Skip to content

Releases: auth0/wordpress

3.7.3

18 Dec 00:41
@joshcanhelp joshcanhelp
3.7.3
9d7777b
Compare
Choose a tag to compare
3.7.3

Full Changelog

Fixed

  • Cast user ID to integer to fix reflected XSS
Assets 2
Loading

3.11.1

05 Aug 16:51
@joshcanhelp joshcanhelp
3.11.1
1703873
Compare
Choose a tag to compare
3.11.1

Full Changelog

Fixed

Assets 2
Loading

3.11.0

04 Jun 22:52
@joshcanhelp joshcanhelp
3.11.0
1a3c1dd
Compare
Choose a tag to compare
3.11.0

Full Changelog

Notes on this release

  • Lock was updated from 11.15 to 11.16. The option to display social connections in small styled buttons is no longer available due to branding compliance reasons with third party identity providers. All the social connections will now be displayed as large styled buttons.
  • New installs using user migration will now have a namespaced user ID returned to Auth0 on first login. If you have or plan on having multiple custom databases, please see the User Migration documentation for more information. New installs will also use configuration variables instead of hard-coded values for the URL, migration token, and user namespace.
  • The WordPress core login override has been refactored to improve the user experience and overall security.
  • Added more complete ID token validation during login.
  • Sites using VIP Go are now able to use MFA.
  • Fixed a bug that prevented sites using user migration from changing the WordPress user's email.

Closed issues

  • WordPress.com VIP Go MFA incompatibility #687

Added

Changed

Deprecated

Fixed

Security

Assets 2
Loading

3.10.0

18 Apr 17:50
@joshcanhelp joshcanhelp
3.10.0
9122dfd
Compare
Choose a tag to compare
3.10.0

Release Notes
Full Changelog

Closed issues

  • Sign in with OTP MFA doesn't work unless "Remember this browser" is enabled #667
  • WP_Auth0_Routes::migration_ws_login, 401 Invalid Credentials #633
  • OpenSSL error in WP_Auth0_Api_Client_Credentials::call #631
  • 1Password Compatibility #627
  • User Migration set as PHP constant causes token to not be generated #620

Added

Changed

Deprecated

Removed

Fixed

Assets 2
Loading

3.9.0

11 Jan 17:50
@joshcanhelp joshcanhelp
3.9.0
5bc3c7e
Compare
Choose a tag to compare
3.9.0

Full Changelog

Notes on this release

  • Added a complete Spanish translation!
  • Email changes for WordPress users now work properly and are rejected clearly if Auth0 rejects the change. This does not affect the email verification process in WordPress; the email is changed only after the verification happens. A current API token is not required but your Application does need to allow for a Client Credentials grant with the Management API (this configured for you by default, more information here).
  • Sibling sub-domains are now allowed for the Login Redirect URL. Anything within the same domain name as the site URL can now be saved.
  • Default Auth0 IP addresses are now allowed by default on the user migration endpoints. Adding or changing the IP addresses for the "Migration IPs Whitelist" field will not affect default IPs.
  • User migration endpoints were improved to provide better errors when requests are rejected and more clear custom database scripts that can be used as an example when setting up the migration manually. Switching this setting on or off does not make any changes in the Auth0 dashboard or to the existing token, it only makes the endpoints available or not.
  • The Social Amplificator functionality has been removed.

Added

Changed

Deprecated

Removed

Fixed

Closed issues

  • Invalid State error 100% of the time #597
  • Update docs #591
  • Correct dimensions for custom login icon #586
  • Basic settings edit box doesn't show values from AUTH0_ENV_* constants #569
  • Better documentation of User Migration endpoints with manual setup #542
  • Keep getting logged out once SSO is turned on #541
Assets 2
Loading

3.8.1

14 Nov 20:08
@joshcanhelp joshcanhelp
3.8.1
85a6d36
Compare
Choose a tag to compare
3.8.1

Full Changelog

Closed issues

  • Javascript: Use readonly instead of disabled on email field #587

Changed

Fixed

Assets 2
Loading

3.8.0

06 Nov 18:28
@joshcanhelp joshcanhelp
3.8.0
1ea429c
Compare
Choose a tag to compare
3.8.0

Full Changelog

Notes on this release

  • Administrators can now mark certain strategies as able to skip email verification. This is typically used for Enterprise strategies that do not provide an email verification flag. This should be used sparingly and only for connections that do not provide this flag.
  • Password changes for WordPress users now work properly and are rejected clearly if Auth0 rejects the change (typically because the password does not conform to the password policy). A current API token is not required but your Application does need to allow for a Client Credentials grant with the Management API (this configured for you by default, more information here).
  • The wp-login.php page is no longer used for any callback processing. If you are using this page to process callbacks in a custom plugin or theme, please update to use the main callback URL for the implicit flow /index.php?auth0=implicit. In addition, users that are already logged in will be redirected to the default login page when accessing wp-login.php.
  • Error logging has been improved in general, along with improvements to the error log display. Consecutive, duplicate errors are now combined, the error log now shows more entries, and entries can be cleared from the admin.
  • The "Auto-Login" setting has been renamed to "Universal Login Page" and moved from the Advanced tab to the Features tab. The functionality is the same as before and will retain the existing setting.

Issues and PRs

Closed issues

  • Plugin tries to create a user if they log in a different way #539
  • Problems with implicit login in > 3.6 #536
  • Add authorization token to header for external request #534
  • Configuring auth0 OIDC URL parameters #521
  • Single sign on shows the login username/password fields briefly before automatically signing in #508
  • Better behavior when logged-in users visits wp-login.php #414
  • Profile password update changes #375
  • auth0 forgot password doesn't change WP password #310
  • Woocommerce can't change user password #300

Added

Changed

Deprecated

Fixed

Assets 2
Loading

3.7.1

08 Oct 17:34
@joshcanhelp joshcanhelp
3.7.1
d5c5c0d
Compare
Choose a tag to compare
3.7.1

Full Changelog

Closed issues

  • "search_engine=v2 is not available for your tenant because it is deprecated" error #562

Fixed

  • 3.7.1 patch release to fix user search engine in rules #563 (joshcanhelp)
Assets 2
Loading

3.7.0

13 Aug 18:53
@joshcanhelp joshcanhelp
3.7.0
86299b3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
3.7.0

Closed issues

  • Optionally load client ID, secret and domain from environment #480
  • Allow login redirect URL to point to an in-network domain for multi-site #459

Added

Changed

Removed

Fixed

Assets 2
Loading

3.6.2

02 Jul 17:47
@joshcanhelp joshcanhelp
3.6.2
e1ba1c2
Compare
Choose a tag to compare
3.6.2

Closed issues

  • auth0_state cookie and Pantheon #494
  • Question: Way to visit directly to Sign Up tab? #489
  • Custom Fields #487
  • TypeError: jQuery(...).tab is not a function #484
  • Error - auth0 cannot find node with id "auth0-login-form" #483

Added

Fixed

Assets 2
Loading