Smart Admin Assistant Pro v1.5.0 – All-in-one WordPress Admin Dashboard Plugin

* Security: Fixed a two-factor authentication bypass. The 2FA setup flow could be used to complete login without verifying a second factor — either by posting directly to the final “complete” step, or by re-running setup against an already-enrolled account. Setup completion now requires a second factor to be verified within the same pending-login session, and already-enrolled users are routed to verification instead of setup.
* Security: The Developer Tools “manage WP debug log” feature no longer writes a plaintext `wp-config.php.bdtsaa-bak` backup next to wp-config.php (web-accessible on most installs, exposing database credentials and secret keys). The config is now updated via an atomic replace with no on-disk backup, and any backup left by a previous version is removed automatically.
* Security: The 2FA verification screen now enforces the account lockout at entry, so the “maximum attempts” limit can no longer be bypassed to brute-force verification codes.
* Security: Magic Login email codes are now generated with a cryptographically secure random source instead of str_shuffle().
* Security: Magic Login token authentication is now throttled per account after repeated invalid attempts.
* Security: Magic Login now derives the client IP from REMOTE_ADDR only, ignoring spoofable forwarding headers unless the site opts in via the `bdtsaa_trust_proxy_headers` filter.
* Security: The Performance module no longer leaves predictable, web-accessible “.htaccess” backup copies (“.htaccess.bdtsaa-backup-*”) in the site root when toggling browser-caching rules. Writes now use a random temporary file with an in-memory restore, and any backups left by earlier versions are removed automatically.
* Security: Two-factor recovery codes are now compared in constant time (hash_equals) to remove a theoretical timing side channel.
* Security: The Magic Login form no longer reveals whether an account exists for a submitted username or email; it always shows the same “check your inbox” response, preventing username/email enumeration.
* Security: The dependency admin notice can no longer be dismissed via a forged GET request; dismissal now always requires a valid nonce and capability.
* Fixed: The stored license state is now loaded on plugins_loaded, before any plugin’s init hooks run — previously the free plugin could query the license before it was bootstrapped and treat the whole request as unlicensed, making premium features intermittently appear locked.
* Fixed: The debug-log REST endpoint always returned an empty log (it called a method that did not exist); it now returns the actual log lines for the React dashboard.
* Fixed: Clearing the debug log via REST reported success even when the file was missing or not writable; it now reports an accurate result and surfaces a clear error when the file cannot be written. Both endpoints now resolve the log path through the viewer’s containment-checked helper.
* Fixed: Clearing the activity log (REST and AJAX) and clearing all IP blocks now report an accurate error when the underlying database operation fails, instead of always reporting success.
* Fixed: The spam-comment cleanup now reports an error when the deletion query fails rather than reporting success with a count of zero.
* Fixed: Removed a stray “1” that was rendered above the license activation form.
* Fixed: Plugin activations were logged in the Activity Log even when “Log plugin changes” was disabled; activation logging now respects the toggle, matching deactivation and update logging.
* Improved: Aligned the Singleton trait with the free plugin (added the direct-access guard) and centralized license-key display masking. No functional change.
* Added: Compatibility with WordPress 7.0.1
* Added: REST API endpoints for Activity Log and Debug Log (React dashboard integration)
* Added: Pro React admin integration with license data for the new dashboard UI
* Improved: Activity log with individual entry deletion, cleaner option tracking, and improved CSV export
* Improved: Login page customization compatibility with the React admin dashboard
* Improved: License activation and deactivation flow with clearer error feedback
* Added: Performance module support for removing .htaccess browser caching rules when disabled
* Fixed: Login template builder event handling and template switching in React admin context