This is a security update. All users of the Disable Login module are strongly encouraged to update.
This release improves how the module enforces access restrictions on user authentication routes. The module is intended to prevent user logins, but in some configurations, not all login endpoints received the correct access checks. This update ensures that access control is consistently applied across all login-related routes, including programmatic authentication paths.
Changes in this release:
Added missing access requirement to specific login routes.
Ensured consistent application of the module’s access check across all authentication entry points.
General security hardening to maintain expected login-blocking behavior.
No configuration changes are required.
Updating the module code is sufficient.