Alternative to #741 - Autosubmit Tweak by georgestephanis · Pull Request #820 · WordPress/two-factor

georgestephanis · 2026-03-04T15:36:51Z

Alternative take on #741 // cc: @eric-michel -- this is a first draft, and the code should be reasonably intelligible, but I let Copilot generate the following summary:

This pull request introduces a more flexible and extensible approach to configuring authentication code lengths and auto-submit behavior across all two-factor authentication providers. It centralizes code length logic, adds new filters for customization, and ensures that UI elements reflect these dynamic settings.

Key changes include:

Core logic improvements

Added a new static method get_code_length to Two_Factor_Provider, with a corresponding two_factor_code_length filter, allowing the default code length to be set for all providers in a consistent way.
Updated the get_code method in Two_Factor_Provider to use the new get_code_length method when no length is specified, making code generation more flexible and consistent.

Provider-specific enhancements

Modified backup codes and email providers to use get_code_length for determining code/token length, and updated their filters to use the new centralized logic. [1] [2]
Introduced the two_factor_autosubmit_length filter to allow customization of the input length at which authentication forms auto-submit, and applied this filter in backup code, email, and TOTP provider authentication screens. [1] [2] [3]
Ensured that the data-digits attribute in TOTP provider input fields accurately reflects the filtered code length, improving UI consistency.

User interface and documentation

Improved the JavaScript handling of expected input length by parsing the data-digits attribute as an integer, ensuring correct behavior with dynamic code lengths.
Updated readme.txt to document the new two_factor_code_length and two_factor_autosubmit_length filters for developers.

Introduce provider-wide code length controls and an autosubmit length filter. - Add Two_Factor_Provider::get_code_length() and update get_code() to accept a null length and fall back to the provider-specific length. Providers can now use two_factor_code_length to customize default code lengths per provider. - Use self::get_code_length() in backup-codes and email providers so their default token/backup lengths are filterable. - Add two_factor_autosubmit_length filter and apply it in backup-codes, email and TOTP providers to control the data-digits attribute (setting it to 0 disables autosubmit). - Update readme.txt to document the new two_factor_code_length and two_factor_autosubmit_length filters. - Minor whitespace cleanups in TOTP packing code. These changes centralize code-length behavior across providers and make the client-side autosubmit behavior configurable.

Ensure the expectedLength value is treated as a number by parsing inputEl.dataset.digits with parseInt(..., 10). This prevents string-based comparisons or unexpected behavior when dataset values are present (or missing), while preserving the optional chaining and defaulting to 0.

github-actions · 2026-03-04T15:37:05Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @Copilot.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: Copilot.

Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

georgestephanis · 2026-03-04T15:37:37Z

To be clear, I may be overcomplicating something that provides a simpler API in the prior PR. This take just makes more sense to my brain, for what little that's worth.

Copilot

Pull request overview

This PR introduces a more flexible and extensible approach to configuring authentication code lengths and auto-submit behavior. It adds a centralized get_code_length() method in Two_Factor_Provider that applies a new two_factor_code_length filter as the base default for all providers, and a new two_factor_autosubmit_length filter that controls the data-digits attribute used by the JavaScript to determine when to auto-submit the authentication form.

Changes:

Added get_code_length() static method to Two_Factor_Provider with a two_factor_code_length filter, and updated get_code() to use it when no length is specified
Added two_factor_autosubmit_length filter applied in backup codes, email, and TOTP authentication_page methods to independently control the auto-submit threshold; updated data-digits output accordingly
Improved JS robustness by parsing data-digits as an integer with parseInt() in class-two-factor-core.php

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`providers/class-two-factor-provider.php`	Adds `get_code_length()` method with `two_factor_code_length` filter; changes `get_code()` default length from `8` to `null` (resolves via `get_code_length()`)
`providers/class-two-factor-backup-codes.php`	Uses `get_code_length()` as default for `two_factor_backup_code_length`; adds `two_factor_autosubmit_length` filter in `authentication_page`
`providers/class-two-factor-email.php`	Uses `get_code_length()` as default for `two_factor_email_token_length`; adds `two_factor_autosubmit_length` filter in `authentication_page`
`providers/class-two-factor-totp.php`	Adds `two_factor_autosubmit_length` filter in `authentication_page`; updates `data-digits` from hardcoded constant to filtered value; minor whitespace cleanup
`class-two-factor-core.php`	Parses `data-digits` dataset attribute with `parseInt()` for more reliable JS numeric comparison
`readme.txt`	Documents new `two_factor_code_length` and `two_factor_autosubmit_length` filter hooks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

providers/class-two-factor-provider.php

providers/class-two-factor-backup-codes.php

readme.txt

providers/class-two-factor-provider.php

providers/class-two-factor-email.php

providers/class-two-factor-backup-codes.php

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot · 2026-03-04T15:50:20Z

@georgestephanis I've opened a new pull request, #821, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Initial plan * Add test coverage for get_code_length() and two_factor_autosubmit_length filter Co-authored-by: georgestephanis <941023+georgestephanis@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: georgestephanis <941023+georgestephanis@users.noreply.github.com>

eric-michel · 2026-03-05T16:47:57Z

I definitely support bringing some consistency to how the code lengths are retrieved for different providers. I noticed the same issue when I was working on my PR, but decided not to try and address that issue to keep the scope small (and because I don't have enough experience with this repo to know if there was a reason for the differences). So if there's support for bigger change I'm definitely all for it.

Having said that, I don't see the value in setting the number of digits for auto submission rather than a simple true/false value (and the corresponding hook names). Any value other than the code length or 0 will result in auto submission at the wrong time. Do you see other applications for altering the number other than simply turning auto submission off?

masteradhoc

@georgestephanis we have to update the version number of filters here

masteradhoc · 2026-03-19T19:55:17Z

providers/class-two-factor-backup-codes.php

+		 *
+		 * To disable autosubmit, set the digits to `0` via the core method `__return_zero`.
+		 *
+		 * @since 0.?.0


Suggested change

* @since 0.?.0

* @since 0.16.0

masteradhoc · 2026-03-19T19:58:47Z

providers/class-two-factor-provider.php

+	/**
+	 * Get the code length for a provider.
+	 *
+	 * @since 0.?.0


Suggested change

* @since 0.?.0

* @since 0.16.0

masteradhoc · 2026-03-19T19:58:58Z

providers/class-two-factor-provider.php

+		/**
+		 * Filter the default code length for a provider.
+		 *
+		 * @since 0.?.0


Suggested change

* @since 0.?.0

* @since 0.16.0

masteradhoc · 2026-03-19T20:22:03Z

providers/class-two-factor-totp.php

 		<p>
 			<label for="authcode"><?php esc_html_e( 'Authentication Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( self::DEFAULT_DIGIT_COUNT ); ?>" />
+			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />


Suggested change

<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />

<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( substr( '1234567890', 0, $code_length ) ); ?>" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />

I think we probably should work a bit on the placeholder as well. the space in between 3 and 4 doesnt make sense. additionally based on the code_length we could also generate this also dynamically.

BTW the spacing after entering the numbers manually i dont feel its a great UX - what do you think?:

two-factor/providers/js/two-factor-login-authcode.js

Lines 16 to 21 in cbc73d5

if ( ! spaceInserted && expectedLength && value.length === Math.floor( expectedLength / 2 ) ) {

value += ' ';

spaceInserted = true;

} else if ( spaceInserted && ! this.value ) {

spaceInserted = false;

}

georgestephanis added 2 commits March 4, 2026 10:29

georgestephanis requested review from Copilot and masteradhoc March 4, 2026 15:36

georgestephanis self-assigned this Mar 4, 2026

Copilot started reviewing on behalf of georgestephanis March 4, 2026 15:37 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Update readme.txt

23b8907

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI mentioned this pull request Mar 4, 2026

Add test coverage for get_code_length() and autosubmit filters #821

Merged

georgestephanis and others added 4 commits March 4, 2026 10:50

Update providers/class-two-factor-provider.php

698c7a5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update providers/class-two-factor-email.php

e9b935d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update providers/class-two-factor-backup-codes.php

4659913

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

masteradhoc requested a review from kasparsd March 11, 2026 20:35

masteradhoc added this to the 0.16.0 milestone Mar 11, 2026

masteradhoc reviewed Mar 19, 2026

View reviewed changes

	<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />
	<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( substr( '1234567890', 0, $code_length ) ); ?>" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />

	if ( ! spaceInserted && expectedLength && value.length === Math.floor( expectedLength / 2 ) ) {
	value += ' ';
	spaceInserted = true;
	} else if ( spaceInserted && ! this.value ) {
	spaceInserted = false;
	}

Conversation

georgestephanis commented Mar 4, 2026

Core logic improvements

Provider-specific enhancements

User interface and documentation

Uh oh!

github-actions bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unlinked Accounts

Uh oh!

georgestephanis commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

eric-michel commented Mar 5, 2026

Uh oh!

masteradhoc left a comment

Choose a reason for hiding this comment

Uh oh!

masteradhoc Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Mar 4, 2026 •

edited

Loading

masteradhoc Mar 19, 2026 •

edited

Loading