EthPress - Web3 Login

The EthPress NFT Access Add-On can be used to control access for WooCommerce products, simple pages and posts.

1. Upload this folder (on WordPress.org, not GitLab) to the /wp-content/plugins/ directory
2. Activate the plugin through the 'Plugins' menu in WordPress

• The login modal is rewritten on Reown AppKit (the successor of WalletConnect v2). The old web3modal based front end is removed
• The new Reown settings section is added: Reown Project ID, Theme mode and Supported networks
• Multichain support: the new Supported networks setting lets you choose which networks are offered to users - the EVM chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Fantom, Gnosis, zkSync, Linea, Scroll, Celo, Polygon zkEVM, Mantle, Blast, Cronos, Moonbeam) and testnets
• Multisite support: the plugin options are now stored network wide
• The [ethpress_unlink_button] shortcode is added to display the Unlink wallet button anywhere. Unlinking removes the wallet association and keeps the account: signing in again with the same wallet links it back to that account, and the wallet cannot be used to register a second one
• A confirmation message is shown to the user after the account is linked
• The Freemius SDK is updated and bundled via Composer
• olegabr/keccak is replaced with kornrunner/keccak
• Requires PHP 8.1
• The Disable standard redirect login setting is added. When enabled, a successful login no longer redirects to the WordPress dashboard or the Redirect URL, but returns the user to the page where the login started
• The noredirect and redirect_to attributes are added to the [ethpress_login_button] shortcode, so the redirect can be controlled per button
• The label attribute is added to the [ethpress_login_button], [ethpress_link_button] and [ethpress_unlink_button] shortcodes, so the button text can be changed per button (PRO)
• The Remember me login setting is added. Wallet users now stay logged in across browser restarts instead of having to connect their wallet on every visit. The Free version always keeps it enabled
• Wallet users are now registered with an email address, collected from the login form, the WooCommerce checkout, or a placeholder derived from the wallet address, so their profile is editable
• The Profile completion login setting is added. When enabled (PRO), new wallet users who registered without an email address are sent to their profile after the first login to add an email and a name. It also has an Inline form next to the login button mode, which collects the email and name before the account is created. The values are remembered for the current browser tab, so a reload does not lose them
• The Hide on the WordPress login page setting is added. When enabled, the wallet login and register buttons are not displayed on wp-login.php. Buttons added with the shortcodes or the widget are not affected
• The Custom CSS setting is added (PRO). It styles the login buttons and the wallet modal
• The Terms & Conditions text and Terms & Conditions URL login settings are added. They show a required "I agree to the Terms & Conditions" checkbox next to the wallet login button; the text links to the given URL when set. The login is blocked until the box is ticked, and the acceptance is checked on the server as well
• The Diagnostics section is added to the plugin settings. It answers the "why does nothing work here" questions without support: whether php-gmp/php-bcmath verify signatures on this server, whether a known message and signature really recover the expected address (checked with this server, or with the verification service when that is the path the logins take), which verification service is used instead, whether your own Reown Project ID is set, and whether new wallets can create an account
• A signature verification that is done by the verification service now fails cleanly when the service is unreachable, if your site blocks outbound requests, or when it answers with an HTML error page or a different JSON shape. Such answers used to raise PHP warnings inside the login request instead of a normal "failed to verify" error. The signature self-test in the Diagnostics section reports exactly that: it probes the service when the service is the path the logins take, and it waits at most 5 seconds
• The [ethpress_login_button] shortcode no longer prints nothing for a logged-in visitor. It prints a hint explaining that the button is hidden because the user is already logged in (notice="1" forces it for every visitor, notice="0" switches it off); site owners see the hint by default
• A wallet without an account is no longer answered with the bare "You have not registered on this site; we cannot log you in". When the site does not accept registrations (the default), the message now says so, names the Anyone can register setting and tells the visitor to contact the site administrator - something they can forward as is. Both messages are filterable with ethpress_registration_closed_message and ethpress_unregistered_message
• Fixed wallet login on sites where another active plugin (for example BuddyPress) prints output, or renders a login form, while the login request is being processed. Such output used to be prepended to the AJAX response, which broke it with the Unexpected token < in JSON at position 0 error and left the user logged in on the server but not in the browser
• A malformed signature that cannot be recovered no longer returns an HTTP 500 error page. The failure is caught and reported as a regular JSON error response
• Fixed the renewed AJAX nonces that a successful login returns in its response. They were created for a session token that the browser did not have yet, so using them right after logging in failed with Bad nonce, please refresh. The renewed nonces are now valid on the session the login just created
• Wallet login nonces are now one-time. The nonce is issued when the login message is requested and consumed when the signature is verified, so a signed message cannot be replayed. Its lifetime is configurable with the ethpress_nonce_lifetime filter (15 minutes by default) instead of the fixed five minutes, and it no longer depends on the session token, which fixes Bad nonce, please refresh on slow mobile wallet flows