Install
Works with Drupal: ^10 || ^11 || ^12Using Composer to manage Drupal site dependencies
Alternative installation files
Security issues fixed
This release fixes security vulnerabilities. Sites are urged to update immediately after reading the following security announcements and release notes:
Release notes
This is a security release. All sites using Authenticator Login Plus should update to 1.0.3. See:
Behavior change
For accounts with two-factor authentication, logins that don't go through the login form (one-time login links, single sign-on modules and other code that calls user_login_finalize()) now ask for the second factor before the account is logged in. Code that such a module runs after its own login call (for example externalauth's ExternalAuthEvents::LOGIN) runs only after the second factor has been entered.
Also included
- #3634529: Store code length and validity period per enrollment, so changing the settings no longer locks out enrolled users.
- #3634531: List each user once on the admin 2FA overview on multilingual sites.
- #3634534: Fix the doubled base path in the Continue link after mandatory enrollment on sites installed in a subdirectory.
- #3635043: Allow bacon/bacon-qr-code ^3.0, so the module can be installed next to endroid/qr-code 5.0.8 or later.
After updating
Run database updates (drush updb or /update.php) and clear caches.
