← All changes | src/controller/class-firewall.php +284 -204 5.3.1 → 6.3.0 View file →

		@@ -13,9 +13,9 @@
13	13	use WP_Defender\Traits\IP;
14	14	use Calotes\Component\Request;
15	15	use Calotes\Component\Response;
16	16	use Calotes\Helper\Array_Cache;
17		-use WP_Defender\Controller\Dashboard;
	17	+use WP_Defender\Component\Network_Cron_Manager;
18	18	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
19	19	use WP_Defender\Component\Mail;
20	20	use WP_Defender\Traits\Formats;
21	21	use WP_Defender\Model\Unlockout;
		@@ -26,9 +26,9 @@
26	26	use WP_Defender\Component\IP\Antibot_Global_Firewall as Antibot_Global_Firewall_Component;
27	27	use WP_Defender\Component\IP\Global_IP as Global_IP_Component;
28	28	use WP_Defender\Component\Blacklist_Lockout;
29	29	use WP_Defender\Component\Http\Remote_Address;
30		-use MaxMind\Db\Reader\InvalidDatabaseException;
	30	+use WP_DEFENDER_VENDOR\MaxMind\Db\Reader\InvalidDatabaseException;
31	31	use WP_Defender\Model\Setting\Notfound_Lockout;
32	32	use WP_Defender\Model\Setting\Global_Ip_Lockout;
33	33	use WP_Defender\Model\Setting\User_Agent_Lockout;
34	34	use WP_Defender\Component\Config\Config_Hub_Helper;
		@@ -84,14 +84,23 @@
84	84	*/
85	85	public $service_sid;
86	86
87	87	/**
	88	+ * The WPMUDEV instance used for interacting with WPMUDEV services.
	89	+ *
	90	+ * @var WPMUDEV
	91	+ */
	92	+ private $wpmudev;
	93	+
	94	+ /**
88	95	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
89	96	*/
90	97	public function __construct() {
91		- $title = esc_html__( 'Firewall', 'defender-security' );
	98	+ $this->wpmudev = wd_di()->get( WPMUDEV::class );
	99	+
	100	+ $title = esc_html__( 'Firewalls', 'defender-security' );
92	101	$this->register_page(
93		- $title,
	102	+ $this->get_title( $title ),
94	103	$this->slug,
95	104	array( $this, 'main_view' ),
96	105	$this->parent_slug,
97	106	null,
		@@ -110,118 +119,151 @@
110	119	wd_di()->get( Firewall_Logs::class );
111	120	wd_di()->get( UA_Lockout::class );
112	121	wd_di()->get( Global_Ip::class );
113	122	wd_di()->get( Antibot_Global_Firewall::class );
	123	+ wd_di()->get( Malicious_Bot::class );
	124	+ wd_di()->get( Fake_Bot_Detection::class );
114	125
115	126	// Integrate MainWP plugin.
116	127	wd_di()->get( Main_Wp::class );
117	128
118		- // We will schedule the time to clean up old firewall logs.
119		- if ( ! wp_next_scheduled( 'firewall_clean_up_logs' ) ) {
120		- wp_schedule_event( time() + 10, 'hourly', 'firewall_clean_up_logs' );
	129	+ /**
	130	+ * Network Cron Manager
	131	+ *
	132	+ * @var Network_Cron_Manager $network_cron_manager
	133	+ */
	134	+ $network_cron_manager = wd_di()->get( Network_Cron_Manager::class );
	135	+ $network_cron_manager->register_callback(
	136	+ 'firewall_clean_up_logs',
	137	+ array( $this->service, 'firewall_clean_up_logs' ),
	138	+ HOUR_IN_SECONDS,
	139	+ time() + 10
	140	+ );
	141	+ $network_cron_manager->register_callback(
	142	+ 'wpdef_firewall_clean_up_lockout',
	143	+ array( $this->service, 'firewall_clean_up_lockout' ),
	144	+ WEEK_IN_SECONDS,
	145	+ time() + 10
	146	+ );
	147	+ $network_cron_manager->register_callback(
	148	+ 'wpdef_firewall_clean_up_unlockout',
	149	+ array( $this, 'clean_up_unlockout' ),
	150	+ WEEK_IN_SECONDS,
	151	+ time() + 20
	152	+ );
	153	+ $network_cron_manager->register_callback(
	154	+ 'wpdef_firewall_fetch_trusted_proxy_preset_ips',
	155	+ array( $this->service, 'update_trusted_proxy_preset_ips' ),
	156	+ DAY_IN_SECONDS
	157	+ );
	158	+ if ( $this->service_sid->is_smart_ip_detection_enabled() ) {
	159	+ $network_cron_manager->register_callback(
	160	+ 'wpdef_smart_ip_detection_ping',
	161	+ array( $this->service_sid, 'smart_ip_detection_ping' ),
	162	+ WEEK_IN_SECONDS
	163	+ );
121	164	}
122		-
123		- // Schedule cleanup blocklist ips event.
124		- $this->schedule_cleanup_blocklist_ips_event();
125		-
126		- add_action( 'firewall_clean_up_logs', array( $this, 'clean_up_firewall_logs' ) );
127		- add_action( 'firewall_cleanup_temp_blocklist_ips', array( $this, 'clean_up_temporary_ip_blocklist' ) );
128		-
129		- // Clean unwanted records from lockout table.
130		- if ( ! wp_next_scheduled( 'wpdef_firewall_clean_up_lockout' ) ) {
131		- wp_schedule_event( time() + 10, 'weekly', 'wpdef_firewall_clean_up_lockout' );
132		- }
133		- add_action( 'wpdef_firewall_clean_up_lockout', array( $this, 'clean_up_firewall_lockout' ) );
134		- // Clean old Unlockouts.
135		- if ( ! wp_next_scheduled( 'wpdef_firewall_clean_up_unlockout' ) ) {
136		- wp_schedule_event( time() + 20, 'weekly', 'wpdef_firewall_clean_up_unlockout' );
137		- }
138		- add_action( 'wpdef_firewall_clean_up_unlockout', array( $this, 'clean_up_unlockout' ) );
139		-
	165	+ $network_cron_manager->register_callback(
	166	+ 'wpdef_firewall_whitelist_server_public_ip',
	167	+ array( $this->service, 'set_whitelist_server_public_ip' ),
	168	+ 12 * HOUR_IN_SECONDS,
	169	+ time() + 15
	170	+ );
140	171	// Additional hooks.
141	172	add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ), 11 );
142	173	add_action( 'admin_print_scripts', array( $this, 'print_emoji_script' ) );
143	174
144	175	$this->maybe_extend_mime_types();
145		-
146		- if ( ! wp_next_scheduled( 'wpdef_firewall_fetch_trusted_proxy_preset_ips' ) ) {
147		- wp_schedule_event( time(), 'daily', 'wpdef_firewall_fetch_trusted_proxy_preset_ips' );
148		- }
149		- add_action(
150		- 'wpdef_firewall_fetch_trusted_proxy_preset_ips',
151		- array(
152		- &
153		- $this,
154		- 'update_trusted_proxy_preset_ips',
155		- )
156		- );
157		-
	176	+ // Schedule cleanup blocklist ips event.
	177	+ $this->schedule_cleanup_blocklist_ips_event();
158	178	add_action( 'wp_ajax_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
159	179	add_action( 'wp_ajax_nopriv_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
160		- if ( $this->service_sid->is_smart_ip_detection_enabled() ) {
161		- if ( ! wp_next_scheduled( 'wpdef_smart_ip_detection_ping' ) ) {
162		- wp_schedule_event( time(), 'weekly', 'wpdef_smart_ip_detection_ping' );
163		- }
164		- add_action( 'wpdef_smart_ip_detection_ping', array( $this, 'smart_ip_detection_ping' ) );
165		- }
166		-
167		- /**
168		- * Whitelist server IP.
169		- */
170		- if ( ! wp_next_scheduled( 'wpdef_firewall_whitelist_server_public_ip' ) ) {
171		- wp_schedule_event( time() + 15, 'twicedaily', 'wpdef_firewall_whitelist_server_public_ip' );
172		- }
173		- add_action( 'wpdef_firewall_whitelist_server_public_ip', array( $this, 'whitelist_server_public_ip' ) );
174	180	}
175	181
176	182	/**
177		- * Get menu title.
	183	+ * Return the title of the page.
178	184	*
179		- * @param string $title The original menu title.
	185	+ * @param string $default_text The original menu title.
180	186	*
181	187	* @return string
182	188	*/
183		- protected function menu_title( string $title ): string {
184		- return $title;
	189	+ public function get_title( $default_text ): string {
	190	+ return $default_text;
185	191	}
186	192
187	193	/**
188		- * Clean up all the old logs from the local storage, this will happen per hourly basis.
	194	+ * Get menu title.
189	195	*
190		- * @return void
191		- * @throws Exception On failure.
	196	+ * @param string $default_text The original menu title.
	197	+ *
	198	+ * @return string
192	199	*/
193		- public function clean_up_firewall_logs(): void {
194		- $this->service->firewall_clean_up_logs();
	200	+ protected function menu_title( string $default_text ): string {
	201	+ return $default_text;
195	202	}
196	203
197	204	/**
198		- * Clean up temporary IP block list.
	205	+ * Sets up the preset firewall configuration.
199	206	*
	207	+ * @param bool $state The feature state.
	208	+ *
200	209	* @return void
201	210	*/
202		- public function clean_up_temporary_ip_blocklist(): void {
203		- $this->service->firewall_clean_up_temporary_ip_blocklist();
	211	+ public function preset_firewall( bool $state ) {
	212	+ // For every lockout.
	213	+ $ll = wd_di()->get( Login_Lockout_Model::class );
	214	+ $nf = wd_di()->get( Notfound_Lockout::class );
	215	+ $ua = wd_di()->get( User_Agent_Lockout::class );
	216	+
	217	+ $ll->enabled = $state;
	218	+ $ll->save();
	219	+ $nf->enabled = $state;
	220	+ $nf->save();
	221	+
	222	+ $old_malicious_bot_enabled = $ua->malicious_bot_enabled;
	223	+ $old_fake_bots_enabled = $ua->fake_bots_enabled;
	224	+ $ua->enabled = $state;
	225	+ if ( $state ) {
	226	+ $ua->malicious_bot_enabled = true;
	227	+ $ua->fake_bots_enabled = true;
	228	+ } else {
	229	+ $ua->malicious_bot_enabled = false;
	230	+ $ua->fake_bots_enabled = false;
	231	+ }
	232	+ $ua->save();
	233	+
	234	+ if ( $state && ! $old_malicious_bot_enabled ) {
	235	+ wd_di()->get( Malicious_Bot::class )->rotate_hash();
	236	+ } elseif ( ! $state ) {
	237	+ if ( $old_malicious_bot_enabled ) {
	238	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	239	+ }
	240	+ if ( $old_fake_bots_enabled ) {
	241	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	242	+ }
	243	+ }
	244	+
	245	+ Config_Hub_Helper::set_clear_active_flag();
204	246	}
205	247
206	248	/**
207		- * This is for handling request from dashboard.
	249	+ * Enable/disable lockout modules.
208	250	*
	251	+ * @param Request $request The request object.
	252	+ *
	253	+ * @return Response
209	254	* @defender_route
210		- * @return Response
211	255	*/
212		- public function dashboard_activation() {
213		- $il = wd_di()->get( Login_Lockout_Model::class );
214		- $nf = wd_di()->get( Notfound_Lockout::class );
215		- $ua = wd_di()->get( User_Agent_Lockout::class );
	256	+ public function toggle_lockout_modules( Request $request ): Response {
	257	+ $data = $request->get_data(
	258	+ array(
	259	+ 'enabled' => array(
	260	+ 'type' => 'boolean',
	261	+ ),
	262	+ )
	263	+ );
	264	+ $this->preset_firewall( $data['enabled'] );
216	265
217		- $il->enabled = true;
218		- $il->save();
219		- $nf->enabled = true;
220		- $nf->save();
221		- $ua->enabled = true;
222		- $ua->save();
223		-
224	266	return new Response( true, $this->to_array() );
225	267	}
226	268
227	269	/**
		@@ -250,9 +292,11 @@
250	292	$data['http_ip_header'],
251	293	Firewall_Service::custom_http_headers(),
252	294	true
253	295	)
254		- && ! empty( $data['trusted_proxy_preset'] )
	296	+ && isset( $data['trusted_proxy_preset'] )
	297	+ && is_string( $data['trusted_proxy_preset'] )
	298	+ && '' !== $data['trusted_proxy_preset']
255	299	&& $data['trusted_proxy_preset'] !== $this->model->trusted_proxy_preset
256	300	) {
257	301	$is_preset_update = true;
258	302	}
		@@ -350,20 +394,56 @@
350	394	/**
351	395	* Enqueues scripts and styles for this page.
352	396	* Only enqueues assets if the page is active.
353	397	*/
354		- public function enqueue_assets() {
	398	+ public function enqueue_assets(): void {
355	399	if ( ! $this->is_page_active() ) {
356	400	return;
357	401	}
358	402
	403	+ add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
359	404	wp_enqueue_media();
360	405
361		- wp_localize_script( 'def-iplockout', 'iplockout', $this->data_frontend() );
362		- wp_enqueue_script( 'def-iplockout' );
	406	+ $handle = 'defender-ui-firewalls';
	407	+ wp_enqueue_script(
	408	+ $handle,
	409	+ WP_DEFENDER_BASE_URL . 'assets/js/firewalls-ui.js',
	410	+ array( 'def-vue', 'def-manifest', 'def-core-ui', 'defender', 'wp-i18n' ),
	411	+ DEFENDER_VERSION,
	412	+ true
	413	+ );
	414	+ wp_set_script_translations( $handle, 'wpdef' );
	415	+
	416	+ wp_localize_script(
	417	+ $handle,
	418	+ 'defenderUIData',
	419	+ array_merge(
	420	+ $this->get_shared_data(),
	421	+ $this->data_frontend()
	422	+ )
	423	+ );
	424	+
	425	+ wp_enqueue_style(
	426	+ $handle,
	427	+ WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css',
	428	+ array(),
	429	+ DEFENDER_VERSION
	430	+ );
	431	+
363	432	$this->enqueue_main_assets();
	433	+ // Keep this action for backward compatibility with existing hooks.
	434	+ do_action( 'defender_ip_lockout_action_assets' );
	435	+ }
364	436
365		- do_action( 'defender_ip_lockout_action_assets' );
	437	+ /**
	438	+ * Add a Firewalls page marker class for scoped admin CSS overrides.
	439	+ *
	440	+ * @param string $classes Current admin body classes.
	441	+ *
	442	+ * @return string
	443	+ */
	444	+ public function admin_body_class( string $classes ): string {
	445	+ return trim( $classes . ' wdf-firewalls-react-page' );
366	446	}
367	447
368	448	/**
369	449	* Renders the preview of lockout screen.
		@@ -391,9 +471,9 @@
391	471	case 'blocklist':
392	472	$settings = wd_di()->get( Blacklist_Model::class );
393	473	$message = $settings->ip_lockout_message;
394	474	break;
395		- case 'ua-lockout':
	475	+ case User_Agent_Lockout::get_module_slug():
396	476	$settings = wd_di()->get( User_Agent_Lockout::class );
397	477	$message = $settings->message;
398	478	$remaining_time = 3600;
399	479	break;
		@@ -448,13 +528,10 @@
448	528	'sanitize' => 'sanitize_text_field',
449	529	),
450	530	)
451	531	);
452		- $maybe_email = $data['user_data'];
453		- if ( empty( $maybe_email ) ) {
454		- return new Response( false, array() );
455		- }
456		- $ips = $this->get_user_ip();
	532	+ $maybe_email = isset( $data['user_data'] ) ? $data['user_data'] : '';
	533	+ $ips = $this->get_user_ip();
457	534	// Check if at least one IP is blocked.
458	535	$blocked_ip = $this->service->get_blocked_ip( $ips );
459	536	// If nothing, just return.
460	537	if ( '' === $blocked_ip ) {
		@@ -459,8 +536,17 @@
459	536	// If nothing, just return.
460	537	if ( '' === $blocked_ip ) {
461	538	return new Response( false, array() );
462	539	}
	540	+ // Count every verification attempt and stop before account lookup or side effects when the limit is reached.
	541	+ if ( $this->check_attempt_counter_by( $blocked_ip ) ) {
	542	+ return new Response( false, array() );
	543	+ }
	544	+
	545	+ // Always return the same response for accepted attempts to avoid exposing account existence or role.
	546	+ if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) {
	547	+ return new Response( true, array() );
	548	+ }
463	549	// Maybe is it a user email?
464	550	$user = get_user_by( 'email', $maybe_email );
465	551	if ( ! is_object( $user ) ) {
466	552	// Maybe is it a username?
		@@ -465,21 +551,21 @@
465	551	if ( ! is_object( $user ) ) {
466	552	// Maybe is it a username?
467	553	$user = get_user_by( 'login', $maybe_email );
468	554	if ( ! is_object( $user ) ) {
469		- $this->check_attempt_counter_by( $blocked_ip );
470		-
471		- return new Response( false, array() );
	555	+ return new Response( true, array() );
472	556	}
473	557	}
474	558	// Send email only for admins.
475	559	if ( ! $this->is_admin( $user ) ) {
476		- // No need to count attempts for existed user but non-admin.
477		- return new Response( false, array() );
	560	+ return new Response( true, array() );
478	561	}
479	562	// Create Unlockout records.
480	563	$arr_uids = array();
481	564	foreach ( $ips as $ip ) {
	565	+ if ( Unlockout::has_pending_request( $ip, $user->user_email ) ) {
	566	+ continue;
	567	+ }
482	568	// Collect blocked IP's.
483	569	$created_id = wd_di()->get( Unlockout::class )->create( $ip, $user->user_email );
484	570	if ( $created_id ) {
485	571	$arr_uids[] = $created_id;
		@@ -485,9 +571,11 @@
485	571	$arr_uids[] = $created_id;
486	572	}
487	573	}
488	574
489		- $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	575	+ if ( array() !== $arr_uids ) {
	576	+ $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	577	+ }
490	578
491	579	return new Response( true, array() );
492	580	}
493	581
		@@ -527,9 +615,10 @@
527	615	$headers = wd_di()->get( Mail::class )->get_headers(
528	616	defender_noreply_email( 'wd_unlock_noreply_email' ),
529	617	Unlock_Me::SLUG_UNLOCK
530	618	);
531		- $subject = esc_html__( 'Request to Unblock IP Address', 'defender-security' );
	619	+ $subject = __( 'Request to Unblock IP Address', 'defender-security' );
	620	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
532	621
533	622	$content_body = $this->render_partial(
534	623	'email/unlockout',
535	624	array(
		@@ -560,16 +649,18 @@
560	649	* @param string $message The message to show.
561	650	* @param int $remaining_time Remaining countdown time in seconds.
562	651	* @param string $reason Block's reason.
563	652	* @param array $ips Array of blocked IP's.
	653	+ * @param bool $discourage_crawlers Whether to discourage crawlers with a noindex meta tag.
564	654	*
565	655	* @return void
566	656	*/
567		- private function actions_for_blocked(
	657	+ public function actions_for_blocked(
568	658	string $message,
569	659	int $remaining_time = 0,
570	660	string $reason = '',
571		- array $ips = array()
	661	+ array $ips = array(),
	662	+ bool $discourage_crawlers = false
572	663	): void {
573	664	$action = HTTP::get( 'action', false );
574	665
575	666	if ( defender_base_action() === $action ) {
		@@ -589,9 +680,9 @@
589	680	// We follow the default naming process to find the required cookie later.
590	681	$cookie_name = str_replace( '.', '_', $ips[0] );
591	682	$cookie_name = 'wpdef_lockout_' . $cookie_name;
592	683	if ( ! isset( $_COOKIE[ $cookie_name ] ) ) {
593		- setcookie( $cookie_name, true, time() + HOUR_IN_SECONDS, '/' );
	684	+ setcookie( $cookie_name, true, time() + HOUR_IN_SECONDS, '/', '', is_ssl(), true );
594	685	}
595	686	}
596	687
597	688	$global_service = wd_di()->get( Global_IP_Component::class );
		@@ -616,20 +707,23 @@
616	707	header( 'Pragma: no-cache' ); // HTTP 1.0.
617	708	header( 'Expires: ' . wp_date( 'D, d M Y H:i:s', time() - 3600 ) . ' GMT' ); // Proxies.
618	709	header( 'Clear-Site-Data: "cache"' ); // Clear cache of the current request.
619	710
620		- $global_ip_lockout = wd_di()->get( Global_Ip_Lockout::class );
621		- $is_displayed = Unlock_Me::is_displayed( $reason, $ips );
622		- $is_displayed_agf = $antibot_service->is_displayed( $ips );
623		- $allow_self_unlock = $global_ip_lockout->allow_self_unlock;
624		- $hide_btn_agf = $is_displayed_agf && ! $allow_self_unlock;
625		- $params = array(
626		- 'message' => ! $hide_btn_agf ? $message : '',
627		- 'remaining_time' => $remaining_time,
628		- 'is_unlock_me' => $is_displayed,
629		- 'is_unlock_me_agf' => $is_displayed_agf,
630		- 'module_name_agf' => Antibot_Global_Firewall_Setting::get_module_name(),
631		- 'hide_btn_agf' => $hide_btn_agf,
	711	+ $global_ip_lockout = wd_di()->get( Global_Ip_Lockout::class );
	712	+ $is_displayed = Unlock_Me::is_displayed( $reason, $ips );
	713	+ $is_displayed_agf = $antibot_service->is_displayed( $ips );
	714	+ $allow_self_unlock = $global_ip_lockout->allow_self_unlock;
	715	+ $hide_btn_agf = $is_displayed_agf && ! $allow_self_unlock;
	716	+ $malicious_bot = wd_di()->get( Malicious_Bot::class );
	717	+ $discourage_crawlers = ! $discourage_crawlers && $malicious_bot->is_hash_request() ? true : $discourage_crawlers;
	718	+ $params = array(
	719	+ 'message' => ! $hide_btn_agf ? $message : '',
	720	+ 'remaining_time' => $remaining_time,
	721	+ 'is_unlock_me' => $is_displayed,
	722	+ 'is_unlock_me_agf' => $is_displayed_agf,
	723	+ 'module_name_agf' => Antibot_Global_Firewall_Setting::get_module_name(),
	724	+ 'hide_btn_agf' => $hide_btn_agf,
	725	+ 'discourage_crawlers' => $discourage_crawlers,
632	726	);
633	727
634	728	// For AntiBot Global Firewall "Unlock me captcha".
635	729	if ( $is_displayed_agf && $allow_self_unlock ) {
		@@ -663,9 +757,9 @@
663	757	$params['action_send_again'] = add_query_arg( $args, admin_url( 'admin-ajax.php' ) );
664	758
665	759	$params['button_title'] = Unlock_Me::get_feature_title();
666	760	$button_disabled = false;
667		- if ( ! empty( $ips ) ) {
	761	+ if ( array() !== $ips ) {
668	762	// Get IP's.
669	763	$request_count = get_transient( $this->check_ip_by_remote_addr( $ips[0] ) );
670	764	$button_disabled = false !== $request_count && $request_count >= Unlock_Me::get_attempt_limit();
671	765	}
		@@ -724,9 +818,9 @@
724	818	$service_ua->block_user_agent_or_ip( $user_agent, $ip, User_Agent_Component::REASON_BAD_POST );
725	819
726	820	return $service_ua->get_message();
727	821	}
728		- if ( ! empty( $user_agent )
	822	+ if ( '' !== trim( $user_agent )
729	823	/**
730	824	* Apply additional checks for user agent before determining if it is a bad user agent.
731	825	*
732	826	* @param bool $is_bad_user_agent The result of checking if the user agent is bad.
		@@ -843,8 +937,16 @@
843	937	// Remove Global IP data.
844	938	( new Global_Ip() )->remove_data();
845	939	// Remove AntiBot Global Firewall data.
846	940	wd_di()->get( Antibot_Global_Firewall::class )->remove_data();
	941	+ // Remove Malicious Bot data.
	942	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	943	+ // Remove Fake Bot data.
	944	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	945	+ // Remove Firewall Logs data.
	946	+ wd_di()->get( Firewall_Logs::class )->remove_data();
	947	+ // Remove WAF data.
	948	+ wd_di()->get( WAF::class )->remove_data();
847	949	// Clear Trusted Proxy data.
848	950	$trusted_proxy_preset = wd_di()->get( Trusted_Proxy_Preset::class );
849	951	foreach ( array_keys( Firewall_Service::trusted_proxy_presets() ) as $preset ) {
850	952	$trusted_proxy_preset->set_proxy_preset( $preset );
		@@ -863,11 +965,11 @@
863	965	*
864	966	* @return array An array of data for the frontend.
865	967	*/
866	968	public function data_frontend(): array {
867		- $summary_data = $this->get_summary();
868	969	$user_ip = $this->get_user_ip();
869	970	$http_ip_header_value = $this->get_user_ip_header();
	971	+ $summary_data = $this->get_summary();
870	972
871	973	$data = array(
872	974	'login' => array(
873	975	'month' => $summary_data['lockout_login_this_month'],
		@@ -887,13 +989,8 @@
887	989	'month' => $summary_data['lockout_this_month'],
888	990	'day' => $summary_data['lockout_today'],
889	991	'last_lockout' => $summary_data['lockout_last'],
890	992	'settings' => $this->model->export(),
891		- 'login_lockout' => wd_di()->get( Login_Lockout_Model::class )->enabled,
892		- 'nf_lockout' => wd_di()->get( Notfound_Lockout::class )->enabled,
893		- 'report' => wd_di()->get( Firewall_Report::class )->to_string(),
894		- 'notification_lockout' => 'enabled' === wd_di()->get( Firewall_Notification::class )->status,
895		- 'ua_lockout' => wd_di()->get( User_Agent_Lockout::class )->enabled,
896	993	'user_ip' => implode( ', ', $user_ip ),
897	994	'user_ip_header' => $http_ip_header_value,
898	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
899	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
		@@ -898,8 +995,14 @@
898	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
899	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
900	997	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
901	998	'antibot' => wd_di()->get( Antibot_Global_Firewall::class )->data_frontend(),
	999	+ 'waf' => wd_di()->get( WAF::class )->data_frontend(),
	1000	+ 'loginLockout' => wd_di()->get( Login_Lockout::class )->data_frontend(),
	1001	+ 'nfLockout' => wd_di()->get( Nf_Lockout::class )->data_frontend(),
	1002	+ 'uaLockout' => wd_di()->get( UA_Lockout::class )->data_frontend(),
	1003	+ 'banning' => wd_di()->get( Blacklist::class )->data_frontend(),
	1004	+ 'logs' => wd_di()->get( Firewall_Logs::class )->data_frontend(),
902	1005	);
903	1006
904	1007	return array_merge( $data, $this->dump_routes_and_nonces() );
905	1008	}
		@@ -934,59 +1037,55 @@
934	1037	*
935	1038	* @return array An array of strings.
936	1039	*/
937	1040	public function export_strings(): array {
938		- $strings = array();
939		- $is_pro = ( new WPMUDEV() )->is_pro();
940		- $firewall_report = new Firewall_Report();
	1041	+ $strings = array();
941	1042	// Login lockout.
942	1043	$strings[] = Login_Lockout_Model::get_module_name() . ' '
943		- . Login_Lockout_Model::get_module_state( (bool) ( new Login_Lockout_Model() )->enabled );
	1044	+ . Login_Lockout_Model::get_module_state( ( new Login_Lockout_Model() )->enabled );
944	1045	// Notfound lockout.
945	1046	$strings[] = Notfound_Lockout::get_module_name() . ' '
946		- . Notfound_Lockout::get_module_state( (bool) ( new Notfound_Lockout() )->enabled );
	1047	+ . Notfound_Lockout::get_module_state( ( new Notfound_Lockout() )->enabled );
947	1048	// Global IP lockout.
948	1049	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
949		- . Global_Ip_Lockout::get_module_state( (bool) ( new Global_Ip_Lockout() )->enabled );
	1050	+ . Global_Ip_Lockout::get_module_state( ( new Global_Ip_Lockout() )->enabled );
	1051	+ // AntiBot Global Firewall.
	1052	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1053	+ . Antibot_Global_Firewall_Setting::get_module_state( ( new Antibot_Global_Firewall_Setting() )->enabled );
950	1054	// UA lockout.
951	1055	$strings[] = User_Agent_Lockout::get_module_name() . ' '
952		- . User_Agent_Lockout::get_module_state( (bool) ( new User_Agent_Lockout() )->enabled );
	1056	+ . User_Agent_Lockout::get_module_state( ( new User_Agent_Lockout() )->enabled );
953	1057	// Notifications and reports.
954	1058	if ( 'enabled' === ( new Firewall_Notification() )->status ) {
955	1059	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
956	1060	}
957		- if ( $is_pro && 'enabled' === $firewall_report->status ) {
958	1061	$strings[] = sprintf(
959		- /* translators: %s: Frequency value. */
960		- esc_html__( 'Email reports sending %s', 'defender-security' ),
961		- $firewall_report->frequency
	1062	+ /* translators: %s: Html for Pro-tag. */
	1063	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1064	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
962	1065	);
963		- } elseif ( ! $is_pro ) {
964	1066	$strings[] = sprintf(
965	1067	/* translators: %s: Html for Pro-tag. */
966		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1068	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
967	1069	'<span class="sui-tag sui-tag-pro">Pro</span>'
968	1070	);
969		- }
970	1071
971	1072	return $strings;
972	1073	}
973	1074
974	1075	/**
975		- * Generates configuration strings based on the provided configuration and
976		- * whether the product is a pro version.
	1076	+ * Generates configuration strings based on the provided configuration.
977	1077	*
978	1078	* @param array $config Configuration data.
979		- * @param bool $is_pro Indicates if the product is a pro version.
980	1079	*
981	1080	* @return array Returns an array of configuration strings.
982	1081	*/
983		- public function config_strings( array $config, bool $is_pro ): array {
	1082	+ public function config_strings( array $config ): array {
984	1083	$strings = array();
985	1084	// Login lockout.
986	1085	if ( isset( $config['login_protection'] ) ) {
987	1086	$strings[] = Login_Lockout_Model::get_module_name() . ' '
988		- . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
	1087	+ . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
989	1088	}
990	1089	// NF lockout.
991	1090	if ( isset( $config['detect_404'] ) ) {
992	1091	$strings[] = Notfound_Lockout::get_module_name() . ' '
		@@ -996,8 +1095,13 @@
996	1095	if ( isset( $config['global_ip_list'] ) ) {
997	1096	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
998	1097	. Global_Ip_Lockout::get_module_state( (bool) $config['global_ip_list'] );
999	1098	}
	1099	+ // AntiBot Global Firewall.
	1100	+ if ( isset( $config['antibot'] ) ) {
	1101	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1102	+ . Antibot_Global_Firewall_Setting::get_module_state( (bool) $config['antibot'] );
	1103	+ }
1000	1104	// UA lockout.
1001	1105	if ( isset( $config['ua_banning_enabled'] ) ) {
1002	1106	$strings[] = User_Agent_Lockout::get_module_name() . ' '
1003	1107	. User_Agent_Lockout::get_module_state( (bool) $config['ua_banning_enabled'] );
		@@ -1005,22 +1109,18 @@
1005	1109	// Notifications.
1006	1110	if ( isset( $config['notification'] ) && 'enabled' === $config['notification'] ) {
1007	1111	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
1008	1112	}
1009		- // Report.
1010		- if ( $is_pro && 'enabled' === $config['report'] ) {
1011	1113	$strings[] = sprintf(
1012		- /* translators: %s: Frequency value. */
1013		- esc_html__( 'Email reports sending %s', 'defender-security' ),
1014		- $config['report_frequency']
	1114	+ /* translators: %s: Html for Pro-tag. */
	1115	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1116	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
1015	1117	);
1016		- } elseif ( ! $is_pro ) {
1017	1118	$strings[] = sprintf(
1018		- /* translators: %s: Html for Pro-tag. */
1019		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1119	+ /* translators: %s: Html for Pro-tag. */
	1120	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
1020	1121	'<span class="sui-tag sui-tag-pro">Pro</span>'
1021	1122	);
1022		- }
1023	1123
1024	1124	return $strings;
1025	1125	}
1026	1126
		@@ -1034,23 +1134,35 @@
1034	1134	if ( defined( 'DOING_AJAX' ) || defined( 'DOING_CRON' ) ) {
1035	1135	return;
1036	1136	}
1037	1137
1038		- $clear = get_site_option( 'wpdef_clear_schedule_firewall_cleanup_temp_blocklist_ips', false );
1039		- if ( $clear ) {
1040		- wp_clear_scheduled_hook( 'firewall_cleanup_temp_blocklist_ips' );
1041		- }
1042		-
1043		- if ( wp_next_scheduled( 'firewall_cleanup_temp_blocklist_ips' ) ) {
1044		- return;
1045		- }
1046		-
1047	1138	$interval = $this->model->ip_blocklist_cleanup_interval;
1048	1139	if ( ! $interval || 'never' === $interval ) {
1049	1140	return;
1050	1141	}
1051	1142
1052		- wp_schedule_event( time() + 15, $interval, 'firewall_cleanup_temp_blocklist_ips' );
	1143	+ $interval_map = array(
	1144	+ 'daily' => DAY_IN_SECONDS,
	1145	+ 'weekly' => WEEK_IN_SECONDS,
	1146	+ 'monthly' => MONTH_IN_SECONDS,
	1147	+ );
	1148	+ /**
	1149	+ * Network Cron Manager
	1150	+ *
	1151	+ * @var Network_Cron_Manager $network_cron_manager
	1152	+ */
	1153	+ $network_cron_manager = wd_di()->get( Network_Cron_Manager::class );
	1154	+ $network_cron_manager->register_callback(
	1155	+ 'firewall_cleanup_temp_blocklist_ips',
	1156	+ array( $this->service, 'firewall_clean_up_temporary_ip_blocklist' ),
	1157	+ $interval_map[ $interval ],
	1158	+ time() + 15
	1159	+ );
	1160	+
	1161	+ $clear = get_site_option( 'wpdef_clear_schedule_firewall_cleanup_temp_blocklist_ips', false );
	1162	+ if ( true === $clear ) {
	1163	+ wp_clear_scheduled_hook( 'firewall_cleanup_temp_blocklist_ips' );
	1164	+ }
1053	1165	}
1054	1166
1055	1167	/**
1056	1168	* Maybe add a filter to extend mime types.
		@@ -1063,9 +1175,9 @@
1063	1175	$server = defender_get_data_from_request( null, 's' );
1064	1176	$current_url = set_url_scheme( 'http://' . $server['HTTP_HOST'] . $server['REQUEST_URI'] );
1065	1177	$current_query = wp_parse_url( $current_url, PHP_URL_QUERY );
1066	1178	$current_query = $current_query ?? '';
1067		- $referer_url = ! empty( $server['HTTP_REFERER'] ) ?
	1179	+ $referer_url = isset( $server['HTTP_REFERER'] ) && '' !== trim( $server['HTTP_REFERER'] ) ?
1068	1180	filter_var( $server['HTTP_REFERER'], FILTER_SANITIZE_URL ) :
1069	1181	'';
1070	1182	$referer_query = wp_parse_url( $referer_url, PHP_URL_QUERY );
1071	1183	$referer_query = $referer_query ?? '';
		@@ -1074,12 +1186,12 @@
1074	1186	parse_str( $referer_query, $referer_queries );
1075	1187
1076	1188	if (
1077	1189	( preg_match( '#^' . network_admin_url() . '#i', $current_url ) &&
1078		- ! empty( $current_queries['page'] ) && $this->slug === $current_queries['page']
	1190	+ isset( $current_queries['page'] ) && '' !== trim( $current_queries['page'] ) && $this->slug === $current_queries['page']
1079	1191	) ||
1080	1192	( preg_match( '#^' . network_admin_url() . '#i', $referer_url ) &&
1081		- ! empty( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
	1193	+ isset( $referer_queries['page'] ) && '' !== trim( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
1082	1194	)
1083	1195	) {
1084	1196	// Add action hook here.
1085	1197	add_filter( 'upload_mimes', array( $this, 'extend_mime_types' ) );
		@@ -1094,9 +1206,9 @@
1094	1206	*
1095	1207	* @return array
1096	1208	*/
1097	1209	public function extend_mime_types( array $types ) {
1098		- if ( empty( $types['csv'] ) ) {
	1210	+ if ( ! isset( $types['csv'] ) || ! is_string( $types['csv'] ) || '' === trim( $types['csv'] ) ) {
1099	1211	$types['csv'] = 'text/csv';
1100	1212	}
1101	1213
1102	1214	return $types;
		@@ -1109,9 +1221,12 @@
1109	1221	* @defender_route
1110	1222	* @since 3.3.0
1111	1223	*/
1112	1224	public function empty_lockouts() {
1113		- if ( Lockout_Ip::truncate() ) {
	1225	+ $ip_deleted = Lockout_Ip::truncate();
	1226	+ $log_deleted = Lockout_Log::delete_lockout_records();
	1227	+
	1228	+ if ( false !== $ip_deleted && false !== $log_deleted ) {
1114	1229	$this->log( 'Deleted lockout records successfully.', self::FIREWALL_LOG );
1115	1230
1116	1231	return new Response(
1117	1232	true,
		@@ -1175,9 +1290,9 @@
1175	1290	*/
1176	1291	public function print_emoji_script(): void {
1177	1292	$allowed_pages = array(
1178	1293	$this->slug,
1179		- wd_di()->get( Dashboard::class )->slug,
	1294	+ wd_di()->get( \WP_Defender\Controller\Dashboard::class )->slug,
1180	1295	);
1181	1296
1182	1297	if ( in_array( HTTP::get( 'page' ), $allowed_pages, true ) ) {
1183	1298	if ( ! function_exists( 'print_emoji_detection_script' ) ) {
		@@ -1189,18 +1304,8 @@
1189	1304	}
1190	1305	}
1191	1306
1192	1307	/**
1193		- * Clean up unwanted records from lockout table.
1194		- *
1195		- * @return void
1196		- * @since 3.8.0
1197		- */
1198		- public function clean_up_firewall_lockout(): void {
1199		- $this->service->firewall_clean_up_lockout();
1200		- }
1201		-
1202		- /**
1203	1308	* Gather IP(s) from various headers and check if any IP is blacklisted, or temporary banned.
1204	1309	*
1205	1310	* @return void
1206	1311	* @since 4.4.2
		@@ -1208,18 +1313,18 @@
1208	1313	public function maybe_lockout_gathered_ips(): void {
1209	1314	$msg = '';
1210	1315	$ips = $this->service->get_user_ip();
1211	1316
1212		- if ( ! empty( $ips ) && is_array( $ips ) ) {
	1317	+ if ( array() !== $ips ) {
1213	1318	foreach ( $ips as $ip ) {
1214	1319	$result = $this->maybe_lockout( $ip );
1215		- if ( empty( $msg ) && ! empty( $result ) ) {
	1320	+ if ( '' === $msg && is_string( $result ) && '' !== trim( $result ) ) {
1216	1321	$msg = $result;
1217	1322	}
1218	1323	}
1219	1324	}
1220	1325
1221		- if ( ! empty( $msg ) ) {
	1326	+ if ( '' !== $msg ) {
1222	1327	$this->actions_for_blocked( $msg, 0, 'blacklist', $ips );
1223	1328	}
1224	1329	}
1225	1330
		@@ -1234,17 +1339,8 @@
1234	1339	Unlockout::remove_records( $timestamp, 100 );
1235	1340	}
1236	1341
1237	1342	/**
1238		- * Update trusted proxy preset IPs periodically.
1239		- *
1240		- * @return void
1241		- */
1242		- public function update_trusted_proxy_preset_ips(): void {
1243		- $this->service->update_trusted_proxy_preset_ips();
1244		- }
1245		-
1246		- /**
1247	1343	* Handle the request to detect the IP header.
1248	1344	*
1249	1345	* @return void
1250	1346	*/
		@@ -1251,9 +1347,9 @@
1251	1347	public function handle_detect_ip_header(): void {
1252	1348	$nonce = defender_get_data_from_request( 'nonce', 'g' );
1253	1349	$nonce_ctx = Smart_Ip_Detection::get_nonce_context();
1254	1350
1255		- if ( empty( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
	1351	+ if ( ! is_string( $nonce ) || '' === trim( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
1256	1352	wp_send_json_error( __( 'Invalid nonce.', 'defender-security' ) );
1257	1353	}
1258	1354
1259	1355	delete_transient( $nonce_ctx );
		@@ -1270,17 +1366,8 @@
1270	1366	}
1271	1367	}
1272	1368
1273	1369	/**
1274		- * Schedule to send request to the API for smart IP detection.
1275		- *
1276		- * @return void
1277		- */
1278		- public function smart_ip_detection_ping(): void {
1279		- $this->service_sid->smart_ip_detection_ping();
1280		- }
1281		-
1282		- /**
1283	1370	* Unlock user from AntiBot Global Firewall blocklist.
1284	1371	*
1285	1372	* @return Response
1286	1373	* @defender_route
		@@ -1313,8 +1400,11 @@
1313	1400	'signature' => defender_get_data_from_request( 'signature', 'r' ),
1314	1401	'number' => defender_get_data_from_request( 'solution', 'r' ),
1315	1402	);
1316	1403
	1404	+ // 'number' should be an integer.
	1405	+ $captcha_payload['number'] = is_numeric( $captcha_payload['number'] ) ? (int) $captcha_payload['number'] : null;
	1406	+
1317	1407	// Successful verification of captcha.
1318	1408	if ( '0' === $captcha_checkbox && wd_di()->get( Altcha_Handler::class )->verify_solution( $captcha_payload ) ) {
1319	1409	// Reset attempt data for all IPs in a batch.
1320	1410	foreach ( $user_ips as $ip ) {
		@@ -1342,16 +1432,6 @@
1342	1432
1343	1433	$this->log( 'Captcha verification failed for IP(s): ' . implode( ', ', $user_ips ), Altcha_Handler::LOG_FILE_NAME );
1344	1434
1345	1435	return new Response( false, array( 'message' => esc_html__( 'Captcha verification failed. Please try again.', 'defender-security' ) ) );
1346		- }
1347		-
1348		- /**
1349		- * Whitelist server public IP.
1350		- *
1351		- * @return void
1352		- * @since 5.0.2
1353		- */
1354		- public function whitelist_server_public_ip(): void {
1355		- $this->service->set_whitelist_server_public_ip();
1356	1436	}
1357	1437	}