From 415309cab42302581a01224ddf1aeedcf967c524 Mon Sep 17 00:00:00 2001 From: spleenftw Date: Tue, 3 Nov 2026 11:58:43 +0100 Subject: [PATCH] Update version to 1.0.0 and enhance features including per-user TOTP, passkeys, and linked OIDC identities --- README.md | 14 +++++++++++--- metadata.json | 2 +- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4bf2a9b..6270a6e 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ OIDC SSO, TOTP and passkey second-factor authentication for **Bludit 3.22.0**. -Current version: **0.1.8 — experimental**. Test on a copy of your site before deployment. +Current version: **1.0.0**. ## Features @@ -55,9 +55,9 @@ For `bludit/docker`, copy the extracted plugin into `/usr/share/nginx/html/bl-pl docker cp bludit:/usr/share/nginx/html/bl-plugins/bludit-secure \ "/tmp/bludit-secure-backup-$(date +%Y%m%d-%H%M%S)" -unzip -o /tmp/bludit-secure-0.1.8.zip -d /tmp/bludit-secure-0.1.8 +unzip -o /tmp/bludit-secure-1.0.0.zip -d /tmp/bludit-secure-1.0.0 -docker cp /tmp/bludit-secure-0.1.8/bludit-secure/. \ +docker cp /tmp/bludit-secure-1.0.0/bludit-secure/. \ bludit:/usr/share/nginx/html/bl-plugins/bludit-secure/ docker restart bludit @@ -118,6 +118,14 @@ The plugin protects **web sessions under `/admin`**. It does not change authenti JavaScript URLs include a content hash so updated passkey behavior is not hidden by stale asset caches. +## Changes in 1.0.0 + +- First stable release for Bludit 3.22.0. +- Includes per-user TOTP, passkeys, linked OIDC identities, optional local MFA after SSO and single-use recovery codes. +- Displays linked SSO profiles in Security and the administrator Users list. +- Revokes sessions when passwords, roles or authentication methods change, and respects disabled Bludit accounts. +- Includes the login CSRF and verification-rate-limit fixes from 0.1.7 and 0.1.8. + ## Changes in 0.1.8 - Prevents successful sign-ins and multiple protocol steps from accumulating in one shared authentication quota. diff --git a/metadata.json b/metadata.json index e924655..4ca4bca 100644 --- a/metadata.json +++ b/metadata.json @@ -1 +1 @@ -{"author":"Interlope","version":"0.1.8","releaseDate":"2026-11-03","license":"MIT","compatible":"3.22.0","notes":"PHP 8.2+, HTTPS, sodium, curl, mbstring. Preview: validate on staging before production."} +{"author":"Interlope","version":"1.0.0","releaseDate":"2026-11-03","license":"MIT","compatible":"3.22.0","notes":"Per-user OIDC SSO, TOTP, passkeys and recovery codes. Requires PHP 8.2+, HTTPS, sodium, curl, mbstring and openssl."}