This changelog format is based on Keep a Changelog and adheres to Semantic Versioning.
- GM/Player search
- GM feedback (public ratings)
- Player feedback (private ratings)
- Private profile option
- The Open Legend tools site now has a built-in auto-login feature for those who maintain a HeroMuster account and chose the Remember Me option to set a secure login cookie in your browser. This means you are logged in on page load, without clicks or redirects.
- Font altered to display numbers with the same linear spacing (no numbers that seem higher or lower than others). Same font, just a different part of the font.
- Added additional caching for the font files to load the site even faster on repeat visits (including different browsing sessions).
- Badges are now enabled. All verified accounts have been assigned their first badge: the Hipster Badge. See your home page to learn more.
- Editing text fields (e.g. Real Name, Postal Code, Social Links, Description) in your account page will now auto-save when you click away from that field (most users were not clicking the save button and leaving the page; this solves that).
- The pre-launch message was moved to the bottom of the hamburger menu on smaller devices (e.g. phones) to reduce visual confusion.
- Updated to Font Awesome 5.0.8.
- Save button spacing was improved for the account page.
Connect with your Fellow Heroes
You can now connect with other heroes on the site through their public profile page. Connections allow you to be notified directly about RPG activity in your network.
A new home screen shows any pending connection requests along with a few placeholders for features to come.
- Profile page meta description now more detailed (more personal than previously if sharing on social media).
- The brand image and title HeroMuster in the top-left of the navigation now brings you to your home screen rather than the frontpage of the site (if you are logged in).
- Users logging in without a redirect (e.g. not being sent from the Open Legend site) will now be sent to the home screen for their account rather than redirected to the OL site. This doesn't effect those initiating the login from that site (they will still get redirected back).
- Profile pages no longer expose last name in the meta description.
- The RPG play style chart on the profile page will no longer jump around during page rendering.
- You can now remove your zipcode and leave only your country if you prefer.
- New accounts have Country and Postal Code automatically added (based on IP Address) in hopes of saving users time.
- Account Settings now asks for your Country to better localize postal codes.
- Postal Code lookup now available for non-USA addresses.
- International City and Country properly displays now on public profile pages.
Public Profile Pages Added
A public profile is now available to account holders. The first time visiting your account page a unique profile link is generated for you which can be customized (with a restricted character set).
- Last name suppression put into place on profile pages.
Account: Full Profile
You can now completely fill out your HeroMuster profile. This includes basic information (name, image, and postal code) as well as more advanced options (RPG systems, roleplaying style, and RPG type).
All of these new choices will be used to complete your HeroMuster profile (coming soon) and help match you with other players and GMs.
All existing accounts have had their names and profile images updated (no existing data overwritten) with Gravatar profile data, if available.
All new accounts, upon email verification, will automatically be checked for an existing Gravatar profile.
- You can now upload a profile image.
- There is now an RSS version of the changelog.
- Profile and Notification changes in your Account are now added to the Activity Log.
- Updated to 4.0.0 release of Bootstrap.
Progressive Web App
A Service Worker will now cache required files on your device to speed up loading times of all pages and notify you if you are offline and trying to access the site.
- Android uses may also be prompted to add HeroMuster to their Home Screen automatically.
- The Account page > Notifications section has now been enabled. Currently there is only one notification option, but as more features are built additional controls will be added.
Internet Explorer 11 (IE11) now supported. It no longer generates errors stopping you from sending verification/login emails or adding a password to the account.
- An activity log is now available on the Account page displaying all recent account activity (e.g. logins, security setting changes, etc).
- The activity log will include more information as features are added to HeroMuster.
- When adding authenticator security, entering an incorrect code will now provide useful messaging.
- When adding any secondary security (password or authenticator) to your account, all remembered device cookies will be purged from the system and require re-verification.
Remembered Device Purge
I realized that when you add a new secondary security feature, such as a password or two-factor authenticator, that constitutes a new minimum security standard. However, HeroMuster was not invalidating all previous Remember this Device cookies in this scenario, essentially allowing any of those devices to bypass this new check while the cookie was valid.
Scenario: Authorized tablet is stolen. You immediately add a password to your account to protect it. Alternatively, the logout page also offers a way to invalidate that device.
Login via Code
For users who may not receive email on the same device as the one they are trying to login, you may now opt to receive an email with a one-time-use code that can be entered into the original device rather than following a link.
A new Account Settings link in the top-right allows you to update your account security settings.
- You can add or remove secondary security settings (Password or Authenticator).
- You can choose to be forgotten (GDPR 2018), deleting your account and all personal information.
- Recent failed login attempts (bad password or authenticator code) are listed with IP and geolocation information.
- Last login (via email link) timestamp visible.
- Now running on Bootstrap v4-beta3, including minor changes to login form to fix incompatible changes from v4-beta2.
- Custom CSS added to pages reducing page rendering time by 50%. Translation: pages will be visible in < 1 second on desktop and < 2 seconds on mobile.
- When setting up a password, the backup password is no longer referred to as a code.
- When setting up an authenticator, the backup code is no longer referred to as a password.
- Account Creation and Login emails have been upgraded to HTML formatting.
Open Legend Tools: My Creations
Logged in users now have a landing page that tracks all their created characters and items called My Creations.
- Creations can be removed from the list with a single click (undo available).
- Importing characters by player name now available.
- Added help email address to post login screen.
- Login with Remember This Device cookie occurs automatically when loading the Login screen.
- Logout no longer displays erroneous errors in some browsers and properly logs out your session and Remember This Device cookie.
User accounts are now enabled requiring only an email address.
- New signups automatically detected, email verification required.
- Account security options: Emailed login link (required), Password (optional) or Google Authenticator (optional)
- Cryptographically secure Remember This Device cookie make logging back in painless.
Description of a new feature.
- Item changed.
- Item changed.
- Item changed.
- List of bug fixes.
- List of bug fixes.
Public acknowledgement of any confirmed security vulnerabilities.
Description and reasoning for soon-to-be-removed features.
Full description of removed feature.