Data-Forums
🎁 FREE DF Login OTP v2.0.0 — Server-stored, one-use email challenges for native forum login - Printable Version

+- Data-Forums (https://data-forums.com/forum)
+-- Forum: 🎁 DF Freebies (https://data-forums.com/forum/Forum-%F0%9F%8E%81-DF-Freebies)
+--- Forum: Free Plugins & Tools (https://data-forums.com/forum/Forum-Free-Plugins-Tools)
+--- Thread: 🎁 FREE DF Login OTP v2.0.0 — Server-stored, one-use email challenges for native forum login (/Thread-%F0%9F%8E%81-Free-DF-Login-OTP-v2-0-0-%E2%80%94-Server-stored-one-use-email-challenges-for-native-forum-login)

DF Login OTP v2.0.0 — Server-stored, one-use email challenges for native forum login - Sir-Vigu - 08-26-2026

Verification record: DFV-AUDIT-20261021
Repair wave 2 — DF Login OTP 2.0.0
21 October 2026 · Sir-Vigu · Scoped staging checks passed

Security-focused replacement for the recovered 1.2 distribution. This is a versioned repair/rebuild, not a recovered original archive. No production activation was performed.

[Image: df-loginotp.webp]
Actual isolated MyBB test capture. Sample data; not a production install or a real payment/broadcast claim.

What changed
  • The hook runs after native MyBB password validation and before the authentication cookie is issued.
  • Random opaque pending token; keyed code hashes, session binding, ten-minute expiry and five-attempt limit stored server-side.
  • One-use conditional consumption, password/loginkey-change invalidation, cancellation and request limits.
  • Primary and additional protected groups count. HTTPS is required by default.
  • Mail-adapter failure fails closed; no password, encrypted password token or plaintext code is stored in challenge records.

Requirements
MyBB 1.8.40 tested; PHP 8.1+ intended (runtime tests on 8.4.26); MySQL/MariaDB; modern browser. Custom themes, external authentication, mail and provider integrations require their own staging checks.

Installation and upgrade
Back up first. Upload inc/ and jscripts/ into the MyBB root. Keep an authenticated ACP recovery session open. Back up DB/files. Deactivate 1.2 without uninstalling, upload the new PHP, then Install & Activate 2.0 to create the new challenge/key tables. Confirm group IDs, HTTPS and real mail delivery before ending the recovery session. Legacy OTP page templates are unused; do not downgrade without restoring the backup.

Settings
ACP → Settings → DF Login OTP. Protected groups defaults to 4,6 on fresh installation. Review existing group values on upgrade. Require HTTPS must stay Yes in production.

Usage
Code:
Use native member.php?action=login with a protected account. After a valid password, enter the emailed six-digit code. Normal unprotected members keep native login.

Test evidence
21 browser/auth-flow assertions cover correct/incorrect code, no auth before OTP, CSRF, expiry, replay, session transfer, credential change, cancellation, attempts, HTTP refusal, delivery failure and ordinary-member login. Additional PHP checks cover protected primary/additional groups.
The eight-release wave passed 117 scoped assertions across PHP/MyBB, browser, HTTP and lifecycle checks. Some tests used a combined plugin context; this is not a universal compatibility certificate or an independent security audit.

Limitations / breaking changes
Protects native forum login completion, NOT the Admin CP login or SSO plugins that set authentication cookies directly. Preserve and test separate ACP/SSO security. Email delivery was exercised through a lab capture adapter, not your real SMTP provider. Third-party CAPTCHA/login integrations need staging checks. This is not an independent security audit.

Deactivate / uninstall
Deactivate retains settings/challenges. Uninstall removes the new challenge/key tables and its settings, invalidating pending challenges; it does not delete accounts or posts.

Changelog
2.0.0 — 21 October 2026: Security-focused replacement for the recovered 1.2 distribution. Full source, README, upgrade notes, changelog, test-scope note and licence included in the ZIP.

Download the current Vault release — existing access rules apply.

Support / licence
Reply below or PM Sir-Vigu (uid 1) with versions and a minimal reproduction. Never publish credentials or private member data. GPL-3.0-or-later; existing attribution retained.

Full verification register

Original release notes
🔐 DF Login OTP v1.2
Bank-style email two-factor for your staff logins - 🎁 FREE for all members
🔧 What it is
Email two-factor authentication for the logins you choose (admins/mods by default). A stolen password is worthless without the inbox. Everyone else logs in exactly as before.

🔁 How it works
  1. Protected member submits username + password (full form OR header quick-login - both supported)
  2. Password verified server-side; a 6-digit code is e-mailed (CSPRNG), hashed into a 15-minute cookie, 60s cooldown
  3. The OTP form carries a signed, AES-256 encrypted, time-limited token - the password NEVER renders in the DOM
  4. Correct code -> hash_equals verification -> core login completes
🛡️ Security design
  • random_int() codes + hash_equals everywhere
  • AES-256-CBC encrypted password token with expiry + signature
  • Rate-limited code e-mails
  • Zero plaintext secrets in HTML
  • Clean uninstall (settings + templates removed)
📸 Live in production right now (our board)
[Image: df-otp-check.jpg]
[Image: df-otp-email.jpg]

🏗️ Structure (reviewer standard)
Lifecycle-only main file · hooks.php · handlers.php · permissions.php · db.php (schema-less, documented) · settings.json/php (insert_query_multiple) · templates.json/php · external stylesheet · English + ACP language packs.

📦 Inside
Full plugin tree - download from the DF Vault button below.

🛠️ Install
  1. Upload the tree preserving paths
  2. ACP -> Plugins -> DF Login OTP -> Install & Activate
  3. Settings -> DF Login OTP -> set protected group IDs (default 3,4)
📝 Changelog
  • 1.2 - AES-encrypted token, quick-login support, mail interpolation fix, CSPRNG codes, rate limiting, reviewer-standard structure (board-tested first!)
  • 1.1 - standardized multi-file build
  • 1.0 - first release
🤝 Support
Reply here or PM Sir-Vigu.
A Data-Forums free release - tested on ourselves before sharing. data-forums.com

RE: guide alignment - Sir-Vigu - 08-27-2026

📖 Aligned with the official "Advanced Plugin Development for MyBB" guide

The MyBB team just published their advanced development manual - we audited this plugin (and our internal standard) against it chapter by chapter:
  • Ch1 Architecture - modular lifecycle/hooks/helpers/db/settings-JSON/templates-JSON/lang structure
  • Ch2 - typed $mybb->get_input() everywhere; no raw input reads
  • Ch3 - PHP 8 ready: initialized template vars, declared class properties
  • Ch5 - idempotent db.php migrations, clean uninstall
  • Ch16 - persistent-artifact is_installed checks
Plus our house rules: board-tested on data-forums.com before release, security-audited, live production demo.

Thank you to the MyBB team for the manual - building to the platform's own standard is the least your users deserve. 🤝
- Sir-Vigu

🎓 Academy🗃 DF Vault💰 DF Treasury🎬 Live Theater🎁 Freebies📱 Get the app✉ Feedback🩻 SEO X-Ray
Data-Forums © 2026