← All changes | src/controller/class-firewall.php +158 -64 5.8.0 → 6.3.0 View file →

		@@ -13,9 +13,8 @@
13	13	use WP_Defender\Traits\IP;
14	14	use Calotes\Component\Request;
15	15	use Calotes\Component\Response;
16	16	use Calotes\Helper\Array_Cache;
17		-use WP_Defender\Controller\Dashboard;
18	17	use WP_Defender\Component\Network_Cron_Manager;
19	18	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
20	19	use WP_Defender\Component\Mail;
21	20	use WP_Defender\Traits\Formats;
		@@ -27,9 +26,9 @@
27	26	use WP_Defender\Component\IP\Antibot_Global_Firewall as Antibot_Global_Firewall_Component;
28	27	use WP_Defender\Component\IP\Global_IP as Global_IP_Component;
29	28	use WP_Defender\Component\Blacklist_Lockout;
30	29	use WP_Defender\Component\Http\Remote_Address;
31		-use MaxMind\Db\Reader\InvalidDatabaseException;
	30	+use WP_DEFENDER_VENDOR\MaxMind\Db\Reader\InvalidDatabaseException;
32	31	use WP_Defender\Model\Setting\Notfound_Lockout;
33	32	use WP_Defender\Model\Setting\Global_Ip_Lockout;
34	33	use WP_Defender\Model\Setting\User_Agent_Lockout;
35	34	use WP_Defender\Component\Config\Config_Hub_Helper;
		@@ -97,9 +96,9 @@
97	96	*/
98	97	public function __construct() {
99	98	$this->wpmudev = wd_di()->get( WPMUDEV::class );
100	99
101		- $title = esc_html__( 'Firewall', 'defender-security' );
	100	+ $title = esc_html__( 'Firewalls', 'defender-security' );
102	101	$this->register_page(
103	102	$this->get_title( $title ),
104	103	$this->slug,
105	104	array( $this, 'main_view' ),
		@@ -202,25 +201,69 @@
202	201	return $default_text;
203	202	}
204	203
205	204	/**
206		- * This is for handling request from dashboard.
	205	+ * Sets up the preset firewall configuration.
207	206	*
208		- * @defender_route
209		- * @return Response
	207	+ * @param bool $state The feature state.
	208	+ *
	209	+ * @return void
210	210	*/
211		- public function dashboard_activation() {
212		- $il = wd_di()->get( Login_Lockout_Model::class );
	211	+ public function preset_firewall( bool $state ) {
	212	+ // For every lockout.
	213	+ $ll = wd_di()->get( Login_Lockout_Model::class );
213	214	$nf = wd_di()->get( Notfound_Lockout::class );
214	215	$ua = wd_di()->get( User_Agent_Lockout::class );
215	216
216		- $il->enabled = true;
217		- $il->save();
218		- $nf->enabled = true;
	217	+ $ll->enabled = $state;
	218	+ $ll->save();
	219	+ $nf->enabled = $state;
219	220	$nf->save();
220		- $ua->enabled = true;
	221	+
	222	+ $old_malicious_bot_enabled = $ua->malicious_bot_enabled;
	223	+ $old_fake_bots_enabled = $ua->fake_bots_enabled;
	224	+ $ua->enabled = $state;
	225	+ if ( $state ) {
	226	+ $ua->malicious_bot_enabled = true;
	227	+ $ua->fake_bots_enabled = true;
	228	+ } else {
	229	+ $ua->malicious_bot_enabled = false;
	230	+ $ua->fake_bots_enabled = false;
	231	+ }
221	232	$ua->save();
222	233
	234	+ if ( $state && ! $old_malicious_bot_enabled ) {
	235	+ wd_di()->get( Malicious_Bot::class )->rotate_hash();
	236	+ } elseif ( ! $state ) {
	237	+ if ( $old_malicious_bot_enabled ) {
	238	+ wd_di()->get( Malicious_Bot::class )->remove_data();
	239	+ }
	240	+ if ( $old_fake_bots_enabled ) {
	241	+ wd_di()->get( Fake_Bot_Detection::class )->remove_data();
	242	+ }
	243	+ }
	244	+
	245	+ Config_Hub_Helper::set_clear_active_flag();
	246	+ }
	247	+
	248	+ /**
	249	+ * Enable/disable lockout modules.
	250	+ *
	251	+ * @param Request $request The request object.
	252	+ *
	253	+ * @return Response
	254	+ * @defender_route
	255	+ */
	256	+ public function toggle_lockout_modules( Request $request ): Response {
	257	+ $data = $request->get_data(
	258	+ array(
	259	+ 'enabled' => array(
	260	+ 'type' => 'boolean',
	261	+ ),
	262	+ )
	263	+ );
	264	+ $this->preset_firewall( $data['enabled'] );
	265	+
223	266	return new Response( true, $this->to_array() );
224	267	}
225	268
226	269	/**
		@@ -351,20 +394,56 @@
351	394	/**
352	395	* Enqueues scripts and styles for this page.
353	396	* Only enqueues assets if the page is active.
354	397	*/
355		- public function enqueue_assets() {
	398	+ public function enqueue_assets(): void {
356	399	if ( ! $this->is_page_active() ) {
357	400	return;
358	401	}
359	402
	403	+ add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
360	404	wp_enqueue_media();
361	405
362		- wp_localize_script( 'def-iplockout', 'iplockout', $this->data_frontend() );
363		- wp_enqueue_script( 'def-iplockout' );
	406	+ $handle = 'defender-ui-firewalls';
	407	+ wp_enqueue_script(
	408	+ $handle,
	409	+ WP_DEFENDER_BASE_URL . 'assets/js/firewalls-ui.js',
	410	+ array( 'def-vue', 'def-manifest', 'def-core-ui', 'defender', 'wp-i18n' ),
	411	+ DEFENDER_VERSION,
	412	+ true
	413	+ );
	414	+ wp_set_script_translations( $handle, 'wpdef' );
	415	+
	416	+ wp_localize_script(
	417	+ $handle,
	418	+ 'defenderUIData',
	419	+ array_merge(
	420	+ $this->get_shared_data(),
	421	+ $this->data_frontend()
	422	+ )
	423	+ );
	424	+
	425	+ wp_enqueue_style(
	426	+ $handle,
	427	+ WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css',
	428	+ array(),
	429	+ DEFENDER_VERSION
	430	+ );
	431	+
364	432	$this->enqueue_main_assets();
	433	+ // Keep this action for backward compatibility with existing hooks.
	434	+ do_action( 'defender_ip_lockout_action_assets' );
	435	+ }
365	436
366		- do_action( 'defender_ip_lockout_action_assets' );
	437	+ /**
	438	+ * Add a Firewalls page marker class for scoped admin CSS overrides.
	439	+ *
	440	+ * @param string $classes Current admin body classes.
	441	+ *
	442	+ * @return string
	443	+ */
	444	+ public function admin_body_class( string $classes ): string {
	445	+ return trim( $classes . ' wdf-firewalls-react-page' );
367	446	}
368	447
369	448	/**
370	449	* Renders the preview of lockout screen.
		@@ -449,13 +528,10 @@
449	528	'sanitize' => 'sanitize_text_field',
450	529	),
451	530	)
452	531	);
453		- $maybe_email = $data['user_data'];
454		- if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) {
455		- return new Response( false, array() );
456		- }
457		- $ips = $this->get_user_ip();
	532	+ $maybe_email = isset( $data['user_data'] ) ? $data['user_data'] : '';
	533	+ $ips = $this->get_user_ip();
458	534	// Check if at least one IP is blocked.
459	535	$blocked_ip = $this->service->get_blocked_ip( $ips );
460	536	// If nothing, just return.
461	537	if ( '' === $blocked_ip ) {
		@@ -460,8 +536,17 @@
460	536	// If nothing, just return.
461	537	if ( '' === $blocked_ip ) {
462	538	return new Response( false, array() );
463	539	}
	540	+ // Count every verification attempt and stop before account lookup or side effects when the limit is reached.
	541	+ if ( $this->check_attempt_counter_by( $blocked_ip ) ) {
	542	+ return new Response( false, array() );
	543	+ }
	544	+
	545	+ // Always return the same response for accepted attempts to avoid exposing account existence or role.
	546	+ if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) {
	547	+ return new Response( true, array() );
	548	+ }
464	549	// Maybe is it a user email?
465	550	$user = get_user_by( 'email', $maybe_email );
466	551	if ( ! is_object( $user ) ) {
467	552	// Maybe is it a username?
		@@ -466,21 +551,21 @@
466	551	if ( ! is_object( $user ) ) {
467	552	// Maybe is it a username?
468	553	$user = get_user_by( 'login', $maybe_email );
469	554	if ( ! is_object( $user ) ) {
470		- $this->check_attempt_counter_by( $blocked_ip );
471		-
472		- return new Response( false, array() );
	555	+ return new Response( true, array() );
473	556	}
474	557	}
475	558	// Send email only for admins.
476	559	if ( ! $this->is_admin( $user ) ) {
477		- // No need to count attempts for existed user but non-admin.
478		- return new Response( false, array() );
	560	+ return new Response( true, array() );
479	561	}
480	562	// Create Unlockout records.
481	563	$arr_uids = array();
482	564	foreach ( $ips as $ip ) {
	565	+ if ( Unlockout::has_pending_request( $ip, $user->user_email ) ) {
	566	+ continue;
	567	+ }
483	568	// Collect blocked IP's.
484	569	$created_id = wd_di()->get( Unlockout::class )->create( $ip, $user->user_email );
485	570	if ( $created_id ) {
486	571	$arr_uids[] = $created_id;
		@@ -486,9 +571,11 @@
486	571	$arr_uids[] = $created_id;
487	572	}
488	573	}
489	574
490		- $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	575	+ if ( array() !== $arr_uids ) {
	576	+ $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids );
	577	+ }
491	578
492	579	return new Response( true, array() );
493	580	}
494	581
		@@ -528,9 +615,10 @@
528	615	$headers = wd_di()->get( Mail::class )->get_headers(
529	616	defender_noreply_email( 'wd_unlock_noreply_email' ),
530	617	Unlock_Me::SLUG_UNLOCK
531	618	);
532		- $subject = esc_html__( 'Request to Unblock IP Address', 'defender-security' );
	619	+ $subject = __( 'Request to Unblock IP Address', 'defender-security' );
	620	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
533	621
534	622	$content_body = $this->render_partial(
535	623	'email/unlockout',
536	624	array(
		@@ -855,8 +943,10 @@
855	943	// Remove Fake Bot data.
856	944	wd_di()->get( Fake_Bot_Detection::class )->remove_data();
857	945	// Remove Firewall Logs data.
858	946	wd_di()->get( Firewall_Logs::class )->remove_data();
	947	+ // Remove WAF data.
	948	+ wd_di()->get( WAF::class )->remove_data();
859	949	// Clear Trusted Proxy data.
860	950	$trusted_proxy_preset = wd_di()->get( Trusted_Proxy_Preset::class );
861	951	foreach ( array_keys( Firewall_Service::trusted_proxy_presets() ) as $preset ) {
862	952	$trusted_proxy_preset->set_proxy_preset( $preset );
		@@ -875,11 +965,11 @@
875	965	*
876	966	* @return array An array of data for the frontend.
877	967	*/
878	968	public function data_frontend(): array {
879		- $summary_data = $this->get_summary();
880	969	$user_ip = $this->get_user_ip();
881	970	$http_ip_header_value = $this->get_user_ip_header();
	971	+ $summary_data = $this->get_summary();
882	972
883	973	$data = array(
884	974	'login' => array(
885	975	'month' => $summary_data['lockout_login_this_month'],
		@@ -899,13 +989,8 @@
899	989	'month' => $summary_data['lockout_this_month'],
900	990	'day' => $summary_data['lockout_today'],
901	991	'last_lockout' => $summary_data['lockout_last'],
902	992	'settings' => $this->model->export(),
903		- 'login_lockout' => wd_di()->get( Login_Lockout_Model::class )->enabled,
904		- 'nf_lockout' => wd_di()->get( Notfound_Lockout::class )->enabled,
905		- 'report' => wd_di()->get( Firewall_Report::class )->to_string(),
906		- 'notification_lockout' => 'enabled' === wd_di()->get( Firewall_Notification::class )->status,
907		- 'ua_lockout' => wd_di()->get( User_Agent_Lockout::class )->enabled,
908	993	'user_ip' => implode( ', ', $user_ip ),
909	994	'user_ip_header' => $http_ip_header_value,
910	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
911	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
		@@ -910,8 +995,14 @@
910	995	'trusted_proxy_presets' => Firewall_Service::trusted_proxy_presets(),
911	996	'global_ip' => wd_di()->get( \WP_Defender\Controller\Global_Ip::class )->data_frontend(),
912	997	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
913	998	'antibot' => wd_di()->get( Antibot_Global_Firewall::class )->data_frontend(),
	999	+ 'waf' => wd_di()->get( WAF::class )->data_frontend(),
	1000	+ 'loginLockout' => wd_di()->get( Login_Lockout::class )->data_frontend(),
	1001	+ 'nfLockout' => wd_di()->get( Nf_Lockout::class )->data_frontend(),
	1002	+ 'uaLockout' => wd_di()->get( UA_Lockout::class )->data_frontend(),
	1003	+ 'banning' => wd_di()->get( Blacklist::class )->data_frontend(),
	1004	+ 'logs' => wd_di()->get( Firewall_Logs::class )->data_frontend(),
914	1005	);
915	1006
916	1007	return array_merge( $data, $this->dump_routes_and_nonces() );
917	1008	}
		@@ -946,59 +1037,55 @@
946	1037	*
947	1038	* @return array An array of strings.
948	1039	*/
949	1040	public function export_strings(): array {
950		- $strings = array();
951		- $is_pro = $this->wpmudev->is_pro();
952		- $firewall_report = new Firewall_Report();
	1041	+ $strings = array();
953	1042	// Login lockout.
954	1043	$strings[] = Login_Lockout_Model::get_module_name() . ' '
955		- . Login_Lockout_Model::get_module_state( (bool) ( new Login_Lockout_Model() )->enabled );
	1044	+ . Login_Lockout_Model::get_module_state( ( new Login_Lockout_Model() )->enabled );
956	1045	// Notfound lockout.
957	1046	$strings[] = Notfound_Lockout::get_module_name() . ' '
958		- . Notfound_Lockout::get_module_state( (bool) ( new Notfound_Lockout() )->enabled );
	1047	+ . Notfound_Lockout::get_module_state( ( new Notfound_Lockout() )->enabled );
959	1048	// Global IP lockout.
960	1049	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
961		- . Global_Ip_Lockout::get_module_state( (bool) ( new Global_Ip_Lockout() )->enabled );
	1050	+ . Global_Ip_Lockout::get_module_state( ( new Global_Ip_Lockout() )->enabled );
	1051	+ // AntiBot Global Firewall.
	1052	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1053	+ . Antibot_Global_Firewall_Setting::get_module_state( ( new Antibot_Global_Firewall_Setting() )->enabled );
962	1054	// UA lockout.
963	1055	$strings[] = User_Agent_Lockout::get_module_name() . ' '
964		- . User_Agent_Lockout::get_module_state( (bool) ( new User_Agent_Lockout() )->enabled );
	1056	+ . User_Agent_Lockout::get_module_state( ( new User_Agent_Lockout() )->enabled );
965	1057	// Notifications and reports.
966	1058	if ( 'enabled' === ( new Firewall_Notification() )->status ) {
967	1059	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
968	1060	}
969		- if ( $is_pro && 'enabled' === $firewall_report->status ) {
970	1061	$strings[] = sprintf(
971		- /* translators: %s: Frequency value. */
972		- esc_html__( 'Email reports sending %s', 'defender-security' ),
973		- $firewall_report->frequency
	1062	+ /* translators: %s: Html for Pro-tag. */
	1063	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1064	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
974	1065	);
975		- } elseif ( ! $is_pro ) {
976	1066	$strings[] = sprintf(
977	1067	/* translators: %s: Html for Pro-tag. */
978		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1068	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
979	1069	'<span class="sui-tag sui-tag-pro">Pro</span>'
980	1070	);
981		- }
982	1071
983	1072	return $strings;
984	1073	}
985	1074
986	1075	/**
987		- * Generates configuration strings based on the provided configuration and
988		- * whether the product is a pro version.
	1076	+ * Generates configuration strings based on the provided configuration.
989	1077	*
990	1078	* @param array $config Configuration data.
991		- * @param bool $is_pro Indicates if the product is a pro version.
992	1079	*
993	1080	* @return array Returns an array of configuration strings.
994	1081	*/
995		- public function config_strings( array $config, bool $is_pro ): array {
	1082	+ public function config_strings( array $config ): array {
996	1083	$strings = array();
997	1084	// Login lockout.
998	1085	if ( isset( $config['login_protection'] ) ) {
999	1086	$strings[] = Login_Lockout_Model::get_module_name() . ' '
1000		- . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
	1087	+ . Login_Lockout_Model::get_module_state( (bool) $config['login_protection'] );
1001	1088	}
1002	1089	// NF lockout.
1003	1090	if ( isset( $config['detect_404'] ) ) {
1004	1091	$strings[] = Notfound_Lockout::get_module_name() . ' '
		@@ -1008,8 +1095,13 @@
1008	1095	if ( isset( $config['global_ip_list'] ) ) {
1009	1096	$strings[] = Global_Ip_Lockout::get_module_name() . ' '
1010	1097	. Global_Ip_Lockout::get_module_state( (bool) $config['global_ip_list'] );
1011	1098	}
	1099	+ // AntiBot Global Firewall.
	1100	+ if ( isset( $config['antibot'] ) ) {
	1101	+ $strings[] = Antibot_Global_Firewall_Setting::get_module_name() . ' '
	1102	+ . Antibot_Global_Firewall_Setting::get_module_state( (bool) $config['antibot'] );
	1103	+ }
1012	1104	// UA lockout.
1013	1105	if ( isset( $config['ua_banning_enabled'] ) ) {
1014	1106	$strings[] = User_Agent_Lockout::get_module_name() . ' '
1015	1107	. User_Agent_Lockout::get_module_state( (bool) $config['ua_banning_enabled'] );
		@@ -1017,22 +1109,18 @@
1017	1109	// Notifications.
1018	1110	if ( isset( $config['notification'] ) && 'enabled' === $config['notification'] ) {
1019	1111	$strings[] = esc_html__( 'Email notifications active', 'defender-security' );
1020	1112	}
1021		- // Report.
1022		- if ( $is_pro && 'enabled' === $config['report'] ) {
1023	1113	$strings[] = sprintf(
1024		- /* translators: %s: Frequency value. */
1025		- esc_html__( 'Email reports sending %s', 'defender-security' ),
1026		- $config['report_frequency']
	1114	+ /* translators: %s: Html for Pro-tag. */
	1115	+ esc_html__( 'Email report inactive %s', 'defender-security' ),
	1116	+ '<span class="sui-tag sui-tag-pro">Pro</span>'
1027	1117	);
1028		- } elseif ( ! $is_pro ) {
1029	1118	$strings[] = sprintf(
1030		- /* translators: %s: Html for Pro-tag. */
1031		- esc_html__( 'Email report inactive %s', 'defender-security' ),
	1119	+ /* translators: %s: Html for Pro-tag. */
	1120	+ esc_html__( 'Web Application Firewall (WAF) inactive %s', 'defender-security' ),
1032	1121	'<span class="sui-tag sui-tag-pro">Pro</span>'
1033	1122	);
1034		- }
1035	1123
1036	1124	return $strings;
1037	1125	}
1038	1126
		@@ -1133,9 +1221,12 @@
1133	1221	* @defender_route
1134	1222	* @since 3.3.0
1135	1223	*/
1136	1224	public function empty_lockouts() {
1137		- if ( Lockout_Ip::truncate() ) {
	1225	+ $ip_deleted = Lockout_Ip::truncate();
	1226	+ $log_deleted = Lockout_Log::delete_lockout_records();
	1227	+
	1228	+ if ( false !== $ip_deleted && false !== $log_deleted ) {
1138	1229	$this->log( 'Deleted lockout records successfully.', self::FIREWALL_LOG );
1139	1230
1140	1231	return new Response(
1141	1232	true,
		@@ -1199,9 +1290,9 @@
1199	1290	*/
1200	1291	public function print_emoji_script(): void {
1201	1292	$allowed_pages = array(
1202	1293	$this->slug,
1203		- wd_di()->get( Dashboard::class )->slug,
	1294	+ wd_di()->get( \WP_Defender\Controller\Dashboard::class )->slug,
1204	1295	);
1205	1296
1206	1297	if ( in_array( HTTP::get( 'page' ), $allowed_pages, true ) ) {
1207	1298	if ( ! function_exists( 'print_emoji_detection_script' ) ) {
		@@ -1308,8 +1399,11 @@
1308	1399	'salt' => defender_get_data_from_request( 'salt', 'r' ),
1309	1400	'signature' => defender_get_data_from_request( 'signature', 'r' ),
1310	1401	'number' => defender_get_data_from_request( 'solution', 'r' ),
1311	1402	);
	1403	+
	1404	+ // 'number' should be an integer.
	1405	+ $captcha_payload['number'] = is_numeric( $captcha_payload['number'] ) ? (int) $captcha_payload['number'] : null;
1312	1406
1313	1407	// Successful verification of captcha.
1314	1408	if ( '0' === $captcha_checkbox && wd_di()->get( Altcha_Handler::class )->verify_solution( $captcha_payload ) ) {
1315	1409	// Reset attempt data for all IPs in a batch.