SMSTunnel
| 开发者 |
narboweb
narcisbodea nicunarcisbodea |
|---|---|
| 更新时间 | 2026年7月19日 17:40 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
SMSTunnel transforms your Android phone into a powerful SMS gateway for WordPress.
Key Features
- Use Your Own Phone - No third-party SMS gateway costs
- Two-Factor Authentication - Secure WordPress login with SMS 2FA
- End-to-End Encryption - Messages encrypted with RSA keys
- Quick Setup - Scan QR code from the mobile app
安装:
- Upload the plugin to /wp-content/plugins/
- Activate the plugin
- Install the SMSTunnel app on your Android phone from https://smstunnel.io/integrations/android-app
- Go to SMSTunnel > Quick Setup and scan the QR code with the app
屏幕截图:
更新日志:
1.0.9
- Security: Added an emergency break-glass bypass for 2FA so admins are not permanently locked out of wp-login during a total SMS outage (fail-closed fallback). Enable by adding define('SMSTUNNEL_2FA_EMERGENCY_BYPASS', true); to wp-config.php (see "Emergency 2FA recovery" in Installation), then remove it once access is restored. Every activation is written to the PHP error log.
- Fix: API validation errors returned by the server as an array (NestJS class-validator) are now flattened to a readable string instead of storing the literal "Array" (PHP 8 "Array to string conversion").
- Fix: The read endpoints (connection test, usage, message status, received messages) now handle HTTP 429 rate-limit responses consistently with the send endpoints.
- Fix: The login 2FA code request is now idempotent - reloading the login page reuses the existing code instead of resending an SMS and burning a rate-limit slot.
- Fix: Uninstall now also removes the locally generated RSA key pair (smstunnel_public_key, smstunnel_private_key) so no key material is left orphaned.
- Added: Optional hybrid end-to-end encryption (v2) using AES-256-GCM for the message payload plus RSA-OAEP for the AES key, removing the ~245 byte size limit of legacy RSA encryption for long SMS messages
- Added: "Use hybrid encryption (v2)" toggle in End-to-End Encryption settings (default OFF; requires an up-to-date SMSTunnel app that advertises v2 support)
- Added: Pairing now stores the device's advertised E2E version so the encryptor only uses v2 for capable devices; falls back to v1 otherwise
- Compatibility: When the hybrid toggle is OFF (default), encryption behaviour is unchanged (RSA PKCS#1 v1.5), so existing paired devices keep working
- Security: Added rate limiting to public (nopriv) 2FA SMS endpoints to prevent SMS bombing (3 codes / 15 min per IP on login, 60s cooldown + 5/hour on phone-setup verification)
- Security: Added brute-force lockout on 2FA code verification (max 5 wrong attempts, then the code is invalidated) and switched to constant-time comparison (hash_equals)
- Security: 2FA server fallback ("login without 2FA when SMS unavailable") now defaults to OFF to avoid fail-open authentication
- Security: Client IP detection now relies solely on REMOTE_ADDR (validated) and no longer trusts spoofable proxy headers
- Security: REST /setup-callback site token now compared in constant time (hash_equals)
- Security: Hardened admin-settings.js E2E pairing UI to use .text() for dynamic/i18n values (DOM XSS)
- Security: Added rate-limit (HTTP 429) handling for the SMS API client
- Security: Strict in_array() comparisons for role checks
- Fix: Synchronized uninstall cleanup with the option keys actually used by the plugin
- Added: Shared recipient validation helpers (smstunnel_validate_e164, smstunnel_is_premium_number, smstunnel_sanitize_recipient) for satellite form plugins
- Security: Added nonce validation (check_ajax_referer) to all nopriv AJAX endpoints including 2FA login and phone setup
- Security: Fixed DOM XSS in quick-setup.js, social-login.js, and admin-settings.js - all server/URL data now uses .text() instead of .html()
- Security: Escaped all remaining unescaped outputs in SMS history table
- Security: API key verification now uses X-API-Key header and configurable server URL (consistent with rest of plugin)
- Fix: Corrected AJAX action name mismatch for API key verification
- Documentation: Added SMSTunnel Authentication section to External Services (auth endpoints)
- Security: Moved all inline JavaScript to external files using wp_enqueue_script and wp_localize_script
- Security: Added OAuth state parameter validation to prevent CSRF attacks on OAuth callback
- Security: REST API /setup-callback now validates site_token in permission_callback instead of callback body
- Security: Removed all wp_add_inline_script calls - all scripts now in external .js files
- Code: Added $request parameter to all REST API permission_callback methods for PHP 8+ compatibility
- Documentation: Updated External Services section with complete service documentation
- Security: Replaced __return_true with documented custom permission_callback methods
- Security: Replaced inline scripts with wp_add_inline_script for proper enqueueing
- Security: Fixed XSS vulnerabilities by using textContent instead of innerHTML for server responses
- Security: Removed external QR code generation services (Google Charts, QR Server API) - all QR codes now generated locally
- Security: Improved escaping for all JavaScript strings using esc_js()
- Documentation: Updated External Services section to accurately reflect service usage
- Security: Added sanitization callbacks for all settings
- Security: Fixed escape output for translatable strings
- Security: Database queries now use prepared statements
- Security: Changed wp_redirect to wp_safe_redirect
- Security: Changed mt_rand to wp_rand
- Compatibility: Tested up to WordPress 6.7.1
- Initial release