DF Login OTP v1.2

DF Login OTP

Bank-style email two-factor for the logins you choose: staff enter their password, get a 6-digit emailed code, and only then get in.

Version: v1.2
Autor: viguss
Deutsche Übersetzung: noch nicht übersetzt
Hochgeladen: 27.08.2026
Letzte Aktualisierung: 27.08.2026
Support: https://forum.mybb.de/thread-39688.html (0 Beiträge)
Kompatibilität: MyBB 1.8.x
Bisherige Downloads: 0

DF Login OTP adds email two-factor authentication to the login flow of the usergroups you protect (admins/moderators by default). Everyone else logs in
exactly as before.

HOW IT WORKS
1. Protected member submits username + password - full form OR header
quick-login (both supported).
2. Password verified server-side; a random_int() 6-digit code is e-mailed;
its hash lives in a 15-minute cookie; 60-second e-mail cooldown.
3. The OTP form carries a signed, AES-256-CBC encrypted, time-limited token -
the password is NEVER rendered in the DOM.
4. Correct code -> token verified with hash_equals -> core login completes.

SECURITY DESIGN
- CSPRNG codes, constant-time comparisons (hash_equals)
- Encrypted + signed + expiring password token
- Rate-limited code e-mails
- No plaintext secrets anywhere in HTML
- Clean uninstall (settings + templates removed)

STRUCTURE (community reviewer standard)
Lifecycle-only main file · hooks.php · handlers.php · permissions.php ·
db.php (schema-less by design, documented) · settings.json/php via
insert_query_multiple · templates.json/php · external stylesheet ·
English + ACP language packs.

BATTLE-TESTED
Installed and live-tested on a production board (data-forums.com) before
submission - quick-login support, mail interpolation and token encryption
were all caught and fixed in real use. Ship what you run.

SETTINGS: protected group IDs (default 3,4).

Quelle: DF Login OTP bei MyBB.com

DF Login OTP

Ähnliche Erweiterungen