PluginProbe ʕ •ᴥ•ʔ
Advanced Google reCAPTCHA / 1.13
Advanced Google reCAPTCHA v1.13
5.40 5.39 trunk 1.0.1 1.0.10 1.0.11 1.0.12 1.0.13 1.0.14 1.0.15 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 1.29 1.30 1.31 1.32 1.33 1.34 1.35
advanced-google-recaptcha / interface / tab_firewall.php
advanced-google-recaptcha / interface Last commit date
tab_activity.php 2 years ago tab_captcha.php 2 years ago tab_design.php 2 years ago tab_firewall.php 2 years ago tab_geoip.php 2 years ago tab_login_form.php 2 years ago tab_temp_access.php 2 years ago
tab_firewall.php
230 lines
1 <?php
2
3 /**
4 * WP Captcha
5 * https://getwpcaptcha.com/
6 * (c) WebFactory Ltd, 2022 - 2023, www.webfactoryltd.com
7 */
8
9 class WPCaptcha_Tab_Firewall extends WPCaptcha
10 {
11 static function display()
12 {
13 $tabs[] = array('id' => 'tab_general', 'class' => 'tab-content', 'label' => __('General', 'advanced-google-recaptcha'), 'callback' => array(__CLASS__, 'tab_general'));
14 $tabs[] = array('id' => 'tab_2fa', 'class' => 'tab-content', 'label' => __('2FA', 'advanced-google-recaptcha'), 'callback' => array(__CLASS__, 'tab_2fa'));
15 $tabs[] = array('id' => 'tab_cloud_protection', 'class' => 'tab-content', 'label' => __('Cloud Protection', 'advanced-google-recaptcha'), 'callback' => array(__CLASS__, 'tab_cloud_protection'));
16
17 echo '<div id="tabs_log" class="ui-tabs wpcaptcha-tabs-2nd-level">';
18 echo '<ul>';
19 foreach ($tabs as $tab) {
20 echo '<li><a href="#' . esc_attr($tab['id']) . '">' . esc_html($tab['label']) . '</a></li>';
21 }
22 echo '</ul>';
23
24 foreach ($tabs as $tab) {
25 if (is_callable($tab['callback'])) {
26 echo '<div style="display: none;" id="' . esc_attr($tab['id']) . '" class="' . esc_attr($tab['class']) . '">';
27 call_user_func($tab['callback']);
28 echo '</div>';
29 }
30 } // foreach
31
32 echo '</div>'; // second level of tabs
33
34
35 } // display
36
37 static function tab_general()
38 {
39 $options = WPCaptcha_Setup::get_options();
40
41 echo '<p>Securing your WordPress website is vital for maintaining the security and privacy of its users. By preventing against the types of attacks below, website owners can ensure that their users receive legitimate content without being exposed to harmful or malicious data.</p>
42 <p>A secure WordPress website promotes a safe browsing experience for users, fostering trust in the site\'s content and services. Additionally, mitigating these risks helps website owners avoid potential legal issues and financial losses associated with security breaches. It also protects the website\'s reputation, ensuring that users continue to rely on the site as a trustworthy source of information and services.</p>';
43
44 echo '<table class="form-table"><tbody>';
45
46 echo '<tr valign="top">
47 <th scope="row"><label for="firewall_block_bots">Block bad bots</label></th>
48 <td>';
49 WPCaptcha_Utility::create_toggle_switch('firewall_block_bots', array('saved_value' => $options['firewall_block_bots'], 'option_key' => esc_attr(WPCAPTCHA_OPTIONS_KEY) . '[firewall_block_bots]'), true, 'firewall_rule_toggle');
50 echo '<br><span>Blocking bad bots on a WordPress site refers to the process of identifying and preventing malicious automated software programs, known as "bots," from accessing, crawling, or interacting with the website. Bad bots are typically used by attackers to perform various malicious activities, such as content scraping, spamming, DDoS attacks, vulnerability scanning, or brute-force attacks to gain unauthorized access to the site.</span>';
51 echo '</td></tr>';
52
53 echo '<tr valign="top">
54 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_directory_traversal">Directory Traversal</label></th>
55 <td>';
56 echo '<div>';
57 WPCaptcha_Utility::create_toggle_switch('firewall_directory_traversal', array('saved_value' => $options['firewall_directory_traversal'], 'option_key' => esc_attr(WPCAPTCHA_OPTIONS_KEY) . '[firewall_directory_traversal]'), true, 'firewall_rule_toggle');
58 echo '</div>';
59 echo '<span>Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to access files on the server that they should not by passing file paths that attempt to traverse the normal directory structure using the parent folder path.</span>';
60 echo '</td></tr>';
61
62 echo '<tr valign="top">
63 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_http_response_splitting">HTTP Response Splitting</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_http_response_splitting" class="open-upsell pro-label">PRO</a></th>
64 <td>';
65 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_http_response_splitting">';
66 WPCaptcha_Utility::create_toggle_switch('firewall_http_response_splitting', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
67 echo '</div>';
68 echo '<span>HTTP Response Splitting is a type of attack that occurs when an attacker can manipulate the response headers that will be interpreted by the client. Protecting against HTTP Response Splitting on a WordPress website is crucial to maintain its security and the privacy of its users. By preventing this vulnerability, website owners can reduce the risk of attackers stealing sensitive information, compromising user accounts, or damaging the website\'s reputation. </span>';
69 echo '</td></tr>';
70
71 echo '<tr valign="top">
72 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_xss">(XSS) Cross-Site Scripting</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_xss" class="open-upsell pro-label">PRO</a></th>
73 <td>';
74 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_xss">';
75 WPCaptcha_Utility::create_toggle_switch('firewall_xss', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
76 echo '</div>';
77 echo '<span>Cross-Site Scripting (XSS) is a type of web application vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. This occurs when a web application does not properly validate or sanitize user input and includes it in the rendered HTML output. There are three main types of XSS: stored, reflected, and DOM-based.<br />In stored XSS, the malicious script is saved in the target server (e.g., in a database), while in reflected XSS, the malicious script is part of the user\'s request and reflected back in the response. DOM-based XSS occurs when the vulnerability is in the client-side JavaScript code, allowing the attacker to manipulate the Document Object Model (DOM) directly. This option only protects agains reflected/request type XSS attacks. You should still be careful about what plugins you install and make sure they are secure.</span>';
78 echo '</td></tr>';
79
80 echo '<tr valign="top">
81 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_cache_poisoning">Cache Poisoning</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_cache_poisoning" class="open-upsell pro-label">PRO</a></th>
82 <td>';
83 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_cache_poisoning">';
84 WPCaptcha_Utility::create_toggle_switch('firewall_cache_poisoning', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
85 echo '</div>';
86 echo '<span>Cache Poisoning is a type of cyberattack where an attacker manipulates the cache data of web applications, content delivery networks (CDNs), or DNS resolvers to serve malicious content to unsuspecting users. The attacker exploits vulnerabilities or misconfigurations in caching mechanisms to insert malicious data into the cache, effectively "poisoning" it. When a user makes a request, the compromised cache serves the malicious content instead of the legitimate content. This can lead to various harmful consequences, such as redirecting users to phishing sites, spreading malware, or stealing sensitive information.</span>';
87 echo '</td></tr>';
88
89 echo '<tr valign="top">
90 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_dual_header">Dual-Header Exploits</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_dual_header" class="open-upsell pro-label">PRO</a></th>
91 <td>';
92 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_dual_header">';
93 WPCaptcha_Utility::create_toggle_switch('firewall_dual_header', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
94 echo '</div>';
95 echo '<span>Dual-Header Exploits, also known as HTTP Header Injection, is a type of web application vulnerability that involves manipulating HTTP headers to execute malicious actions or inject malicious content. Similar to HTTP Response Splitting, an attacker exploits this vulnerability by injecting newline characters (CRLF - carriage return and line feed) or other special characters into user input. This allows the attacker to create or modify HTTP headers, which can lead to various harmful consequences. For instance, an attacker can set cookies, redirect users to malicious websites, or perform cross-site scripting (XSS) attacks.</span>';
96 echo '</td></tr>';
97
98 echo '<tr valign="top">
99 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_sql_injection">SQL/PHP/Code Injection</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_sql_injection" class="open-upsell pro-label">PRO</a></th>
100 <td>';
101 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_sql_injection">';
102 WPCaptcha_Utility::create_toggle_switch('firewall_sql_injection', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
103 echo '</div>';
104 echo '<span>SQL/PHP/Code Injection is a type of web application vulnerability where an attacker inserts malicious code or commands into a web application, typically by exploiting insufficient input validation or sanitization. This allows the attacker to execute unauthorized actions, such as extracting sensitive information from databases, modifying data, or gaining unauthorized access to the system.</span>';
105 echo '</td></tr>';
106
107 echo '<tr valign="top">
108 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_file_injection">File Injection/Inclusion</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_file_injection" class="open-upsell pro-label">PRO</a></th>
109 <td>';
110 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_file_injection">';
111 WPCaptcha_Utility::create_toggle_switch('firewall_file_injection', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
112 echo '</div>';
113 echo '<span>File Injection/Inclusion is a type of web application vulnerability where an attacker exploits insufficient validation or sanitization of user input to include or inject malicious files into a web application. There are two main types of File Injection/Inclusion vulnerabilities: Local File Inclusion (LFI) and Remote File Inclusion (RFI). This can lead to unauthorized access to sensitive files, source code disclosure, or even the execution of server-side scripts if the application processes the included file. If the application is manipulated to process a remote file, the attacker\'s code is executed, potentially granting unauthorized access, control over the server, or the ability to perform various malicious actions.</span>';
114 echo '</td></tr>';
115
116 echo '<tr valign="top">
117 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_null_byte_injection">Null Byte Injection</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_null_byte_injection" class="open-upsell pro-label">PRO</a></th>
118 <td>';
119 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_null_byte_injection">';
120 WPCaptcha_Utility::create_toggle_switch('firewall_null_byte_injection', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
121 echo '</div>';
122 echo '<span>Null Byte Injection is a type of web application vulnerability that exploits the way certain programming languages, such as C and PHP, handle null characters. The null character serves as a string terminator in these languages, signaling the end of a string. An attacker can use a null byte to manipulate user input or file paths, causing the application to truncate the string after the null character. This can lead to unexpected behaviors, such as bypassing input validation or accessing sensitive files.</span>';
123 echo '</td></tr>';
124
125 echo '<tr valign="top">
126 <th scope="row"><label class="open-upsell open-upsell-block" for="firewall_php_info">PHP information leakage</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="firewall_php_info" class="open-upsell pro-label">PRO</a></th>
127 <td>';
128 echo '<div class="open-upsell open-upsell-block" data-feature="firewall_php_info">';
129 WPCaptcha_Utility::create_toggle_switch('firewall_php_info', array('saved_value' => 0, 'option_key' => ''), true, 'firewall_rule_toggle');
130 echo '</div>';
131 echo '<span>PHP information leakage refers to the unintended exposure of sensitive information about the PHP environment, configurations, or code running on a WordPress website. This information can be valuable for attackers, as it may reveal potential vulnerabilities, system details, or other information that could be exploited to compromise the site.</span>';
132 echo '</td></tr>';
133
134 echo '<tr><td></td><td>';
135 WPCaptcha_admin::footer_save_button();
136 echo '</td></tr>';
137
138 echo '</tbody></table>';
139 }
140
141 static function tab_2fa()
142 {
143 echo '<div class="tab-content">';
144
145 echo '<table class="form-table"><tbody>';
146
147 echo '<tr valign="top">
148 <th scope="row" style="width:300px;"><label class="open-upsell open-upsell-block" for="2fa_email">Email Based Two Factor Authentication</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="2fa_email" class="open-upsell pro-label">PRO</a></th>
149 <td>';
150 echo '<div class="open-upsell open-upsell-block" data-feature="2fa_email">';
151 WPCaptcha_Utility::create_toggle_switch('2fa_email', array('saved_value' => 0, 'option_key' => ''));
152 echo '</div>';
153 echo '<span>After the correct username &amp; password are entered the user will receive an email with a one-time link to confirm the login.<br>In case somebody steals the username &amp; password they still won\'t be able to login without access to the account email.</span>';
154 echo '</td></tr>';
155
156 echo '<tr><td></td><td>';
157 echo '<p class="submit"><a class="button button-primary button-large open-upsell" data-feature="2fa-save">Save Changes <i class="wpcaptcha-icon wpcaptcha-checkmark"></i></a></p>';
158 echo '</td></tr>';
159
160 echo '</tbody></table>';
161
162 echo '</div>';
163 } // display
164
165 static function tab_cloud_protection()
166 {
167 echo '<div class="tab-content">';
168
169 echo '<table class="form-table"><tbody>';
170
171 echo '<tr valign="top">
172 <th scope="row"><label class="open-upsell open-upsell-block" for="cloud_use_account_lists">Use Account Whitelist &amp; Blacklist</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="cloud_use_account_lists" class="open-upsell pro-label">PRO</a></th>
173 <td>';
174 echo '<div class="open-upsell open-upsell-block" data-feature="cloud_use_account_lists">';
175 WPCaptcha_Utility::create_toggle_switch('cloud_use_account_lists', array('saved_value' => 0, 'option_key' => ''));
176 echo '</div>';
177 echo '<span>These lists are private and available only to your sites. Configure them in the WP Captcha Dashboard</span>';
178 echo '</td></tr>';
179
180 echo '<tr valign="top">
181 <th scope="row"><label class="open-upsell open-upsell-block" for="cloud_use_blacklist">Use Global Cloud Blacklist</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="cloud_use_account_lists" class="open-upsell pro-label">PRO</a></th>
182 <td>';
183 echo '<div class="open-upsell open-upsell-block" data-feature="cloud_use_blacklist">';
184 WPCaptcha_Utility::create_toggle_switch('cloud_use_blacklist', array('saved_value' => 0, 'option_key' => ''));
185 echo '</div>';
186 echo '<span>A list of bad IPs maintained daily by WebFactory, and based on realtime malicios activity observed on thousands of websites. IPs found on this list are trully bad and should not have access to your site.</span>';
187 echo '</td></tr>';
188
189 echo '<tr valign="top">
190 <th scope="row"><label class="open-upsell open-upsell-block" for="global_block">Cloud Block Type</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="cloud_global_block" class="open-upsell pro-label">PRO</a></th>
191 <td>';
192 echo '<label class="open-upsell open-upsell-block wpcaptcha-radio-option">';
193 echo '<span class="radio-container"><input type="radio" name="" id="cloud_global_block_global" value="1"><span class="radio"></span></span> Completely block website access';
194 echo '</label>';
195
196 echo '<label class="open-upsell open-upsell-block wpcaptcha-radio-option">';
197 echo '<span class="radio-container"><input type="radio" name="" id="cloud_global_block_login" value="0"><span class="radio"></span></span> Only block access to the login page';
198 echo '</label>';
199 echo '<span>Completely block website access for IPs on cloud blacklist, or just blocking access to the login page.</span>';
200 echo '</td></tr>';
201
202 echo '<tr valign="top">
203 <th scope="row"><label class="open-upsell open-upsell-block" for="block_message_cloud">Block Message</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="block_message_cloud" class="open-upsell pro-label">PRO</a></th>
204 <td><input type="text" class="open-upsell open-upsell-block regular-text" id="block_message_cloud" name="" value="We\'re sorry, but access from your IP is not allowed." />';
205 echo '<span>Message displayed to visitors blocked based on cloud lists. Default: <i>We\'re sorry, but access from your IP is not allowed.</i></span>';
206 echo '</td></tr>';
207
208 echo '<tr valign="top">
209 <th scope="row"><label class="open-upsell open-upsell-block">Cloud Whitelist</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="cloud_protection_whitelist" class="open-upsell pro-label">PRO</a></th>
210 <td><textarea class="open-upsell open-upsell-block" rows="4"></textarea>';
211 echo '<span>The Cloud Protection Whitelist can only be edited in the WP Captcha Dashboard</span>';
212 echo '</td></tr>';
213
214 echo '<tr valign="top">
215 <th scope="row"><label class="open-upsell open-upsell-block">Cloud Blacklist</label><a title="This feature is available in the PRO version. Click for details." href="#" data-feature="cloud_protection_blacklist" class="open-upsell pro-label">PRO</a></th>
216 <td><textarea class="open-upsell open-upsell-block" rows="4"></textarea>';
217 echo '<span>The Cloud Protection Blacklist can only be edited in the WP Captcha Dashboard</span>';
218 echo '</td></tr>';
219
220 echo '<tr><td></td><td>';
221 echo '<p class="submit"><a class="button button-primary button-large open-upsell" data-feature="cloud-protection-save">Save Changes <i class="wpcaptcha-icon wpcaptcha-checkmark"></i></a></p>';
222 echo '</td></tr>';
223
224 echo '</tbody></table>';
225
226 echo '</div>';
227 } // display
228
229 } // class WPCaptcha_Tab_Firewall
230