3.4.0

• fix: Allow csrf retrieval for asyncCsrfInputs. Thanks to @Tim-Wils

3.3.7

Fixed

• fix: removed reference to old code

3.3.6

Fixed

• fix: don't allow visits to plugin templates before 2fa

3.3.5

fix: Missing usertoken table on fresh install

3.3.4

Fixed

• fix: Exposure of Sensitive Attributes
• fix: Corrected the single use token time window

3.3.3

Changed

• Deprecate php 8.0
• Updated spomky-labs/otphp
• Updated endroid/qr-code

Fixed

• Remove unneeded getTotp call.
• fix: Exposure of Sensitive Attributes
• fix: Token is now single use within time window

3.3.2

Fixed

• Fixed a post-login vulnerability.

3.3.1

Fixed

• Use isTwoFactorEnabled on settings screen.
• Use two-factor-authentication/settings/turn-on action on settings screen.

3.3.0

Fixed

• Verify screen updated to Craft's new frontend style.
• Verify step wasn't functioning correctly.

3.2.1

Fixed

• Prevent error when lastLoginDate is not set. Thanks to @joepagan