class-limit-login-attempts.php — Admin and Site Enhancements (ASE) 7.8.1

admin-site-enhancements / classes / class-limit-login-attempts.php

admin-site-enhancements / classes Last commit date

class-limit-login-attempts.php

508 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	use WP_Error;
6
7	/**
8	* Class for Limit Login Attempts module
9	*
10	* @since 6.9.5
11	*/
12	class Limit_Login_Attempts {
13
14	/**
15	* Maybe allow login if not locked out. Should return WP_Error object if not allowed to login.
16	*
17	* @since 2.5.0
18	*/
19	public function maybe_allow_login( $user_or_error, $username, $password ) {
20	global $wpdb, $asenha_limit_login;
21
22	$table_name = $wpdb->prefix . 'asenha_failed_logins';
23
24	// Maybe create table if it does not exist yet, e.g. upgraded from previous version of plugin, so, no activation methods are fired
25	$query = $wpdb->prepare( 'SHOW TABLES LIKE %s', $wpdb->esc_like( $table_name ) );
26
27	if ( $wpdb->get_var( $query ) === $table_name ) {
28	// Table already exists, do nothing.
29	} else {
30	$activation = new Activation;
31	$activation->create_failed_logins_log_table();
32	}
33
34	// Get values from options needed to do various checks
35	$options = get_option( ASENHA_SLUG_U, array() );
36	$login_fails_allowed = $options['login_fails_allowed'];
37	$login_lockout_maxcount = $options['login_lockout_maxcount'];
38
39	$ip_address_whitelist_raw = ( isset( $options['limit_login_attempts_ip_whitelist'] ) ) ? explode( PHP_EOL, $options['limit_login_attempts_ip_whitelist'] ) : array();
40	$ip_address_whitelist = array();
41	if ( ! empty( $ip_address_whitelist_raw ) ) {
42	foreach( $ip_address_whitelist_raw as $ip_address ) {
43	$ip_address_whitelist[] = trim( $ip_address );
44	}
45	}
46
47	$change_login_url = $options['change_login_url'];
48	$custom_login_slug = $options['custom_login_slug'];
49
50	// Instantiate object to access common methods
51	$common_methods = new Common_Methods;
52
53	// Get user/visitor IP address
54	$ip_address = $common_methods->get_user_ip_address( 'ip', 'limit-login-attempts' );
55
56	if ( ! in_array( $ip_address, $ip_address_whitelist ) ) { // IP is not whitelisted
57	// Check if IP address has failed login attempts recorded in the DB log
58	$sql = $wpdb->prepare("SELECT * FROM `" . $table_name . "` Where `ip_address` = %s", $ip_address);
59	$result = $wpdb->get_results( $sql, ARRAY_A );
60
61	$result_count = count( $result );
62
63	if ( $result_count > 0 ) { // IP address has been recorded in the database.
64	$fail_count = $result[0]['fail_count'];
65	$lockout_count = $result[0]['lockout_count'];
66	$last_fail_on = $result[0]['unixtime'];
67	} else {
68	$fail_count = 0;
69	$lockout_count = 0;
70	$last_fail_on = '';
71	}
72	} else { // IP is whitelisted
73	$result = array();
74	$result_count = 0;
75	$fail_count = 0;
76	$lockout_count = 0;
77	$last_fail_on = '';
78	}
79
80	// Initialize the global variable
81	$asenha_limit_login = array (
82	'ip_address' => $ip_address,
83	'request_uri' => sanitize_text_field( $_SERVER['REQUEST_URI'] ),
84	'ip_address_log' => $result,
85	'fail_count' => $fail_count,
86	'lockout_count' => $lockout_count,
87	'maybe_lockout' => false,
88	'extended_lockout' => false,
89	'within_lockout_period' => false,
90	'lockout_period' => 0,
91	'lockout_period_remaining' => 0,
92	'login_fails_allowed' => $login_fails_allowed,
93	'login_lockout_maxcount' => $login_lockout_maxcount,
94	// 'default_lockout_period' => 15, // 15 seconds. FOR TESTING.
95	// 'default_lockout_period' => 60, // 1 minutes in seconds
96	'default_lockout_period' => 60*15, // 15 minutes in seconds
97	// 'extended_lockout_period' => 3*60, // 3 minutes in seconds
98	'extended_lockout_period' => 246060, // 24 hours in seconds
99	'change_login_url' => $change_login_url, // is custom login URL enabled?
100	'custom_login_slug' => $custom_login_slug,
101	);
102
103	if ( ! in_array( $ip_address, $ip_address_whitelist ) ) { // IP is not whitelisted
104
105	if ( $result_count > 0 ) { // IP address has been recorded in the database.
106
107	// Failed attempts have been recorded and fulfills lockout condition
108	if ( ! empty( $fail_count ) && ( ( $fail_count ) % $login_fails_allowed == 0 ) ) {
109
110	$asenha_limit_login['maybe_lockout'] = true;
111
112	// Has reached max / gone beyond number of lockouts allowed?
113	if ( $lockout_count >= $login_lockout_maxcount ) {
114	$asenha_limit_login['extended_lockout'] = true;
115	$lockout_period = $asenha_limit_login['extended_lockout_period'];
116	} else {
117	$asenha_limit_login['extended_lockout'] = false;
118	$lockout_period = $asenha_limit_login['default_lockout_period'];
119	}
120
121	$asenha_limit_login['lockout_period'] = $lockout_period;
122
123	// User/visitor is still within the lockout period
124	if ( ( time() - $last_fail_on ) <= $asenha_limit_login['lockout_period'] ) {
125
126	$asenha_limit_login['within_lockout_period'] = true;
127	$asenha_limit_login['lockout_period_remaining'] = $asenha_limit_login['lockout_period'] - ( time() - $last_fail_on );
128
129	if ( $asenha_limit_login['lockout_period_remaining'] <= 60 ) {
130
131	// Get remaining lockout period in minutes and seconds
132	$lockout_period_remaining = $asenha_limit_login['lockout_period_remaining'] . ' seconds';
133
134	} elseif ( $asenha_limit_login['lockout_period_remaining'] <= 60*60 ) {
135
136	// Get remaining lockout period in minutes and seconds
137	$lockout_period_remaining = $common_methods->seconds_to_period( $asenha_limit_login['lockout_period_remaining'], 'to-minutes-seconds' );
138
139	} elseif ( $asenha_limit_login['lockout_period_remaining'] > 6060 && $asenha_limit_login['lockout_period_remaining'] <= 2460*60 ) {
140
141	// Get remaining lockout period in minutes and seconds
142	$lockout_period_remaining = $common_methods->seconds_to_period( $asenha_limit_login['lockout_period_remaining'], 'to-hours-minutes-seconds' );
143
144	} elseif ( $asenha_limit_login['lockout_period_remaining'] > 246060 ) {
145
146	// Get remaining lockout period in minutes and seconds
147	$lockout_period_remaining = $common_methods->seconds_to_period( $asenha_limit_login['lockout_period_remaining'], 'to-days-hours-minutes-seconds' );
148
149	}
150
151	$error = new WP_Error( 'ip_address_blocked', '<b>WARNING:</b> You\'ve been locked out. You can login again in ' . $lockout_period_remaining . '.' );
152
153	return $error;
154
155	} else { // User/visitor is no longer within the lockout period
156
157	$asenha_limit_login['within_lockout_period'] = false;
158
159	if ( $lockout_count == $login_lockout_maxcount ) {
160
161	// Remove the DB log entry for the current IP address. i.e. release from extended lockout
162
163	$where = array( 'ip_address' => $ip_address );
164	$where_format = array( '%s' );
165
166	// Delete existing data in the database
167	$wpdb->delete(
168	$table_name,
169	$where,
170	$where_format
171	);
172
173	}
174
175	return $user_or_error;
176
177	}
178
179	} else {
180
181	$asenha_limit_login['maybe_lockout'] = false;
182
183	return $user_or_error;
184
185	}
186
187	} else { // IP address has not been recorded in the database.
188
189	return $user_or_error;
190
191	}
192
193	} else { // IP is whitelisted
194	return $user_or_error;
195	}
196	}
197
198	/**
199	* Handle login errors
200	*
201	* @link https://developer.wordpress.org/reference/classes/wp_error/#methods
202	* @since 2.5.0
203	*/
204	public function login_error_handler( $errors, $redirect_to ) {
205	global $asenha_limit_login;
206
207	if ( is_wp_error( $errors ) ) {
208
209	$error_codes = $errors->get_error_codes();
210
211	foreach ( $error_codes as $error_code ) {
212
213	if ( $error_code == 'invalid_username' \|\| $error_code == 'incorrect_password' ) {
214
215	// Remove default error messages that may give out valueable info to hackers
216
217	$errors->remove( 'invalid_username' ); // Outputs info that says username does not exist. May encourage login attempt with a different username instead.
218
219	$errors->remove( 'incorrect_password' ); // Outputs info that implies username exist. May encourage login attempt with a different password.
220
221	// Add a new error message that does not provide useful clues to hackers
222	$errors->add( 'invalid_username_or_incorrect_password', '<b>' . __( 'Error:', 'admin-site-enhancements' ) . '</b> ' . __( 'Invalid username/email or incorrect password.', 'admin-site-enhancements' ) );
223
224	// $errors->add( 'another_error_code', 'The error message.' );
225
226	}
227
228	}
229
230	}
231
232	return $errors;
233	}
234
235	/**
236	* Disable login form inputs via CSS
237	*
238	* @since 2.5.0
239	*/
240	public function maybe_hide_login_form() {
241	global $asenha_limit_login;
242
243	if ( isset( $asenha_limit_login['within_lockout_period'] ) && $asenha_limit_login['within_lockout_period'] ) {
244
245	// Hide logo, login form and the links below it
246	?>
247	<script>
248	document.addEventListener("DOMContentLoaded", function(event) {
249	var loginForm = document.getElementById("loginform");
250	loginForm.remove();
251	});
252	</script>
253	<style type="text/css">
254
255	body.login {
256	background:#f6d6d7;
257	}
258
259	#login h1,
260	#loginform,
261	#login #nav,
262	#backtoblog,
263	.language-switcher {
264	display: none;
265	}
266
267	@media screen and (max-height: 550px) {
268
269	#login {
270	padding: 80px 0 20px !important;
271	}
272
273	}
274
275	</style>
276	<?php
277	} else {
278	$options = get_option( ASENHA_SLUG_U, array() );
279	$login_fails_allowed = $options['login_fails_allowed'];
280	$page_was_reloaded = isset( $_GET['rl'] ) && 1 == sanitize_text_field( $_GET['rl'] ) ? true : false;
281
282	if ( isset( $asenha_limit_login['fail_count'] )
283	&& ( ( $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
284	\|\| ( 2 * $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
285	\|\| ( 3 * $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
286	\|\| ( 4 * $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
287	\|\| ( 5 * $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
288	\|\| ( 6 * $login_fails_allowed - 1 ) == intval( $asenha_limit_login['fail_count'] )
289	)
290	) {
291	if ( array_key_exists( 'change_login_url', $options ) && $options['change_login_url'] ) {
292	// Custom Login URL is enabled, e.g. /manage
293	// Do nothing
294	} else {
295	// Default login URL, i.e. /wp-login.php
296	// Reload the login page so we get the up-to-date data in $asenha_limit_login
297	// Only reload if page was not reloaded before. This prevents infinite reloads.
298	if ( ! $page_was_reloaded ) {
299	?>
300	<script>
301	let url = window.location.href;
302	if (url.indexOf('?') > -1){
303	url += '&rl=1'
304	} else {
305	url += '?rl=1'
306	}
307	location.replace(url);
308	</script>
309	<?php
310	}
311
312	}
313	}
314	}
315	}
316
317	/**
318	* Add login error message on top of the login form
319	*
320	* @since 2.5.0
321	*/
322	public function add_failed_login_message( $message ) {
323	global $asenha_limit_login;
324
325	if ( isset( $_REQUEST['failed_login'] ) && $_REQUEST['failed_login'] == 'true' ) {
326
327	if ( ! is_null( $asenha_limit_login ) && isset( $asenha_limit_login['within_lockout_period'] ) && ! $asenha_limit_login['within_lockout_period'] ) {
328
329	$message = '<div id="login_error" class="notice notice-error"><b>' . __( 'Error:', 'admin-site-enhancements' ) . '</b> ' . __( 'Invalid username/email or incorrect password.', 'admin-site-enhancements' ) . '</div>';
330
331	}
332
333	}
334
335	return $message;
336	}
337
338	/**
339	* Log failed login attempts
340	*
341	* @since 2.5.0
342	*/
343	public function log_failed_login( $username ) {
344	global $wpdb, $asenha_limit_login;
345
346	$table_name = $wpdb->prefix . 'asenha_failed_logins';
347
348	$ip_address = isset( $asenha_limit_login['ip_address'] ) ? $asenha_limit_login['ip_address'] : '';
349	$request_uri = isset( $asenha_limit_login['request_uri'] ) ? $asenha_limit_login['request_uri'] : '';
350	$login_fails_allowed = isset( $asenha_limit_login['login_fails_allowed'] ) ? $asenha_limit_login['login_fails_allowed'] : 3;
351	$login_lockout_maxcount = isset( $asenha_limit_login['login_lockout_maxcount'] ) ? $asenha_limit_login['login_lockout_maxcount'] : 3;
352
353	// Check if the IP address has been used in a failed login attempt before, i.e. has it been recorded in the database?
354	$sql = $wpdb->prepare( "SELECT * FROM `" . $table_name . "` WHERE `ip_address` = %s", $ip_address );
355	$result = $wpdb->get_results( $sql, ARRAY_A );
356	if ( $result ) {
357	$result_count = count( $result );
358	} else {
359	$result_count = 0;
360	}
361
362	// Update logged info for the IP address in the global variable
363	if ( $result ) {
364	$asenha_limit_login['ip_address_log'] = $result;
365	}
366
367	if ( $result_count == 0 ) { // IP address has not been recorded in the database.
368
369	$new_fail_count = 1;
370	$new_lockout_count = 0;
371
372	} else { // IP address has been recorded in the database.
373
374	$new_fail_count = $result[0]['fail_count'] + 1;
375	$new_lockout_count = floor( ( $result[0]['fail_count'] + 1 ) / $login_fails_allowed );
376
377	}
378
379	// Get the URL where login failed, i.e. where brute force attack might be happening
380	// $login_url = ( ! empty( $_SERVER['HTTPS'] ) ? 'https://' : 'http://') . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] );
381
382	// Time stamps
383	$unixtime = time();
384	if ( function_exists( 'wp_date' ) ) {
385	$datetime_wp = wp_date( 'Y-m-d H:i:s', $unixtime );
386	} else {
387	$datetime_wp = date_i18n( 'Y-m-d H:i:s', $unixtime );
388	}
389
390	$data = array(
391	'ip_address' => $ip_address,
392	'username' => $username,
393	'fail_count' => $new_fail_count,
394	'lockout_count' => $new_lockout_count,
395	'request_uri' => $request_uri,
396	'unixtime' => $unixtime,
397	'datetime_wp' => $datetime_wp,
398	'info' => '',
399	);
400
401	$data_format = array(
402	'%s', // string
403	'%s', // string
404	'%d', // integer
405	'%d', // integer
406	'%s', // string
407	'%d', // integer
408	'%s', // string
409	'%s', // string
410	);
411
412	if ( $result_count == 0 ) {
413
414	// Insert into the database
415	$result = $wpdb->insert(
416	$table_name,
417	$data,
418	$data_format
419	);
420
421	} else {
422
423	$fail_count = $result[0]['fail_count'];
424	$lockout_count = $result[0]['lockout_count'];
425	$last_fail_on = $result[0]['unixtime'];
426
427	$where = array( 'ip_address' => $ip_address );
428	$where_format = array( '%s' );
429
430	// Failed attempts have been recorded and fulfills lockout condition
431	if ( ! empty( $fail_count )
432	&& ( $login_fails_allowed > 0 )
433	&& ( $fail_count % $login_fails_allowed == 0 )
434	) {
435
436	// Has reached max / gone beyond number of lockouts allowed?
437	if ( $lockout_count >= $login_lockout_maxcount ) {
438	$asenha_limit_login['extended_lockout'] = true;
439	$lockout_period = $asenha_limit_login['extended_lockout_period'];
440	} else {
441	$asenha_limit_login['extended_lockout'] = false;
442	$lockout_period = $asenha_limit_login['default_lockout_period'];
443	}
444
445	$asenha_limit_login['lockout_period'] = $lockout_period;
446
447	// User/visitor is still within the lockout period
448	if ( ( time() - $last_fail_on ) <= $lockout_period ) {
449
450	// Do nothing
451
452	} else {
453
454	if ( $lockout_count < $login_lockout_maxcount ) {
455
456	// Update existing data in the database
457	$wpdb->update(
458	$table_name,
459	$data,
460	$where,
461	$data_format,
462	$where_format
463	);
464
465	}
466
467	}
468
469	} else {
470
471	// Update existing data in the database
472	$wpdb->update(
473	$table_name,
474	$data,
475	$where,
476	$data_format,
477	$where_format
478	);
479
480	}
481
482	}
483	}
484
485	/**
486	* Clear failed login attempts log after successful login
487	*
488	* @since 2.5.0
489	*/
490	public function clear_failed_login_log() {
491	global $wpdb, $asenha_limit_login;
492
493	$table_name = $wpdb->prefix . 'asenha_failed_logins';
494	$ip_address = isset( $asenha_limit_login['ip_address'] ) ? $asenha_limit_login['ip_address'] : '';
495
496	// Remove the DB log entry for the current IP address.
497
498	$where = array( 'ip_address' => $ip_address );
499	$where_format = array( '%s' );
500
501	$wpdb->delete(
502	$table_name,
503	$where,
504	$where_format
505	);
506	}
507
508	}