🎁 FREE 🔐 DF Login OTP v1.2 | 🎁 Free MyBB Plugin

🔐 DF Login OTP v1.2
Bank-style email two-factor for your staff logins - 🎁 FREE for all members

---

🔧 What it is
Email two-factor authentication for the logins you choose (admins/mods by default). A stolen password is worthless without the inbox. Everyone else logs in exactly as before.

🔁 How it works

1. Protected member submits username + password (full form OR header quick-login - both supported)
   
2. Password verified server-side; a 6-digit code is e-mailed (CSPRNG), hashed into a 15-minute cookie, 60s cooldown
   
3. The OTP form carries a signed, AES-256 encrypted, time-limited token - the password NEVER renders in the DOM
   
4. Correct code -> hash_equals verification -> core login completes
   

🛡️ Security design

• random_int() codes + hash_equals everywhere
  
• AES-256-CBC encrypted password token with expiry + signature
  
• Rate-limited code e-mails
  
• Zero plaintext secrets in HTML
  
• Clean uninstall (settings + templates removed)
  

📸 Live in production right now (our board)



🏗️ Structure (reviewer standard)
Lifecycle-only main file · hooks.php · handlers.php · permissions.php · db.php (schema-less, documented) · settings.json/php (insert_query_multiple) · templates.json/php · external stylesheet · English + ACP language packs.

📦 Inside
Full plugin tree - download from the DF Vault button below.

🛠️ Install

1. Upload the tree preserving paths
   
2. ACP -> Plugins -> DF Login OTP -> Install & Activate
   
3. Settings -> DF Login OTP -> set protected group IDs (default 3,4)
   

📝 Changelog

• 1.2 - AES-encrypted token, quick-login support, mail interpolation fix, CSPRNG codes, rate limiting, reviewer-standard structure (board-tested first!)
  
• 1.1 - standardized multi-file build
  
• 1.0 - first release
  

🤝 Support
Reply here or PM Sir-Vigu.

---

A Data-Forums free release - tested on ourselves before sharing. data-forums.com

👍 Like0❤️ Love0😂 Haha0🔥 Fire0👏 Clap0⚡ 0

📖 Aligned with the official "Advanced Plugin Development for MyBB" guide

The MyBB team just published their advanced development manual - we audited this plugin (and our internal standard) against it chapter by chapter:

• Ch1 Architecture - modular lifecycle/hooks/helpers/db/settings-JSON/templates-JSON/lang structure
  
• Ch2 - typed $mybb->get_input() everywhere; no raw input reads
  
• Ch3 - PHP 8 ready: initialized template vars, declared class properties
  
• Ch5 - idempotent db.php migrations, clean uninstall
  
• Ch16 - persistent-artifact is_installed checks
  

Plus our house rules: board-tested on data-forums.com before release, security-audited, live production demo.

Thank you to the MyBB team for the manual - building to the platform's own standard is the least your users deserve. 🤝

---

- Sir-Vigu

👍 Like0❤️ Love0😂 Haha0🔥 Fire0👏 Clap0⚡ 0