1.4.0 (July 16, 2026)

• Enh: Migrated the request interception to the core user gate system (TwofaGate, requires humhub/humhub#8291) — deterministic ordering towards other intercepting modules (password change → 2FA → terms), no more redirect loops, and user/auth (login/logout) stays reachable while verification is pending
• Enh: AJAX requests now receive 401 + JSON {gate, url} while verification is pending, instead of an HTML redirect; token-authenticated API requests are not intercepted (REST authentication is handled by the rest module)
• Enh: TwofaHelper::isVerifyingRequired() was split into the side-effect free isVerificationPending() and sendCodeIfNeeded() — the verification code is delivered at interception time (TwofaGate::onIntercept()) instead of as a side effect of a check; a failed code delivery no longer skips the verification (fail-closed)
• Chg: Removed the unused BeforeCheck event, Module::isTwofaCheckUrl() and the doNotInterceptActionIds usage

1.3.0 (June 5, 2026)

• Enh #111: Update for HumHub 1.19

1.2.3 (July 16, 2026)

• Fix: Infinite redirect loop to the 2FA check page when another module intercepts the current action — the handler now yields when another interceptor already redirected the request, cancels the action via $event->isValid and uses a twofa-own, security-reviewed exemption list (check page, login/logout, push token update) instead of a generic opt-out flag

1.2.2 (June 18, 2026)

• Enh: Automated code refactoring for HumHub 1.18.0-beta.6 using Rector
• Fix #109: Infinite loop of code verification when Push Notifications module is enabled
• Fix #114: Fix redirect on check verification

1.2.1 (April 24, 2026)

• Fix #85: Use Return URL after code verification instead of redirecting to home
• Enh #86: Improved Module Test GitHub Actions
• Enh #87: Implemented module-coding-standards
• Fix #90: Use MailStyleHelper for safe email inline styling
• Fix #98: Remove deprecations
• Enh #100: Add admin action to reset 2FA for a user
• Enh #101: Add recovery codes
• Enh #104: replace abandoned Google Auth library
• Enh: Automated code refactoring for HumHub 1.18.0-beta.6 using Rector
• Enh #105: Add optional help text on the 2FA check screen
• Fix #106: Send a new email code after trusted IP changes in the same session

1.2.0 (August 27, 2025)

• Enh #58: Tests for next version
• Fix #63: Update module resources path
• Enh #65: Use PHP CS Fixer
• Enh #66: Reduce translation message categories
• Enh #81: Time Based Code
• Enh #78: Migration to Bootstrap 5 for HumHub 1.18
• Enh #71: Time Based Code
• Fix #76: Fix timezone in email
• Fix #80: Update test user passwords

1.1.3 (June 8, 2023)

• Fix #53: Fix initialize of inline script of QR code

1.1.2 (May 17, 2023)

• Fix #55: Don't send a verification code when trusted IP address

1.1.1 (January 3, 2023)

• Fix #52: Fix checking of current IP address by trusted networks list

1.1.0 (November 9, 2022)

• Enh #41: Added Option to use Google Authentication as Default
• Fix #50: Don't send a verification code when browser was remembered

1.0.7 (March 2, 2022)

• Fix #45: Fix remember browser

1.0.6 (February 2, 2022)

• Enh #36: Update logout url to POST method
• Enh: Added French translations
• Enh #33: Added trusted network functionality
• Enh #16: Added remember browser for X days
• Fix #41: Fix error for user without email address

1.0.5 (August 10 , 2021)

• Fix #29: Fix button "Log out" to prevent pjax
• Fix #31: Don't require 2FA on administration action "Impersonate"

1.0.4 (15 June, 2021)

• Fix #23: Urlencode account name in otpauth URL
• Fix #25: Fix double rendering QR code after cancel of requesting new code

1.0.3 (May 11, 2021)

• Fix #22: Composer dependencies for Google Auth missing in marketplace package

1.0.2 (May 10, 2021)

• Enh #18: Generate QR code for Google authenticator by local JS script (Don't send TOTP key to Google)

1.0.1 (May 6, 2021)

• Fix: Link in translatable string
• Enh: Use controller config for not intercepted actions (HumHub 1.9+)
• Fix: Don't verify code if user must change password

1.0.0 (February 9, 2021)

• Enh: Initial release
• Init: Default driver to send code by e-mail
• Enh: Driver "Google Authenticator"
• Enh: Require pin code before enabling Google Authenticator