Release v1.5.0
Smart Admin Assistant Pro v1.5.0
What's new in v1.5.0
Smart Admin Assistant Pro v1.5.0 was released on . Want to enhance your admin dashboard and build a faster workflow? See the full changelog below and compare with the complete version history.
Release details
Released
190.5 KB
File available
Changelog
Other
- Security: Fixed a two-factor authentication bypass. The 2FA setup flow could be used to complete login without verifying a second factor — either by posting directly to the final "complete" step, or by re-running setup against an already-enrolled account. Setup completion now requires a second factor to be verified within the same pending-login session, and already-enrolled users are routed to verification instead of setup.
- Security: The Developer Tools "manage WP debug log" feature no longer writes a plaintext `wp-config.php.bdtsaa-bak` backup next to wp-config.php (web-accessible on most installs, exposing database credentials and secret keys). The config is now updated via an atomic replace with no on-disk backup, and any backup left by a previous version is removed automatically.
- Security: The 2FA verification screen now enforces the account lockout at entry, so the "maximum attempts" limit can no longer be bypassed to brute-force verification codes.
- Security: Magic Login email codes are now generated with a cryptographically secure random source instead of str_shuffle().
- Security: Magic Login token authentication is now throttled per account after repeated invalid attempts.
- Security: Magic Login now derives the client IP from REMOTE_ADDR only, ignoring spoofable forwarding headers unless the site opts in via the `bdtsaa_trust_proxy_headers` filter.
- Security: The Performance module no longer leaves predictable, web-accessible ".htaccess" backup copies (".htaccess.bdtsaa-backup-*") in the site root when toggling browser-caching rules. Writes now use a random temporary file with an in-memory restore, and any backups left by earlier versions are removed automatically.
- Security: Two-factor recovery codes are now compared in constant time (hash_equals) to remove a theoretical timing side channel.
- Security: The Magic Login form no longer reveals whether an account exists for a submitted username or email; it always shows the same "check your inbox" response, preventing username/email enumeration.
- Security: The dependency admin notice can no longer be dismissed via a forged GET request; dismissal now always requires a valid nonce and capability.
Fixed
- The stored license state is now loaded on plugins_loaded, before any plugin's init hooks run — previously the free plugin could query the license before it was bootstrapped and treat the whole request as unlicensed, making premium features intermittently appear locked.
- The debug-log REST endpoint always returned an empty log (it called a method that did not exist); it now returns the actual log lines for the React dashboard.
- Clearing the debug log via REST reported success even when the file was missing or not writable; it now reports an accurate result and surfaces a clear error when the file cannot be written. Both endpoints now resolve the log path through the viewer's containment-checked helper.
- Clearing the activity log (REST and AJAX) and clearing all IP blocks now report an accurate error when the underlying database operation fails, instead of always reporting success.
- The spam-comment cleanup now reports an error when the deletion query fails rather than reporting success with a count of zero.
- Removed a stray "1" that was rendered above the license activation form.
- Plugin activations were logged in the Activity Log even when "Log plugin changes" was disabled; activation logging now respects the toggle, matching deactivation and update logging.
- Login template builder event handling and template switching in React admin context
Improved
- Aligned the Singleton trait with the free plugin (added the direct-access guard) and centralized license-key display masking. No functional change.
- Activity log with individual entry deletion, cleaner option tracking, and improved CSV export
- Login page customization compatibility with the React admin dashboard
- License activation and deactivation flow with clearer error feedback
Added
- Compatibility with WordPress 7.0.1
- REST API endpoints for Activity Log and Debug Log (React dashboard integration)
- Pro React admin integration with license data for the new dashboard UI
- Performance module support for removing .htaccess browser caching rules when disabled
Compatibility
- Requires WordPress
- 6.1
- Tested up to
- 7.0
- Requires PHP
- 7.4
Verified safe
Smart Admin Assistant Pro v1.5.0 scanned clean with no security threats detected.
View full scan report