Release 5.10.2.1

FIX: Changing notification options (SMTP server and SysLog options) was not always possible
FIX: SMSEagle v2 implementation was not always able to send to international countries
FIX: websocketCore.php was missing in the sources
ENH: Template updated to propose the free "multiOTP token app" by default for Android and iOS
ENH: Embedded Windows PHP edition updated to version 8.4.16 x64 (from 8.4.14 x86)
ENH: Embedded Windows nginx edition updated to version 1.29.6
ENH: Updated environment detection, like docker detection
ENH: Updated Linux helper, for the future new web interface
ENH: For Windows, WMIC dependencies has been removed and replaced by Powershell commands

Author: André Liechti

Dockerfile

@@ -15,8 +15,8 @@
 # Please check https://www\.multiOTP.net/ and you will find the magic button ;-)
 #
 # @author    Andre Liechti, SysCo systemes de communication sa, <[email protected]>
-# @version   5.10.1.2
-# @date      2026-01-05
+# @version   5.10.2.1
+# @date      2026-03-23
 # @since     2013-11-29
 # @copyright (c) 2013-2026 SysCo systemes de communication sa
 # @copyright GNU Lesser General Public License
@@ -43,8 +43,8 @@ LABEL org.opencontainers.image.title="multiOTP open source"
 LABEL org.opencontainers.image.description="multiOTP open source, running on Debian ${DEBIAN} with PHP${PHPVERSION}." \
       License="LGPL-3.0" \
       Usage="docker run -v [PATH/TO/MULTIOTP/DATA/VOLUME]:/etc/multiotp -v [PATH/TO/FREERADIUS/CONFIG/VOLUME]:/etc/freeradius -v [PATH/TO/MULTIOTP/LOG/VOLUME]:/var/log/multiotp -v [PATH/TO/FREERADIUS/LOG/VOLUME]:/var/log/freeradius -p [HOST WWW PORT NUMBER]:80 -p [HOST SSL PORT NUMBER]:443 -p [HOST RADIUS-AUTH PORT NUMBER]:1812/udp -p [HOST RADIUS-ACCNT PORT NUMBER]:1813/udp -d multiotp-open-source" \
-      Version="5.10.1.2"
-LABEL org.opencontainers.image.Version="5.10.1.2"
+      Version="5.10.2.1"
+LABEL org.opencontainers.image.Version="5.10.2.1"
 LABEL org.opencontainers.image.authors="Andre Liechti <[email protected]>"
 LABEL org.opencontainers.image.url="https://www.multiotp.net"
 LABEL org.opencontainers.image.source="https://github.com/multiOTP/multiotp"
@@ -120,7 +120,7 @@ COPY raspberry/boot-part/multiotp-tree /boot/multiotp-tree/
 WORKDIR /
 
 RUN chmod 777 /boot/*.sh && \
-    /boot/install.sh
+    /boot/install.sh RUNDOCKER
 
 EXPOSE 80/tcp 443/tcp 1812/udp 1813/udp
 

README.md

@@ -6,7 +6,7 @@ multiOTP open source is OATH certified for HOTP/TOTP
 (c) 2010-2026 SysCo systemes de communication sa  
 https://www.multiotp.net/
 
-Current build: 5.10.1.2 (2026-01-05)
+Current build: 5.10.2.1 (2026-03-23)
 
 Binary download: https://download.multiotp.net/ (including virtual appliance image, docker and full release notes)
 
@@ -22,7 +22,10 @@ PATH/TO/FREERADIUS/LOG/VOLUME:/var/log/freeradius
 
 The **multiotp/multiotp-open-source** docker is working on Synology devices !  
 
-Binary download of the multiOTP open source Credential Provider for Windows 7/8/8.1/10/11/2012(R2)/2016/2019/2022 : https://download.multiotp.net/credential-provider/
+It's strongly recommended to read the whole README file.  
+That said, if you're in a hurry: the default RADIUS secret for subnet 0.0.0.0/0 is `myfirstpass`.
+
+Binary download of the multiOTP open source Credential Provider for Windows 7/8/8.1/10/11/2012(R2)/2016/2019/2022/2025 : https://download.multiotp.net/credential-provider/
 
 [![Donate via PayPal](https://img.shields.io/badge/donate-paypal-87ceeb.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=USD&[email protected]&item_name=Donation%20for%20multiOTP%20project)
 *Please consider supporting this project by making a donation via [PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=USD&[email protected]&item_name=Donation%20for%20multiOTP%20project)*
@@ -47,13 +50,21 @@ appliances including more features like:
  - Full Web GUI interface
  - Automated provisioning of new account (based on Active Directory)
  - High Availability master-slave support (Enterprise Edition)
+ - Push token using free multiOTP token App (Enterprise Edition)
  - Web API support (Enterprise Edition)
  - free virtual appliances available, including a free lifetime one user licence
  - online demo of the full Web GUI interface
  - ...
 
 
 The multiOTP class supports currently the following algorithms and RFC's:
+- OATH/HOTP or OATH/TOTP, base32/hex/raw seed, QRcode provisioning
+  (multiOTP token App, FreeOTP, Google Authenticator, ...)
+- Yubico OTP (http://yubico.com/yubikey)
+- mOTP (http://motp.sourceforge.net)
+- SMS tokens (using Afilnet, aspsms, Clickatell, eCall, IntelliSMS, Nexmo, NowSMS,
+  SMSEagle, SMSGateway, Spryng, Swisscom, Telnyx, any custom provider, your own script)
+- TAN (emergency scratch passwords)
 - RFC1994 CHAP (Challenge Handshake Authentication Protocol)
 - RFC2433 MS-CHAP (Microsoft PPP CHAP Extensions)
 - RFC2487 SMTP Service Extension for Secure SMTP over TLS
@@ -63,13 +74,6 @@ The multiOTP class supports currently the following algorithms and RFC's:
 - RFC5424 Syslog Protocol (client)
 - RFC6030 PSKC (Additional Portable Symmetric Key Container Algorithm Profiles)
 - RFC6238 OATH/TOTP (TOTP: Time-Based One-Time Password Algorithm)
-- Yubico OTP (http://yubico.com/yubikey)
-- mOTP (http://motp.sourceforge.net)
-- OATH/HOTP or OATH/TOTP, base32/hex/raw seed, QRcode provisioning
-  (FreeOTP, Google Authenticator, ...)
-- SMS tokens (using Afilnet, aspsms, Clickatell, eCall, IntelliSMS, Nexmo, NowSMS,
-  SMSEagle, SMSGateway, Spryng, Swisscom, Telnyx, any custom provider, your own script)
-- TAN (emergency scratch passwords)
 
 This package was initially published here : http://syscoal.users.phpclasses.org/package/6373.html
 For more PHP classes, have a look on [PHPclasses.org](http://syscoal.users.phpclasses.org/browse/), where a lot of authors are sharing their classes for free.
@@ -155,6 +159,16 @@ WHAT'S NEW IN THIS 5.10.x RELEASE
 CHANGE LOG OF RELEASED VERSIONS
 ===============================
 ```
+2026-03-23 5.10.2.1 FIX: Changing notification options (SMTP server and SysLog options) was not always possible
+                    FIX: SMSEagle v2 implementation was not always able to send to international countries
+                    FIX: websocketCore.php was missing in the sources
+                    ENH: Template updated to propose the free "multiOTP token app" by default for Android and iOS
+                    ENH: Embedded Windows PHP edition updated to version 8.4.16 x64 (from 8.4.14 x86)
+                    ENH: Embedded Windows nginx edition updated to version 1.29.6
+                    ENH: Updated environment detection, like docker detection
+                    ENH: Updated Linux helper, for the future new web interface
+                    ENH: For Windows, WMIC dependencies has been removed and replaced by Powershell commands
+2026-01-23 5.10.1.5 ENH: For Docker installation, configuration files are copied automatically in the external volumes if missing
 2026-01-05 5.10.1.2 FIX: Locked and delayed status handled before push status
 2025-12-23 5.10.1.1 ENH: New SendEmail implementation with internal smtp stack (using smtp parameters)
                     ENH: Better Docker integration
@@ -932,6 +946,13 @@ Provisioning will be done simply by flashing a QRcode.
     - YubiKey Nano
     - YubiKey Neo
     - YubiKey Neo-N
+    
+The YubiKey CSV import is based on the .CSV created by the legacy Yubikey Personalization Tools, which is, the following lines in a file called for example **yubico_log.csv**:
+
+```
+LOGGING START,2025-05-04T03:02:01
+Yubico OTP,2025-05-04T03:02:01,1,vvcccdjkllvd,sde2c13f6a65,c6d293cbf190e4eb13f45b3913edea7b,,,0,0,0,0,0,0,0,0,0,0
+```
 
 If you want to use software tokens with Apps like Google Authenticator, you can
 create a QRcode provisioning in two EASY steps with the command line tool:
@@ -1969,7 +1990,7 @@ MULTIOTP COMMAND LINE TOOL
 ==========================
 
 ``` 
-multiOTP 5.10.1.2 (2026-01-05)
+multiOTP 5.10.2.1 (2026-03-23)
 (c) 2010-2026 SysCo systemes de communication sa
 http://www.multiOTP.net   (you can try the [Donate] button ;-)
 
@@ -2504,8 +2525,8 @@ Visit https://forum.multiotp.net/ for additional support
 ``` 
 
 ``` 
-Hash verification for multiotp_5.10.1.2.zip 
-SHA256:3e2cf1e4704695b30b823df1b3952614342c203a1260350a21bce699c79431fc 
-SHA1:b67317fd8bc32ba8e8f0d6cbae9005b673cc2ad2 
-MD5:c0e70540ccf2b8c6d48d822ba201840c 
+Hash verification for multiotp_5.10.2.1.zip 
+SHA256:61f69686dd814dcca83fbe03629f7db2979be89136ef4d26a714051fa24a99df 
+SHA1:755072a5aa8a909564a32ec184fbfd51427f5696 
+MD5:c1a63cd5d8ec69771c0854acf4301dd3 
 ``` 

check.multiotp.class.php

@@ -22,8 +22,8 @@
  * PHP 5.4.0 or higher is supported.
  *
  * @author    Andre Liechti, SysCo systemes de communication sa, <[email protected]>
- * @version   5.10.1.2
- * @date      2026-01-05
+ * @version   5.10.2.1
+ * @date      2026-03-23
  * @since     2013-07-10
  * @copyright (c) 2013-2026 SysCo systemes de communication sa
  * @copyright GNU Lesser General Public License

checkmultiotp.cmd

@@ -11,8 +11,8 @@ REM
 REM Windows batch file for Windows 2K/XP/2003/7/2008/8/2012/10/2019
 REM
 REM @author    Andre Liechti, SysCo systemes de communication sa, <[email protected]>
-REM @version   5.10.1.2
-REM @date      2026-01-05
+REM @version   5.10.2.1
+REM @date      2026-03-23
 REM @since     2010-07-10
 REM @copyright (c) 2010-2026 SysCo systemes de communication sa
 REM @copyright GNU Lesser General Public License

contrib/MultiotpSms.php

@@ -513,8 +513,8 @@ function setProvider(
         $this->encoding = "UTF";
         $this->status_success = "20";
         $this->content_success = "OK";
-        $this->no_double_zero = FALSE;
-        $this->international_format = FALSE;
+        $this->no_double_zero = TRUE;
+        $this->international_format = TRUE;
         $this->basic_auth = FALSE;
         $this->content_encoding = "";
         $this->header = "Content-Type: text/plain\r\n";
@@ -1029,6 +1029,11 @@ function sendSMS(
         $fp = @fsockopen($protocol.$host, $server_port, $errno, $errdesc, $this->timeout);
       }
 
+// DEBUG
+file_put_contents('sms_debug.log', "$url\n", FILE_APPEND);
+file_put_contents('sms_debug.log', "$payload\n", FILE_APPEND);
+
+
       if (FALSE !== $fp) {
         $info['timed_out'] = FALSE;
         $output = "";

contrib/MultiotpTools.php

@@ -4,8 +4,8 @@
  * Check PHP version and define version constant if needed
  *   (PHP_VERSION_ID is natively available only for PHP >= 5.2.7)
  ****************************************************************/
-if (!function_exists('constant_defined')) {
-  function constant_defined(
+if (!function_exists('defined')) {
+  function defined(
     $constant_name
   ) {
     $result = false;
@@ -20,17 +20,15 @@ function constant_defined(
 }
 
 
-if (!constant_defined('PHP_VERSION_ID'))
-{
-    $version = explode('.', PHP_VERSION);
-    define('PHP_VERSION_ID', ($version[0] * 10000 + $version[1] * 100 + $version[2]));
+if (!defined('PHP_VERSION_ID')) {
+  $version = explode('.', PHP_VERSION);
+  define('PHP_VERSION_ID', ($version[0] * 10000 + $version[1] * 100 + $version[2]));
 }
 
-if (PHP_VERSION_ID < 50207)
-{
-    define('PHP_MAJOR_VERSION',   $version[0]);
-    define('PHP_MINOR_VERSION',   $version[1]);
-    define('PHP_RELEASE_VERSION', $version[2]);
+if (PHP_VERSION_ID < 50207) {
+  define('PHP_MAJOR_VERSION',   $version[0]);
+  define('PHP_MINOR_VERSION',   $version[1]);
+  define('PHP_RELEASE_VERSION', $version[2]);
 }  
 
 
@@ -130,26 +128,23 @@ function is64bitPHP() {
  ***********************************************************************/
 if (!function_exists('ram_total_space')) {
     function ram_total_space() {
-        $size = 0;
-        if (mb_strtolower(mb_substr(PHP_OS, 0, 3),'UTF-8') === 'win') {
-            $lines = null;
-            $matches = null;
-            exec('wmic ComputerSystem get TotalPhysicalMemory /Value', $lines);
-            if (preg_match('/^TotalPhysicalMemory\=(\d+)$/', $lines[2], $matches)) {
-                $size = $matches[1];
-            }
-        } else {
-            $meminfo_file = fopen('/proc/meminfo', 'r');
-            while ($line = fgets($meminfo_file)) {
-                $elements = array();
-                if (preg_match('/^MemTotal:\s+(\d+)\skB$/', $line, $elements)) {
-                    $size = $elements[1] * 1024;
-                    break;
-                }
-            }
-            fclose($meminfo_file);
+      $size = 0;
+      if (mb_strtolower(mb_substr(PHP_OS, 0, 3),'UTF-8') === 'win') {
+        $lines = null;
+        exec('powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).TotalPhysicalMemory"', $lines);
+        $size = intval(trim($lines[0] ?? 0));
+      } else {
+        $meminfo_file = fopen('/proc/meminfo', 'r');
+        while ($line = fgets($meminfo_file)) {
+          $elements = array();
+          if (preg_match('/^MemTotal:\s+(\d+)\skB$/', $line, $elements)) {
+            $size = $elements[1] * 1024;
+            break;
+          }
         }
-        return (double) $size;
+        fclose($meminfo_file);
+      }
+      return (double) $size;
     }
 }
 
@@ -162,27 +157,24 @@ function ram_total_space() {
  ***********************************************************************/
 if (!function_exists('ram_free_space')) {
     function ram_free_space() {
-        $size = 0;
-        if (mb_strtolower(mb_substr(PHP_OS, 0, 3),'UTF-8') === 'win') {
-            $lines = null;
-            $matches = null;
-            exec('wmic OS get FreePhysicalMemory /Value', $lines);
-            if (preg_match('/^FreePhysicalMemory\=(\d+)$/', $lines[2], $matches)) {
-                $size = $matches[1] * 1024;
-            }
-        } else {
-            $meminfo_file = fopen('/proc/meminfo', 'r');
-            while ($line = fgets($meminfo_file)) {
-                $elements = array();
-                if (preg_match('/^MemFree:\s+(\d+)\skB$/', $line, $elements)) {
-                    // KB to Bytes
-                    $size = $elements[1] * 1024;
-                    break;
-                }
-            }
-            fclose($meminfo_file);
+      $size = 0;
+      if (mb_strtolower(mb_substr(PHP_OS, 0, 3),'UTF-8') === 'win') {
+        $lines = null;
+        exec('powershell -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).FreePhysicalMemory"', $lines);
+        $size = intval(trim($lines[0] ?? 0)) * 1024;
+      } else {
+        $meminfo_file = fopen('/proc/meminfo', 'r');
+        while ($line = fgets($meminfo_file)) {
+          $elements = array();
+          if (preg_match('/^MemFree:\s+(\d+)\skB$/', $line, $elements)) {
+            // KB to Bytes
+            $size = $elements[1] * 1024;
+            break;
+          }
         }
-        return (double) $size;
+        fclose($meminfo_file);
+      }
+      return (double) $size;
     }
 }
 
@@ -1199,6 +1191,33 @@ function mask2cidr($mask) {
 }
 
 
+if (!function_exists('cidr2mask'))
+{
+    // https://gist.github.com/linickx/1309388
+    function cidr2mask($netmask) {
+      $netmask_result="";
+      for($i=1; $i <= $netmask; $i++) {
+        $netmask_result .= "1";
+      }
+
+      for($i=$netmask+1; $i <= 32; $i++) {
+        $netmask_result .= "0";
+      }
+
+      $netmask_ip_binary_array = str_split( $netmask_result, 8 );
+
+      $netmask_ip_decimal_array = array();
+      foreach( $netmask_ip_binary_array as $k => $v ){
+        $netmask_ip_decimal_array[$k] = bindec( $v ); // "100" => 4
+      }
+
+      $subnet = join( ".", $netmask_ip_decimal_array );
+
+      return $subnet;
+    }
+}
+
+
 if (!function_exists('protect_file'))
 {
   function protect_file(