friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 7
wp-m365-login/includes
History
Friederich Loheide 9b893e42bc Fix the findings of the third security audit 
- Privileged accounts: the UPN rule also applies when bind_oid is off or
  the account is not bound; privileges are checked on every site of a
  multisite user, include code/HTML capabilities (unfiltered_html,
  plugins, themes, users) and the remembered roles of deactivated
  accounts.
- send_auth_cookies protection also works on WordPress 6.0/6.1.
- Run lock via INSERT IGNORE (atomic), refreshed during long runs; a
  shutdown handler reports fatal errors and frees the lock.
- Deprovisioning only for accounts linked in the current tenant (tenant
  recorded per account; legacy links not found are left alone).
- Safety stop based on the accounts linked before the run; new safety
  stop for removals of administrative roles.
- Disable is idempotent; row-action nonces are bound to the state.
- Profile photos are re-encoded to 240 px (drops EXIF and appended
  data), size-limited while downloading, removed on deactivation;
  index.php guard in the photo folder.
- Privacy exporter and eraser for the copied data.
- One-time migration hardens accounts deactivated by 1.0 and cleans a
  stored certificate bundle; the .cer download is always re-exported.
- Password fields hidden in button-only mode even when the connection
  is broken; settings written non-autoloaded; robust user ID queries.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-24 03:52:13 +00:00
..
class-m365-login-admin.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-auth.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-button.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-certificate.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-crypto.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-graph.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-jwt.php Add M365 Login plugin: Microsoft Entra ID sign-in for existing users 2026-09-22 14:21:10 +00:00
class-m365-login-settings.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login-sync.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
class-m365-login.php Fix the findings of the third security audit 2026-09-24 03:52:13 +00:00
functions.php Support custom login pages 2026-09-22 14:52:11 +00:00