Login by call now trusts only confirmed numbers, respects the site's registration settings, and is more securely protected against brute-force attacks.
New Features
A "Limit Number of Attempts" section has been added to the module settings: counting period and limits for call requests from a single browser, from a single IP address, and for a single number, as well as a limit for status checks. Default values remain unchanged; only the limit for a single number has been added (5 requests within 15 minutes).
New "New Users" setting: similar to the main module settings (default), either create an account for any new number or allow only existing users to log in.
English interface language has been added.
Changes in Operation
Users are searched only by confirmed number for phone authorization and by accounts created by the module itself (login matches the number). For such an account upon first login after an update, the number is saved as confirmed.
The "Phone" and "Mobile" profile fields are no longer used for login: they are filled in by the user, and the number in them is not confirmed. A buyer whose number is specified only in these fields will receive a new account upon login by call (if registration is allowed). To allow them to log in to the previous account, specify their number as the phone number for authorization.
For new users, the number is saved as a confirmed number for phone authorization. They are added to default groups from the main module settings, and site modules receive a registration event as with standard registration.
If the number belongs to a blocked user, login is not performed and no new account is created.
Users with one-time password enabled (Proactive Protection module) cannot log in by call: they still require login with a one-time password.
Visitors no longer see technical error text from the call service or system errors: they receive a general message, while details are recorded in the event log.
The API key is passed to SMS.RU in the request body and no longer appears in the request URL.
Users with read permission for the module can view the module settings page, but only users with write permission can save settings.
Important for sites where registration is disabled
If the main module settings prohibit "Allow users to register themselves," the module will no longer create accounts for new phone numbers. To restore the previous behavior, select "Create an account for a new number" in the module settings.
Compatibility
The main module version 20.5.0 or higher is required: the module has previously utilized features from this version.
The phone authorization component communicates with the server via the standard AJAX action mechanism of components. If you have copied the component template into your site template, your copy will continue to work via the original handler, but it will be removed in version 2.0. Update your copy using the new template.
The functions xlogic_authcall_init, xlogic_find_or_create_user, and other module functions with the xlogic_ prefix are deprecated and will be removed in version 2.0. If you have called them in your code, switch to the module class methods.
Database Update
A table for attempt counters is created, along with an agent that deletes outdated records every hour. No manual action is required: the table is created automatically upon the first access to the module.