- + 2FA
- Administration Improvements
Site administrators can now reset or disable Two-Factor Authentication (2FA) for individual users.
This supports secure account recovery scenarios, such as when users lose access to their authentication devices.
The enhancement complements group-based 2FA enforcement and grace-period policies in organizational environments.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8723
- Enforcement with Per-User and Per-Group Grace Periods
Tiki now supports enforcing Two-Factor Authentication (2FA) using configurable grace periods applied per group and per user.
Administrators can define enforcement policies with grace periods (for example 3, 7, 14, or 30 days), calculated per user based on enforcement date or account creation.
Clear reminders are shown to users during the grace period, and optional notifications can be sent to users who have not yet enabled 2FA.
A grace period of 0 days enforces immediate 2FA, and accounts are automatically locked once the grace period expires.
An admin interface allows granting, revoking, or extending grace periods for individual users, supporting scalable and secure 2FA rollout.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8710
- + Batch Lock/Unlock for User Accounts
- Administrators can now lock or unlock multiple user accounts at once from the user administration interface.
Multiple users can be selected and the lock or unlock action applied via the dropdown menu.
This enhancement reduces manual effort and significantly speeds up account management on sites with large user bases.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8733
- + Blending Permission Scope System
- A new preference introduces flexible permission scope handling.
Administrators can choose between the traditional strict scope (nearest defined scope wins) or the new blending scope, which merges permissions from nearest to farthest using an additive model.
This provides more granular control over permission inheritance and enforcement.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/7181
- + Brute Force Protection (Experimental)
- A new experimental brute force protection system has been introduced to mitigate automated attacks on authentication-related workflows.
The new BruteForceProtection service applies exponential backoff throttling to login attempts, user registration, and password reset requests.
Attempts are tracked in a new tiki_bruteforce_attempts database table with automatic, time-based cleanup.
New experimental admin preferences allow enabling or disabling the feature, configuring the initial delay, growth rate multiplier, and forget time window.
Users receive clear retry messages indicating when the next attempt is allowed.
The system includes full unit test coverage for timing, attempt tracking, and expiry behavior.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8588
- + Centralized SSRF Protection Library
- + Cookie Consent System Improvements
- Reworked parts of the cookie consent system to improve usability, preference persistence, and consent management reliability.
Enhancements include improved preference synchronization, support for disabling unused consent categories, expanded translatable strings, and better handling of consent states.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9843
- + Email-to-Tracker Safety Preference
- A new preference has been added (
email_to_tracker_mode ) to control whether emails are moved or copied when creating tracker items from IMAP.
The enhancement is especially useful in test or pre-production environments where email retention is critical.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8646
- + Encrypted Tracker Field Workflow and Security Improvements
- Resolved multiple issues affecting encrypted tracker fields and completed the end-to-end encryption key unlock workflow.
Improvements include better validation, secure key handling, permission checks, transaction safety, and more reliable item creation and editing behavior.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/10042
- + Expanded HTTP Security Headers and CORS Support
- Tiki now supports a full set of configurable CORS and cross-origin policy headers, including credential handling, allowed methods and headers, and modern browser isolation controls (COOP, COEP, CORP).
All headers are configurable from the Admin → Security interface and follow MDN specifications.
Smart validation prevents unsafe configurations, and all options are disabled by default to preserve backward compatibility.
This enhancement strengthens security while giving administrators fine-grained control over cross-origin behavior.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8639
- + Groups Emulation Interface and Validation Improvements
- Enhanced the Groups Emulation module with a more intuitive interface, including clearer distinction between parent and inherited groups, collapsible group sections, group counts, and active status badges.
Improved frontend and backend validation to prevent invalid group selections and make permission testing more reliable.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/10182
- + Forum Email Masking Option
- A new privacy feature allows forums to automatically hide email addresses from public view.
A new forum_mask_emails preference controls masking behavior, and a maskFields method in the Comments class ensures sensitive fields are safely masked.
A new forummaskemail template modifier is used across forum views, and admin settings have been updated to manage email masking.
This enhancement helps prevent email harvesting and strengthens privacy on forums open to anonymous visitors.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9159
- + More Restrictive Default Tracker Permissions
- Tracker permission defaults were updated to use more restrictive access settings for new installations, reducing unintended anonymous access to tracker content.
A new tiki-check.php warning also helps administrators identify potentially unsafe anonymous tracker permission configurations.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9674
- + Password Reset Security with Cryptographic Tokens Improved
- The password reset process has been modernized to use cryptographically secure random tokens instead of the previous MD5-based validation.
This significantly reduces the risk of token prediction, forgery, or replay attacks.
Key improvements include:
- Replacement of insecure MD5 hashes with secure, randomly generated reset tokens.
- Introduction of PasswordResetLib for token creation, validation, and expiration handling.
- Addition of a new database table, tiki_password_reset_tokens, to safely store and manage reset tokens.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8426
- + Retry-After Header for Load Threshold Protection
- When "use_load_threshold" protection is triggered, Tiki now sends a "Retry-After" HTTP header.
Informs clients and bots how long to wait before retrying requests when the server is under high load.
Improves behavior of search engines and automated clients during temporary overload situations.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9349
- + SAML Authentication: Admin Fallback Login
- When SAML authentication is enabled, all users with Admin privileges can now log in using Tiki’s fallback authentication method.
This improves flexibility while preserving a secure login flow and simplifies access for administrators.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/8214
- + Security Checks in tiki-check Enhanced
- tiki-check.php and its dashboard have been extended with additional security verifications to help administrators quickly identify potential risks.
New checks include:
- Detection of exposed or misconfigured phpMyAdmin installations.
- Detection of leftover or publicly accessible Adminer / AdminerEvo files.
- Verification of unsafe, world-readable permissions on db/local.php.
- Additional warnings for other common insecure deployment conditions.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/7986
- + Tracker Data Redaction Support
- + Trusted Proxy Restriction for Load Balancer Access
- Support for trusted proxies has been added to improve security when Tiki is deployed behind a load balancer.
The feature_loadbalancer_header preference enables handling of load balancer headers.
The feature_loadbalancer_trusted_proxies preference allows restricting accepted proxy IP addresses to a trusted list.
Helps prevent spoofed headers and unauthorized access through proxy infrastructure.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9484
- + ((Two-factor-authentication|Two-Factor Authentication (2FA) Setup Experience))
- Updated the Two-Factor Authentication (2FA) setup panel to improve usability, accessibility, and standards-based guidance.
Enhancements include clearer setup instructions, vendor-neutral TOTP guidance, copy-to-clipboard support for secret keys, and improved mobile-friendly verification code input.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9837
- + Rate Limiting for Attack Protection
- + Usernames Cannot Contain Spaces
- Tiki now strictly enforces that usernames cannot contain spaces and must follow a single contiguous pattern.
This prevents ambiguities between usernames and page content or other identifiers.
The rule applies system-wide and improves compatibility with features such as feature_tag_users.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/9040
- + WebAuthn/Passkey Onboarding Experience
- Enhanced the WebAuthn/passkey onboarding workflow with a dedicated post-registration enrollment prompt, retry and skip options, and clearer error feedback.
This improves usability and aligns the registration experience with modern authentication workflows.
https://gitlab.com/tikiwiki/tiki/-/merge_requests/10030
|