← All changes | src/controller/class-firewall.php +173 -110 5.6.0 → 6.3.0 View file →

		@@ -13,9 +13,8 @@
13	13	use WP_Defender\Traits\IP;
14	14	use Calotes\Component\Request;
15	15	use Calotes\Component\Response;
16	16	use Calotes\Helper\Array_Cache;
17		-use WP_Defender\Controller\Dashboard;
18	17	use WP_Defender\Component\Network_Cron_Manager;
19	18	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
20	19	use WP_Defender\Component\Mail;
21	20	use WP_Defender\Traits\Formats;
		@@ -27,9 +26,9 @@
27	26	use WP_Defender\Component\IP\Antibot_Global_Firewall as Antibot_Global_Firewall_Component;
28	27	use WP_Defender\Component\IP\Global_IP as Global_IP_Component;
29	28	use WP_Defender\Component\Blacklist_Lockout;
30	29	use WP_Defender\Component\Http\Remote_Address;
31		-use MaxMind\Db\Reader\InvalidDatabaseException;
	30	+use WP_DEFENDER_VENDOR\MaxMind\Db\Reader\InvalidDatabaseException;
32	31	use WP_Defender\Model\Setting\Notfound_Lockout;
33	32	use WP_Defender\Model\Setting\Global_Ip_Lockout;
34	33	use WP_Defender\Model\Setting\User_Agent_Lockout;
35	34	use WP_Defender\Component\Config\Config_Hub_Helper;
		@@ -46,9 +45,8 @@
46	45	use WP_Defender\Model\Antibot_Global_Firewall as Antibot_Global_Firewall_Model;
47	46	use WP_Defender\Component\Altcha_Handler;
48	47	use WP_Defender\Controller\Hub_Connector;
49	48	use WP_Defender\Integrations\Main_Wp;
50		-use WP_Defender\Component\Breadcrumbs;
51	49
52	50	/**
53	51	* Handles IP lockouts, notifications, and settings related to the firewall features.
54	52	*/
		@@ -98,9 +96,9 @@
98	96	*/
99	97	public function __construct() {
100	98	$this->wpmudev = wd_di()->get( WPMUDEV::class );
101	99
102		- $title = esc_html__( 'Firewall', 'defender-security' );
	100	+ $title = esc_html__( 'Firewalls', 'defender-security' );
103	101	$this->register_page(
104	102	$this->get_title( $title ),
105	103	$this->slug,
106	104	array( $this, 'main_view' ),
		@@ -178,10 +176,8 @@
178	176	// Schedule cleanup blocklist ips event.
179	177	$this->schedule_cleanup_blocklist_ips_event();
180	178	add_action( 'wp_ajax_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
181	179	add_action( 'wp_ajax_nopriv_' . Smart_Ip_Detection::ACTION_PING, array( $this, 'handle_detect_ip_header' ) );
182		-
183		- add_action( 'admin_init', array( $this, 'mark_page_visited' ) );
184	180	}
185	181
186	182	/**
187	183	* Return the title of the page.
		@@ -201,38 +197,73 @@
201	197	*
202	198	* @return string
203	199	*/
204	200	protected function menu_title( string $default_text ): string {
205		- // Breadcrumbs are only for Pro features.
206		- if ( ! $this->wpmudev->is_pro() ) {
207		- return $default_text;
208		- }
209		- // Check if the user has already visited the feature page.
210		- if ( wd_di()->get( Breadcrumbs::class )->get_meta_key() ) {
211		- return $default_text;
212		- }
213		-
214		- return $default_text . '<span class="wd-new-feature-dot"></span>';
	201	+ return $default_text;
215	202	}
216	203
217	204	/**
218		- * This is for handling request from dashboard.
	205	+ * Sets up the preset firewall configuration.
219	206	*
220		- * @defender_route
221		- * @return Response
	207	+ * @param bool $state The feature state.
	208	+ *
	209	+ * @return void
222	210	*/
223		- public function dashboard_activation() {
224		- $il = wd_di()->get( Login_Lockout_Model::class );
	211	+ public function preset_firewall( bool $state ) {
	212	+ // For every lockout.
	213	+ $ll = wd_di()->get( Login_Lockout_Model::class );
225	214	$nf = wd_di()->get( Notfound_Lockout::class );
226	215	$ua = wd_di()->get( User_Agent_Lockout::class );
227	216
228		- $il->enabled = true;
229		- $il->save();
230		- $nf->enabled = true;
	217	+ $ll->enabled = $state;
	218	+ $ll->save();
	219	+ $nf->enabled = $state;
231	220	$nf->save();
232		- $ua->enabled = true;
	221	+
	222	+ $old_malicious_bot_enabled = $ua->malicious_bot_enabled;
	223	+ $old_fake_bots_enabled = $ua->fake_bots_enabled;
	224	+ $ua->enabled = $state;
	225	+ if ( $state ) {
	226	+ $ua->malicious_bot_enabled = true;
	227	+ $ua->fake_bots_enabled = true;
	228	+ } else {
	229	+ $ua->malicious_bot_enabled = false;
	230	+ $ua->fake_bots_enabled = false;
	231	+ }
233	232	$ua->save();
234	233
	234	+ if ( $state && ! $old_malicious_bot_enabled ) {
	235	+ wd_di()->get( Malicious_Bot::class )->rotate_hash();
	236	+ } elseif ( ! $state ) {
	237	+ if ( $old_malicious_bot_enabled ) {
	238	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	239	+ }
	240	+ if ( $old_fake_bots_enabled ) {
	241	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	242	+ }
	243	+ }
	244	+
	245	+ Config_Hub_Helper::set_clear_active_flag();
	246	+ }
	247	+
	248	+ /**
	249	+ * Enable/disable lockout modules.
	250	+ *
	251	+ * @param Request $request The request object.
	252	+ *
	253	+ * @return Response
	254	+ * @defender_route
	255	+ */
	256	+ public function toggle_lockout_modules( Request $request ): Response {
	257	+ $data = $request->get_data(
	258	+ array(
	259	+ 'enabled' => array(
	260	+ 'type' => 'boolean',
	261	+ ),
	262	+ )
	263	+ );
	264	+ $this->preset_firewall( $data['enabled'] );
	265	+
235	266	return new Response( true, $this->to_array() );
236	267	}
237	268
238	269	/**
		@@ -261,9 +292,11 @@
261	292	$data['http_ip_header'],
262	293	Firewall_Service::custom_http_headers(),
263	294	true
264	295	)
265		- && ! empty( $data['trusted_proxy_preset'] )
	296	+ && isset( $data['trusted_proxy_preset'] )
	297	+ && is_string( $data['trusted_proxy_preset'] )
	298	+ && '' !== $data['trusted_proxy_preset']
266	299	&& $data['trusted_proxy_preset'] !== $this->model->trusted_proxy_preset
267	300	) {
268	301	$is_preset_update = true;
269	302	}
		@@ -361,20 +394,56 @@
361	394	/**
362	395	* Enqueues scripts and styles for this page.
363	396	* Only enqueues assets if the page is active.
364	397	*/
365		- public function enqueue_assets() {
	398	+ public function enqueue_assets(): void {
366	399	if ( ! $this->is_page_active() ) {
367	400	return;
368	401	}
369	402
	403	+ add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
370	404	wp_enqueue_media();
371	405
372		- wp_localize_script( 'def-iplockout', 'iplockout', $this->data_frontend() );
373		- wp_enqueue_script( 'def-iplockout' );
	406	+ $handle = 'defender-ui-firewalls';
	407	+ wp_enqueue_script(
	408	+ $handle,
	409	+ WP_DEFENDER_BASE_URL . 'assets/js/firewalls-ui.js',
	410	+ array( 'def-vue', 'def-manifest', 'def-core-ui', 'defender', 'wp-i18n' ),
	411	+ DEFENDER_VERSION,
	412	+ true
	413	+ );
	414	+ wp_set_script_translations( $handle, 'wpdef' );
	415	+
	416	+ wp_localize_script(
	417	+ $handle,
	418	+ 'defenderUIData',
	419	+ array_merge(
	420	+ $this->get_shared_data(),
	421	+ $this->data_frontend()
	422	+ )
	423	+ );
	424	+
	425	+ wp_enqueue_style(
	426	+ $handle,
	427	+ WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css',
	428	+ array(),
	429	+ DEFENDER_VERSION
	430	+ );
	431	+
374	432	$this->enqueue_main_assets();
	433	+ // Keep this action for backward compatibility with existing hooks.
	434	+ do_action( 'defender_ip_lockout_action_assets' );
	435	+ }
375	436
376		- do_action( 'defender_ip_lockout_action_assets' );
	437	+ /**
	438	+ * Add a Firewalls page marker class for scoped admin CSS overrides.
	439	+ *
	440	+ * @param string $classes Current admin body classes.
	441	+ *
	442	+ * @return string
	443	+ */
	444	+ public function admin_body_class( string $classes ): string {
	445	+ return trim( $classes . ' wdf-firewalls-react-page' );
377	446	}
378	447
379	448	/**
380	449	* Renders the preview of lockout screen.
		@@ -459,13 +528,10 @@
459	528	'sanitize' => 'sanitize_text_field',
460	529	),
461	530	)
462	531	);
463		- $maybe_email = $data['user_data'];
464		- if ( empty( $maybe_email ) ) {
465		- return new Response( false, array() );
466		- }
467		- $ips = $this->get_user_ip();
	532	+ $maybe_email = isset( $data['user_data'] ) ? $data['user_data'] : '';
	533	+ $ips = $this->get_user_ip();
468	534	// Check if at least one IP is blocked.
469	535	$blocked_ip = $this->service->get_blocked_ip( $ips );
470	536	// If nothing, just return.
471	537	if ( '' === $blocked_ip ) {
		@@ -470,8 +536,17 @@
470	536	// If nothing, just return.
471	537	if ( '' === $blocked_ip ) {
472	538	return new Response( false, array() );
473	539	}
	540	+ // Count every verification attempt and stop before account lookup or side effects when the limit is reached.
	541	+ if ( $this->check_attempt_counter_by( $blocked_ip ) ) {
	542	+ return new Response( false, array() );
	543	+ }
	544	+
	545	+ // Always return the same response for accepted attempts to avoid exposing account existence or role.
	546	+ if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) {
	547	+ return new Response( true, array() );
	548	+ }
474	549	// Maybe is it a user email?
475	550	$user = get_user_by( 'email', $maybe_email );
476	551	if ( ! is_object( $user ) ) {
477	552	// Maybe is it a username?
		@@ -476,21 +551,21 @@
476	551	if ( ! is_object( $user ) ) {
477	552	// Maybe is it a username?
478	553	$user = get_user_by( 'login', $maybe_email );
479	554	if ( ! is_object( $user ) ) {
480		- $this->check_attempt_counter_by( $blocked_ip );
481		-
482		- return new Response( false, array() );
	555	+ return new Response( true, array() );
483	556	}
484	557	}
485	558	// Send email only for admins.
486	559	if ( ! $this->is_admin( $user ) ) {
487		- // No need to count attempts for existed user but non-admin.
488		- return new Response( false, array() );
	560	+ return new Response( true, array() );
489	561	}
490	562	// Create Unlockout records.
491	563	$arr_uids = array();
492	564	foreach ( $ips as $ip ) {
	565	+ if ( Unlockout::has_pending_request( $ip, $user->user_email ) ) {
	566	+ continue;
	567	+ }
493	568	// Collect blocked IP's.
494	569	$created_id = wd_di()->get( Unlockout::class )->create( $ip, $user->user_email );
495	570	if ( $created_id ) {
496	571	$arr_uids[] = $created_id;
		@@ -496,9 +571,11 @@
496	571	$arr_uids[] = $created_id;
497	572	}
498	573	}
499	574
500		- $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	575	+ if ( array() !== $arr_uids ) {
	576	+ $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	577	+ }
501	578
502	579	return new Response( true, array() );
503	580	}
504	581
		@@ -538,9 +615,10 @@
538	615	$headers = wd_di()->get( Mail::class )->get_headers(
539	616	defender_noreply_email( 'wd_unlock_noreply_email' ),
540	617	Unlock_Me::SLUG_UNLOCK
541	618	);
542		- $subject = esc_html__( 'Request to Unblock IP Address', 'defender-security' );
	619	+ $subject = __( 'Request to Unblock IP Address', 'defender-security' );
	620	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
543	621
544	622	$content_body = $this->render_partial(
545	623	'email/unlockout',
546	624	array(
		@@ -679,9 +757,9 @@
679	757	$params['action_send_again'] = add_query_arg( $args, admin_url( 'admin-ajax.php' ) );
680	758
681	759	$params['button_title'] = Unlock_Me::get_feature_title();
682	760	$button_disabled = false;
683		- if ( ! empty( $ips ) ) {
	761	+ if ( array() !== $ips ) {
684	762	// Get IP's.
685	763	$request_count = get_transient( $this->check_ip_by_remote_addr( $ips[0] ) );
686	764	$button_disabled = false !== $request_count && $request_count >= Unlock_Me::get_attempt_limit();
687	765	}
		@@ -740,9 +818,9 @@
740	818	$service_ua->block_user_agent_or_ip( $user_agent, $ip, User_Agent_Component::REASON_BAD_POST );
741	819
742	820	return $service_ua->get_message();
743	821	}
744		- if ( ! empty( $user_agent )
	822	+ if ( '' !== trim( $user_agent )
745	823	/**
746	824	* Apply additional checks for user agent before determining if it is a bad user agent.
747	825	*
748	826	* @param bool $is_bad_user_agent The result of checking if the user agent is bad.
		@@ -865,8 +943,10 @@
865	943	// Remove Fake Bot data.
866	944	wd_di()->get( Fake_Bot_Detection::class )->remove_data();
867	945	// Remove Firewall Logs data.
868	946	wd_di()->get( Firewall_Logs::class )->remove_data();
	947	+ // Remove WAF data.
	948	+ wd_di()->get( WAF::class )->remove_data();
869	949	// Clear Trusted Proxy data.
870	950	$trusted_proxy_preset = wd_di()->get( Trusted_Proxy_Preset::class );
871	951	foreach ( array_keys( Firewall_Service::trusted_proxy_presets() ) as $preset ) {
872	952	$trusted_proxy_preset->set_proxy_preset( $preset );
		@@ -885,11 +965,11 @@
885	965	*
886	966	* @return array An array of data for the frontend.
887	967	*/
888	968	public function data_frontend(): array {
889		- $summary_data = $this->get_summary();
890	969	$user_ip = $this->get_user_ip();
891	970	$http_ip_header_value = $this->get_user_ip_header();
	971	+ $summary_data = $this->get_summary();
892	972
893	973	$data = array(
894	974	'login' => array(
895	975	'month' => $summary_data['lockout_login_this_month'],
		@@ -909,13 +989,8 @@
909	989	'month' => $summary_data['lockout_this_month'],
910	990	'day' => $summary_data['lockout_today'],
911	991	'last_lockout' => $summary_data['lockout_last'],
912	992	'settings' => $this->model->export(),
913		- 'login_lockout' => wd_di()->get( Login_Lockout_Model::class )->enabled,
914		- 'nf_lockout' => wd_di()->get( Notfound_Lockout::class )->enabled,
915		- 'report' => wd_di()->get( Firewall_Report::class )->to_string(),
916		- 'notification_lockout' => 'enabled' === wd_di()->get( Firewall_Notification::class )->status,
917		- 'ua_lockout' => wd_di()->get( User_Agent_Lockout::class )->enabled,
918	993	'user_ip' => implode( ', ', $user_ip ),
919	994	'user_ip_header' => $http_ip_header_value,
920	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
921	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
		@@ -920,8 +995,14 @@
920	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
921	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
922	997	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
923	998	'antibot' => wd_di()->get( Antibot_Global_Firewall::class )->data_frontend(),
	999	+ 'waf' => wd_di()->get( WAF::class )->data_frontend(),
	1000	+ 'loginLockout' => wd_di()->get( Login_Lockout::class )->data_frontend(),
	1001	+ 'nfLockout' => wd_di()->get( Nf_Lockout::class )->data_frontend(),
	1002	+ 'uaLockout' => wd_di()->get( UA_Lockout::class )->data_frontend(),
	1003	+ 'banning' => wd_di()->get( Blacklist::class )->data_frontend(),
	1004	+ 'logs' => wd_di()->get( Firewall_Logs::class )->data_frontend(),
924	1005	);
925	1006
926	1007	return array_merge( $data, $this->dump_routes_and_nonces() );
927	1008	}
		@@ -956,59 +1037,55 @@
956	1037	*
957	1038	* @return array An array of strings.
958	1039	*/
959	1040	public function export_strings(): array {
960		- $strings = array();
961		- $is_pro = $this->wpmudev->is_pro();
962		- $firewall_report = new Firewall_Report();
	1041	+ $strings = array();
963	1042	// Login lockout.
964	1043	$strings[] = Login_Lockout_Model::get_module_name() . ' '
965		- . Login_Lockout_Model::get_module_state( (bool) ( new Login_Lockout_Model() )->enabled );
	1044	+ . Login_Lockout_Model::get_module_state( ( new Login_Lockout_Model() )->enabled );
966	1045	// Notfound lockout.
967	1046	$strings[] = Notfound_Lockout::get_module_name() . ' '
968		- . Notfound_Lockout::get_module_state( (bool) ( new Notfound_Lockout() )->enabled );
	1047	+ . Notfound_Lockout::get_module_state( ( new Notfound_Lockout() )->enabled );
969	1048	// Global IP lockout.
970	1049	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
971		- . Global_Ip_Lockout::get_module_state( (bool) ( new Global_Ip_Lockout() )->enabled );
	1050	+ . Global_Ip_Lockout::get_module_state( ( new Global_Ip_Lockout() )->enabled );
	1051	+ // AntiBot Global Firewall.
	1052	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1053	+ . Antibot_Global_Firewall_Setting::get_module_state( ( new Antibot_Global_Firewall_Setting() )->enabled );
972	1054	// UA lockout.
973	1055	$strings[] = User_Agent_Lockout::get_module_name() . ' '
974		- . User_Agent_Lockout::get_module_state( (bool) ( new User_Agent_Lockout() )->enabled );
	1056	+ . User_Agent_Lockout::get_module_state( ( new User_Agent_Lockout() )->enabled );
975	1057	// Notifications and reports.
976	1058	if ( 'enabled' === ( new Firewall_Notification() )->status ) {
977	1059	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
978	1060	}
979		- if ( $is_pro && 'enabled' === $firewall_report->status ) {
980	1061	$strings[] = sprintf(
981		- /* translators: %s: Frequency value. */
982		- esc_html__( 'Email reports sending %s', 'defender-security' ),
983		- $firewall_report->frequency
	1062	+ /* translators: %s: Html for Pro-tag. */
	1063	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1064	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
984	1065	);
985		- } elseif ( ! $is_pro ) {
986	1066	$strings[] = sprintf(
987	1067	/* translators: %s: Html for Pro-tag. */
988		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1068	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
989	1069	'<span class="sui-tag sui-tag-pro">Pro</span>'
990	1070	);
991		- }
992	1071
993	1072	return $strings;
994	1073	}
995	1074
996	1075	/**
997		- * Generates configuration strings based on the provided configuration and
998		- * whether the product is a pro version.
	1076	+ * Generates configuration strings based on the provided configuration.
999	1077	*
1000	1078	* @param array $config Configuration data.
1001		- * @param bool $is_pro Indicates if the product is a pro version.
1002	1079	*
1003	1080	* @return array Returns an array of configuration strings.
1004	1081	*/
1005		- public function config_strings( array $config, bool $is_pro ): array {
	1082	+ public function config_strings( array $config ): array {
1006	1083	$strings = array();
1007	1084	// Login lockout.
1008	1085	if ( isset( $config['login_protection'] ) ) {
1009	1086	$strings[] = Login_Lockout_Model::get_module_name() . ' '
1010		- . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
	1087	+ . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
1011	1088	}
1012	1089	// NF lockout.
1013	1090	if ( isset( $config['detect_404'] ) ) {
1014	1091	$strings[] = Notfound_Lockout::get_module_name() . ' '
		@@ -1018,8 +1095,13 @@
1018	1095	if ( isset( $config['global_ip_list'] ) ) {
1019	1096	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
1020	1097	. Global_Ip_Lockout::get_module_state( (bool) $config['global_ip_list'] );
1021	1098	}
	1099	+ // AntiBot Global Firewall.
	1100	+ if ( isset( $config['antibot'] ) ) {
	1101	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1102	+ . Antibot_Global_Firewall_Setting::get_module_state( (bool) $config['antibot'] );
	1103	+ }
1022	1104	// UA lockout.
1023	1105	if ( isset( $config['ua_banning_enabled'] ) ) {
1024	1106	$strings[] = User_Agent_Lockout::get_module_name() . ' '
1025	1107	. User_Agent_Lockout::get_module_state( (bool) $config['ua_banning_enabled'] );
		@@ -1027,22 +1109,18 @@
1027	1109	// Notifications.
1028	1110	if ( isset( $config['notification'] ) && 'enabled' === $config['notification'] ) {
1029	1111	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
1030	1112	}
1031		- // Report.
1032		- if ( $is_pro && 'enabled' === $config['report'] ) {
1033	1113	$strings[] = sprintf(
1034		- /* translators: %s: Frequency value. */
1035		- esc_html__( 'Email reports sending %s', 'defender-security' ),
1036		- $config['report_frequency']
	1114	+ /* translators: %s: Html for Pro-tag. */
	1115	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1116	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
1037	1117	);
1038		- } elseif ( ! $is_pro ) {
1039	1118	$strings[] = sprintf(
1040		- /* translators: %s: Html for Pro-tag. */
1041		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1119	+ /* translators: %s: Html for Pro-tag. */
	1120	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
1042	1121	'<span class="sui-tag sui-tag-pro">Pro</span>'
1043	1122	);
1044		- }
1045	1123
1046	1124	return $strings;
1047	1125	}
1048	1126
		@@ -1080,9 +1158,9 @@
1080	1158	time() + 15
1081	1159	);
1082	1160
1083	1161	$clear = get_site_option( 'wpdef_clear_schedule_firewall_cleanup_temp_blocklist_ips', false );
1084		- if ( $clear ) {
	1162	+ if ( true === $clear ) {
1085	1163	wp_clear_scheduled_hook( 'firewall_cleanup_temp_blocklist_ips' );
1086	1164	}
1087	1165	}
1088	1166
		@@ -1097,9 +1175,9 @@
1097	1175	$server = defender_get_data_from_request( null, 's' );
1098	1176	$current_url = set_url_scheme( 'http://' . $server['HTTP_HOST'] . $server['REQUEST_URI'] );
1099	1177	$current_query = wp_parse_url( $current_url, PHP_URL_QUERY );
1100	1178	$current_query = $current_query ?? '';
1101		- $referer_url = ! empty( $server['HTTP_REFERER'] ) ?
	1179	+ $referer_url = isset( $server['HTTP_REFERER'] ) && '' !== trim( $server['HTTP_REFERER'] ) ?
1102	1180	filter_var( $server['HTTP_REFERER'], FILTER_SANITIZE_URL ) :
1103	1181	'';
1104	1182	$referer_query = wp_parse_url( $referer_url, PHP_URL_QUERY );
1105	1183	$referer_query = $referer_query ?? '';
		@@ -1108,12 +1186,12 @@
1108	1186	parse_str( $referer_query, $referer_queries );
1109	1187
1110	1188	if (
1111	1189	( preg_match( '#^' . network_admin_url() . '#i', $current_url ) &&
1112		- ! empty( $current_queries['page'] ) && $this->slug === $current_queries['page']
	1190	+ isset( $current_queries['page'] ) && '' !== trim( $current_queries['page'] ) && $this->slug === $current_queries['page']
1113	1191	) ||
1114	1192	( preg_match( '#^' . network_admin_url() . '#i', $referer_url ) &&
1115		- ! empty( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
	1193	+ isset( $referer_queries['page'] ) && '' !== trim( $referer_queries['page'] ) && $this->slug === $referer_queries['page']
1116	1194	)
1117	1195	) {
1118	1196	// Add action hook here.
1119	1197	add_filter( 'upload_mimes', array( $this, 'extend_mime_types' ) );
		@@ -1128,9 +1206,9 @@
1128	1206	*
1129	1207	* @return array
1130	1208	*/
1131	1209	public function extend_mime_types( array $types ) {
1132		- if ( empty( $types['csv'] ) ) {
	1210	+ if ( ! isset( $types['csv'] ) || ! is_string( $types['csv'] ) || '' === trim( $types['csv'] ) ) {
1133	1211	$types['csv'] = 'text/csv';
1134	1212	}
1135	1213
1136	1214	return $types;
		@@ -1143,9 +1221,12 @@
1143	1221	* @defender_route
1144	1222	* @since 3.3.0
1145	1223	*/
1146	1224	public function empty_lockouts() {
1147		- if ( Lockout_Ip::truncate() ) {
	1225	+ $ip_deleted = Lockout_Ip::truncate();
	1226	+ $log_deleted = Lockout_Log::delete_lockout_records();
	1227	+
	1228	+ if ( false !== $ip_deleted && false !== $log_deleted ) {
1148	1229	$this->log( 'Deleted lockout records successfully.', self::FIREWALL_LOG );
1149	1230
1150	1231	return new Response(
1151	1232	true,
		@@ -1209,9 +1290,9 @@
1209	1290	*/
1210	1291	public function print_emoji_script(): void {
1211	1292	$allowed_pages = array(
1212	1293	$this->slug,
1213		- wd_di()->get( Dashboard::class )->slug,
	1294	+ wd_di()->get( \WP_Defender\Controller\Dashboard::class )->slug,
1214	1295	);
1215	1296
1216	1297	if ( in_array( HTTP::get( 'page' ), $allowed_pages, true ) ) {
1217	1298	if ( ! function_exists( 'print_emoji_detection_script' ) ) {
		@@ -1232,18 +1313,18 @@
1232	1313	public function maybe_lockout_gathered_ips(): void {
1233	1314	$msg = '';
1234	1315	$ips = $this->service->get_user_ip();
1235	1316
1236		- if ( ! empty( $ips ) && is_array( $ips ) ) {
	1317	+ if ( array() !== $ips ) {
1237	1318	foreach ( $ips as $ip ) {
1238	1319	$result = $this->maybe_lockout( $ip );
1239		- if ( empty( $msg ) && ! empty( $result ) ) {
	1320	+ if ( '' === $msg && is_string( $result ) && '' !== trim( $result ) ) {
1240	1321	$msg = $result;
1241	1322	}
1242	1323	}
1243	1324	}
1244	1325
1245		- if ( ! empty( $msg ) ) {
	1326	+ if ( '' !== $msg ) {
1246	1327	$this->actions_for_blocked( $msg, 0, 'blacklist', $ips );
1247	1328	}
1248	1329	}
1249	1330
		@@ -1266,9 +1347,9 @@
1266	1347	public function handle_detect_ip_header(): void {
1267	1348	$nonce = defender_get_data_from_request( 'nonce', 'g' );
1268	1349	$nonce_ctx = Smart_Ip_Detection::get_nonce_context();
1269	1350
1270		- if ( empty( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
	1351	+ if ( ! is_string( $nonce ) || '' === trim( $nonce ) || get_transient( $nonce_ctx ) !== $nonce ) {
1271	1352	wp_send_json_error( __( 'Invalid nonce.', 'defender-security' ) );
1272	1353	}
1273	1354
1274	1355	delete_transient( $nonce_ctx );
		@@ -1319,8 +1400,11 @@
1319	1400	'signature' => defender_get_data_from_request( 'signature', 'r' ),
1320	1401	'number' => defender_get_data_from_request( 'solution', 'r' ),
1321	1402	);
1322	1403
	1404	+ // 'number' should be an integer.
	1405	+ $captcha_payload['number'] = is_numeric( $captcha_payload['number'] ) ? (int) $captcha_payload['number'] : null;
	1406	+
1323	1407	// Successful verification of captcha.
1324	1408	if ( '0' === $captcha_checkbox && wd_di()->get( Altcha_Handler::class )->verify_solution( $captcha_payload ) ) {
1325	1409	// Reset attempt data for all IPs in a batch.
1326	1410	foreach ( $user_ips as $ip ) {
		@@ -1348,27 +1432,6 @@
1348	1432
1349	1433	$this->log( 'Captcha verification failed for IP(s): ' . implode( ', ', $user_ips ), Altcha_Handler::LOG_FILE_NAME );
1350	1434
1351	1435	return new Response( false, array( 'message' => esc_html__( 'Captcha verification failed. Please try again.', 'defender-security' ) ) );
1352		- }
1353		-
1354		- /**
1355		- * Mark the feature page as visited.
1356		- *
1357		- * @return void
1358		- */
1359		- public function mark_page_visited(): void {
1360		- // Breadcrumbs are only for Pro features.
1361		- if ( ! $this->wpmudev->is_pro() ) {
1362		- return;
1363		- }
1364		- if ( 'wdf-ip-lockout' !== defender_get_current_page()
1365		- || User_Agent_Lockout::get_module_slug() !== defender_get_data_from_request( 'view', 'g' )
1366		- ) {
1367		- return;
1368		- }
1369		- // Only for activated UA module.
1370		- if ( wd_di()->get( User_Agent_Lockout::class )->enabled ) {
1371		- wd_di()->get( Breadcrumbs::class )->update_meta_key();
1372		- }
1373	1436	}
1374	1437	}