friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 7
wp-m365-login/includes
History
Friederich Loheide b35f6a867b Close button-only bypass via XML-RPC system.multicall 
The credential-based exemption used did_action(
'application_password_did_authenticate'), which is request-global. In a
system.multicall, a first boxcar authenticated with any application
password let later boxcars sign in other users with a normal password.

The exemption now applies only to the user the application password
authenticated in the same authenticate pass (reset at priority 0).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-23 17:20:02 +00:00
..
class-m365-login-admin.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-auth.php Close button-only bypass via XML-RPC system.multicall 2026-09-23 17:20:02 +00:00
class-m365-login-button.php Support custom login pages 2026-09-22 14:52:11 +00:00
class-m365-login-certificate.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-crypto.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-graph.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-jwt.php Add M365 Login plugin: Microsoft Entra ID sign-in for existing users 2026-09-22 14:21:10 +00:00
class-m365-login-settings.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login-sync.php Fix the findings of a full second security audit 2026-09-23 17:10:30 +00:00
class-m365-login.php Add Microsoft 365 user sync with roles, profile fields and deprovisioning 2026-09-23 16:34:30 +00:00
functions.php Support custom login pages 2026-09-22 14:52:11 +00:00