3.6.1

Closed issues

• No versions in Wordpress plugin repo #478
• Javascript error loading Customize #476

Fixed

• Fix SLO callback URL #479 (joshcanhelp)
• Fix Customizer failing after upgrade; fix widget settings #477 (joshcanhelp)

3.6.0

3.6.0 (2018-06-05)

Full Changelog

NOTES

• Passwordless was reconfigured completely to use the combined Lock library (currently hard-coded to 11.5). All current settings will be migrated to the new configuration so your login process should not change. Lock initiation has also been refactored to improve maintainability and adhere to WordPress standards.
• The Setup Wizard has been adjusted to more clearly explain the process and options available. This only affects new installations using the Setup Wizard for configuration.
• The settings page has been rearranged and improved overall. New settings descriptions have also been added along with links to documentation, where appropriate.
• State validation was added to both login flows; nonce validation was added to sites using Implicit flow.
• OIDC compliant Applications should now function as expected (though this setting is not yet activated by default on installation). OpenID Connect login is now possible by turning off the Client Credentials grant for your WordPress Application.
• Dashboard widgets have been removed. This can easily be added back as a plugin, if needed. Please contact support if you need assistance with this.
• A number of new hooks have been added, please see our docs page on extension for a complete inventory with examples. This includes the ability to support refresh tokens.
• Federated logout has been removed.

Closed issues

• Expose a configurable toggle that allows Users to state if federated logout should be used #471
• Updating to 3.5.2 - Fatal error: Uncaught Error: Cannot use object of type stdClass as array in /app/wp-content/plugins/auth0/lib/WP_Auth0_DBManager.php on line 225 #464
• Autoloader performance issue #461
• Bad request does not raise error #432
• Widget URL changes don't save when you are using passwordless #430
• Deprecate oauth/ro endpoint #410
• Handling errors #403
• Fallback /api/v2/users/{id} to /userinfo #401
• CORS errors #400
• Provide Resend verification email only for DB connections #345
• SSO disabled, Single Logout enabled causes users to get logged out automatically a few seconds after logging in #336
• French translation : html characters #309
• "Invalid authorization code": Access token is requested twice in a row, breaking the login flow #305
• Make state work after SSO login #302
• Is there a way to use Refresh Tokens and Wordpress? #296
• Only decode the payload before user profile fetch in login manager #283
• redirect callback errors #280
• Linked Users won't be able to login using implicit flow and pipeline 2 #272
• Normalize use of shortcode and widget #260
• Wrong z-index on modal error message in manual setup #252
• Logout does not work when Wordpress is locked down (private site) #39

Added

• Adding refresh token support; adjusting default scope #456 (joshcanhelp)
• Add code quality tools, improved composer.json #454 (joshcanhelp)
• Add /userinfo fallback during login #423 (joshcanhelp)
• State handling during login process for both types #406 (joshcanhelp)

Changed

• Change token exchange redirect URL to match what was sent for auth code #463 (joshcanhelp)
• Hide the signup tab if registrations are turned off #460 (joshcanhelp)
• New class for state handling; set cookie for implicit nonce #458 (joshcanhelp)
• Change auto-login action #449 (joshcanhelp)
• Require telemetry for API calls #441 (joshcanhelp)
• Change Appearance tab settings output #439 (joshcanhelp)
• Change Feature settings output #436 (joshcanhelp)
• Change Basic settings field display; better admin UX #433 (joshcanhelp)
• Change how Advanced admin settings fields are output #429 (joshcanhelp)
• Setting titles and option names #427 (joshcanhelp)
• Clean up admin notices #421 (joshcanhelp)
• Change asset enqueuing #419 (joshcanhelp)
• Improve WP_Auth0_Options #418 (joshcanhelp)

Deprecated

• Deprecate 2 lookup methods #446 (joshcanhelp)
• Deprecating wp-admin settings-related methods + classes #445 (joshcanhelp)
• Deprecating unused Lock Options classes and methods #444 (joshcanhelp)
• Deprecating admin_enqueue functions #443 (joshcanhelp)
• Deprecate oauth/ro endpoint #413 (joshcanhelp)

Removed

• Remove wp-admin click tracking #451 (joshcanhelp)
• Remove dashboard widgets #428 (joshcanhelp)
• Remove and migrate Passwordless setting #425 (joshcanhelp)
• Remove api_audience settings field #422 (joshcanhelp)
• Removing dashboard widgets #397 (joshcanhelp)

Fixed

• Correcting input field height on settings pages for IE #472 (joshcanhelp)
• Save sub or user_id if not provided; remove extemporaneous ID token attributes #469 (joshcanhelp)
• Improve Setup Wizard #468 (joshcanhelp)
• Fix install and DB update errors #467 (joshcanhelp)
• Fix SLO redirect, SLO on when SSO off, SSO setting not pushed to dashboard #466 (joshcanhelp)
• Fixed auto-loader to skip non-WP-Auth0 classes #465 (joshcanhelp)
• Fix empty path notice on initial setup #457 (joshcanhelp)
• Fix logout process #453 (joshcanhelp)
• Fix help tab text and settings tab UX #452 (joshcanhelp)
• Only show email verification resend for DB connections #447 (joshcanhelp)
• Fix Passwordless handling; update Lock instantiation #434 (joshcanhelp)
• Fix Implicit login handling #426 (joshcanhelp)
• Admin settings refactor - WP_Auth0_Admin_Generic #416 (joshcanhelp)
• Fix Login Process Error Handling #409 ([joshcanhelp](https://gi...

3.5.2

Please see Important Note on 3.5.0

Closed issues

• [Security] [URGENT] XSS injection error page #381
• Non-static method WP_Auth0_Api_Client::convertCertToPem() should not be called statically #380
• Notices in /lib/admin/WP_Auth0_Admin_Advanced.php #374
• SSO login failing when not using implicit flow #363
• "Override WordPress avatars" option doesn't appear to work with comments #355
• Change log is missing from readme.txt, the separate changelog file is not updated #346
• Uninstall doesn't remove all Auth0 database plugin entries #322
• Unable to save migration IPs whitelist #320
• 3.2.16 throws errors if Error Log is empty #285
• Login plugin form name incorrect #269

Changed

• Readme updates #392 (joshcanhelp)
• Changed error handling #384 (joshcanhelp)

Fixed

• Changing boolval() and array shorthand to PHP 5.3-compatable #402 (joshcanhelp)
• Fixed SSO auto-login in Lock #394 (joshcanhelp)
• Renaming un-deprecated function #393 (joshcanhelp)
• Cleanup PR for 3.5.2 #391 (joshcanhelp)
• Improved setup wizard client create process #389 (joshcanhelp)
• Deleting all added options and transients on uninstall #387 (joshcanhelp)
• Fixed wrong title and icon for login widget #385 (joshcanhelp)
• XSS in error query vars #383 (joshcanhelp)
• Fixed migration IPs being saved #382 (joshcanhelp)
• Fixed get_avatar hooked function to account for other user identifiers #376 (joshcanhelp)

3.5.1

Please see Important Note on 3.5.0

Fixed

• Fixed Client Grant Types during update #377 (joshcanhelp)

3.5.0

Important Note

This is a major update that requires changes to your Auth0 Dashboard to be completed. You can save a new API token in your Basic settings in wp-admin before upgrading and the changes will be made automatically during the update. Otherwise, please review your Client Settings, specifically Advanced > Grant Types, and authorize your Client for the Management API.

Changed

• updating CDN URLs for Lock and Auth.js #365 (joshcanhelp)
• Changing home_url() to site_url(), wp_login_url(), and wp_logout_url() #360 (joshcanhelp)

Fixed

• Changing algorithm for migration tokens #372 (joshcanhelp)
• Migration tokens only use HS256 #371 (joshcanhelp)
• Fixed automatic setup process for public sites #370 (joshcanhelp)
• Added use Management API for user data #368 (joshcanhelp)
• Fixing DB version upgrade #367 (joshcanhelp)
• Creating client_grant for management API #366 (joshcanhelp)
• Fixed login flow for new tenants, refactored verification email resend #364 (joshcanhelp)
• Fixed shortcode warning #362 (joshcanhelp)
• Fixing "Algorithm not allowed" error during user migration #361 (joshcanhelp)
• When activating using wp-cli the plugin should not redirect #344 (AubreyHewes)

3.4.0

Added

• Added Lock 11 / Auth0 9.0, Updated SSO, JWT Algorithm Upgrade Fixes #350 (cocojoe)
• Add RS256 support #331 (renrizzolo)

Fixed

• Switching wizard admin user creation to use /dbconnections/signup #356 (joshcanhelp)

3.3.2

Added

• Added translation support for a few user-facing exception messages #312 (idpaterson)

Changed

• Use literal 'wp-auth0' rather than WPA0_LANG constant #311 (idpaterson)

3.2.24

Changed

• More generous JWT leeway #332 (cocojoe)

Removed

• Remove client_id/secret validation since it is not allowed anymore #334 (glena)

3.2.23

Changed

• Update /authorize URL #326 (cocojoe)

3.2.22

Fixed

• Fixed migration for older plugins that use base64 secret #324 (cocojoe)