Fliegerlogin – SSO for Vereinsflieger

Änderungsprotokoll

3.1.1

• The debug log no longer stores Vereinsflieger session tokens or session cookies. Redaction went by field name, so password and appkey were caught — but the session token travels inside the value: in the query string of every request and once more in the response body, both stored under the harmless names url and body. The session cookie sat in headers the same way. The log lives in a WordPress option that any plugin can read. Values are now scrubbed as well, and the existing log is discarded once on update. Member name, email address and id stay readable on purpose: without them the log cannot say who ran into a problem, and nobody logs in with them.
• Fixes a fatal error for members using two factor authentication. Since 3.0.0 the one time password screen died with a white page: the script that carries the already entered credentials into the second step was built from a format string in double quotes, so PHP replaced the %1$d and %2$s placeholders with undefined variables and sprintf aborted. Two factor logins have been impossible in 3.0.0, 3.0.1, 3.0.2 and 3.1.0. Nothing else reaches that code, which is why it stayed unnoticed.
• The screenshots on this page were retaken on a clean WordPress installation, without a club name, a real app key or unrelated plugins in the sidebar.

3.1.0

• Licensing and updates of the paid edition moved from Freemius to vereo. Fliegerlogin Premium now takes its licence key, its update check and its automatic updates from https://vereo.ch. Every answer is signed with Ed25519 and verified in the plugin, so a redirected domain cannot forge a valid licence, and a signed answer keeps the safeguards running for its grace period when the server cannot be reached.
• This free edition no longer contains the Freemius SDK. It contacted an external service, carried the opt-in dialogue and the upgrade prompts, and none of that was ever needed here: the free edition is updated by WordPress.org. What remains is a page of its own under Fliegerlogin → Premium that names what the paid edition adds, and a link in the plugin list.
• Bestehende Premium-Installationen müssen ihren Lizenzschlüssel einmal unter Fliegerlogin → Lizenz eintragen. Der Schlüssel steht im Kundenbereich.

3.0.2

• Updated the bundled Symfony components to 7.4.16 and composer/ca-bundle to 1.5.14 — patch releases within the LTS line. Composer Audit reports no known vulnerabilities.
• Tested against WordPress 7.1. Every core function and hook the plugin uses was checked against the 7.1 sources: none is deprecated, and none has been removed.
• Fixes a broken login in 3.0.0 and 3.0.1. Renaming the plugin’s prefixes in 3.0.0 also renamed the column in the users table that links a WordPress account to a Vereinsflieger member — but that column already existed in every installation, and no migration came with the rename. The plugin then queried a column that was not there, and no linked member could log in. This release renames the existing column instead of expecting a new one; the link between accounts and members is preserved. Sites set up fresh on 3.0.0 are unaffected and are left untouched.
• Fixes a fatal error on the login screen. When the account was found by email address rather than by Vereinsflieger id, the check that refuses to adopt an administrator account was handed a raw database row where it expected a WP_User, and the request died with a TypeError. Reported from a live site.

3.0.1

• Documentation: the captcha guard and Cloudflare Turnstile are now named in the feature list, in the FAQ and in the upgrade notes for 3.0.0. The guard has been part of the plugin since 2.3.0 and moved to Premium in 3.0.0, which the 3.0.0 notes failed to mention.
• The German translation now covers every string, and has been revised against the glossary and style guide of the German Polyglots team. Swiss variants were added: de_CH (formal) and de_CH_informal.

3.0.0

• Fliegerlogin erscheint ab sofort in zwei Editionen. Diese freie Edition behält das vollständige Single Sign-on mit Vereinsflieger und die Ratenbegrenzung nach IP-Adresse samt Einstellungsseite; die weitergehenden Schutzmaßnahmen und das Debug-Log sind nach Fliegerlogin Premium umgezogen, einem eigenen Download.
• Neue Seite Security: Ratenbegrenzung aktivieren oder deaktivieren, Zahl der Fehlversuche und Sperrdauer festlegen, entscheiden, ob sie für jede WordPress-Anmeldung gilt, und die derzeit gesperrten Adressen einsehen und wieder freigeben.
• Die Ratenbegrenzung bleibt kostenlos und aktiviert. Sie schützt das Anfragekontingent bei Vereinsflieger, auf dem das ganze Plugin aufbaut – eine Website ohne sie stand nie zur Debatte.
• Sicherheit: Ein WordPress-Konto, das die Website verwalten kann, wird nicht mehr automatisch verknüpft, nur weil ein Vereinsflieger-Konto dieselbe E-Mail-Adresse trägt. Eine solche Verknüpfung ist jetzt ein bewusster Schritt von Hand. Zuvor hätte jede Person, die diese Adresse bei Vereinsflieger registrieren konnte, das Konto übernehmen können.
• Sicherheit: Beim Verknüpfen eines bestehenden WordPress-Kontos wird dessen Passwort nicht mehr ersetzt, und die Rolle für neue Mitglieder kann keine mehr sein, die die Website oder ihre Benutzer verwaltet.
• Umstieg von 2.6.x: Alle Einstellungen bleiben erhalten, diese Edition wertet die kostenpflichtigen aber nicht mehr aus. Websites, die auf Geosperre, Sicherungsautomat, Negativ-Cache, die Captcha-Sperre oder den Schutz vor dem Ausspähen von Benutzernamen gebaut haben, brauchen dafür Fliegerlogin Premium. Die Captcha-Sperre verdient ein eigenes Wort, weil sie seit 2.3.0 im Plugin steckt: Weist ein Captcha-Plugin wie Cloudflare Turnstile eine Anmeldung ab, fragt diese Edition trotzdem bei Vereinsflieger nach und verbraucht eine Anfrage. Dass diese Abweisung beachtet wird, ist nach Premium umgezogen.
• Setzt jetzt WordPress 6.0 und PHP 8.2 voraus (zuvor 5.0 / 8.1). Die bisherige WordPress-Untergrenze war nie zutreffend: der Zähler für das API-Kontingent ruft wp_date() auf, und das gibt es erst ab 5.3. Die PHP-Untergrenze folgt den aktualisierten Bibliotheken von Symfony und phpDocumentor.
• Mitgelieferte Bibliotheken aktualisiert: Symfony 6.4 auf 7.4 LTS und phpDocumentor reflection-docblock 5.6 auf 6.0. Composer Audit meldet keine bekannten Schwachstellen.
• Eingebettete Skripte und Stile werden jetzt über wp_add_inline_script() und wp_add_inline_style() registriert, statt direkt ausgegeben zu werden.
• Jede Konstante, Funktion und jedes Formularfeld des Plugins trägt jetzt dasselbe Präfix fliegerlogin und kann damit nicht mehr mit einem anderen Plugin kollidieren. Wer das Debug-Log über die wp-config.php aktiviert hat: die Konstante heißt jetzt FLIEGERLOGIN_DEBUG statt WPVF_DEBUG. Gespeicherte Einstellungen bleiben unberührt.
• Der Anmeldevorgang ist um eine einzige Schnittstelle zu den kostenpflichtigen Schutzmaßnahmen herum neu gefasst, was eine Menge Verzweigungen aus dem Anmeldepfad genommen hat.
• Die Ausgabemaskierung auf den Administrationsseiten ist durchgängig gehärtet, und ein Einstellungs-Link, der wegen einer fehlenden Text Domain nie übersetzbar war, ist repariert.

2.6.1

• Renamed the plugin to Fliegerlogin – SSO for Vereinsflieger. The settings page moved from Vereinsflieger to Fliegerlogin in the admin menu; all existing settings are preserved and no reconfiguration is needed after the update.
• Custom translations are now read from wp-content/languages/sso-for-vereinsflieger/ instead of wp-content/languages/wp-vereinsflieger/. Move your files if you use this feature.
• Updated the Guzzle HTTP stack (guzzle 7.15.2, psr7 2.13.0) to address three medium-severity advisories published on 2026-07-20: URI fragments leaking into redirect Referer headers, host-only cookie scope not being preserved, and unbounded response cookies. Composer Audit now reports no known vulnerabilities.
• The bundled dependencies no longer contain the PHPUnit test framework, and use an optimised classmap autoloader.

2.6.0

• Added a username plausibility filter: since a Vereinsflieger login is always an email address (some clubs additionally allow the numeric member number), login attempts with any other username — the classic brute-force names like „admin“, „root“ or „test“ — are now rejected before any Vereinsflieger API request is spent. Can be toggled on the Security page (on by default), with a choice of accepted format (email address only, or email address + numeric member number), and is shown in the protection overview.

2.5.0

• Renamed the Rate Limits admin page to Security and added a protection overview with status badges for every safeguard.
• Added a global circuit breaker that pauses all Vereinsflieger API calls when the aggregate traffic spikes (sliding-window burst limit) or the daily request quota (max. 500/day per appkey) is exhausted — protecting the shared server IP / appkey against distributed brute-force attacks that per-IP rate limiting cannot stop.
• Added optional geo blocking (allow/block by country) with country detection via Cloudflare, web-server GeoIP variables, the PHP geoip extension, or a MaxMind database, including a live detection diagnostic (that distinguishes „Cloudflare not in path“ from „IP Geolocation header off“) and a fail-open/fail-closed choice.
• The plugin can now download and auto-update the GeoLite2 country database itself (configurable source URL, daily/weekly/monthly via WP-Cron, plus a manual „Update now“), stored in the uploads folder — geo blocking works without Cloudflare and without placing a database file by hand. Bundles the geoip2/geoip2 reader (pure PHP, no C extension required).
• Generalised the captcha guard to a configurable list of blocking WP_Error codes.
• Added an XML-RPC guard that skips the Vereinsflieger lookup for xmlrpc.php login attempts.
• Added a negative cache that remembers recently rejected credentials (as a salted hash) so repeated wrong logins fail instantly without spending API requests.
• Added username-enumeration protection: blocks ?author=N and author archives, the REST /wp/v2/users endpoint, and the author sitemap for logged-out visitors, and optionally replaces WordPress’s „unknown username“ vs. „wrong password“ login errors with a single generic message (the plugin’s own 2FA / rate-limit / Vereinsflieger messages are kept).
• All new safeguards can be toggled independently on the Security page.
• Redesigned the Debug Log page to match the Security area: an at-a-glance status/entry/error/success overview, colour-coded severity per row with category badges derived from the event, and a live text + level filter.
• Updated the Guzzle HTTP stack (guzzle 7.14.2, psr7 2.12.5, promises 2.5.1); Composer Audit reports no known vulnerabilities.

2.4.0

• Added a compact rate limit overview to the Vereinsflieger → Rate Limits admin page with protection status, blocked IP count, active failure counters, the next automatic unblock time, today’s Vereinsflieger API usage, and recent rate-limit events.
• Active failed-login counters below the block threshold are now tracked for visibility on the rate-limit overview and automatically cleaned up when their transient expires.
• Updated Guzzle dependencies to address current medium-severity security advisories reported by Composer Audit.

2.3.1

• Hardened IP-based rate limiting with a sliding lockout: further blocked login attempts now extend the existing lockout window instead of allowing a new attempt window immediately after the original lockout expires.

2.3.0

• Added a Vereinsflieger → Rate Limits admin page to enable or disable IP-based rate limiting, optionally apply it to all WordPress login attempts, configure the failed-attempt threshold and lockout duration, view currently blocked IPs, and unblock individual addresses.
• Improved compatibility with Cloudflare Turnstile login protection by respecting an earlier cfturnstile_error from the Turnstile authentication filter and skipping the Vereinsflieger API fallback for those rejected requests.
• Prefer custom and bundled plugin translations over WordPress.org language packs so local translation changes are not overwritten by automatic translation updates.
• Updated German translations.

2.2.0

• Added IP-based rate limiting for Vereinsflieger login attempts. After 5 consecutive failed credential checks, the IP is blocked for 15 minutes. Cloudflare deployments use the CF-Connecting-IP header so the block targets the real client IP, not the Cloudflare proxy. The counter is stored as a WordPress transient and is automatically cleared on a successful login. This prevents brute-force attacks from exhausting the Vereinsflieger API daily request quota and triggering an AppKey or IP block.

2.1.0

• Added a built-in debug log under Vereinsflieger → Debug Log in the WP admin, with on/off toggle, clear button, and a tabular viewer. Logs are kept in a rolling buffer of the last 500 entries inside a WP option — no SSH or debug.log access required. define('WPVF_DEBUG', true) in wp-config.php still acts as a forced-on override for development. The log covers the whole authentication flow: filter entry, the 2.0.1 skip-existing-WP-user branch, every Vereinsflieger HTTP request/response (status, headers, body excerpt), credential rejections, API errors, 2FA prompts, and final user resolution. Sensitive values (passwords, OTPs, access tokens, app keys) are auto-redacted.

2.0.3

• Bug fix: login no longer crashes with a fatal NotNormalizableValueException when the Vereinsflieger API returns the user id as a string (e.g. "uid": "564284"). The deserializer now relies on PHP’s own type coercion via the typed setters.
• Bug fix: a non-JSON response from the Vereinsflieger API (e.g. an HTML error page from /auth/signout) no longer triggers a fatal NotEncodableValueException. Such responses are now wrapped as a regular HttpException so existing error handling kicks in — in particular the best-effort logout after a successful login no longer breaks the login flow.

2.0.2

• Surface the Vereinsflieger API error message on failed logins. Previously, every 403 response was silently mapped to the generic WordPress „incorrect credentials“ message, making it impossible to distinguish a wrong password from a misconfigured CID, an invalid AppKey, or an exceeded daily request quota. The plugin now appends the API’s error string (e.g. „Application key invalid“, „Daily request limit exceeded“) to the login screen.
• Added German translations for the new error notices and refreshed source-line references in the .po/.mo files.

2.0.1

• Bug fix: skip the Vereinsflieger API fallback when the entered username belongs to an existing WordPress user that is not linked to Vereinsflieger. Mistyped passwords for regular WP accounts no longer waste 4 requests against the daily API quota and no longer surface a misleading „Vereinsflieger is offline“ message.
• Disabled WordPress’s „Lost your password?“ flow for Vereinsflieger-linked accounts (both at lostpassword_post and at the actual reset step). Previously, members could reset their WP password and would then get blocked from logging in, because the plugin refuses default-login for linked accounts.
• Added German translations for the new password-reset notices and refreshed source-line references in the .po/.mo files.

2.0.0

• Breaking: Now requires PHP 8.1+ (was 7.2.5).
• Updated all bundled libraries (Guzzle, Symfony Serializer, PSR-7) to current versions and addressed several CVEs in the previously bundled releases.
• Added a daily API request counter on the configuration page so administrators can see how much of the 500-calls-per-day quota is left.
• Removed the donation notice from the configuration page.
• Hardened authentication: hashed-password handoff is now read from $_POST only (not $_REQUEST) and validated as an md5 hex string.
• Replaced uniqid() with wp_generate_password() for placeholder passwords on linked accounts.
• Added a CSRF nonce to the settings form.
• Vereinsflieger session is now released after a successful WordPress login instead of staying open.
• Bug fix: Api::logout() no longer silently swallows API errors via a misplaced finally-return.
• Bug fix: server-error detection in the login error path no longer matched every status code.
• Bug fix: Options::setAllowDefaultLogin() now correctly distinguishes the unset state.
• Fixed the long-standing „Vereinflieger“ typo in the configuration page strings.

1.1.0

• Enhance error reporting in case Vereinsflieger-API returns with a server error.

1.0.10

• Fix an error caused by changed behaviour of Vereinsflieger API

1.0.9

• Fix an error in German translated links

1.0.8

• Fix issue which changes the wordpress user’s password on every login
• Added option, to allow users linked with Vereinsflieger still using their wordpress credentials
• Added a link at the plugin page to the plugin’s settings

1.0.6

• Added translations (de + en)

1.0.5

• Added icons

1.0

• First version