Release notes and development status

Version in development: 3.8.3.1
Expected release date: Unknown

Current version: 3.8.2.1

 

 

Version 3.8.2.1 Release notes

• Various bug fixes
• Various cosmetic improvements
• Various security enhancements

Version 3.8.1.3 Release notes

• Undisclosed bug fixes

Version 3.8.1.2 Release notes

• Updated "how to setup" readme documentation
• Fixed multi-session session key generation, if signed in more than once on the same computer the system would not generate a new key, leading to an error as the same key cannot be used for both sessions, keys must be unique
• Fixed cookies not deleted on session termination where the system would return the querystring ?session=0 or ?accountexpired=1 or ?tokensinvalidated=1 or ?sessionstruncated=1 cookies would not be deleted
• Outbound essential includes are now within the includes_db_levelx_xxxx files
• Fixed an error where clicking "End all sessions" on the users side would not end any sessions, this was due to the inital session data not being read to the recordset and data to generate new keys on ending all sessions was not being saved as well as sessions in the sessions table not being deleted
• Added ISP information to the edit user active sessions area in the admin panel
• When changing your password sessions now get deleted from the account settings page when the access token is discarded instead of deleting from the auth.php file, although the change will still re-direct there, the inital deletion happens on the account settings page

Version 3.8.1.1 Release notes

• Added HttpOnly flag option to cookies in the setup wizard
• Added password strength meter to secure sign in interface to prevent bad passwords from being entered
• Added more encryption keys to the keychain bringing the total to 22 keys
• Added a new feature "Forgot email address" area this can be turned off or on by the Super Admin
• Hidden security answers as a password field but can be unhidden by clicking the "Information hidden" switch
• Fixed invalidate all tokens as this function was not working
• Fixed truncate all sessions as this function was not working
• Added a new feature "Welcome email" the Super Admin can turn this feature on or off in the settings
• Added a new feature "Security advisory" the Super Admin can turn this feature on or off in the settings
• Patched a serious security vulnerbility with the reset password area codes, the authkey is now hashed in the database before the original cypher text is sent in the email, when clicking the reset password link in the email if the authkey cypher text matches to whatever the hash value is in the database the password reset can continue
• Added a new feature in the settings "PIN code wait interval" this allows the Super Admin to specify how long must the user wait before being able to request a new PIN code, this also prevents too many PIN codes being sent at once by the same user
• Added a new feature in the setttings "Delete expired accounts after x days" this setting is for expired accounts and the Super Admin can set the time in days for when these accounts are deleted, this only applies to accounts that have an expiry date set
• Added a new security feature "Force update security info status" this is in the edit user page on the Admin side, this allows a Super Admin or Admin to force an update of the security questions and answers for the user who's account is being edited
• Added "Delete account" to the edit user page actions menu
• Added "Security advisor" to the Account overview menu in accountsystem
• Added new cron job for deleting expired accounts, this should be run on a schedule as the same as other cron jobs
• Added a new professional styled bootstrap modal for security advisor which pops up on the account overview page after a security information update or password update, it's then marked as read and will not pop up again until the information is changed again
• Added a new professional styled bootstrap modal for forcing update of security information or passwords, the user cannot escape the modal without updating the information first
  
• Fixed issue where not all cookies were being deleted at sign out, this was due to extra information added in the array, these included the Admin panel current page and max rows, account statistics tab, account sessions tab and active sessions tab cookies
• Added the ability to configure an email subject for welcome emails in the setup wizard
• Added the ability to configure hashing strength for reset password codes in the setup wizard
• Added the Global account setting "Delete PIN codes after" this allows the Super Admin to specify when un-used or expired PIN codes are deleted from the database, this is then run as a cron job or scheduled task
• Security enchancement which now allows the locking out of accounts on the Admin sign in and locking out Admin accounts, this can be turned on or off in the Global account settings by the Super Admin
• Security enhancement setting which now allows optional locking out of user accounts on the User sign in, this can be turned on or off in the Global account settings by the Super Admin
  

Version 3.7.4 Release notes

• New setup wizard
• New setup step for creating the authentication interface either the default secure interface or the standard interface is available to choose from
• New easily customise email templates from the setup wizard area
• Updated Jquery library to 3.6.0
• Updated authentication system dependencies
• Updated SourceGuardian bootloaders to support from PHP 7.4 to PHP 8.1
• Patched an undisclosed security vulnerability in the activation code
• Added extra location information and ISP information to my active sessions area
  
• Fixed session association with database and cookies
• Added an about page on the setup wizard
• Added detection for Windows 11 in my active sessions area
• Fixed external cron jobs, by selecting only accounts that pass the criteria in the recordset and the appropriate action taken through the correct action depending on the cron job being executed
• Added an extra encryption key to the key store for future uses brings the total to 20 keys in the keychain
• Added a separate create an account page for using the standard interface
• Consolidated the setup wizard area into just a few files
• The authentication system is now fully compatible with PHP 8.1
• Toast messages now display in a fixed position on the top right-hand corner of the screen
• Updated the database structure to accommodate future features
• Updated “How to setup” read me documentation
• Added the line $Email->CharSet = "ISO-8859-1"; to all emails sent by the system to configure the proper headers for multi-part/alternative email messages
• Made support contact form CAPTCHA larger and reduced the number of characters from 6 to 5
• updated code to write siteurl.php in config to the $_SESSION variable is now
  <?php if(!isset($_SESSION['sessionname'] )) { $_SESSION['sessionname'] ; } ?>
  this helps stop writing the session every time when loading a page with the siteurl.php include
• Updated Innovate API activation module to version 3.1.0
  
  

Version 3.7.3 Release notes

• Update password in account settings area now fixed as it would not save new password becuase of incorrect id's on the input fields
• New limited version available to purchase, which does not allow editing of the system functions including HTML, all files in the limited version are bytecode encrypted and require the "SourceGuardian" extension to read the encrypted files

Version 3.7.2 Release notes

• Small UI change Two-factor authentication is now refered to as Multi-factor authentication however session variables and database tables remain unchanged
• Patched an XXS cross site scripting vulnerablity which could allow an Admin to end all Super Admin sessions on the site, patched by adding the correct CSRF token to the submitting form
• Fixed a coding error where the edit user form would not submit if the event logs were turned off
• MFA for the users side had no timezone set from the session at login, therefore did not send the PIN code email, this has now been fixed
• Consolidated user functions into the edit users page using the "action" querystring attribute you are able to access the different user actions from the same page
• Consolidated management items such as alerts, blocked IP addresses and banned email addresses into a single file for each, add, edit and delete can be acceessed by the "action" querystring attribute
• Consolidated remediation tools into a single file and can be accessed using the "action" querystring attibute
• Consolidated accountsystem items such as reset password and email area, request one-time PIN code and account activation areas
• Updated database structure for future features
• Updated "How to setup" documentation
• Admin panel and display user pages now displays the last approximate location of sign in
• Terminology change from login to sign in and sign out for a more modern approach
• Corrected an error on the authentication log which would only allow failure event to be displayed when searching for an email address and the result "success"
• Renamed the login.php file to auth.php as the file does multiple operations not just signing in
• Added bootstrap modal confirmation boxes to confirm actions that might be accidentally used
• Made security answers non case sensitive as too many people forget what case they've used
• Added a glass effect to the Admin panel menu and search bars
• Corrected CSS errors with the account statistics, settings and active sessions box in account settings
• Added new setup validation rules to prevent filenames being submitted as the host URL
• Added new setup validation rules to prevent localhost and local IP addresses being submitted as the host URL
• Security answers are no longer case sensitive as too many people forget which case they have used
• Removed in-page cron jobs as this would impact on performance, all cron jobs are now external and should be run on a schedule as from the system perspective rather than the user perspective
• Fixed combined logs which now sorts by the proper date descending fixed from using a LEFT OUTER JOIN to using UNION SELECT in the SQL statement to select from both authentication logs and event logs
• Security enhancements made to the activation process including anti-tampering measures
• Some files are bytecode encrypted which now requires you to access your "php.ini" file and install a bootloader in order to read the encrypted files, please make sure you either have access to you "php.ini" file on your host or have the "SourceGuardian" PHP extension loaded on your hosting provider before purchasing as this is required for the system to work

Version 3.7.1 Release notes

• Main activation setup page new validation rule to stop trailing slash URLs being submitted
• New styles for the account settings and statistics page
• Account settings and statistics page now requires JQuery 3.5.0 and above
• My current sessions page header and title has now been renamed to My active sessions
• Active sessions may now be managed from the main account statistics or account settings area
• Fixed an issue with account settings page as scheduled profile picture would not upload
• Fixed an issue with LITE two-factor authentication as selecting remember me would generate incorrect tokens and would not log in admin accounts
• Updated menu in the setup section
• New feature "check for updates" allows the site admin to check for software updates and download any new updates that are available
• Fixed critical database flaw with foreign constraints as would not allow selecting and deleting account from the admin panel if the user had any active sessions
• Corrected errors with the alert messages not displaying correctly
• Strengthened activation codebase
• Sentry Web Authentication system dependencies updated and is now fully PHP 8.x compatible
• New layout and styles for the setup area, more mobile friendly and simplified
• Strengthened the activation system code
• New activation status page in the setup area
• New bootstrap modal for confirming deactivation of host key
• Patched a security vulnerability that could lead to a session hijack on admin and super admin accounts by exposing session information from the sessions table

Version 3.6.1 Release notes

• Various bug fixes
• Corrected timezone rendering issues for the Admin panel
• Timezone is now stored in a session instead of a cookie using an AJAX $post request between the JavaScript variable and PHP
• New software activation functionality, the Sentry Web Authentication System must now be activated with a legitimate license key and host activation key
• Patched an undisclosed security vulnerablity that could allow Arbitrary code execution
  

Version 3.5.5 Release notes

• All outgoing emails contain the users first and last name instead of email address to ensure confidence that it is a genuine email sent by the system
• Fixed account activation bug where the users screen would just blockout and forever not activate
• Updated the database structure to include the users first and last name
• Updated all forms for creating accounts and upadating users first and last name

Version 3.5.4 Release notes

• New setup process the ability to set the length of tokens, this is dependant on the owner who has to forecast the amount of users that will use the system, these settings should be set between 30 and 254 random characters
• Fixed escaping special characters in the account creation policy by encoding HTML entities within the HTML editor

Version 3.5.3 Release notes

• New setup process feature the ability for the owner to apply an account creation policy for when users are creating accounts, if enabled the user must first accept the account creation polcy or terms of service etc. before being allowed to create the account
• Resetting a password now requires that the same IP setting the password was the IP address that started the reset password process in the first place, if the IP addresses do not match then the password cannot be set

Version 3.5.2 Release notes

• Bug fixes

Version 3.5.1 Release notes

• Complete rewrite of the Admin and User UI, more of a Google type approach where the user or admin has to enter an email address first and then their password on the next screen
• New user registration if the email address on the user login UI doesn't exist the user can be offered an oppertunity to create an account with that chosen email addesss
• The admin now has the ability to close user login in the global settings in the Admin panel
• PIN codes no longer invalidate or nullify after an invalid attempt, they will however still expire by the time set by the admin in the Admin panel
• Security enhancements to account lockout, accounts can now be locked out for an extended period of time in days based on the number of consecutive lockouts specified by the admin in the Admin panel
• Security enchancement to the normal two-factor authentication PIN code area, accounts can now get locked out based on the amount of invalid attempts at the PIN code
• New setting in the admin panel with the ability to turn profile pictures on or off
• New setting in the admin panel with the ability to turn uploading profile pictures on or off
• Security enhancement for encrypting tokens/cookies with the ability to now select the AES-GCM (Galois counter mode) encryption method in the setup area for better cryptography and performance gains
• Security enhancement for the Admin login UI, Admins can now login with a LITE version of the two-factor authentication method this allows for answering security questions only, no PIN codes and will not be locked out if there are too many attempts
• Under the hood some recordsets have been renamed to provide a better environment for developers
• Expired PIN codes will be removed from the database after 1 day as long as cron jobs or scheduled tasks are running regularly
• CSS styles updated
• Added filter links in the Admin panel where the colour keys are for accounts just click on the status and the Admin panel will filter results based on account status
• Added the ability to set the number of consecutive lockouts in the Admin panel
• Added the ability to set the time in days for extended lockout
• Removed session token and modification token from the edit user page in the Admin panel
• Added consecutive lockout counter in the edit user page in the Admin panel
• Edit user "Force logout and generate new tokens" now redirects back to edit user page after completion
• Removed block IP address from the standard admin edit user page as normal admins do not have permission to block IP addresses
• Added extended lockout view to user profiles on the Admin panel
• Account statistics on the users settings page now displays the correct time for the users timezone
• Forced password updates no longer requires the user to know their current password
• Forced security information updates no longer requires the user to know their current security answers
• Updated JQuery library to 3.5.0 except for the user settings page which still requires 3.4.1
• Updated Bootstrap library
• Security enhancement added new support for SameSite cookies in the setup area which forces the system minimum requirements to PHP 7.3 and above
• Security enhancement added new CSP (content security policy) to prevent XXS or cross-site scripting attacks, this can be modified to your specific needs if you wish
• Various other bug fixes and improvements
• Various cosmetic improvements

Identified issues:

• Remember me no longer works due to incorrect array key in setcookie function which is currently "expire" and should be "expires" - STATUS - Fixed
• Missing expiration date on reset password authkey email - STATUS - Fixed

Version 3.4.0 Release notes

• CSS styles updated to allow better mobile support
• Updated logo to Nexus powered application
• Added new password shown/hidden sliders
• Updated menus to be more mobile friendly
• New feature invalidate all security information
  
• New feature reset all passwords which resets passwords with random password and emails the user that password and also forces the user to change it at next login
• New feature interim redirect allows the super admin to redirect users to a specific site or page
• Security enhancement secured block IP addresses so that only super admins can block or manage blocked IP addresses
  
• Security enhancement secured password, PIN and security information hashing by adding the users uuid into the hash meaning two users with the same passwords will have different hash values
• New setup step now allows the owner to select the strength of hashing for passwords, PIN codes and security information and the encryption strength for tokens
• Fixed permission and recordset clash with authentication and event logs
• Changed alerts, blocked IP's and banned emails ID's to UUID's
• Modified database structure to allow new features
• Added an interim-bridge for forcing update of security information in the accountsystem > interim directory
• Invalidating security information now forces the user to update the information on next login
• Added new JQuery blockout UI screens
• Added new JQuery dropdown selection boxes on the setup and admin panel
• Added new Bootstrap radio buttons on the setup
• Updated the admin login UI
  

Version 3.3.1 Release notes

• Fixed problem with creating a new account in admin panel with expiry date and time
• CSS files updated
• Styles for authentication logs updated to a more modern feel
• Styles for information and error toast messages updated
• Moved the "delete selected accounts" button in the admin panel to where the select all checkbox is
• Created external cron-jobs for external scheduled tasks as well as integrated cron-jobs to be added as optional on page visits to run on demand
• Created a Windows command line batch script using CURL to access URL's silently and run external cron-jobs
• Redesigned the user account statistics and account settings interface
• Added the ability to schedule profile pictures as temporary profile pictures
• Added the ability to schedule alert messages on the admin and user login pages
• Added the ability for Super admin's and admin's to remove scheduled profile pictures
  
• Changed limit of accounts on Admin panel to 100 as too many displayed may crash the browser
• Changed limit of records displayed on the authentication, event and combined logs to 200 as too many records may crash the browser
• Fixed permissions error where normal admins could logout all super admin's sessions in the admin panel
• Added the ability for users to hide alert messages on the login pages by clicking the X button at the top of the message
• Added a "lock settings" button when account settings are unlocked, this destroys the current session and locks the settings again
  
  

Version 3.2.1 Release notes

• Fixed issue where cookies were not deleted properly on logout
• Fixed sessions were not deleted when user changes password, a password change means all existing sessions using the old password are logged out and master tokens changed/regenerated

Version 3.2.0 Release notes

• Changed the querystring in the Admin panel from ?email=&ip= to a base64 encrypted uuid, this makes it easier to locate user records
• Added a new setting "Send email before inactive account gets deleted" in the Admin panel, which allows admins to automatically send an email to accounts that have nearly reached the inactive date warning them that their account will be deleted if they do not log in.
• Added the ability to rename the default "images", "accountsystem" and "management" directories to whatever the owner wants
• Added new JQuery alerts, when a field has been incorrectly filled in the box now turns red to indicate that it needs attention before being submitted
• Updated the database structure
• Added new email subject field in the setup process to specify the subject for the outgoing email for the inactive accounts
• Added the ability for the cookies to be valid for the entire domain or sub-domain, not just limited to the host
• Edit users in the Admin panel now contains combined logs option under "actions", this only shows if both authentication and event logs are enabled
• Corrected errors where some sessions were not correctly deleted due to submitting the wrong data type to the database
• A few cosmetic adjustments
• Combined logs menu only appears if both authentication and event logs are enabled
• Links to edit users in the authentication, event and combined logs are now base64 encrypted uuids
• Database now uses generated uuid's as user id's instead of being incremental, this reduces attack surface and mitigates against command injection attacks

Identified issues

• Cookies fail to clear on logout, this issue has been addressed and acknowleged and will not affect how the system works, attackers cannot replay sessions as sessions are deleted from the sessions table on logout, the problem is just that the cookies remain instead of being deleted - STATUS - fixed

Version 3.1.2 Release notes

• Added new combined logs, which combines the authentication log and event log into one convenient log with the ability to search for specific start and end dates within a search
• Added new live predictive search to the Admin panel, authentication logs, event logs, combined logs, manage blocked IP's and manage banned email addresses
• Added the ability to securely bypass the two-factor authentication PIN code, for example if you didn't recieve the PIN code email you can answer your security questions instead
• Modified the search code on the Admin panel to "contains" this means you don't have to have an exact match for a result, also all searches now stay on the main page instead of an external page by passing the "q" parameter
• New table layout for Admin panel, authentication logs, event logs and combined logs, the new table layout is mobile friendly
• General bug fixes and improvements

Version 3.1.1 Release notes

• Added "unlock my account" to the Admin panel for admin's who's accounts are stuck on "locked out" status locked out from the users area.
• Added a new setup step to customise the sites base URL, admin and user login and logout redirects and logout redirect timeout before being redirected to the logout URL.
• Added options to the cookie setup area to customise cookie names for the main session. modification key, temporary key and two-factor authentication keys.
• Added new options to the email setup area to specify outgoing email subjects, incoming email address for the contact support form, outgoing email address for the system to send out emails and from name field for outgoing email.
• Updated Breezeserve powered application logo
• Updated menu under "my account" users side

Version 3.0.2 Release notes

• Added colour coded profile information and colour keys in the Admin panel for example accounts that are disabled appear in the colour red.

Version 3.0.1 Release notes

• New multi-session management much like Facebook and other social networks have, the ability to see your logged in devices from where, when and what device, and end sessions you do not recongnise the information available is what browser, operating system, IP address, approximate location, logged in date, session expiry date and timezone, Admins can end sessions for users in the admin panel, users can manage their own sessions Admins cannot manage super admin's sessions.
• Added truncate sessions table in the event of an emergency the Super admin can truncate and end all sessions on the site

 

For support or any queries please contact support@sentrywebauth.com
The Sentry web authentication and Innovate logos are copyright of Michael Lowe 2024
Copyright © 2024 Michael Lowe