[XTR] SMS Verification 1.0.6

[XTR] SMS Verification is an enterprise-grade, SMS-based phone verification and security add-on built natively on top of XenForo 2.3, fully compliant with XenForo's core architecture. Its primary purpose is to prevent fake account creation, block bot registrations, strengthen account security, and systematically manage member phone numbers.

This add-on goes far beyond simple registration verification. It delivers a comprehensive SMS management solution covering login security (Two-Factor Authentication – 2FA), password reset, phone number change/removal, bulk SMS broadcasting, member phone display, and much more.

The add-on is written entirely to XenForo 2.3 standards: no jQuery is used anywhere, all JavaScript is written in vanilla JS using XF Helper API; PHP 8.0+ is required; it is fully compatible with Symfony Mailer and Symfony Cache. It integrates tightly with XenForo's permission system, user group system, IP logging, alert (notification) system, and options infrastructure.

---

Supported SMS Providers (9 Total)

The add-on ships with a flexible provider architecture supporting leading Turkish domestic SMS services as well as widely used global platforms. Each provider is independently configurable through the Admin Control Panel and can be toggled active/inactive at any time.

Turkish (Domestic) SMS Providers:

• VatanSMS (vatansms.net) — JSON REST API
  Integrates with the modern REST JSON API of VatanSMS, one of Turkey's leading bulk SMS platforms. Configured with API ID, API Key, and Sender ID. Every request is sent with message type "bilgi" (informational).
• VatanSMS.com (vatansms.com) — XML POST API
  Integrates with the XML POST-based API of VatanSMS's second platform, vatansms.com. Configured with username, password, customer number (KNO), and sender ID. The XML body is securely built and posted to the VatanSMS panel endpoint.
• NetGSM (netgsm.com.tr)
  Integrates with the REST GET API of NetGSM, one of Turkey's most established SMS infrastructure providers. Configured with username, password, and a message header. Turkish character support is automatically enabled via the dil=TR parameter.
• MutluCell (mutlucell.com)
  Integrates with MutluCELL's XML-based bulk SMS API. Configured with username, password, and originator. Message content is safely embedded in a CDATA block.
• KaynakSMS (kaynaksms.com)
  Integrates with KaynakSMS's form-data POST API. Configured with username, password, user code, and sender ID.
• İletiMerkezi (iletimerkezi.com)
  Integrates with İletiMerkezi's JSON API, one of Turkey's leading corporate SMS providers. Configured with an API Key, API Hash, and sender ID.

Global (International) SMS Providers:

• Twilio
  Integrates with the REST API of Twilio, the world's most widely used cloud communications platform. Configured with Account SID, Auth Token, and From Number. Phone numbers are automatically normalized to E.164 format (+XXXXX).
• BulkSMS (bulksms.com)
  Integrates with the REST API of global bulk SMS service BulkSMS. Authentication is performed via HTTP Basic Auth with username and password. E.164 number format is automatically supported.
• SendPulse
  Integrates with the SendPulse SMS API which uses OAuth 2.0-based authentication. An access token is first obtained using the API ID and API Secret, then the SMS is dispatched. This two-step process ensures maximum security.

Each provider can be configured independently from the Admin panel, toggled active/inactive, and all API connection errors are recorded in XenForo's standard error log system.

Click to expand...

---

Member-Facing Features (Public)

1. SMS Verification at Registration

When a new member registers, they must enter a phone number and then confirm the SMS code sent to that number before their account becomes active. This completely blocks bot registrations and fake account creation.

The verification flow consists of the following steps:

1. The member enters their phone number (submitted with country code in E.164 format).
2. Optionally, an SMS terms and rules text is displayed; the member cannot proceed without acceptance.
3. Optionally, the member chooses whether to receive board news via SMS.
4. The member clicks "Send Code"; the active SMS provider delivers a code-containing SMS.
5. The member enters the received code; upon correct entry, verification is complete.
6. After successful verification, the account is activated and, if configured, the member is automatically added to the designated user group.

2. SMS Management in Account Panel (/account/sms-verification)

After logging in, members can go to Account Details > SMS Verification to manage the following settings:

• Add / Change Phone Number: Members can update their phone number. During the change, an SMS code is sent to the new number and saved only after verification. Admins can configure how frequently a member can change their number (0 to 365 days).
• Remove Phone Number: If enabled by the admin, members can permanently remove their phone number from their profile. The account state is updated, the timed group assignment is revoked, and the action is logged with the member's IP address.
• Board News SMS Notifications: Members can update their preference for receiving forum news via SMS.
• Hide Phone Number: Members can choose whether their phone number is visible to others on their member profile.
• Terms and Rules Acceptance: Members can accept the SMS terms and rules on this page.

3. SMS Quick Login (/login/sms-login)

When enabled by the admin, members can log in using only their phone number and an SMS code, without needing a password. This is a major convenience for members who forget passwords or prefer passwordless logins. The login flow is: the member enters their phone number, receives an SMS code, and logs in by entering the code.

4. Password Reset via SMS

When enabled by the admin, members can request an SMS-based password reset code on the "Forgot Password" page using their phone number. This offers a secure alternative to email-based password resets.

5. Two-Factor Authentication (2FA) — SMS Method

When enabled by the admin, members can select "SMS" as their Two-Factor Authentication method from their account security tab. When logging in, a 2FA code is automatically sent to their registered phone number. Members must enter this code to complete login. The 2FA code length (4-8 digits) and expiry time (60-3600 seconds) are independently configurable.

---

Admin Control Panel (Admin CP) Features

1. Provider Management (/admin.php?xentr-sms-providers)

All supported SMS providers are listed from the Admin panel. New providers can be added, existing ones edited or deleted. Each provider has an active/inactive toggle. Only the provider marked as active is used for sending SMS, enabling seamless provider switching.

2. SMS Delivery Logs (/admin.php?xentr-sms-logs)

All SMS messages sent by the system are logged in detail. Log records include:

• The sending user (user_id and username)
• Phone number
• Message type (verification, tfa, password_reset, bulk_sms, phone_change, phone_remove, etc.)
• Delivery status (success / failed)
• Date and time of delivery
• IP address used for the request
• Provider response (including API error messages)

Logs are paginated (20 per page), individual records can be viewed and deleted. The log retention period is configurable by the admin (0 to 365 days); old logs are automatically purged via a cron job.

3. Bulk SMS Sending

Admins can broadcast SMS messages to members from the Admin panel. This function integrates with XenForo's criteria-based user selection system, enabling bulk SMS to specific user groups, members meeting specific criteria, or members within a particular registration date range. The bulk sending job runs via XenForo's background job queue (Job Queue), ensuring no server strain even when sending to large audiences.

Dynamic variables are supported in the message body:

• {name} — Member username
• {id} — Member user ID

4. Phone Number Display on Member Profiles

If the admin enables the "Show phone number in member list" option, phone numbers are visible on member profile pages and in the member list. Members can hide their own number using the "Hide My Phone Number" option.

5. Phone Change Admin Notifications

Through the Admin CP, one or more staff usernames can be added to the "Phone changes alert recipients" field. Whenever a member changes or removes their phone number, the designated administrators are instantly notified via XenForo's standard alert (notification) system — directly in their notification bell.

---

Security & Flood Control System

This add-on features a multi-layered security architecture to combat spam and abuse:

• Daily SMS Limit: The maximum number of SMS messages that can be sent per IP address or user ID within 24 hours is configurable (0-100). When the limit is reached, the system automatically blocks further SMS sending.
• Maximum Verification Attempt Limit: The number of incorrect code entries allowed per verification code is configurable (1-10). Once the limit is reached, the code is invalidated.
• Maximum Resend Limit: The number of times the same verification code can be resent is configurable (1-10).
• Resend Delay: The minimum wait time (in seconds) before requesting a new code is configurable (30-600 seconds).
• Code Expiry Time: The duration (in seconds) a sent verification code remains valid is configurable (60-3600 seconds). Expired codes are automatically deleted.
• CAPTCHA Integration: XenForo's standard CAPTCHA system can optionally be added to the SMS send form.
• IP Logging: All phone number add, change, and removal actions are recorded in XenForo's standard IP log system along with the user's IP address.
• Limit Bypass Permission: A dedicated "Bypass SMS limits" permission can be granted to trusted members or administrators, exempting them from all rate limiting restrictions.

---

User Group Integration

Members who successfully verify their phone number are automatically added to the user group designated by the admin. With this feature:

• Verified members can be granted exclusive access to forum sections or the ability to create threads/reply.
• A "verified members only" rule can easily be enforced by making verification mandatory.
• When a member removes their number, their group assignment is automatically revoked.

---

Content Restriction Features

The add-on provides the ability to restrict forum activities for members who have not verified their phone numbers:

• Thread Creation Restriction: Only verified members can start threads in specified forum categories.
• Reply Restriction: Only verified members can post replies in specified forum categories.
• Conversation (DM) Restriction: Only verified members can send private messages.
• Signature Restriction: Only verified members can create or edit their signature.

---

Verified Member Badge

Members who verify their phone number can display a special badge on their profile, member card, and message post bit. The badge is fully customizable:

• The badge can be enabled or disabled.
• Any icon from the Font Awesome SVG sprite system can be selected (e.g., a checkmark badge).
• The badge color is set with a hex color code.

---

Security Architecture Details

All critical security layers of this add-on are built on XenForo's core mechanisms:

• All API credentials (SMS provider details) are stored in the database protected by XenForo's admin panel access control (option permission).
• Verification codes are generated using the cryptographically secure random_int() function.
• Code matching uses hash_equals() to prevent timing attacks.
• When phone numbers are removed from profiles, data is cleanly purged.
• All actions are tracked via XenForo's IP logging system.
• All form inputs are validated through XenForo's standard filter() mechanism.
• SMS provider API requests are safely managed with http_errors => false; exceptions are recorded in XenForo's error log system.

---

• 9 SMS Provider Integrations — VatanSMS (JSON), VatanSMS.com (XML), NetGSM, MutluCell, KaynakSMS, İletiMerkezi, Twilio, BulkSMS, SendPulse
• SMS Verification at Registration — Blocks fake accounts and bot registrations
• Two-Factor Authentication (2FA) — SMS-based secure secondary login layer
• SMS Quick Login — Passwordless login with phone number + SMS code
• Password Reset via SMS — Secure alternative to email-based password resets
• Phone Number Add / Change — Members can update their own phone number
• Phone Number Removal — Members can remove their number if permitted
• Provider Management Panel — Each provider is individually configurable with active/inactive toggle
• Detailed SMS Log System — All deliveries logged: user, number, type, date, IP, provider response
• Bulk SMS Broadcasting — Criteria-based member selection, delivered via background job queue
• Automatic User Group Assignment — Member is auto-assigned to a group upon verification
• Thread / Reply / DM / Signature Restrictions — Content restrictions for unverified members
• Verified Member Badge — Customizable icon and color badge on profiles
• Phone Number Privacy Toggle — Members can hide their number from profiles
• Daily SMS Limit — Per-IP and per-user daily SMS rate limiting
• Resend Limit & Delay — Multi-layer flood control
• Maximum Failed Attempt Limit — Brute force attack protection
• Configurable Code Length (4-10 digits) — For both verification and 2FA codes
• Configurable Code Expiry Time — Between 60 and 3600 seconds
• CAPTCHA Integration — Additional bot protection at the form level
• Terms & Rules Acceptance Flow — Usage terms confirmation before SMS
• Phone Change Frequency Control — 0 to 365 day change interval
• Board News SMS Preference Management — Member's opt-in/out preference persisted
• IP Logging — All actions recorded with IP address
• Limit Bypass Permission — Exempts trusted members from all rate limits
• Phone Change Admin Alert — Instant notification to designated staff on number change
• Phone Display on Member Profiles — Phone number visible in member list/profiles
• Full XenForo 2.3 Architecture Compliance — Vanilla JS, PHP 8.0+, Symfony-compatible
• Automatic Log Cleanup (Cron) — Logs older than configured period auto-purged
• Multi-Language Support — All text strings fully translatable via phrase system