Sigil – Passkeys and Two-Factor Authentication

0.3.3

• Everyone sharing one address, as an office, a school or a mobile network does, is no longer held to a single person’s allowance of attempts. A few colleagues mistyping could stop everybody else signing in. Guessing any one account is bounded by the same five attempts as before.
• A site behind a proxy can now tell the plugin the real visitor address with the sigil_client_ip filter, instead of counting every visitor as the proxy.
• An account keeps only its newest few unspent verification sessions rather than an unlimited pile of them.
• The allowed-methods screen now says when a role was left with every method because nothing was ticked for it, rather than appearing to have discarded the save.

0.3.2

• A percent sign in the challenge wording no longer breaks the login screen. The line naming the person signing in was formatted rather than substituted, so wording like “50% off” stopped anybody with a second factor from completing a sign-in.
• An account holding only passkeys is no longer asked for a code when resetting its password. It was being emailed one that could never be accepted, which left the account unrecoverable.
• The two-factor column on the users list now reads each account’s own rules rather than those of the administrator looking at the page, so an account no longer shows as having nothing set up when it has.
• Importing settings now says what happened, including when the imported policy is switched on but names nobody.
• The page carrying the enrolment form is only adopted when an administrator wrote it.

0.3.1

• Repeated login guesses are now counted in a way that a burst of simultaneous requests cannot outrun. The previous counter read a number, added one and wrote it back, so guesses arriving together all read the same number, and the real limit became however many requests could be made at once rather than the five it promised.
• A server that does not report the visitor’s address no longer counts everybody together, where five failures anywhere would have held up every account on the site.
• Failed attempts are cleared out daily instead of being kept indefinitely.
• If the table the counter lives in goes missing, it is rebuilt rather than being allowed to refuse every sign-in.

0.3.0

• You are now emailed when a second factor is added to or removed from your account. Adding one is how somebody who already has your password keeps access, and nothing about the account looks different afterwards, so the only person who can notice is you.
• Anyone who becomes subject to a 2FA requirement is emailed once, when their deadline is set. People who never open the dashboard never saw the notice there, so the first they knew of a policy was the day it stopped them.
• The login code email now says where the code was requested from. It says “may be a proxy” rather than naming a location, because that is all the server actually knows.
• Administrators are warned when the server clock has drifted far enough to reject correct authenticator codes. Without it, a clock problem looks exactly like every user mistyping at once.
• You can choose which method you are asked for first, if you have set up more than one.

0.2.2

• Adds two extension points: sigil_challenge_text for the wording of the two-factor screen, and sigil_manage_capability for which capability reaches the settings. Values are escaped after filtering, and the capability filter only narrows, never widens.
• Nothing user-facing changed. Existing installs need do nothing.

0.2.1

• Multisite: when an upgrade merges per-site passkey tables, the highest signature counter for each credential is kept. Where the same authenticator was registered on two sites, the lower one could otherwise win and the clone check would have less to work with.
• Adds extension points so an add-on can rewrite the login code email, change where enrolment sends people afterwards, and load the front-end styles outside the shortcode. Nothing in the plugin behaves differently on its own.
• Nothing user-facing changed. Existing installs need do nothing.