2.5.3

What's Changed

• shibboleth: Require spoofkey check for http; deprecate bypass by @jrchamp in #109
• shibboleth: Simplify role header, value checks by @jrchamp in #110
• Only allow redirects for approved hosts by @jrchamp in #112

Full Changelog: 2.5.2...2.5.3

2.5.2

• Compatibility: PHP 8.0 and newer require count() argument to be countable #108 (thanks @Gameink, @frereut)

2.5.1

• options-user: use readonly instead of disabled
  • Reported by @MadtownLems, this avoids the false warning about unsaved changes on the profile page but does not prevent profile updates from being saved.
• ci-full: add WordPress plugin check, which discovered:
  • specify domain for all strings
  • readme: shorten changelog messages
  • readme: bump Tested version, specify license
  • readme: cleanup outdated documentation
  • options-user: sanitize message code
  • shibboleth: fix variable warnings

2.5.0

• Add the ability to configure multiple IdPs #101 (thanks @smbader)

v2.4.3

• Compatibility: Check for Shibboleth username instead of Shib-Session-ID; thanks @spfncer #97
• CI: Update GitHub Action workflows and code for WordPress coding standard v3 #94
• Cleanup: Reduced duplication via a logging helper function #95

v2.4.2

• Documentation: Updated Shibboleth documentation external links #92
• Accessibility: Improve labels and heading structure on admin pages #92
• Security: Improve input sanitization and use of nonces #92
• CI: Switch GitHub Action workflows to check against WordPress coding standard #92

v2.4.1

• Compatibility: Fix redirect_to issues on WordPress 6; thanks @masteradhoc, @caosborne89, @jakeparis #88
• Accessibility: Improve color contrast on login page #89
• Fix user profile to only show account link button to the user themself; thanks @jakeparis #90
• CI: Add GitHub Action workflows to check against WordPress-Core coding standard #91

v2.4

• Added hooks for hopefully rare cases where user overrides are necessary; thanks @dsXLII #74
• Better login form support for WordPress 5.3; thanks @jakeparis #76
• Spelling fixes; thanks @junaidkbr #72
• General cleanup to better align with the WordPress Coding Standards #80

v2.3

Changes include:

• Implementing a fallback option for the "Shibboleth Attribute Access Method". For example, if your web server returns redirected environment variables, but occasionally returns standard environment variables, you would want to enable this option.
• Removing deprecated create_function() from use.
• Bumped minimum PHP and WordPress versions to 5.6 and 4.0 respectively.
• Greatly improved the handling of managed fields and cleaned up options-user.php.

v2.2.2

Changes include:

• Re-implementing conditional for .htaccess to protect against the Shibboleth Apache module not being installed; thanks to @jrchamp for reporting. This change includes conditionals for mod_shib, mod_shib.c, and mod_shib.cpp. If you run into issues related to this change, please open an issue on GitHub.