PluginProbe
Authorizer / 3.9.0
Authorizer v3.9.0
3.15.3 3.15.2 3.15.1 3.15.0 3.14.3 3.14.4 3.14.2 3.14.1 2.8.1 2.8.2 2.8.3 2.8.4 2.8.5 2.8.6 2.8.7 2.8.8 2.9.0 2.9.1 2.9.10 2.9.11 2.9.12 2.9.13 2.9.2 2.9.3 2.9.6 All 126 releases
← All changes | readme.txt +197 -333 2.8.4 → 3.9.0 View file →
@@ -1,32 +1,32 @@
1 1 === Authorizer ===
2 -Contributors: figureone, the_magician, pkarjala, aargh-a-knot, elarequi, jojaba
3 -Tags: cas, ldap, google, google plus, login, authentication, authorization, access, education, limit login attempts, oauth
4 -Requires at least: 4.4
5 -Tested up to: 4.9.1
6 -Stable tag: trunk
2 +Contributors: figureone, the_magician, pkarjala, aargh-a-knot, elarequi, jojaba, slyraskal
3 +Tags: login, authentication, cas, ldap, oauth
4 +Tested up to: 6.6
5 +Stable tag: 3.9.0
7 6 License: GPLv2 or later
8 7 License URI: http://www.gnu.org/licenses/gpl-2.0.html
9 8
10 -Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
9 +Authorizer limits login attempts, restricts access to specific users, and authenticates against external sources (OAuth2, Google, LDAP, or CAS).
11 10
12 11 == Description ==
13 12
14 -*Authorizer* restricts access to a WordPress site to specific users, typically students enrolled in a university course. It maintains a list of approved users that you can edit to determine who has access. It also replaces the default WordPress login/authorization system with one relying on an external server, such as Google, CAS, or LDAP. Finally, *Authorizer* lets you limit invalid login attempts to prevent bots from compromising your users' accounts.
13 +*Authorizer* restricts access to a WordPress site to specific users, typically students enrolled in a university course. It maintains a list of approved users that you can edit to determine who has access. It also replaces the default WordPress login/authorization system with one relying on an external server, such as Google, CAS, LDAP, or an OAuth2 provider. Finally, *Authorizer* lets you limit invalid login attempts to prevent bots from compromising your users' accounts.
15 14
16 -View or contribute to the plugin source on Github: [https://github.com/uhm-coe/authorizer](https://github.com/uhm-coe/authorizer)
15 +View or contribute to the plugin source on GitHub: [https://github.com/uhm-coe/authorizer](https://github.com/uhm-coe/authorizer)
17 16
18 17 *Authorizer* requires the following:
19 18
20 -* **CAS server** (2.x, 3.x, 4.x, or 5.x) or **LDAP server** (plugin needs the URL)
19 +* **CAS server** (2.x, 3.x, 4.x, 5.x, 6.x, or 7.x) or **LDAP server** (plugin needs the URL)
21 20 * PHP extensions: php-ldap, php-curl, php-dom
22 21
23 22 *Authorizer* provides the following options:
24 23
25 -* **Authentication**: WordPress accounts; Google accounts; CAS accounts; LDAP accounts
24 +* **Authentication**: WordPress accounts; Google accounts; CAS accounts; LDAP accounts; OAuth2 accounts
26 25 * **Login Access**: All authenticated users (all local and all external can log in); Only specific users (all local and approved external users can log in)
27 26 * **View Access**: Everyone (open access); Only logged in users
28 27 * **Limit Login Attempts**: Progressively increase the amount of time required between invalid login attempts.
28 +* **Shortcode**: Use the `[authorizer_login_form]` shortcode to embed a wp_login_form() outside of wp-login.php.
29 29
30 30 == Installation ==
31 31
32 32 1. Upload the `authorizer` directory to the `/wp-content/plugins/` directory
@@ -34,9 +34,9 @@
34 34 1. Specify your server details in the 'Settings' menu in WordPress
35 35
36 36 == Frequently Asked Questions ==
37 37
38 -= Help! I've disabled WordPress logins, my external logins (Google/CAS/LDAP) aren't working, and now I can't get back in! =
38 += Help! I've disabled WordPress logins, my external logins (Google/CAS/LDAP/OAuth2) aren't working, and now I can't get back in! =
39 39
40 40 If you add external=wordpress to the wp-login.php URL querystring, you can always get the WordPress login form to reappear. For example, if your site is at [https://www.example.com](https://www.example.com), then the URL would be: [https://www.example.com/wp-login.php?external=wordpress](https://www.example.com/wp-login.php?external=wordpress)
41 41
42 42 = Where is this plugin used? =
@@ -61,373 +61,237 @@
61 61 12. Authorizer Option overridden by a Network Admin Option.
62 62
63 63 == Changelog ==
64 64
65 -= 2.8.4 =
66 -* Fix when inviting existing users to a blog in multisite and setting a role with a display name that doesn't match the role name. Props @julienlusson for finding the bug!
65 += 3.9.0 =
66 +* Tested up to WordPress 6.6.
67 +* Fix ldap_connect() deprecation notice in PHP 8.3. Props @svyatoslavnetrunner for the [code](https://wordpress.org/support/topic/php8-ldap_connect-deprecation/)!
68 +* Trim whitespace from Google Client ID and Secret. Props @JSLittlefield for the [suggestion](https://wordpress.org/support/topic/solved-white-screen-using-google-authentication/)!
69 +* Allow defining Google Client ID and OAuth2 Client ID via filters (`authorizer_google_client_id` and `authorizer_oauth2_client_id`) or wp-config.php constants (`define( 'AUTHORIZER_GOOGLE_CLIENT_ID', '...' );` and `define( 'AUTHORIZER_OAUTH2_CLIENT_ID', '...' );`) to support integrations with third-party secrets managers (or simply to keep the secrets out of the database in plaintext). Client Secrets were already added in version 3.6.1, this update adds filters and constants for the Client IDs. Props @nks04747 for the [suggestion](https://wordpress.org/support/topic/storing-oauth2-client-id-in-wp-config/)!
70 +* Fix Google/LDAP/Oauth2 secrets fields not hiding in Authorizer Settings if overridden by a filter or constant, and the external service is disabled.
71 +* Fix warning about duplicate DOM IDs in Authorizer Settings.
72 +* Update composer dependencies: guzzlehttp/guzzle (7.8.1 => 7.9.1); guzzlehttp/promises (2.0.2 => 2.0.3); guzzlehttp/psr7 (2.6.2 => 2.7.0); monolog/monolog (2.9.2 => 2.9.3); paragonie/constant_time_encoding (v2.6.3 => v2.7.0); phpseclib/phpseclib (3.0.37 => 3.0.39); psr/http-factory (1.0.2 => 1.1.0); symfony/deprecation-contracts (v2.5.2 => v2.5.3).
67 73
68 -= 2.8.3 =
69 -* Fix for using wp-cli to activate the plugin (broke in 2.8.0). Props @timkite for the discovery!
70 -* Fix for network-activating authorizer via wp-cli.
74 += 3.8.5 =
75 +* Fix database migrations re-running in complex multisite multi-network setups. Props @mpemburn for the research (and endurance) to discover the [root cause](https://wordpress.org/support/topic/numerous-set_default_options-calls-cause-site-to-crash/)!
71 76
72 -= 2.8.2 =
73 -* Revert overly strict querystring sanitization (caused CAS login problems in servers that don’t encode forward slashes as %2F in querystring values). Props @anamba for the report and bug testing!
77 += 3.8.4 =
78 +* Update French translations. Props @julienlusson!
79 +* Fix TinyMCE settings fields sometimes uneditable. Props dorianborovina for the detailed [bug report](https://github.com/uhm-coe/authorizer/issues/152)!
80 +* Remove package-lock.json (development dependency).
74 81
75 -= 2.8.1 =
76 -* Force asset reload (coding standards changed the formatting of a lot of js and css assets).
82 += 3.8.3 =
83 +* Disable caching on the Authorizer Settings page to reduce memory footprint. Props @timkite for the [report](https://wordpress.org/support/topic/authorizer-admin-page-using-too-much-memory/)!
84 +* Add zh_CN translation. Props pinke for the [pull request](https://github.com/uhm-coe/authorizer/pull/150)!
85 +* Update translatable strings.
77 86
78 -= 2.8.0 =
79 -* Add authorizer_ldap_search_filter filter (for customizing the LDAP search filter to further restrict LDAP logins). Props @jesus33c for the idea!
80 -* Add authorizer_user_register action. Props @pablo-tapia for the suggestion!
81 -* Allow CAS servers behind redirected URLs. Props @cwhunt for the code!
82 -* Check CAS server reachability by testing serviceValidate endpoint. Props @cwhunt for the code!
83 -* Allow "No role for this site" as a default role for new users. Props @julienlusson for the pull request!
84 -* Update French translations. Props @julienlusson for the pull request!
85 -* Update code to follow WordPress coding standards (php, css, js). Props @michaeldfoley for fixing a bug with our overzealous sanitization!
86 -* Update cacert.pem.
87 -* Fix bug with paging on network approved user list.
88 -* Note: this version requires WordPress 4.4 or later.
87 += 3.8.2 =
88 +* Fix new user always assigned default role on first login instead of role in approved list. Bug introduced in 3.8.1. Props @melidonis for the [report](https://wordpress.org/support/topic/new-users-role-reverted-to-subscriber/)!
89 89
90 -= 2.7.2 =
91 -* Fix Approved User list sort when set to Date approved / Descending (was still showing as ascending).
92 -* Support multiple LDAP search bases. Props @jmutsaerts for the feature request.
90 += 3.8.1 =
91 +* Add missing OAuth2 automatic login multisite option.
93 92
94 -= 2.7.1 =
95 -* Compatibility fix for PHP < 5.5. Props @klausdk for the report!
96 -* Additional fix for role not getting set when adding an existing user to a site in multisite. Props @julienlusson for the fix!
93 += 3.8.0 =
94 +* Block the WordPress lost password endpoint if Authorizer is configured to disable WordPress logins. Props @manakuke for the [discovery](https://wordpress.org/support/topic/remove-block-forgot-password-page/)!
95 +* Allow immediately showing OAuth2 login form if it’s the only external service enabled and WordPress logins are hidden (e.g., skip showing the “Log In with OAuth2” button on wp-login.php). Props @dblas for the [suggestion](https://wordpress.org/support/topic/bypassing-the-wp-log-on-screen/)!
96 +* Generate performant translations from .mo files. See: https://make.wordpress.org/core/2024/02/27/i18n-improvements-6-5-performant-translations/
97 +* Fix role change in authorizer_custom_role filter not synced to approved list. Props mdebski for the [issue and research](https://github.com/uhm-coe/authorizer/issues/149)!
98 +* Fix duplicate delete option during uninstall routine.
99 +* Fix unneeded role dropdown for blocked users (since blocked users get their roles removed, this was causing php warnings on checking strlen() on the null role value).
100 +* Tested up to WordPress 6.5.3.
97 101
98 -= 2.7.0 =
99 -* Feature: Approve multiple users at once (by pasting their email addresses into the new approved user field, separated by newlines, spaces, commas, or semicolons).
100 -* Feature: Paging, sorting, and searching in the Approved User list for sites with many users (finally!).
101 -* Update LDAP TLS option for clarity. Props @Scriptkiddi for the pull request!
102 -* Support deprecated multisite constant BLOGID_CURRENT_SITE in addition to BLOG_ID_CURRENT_SITE. Props @er2576 for tracking that down!
103 -* Fix for CAS logouts not working in some situations (remove CAS isAuthenticated() check before CAS logout).
104 -* Fix for updating approved list entry when an email address change is made on the WordPress user profile page in a multisite environment.
105 -* Fix for role not getting set when creating and adding a new user to a blog in multisite. Props @julienlusson for the report and @pkarjala for the fix!
102 += 3.7.1 =
103 +* Replace jquery.multi-select composer dependency with local copy (since the composer package was removed). Props @julienlusson the catch!
106 104
107 -= 2.6.23 =
108 -* Added ability to disable the dashboard widget (useful on sites with many users until paged user lists are implemented).
109 -* Fix for the multisite option override link always going to the External Services tab.
110 -* Fix for hide/show of Login Access options when certain options are selected.
105 += 3.7.0 =
106 +* Drop support for PHP 7.2 and 7.3. Minimum PHP version is now 7.4 (due to google-api-php-client requirements).
107 +* Simple History now logs a different message if the global lockout is triggered on a nonexistent user. Props @TuringTux for the [pull request](https://github.com/uhm-coe/authorizer/pull/143)!
108 +* Update French translations. Props @julienlusson!
109 +* Fix incrementing the wrong failed login counter if failed login used an email address instead of a username. Now the specific user counter is incremented instead of the global/nonexistent user counter. Props @TuringTux for the [report and investigation](https://github.com/uhm-coe/authorizer/issues/138)!
110 +* Fix for PHP warning when viewing admin pages in Pressbooks.
111 +* Fix for PHP warning about missing `ldap_test_user` setting on some multisite installs.
112 +* Remove old jQuery library from multi-select package (has XSS vulnerabilities).
113 +* Update composer dependencies: google/apiclient (v2.13.2 => v2.14.0); thenetworg/oauth2-azure (v2.1.1 => v2.2.2); components/jquery (3.6.0 => v3.7.1); google/apiclient-services (v0.297.0 => v0.302.0); guzzlehttp/guzzle (7.5.1 => 7.8.1); guzzlehttp/promises (1.5.2 => 2.0.2); guzzlehttp/psr7 (2.5.0 => 2.6.2); monolog/monolog (2.9.1 => 2.9.2); phpseclib/phpseclib (3.0.19 => 3.0.37); psr/http-client (1.0.2 => 1.0.3).
111 114
112 -= 2.6.22 =
113 -* Fix for regression showing certain private posts. Props @InvisibleMass for finding the bug!
114 -* Fix for users without the php-mbstring extension installed.
115 -* Update jQuery multi-select plugin from 0.9.8 to 0.9.12.
116 -* Fix for bug in syncing user roles during login. Props @dsusco for the pull request!
115 += 3.6.3.1 =
116 +* Compatibility fix for Oxygen Builder.
117 117
118 -= 2.6.21 =
119 -* Fix broken logins caused by regression on previous fix for multivalued email attribute
118 += 3.6.3 =
119 +* Update helper text for the LDAP STARTTLS option. Props @TuringTux for the [pull request](https://github.com/uhm-coe/authorizer/pull/132)!
120 +* Update French translations. Props @julienlusson!
121 +* Update composer dependencies (phpseclib/phpseclib 3.0.18 => 3.0.19; psr/http-message 1.0.1 => 1.1; psr/http-factory 1.0.1 => 1.0.2; guzzlehttp/psr7 2.4.3 => 2.5.0; apereo/phpcas 1.6.0 => 1.6.1; firebase/php-jwt v6.3.2 => v6.4.0; google/apiclient v2.13.0 => v2.13.2; google/apiclient-services v0.285.0 => v0.297.0; google/auth v1.25.0 => v1.26.0; guzzlehttp/guzzle 7.5.0 => 7.5.1; league/oauth2-client 2.6.1 => 2.7.0; monolog/monolog 2.8.0 => 2.9.1; psr/http-client 1.0.1 => 1.0.2).
122 +* Fix: Remove private pages from search results and archives if visitor is an anonymous user and site is configured to only allow logged in users to see the site. Props @ramrajone for the bug report!
123 +* Fix: Allow minor clock drift (30s) between the WordPress server and Google's server when processing Google logins.
124 +* Tested up to WordPress 6.2.
120 125
121 -= 2.6.20 =
122 -* Fix for issue with incorrect parsing of an array of email addresses to be converted to lowercase.
123 -* Fix for nonce cookie issue on google logins where cookie was being sent after headers, resulting in an error message.
126 += 3.6.2 =
127 +* Performance tweaks during Authorizer updates on large multisites.
128 +* Ensure lockout values are integers for invalid login attempts (php8 compatibility).
129 +* Check for existence of super admin roles before adding super admin to approved list on multisite activation.
130 +* Update French translations. Props @julienlusson!
131 +* Allow defining LDAP Directory User and Password via filters (`authorizer_ldap_user` and `authorizer_ldap_password`) or wp-config.php constants (`define( 'AUTHORIZER_LDAP_USER', '...' );` and `define( 'AUTHORIZER_LDAP_PASSWORD', '...' );`) to support integrations with third-party secrets managers (or simply to keep the secrets out of the WordPress database).
132 +* Allow `authorizer_custom_role` filter on admin logins.
124 133
125 -= 2.6.19 =
126 -* Fix for issue with case sensitivity checks on user emails affecting role assignments, user deletions, and user updates in Authorizer. All existing uppercase emails in Authorizer will migrate to lowercase as users log in. Thank you again to @mmcglynn for continued extensive help in testing.
127 -* Update CAS server connection check to accept 300 response codes as valid presence of a CAS server. It is the administrator's duty to ensure that a redirect on their CAS url is acceptable.
134 += 3.6.1 =
135 +* Allow defining Google Client Secret and OAuth2 Client Secret via filters (`authorizer_google_client_secret` and `authorizer_oauth2_client_secret`) or wp-config.php constants (`define( 'AUTHORIZER_GOOGLE_CLIENT_SECRET', '...' );` and `define( 'AUTHORIZER_OAUTH2_CLIENT_SECRET', '...' );`) to support integrations with third-party secrets managers (or simply to keep the secrets out of the database in plaintext).
136 +* Handle arrays in CAS attribute for first/last name.
137 +* Fix: conflict with W3 Total Cache (when using Azure CDN provider that uses an older guzzlehttp library). [Check status](https://github.com/W3EDGE/w3-total-cache/issues/642)
138 +* Fix: only clean up Google session on logout if it exists.
139 +* Fix: Remove all plugin options in database upon deletion/uninstall.
140 +* Fix: Handle Google login error triggered when a stale browser window sends a login request.
141 +* Upgrade composer dependencies (firebase/php-jwt v6.3.1 => v6.3.2, google/apiclient v2.12.6 => v2.13.0, google/apiclient-services v0.272.1 => v0.285.0, google/auth v1.23.1 => v1.25.0, phpseclib/phpseclib 3.0.17 => 3.0.18).
142 +* Mention OAuth2 support in readme.txt.
143 +* Update translatable strings.
128 144
129 -= 2.6.18 =
130 -* Fix for issue with approved list roles not updating correctly when changed using the authorizer_custom_role hook. Thank you to @mmcglynn for extensive help in testing.
131 -* Fix for issue with removing user's roles when removing them from a multisite WordPress install.
145 += 3.6.0 =
146 +* Security: update to [phpCAS 1.6.0](https://github.com/apereo/phpCAS/releases/tag/1.6.0) to address CVE-2022-39369.
147 +* Update composer dependencies (google/apiclient-services 0.271.0 => 0.272.1; google/auth 1.23.0 => 1.23.1; firebase/php-jwt 6.3.0 => 6.3.1; guzzlehttp/psr7 2.4.1 => 2.4.3; phpseclib/phpseclib 3.0.16 => 3.0.17).
148 +* Fix CAS logouts on proxied CAS servers.
149 +* Set default values for missed multisite option ldap_test_user.
150 +* Respect redirect_to param to wp-login.php with Azure logins. Props @manakuke for discovering the [issue](https://github.com/uhm-coe/authorizer/commit/a3d28a91c4ef6bdb32a567f4e5073ed250577ee3)!
132 151
133 -= 2.6.17 =
134 -* Fix for approved list roles not updating if changed on the fly in authorizer_custom_role hook.
135 -* Update phpCAS from 1.3.4 to 1.3.5. See [changelog](https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog).
152 += 3.5.0 =
153 +* Migrate Google Sign-In to Google Identity Services library. Details [here](https://developers.google.com/identity/gsi/web/guides/migration).
154 +* Fix inconsistent labels by network users in the approved list (WordPress multisite).
155 +* Update composer dependencies (google/apiclient-services v0.269.0 => v0.271.0).
136 156
137 -= 2.6.16 =
138 -* Fix: Remove user's role when removing them from the approved list. This is a security feature, in case a removed user is presumed deleted from the site. Since Authorizer does not delete users (to avoid the issue of reassigning or deleting that user’s content), removing their role removes all capabilities from the site until they are re-added to the approved list.
157 += 3.4.2 =
158 +* Update French translations. Props @julienlusson!
159 +* Fix password reset for WordPress users when "Immediately redirect to CAS login form." Props @pkarjala for the [fix](https://github.com/uhm-coe/authorizer/issues/121)!
160 +* Upgrade composer dependencies (firebase/php-jwt 5.5.1 => 6.3.0; google/apiclient-services v0.254.0 => v0.269.0; google/auth v1.21.1 => v1.23.0; guzzlehttp/guzzle 7.4.5 => 7.5.0; guzzlehttp/promises 1.5.1 => 1.5.2; guzzlehttp/psr7 2.4.0 => 2.4.1; monolog/monolog 2.7.0 => 2.8.0; phpseclib/phpseclib 3.0.14 => 3.0.16; symfony/deprecation-contracts 2.5.1 => 2.5.2; thenetworg/oauth2-azure 2.0.1 => v2.1.1).
139 161
140 -= 2.6.15 =
141 -* Fix for duplicate users in approved list (users added via authorizer_automatically_approve_login filter were re-added to approved list each time they logged in).
162 += 3.4.1 =
163 +* Add setting to support CAS servers behind proxies. Props @slyraskal for the [pull request](https://github.com/uhm-coe/authorizer/pull/117)!
142 164
143 -= 2.6.14 =
144 -* Move nonce cookie creation to the first time it is needed (for Google logins). Props @emsearcy for the pull request!
165 += 3.4.0 =
166 +* Upgrade guzzlehttp from 7.4.2 to 7.4.5.
167 +* Upgrade composer dependencies (apereo/phpcas 1.4.0 => 1.5.0; google/apiclient v2.12.4 => v2.12.6; google/apiclient-services v0.246.0 => v0.254.0; google/auth v1.21.0 => v1.21.1; monolog/monolog 2.5.0 => 2.7.0; paragonie/constant_time_encoding 2.5.0 => 2.6.3).
168 +* Authorizer now requires PHP 7.2 or higher (phpCAS requirement).
145 169
146 -= 2.6.13 =
147 -* Respect redirect_to param on CAS logout (if param exists). Props @dgoldber for finding that!
170 += 3.3.3 =
171 +* Add multisite option to prevent subsites from overriding multisite settings.
172 +* Allow LDAP bind as user logging in before attempting anonymous bind (by using the [username] wildcard in the LDAP Directory User settings field).
173 +* Add LDAP test connection to Authorizer multisite settings.
174 +* Tested up to WordPress 6.0.
175 +* Update translatable strings.
176 +* Update French translations. Props @julienlusson!
148 177
149 -= 2.6.12 =
150 -* Better detection of fuzzy permalink matches for private pages. Applies if site is restricted but 404 pages are marked as public; if this was the case, anonymous visitors to malformed permalinks (e.g., “example.com/sample page” or “example.com/sample%20page” instead of “example.com/sample-page”) were able to see the restricted page. Props @6hogan for finding that!
178 += 3.3.2 =
179 +* Attempt LDAP bind as user logging in if directory user credentials not provided or incorrect.
180 +* Fixed logged errors if LDAP search base couldn't be found (error only shows in LDAP test connection now).
181 +* Fixed LDAP test connection password saved in database.
182 +* Upgrade composer dependencies (google/apiclient v2.12.2 => v2.12.4; google/apiclient-services v0.242.0 => v0.246.0; google/auth v1.19.0 => v1.21.0; monolog/monolog 2.4.0 => 2.5.0).
151 183
152 -= 2.6.11 =
153 -* Fix for CAS logins redirecting to the redirect_to param of wp-login.php.
154 -* Fix for redirect after CAS logout on some CAS servers requiring whitelisted services (add a trailing slash to the logout service param).
184 += 3.3.1 =
185 +* Upgrade composer dependencies (firebase/php-jwt v5.4.0 => v5.5.1; google/apiclient v2.11.0 => v2.12.2; google/apiclient-services v0.213.0 => v0.242.0; google/auth v1.18.0 => v1.19.0; guzzlehttp/guzzle 7.3.0 => 7.4.2; guzzlehttp/promises 1.4.1 => 1.5.1; league/oauth2-client 2.6.0 => 2.6.1; monolog/monolog 2.3.4 => 2.4.0; paragonie/constant_time_encoding v2.4.0 => v2.5.0; phpseclib/phpseclib 3.0.10 => 3.0.14).
186 +* Upgrade guzzlehttp/psr7 2.0.0 => 2.2.1 (security).
155 187
156 -= 2.6.10 =
157 -* Allow multiple whitelisted domains under Google Hosted Domain. Props Michael K. for the suggestion!
158 -* Drop php-mcrypt library dependency (use openssl library instead since mcrypt is deprecated as of PHP 7.1).
159 -* Fix for some CAS servers redirecting to improper WordPress destination. Props @asithade for the [pull request](https://github.com/uhm-coe/authorizer/pull/29)!
160 -* Fix for mixed-case LDAP attribute names (first name, last name, email) not being recognized because ldap_get_entries() returns attirbute names in lowercase. Props @yatesconsulting for the [report](https://github.com/uhm-coe/authorizer/issues/27)!
161 -* Fix for immediate CAS redirect hook firing after content was sent to browser, triggering a PHP warning if output buffering isn't enabled on the web server. Props @steven1350 for reporting the bug!
162 -
163 -= 2.6.9 =
164 -* Fix for LDAP logins failing if the user password contained a single quote, double quote, or a backslash. Props @alxbr for the research!
165 -
166 -= 2.6.8 =
167 -* Fix for edge case where a network approved user wouldn't be allowed to visit wp-admin on a site they had not been added to yet.
168 -* Fix for quotation marks in LDAP password causing LDAP bind to fail.
169 -* Fix for issues with marking translated (via WPML) categories public. Props @mafoti for the pull request!
170 -* Fix for placeholder text for plugin option fields being mistaken for actual values. Props @pkarjala for the pull request!
171 -* Fix for blocked flag in usermeta not getting removed when unblocking a user.
172 -* Feature: Add filter to inspect CAS attributes and automatically approve a user based on any values there. Example:
173 -```
174 -/**
175 - * Filter whether to automatically approve the currently logging in user
176 - * based on any of their user attributes.
177 - *
178 - * @param bool $automatically_approve_login
179 - * Whether to automatically approve the currently logging in user.
180 - * @param array $user_data User data returned from external service.
181 - */
182 -function approve_all_faculty_logins( $automatically_approve_login, $user_data ) {
183 - // Automatically approve logins for all faculty members.
184 - if (
185 - isset( $user_data['cas_attributes']['eduPersonAffiliation'] ) &&
186 - 'faculty' === $user_data['cas_attributes']['eduPersonAffiliation']
187 - ) {
188 - $automatically_approve_login = true;
189 - }
190 - return $automatically_approve_login;
191 -}
192 -add_filter( 'authorizer_automatically_approve_login', 'approve_all_faculty_logins', 10, 2 );
193 -```
194 -
195 -
196 -= 2.6.7 =
197 -* Support LDAP URI in hostname field (e.g., ldaps://ldap.example.edu:636). Props @timkite for your contribution!
188 += 3.3.0 =
189 +* Add LDAP connection test feature (under LDAP settings).
198 190 * Update translatable strings.
199 -* Simplify CAS login routine.
191 +* Update French translations. Props @julienlusson!
192 +* Add settings icon to dashboard widget header.
193 +* Better styling in dashboard widget.
194 +* Remove "Local WordPress user" icon from Approved User list (uninformative).
195 +* Small coding standards fixes.
200 196
201 -= 2.6.6 =
202 -* Fix for mixed line endings in phpCAS library, causing warnings when running PHP Compatibility Checker plugin. Props @wpgirl369/@eshannon3 for the pull request!
203 -* Fix: Never block access to super admins (or admins in single site mode). Props @eizzumdm and @nreljin!
204 -* Add user to network approved list when they are granted super admin privileges on the Edit User screen outside of Authorizer. Remove user from network approved list when this is revoked (and readd them to the approved list on any site they are currently a member of).
205 -* Fix for notification emails sent to all site users if plugin wasn't correctly activated.
206 -* Handle CAS servers that return an email address in response to phpCAS::getUser()
197 += 3.2.2 =
198 +* Fix PHP warning when anonymous users browse a restricted site.
199 +* Only load authorizer-public.js when necessary (when site is configured so only logged in users can view the site, current user does not have access, and anonymous users should be shown a message). Props @flim0 for the catch!
207 200
208 -= 2.6.5 =
209 -* Use wp_remote_get() instead of curl to check CAS server availability. php-curl is no longer a dependency.
210 -* Fix for error introduced in last version with cacert.pem updating.
201 += 3.2.1 =
202 +* Fix generic OAuth2 connector unable to create username from email. Props @abnerjacobsen for the [bug report](https://github.com/uhm-coe/authorizer/issues/106)!
203 +* Redirect to home page after logging in if using custom login url via the WPS Hide Login plugin. Props @wixaw for the [report](https://github.com/uhm-coe/authorizer/issues/103).
211 204
212 -= 2.6.4 =
213 -* Use wp_safe_remote_get() instead of file_get_contents() to update cacert.pem. Props @kriswme2!
214 -* Fix error message shown when login form is first shown and LDAP is enabled. Props @akompanas!
215 -* Fix for lengthy timeout if ldap_start_tls() fails when connecting to an LDAP server. Props @TJuberg!
216 -* Fix a bug preventing first-time login of an approved user when a WordPress user already existed with the same username (but a different email address).
217 -* Remove the spinner overlay when logging in via Google (user could accidentally close the Google sign-in popup, and the spinner prevented them from reopening it by clicking on the "Sign In with Google" button).
218 -* Clean up plugin files (rename 'inc' directory to 'vendor').
219 -* Fix for CAS version option being selectable when it's been multisite overridden.
220 -* Fix for missing translatable string (anonymous access message in bootstrap dismissible alert).
221 -* Show all roles in all sites on the Approved Users role dropdown in network admin.
222 -* Make sure role is updated on all sites when approving a new multisite user that already exists in WordPress.
205 += 3.2.0 =
206 +* Tested up to WordPress 5.8.
207 +* Authorizer now requires PHP 7.2.5 or higher to support its dependencies. See: [this](https://wordpress.org/about/requirements/) and [this](https://www.php.net/supported-versions.php) if you are running an outdated version of PHP.
208 +* Fix for PHP versions below 7.3 (`array_key_last()` is not available for older PHP versions and was added in the last update). Props @ianchan-1 for reporting the issue!
209 +* Update dependencies (apereo/phpcas 1.3.9 => 1.4.0; components/jquery 3.5.1 => 3.6.0; firebase/php-jwt v5.3.0 => v5.4.0; google/auth v1.16.0 => v1.18.0; google/apiclient v2.9.2 => v2.11.0; google/apiclient-services v0.201.0 => v0.213.0; google/auth v1.15.1 => v1.17.0; guzzlehttp/guzzle 6.5.5 => 7.3.0; guzzlehttp/psr7 1.8.2 => 2.0.0; monolog/monolog 1.26.1 => 2.3.4; paragonie/random_compat v2.0.20 => v9.99.100; phpseclib/phpseclib 2.0.32 => 3.0.10).
210 +* Add LDAP Search Filter to plugin settings. Props @hbjusa for the [pull request](https://github.com/uhm-coe/authorizer/pull/102)!
211 +* Add [authorizer_login_form] shortcode. Props @shredderwoods and @hilfans for the suggestions!
223 212
224 -= 2.6.3 =
225 -* Feature: Add user to authorizer approved list when added from the Users screen.
226 -* Feature: In multisite, add approved user to all approved sites on first login.
227 -* Feature: Sync role and email address in approved list when changed elsewhere.
228 -* Feature: Add super admins to network approved list on plugin activation.
229 -* Feature: Allow "no role for this site" selection for user roles.
230 -* Fix for existing WordPress user logging in: make sure they are in the approved list.
231 -* Fix for local (WordPress) authentication not respecting the blocked list.
232 -* Fix for whitespace and "mailto:" in emails (trim when clicking approve button).
233 -* Fix for external=wordpress safety login not working if option to immediately redirect to CAS is enabled.
234 -* Fix for deprecation warning in WordPress 4.6: wp_get_sites().
235 -* Fix for deprecation warning in WordPress 4.6: wp_new_user_notification().
236 -* Fix for multisite users not being removed from pending lists.
237 -* Improve code efficiency.
213 += 3.1.2 =
214 +* Fix PHP warnings about uninitialized oauth2_hosteddomain option.
238 215
239 -= 2.6.2 =
240 -* Revert LDAP/CAS email domain guessing logic (some existing users rely on the old method to determine email address domains). If email domain or CAS/LDAP attribute containing email address is not specified in Authorizer options, guess that email domain is the last two components of the CAS/LDAP host when splitting by periods (e.g., authn.example.com would return an email domain of example.com).
216 += 3.1.1 =
217 +* Update French translations. Props @julienlusson!
218 +* Note: the next minor version of Authorizer, 3.2, will drop support for PHP 5.6 in order to stay current with phpCAS releases, which now require a minimum of PHP 7.0.
241 219
242 -= 2.6.1 =
243 -* Tested up to WordPress 4.6.1.
244 -* Update cacert.pem file.
220 += 3.1.0 =
221 +* Note: the next minor version of Authorizer, 3.2, will drop support for PHP 5.6 in order to stay current with phpCAS releases, which now require a minimum of PHP 7.0.
222 +* Update phpCAS dependency from 1.3.8 to 1.3.9.
223 +* Allow restricting OAuth2 logins to a specific domain (of the email address of users authenticating).
224 +* Update oauth2-azure dependency from 2.0.0 to 2.0.1.
225 +* Update Google APIs Client Library for PHP dependency from 2.8.3 to 2.9.2.
226 +* Update Google PHP API Client Services dependency from 0.156 to 0.201.0.
227 +* Update dependencies of dependencies (firebase/php-jwt 5.2.0 => 5.3.0; google/auth 1.14.3 => 1.15.1; guzzlehttp/promises 1.4.0 => 1.4.1; guzzlehttp/psr7 1.7.0 => 1.8.2
228 +monolog/monolog 1.26.0 => 1.26.1; paragonie/random_compat 2.0.19 => 2.0.20; phpseclib/phpseclib 2.0.31 => 2.0.32; psr/log 1.1.3 => 1.1.4).
229 +* Update translatable strings.
245 230
246 -= 2.6.0 =
247 -* Tested up to WordPress 4.6.
248 -* Feature: Add method for constructing email address for CAS/LDAP servers that don't return an email attribute. Simply enter @yourdomain.edu into the mail attribute field to have email addresses be constructed as username@yourdomain.edu.
249 -* Fix: Updates to cacerts.pem for CAS servers now works for WordPress installs behind a proxy. Props dchambel! https://github.com/uhm-coe/authorizer/pull/13
250 -* Feature: Allow restricting Google logins to a single Google Apps hosted domain (e.g., mycollege.edu).
251 -* Update google-api-php-client from 1.0.5-beta to 1.1.5.
252 -* Fix for REST API integration: Authorizer will now deny read/view access via the REST API if the site is private and the user is not authenticated. Other REST API access is unaffected by Authorizer, and is managed by the REST API authentication schema (cookie, oauth, or basic authentication). See [http://v2.wp-api.org/guide/authentication/](http://v2.wp-api.org/guide/authentication/) for details.
253 -* Fix: Warn if php_openssl.dll is not installed on Windows servers (cannot update cacert.pem if it's missing).
254 -* Fix for mcrypt key length error in php 5.6 and higher.
255 -* Fix for broken newlines in notification emails (also update translations).
256 -* Feature: Customize user roles based on CAS or LDAP attributes. Example:
257 -```
258 -/**
259 - * Filter the default role of the currently logging in user based on any of
260 - * their user attributes.
261 - *
262 - * @param string $default_role Default role of the currently logging in user.
263 - * @param array $user_data User data returned from external service.
264 - */
265 -function my_authorizer_custom_role( $default_role, $user_data ) {
266 - // Allow library guests to log in via CAS, but only grant them 'subscriber' role.
267 - if (
268 - isset( $user_data['cas_attributes']['eduPersonPrimaryAffiliation'] ) &&
269 - 'library-walk-in' === $user_data['cas_attributes']['eduPersonPrimaryAffiliation']
270 - ) {
271 - $default_role = 'subscriber';
272 - }
273 - return $default_role;
274 -}
275 -add_filter( 'authorizer_custom_role', 'my_authorizer_custom_role', 10, 2 );
276 -```
277 231
278 -= 2.5.1 =
279 -* Updated Spanish translations. Props @elarequi.
280 -* Fix: Include translatable strings found in javascript files.
281 -* Fix: Force lowercase emails from LDAP. Props @akompanas.
282 -* Fix: Set some LDAP defaults likely to be the same on all installs
: ldap_port, ldap_attr_username.
283 -* Fix: Construct LDAP default email domain from LDAP search base, not from host (helps to differentiate between subdomain installs and domains with country codes).
232 += 3.0.10 =
233 +* Sync role to approved list if edited via bulk action on All Users page. Props @lukeislucas for discovering that edge case!
234 +* Remove unused params in sanitize_user_list().
284 235
285 -= 2.5.0 =
286 -* Translations: Props to @elarequi for wrapping text strings in the translation functions and for providing Spanish translations.
287 - - Fichero authorizer.php: Se preparan todas las cadenas necesarias, para hacerlas traducibles.
288 - - Se crea el directorio /languages, con los ficheros de traducción.
289 -* Translations: Props @jojaba for providing French translations.
290 -* Feature: Allow 404 pages to be shown publicly on restricted sites.
291 -* Feature: Add filter to inspect CAS attributes and deny access based on any values there. Props @jojaba for the suggestion. Example:
292 -```
293 -/**
294 - * Filter whether to block the currently logging in user based on any of their
295 - * user attributes.
296 - *
297 - * @param bool $allow_login Whether to block the currently logging in user.
298 - * @param array $user_data User data returned from external service.
299 - */
300 -function check_cas_attributes( $allow_login, $user_data ) {
301 - // Block access to CAS logins from library guests.
302 - if (
303 - isset( $user_data['cas_attributes']['eduPersonPrimaryAffiliation'] ) &&
304 - 'library-walk-in' === $user_data['cas_attributes']['eduPersonPrimaryAffiliation']
305 - ) {
306 - $allow_login = false;
307 - }
308 - return $allow_login;
309 -}
310 -add_filter( 'authorizer_allow_login', 'check_cas_attributes', 10, 2 );
311 -```
236 += 3.0.9 =
237 +* Update phpseclib 2.0.30 => 2.0.31 (CVE-2021-30130).
312 238
313 -* Feature: Add action for inspecting attributes returned from CAS.
314 -* Fix: Users deleted in WordPress will be removed from Authorizer lists. Props @jojaba for catching that.
315 -* Fix: Some plugin options were getting reset when switching between multisite and single site modes. Props @jojaba for finding it.
316 -* Fix: Save button in multisite options was unavailable when disabling multisite override.
317 -* Cleaned up code complexity. Props @mackensen for the pull requests.
239 += 3.0.8 =
240 +* Fix misplaced "This setting is overridden by a multisite option" in subsite settings within a multisite (caused by change in wp-admin core styles).
241 +* Link to appropriate tab in multisite settings when clicking "This setting is overridden by a multisite option."
242 +* Fix for warnings setting first/last name on new pending user.
243 +* Use [standardized WordPress 5.7 admin colors](https://make.wordpress.org/core/2021/02/23/standardization-of-wp-admin-colors-in-wordpress-5-7/).
318 244
319 -= 2.4.0 =
320 -* Feature: Add option to log into CAS automatically (only if no other external service is configured, and only if WordPress logins are hidden). Props @manakuke for the idea!
321 -* Feature: Option to configure older CAS server versions (SAML_VERSION_1_1, CAS_VERSION_3_0, CAS_VERSION_2_0, CAS_VERSION_1_0). Props @autredr for the suggestion and helping debug!
322 -* Fix: Better CAS server availability checking. Props @autredr for the code!
323 -* Documentation: readme.txt now includes the URL to access WordPress logins if they've been disabled.
324 -* Update phpCAS from 1.3.3 to 1.3.4. See [changelog](https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog).
325 -* Fix for [WordPress REST API (Version 2)](https://wordpress.org/plugins/rest-api/) bypassing Authorizer restricted access. Props @nurbson for the report.
245 += 3.0.7 =
246 +* Fix jQuery deprecation notices in WordPress 5.7.
247 +* Tested up to WordPress 5.7.
326 248
327 -= 2.3.12 =
328 -* The username of new LDAP users will be the value of the attribute specified in "LDAP attribute containing username" instead of the portion of their email address before the @ symbol.
249 += 3.0.6 =
250 +* Restore PHP 5.6 compatibility.
329 251
330 -= 2.3.11 =
331 -* Fix for issue with LDAP logins created in the last update. Props @ebraux for the [report](https://wordpress.org/support/topic/ldap-external-stopped-working-since-updating-to-2410)!
252 += 3.0.5 =
253 +* Fix REST API access restriction (allow app passwords introduced in WordPress 5.6).
332 254
333 -= 2.3.10 =
334 -* Handle multiple email addresses registered to a single CAS login (if any are blocked, the user is blocked; otherwise if any are approved, the user is approved).
335 -* Better error reporting on CAS errors.
255 += 3.0.4 =
256 +* PHP 8 compatibility.
257 +* Fix warnings about uninitialized oauth2 options.
258 +* Update Google API PHP Client from 2.8.1 to 2.8.3 (composer update google/apiclient).
259 +* Update Google API PHP Client Services from 0.152 to 0.156 (composer update google/apiclient-services).
260 +* Update composer dependencies (monolog 2.1.1 => 2.2.0; phpseclib 2.0.29 => 2.0.30).
336 261
337 -= 2.3.9 =
338 -* Fix for conflict with [WordPress REST API (Version 2)](https://wordpress.org/plugins/rest-api/) plugin. Props @nurbson for the report.
262 += 3.0.3 =
263 +* Fix php errors causing authorizer.js and some vendor assets not to load on network admin. Props @julienlusson for finding this bug!
339 264
340 -= 2.3.8 =
341 -* Fix for a fringe case where WordPress users removed from the approved list weren't blocked from accessing a site restricted to approved users.
265 += 3.0.2 =
266 +* Add tenant-specific configuration option to Microsoft Azure oauth2 provider.
342 267
343 -= 2.3.7 =
344 -* Feature: Show number of users in pending, approved, and blocked lists on Authorizer options page. Props @manakuke for the idea!
268 += 3.0.1 =
269 +* Add Microsoft Azure oauth2 provider.
270 +* Updated French translations. Props @julienlusson for the [pull request](https://github.com/uhm-coe/authorizer/pull/96)!
345 271
346 -= 2.3.6 =
347 -* Feature: Allow anonymous LDAP binds.
348 -* Fix: Concurrency issue with large number of approved users. Props @manakuke.
272 += 3.0.0 =
273 +* Authenticate with more providers via OAuth2. Let us [know](https://github.com/uhm-coe/authorizer/issues) if you have any troubles integrating your OAuth2 provider.
274 +* Add filter `authorizer_oauth2_generic_authorization_parameters` for targeting the specifics of generic oauth2 providers. Provide an array with options, such as `array( 'scope' => 'user:email' )`, to customize your generic oauth2 provider.
275 +* Add filter `authorizer_oauth2_generic_authenticated_email` for manually inspecting the results returned from the oauth2 provider to find the resource owner's email to give to WordPress for the authenticated user. Use this for oauth2 providers that release email addresses in nonstandard places.
276 +* Fix first/last names not getting updated for admins on a CAS or LDAP login.
277 +* Fix PHP warning if invalid login attempt settings are empty (also prevent the “Authorizer lockout triggered for 0 seconds on user after the 0th invalid attempt” simple history log message).
278 +* Fix update usermeta button disappearing in Approved Users list after clicking it.
279 +* Fix serialization of usermeta in Approved Users list for unregistered users.
280 +* Remove bootstrap dependency (replace glyphicons with WordPress dashicons).
281 +* Update translatable strings.
282 +* Update phpCAS from 1.3.6 to 1.3.8.
283 +* Update Google API PHP Client from 2.7.1 to 2.8.1.
349 284
350 -= 2.3.5 =
351 -* Feature: Allow individual sites in a network/multisite install to override Authorizer's multisite settings and be configured independently.
285 += < 3.0.0 =
286 +* [Full changelog available here](https://github.com/uhm-coe/authorizer/blob/master/CHANGELOG.md)
352 287
353 -= 2.3.4 =
354 -* Quick fix: Remove user lists from post data when saving options (fixes an issue with hitting apache/php post size limits when 5000+ approved users exist).
288 +== Upgrade Notice ==
355 289
356 -= 2.3.3 =
357 -* Fix: disappearing usermeta box if server is unreachable.
358 -* Update documentation with supported CAS versions.
359 -* Feature: Allow posts to be marked as public on restricted access sites.
360 -* Feature: Allow categories to be marked as public on restricted access sites.
290 += 3.5.0 =
291 +**Upgrade Notice**: Google Sign-Ins now use the new [Google Identity Services library](https://developers.google.com/identity/gsi/web/guides/migration), which uses a different Sign In button UI and may also include the One Tap prompt. Please test if you use Google Sign-Ins!
361 292
362 -= 2.3.2 =
363 -* Feature: Add the ability to specify which CAS or LDAP attribute contains the user's email address. Useful for organizations that use an ID or something other than an email to authenticate.
364 -* Feature: You can now choose an ACF field to show next to users in the approved list. It will show a dropdown with the available values if the field type is select, and an input[text] otherwise.
365 -* Fix: Preapproved users' usermeta or ACF values get saved and applied when they log in for the first time.
366 -* Fix: ACF5 and ACF4 fields are now listed as options for the usermeta field.
367 -
368 -= 2.3.1 =
369 -* Fix: Skip SSL check when checking if a CAS server is reachable.
370 -* Fix: Pressing enter on Access List form elements now does the right thing.
371 -* Feature: Update first and last names from CAS or LDAP attributes.
372 -
373 -= 2.3.0 =
374 -* Fix: Site admins in a network can only access authorizer if the following option is enabled in Network Settings: "Allow site administrators to add new users to their site via the "Users → Add New" page." Props @aargh-a-knot.
375 -* Fix: Block user button wasn't correctly moving a user from the approved list to the blocked list.
376 -* Fix: Settings link in plugins list now correctly goes to the Authorizer page if it is shown in the top level menu.
377 -* Enhancement: New icon for authorizer in the plugin directory.
378 -* Enhancement: images have been optimized with ImageOptim.
379 -* Enhancement: Banner in multisite options aligns better when update notifications are present.
380 -* Enhancement: Checkbox and radio option labels are now clickable in authorizer options.
381 -* Verified compatibility with WordPress 4.3.1.
382 -
383 -= 2.2.4 =
384 -* fix: only run cas or google logout routines if the current user was authenticated by one of those services
385 -* Thu Apr 16, 2015
386 -
387 -= 2.2.3 =
388 -* 2.2.3: fix for multisite function being called on non-multisite installs (prevented plugin installation)
389 -* Thu Apr 16, 2015
390 -
391 -= 2.2 =
392 -* 2.2.0: Urgent fix for assets folder (deploy script missed it)
393 -* 2.2.1: readme fix
394 -* 2.2.2: asset fix
395 -* Wed Apr 1, 2015
396 -
397 -= 2.1 =
398 -* Updates and bug fixes.
399 -* Wed Apr 1, 2015
400 -
401 -= 2.0 =
402 -* First public release.
403 -* Tue Jun 3, 2014
404 -
405 -= 1.6 =
406 -* Allow multiple external services to be enabled at once.
407 -* Mon May 26, 2014
408 -
409 -= 1.5 =
410 -* Add Google Logins support
411 -* Thu May 22, 2014
412 -
413 -= 1.1 =
414 -* Rename to Authorizer
415 -* Add LDAP support
416 -* Wed Mar 12, 2014
417 -
418 -= 1.0 =
419 -* First stable release.
420 -* Wed Aug 14, 2013
421 -
422 -= 0.2 =
423 -* Switch to CAS instead of LDAP/Sakai.
424 -* Thu Jul 11, 2013
425 -
426 -= 0.1 =
427 -* Initial development build.
428 -* Wed Apr 10, 2013
429 -
430 -== Upgrade Notice ==
293 += 3.2.0 =
294 +Authorizer now requires PHP 7.2.5 or higher (phpCAS 1.4.0 requirement).
431 295
432 296 = 1.0 =
433 297 Upgrade now to get the latest features.