ZT 2FA Shield for Admin

Version 2.2 14-10-2026 (02:32 PM) Latest

Implemented 2

Backup Code Regeneration Security Modal: Added an interactive security authorization modal window that safeguards the backup code regeneration process with instant 2FA authentication.
4-Column Cryptographic License Grid: Introduced a responsive 4-column license details card displaying Order ID, Order Email, Authorized Domain, and Expiry Date with dedicated vector icons.

Improved 2

Dynamic In-Page Security Feedback: Automatically updates the remaining backup codes counter and reveals fresh codes with one-click clipboard copy and text download without page reload.
OpenCart Base URL Safe Navigation: Hardened license activation redirects and tab state switching to prevent accidental session logouts caused by OpenCart's core <base href> handling.

Fixed 2

Startup Controller Route Interception: Resolved authentication bypass across OpenCart 3.0.3.8 through 3.0.4.0 startup controllers to ensure seamless 2FA login verification prompts.
Class Namespace Compatibility: Added backward-compatible library aliases ensuring flawless TOTP engine initialization across different module versions.

Security 2

Mandatory 2FA Gate for Rescue Codes: Completely eliminated unauthorized backup code harvesting from unattended admin terminals by requiring active 6-digit TOTP or emergency backup code validation.
Strict Server-Side Key Generation Guards: Locked the backend code generation API behind cryptographic session and token verification, rejecting any unauthenticated requests.

Version 2.1 09-10-2026 (12:28 AM)

Implemented 2

VIP Top-Priority Module Placement: Automatically elevates ZT 2FA Shield to the very top position of the OpenCart module list for immediate, effortless one-click access.
Signature Visual Branding: Enhances the module title with bold signature navy styling and a dedicated cube icon, making it instantly recognizable in the extensions catalog.

Improved 2

Zero-Interference Store Isolation: Engineered strict pinpoint targeting that matches only this extension, guaranteeing all other store modules remain completely untouched in original order and styling.
Production Archive Packaging: Rebuilt clean, streamlined installation archive formatted for instant compatibility with OpenCart's native extension installer.

Fixed 1

XML Modification Tag Encapsulation: Enclosed all template markup and injection logic safely within standard character data blocks, eliminating modification compilation warnings.

Security 1

Strict Identity Route Validation: Enforced exact dual verification against module route and heading title to prevent false-positive matching or accidental alterations to other installed extensions.

Version 2.0 07-10-2026 (06:55 PM)

Implemented 5

About and Support Tab: Built dedicated administrative dashboard tab featuring direct WhatsApp support, Telegram support, and official developer resources.
Technical Specifications Grid: Added clean system environment display detailing OpenCart platform compatibility, native architecture, and PHP runtime support.
Save and Stay Workflow: Introduced dual action buttons (Save & Stay and Save & Exit) allowing administrators to save configurations while remaining on the active screen.
Emergency Self-Destruct Recovery Script: Engineered standalone recovery script with dual security gates, one-click 2FA reset, and automated file self-destruction.
Standalone In-Memory 2FA Testing Tool: Created browser-based ephemeral authenticator application for testing TOTP codes in memory without cluttering physical devices.

Improved 4

Unified 2FA Reset Confirmation Modal: Standardized user profile deactivation popup to match the amber authorization dialog with 6-digit PIN inputs and backup code switching.
Streamlined Navigation Layout: Relocated self-service 2FA shortcut into the module card banner directly adjacent to the Dark Mode toggle to prevent toolbar clutter.
Clean Administrative Footer Branding: Refined admin footer display to present a minimalist creator signature with animated pulsing heart.
Database Settings Sanitation: Automatically filtered out temporary interface control parameters before saving module settings to prevent database pollution.

Fixed 3

Startup Login Interception Lifecycle: Adjusted startup controller hook order to execute strictly after user session initialization, preventing null object exceptions.
Modal Display Class Synchronization: Corrected backdrop and dialog class transitions to ensure smooth popup appearance and automatic first-digit input focus.
Recovery Script Path Resolution: Fixed configuration loader path resolution in the emergency reset utility.

Security 4

OpenCart 3.0.5.1 Session Validation: Hardened all administrative AJAX endpoints with active user session checks to prevent unauthenticated execution.
Dual Password Encoding Verification: Implemented dual-layer password authentication supporting both modern entity-decoded and raw password hashing standards.
Protected Staff 2FA Reset Authorization: Guarded administrative staff resets behind mandatory master 2FA authorization or account password verification.
Legacy PHP Randomness Polyfill: Added backward-compatible fallback for cryptographic randomness ensuring safe execution across PHP 5.4 through PHP 8.5.

Version 1.0 07-10-2026 (03:09 AM) Initial Release

Implemented 7

RFC 6238 TOTP Engine: Pure-PHP time-based one-time password generation and validation with drift tolerance, requiring zero external dependencies.
Vector QR Code Generator: Native SVG QR code generation rendering crisp vector graphics directly in the browser with high offline privacy.
Emergency Rescue Codes: Generation and verification of 10 cryptographically hashed single-use backup codes with one-click copy and .txt file export.
Self-Service 2FA Activation Wizard: Guided two-step setup interface for administrators with real-time verification and secret key formatting.
Zero-Friction 6-Digit PIN Inputs: Specialized multi-box input controller with automatic cursor advancement, backspace navigation, and paste distribution.
Automated Login Interception: Seamless OCMOD interception requiring 2FA verification immediately after valid password authentication before granting dashboard access.
Security Audit Logging System: Complete audit trail tracking authentication successes, failed attempts, backup code usage, resets, and configuration modifications.

Improved 5

Trending Creator Signature: Added sleek "Made with ❤️ by Zaintech Technologies" signature with animated pulsing heart and verified external link to https://www.zaintech.pk.
Adaptive Light & Dark Theme System: Clean Light Mode default conforming to OpenCart admin aesthetics, paired with an optional high-contrast Dark Mode toggle.
Modern Modal Confirmation Dialogs: Replaced standard browser confirm popups with responsive, glassmorphic modal dialogs with smooth entrance animations.
Non-Blocking Toast Notification Center: Smooth floating toast notifications delivering instant real-time feedback with tailored status colors.
Optional Left Sidebar Navigation: Flexible configuration toggle allowing administrators to show or hide the module shortcut under OpenCart's System menu.

Fixed 4

QR Code Rendering Reliability: Resolved external QR image loading failures by embedding an ultra-fast, offline vector SVG renderer.
Network Validation Error Handling: Corrected AJAX response parsing during secret verification to deliver clear, actionable diagnostic toasts.
Audit Log Modal Interface: Replaced browser popups for log clearance actions with styled in-app confirmation dialogs.
Font Awesome Icon Mismatches: Standardized all icon classes across templates to prevent broken glyphs on varying OpenCart installations.

Security 4

Mandatory 2FA Authorization for Deactivation: Closed unlocked terminal security risks by requiring valid 6-digit TOTP authorization or emergency backup codes before disabling 2FA.
Server-Side Controller Enforcement: Fortified backend API endpoints to reject any deactivation attempts lacking cryptographically validated credentials.
Brute-Force Lockout Defense: Configurable maximum attempt thresholds and IP/account lockout timers to block automated credential attacks.
Strict Session Quarantine: Safeguarded intermediate login states to prevent unauthorized URL manipulation prior to successful second-factor validation.