6.5.0

2020-03-12 Tweak18 Fix6 Deprecated1

Tweaks

  • Add super admins as a selectable role for User Groups.
  • Add reCAPTCHA to the Reset Password form.
  • Add support for resending a Two-Factor Email code.
  • Add support for resending a Passwordless Login email.
  • Allow selecting users across all sites in a network for User Groups, Security Profile cards, and User Security Check.
  • Include all super admins by default in the Security Profile card, even if they are not a member of the network's main site.
  • Display all of a user's roles in the Security Profile card.
  • When logging in with Passwordless Login, skip Two-Factor if the primary Two-Factor method is Email.
  • Force a space after each Two-Factor Backup Code to assist with copying and pasting.
  • Include the website URL in the download file for Two-Factor Backup Codes.
  • Add a warning if a WordPress Salt is set to an invalid value.
  • Allow re-entering the Two-Factor Onboard flow even after Two-Factor is setup by visiting /wp-login.php?itsec_after_interstitial=2fa-on-board directly.
  • Add a new WP CLI command for managing user Two-Factor enrollment.
  • Add a new WP CLI command for retrieving logs.
  • Include child log items in the logs list table. These are helpful for debugging issues.
  • Improve performance of the logs page on sites with large number of log items.
  • Only show Lockout Bypass Magic Link for valid users.
  • When logging $_SERVER, only log a snapshot of available properties.

Fixes

  • New Password Requirements for already created accounts were not enforced until the second login.
  • User Security Check would not display in Multisite.
  • Prevent fatal error if invalid user IDs are encountered by User Groups.
  • Infinite loop when trying to use Application Passwords on Multisite.
  • User Logging did not correctly capture the user id of the logged-out user on WordPress 5.3.
  • Warnings when doing a settings import.

Deprecateds

  • The "getlockouts", "releaselockout", and "getrecent" WP CLI commands. Use the "lockout" and "log" commands instead. They will be removed in a future release.