ВЕРСИИ (4)

## 1.1.2 – Security fixes Players who are not logged in yet can no longer: - use their admin's creative mode: they're put in survival until they log in (game mode restored after), and F3+F4 / game mode changes are blocked (`restrictions.lockGameMode`) - use items by right-clicking the air (ender pearls, food, potions, projectiles…), eat, or teleport with ender pearls/chorus fruit/spectator mode - take items from armor stands - hurt other players with projectiles or lingering potions - drag items in their inventory Also: - `/logout` now saves your position, so `/login` brings you back to where you logged out (no more free teleport) - Players who aren't logged in can fall instead of being frozen in the air and kicked for flying - Only one password check at a time per player (protects the server from `/login` spam) - New: players who don't log in within `security.loginTimeoutSeconds` (default 60) are kicked

## 1.1.1 - **New:** `spawn.noReturnWorlds`, a list of worlds where the logout position isn't kept (event worlds, minigames…). Players who log out in one of these worlds rejoin at the spawn instead of going back there. ```yaml spawn: noReturnWorlds: ["event"]

## 1.1.0 – Two-factor authentication & spawn options ### New - **Two-factor authentication (TOTP)**, works with Google Authenticator, Authy, Aegis, 2FAS… - `/2fa add <password>` shows a key (click to copy), then `/2fa confirm <code>` enables it - After `/login`, players with 2FA enter `/2fa <code>` (alias: `/totp`) - `/2fa remove <code>` to disable it, `/authme resettotp <player>` for admins (lost phone) - Brute-force protection: 5 tries, then kick + temporary lock (survives reconnects). Used codes can't be reused - **`/authme setspawn`**: saves your position *and the direction you're looking* as the login spawn - **`spawn.forceSpawnOnJoin`**: always put players at the spawn when they join - **`spawn.spawnWorld`**: choose which world's spawn is used (default: main world) ### Changes - The login spawn now uses the main world, not the world the player logged out in - Passwords and 2FA codes no longer appear in the console - Login lockouts now survive reconnects (per account + IP), and `/changepassword` is rate limited - `/authme status` now shows whether a player uses 2FA - With `premium.allowOfflineMode`, accounts that have 2FA must log in with their password + code ### Fixes - With `invalidateOnQuit` and `timeoutMinutes: 0`, a player who never logged in could get an auto-login session ### Upgrading Replace the jar and restart. The database is upgraded automatically, and new options are added to `config.yml` and `lang.yml` without touching your settings. New permissions: `authme.player.totp` (everyone), `authme.admin.setspawn` and `authme.admin.resettotp` (op).