NewLogin

Changelog

Highlights

This release focuses on making the project reproducible, improving account security, fixing email recovery, and cleaning up legacy configuration behavior.

Added

* Added a fully reproducible project structure, including pom.xml, src/main/java, resources, README, LICENSE, CHANGELOG, and CI setup. Added versioned password hashing using PBKDF2-HMAC-SHA256*. * Added unique salts, safe password comparison, and automatic migration from legacy SHA-256 password hashes. * Added real SMTP email delivery with TLS/STARTTLS, authentication, UTF-8 HTML support, timeouts, a dedicated executor, and reload support. * Added recovery-code expiration, maximum attempt limits, and cooldowns per player/IP. * Added schema-version support to persisted data. * Added automatic backups before destructive data operations. * Added UUID/IP-based lockout protection. * Added blindness effect support for pre-login protection.

Changed

* Updated /email confirm to correctly use args[1]. * Email recovery is now allowed before login. * Recovery codes now use SecureRandom. * Password recovery no longer sends or stores temporary plain-text passwords. * Players now set a new password directly using:

/email confirm <code> <new-password> <confirm-password>

or:

/resetpassword own ...

* Pre-login command protection now uses exact command matching. * Player visibility and effects are now properly cleaned up on quit and plugin disable. * DataManager.java now properly removes players.<uuid> entries and saves a clean data snapshot.

Removed

* Removed the plain-text temporary password recovery flow. * Removed MySQL and captcha settings from the default configuration. * Legacy captcha settings are now automatically disabled if found in old configuration files.

Fixed

* Fixed destructive persistence operations not fully removing player data. * Fixed stale or unsafe recovery behavior from the old password reset flow. * Fixed legacy configuration compatibility issues by enforcing valid YAML handling.

Major Release - Complete Security Update

Release Date: January 2026 Minecraft Version: 1.21+ Java Version: 21 ---

New Commands

| Command | Description | Permission | |---------|-------------|------------| | /logout | Manual logout for players | - | | /unregister <player> [--confirm] | Remove a player's registration (admin) | newlogin.unregister | | /newlogin | Administrative commands | newlogin.admin | | /email | Email management for password recovery | - | ---

Admin Commands (/newlogin)

- `reload` - Reload plugin configuration - `info <player>` - Show detailed player information - `list [page]` - List all registered players (paginated) - `stats` - Show plugin statistics - `forcelogin <player>` - Force login a player - `forcelogout <player>` - Force logout a player - `setspawn` - Set the login spawn location - `help` - Display help menu ---

Email System (/email)

- `set <email>` - Set your email address - `remove` - Remove your email - `show` - Display your current email - `recover <email>` - Request password recovery - `confirm <code>` - Confirm email or recovery code ---

New Security Features

- Damage Protection - Players cannot receive damage before login - Hunger Protection - Hunger bar doesn't decrease before login - Inventory Protection - Cannot open inventories before login - Item Pickup Protection - Cannot pick up items before login - Block Protection - Cannot break/place blocks before login - Entity Interaction Protection - Cannot interact with entities before login - Item Swap Protection - Cannot swap hand items before login ---

Login Spawn System

- Teleport unlogged players to a specific location - Automatically restore original location after login - Configurable via /newlogin setspawn or config.yml

/dev/null/config.yml#L1-L8
login-spawn:
  enabled: false
  world: "world"
  x: 0.0
  y: 64.0
  z: 0.0
  yaw: 0.0
  pitch: 0.0

---

Invisibility System

- Players become invisible until they login - Hidden from other players completely - Invisibility potion effect applied automatically - Configurable in config.yml ---

New Aliases

| Command | Aliases | |---------|---------| | /login | /l | | /register | /reg | | /changepassword | /changepass, /mudarsenha | | /resetpassword | /resetpass | | /logout | /sair | | /newlogin | /nl, /nlogin | | /email | /mail | ---

Tab Completion

- Full tab completion support for all commands - Smart suggestions for player names - Permission-aware completions ---

New Player Data Tracking

- Login Count - Track total logins per player - Last IP - Store last known IP address - Registration Date - When player registered - Last Login - Last successful login timestamp ---

New Permissions

/dev/null/permissions.yml#L1-L25
newlogin.*                    - Access to all commands
newlogin.admin                - Admin commands access
newlogin.admin.reload         - Reload configuration
newlogin.admin.info           - View player info
newlogin.admin.list           - List registered players
newlogin.admin.stats          - View statistics
newlogin.admin.forcelogin     - Force player login
newlogin.admin.forcelogout    - Force player logout
newlogin.admin.setspawn       - Set login spawn
newlogin.resetpassword        - Reset player passwords
newlogin.unregister           - Unregister players
newlogin.bypass.timeout       - Bypass login timeout
newlogin.bypass.lockout       - Bypass attempt lockout

---

New Configuration Options

#### Login Protection

/dev/null/config.yml#L1-L6
login-protection:
  invisibility: false
  blindness: false
  no-damage: true
  no-hunger: true

#### Email System (SMTP)

/dev/null/config.yml#L1-L10
email:
  enabled: false
  smtp:
    host: "smtp.gmail.com"
    port: 587
    username: ""
    password: ""
    tls: true
  from: "[email protected]"

#### Logging

/dev/null/config.yml#L1-L5
logging:
  successful-logins: true
  failed-logins: true
  password-changes: true
  registrations: true

#### Allowed Commands Before Login

/dev/null/config.yml#L1-L4
security:
  allowed-commands:
    - "help"
    - "rules"

---

New Messages

/dev/null/messages.yml#L1-L15
auto-login-success: "&aSession restored! You were logged in automatically."
not-logged-in: "&cYou are not logged in!"
logout-success: "&aYou have been logged out successfully!"
login-timeout-kick: "&cLogin timeout! Please reconnect and login."
unregister-success: "&aPlayer {player} has been unregistered!"
unregistered-by-admin: "&cYour registration was removed by an administrator."
invalid-email: "&cInvalid email format!"
email-already-used: "&cThis email is already in use!"
email-confirmation-sent: "&aConfirmation email sent to {email}!"
email-set-success: "&aEmail set successfully: {email}"
recovery-email-sent: "&aRecovery email sent to {email}!"
invalid-code: "&cInvalid or expired code!"

---

Bug Fixes & Improvements

- Improved password hashing with SHA-256 + salt - Better session management - Fixed movement detection (allows camera rotation) - Improved lockout system with remaining time display - Better error handling and logging - Async data saving to prevent lag - Memory leak fixes in session cleanup

Security

SHA-256 Hash with Salt*: Implemented secure hashing system with a unique salt per player Brute Force Protection*: Temporary lockout system after multiple failed attempts * Configurable: max attempts and lockout duration * Informative messages for blocked players Password Validation*: Configurable minimum requirements * Minimum password length * Uppercase letter requirement * Number requirement * Special character requirement

New Features

Advanced Session System* * IP-based auto-login (configurable) * Configurable session timeout * Last activity tracking * Automatic cleanup of expired sessions Configuration Manager* * Complete and organized config.yml file * All messages customizable * Adjustable security settings * Flexible session configurations Full Pre-Login Protection* * Movement blocking * Chat blocking * Command blocking (except login/register) * Interaction blocking with blocks and entities * Damage blocking * Item drop blocking

Improvements

LoginManager* * Automatic migration of old passwords to the new hashing system * Password strength check * Improved login attempt system PlayerManager* * Integrated session management * Player activity tracking * Automatic data cleanup DataManager* * Support for new fields (salt, IP, timestamps) * Optimized asynchronous operations * Better error handling PlayerListener* * Comprehensive event protection * Configurable reminder messages * Improved user experience

Updated Commands

/register*: Enhanced password validation with detailed feedback /login*: Attempt system with temporary lockout /changepassword*: New password validation /resetpassword*: Still available for administrators

Configuration

config.yml*: New comprehensive configuration file * Security section (hashing, attempts, validation) * Session section (auto-login, timeout) * Protection section (blocked events) * Messages section (all customizable)

Bug Fixes

* Fixed insecure plain text password storage * Fixed missing protection against command spam * Fixed players being able to interact before logging in * Fixed missing session timeout

- /changepassword - /resetpassword (admin only) - bug fixes

- First version