.
  • The Social Amplificator functionality has been removed.

Added

Changed

Deprecated

Removed

Fixed

Closed issues

  • Invalid State error 100% of the time #597
  • Update docs #591
  • Correct dimensions for custom login icon #586
  • Basic settings edit box doesn't show values from AUTH0_ENV_* constants #569
  • Better documentation of User Migration endpoints with manual setup #542
  • Keep getting logged out once SSO is turned on #541
wordpress - 3.8.1

Published by joshcanhelp almost 6 years ago

Full Changelog

Closed issues

  • Javascript: Use readonly instead of disabled on email field #587

Changed

Fixed

wordpress - 3.8.0

Published by joshcanhelp almost 6 years ago

Full Changelog

Notes on this release

  • Administrators can now mark certain strategies as able to skip email verification. This is typically used for Enterprise strategies that do not provide an email verification flag. This should be used sparingly and only for connections that do not provide this flag.
  • Password changes for WordPress users now work properly and are rejected clearly if Auth0 rejects the change (typically because the password does not conform to the password policy). A current API token is not required but your Application does need to allow for a Client Credentials grant with the Management API (this configured for you by default, more information here).
  • The wp-login.php page is no longer used for any callback processing. If you are using this page to process callbacks in a custom plugin or theme, please update to use the main callback URL for the implicit flow /index.php?auth0=implicit. In addition, users that are already logged in will be redirected to the default login page when accessing wp-login.php.
  • Error logging has been improved in general, along with improvements to the error log display. Consecutive, duplicate errors are now combined, the error log now shows more entries, and entries can be cleared from the admin.
  • The "Auto-Login" setting has been renamed to "Universal Login Page" and moved from the Advanced tab to the Features tab. The functionality is the same as before and will retain the existing setting.

Issues and PRs

Closed issues

  • Plugin tries to create a user if they log in a different way #539
  • Problems with implicit login in > 3.6 #536
  • Add authorization token to header for external request #534
  • Configuring auth0 OIDC URL parameters #521
  • Single sign on shows the login username/password fields briefly before automatically signing in #508
  • Better behavior when logged-in users visits wp-login.php #414
  • Profile password update changes #375
  • auth0 forgot password doesn't change WP password #310
  • Woocommerce can't change user password #300

Added

Changed

Deprecated

Fixed

wordpress - 3.7.1

Published by joshcanhelp about 6 years ago

Full Changelog

Closed issues

  • "search_engine=v2 is not available for your tenant because it is deprecated" error #562

Fixed

  • 3.7.1 patch release to fix user search engine in rules #563 (joshcanhelp)
wordpress - 3.7.0

Published by joshcanhelp about 6 years ago

Closed issues

  • Optionally load client ID, secret and domain from environment #480
  • Allow login redirect URL to point to an in-network domain for multi-site #459

Added

Changed

Removed

Fixed

wordpress - 3.6.2

Published by joshcanhelp over 6 years ago

Closed issues

  • auth0_state cookie and Pantheon #494
  • Question: Way to visit directly to Sign Up tab? #489
  • Custom Fields #487
  • TypeError: jQuery(...).tab is not a function #484
  • Error - auth0 cannot find node with id "auth0-login-form" #483

Added

Fixed

wordpress - 3.6.1

Published by joshcanhelp over 6 years ago

Closed issues

  • No versions in Wordpress plugin repo #478
  • Javascript error loading Customize #476

Fixed

wordpress - 3.6.0

Published by joshcanhelp over 6 years ago

3.6.0 (2018-06-05)

Full Changelog

NOTES

  • Passwordless was reconfigured completely to use the combined Lock library (currently hard-coded to 11.5). All current settings will be migrated to the new configuration so your login process should not change. Lock initiation has also been refactored to improve maintainability and adhere to WordPress standards.
  • The Setup Wizard has been adjusted to more clearly explain the process and options available. This only affects new installations using the Setup Wizard for configuration.
  • The settings page has been rearranged and improved overall. New settings descriptions have also been added along with links to documentation, where appropriate.
  • State validation was added to both login flows; nonce validation was added to sites using Implicit flow.
  • OIDC compliant Applications should now function as expected (though this setting is not yet activated by default on installation). OpenID Connect login is now possible by turning off the Client Credentials grant for your WordPress Application.
  • Dashboard widgets have been removed. This can easily be added back as a plugin, if needed. Please contact support if you need assistance with this.
  • A number of new hooks have been added, please see our docs page on extension for a complete inventory with examples. This includes the ability to support refresh tokens.
  • Federated logout has been removed.

Closed issues

  • Expose a configurable toggle that allows Users to state if federated logout should be used #471
  • Updating to 3.5.2 - Fatal error: Uncaught Error: Cannot use object of type stdClass as array in /app/wp-content/plugins/auth0/lib/WP_Auth0_DBManager.php on line 225 #464
  • Autoloader performance issue #461
  • Bad request does not raise error #432
  • Widget URL changes don't save when you are using passwordless #430
  • Deprecate oauth/ro endpoint #410
  • Handling errors #403
  • Fallback /api/v2/users/{id} to /userinfo #401
  • CORS errors #400
  • Provide Resend verification email only for DB connections #345
  • SSO disabled, Single Logout enabled causes users to get logged out automatically a few seconds after logging in #336
  • French translation : html characters #309
  • "Invalid authorization code": Access token is requested twice in a row, breaking the login flow #305
  • Make state work after SSO login #302
  • Is there a way to use Refresh Tokens and Wordpress? #296
  • Only decode the payload before user profile fetch in login manager #283
  • redirect callback errors #280
  • Linked Users won't be able to login using implicit flow and pipeline 2 #272
  • Normalize use of shortcode and widget #260
  • Wrong z-index on modal error message in manual setup #252
  • Logout does not work when Wordpress is locked down (private site) #39

Added

Changed

Deprecated

Removed

Fixed

wordpress - 3.5.2

Published by joshcanhelp over 6 years ago

Please see Important Note on 3.5.0

Closed issues

  • [Security] [URGENT] XSS injection error page #381
  • Non-static method WP_Auth0_Api_Client::convertCertToPem() should not be called statically #380
  • Notices in /lib/admin/WP_Auth0_Admin_Advanced.php #374
  • SSO login failing when not using implicit flow #363
  • "Override WordPress avatars" option doesn't appear to work with comments #355
  • Change log is missing from readme.txt, the separate changelog file is not updated #346
  • Uninstall doesn't remove all Auth0 database plugin entries #322
  • Unable to save migration IPs whitelist #320
  • 3.2.16 throws errors if Error Log is empty #285
  • Login plugin form name incorrect #269

Changed

Fixed

wordpress - 3.5.1

Published by cocojoe over 6 years ago

Please see Important Note on 3.5.0

Fixed

wordpress - 3.5.0

Published by cocojoe over 6 years ago

Important Note

This is a major update that requires changes to your Auth0 Dashboard to be completed. You can save a new API token in your Basic settings in wp-admin before upgrading and the changes will be made automatically during the update. Otherwise, please review your Client Settings, specifically Advanced > Grant Types, and authorize your Client for the Management API.

Changed

Fixed

wordpress - 3.4.0

Published by cocojoe over 6 years ago

Added

Fixed

  • Switching wizard admin user creation to use /dbconnections/signup #356 (joshcanhelp)
wordpress - 3.3.2

Published by cocojoe about 7 years ago

Added

  • Added translation support for a few user-facing exception messages #312 (idpaterson)

Changed

  • Use literal 'wp-auth0' rather than WPA0_LANG constant #311 (idpaterson)
wordpress - 3.2.24

Published by cocojoe about 7 years ago

Changed

Removed

  • Remove client_id/secret validation since it is not allowed anymore #334 (glena)
wordpress - 3.2.23

Published by cocojoe about 7 years ago

Changed

wordpress - 3.2.22

Published by cocojoe over 7 years ago

Fixed

  • Fixed migration for older plugins that use base64 secret #324 (cocojoe)
Package Rankings
Top 18.1% on Packagist.org
Badges
Extracted from project README's
License
Related Projects
wpvulnerability

Plugin WPVulnerability for WordPress. https://wordpress.org/plugins/wpvulnerability/

16 Apr 2022 26
authenticator

This plugin allows you to make your WordPress site accessible to logged in users only.

03 Jul 2012 24
amp-wp

Enable AMP on your WordPress site, the WordPress way.

22 Sep 2015 1,787
wp-plugin-base

Powerful opinated boilerplate for WordPress plugins

29 Apr 2022 13
WordPress-Plugin-Boilerplate-Powered

Wordpress Plugin Boilerplate but Powered with examples and a generator!

26 Jun 2014 749
starter-plugin

Template for WordPress plugins, it took 7️⃣ years to write

14 Jun 2020 46
wordpress-framework-utilities

A set of related utility classes to kick start WordPress development.

25 Apr 2020 0
WordPress-iOS

WordPress for iOS - Official repository

18 Mar 2013 3,619
wp-cli

⚙️ WP-CLI framework

10 Sep 2011 4,859
wordpress-website-lifecycle

How to work with WordPress 📅 for long years

21 Dec 2022 63
WordPress

WordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Pl...

01 Dec 2011 18,893
WordPress-Coding-Standards

PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions

02 May 2011 2,483
wp-feature-notifications

WP Feature Notifications - a proposal to modernise the way in which WordPress handles emails, adm...

14 Jul 2020 188
two-factor

Two-Factor Authentication for WordPress.

23 Oct 2014 724
cliff-wp-plugin-boilerplate

Cliff's WordPress plugin boilerplate

04 Sep 2018 73