Tilspire 1.10.0

tilspire 1.10.0 is out. It's a security release, so sites set to take security updates automatically install it on their own.

Email links a scanner can't use #

Some mail systems open every link in an incoming message to check it for malware. Until now, that visit was enough to confirm an email address or to use a password-reset link. From 1.10.0, an emailed link only opens a page; nothing happens until you press its button.

Resetting a lost second factor #

When someone loses the phone that holds their authenticator, an administrator can now reset their two-factor sign-in after confirming their own password and code. The reset signs that account out everywhere and emails its owner.

Older two-factor secrets, sealed #

Sites upgraded from 1.8.0 or earlier kept existing two-factor secrets unencrypted. 1.10.0 encrypts each one the next time its owner signs in with it, writing the key to site/config/config.php. From then on, keep that file with your backups.

Roles, permissions and updates #

• The role editor shows the permissions of a disabled module, so they can be removed, and the role new members sign up with can no longer be given permissions.
• php core/cli/update.php --auto applies every waiting database migration, the core's and each enabled module's, unless automatic updates are turned off.

Apply it from Admin ▸ Updates, or see the changelog for every release.