diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 62e4019f..2bf19817 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -1719,6 +1719,27 @@ public static function user_two_factor_options( $user ) {
$show_2fa_options ? '' : 'disabled="disabled"'
);
+ $providers = self::get_providers();
+
+ // Disable U2F unless already configured.
+ if ( isset( $providers['Two_Factor_FIDO_U2F'] ) ) {
+ $disabled = ! $providers['Two_Factor_FIDO_U2F']->is_available_for_user( $user );
+
+ /**
+ * Filter whether the deprecated U2F provider is available.
+ *
+ * The U2F provider does not support modern browsers, and it being enabled causes confusion.
+ *
+ * @param bool $disabled Whether the provider is disabled for this user.
+ * @param WP_User $user The user being displayed.
+ */
+ $disabled = apply_filters( 'two_factor_u2f_disabled', $disabled, $user );
+
+ if ( $disabled ) {
+ unset( $providers['Two_Factor_FIDO_U2F'] );
+ }
+ }
+
wp_nonce_field( 'user_two_factor_options', '_nonce_user_two_factor_options', false );
?>
@@ -1732,7 +1753,7 @@ public static function user_two_factor_options( $user ) {
- $object ) : ?>
+ $object ) : ?>
/> |
/> |
diff --git a/providers/class-two-factor-fido-u2f-admin.php b/providers/class-two-factor-fido-u2f-admin.php
index 23530370..c6eb67fa 100644
--- a/providers/class-two-factor-fido-u2f-admin.php
+++ b/providers/class-two-factor-fido-u2f-admin.php
@@ -61,6 +61,15 @@ public static function enqueue_assets( $hook ) {
$security_keys = Two_Factor_FIDO_U2F::get_security_keys( $user_id );
+ // Disabled interface if there's no keys.
+ if (
+ ! $security_keys &&
+ /** This filter is documented in class-two-factor-core.php */
+ apply_filters( 'two_factor_u2f_disabled', true )
+ ) {
+ return;
+ }
+
// @todo Ensure that scripts don't fail because of missing u2fL10n.
try {
$data = Two_Factor_FIDO_U2F::$u2f->getRegisterData( $security_keys );
@@ -164,6 +173,15 @@ protected static function asset_version() {
* @param WP_User $user WP_User object of the logged-in user.
*/
public static function show_user_profile( $user ) {
+ // Don't display if the user cannot configure it.
+ if (
+ ! Two_Factor_FIDO_U2F::get_instance()->is_available_for_user( $user ) &&
+ /** This filter is documented in class-two-factor-core.php */
+ apply_filters( 'two_factor_u2f_disabled', true )
+ ) {
+ return;
+ }
+
wp_nonce_field( "user_security_keys-{$user->ID}", '_nonce_user_security_keys' );
$new_key = false;
diff --git a/readme.txt b/readme.txt
index f4baaffa..26bb38f8 100644
--- a/readme.txt
+++ b/readme.txt
@@ -6,7 +6,7 @@ Stable tag: 0.9.1
License: GPL-2.0-or-later
License URI: https://spdx.org/licenses/GPL-2.0-or-later.html
-Enable Two-Factor Authentication using time-based one-time passwords, Universal 2nd Factor (FIDO U2F, YubiKey), email, and backup verification codes.
+Enable Two-Factor Authentication using time-based one-time passwords, email, and backup verification codes.
== Description ==
@@ -14,7 +14,6 @@ Use the "Two-Factor Options" section under "Users" → "Your Profile" to enable
- Email codes
- Time Based One-Time Passwords (TOTP)
-- FIDO Universal 2nd Factor (U2F)
- Backup Codes
- Dummy Method (only for testing purposes)