Vor 1 Stunde
Eine neue Erweiterung wurde veröffentlicht: DF Login OTP
Zitat:DF Login OTP adds email two-factor authentication to the login flow of the usergroups you protect (admins/moderators by default). Everyone else logs in
exactly as before.
HOW IT WORKS
1. Protected member submits username + password - full form OR header
quick-login (both supported).
2. Password verified server-side; a random_int() 6-digit code is e-mailed;
its hash lives in a 15-minute cookie; 60-second e-mail cooldown.
3. The OTP form carries a signed, AES-256-CBC encrypted, time-limited token -
the password is NEVER rendered in the DOM.
4. Correct code -> token verified with hash_equals -> core login completes.
SECURITY DESIGN
- CSPRNG codes, constant-time comparisons (hash_equals)
- Encrypted + signed + expiring password token
- Rate-limited code e-mails
- No plaintext secrets anywhere in HTML
- Clean uninstall (settings + templates removed)
STRUCTURE (community reviewer standard)
Lifecycle-only main file · hooks.php · handlers.php · permissions.php ·
db.php (schema-less by design, documented) · settings.json/php via
insert_query_multiple · templates.json/php · external stylesheet ·
English + ACP language packs.
BATTLE-TESTED
Installed and live-tested on a production board (data-forums.com) before
submission - quick-login support, mail interpolation and token encryption
were all caught and fixed in real use. Ship what you run.
SETTINGS: protected group IDs (default 3,4).