From c15668dc6d3196e47fcbe35c9a835962d797fa5b Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Sat, 27 Apr 2024 19:23:24 +0200 Subject: [PATCH 1/4] Changelog for 3.x --- CHANGELOG.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 16c097d..69ace0d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,9 +8,35 @@ Version 3.x requires at least PHP 8.2. +### Constructor signature change + +In order to ensure users of this library make a conscious choice of QR Code Provider, the QR Code Provider is now a mandatory argument. + +If you didn't provide one explicitely before, you can get the old behavior with: + +~~~php +use RobThree\Auth\TwoFactorAuth; +use RobThree\Auth\Providers\Qr\QRServerProvider; +$tfa = new TwoFactorAuth(new QRServerProvider()); +~~~ + +If you provided one before, the order of the paramaters have been changed, so simply move the QRCodeProvider argument to the first place. + +Documentation on selecting a QR Code Provider is available here: [QR Code Provider documentation](https://robthree.github.io/TwoFactorAuth/qr-codes.html). + +### Default secret length + +The default secret length has been increased from 80 bits to 160 bits (RFC4226) PR #117. This might cause an issue in your application if you were previously storing secrets in a column with restricted size. This change doesn't impact existing secrets, only new ones will get longer. + +Previously a secret was 16 characters, now it needs to be stored in a 32 characters width column. + +You can keep the old behavior by setting `80` as argument to `createSecret()` (not recommended). + ## Other changes * The new PHP attribute [SensitiveParameter](https://www.php.net/manual/en/class.sensitiveparameter.php) was added to the code, to prevent accidental leak of secrets in stack traces. +* Likely not breaking anything, but now all external QR Code providers use HTTPS with a verified certificate, see #126. +* The CSPRNG is now exclusively using `random_bytes()` PHP function. Previously a fallback to `openssl` or non cryptographically secure PRNG existed, they have been removed (#122) # Version 2.x From eb02cb709557c8cb22d980d1540470b297c7ac5b Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Sat, 27 Apr 2024 19:26:09 +0200 Subject: [PATCH 2/4] fix typos --- CHANGELOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 69ace0d..378f7d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,9 +10,9 @@ Version 3.x requires at least PHP 8.2. ### Constructor signature change -In order to ensure users of this library make a conscious choice of QR Code Provider, the QR Code Provider is now a mandatory argument. +In order to ensure users of this library make a conscious choice of QR Code Provider, the QR Code Provider is now a mandatory argument, in first place. -If you didn't provide one explicitely before, you can get the old behavior with: +If you didn't provide one explicitly before, you can get the old behavior with: ~~~php use RobThree\Auth\TwoFactorAuth; @@ -20,7 +20,7 @@ use RobThree\Auth\Providers\Qr\QRServerProvider; $tfa = new TwoFactorAuth(new QRServerProvider()); ~~~ -If you provided one before, the order of the paramaters have been changed, so simply move the QRCodeProvider argument to the first place. +If you provided one before, the order of the parameters have been changed, so simply move the QRCodeProvider argument to the first place. Documentation on selecting a QR Code Provider is available here: [QR Code Provider documentation](https://robthree.github.io/TwoFactorAuth/qr-codes.html). From ab677e43ee7be9cc5259c269d181a145efdfa0f5 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi <3043706+NicolasCARPi@users.noreply.github.com> Date: Sun, 28 Apr 2024 00:22:41 +0200 Subject: [PATCH 3/4] Update CHANGELOG.md propose the use of named arguments Co-authored-by: Will Power <1619102+willpower232@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 378f7d8..748b467 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,7 +20,7 @@ use RobThree\Auth\Providers\Qr\QRServerProvider; $tfa = new TwoFactorAuth(new QRServerProvider()); ~~~ -If you provided one before, the order of the parameters have been changed, so simply move the QRCodeProvider argument to the first place. +If you provided one before, the order of the parameters have been changed, so simply move the QRCodeProvider argument to the first place or use named arguments. Documentation on selecting a QR Code Provider is available here: [QR Code Provider documentation](https://robthree.github.io/TwoFactorAuth/qr-codes.html). From 5c97ce9be8f3d6eae6e87fab0e5ad96686eb84e1 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi <3043706+NicolasCARPi@users.noreply.github.com> Date: Sun, 28 Apr 2024 00:22:58 +0200 Subject: [PATCH 4/4] Update CHANGELOG.md Co-authored-by: Will Power <1619102+willpower232@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 748b467..d13ceb7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,7 +30,7 @@ The default secret length has been increased from 80 bits to 160 bits (RFC4226) Previously a secret was 16 characters, now it needs to be stored in a 32 characters width column. -You can keep the old behavior by setting `80` as argument to `createSecret()` (not recommended). +You can keep the old behavior by setting `80` as argument to `createSecret()` (not recommended, see [#117](https://github.com/RobThree/TwoFactorAuth/pull/117) for further discussion). ## Other changes