friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 7

Remove the login box frame and hide "Lost your password?" reliably
Some checks are pending
CI / PHP lint (7.4) (pull_request) Waiting to run
Details
CI / PHP lint (8.0) (pull_request) Waiting to run
Details
CI / PHP lint (8.1) (pull_request) Waiting to run
Details
CI / PHP lint (8.2) (pull_request) Waiting to run
Details
CI / PHP lint (8.3) (pull_request) Waiting to run
Details
CI / PHP lint (8.4) (pull_request) Waiting to run
Details
CI / WordPress Coding Standards (pull_request) Waiting to run
Details
CI / WordPress.org Plugin Check (pull_request) Waiting to run
Details

Browse source 
- No border or shadow around the login box on wp-login.php (form and
  Microsoft block, also in button-only mode); the white area stays.
- Button-only mode: the "Lost your password?" link is removed through
  lost_password_html_link instead of CSS only, the lostpassword,
  retrievepassword, rp and resetpass screens redirect to the login page
  and allow_password_reset refuses resets – all unless the fallback link
  is active.
- The login stylesheet is also loaded when only the form is hidden
  (e.g. broken connection); before, the link and form showed there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Friederich Loheide 2026-09-24 04:30:13 +00:00
parent cc88f145f2
commit 7749ebff9b
10 changed files with 377 additions and 301 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -258,7 +258,9 @@ Die Passwort-Anmeldung betrifft das nicht; wer auch die sperren will, kombiniert
Im Tab *Sicherheit* → **Button-only mode**:
- Blendet Benutzername/Passwort-Felder und den „Passwort vergessen?“-Link aus.
- Blendet Benutzername/Passwort-Felder aus. Der „Passwort vergessen?“-Link wird serverseitig entfernt, die
Passwort-vergessen-Seite leitet zur Anmeldung um, und Passwort-Resets (auch „Passwort zurücksetzen“ in der
Benutzerliste) sind gesperrt – mit aktivem Fallback-Link funktioniert beides wie gewohnt.
- **Sperrt Passwort-Logins serverseitig**, nicht nur per CSS – auf `wp-login.php` und in jedem eigenen Login-Formular (`authenticate`-Filter).
- Unterschieden wird nach **Zugangsdaten, nicht nach Anfrage-Typ**: Das normale Passwort wird überall abgelehnt – auch über
XML-RPC und in Login-Handlern anderer Plugins, die in `xmlrpc.php` oder einer REST-Anfrage laufen. Application Passwords