← All changes | src/controller/class-firewall.php +283 -206 5.5.1 → 6.3.0 View file →

		@@ -13,9 +13,9 @@
13	13	use WP_Defender\Traits\IP;
14	14	use Calotes\Component\Request;
15	15	use Calotes\Component\Response;
16	16	use Calotes\Helper\Array_Cache;
17		-use WP_Defender\Controller\Dashboard;
	17	+use WP_Defender\Component\Network_Cron_Manager;
18	18	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
19	19	use WP_Defender\Component\Mail;
20	20	use WP_Defender\Traits\Formats;
21	21	use WP_Defender\Model\Unlockout;
		@@ -26,9 +26,9 @@
26	26	use WP_Defender\Component\IP\Antibot_Global_Firewall as Antibot_Global_Firewall_Component;
27	27	use WP_Defender\Component\IP\Global_IP as Global_IP_Component;
28	28	use WP_Defender\Component\Blacklist_Lockout;
29	29	use WP_Defender\Component\Http\Remote_Address;
30		-use MaxMind\Db\Reader\InvalidDatabaseException;
	30	+use WP_DEFENDER_VENDOR\MaxMind\Db\Reader\InvalidDatabaseException;
31	31	use WP_Defender\Model\Setting\Notfound_Lockout;
32	32	use WP_Defender\Model\Setting\Global_Ip_Lockout;
33	33	use WP_Defender\Model\Setting\User_Agent_Lockout;
34	34	use WP_Defender\Component\Config\Config_Hub_Helper;
		@@ -84,14 +84,23 @@
84	84	*/
85	85	public $service_sid;
86	86
87	87	/**
	88	+ * The WPMUDEV instance used for interacting with WPMUDEV services.
	89	+ *
	90	+ * @var WPMUDEV
	91	+ */
	92	+ private $wpmudev;
	93	+
	94	+ /**
88	95	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
89	96	*/
90	97	public function __construct() {
91		- $title = esc_html__( 'Firewall', 'defender-security' );
	98	+ $this->wpmudev = wd_di()->get( WPMUDEV::class );
	99	+
	100	+ $title = esc_html__( 'Firewalls', 'defender-security' );
92	101	$this->register_page(
93		- $title,
	102	+ $this->get_title( $title ),
94	103	$this->slug,
95	104	array( $this, 'main_view' ),
96	105	$this->parent_slug,
97	106	null,
		@@ -110,119 +119,151 @@
110	119	wd_di()->get( Firewall_Logs::class );
111	120	wd_di()->get( UA_Lockout::class );
112	121	wd_di()->get( Global_Ip::class );
113	122	wd_di()->get( Antibot_Global_Firewall::class );
114		- wd_di()->get( Bot_Trap::class );
	123	+ wd_di()->get( Malicious_Bot::class );
	124	+ wd_di()->get( Fake_Bot_Detection::class );
115	125
116	126	// Integrate MainWP plugin.
117	127	wd_di()->get( Main_Wp::class );
118	128
119		- // We will schedule the time to clean up old firewall logs.
120		- if ( ! wp_next_scheduled( 'firewall_clean_up_logs' ) ) {
121		- wp_schedule_event( time() + 10, 'hourly', 'firewall_clean_up_logs' );
	129	+ /**
	130	+ * Network Cron Manager
	131	+ *
	132	+ * @var Network_Cron_Manager $network_cron_manager
	133	+ */
	134	+ $network_cron_manager = wd_di()->get( Network_Cron_Manager::class );
	135	+ $network_cron_manager->register_callback(
	136	+ 'firewall_clean_up_logs',
	137	+ array( $this->service, 'firewall_clean_up_logs' ),
	138	+ HOUR_IN_SECONDS,
	139	+ time() + 10
	140	+ );
	141	+ $network_cron_manager->register_callback(
	142	+ 'wpdef_firewall_clean_up_lockout',
	143	+ array( $this->service, 'firewall_clean_up_lockout' ),
	144	+ WEEK_IN_SECONDS,
	145	+ time() + 10
	146	+ );
	147	+ $network_cron_manager->register_callback(
	148	+ 'wpdef_firewall_clean_up_unlockout',
	149	+ array( $this, 'clean_up_unlockout' ),
	150	+ WEEK_IN_SECONDS,
	151	+ time() + 20
	152	+ );
	153	+ $network_cron_manager->register_callback(
	154	+ 'wpdef_firewall_fetch_trusted_proxy_preset_ips',
	155	+ array( $this->service, 'update_trusted_proxy_preset_ips' ),
	156	+ DAY_IN_SECONDS
	157	+ );
	158	+ if ( $this->service_sid->is_smart_ip_detection_enabled() ) {
	159	+ $network_cron_manager->register_callback(
	160	+ 'wpdef_smart_ip_detection_ping',
	161	+ array( $this->service_sid, 'smart_ip_detection_ping' ),
	162	+ WEEK_IN_SECONDS
	163	+ );
122	164	}
123		-
124		- // Schedule cleanup blocklist ips event.
125		- $this->schedule_cleanup_blocklist_ips_event();
126		-
127		- add_action( 'firewall_clean_up_logs', array( $this, 'clean_up_firewall_logs' ) );
128		- add_action( 'firewall_cleanup_temp_blocklist_ips', array( $this, 'clean_up_temporary_ip_blocklist' ) );
129		-
130		- // Clean unwanted records from lockout table.
131		- if ( ! wp_next_scheduled( 'wpdef_firewall_clean_up_lockout' ) ) {
132		- wp_schedule_event( time() + 10, 'weekly', 'wpdef_firewall_clean_up_lockout' );
133		- }
134		- add_action( 'wpdef_firewall_clean_up_lockout', array( $this, 'clean_up_firewall_lockout' ) );
135		- // Clean old Unlockouts.
136		- if ( ! wp_next_scheduled( 'wpdef_firewall_clean_up_unlockout' ) ) {
137		- wp_schedule_event( time() + 20, 'weekly', 'wpdef_firewall_clean_up_unlockout' );
138		- }
139		- add_action( 'wpdef_firewall_clean_up_unlockout', array( $this, 'clean_up_unlockout' ) );
140		-
	165	+ $network_cron_manager->register_callback(
	166	+ 'wpdef_firewall_whitelist_server_public_ip',
	167	+ array( $this->service, 'set_whitelist_server_public_ip' ),
	168	+ 12 * HOUR_IN_SECONDS,
	169	+ time() + 15
	170	+ );
141	171	// Additional hooks.
142	172	add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ), 11 );
143	173	add_action( 'admin_print_scripts', array( $this, 'print_emoji_script' ) );
144	174
145	175	$this->maybe_extend_mime_types();
146		-
147		- if ( ! wp_next_scheduled( 'wpdef_firewall_fetch_trusted_proxy_preset_ips' ) ) {
148		- wp_schedule_event( time(), 'daily', 'wpdef_firewall_fetch_trusted_proxy_preset_ips' );
149		- }
150		- add_action(
151		- 'wpdef_firewall_fetch_trusted_proxy_preset_ips',
152		- array(
153		- &
154		- $this,
155		- 'update_trusted_proxy_preset_ips',
156		- )
157		- );
158		-
	176	+ // Schedule cleanup blocklist ips event.
	177	+ $this->schedule_cleanup_blocklist_ips_event();
159	178	add_action( 'wp_ajax_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
160	179	add_action( 'wp_ajax_nopriv_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
161		- if ( $this->service_sid->is_smart_ip_detection_enabled() ) {
162		- if ( ! wp_next_scheduled( 'wpdef_smart_ip_detection_ping' ) ) {
163		- wp_schedule_event( time(), 'weekly', 'wpdef_smart_ip_detection_ping' );
164		- }
165		- add_action( 'wpdef_smart_ip_detection_ping', array( $this, 'smart_ip_detection_ping' ) );
166		- }
167		-
168		- /**
169		- * Whitelist server IP.
170		- */
171		- if ( ! wp_next_scheduled( 'wpdef_firewall_whitelist_server_public_ip' ) ) {
172		- wp_schedule_event( time() + 15, 'twicedaily', 'wpdef_firewall_whitelist_server_public_ip' );
173		- }
174		- add_action( 'wpdef_firewall_whitelist_server_public_ip', array( $this, 'whitelist_server_public_ip' ) );
175	180	}
176	181
177	182	/**
178		- * Get menu title.
	183	+ * Return the title of the page.
179	184	*
180		- * @param string $title The original menu title.
	185	+ * @param string $default_text The original menu title.
181	186	*
182	187	* @return string
183	188	*/
184		- protected function menu_title( string $title ): string {
185		- return $title;
	189	+ public function get_title( $default_text ): string {
	190	+ return $default_text;
186	191	}
187	192
188	193	/**
189		- * Clean up all the old logs from the local storage, this will happen per hourly basis.
	194	+ * Get menu title.
190	195	*
191		- * @return void
192		- * @throws Exception On failure.
	196	+ * @param string $default_text The original menu title.
	197	+ *
	198	+ * @return string
193	199	*/
194		- public function clean_up_firewall_logs(): void {
195		- $this->service->firewall_clean_up_logs();
	200	+ protected function menu_title( string $default_text ): string {
	201	+ return $default_text;
196	202	}
197	203
198	204	/**
199		- * Clean up temporary IP block list.
	205	+ * Sets up the preset firewall configuration.
200	206	*
	207	+ * @param bool $state The feature state.
	208	+ *
201	209	* @return void
202	210	*/
203		- public function clean_up_temporary_ip_blocklist(): void {
204		- $this->service->firewall_clean_up_temporary_ip_blocklist();
	211	+ public function preset_firewall( bool $state ) {
	212	+ // For every lockout.
	213	+ $ll = wd_di()->get( Login_Lockout_Model::class );
	214	+ $nf = wd_di()->get( Notfound_Lockout::class );
	215	+ $ua = wd_di()->get( User_Agent_Lockout::class );
	216	+
	217	+ $ll->enabled = $state;
	218	+ $ll->save();
	219	+ $nf->enabled = $state;
	220	+ $nf->save();
	221	+
	222	+ $old_malicious_bot_enabled = $ua->malicious_bot_enabled;
	223	+ $old_fake_bots_enabled = $ua->fake_bots_enabled;
	224	+ $ua->enabled = $state;
	225	+ if ( $state ) {
	226	+ $ua->malicious_bot_enabled = true;
	227	+ $ua->fake_bots_enabled = true;
	228	+ } else {
	229	+ $ua->malicious_bot_enabled = false;
	230	+ $ua->fake_bots_enabled = false;
	231	+ }
	232	+ $ua->save();
	233	+
	234	+ if ( $state && ! $old_malicious_bot_enabled ) {
	235	+ wd_di()->get( Malicious_Bot::class )->rotate_hash();
	236	+ } elseif ( ! $state ) {
	237	+ if ( $old_malicious_bot_enabled ) {
	238	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	239	+ }
	240	+ if ( $old_fake_bots_enabled ) {
	241	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	242	+ }
	243	+ }
	244	+
	245	+ Config_Hub_Helper::set_clear_active_flag();
205	246	}
206	247
207	248	/**
208		- * This is for handling request from dashboard.
	249	+ * Enable/disable lockout modules.
209	250	*
	251	+ * @param Request $request The request object.
	252	+ *
	253	+ * @return Response
210	254	* @defender_route
211		- * @return Response
212	255	*/
213		- public function dashboard_activation() {
214		- $il = wd_di()->get( Login_Lockout_Model::class );
215		- $nf = wd_di()->get( Notfound_Lockout::class );
216		- $ua = wd_di()->get( User_Agent_Lockout::class );
	256	+ public function toggle_lockout_modules( Request $request ): Response {
	257	+ $data = $request->get_data(
	258	+ array(
	259	+ 'enabled' => array(
	260	+ 'type' => 'boolean',
	261	+ ),
	262	+ )
	263	+ );
	264	+ $this->preset_firewall( $data['enabled'] );
217	265
218		- $il->enabled = true;
219		- $il->save();
220		- $nf->enabled = true;
221		- $nf->save();
222		- $ua->enabled = true;
223		- $ua->save();
224		-
225	266	return new Response( true, $this->to_array() );
226	267	}
227	268
228	269	/**
		@@ -251,9 +292,11 @@
251	292	$data['http_ip_header'],
252	293	Firewall_Service::custom_http_headers(),
253	294	true
254	295	)
255		- && ! empty( $data['trusted_proxy_preset'] )
	296	+ && isset( $data['trusted_proxy_preset'] )
	297	+ && is_string( $data['trusted_proxy_preset'] )
	298	+ && '' !== $data['trusted_proxy_preset']
256	299	&& $data['trusted_proxy_preset'] !== $this->model->trusted_proxy_preset
257	300	) {
258	301	$is_preset_update = true;
259	302	}
		@@ -351,20 +394,56 @@
351	394	/**
352	395	* Enqueues scripts and styles for this page.
353	396	* Only enqueues assets if the page is active.
354	397	*/
355		- public function enqueue_assets() {
	398	+ public function enqueue_assets(): void {
356	399	if ( ! $this->is_page_active() ) {
357	400	return;
358	401	}
359	402
	403	+ add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
360	404	wp_enqueue_media();
361	405
362		- wp_localize_script( 'def-iplockout', 'iplockout', $this->data_frontend() );
363		- wp_enqueue_script( 'def-iplockout' );
	406	+ $handle = 'defender-ui-firewalls';
	407	+ wp_enqueue_script(
	408	+ $handle,
	409	+ WP_DEFENDER_BASE_URL . 'assets/js/firewalls-ui.js',
	410	+ array( 'def-vue', 'def-manifest', 'def-core-ui', 'defender', 'wp-i18n' ),
	411	+ DEFENDER_VERSION,
	412	+ true
	413	+ );
	414	+ wp_set_script_translations( $handle, 'wpdef' );
	415	+
	416	+ wp_localize_script(
	417	+ $handle,
	418	+ 'defenderUIData',
	419	+ array_merge(
	420	+ $this->get_shared_data(),
	421	+ $this->data_frontend()
	422	+ )
	423	+ );
	424	+
	425	+ wp_enqueue_style(
	426	+ $handle,
	427	+ WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css',
	428	+ array(),
	429	+ DEFENDER_VERSION
	430	+ );
	431	+
364	432	$this->enqueue_main_assets();
	433	+ // Keep this action for backward compatibility with existing hooks.
	434	+ do_action( 'defender_ip_lockout_action_assets' );
	435	+ }
365	436
366		- do_action( 'defender_ip_lockout_action_assets' );
	437	+ /**
	438	+ * Add a Firewalls page marker class for scoped admin CSS overrides.
	439	+ *
	440	+ * @param string $classes Current admin body classes.
	441	+ *
	442	+ * @return string
	443	+ */
	444	+ public function admin_body_class( string $classes ): string {
	445	+ return trim( $classes . ' wdf-firewalls-react-page' );
367	446	}
368	447
369	448	/**
370	449	* Renders the preview of lockout screen.
		@@ -392,9 +471,9 @@
392	471	case 'blocklist':
393	472	$settings = wd_di()->get( Blacklist_Model::class );
394	473	$message = $settings->ip_lockout_message;
395	474	break;
396		- case 'ua-lockout':
	475	+ case User_Agent_Lockout::get_module_slug():
397	476	$settings = wd_di()->get( User_Agent_Lockout::class );
398	477	$message = $settings->message;
399	478	$remaining_time = 3600;
400	479	break;
		@@ -449,13 +528,10 @@
449	528	'sanitize' => 'sanitize_text_field',
450	529	),
451	530	)
452	531	);
453		- $maybe_email = $data['user_data'];
454		- if ( empty( $maybe_email ) ) {
455		- return new Response( false, array() );
456		- }
457		- $ips = $this->get_user_ip();
	532	+ $maybe_email = isset( $data['user_data'] ) ? $data['user_data'] : '';
	533	+ $ips = $this->get_user_ip();
458	534	// Check if at least one IP is blocked.
459	535	$blocked_ip = $this->service->get_blocked_ip( $ips );
460	536	// If nothing, just return.
461	537	if ( '' === $blocked_ip ) {
		@@ -460,8 +536,17 @@
460	536	// If nothing, just return.
461	537	if ( '' === $blocked_ip ) {
462	538	return new Response( false, array() );
463	539	}
	540	+ // Count every verification attempt and stop before account lookup or side effects when the limit is reached.
	541	+ if ( $this->check_attempt_counter_by( $blocked_ip ) ) {
	542	+ return new Response( false, array() );
	543	+ }
	544	+
	545	+ // Always return the same response for accepted attempts to avoid exposing account existence or role.
	546	+ if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) {
	547	+ return new Response( true, array() );
	548	+ }
464	549	// Maybe is it a user email?
465	550	$user = get_user_by( 'email', $maybe_email );
466	551	if ( ! is_object( $user ) ) {
467	552	// Maybe is it a username?
		@@ -466,21 +551,21 @@
466	551	if ( ! is_object( $user ) ) {
467	552	// Maybe is it a username?
468	553	$user = get_user_by( 'login', $maybe_email );
469	554	if ( ! is_object( $user ) ) {
470		- $this->check_attempt_counter_by( $blocked_ip );
471		-
472		- return new Response( false, array() );
	555	+ return new Response( true, array() );
473	556	}
474	557	}
475	558	// Send email only for admins.
476	559	if ( ! $this->is_admin( $user ) ) {
477		- // No need to count attempts for existed user but non-admin.
478		- return new Response( false, array() );
	560	+ return new Response( true, array() );
479	561	}
480	562	// Create Unlockout records.
481	563	$arr_uids = array();
482	564	foreach ( $ips as $ip ) {
	565	+ if ( Unlockout::has_pending_request( $ip, $user->user_email ) ) {
	566	+ continue;
	567	+ }
483	568	// Collect blocked IP's.
484	569	$created_id = wd_di()->get( Unlockout::class )->create( $ip, $user->user_email );
485	570	if ( $created_id ) {
486	571	$arr_uids[] = $created_id;
		@@ -486,9 +571,11 @@
486	571	$arr_uids[] = $created_id;
487	572	}
488	573	}
489	574
490		- $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	575	+ if ( array() !== $arr_uids ) {
	576	+ $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	577	+ }
491	578
492	579	return new Response( true, array() );
493	580	}
494	581
		@@ -528,9 +615,10 @@
528	615	$headers = wd_di()->get( Mail::class )->get_headers(
529	616	defender_noreply_email( 'wd_unlock_noreply_email' ),
530	617	Unlock_Me::SLUG_UNLOCK
531	618	);
532		- $subject = esc_html__( 'Request to Unblock IP Address', 'defender-security' );
	619	+ $subject = __( 'Request to Unblock IP Address', 'defender-security' );
	620	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
533	621
534	622	$content_body = $this->render_partial(
535	623	'email/unlockout',
536	624	array(
		@@ -561,8 +649,9 @@
561	649	* @param string $message The message to show.
562	650	* @param int $remaining_time Remaining countdown time in seconds.
563	651	* @param string $reason Block's reason.
564	652	* @param array $ips Array of blocked IP's.
	653	+ * @param bool $discourage_crawlers Whether to discourage crawlers with a noindex meta tag.
565	654	*
566	655	* @return void
567	656	*/
568	657	public function actions_for_blocked(
		@@ -568,9 +657,10 @@
568	657	public function actions_for_blocked(
569	658	string $message,
570	659	int $remaining_time = 0,
571	660	string $reason = '',
572		- array $ips = array()
	661	+ array $ips = array(),
	662	+ bool $discourage_crawlers = false
573	663	): void {
574	664	$action = HTTP::get( 'action', false );
575	665
576	666	if ( defender_base_action() === $action ) {
		@@ -590,9 +680,9 @@
590	680	// We follow the default naming process to find the required cookie later.
591	681	$cookie_name = str_replace( '.', '_', $ips[0] );
592	682	$cookie_name = 'wpdef_lockout_' . $cookie_name;
593	683	if ( ! isset( $_COOKIE[ $cookie_name ] ) ) {
594		- setcookie( $cookie_name, true, time() + HOUR_IN_SECONDS, '/' );
	684	+ setcookie( $cookie_name, true, time() + HOUR_IN_SECONDS, '/', '', is_ssl(), true );
595	685	}
596	686	}
597	687
598	688	$global_service = wd_di()->get( Global_IP_Component::class );
		@@ -617,20 +707,23 @@
617	707	header( 'Pragma: no-cache' ); // HTTP 1.0.
618	708	header( 'Expires: ' . wp_date( 'D, d M Y H:i:s', time() - 3600 ) . ' GMT' ); // Proxies.
619	709	header( 'Clear-Site-Data: "cache"' ); // Clear cache of the current request.
620	710
621		- $global_ip_lockout = wd_di()->get( Global_Ip_Lockout::class );
622		- $is_displayed = Unlock_Me::is_displayed( $reason, $ips );
623		- $is_displayed_agf = $antibot_service->is_displayed( $ips );
624		- $allow_self_unlock = $global_ip_lockout->allow_self_unlock;
625		- $hide_btn_agf = $is_displayed_agf && ! $allow_self_unlock;
626		- $params = array(
627		- 'message' => ! $hide_btn_agf ? $message : '',
628		- 'remaining_time' => $remaining_time,
629		- 'is_unlock_me' => $is_displayed,
630		- 'is_unlock_me_agf' => $is_displayed_agf,
631		- 'module_name_agf' => Antibot_Global_Firewall_Setting::get_module_name(),
632		- 'hide_btn_agf' => $hide_btn_agf,
	711	+ $global_ip_lockout = wd_di()->get( Global_Ip_Lockout::class );
	712	+ $is_displayed = Unlock_Me::is_displayed( $reason, $ips );
	713	+ $is_displayed_agf = $antibot_service->is_displayed( $ips );
	714	+ $allow_self_unlock = $global_ip_lockout->allow_self_unlock;
	715	+ $hide_btn_agf = $is_displayed_agf && ! $allow_self_unlock;
	716	+ $malicious_bot = wd_di()->get( Malicious_Bot::class );
	717	+ $discourage_crawlers = ! $discourage_crawlers && $malicious_bot->is_hash_request() ? true : $discourage_crawlers;
	718	+ $params = array(
	719	+ 'message' => ! $hide_btn_agf ? $message : '',
	720	+ 'remaining_time' => $remaining_time,
	721	+ 'is_unlock_me' => $is_displayed,
	722	+ 'is_unlock_me_agf' => $is_displayed_agf,
	723	+ 'module_name_agf' => Antibot_Global_Firewall_Setting::get_module_name(),
	724	+ 'hide_btn_agf' => $hide_btn_agf,
	725	+ 'discourage_crawlers' => $discourage_crawlers,
633	726	);
634	727
635	728	// For AntiBot Global Firewall "Unlock me captcha".
636	729	if ( $is_displayed_agf && $allow_self_unlock ) {
		@@ -664,9 +757,9 @@
664	757	$params['action_send_again'] = add_query_arg( $args, admin_url( 'admin-ajax.php' ) );
665	758
666	759	$params['button_title'] = Unlock_Me::get_feature_title();
667	760	$button_disabled = false;
668		- if ( ! empty( $ips ) ) {
	761	+ if ( array() !== $ips ) {
669	762	// Get IP's.
670	763	$request_count = get_transient( $this->check_ip_by_remote_addr( $ips[0] ) );
671	764	$button_disabled = false !== $request_count && $request_count >= Unlock_Me::get_attempt_limit();
672	765	}
		@@ -725,9 +818,9 @@
725	818	$service_ua->block_user_agent_or_ip( $user_agent, $ip, User_Agent_Component::REASON_BAD_POST );
726	819
727	820	return $service_ua->get_message();
728	821	}
729		- if ( ! empty( $user_agent )
	822	+ if ( '' !== trim( $user_agent )
730	823	/**
731	824	* Apply additional checks for user agent before determining if it is a bad user agent.
732	825	*
733	826	* @param bool $is_bad_user_agent The result of checking if the user agent is bad.
		@@ -844,10 +937,16 @@
844	937	// Remove Global IP data.
845	938	( new Global_Ip() )->remove_data();
846	939	// Remove AntiBot Global Firewall data.
847	940	wd_di()->get( Antibot_Global_Firewall::class )->remove_data();
848		- // Remove Bot Trap data.
849		- wd_di()->get( Bot_Trap::class )->remove_data();
	941	+ // Remove Malicious Bot data.
	942	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	943	+ // Remove Fake Bot data.
	944	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	945	+ // Remove Firewall Logs data.
	946	+ wd_di()->get( Firewall_Logs::class )->remove_data();
	947	+ // Remove WAF data.
	948	+ wd_di()->get( WAF::class )->remove_data();
850	949	// Clear Trusted Proxy data.
851	950	$trusted_proxy_preset = wd_di()->get( Trusted_Proxy_Preset::class );
852	951	foreach ( array_keys( Firewall_Service::trusted_proxy_presets() ) as $preset ) {
853	952	$trusted_proxy_preset->set_proxy_preset( $preset );
		@@ -866,11 +965,11 @@
866	965	*
867	966	* @return array An array of data for the frontend.
868	967	*/
869	968	public function data_frontend(): array {
870		- $summary_data = $this->get_summary();
871	969	$user_ip = $this->get_user_ip();
872	970	$http_ip_header_value = $this->get_user_ip_header();
	971	+ $summary_data = $this->get_summary();
873	972
874	973	$data = array(
875	974	'login' => array(
876	975	'month' => $summary_data['lockout_login_this_month'],
		@@ -890,13 +989,8 @@
890	989	'month' => $summary_data['lockout_this_month'],
891	990	'day' => $summary_data['lockout_today'],
892	991	'last_lockout' => $summary_data['lockout_last'],
893	992	'settings' => $this->model->export(),
894		- 'login_lockout' => wd_di()->get( Login_Lockout_Model::class )->enabled,
895		- 'nf_lockout' => wd_di()->get( Notfound_Lockout::class )->enabled,
896		- 'report' => wd_di()->get( Firewall_Report::class )->to_string(),
897		- 'notification_lockout' => 'enabled' === wd_di()->get( Firewall_Notification::class )->status,
898		- 'ua_lockout' => wd_di()->get( User_Agent_Lockout::class )->enabled,
899	993	'user_ip' => implode( ', ', $user_ip ),
900	994	'user_ip_header' => $http_ip_header_value,
901	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
902	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
		@@ -901,8 +995,14 @@
901	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
902	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
903	997	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
904	998	'antibot' => wd_di()->get( Antibot_Global_Firewall::class )->data_frontend(),
	999	+ 'waf' => wd_di()->get( WAF::class )->data_frontend(),
	1000	+ 'loginLockout' => wd_di()->get( Login_Lockout::class )->data_frontend(),
	1001	+ 'nfLockout' => wd_di()->get( Nf_Lockout::class )->data_frontend(),
	1002	+ 'uaLockout' => wd_di()->get( UA_Lockout::class )->data_frontend(),
	1003	+ 'banning' => wd_di()->get( Blacklist::class )->data_frontend(),
	1004	+ 'logs' => wd_di()->get( Firewall_Logs::class )->data_frontend(),
905	1005	);
906	1006
907	1007	return array_merge( $data, $this->dump_routes_and_nonces() );
908	1008	}
		@@ -937,59 +1037,55 @@
937	1037	*
938	1038	* @return array An array of strings.
939	1039	*/
940	1040	public function export_strings(): array {
941		- $strings = array();
942		- $is_pro = ( new WPMUDEV() )->is_pro();
943		- $firewall_report = new Firewall_Report();
	1041	+ $strings = array();
944	1042	// Login lockout.
945	1043	$strings[] = Login_Lockout_Model::get_module_name() . ' '
946		- . Login_Lockout_Model::get_module_state( (bool) ( new Login_Lockout_Model() )->enabled );
	1044	+ . Login_Lockout_Model::get_module_state( ( new Login_Lockout_Model() )->enabled );
947	1045	// Notfound lockout.
948	1046	$strings[] = Notfound_Lockout::get_module_name() . ' '
949		- . Notfound_Lockout::get_module_state( (bool) ( new Notfound_Lockout() )->enabled );
	1047	+ . Notfound_Lockout::get_module_state( ( new Notfound_Lockout() )->enabled );
950	1048	// Global IP lockout.
951	1049	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
952		- . Global_Ip_Lockout::get_module_state( (bool) ( new Global_Ip_Lockout() )->enabled );
	1050	+ . Global_Ip_Lockout::get_module_state( ( new Global_Ip_Lockout() )->enabled );
	1051	+ // AntiBot Global Firewall.
	1052	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1053	+ . Antibot_Global_Firewall_Setting::get_module_state( ( new Antibot_Global_Firewall_Setting() )->enabled );
953	1054	// UA lockout.
954	1055	$strings[] = User_Agent_Lockout::get_module_name() . ' '
955		- . User_Agent_Lockout::get_module_state( (bool) ( new User_Agent_Lockout() )->enabled );
	1056	+ . User_Agent_Lockout::get_module_state( ( new User_Agent_Lockout() )->enabled );
956	1057	// Notifications and reports.
957	1058	if ( 'enabled' === ( new Firewall_Notification() )->status ) {
958	1059	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
959	1060	}
960		- if ( $is_pro && 'enabled' === $firewall_report->status ) {
961	1061	$strings[] = sprintf(
962		- /* translators: %s: Frequency value. */
963		- esc_html__( 'Email reports sending %s', 'defender-security' ),
964		- $firewall_report->frequency
	1062	+ /* translators: %s: Html for Pro-tag. */
	1063	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1064	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
965	1065	);
966		- } elseif ( ! $is_pro ) {
967	1066	$strings[] = sprintf(
968	1067	/* translators: %s: Html for Pro-tag. */
969		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1068	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
970	1069	'<span class="sui-tag sui-tag-pro">Pro</span>'
971	1070	);
972		- }
973	1071
974	1072	return $strings;
975	1073	}
976	1074
977	1075	/**
978		- * Generates configuration strings based on the provided configuration and
979		- * whether the product is a pro version.
	1076	+ * Generates configuration strings based on the provided configuration.
980	1077	*
981	1078	* @param array $config Configuration data.
982		- * @param bool $is_pro Indicates if the product is a pro version.
983	1079	*
984	1080	* @return array Returns an array of configuration strings.
985	1081	*/
986		- public function config_strings( array $config, bool $is_pro ): array {
	1082	+ public function config_strings( array $config ): array {
987	1083	$strings = array();
988	1084	// Login lockout.
989	1085	if ( isset( $config['login_protection'] ) ) {
990	1086	$strings[] = Login_Lockout_Model::get_module_name() . ' '
991		- . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
	1087	+ . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
992	1088	}
993	1089	// NF lockout.
994	1090	if ( isset( $config['detect_404'] ) ) {
995	1091	$strings[] = Notfound_Lockout::get_module_name() . ' '
		@@ -999,8 +1095,13 @@
999	1095	if ( isset( $config['global_ip_list'] ) ) {
1000	1096	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
1001	1097	. Global_Ip_Lockout::get_module_state( (bool) $config['global_ip_list'] );
1002	1098	}
	1099	+ // AntiBot Global Firewall.
	1100	+ if ( isset( $config['antibot'] ) ) {
	1101	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1102	+ . Antibot_Global_Firewall_Setting::get_module_state( (bool) $config['antibot'] );
	1103	+ }
1003	1104	// UA lockout.
1004	1105	if ( isset( $config['ua_banning_enabled'] ) ) {
1005	1106	$strings[] = User_Agent_Lockout::get_module_name() . ' '
1006	1107	. User_Agent_Lockout::get_module_state( (bool) $config['ua_banning_enabled'] );
		@@ -1008,22 +1109,18 @@
1008	1109	// Notifications.
1009	1110	if ( isset( $config['notification'] ) && 'enabled' === $config['notification'] ) {
1010	1111	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
1011	1112	}
1012		- // Report.
1013		- if ( $is_pro && 'enabled' === $config['report'] ) {
1014	1113	$strings[] = sprintf(
1015		- /* translators: %s: Frequency value. */
1016		- esc_html__( 'Email reports sending %s', 'defender-security' ),
1017		- $config['report_frequency']
	1114	+ /* translators: %s: Html for Pro-tag. */
	1115	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1116	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
1018	1117	);
1019		- } elseif ( ! $is_pro ) {
1020	1118	$strings[] = sprintf(
1021		- /* translators: %s: Html for Pro-tag. */
1022		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1119	+ /* translators: %s: Html for Pro-tag. */
	1120	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
1023	1121	'<span class="sui-tag sui-tag-pro">Pro</span>'
1024	1122	);
1025		- }
1026	1123
1027	1124	return $strings;
1028	1125	}
1029	1126
		@@ -1037,23 +1134,35 @@
1037	1134	if ( defined( 'DOING_AJAX' ) || defined( 'DOING_CRON' ) ) {
1038	1135	return;
1039	1136	}
1040	1137
1041		- $clear = get_site_option( 'wpdef_clear_schedule_firewall_cleanup_temp_blocklist_ips', false );
1042		- if ( $clear ) {
1043		- wp_clear_scheduled_hook( 'firewall_cleanup_temp_blocklist_ips' );
1044		- }
1045		-
1046		- if ( wp_next_scheduled( 'firewall_cleanup_temp_blocklist_ips' ) ) {
1047		- return;
1048		- }
1049		-
1050	1138	$interval = $this->model->ip_blocklist_cleanup_interval;
1051	1139	if ( ! $interval || 'never' === $interval ) {
1052	1140	return;
1053	1141	}
1054	1142
1055		- wp_schedule_event( time() + 15, $interval, 'firewall_cleanup_temp_blocklist_ips' );
	1143	+ $interval_map = array(
	1144	+ 'daily' => DAY_IN_SECONDS,
	1145	+ 'weekly' => WEEK_IN_SECONDS,
	1146	+ 'monthly' => MONTH_IN_SECONDS,
	1147	+ );
	1148	+ /**
	1149	+ * Network Cron Manager
	1150	+ *
	1151	+ * @var Network_Cron_Manager $network_cron_manager
	1152	+ */
	1153	+ $network_cron_manager = wd_di()->get( Network_Cron_Manager::class );
	1154	+ $network_cron_manager->register_callback(
	1155	+ 'firewall_cleanup_temp_blocklist_ips',
	1156	+ array( $this->service, 'firewall_clean_up_temporary_ip_blocklist' ),
	1157	+ $interval_map[ $interval ],
	1158	+ time() + 15
	1159	+ );
	1160	+
	1161	+ $clear = get_site_option( 'wpdef_clear_schedule_firewall_cleanup_temp_blocklist_ips', false );
	1162	+ if ( true === $clear ) {
	1163	+ wp_clear_scheduled_hook( 'firewall_cleanup_temp_blocklist_ips' );
	1164	+ }
1056	1165	}
1057	1166
1058	1167	/**
1059	1168	* Maybe add a filter to extend mime types.
		@@ -1066,9 +1175,9 @@
1066	1175	$server = defender_get_data_from_request( null, 's' );
1067	1176	$current_url = set_url_scheme( 'http://' . $server['HTTP_HOST'] . $server['REQUEST_URI'] );
1068	1177	$current_query = wp_parse_url( $current_url, PHP_URL_QUERY );
1069	1178	$current_query = $current_query ?? '';
1070		- $referer_url = ! empty( $server['HTTP_REFERER'] ) ?
	1179	+ $referer_url = isset( $server['HTTP_REFERER'] ) && '' !== trim( $server['HTTP_REFERER'] ) ?
1071	1180	filter_var( $server['HTTP_REFERER'], FILTER_SANITIZE_URL ) :
1072	1181	'';
1073	1182	$referer_query = wp_parse_url( $referer_url, PHP_URL_QUERY );
1074	1183	$referer_query = $referer_query ?? '';
		@@ -1077,12 +1186,12 @@
1077	1186	parse_str( $referer_query, $referer_queries );
1078	1187
1079	1188	if (
1080	1189	( preg_match( '#^' . network_admin_url() . '#i', $current_url ) &&
1081		- ! empty( $current_queries['page'] ) && $this->slug === $current_queries['page']
	1190	+ isset( $current_queries['page'] ) && '' !== trim( $current_queries['page'] ) && $this->slug === $current_queries['page']
1082	1191	) ||
1083	1192	( preg_match( '#^' . network_admin_url() . '#i', $referer_url ) &&
1084		- ! empty( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
	1193	+ isset( $referer_queries['page'] ) && '' !== trim( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
1085	1194	)
1086	1195	) {
1087	1196	// Add action hook here.
1088	1197	add_filter( 'upload_mimes', array( $this, 'extend_mime_types' ) );
		@@ -1097,9 +1206,9 @@
1097	1206	*
1098	1207	* @return array
1099	1208	*/
1100	1209	public function extend_mime_types( array $types ) {
1101		- if ( empty( $types['csv'] ) ) {
	1210	+ if ( ! isset( $types['csv'] ) || ! is_string( $types['csv'] ) || '' === trim( $types['csv'] ) ) {
1102	1211	$types['csv'] = 'text/csv';
1103	1212	}
1104	1213
1105	1214	return $types;
		@@ -1112,9 +1221,12 @@
1112	1221	* @defender_route
1113	1222	* @since 3.3.0
1114	1223	*/
1115	1224	public function empty_lockouts() {
1116		- if ( Lockout_Ip::truncate() ) {
	1225	+ $ip_deleted = Lockout_Ip::truncate();
	1226	+ $log_deleted = Lockout_Log::delete_lockout_records();
	1227	+
	1228	+ if ( false !== $ip_deleted && false !== $log_deleted ) {
1117	1229	$this->log( 'Deleted lockout records successfully.', self::FIREWALL_LOG );
1118	1230
1119	1231	return new Response(
1120	1232	true,
		@@ -1178,9 +1290,9 @@
1178	1290	*/
1179	1291	public function print_emoji_script(): void {
1180	1292	$allowed_pages = array(
1181	1293	$this->slug,
1182		- wd_di()->get( Dashboard::class )->slug,
	1294	+ wd_di()->get( \WP_Defender\Controller\Dashboard::class )->slug,
1183	1295	);
1184	1296
1185	1297	if ( in_array( HTTP::get( 'page' ), $allowed_pages, true ) ) {
1186	1298	if ( ! function_exists( 'print_emoji_detection_script' ) ) {
		@@ -1192,18 +1304,8 @@
1192	1304	}
1193	1305	}
1194	1306
1195	1307	/**
1196		- * Clean up unwanted records from lockout table.
1197		- *
1198		- * @return void
1199		- * @since 3.8.0
1200		- */
1201		- public function clean_up_firewall_lockout(): void {
1202		- $this->service->firewall_clean_up_lockout();
1203		- }
1204		-
1205		- /**
1206	1308	* Gather IP(s) from various headers and check if any IP is blacklisted, or temporary banned.
1207	1309	*
1208	1310	* @return void
1209	1311	* @since 4.4.2
		@@ -1211,18 +1313,18 @@
1211	1313	public function maybe_lockout_gathered_ips(): void {
1212	1314	$msg = '';
1213	1315	$ips = $this->service->get_user_ip();
1214	1316
1215		- if ( ! empty( $ips ) && is_array( $ips ) ) {
	1317	+ if ( array() !== $ips ) {
1216	1318	foreach ( $ips as $ip ) {
1217	1319	$result = $this->maybe_lockout( $ip );
1218		- if ( empty( $msg ) && ! empty( $result ) ) {
	1320	+ if ( '' === $msg && is_string( $result ) && '' !== trim( $result ) ) {
1219	1321	$msg = $result;
1220	1322	}
1221	1323	}
1222	1324	}
1223	1325
1224		- if ( ! empty( $msg ) ) {
	1326	+ if ( '' !== $msg ) {
1225	1327	$this->actions_for_blocked( $msg, 0, 'blacklist', $ips );
1226	1328	}
1227	1329	}
1228	1330
		@@ -1237,17 +1339,8 @@
1237	1339	Unlockout::remove_records( $timestamp, 100 );
1238	1340	}
1239	1341
1240	1342	/**
1241		- * Update trusted proxy preset IPs periodically.
1242		- *
1243		- * @return void
1244		- */
1245		- public function update_trusted_proxy_preset_ips(): void {
1246		- $this->service->update_trusted_proxy_preset_ips();
1247		- }
1248		-
1249		- /**
1250	1343	* Handle the request to detect the IP header.
1251	1344	*
1252	1345	* @return void
1253	1346	*/
		@@ -1254,9 +1347,9 @@
1254	1347	public function handle_detect_ip_header(): void {
1255	1348	$nonce = defender_get_data_from_request( 'nonce', 'g' );
1256	1349	$nonce_ctx = Smart_Ip_Detection::get_nonce_context();
1257	1350
1258		- if ( empty( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
	1351	+ if ( ! is_string( $nonce ) || '' === trim( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
1259	1352	wp_send_json_error( __( 'Invalid nonce.', 'defender-security' ) );
1260	1353	}
1261	1354
1262	1355	delete_transient( $nonce_ctx );
		@@ -1273,17 +1366,8 @@
1273	1366	}
1274	1367	}
1275	1368
1276	1369	/**
1277		- * Schedule to send request to the API for smart IP detection.
1278		- *
1279		- * @return void
1280		- */
1281		- public function smart_ip_detection_ping(): void {
1282		- $this->service_sid->smart_ip_detection_ping();
1283		- }
1284		-
1285		- /**
1286	1370	* Unlock user from AntiBot Global Firewall blocklist.
1287	1371	*
1288	1372	* @return Response
1289	1373	* @defender_route
		@@ -1316,8 +1400,11 @@
1316	1400	'signature' => defender_get_data_from_request( 'signature', 'r' ),
1317	1401	'number' => defender_get_data_from_request( 'solution', 'r' ),
1318	1402	);
1319	1403
	1404	+ // 'number' should be an integer.
	1405	+ $captcha_payload['number'] = is_numeric( $captcha_payload['number'] ) ? (int) $captcha_payload['number'] : null;
	1406	+
1320	1407	// Successful verification of captcha.
1321	1408	if ( '0' === $captcha_checkbox && wd_di()->get( Altcha_Handler::class )->verify_solution( $captcha_payload ) ) {
1322	1409	// Reset attempt data for all IPs in a batch.
1323	1410	foreach ( $user_ips as $ip ) {
		@@ -1345,16 +1432,6 @@
1345	1432
1346	1433	$this->log( 'Captcha verification failed for IP(s): ' . implode( ', ', $user_ips ), Altcha_Handler::LOG_FILE_NAME );
1347	1434
1348	1435	return new Response( false, array( 'message' => esc_html__( 'Captcha verification failed. Please try again.', 'defender-security' ) ) );
1349		- }
1350		-
1351		- /**
1352		- * Whitelist server public IP.
1353		- *
1354		- * @return void
1355		- * @since 5.0.2
1356		- */
1357		- public function whitelist_server_public_ip(): void {
1358		- $this->service->set_whitelist_server_public_ip();
1359	1436	}
1360	1437	}