← All changes | src/model/notification/class-firewall-notification.php +33 -14 6.1.0 → 6.3.0 View file →

		@@ -91,10 +91,10 @@
91	91	return true;
92	92	}
93	93	return false;
94	94	}
95		- // Check 'User Agent Lockout'.
96		- if ( Lockout_Log::LOCKOUT_UA === $model->type ) {
	95	+ // Check 'User Agent Lockout' (includes Fake Bot and Malicious Bot lockouts).
	96	+ if ( in_array( $model->type, Lockout_Log::get_ua_lockout_types(), true ) ) {
97	97	if ( true === wd_di()->get( User_Agent_Lockout::class )->enabled ) {
98	98	return true;
99	99	}
100	100	return false;
		@@ -103,8 +103,24 @@
103	103	return false;
104	104	}
105	105
106	106	/**
	107	+ * Sends the notification for a lockout when it is enabled for that type.
	108	+ *
	109	+ * Firewall-time detectors call this directly because the 'defender_notify' hook
	110	+ * is not registered yet at that stage, keeping the eligibility rules in this class.
	111	+ *
	112	+ * @param Lockout_Log $model The lockout log model.
	113	+ *
	114	+ * @return void
	115	+ */
	116	+ public function notify_lockout( Lockout_Log $model ): void {
	117	+ if ( $this->check_options( $model ) ) {
	118	+ $this->send( $model );
	119	+ }
	120	+ }
	121	+
	122	+ /**
107	123	* Constructs and sends the firewall notification email based on the lockout log.
108	124	*
109	125	* @param Lockout_Log $model The lockout log model.
110	126	*
		@@ -149,9 +165,9 @@
149	165	if ( Lockout_Log::AUTH_LOCK === $model->type ) {
150	166	return 'login-lockout';
151	167	}
152	168
153		- if ( Lockout_Log::LOCKOUT_UA === $model->type ) {
	169	+ if ( in_array( $model->type, Lockout_Log::get_ua_lockout_types(), true ) ) {
154	170	return 'ua-lockout';
155	171	}
156	172
157	173	return 'lockout-404';
		@@ -239,9 +255,10 @@
239	255	* @return array Email subject and body text.
240	256	*/
241	257	private function get_login_lockout_email_data( Lockout_Log $model, string $network_site_url ): array {
242	258	/* translators: %s: Site URL. */
243		- $subject = sprintf( esc_html__( 'Login lockout alert for %s', 'defender-security' ), $network_site_url );
	259	+ $subject = sprintf( __( 'Login lockout alert for %s', 'defender-security' ), $network_site_url );
	260	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
244	261	// If the log is made from the 2FA module, then we get the settings from it, otherwise from Login_Lockout.
245	262	$settings = wd_di()->get( Login_Lockout::class );
246	263	if ( false !== strpos( $model->log, '2fa attempts' ) ) {
247	264	$component = wd_di()->get( Two_Fa::class );
		@@ -260,10 +277,10 @@
260	277	'defender-security'
261	278	);
262	279	$text = sprintf(
263	280	$text,
264		- '<strong>' . $model->ip . '</strong>',
265		- '<a href="' . $network_site_url . '">' . $network_site_url . '</a>',
	281	+ '<strong>' . esc_html( $model->ip ) . '</strong>',
	282	+ '<a href="' . esc_url( $network_site_url ) . '">' . esc_html( $network_site_url ) . '</a>',
266	283	'<strong>' . $attempt_limit . '</strong>',
267	284	$type,
268	285	$this->get_lockout_duration_text( $settings->lockout_type, $time_limit )
269	286	);
		@@ -281,16 +298,17 @@
281	298	*/
282	299	private function get_ua_lockout_email_data( Lockout_Log $model, string $network_site_url ): array {
283	300	$subject = sprintf(
284	301	/* translators: %s: Site URL. */
285		- esc_html__( 'User Agent lockout alert for %s', 'defender-security' ),
	302	+ __( 'User Agent lockout alert for %s', 'defender-security' ),
286	303	$network_site_url
287	304	);
288		- $text = sprintf(
	305	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
	306	+ $text = sprintf(
289	307	/* translators: 1: User agent, 2: Site URL */
290	308	__( 'The %1$s has been locked out of %2$s.', 'defender-security' ),
291		- '<strong>' . $model->user_agent . '</strong>',
292		- '<a href="' . $network_site_url . '">' . $network_site_url . '</a>',
	309	+ '<strong>' . esc_html( $model->user_agent ) . '</strong>',
	310	+ '<a href="' . esc_url( $network_site_url ) . '">' . esc_html( $network_site_url ) . '</a>'
293	311	);
294	312
295	313	return compact( 'subject', 'text' );
296	314	}
		@@ -304,9 +322,10 @@
304	322	* @return array Email subject and body text.
305	323	*/
306	324	private function get_404_lockout_email_data( Lockout_Log $model, string $network_site_url ): array {
307	325	/* translators: %s: Site URL. */
308		- $subject = sprintf( esc_html__( '404 lockout alert for %s', 'defender-security' ), $network_site_url );
	326	+ $subject = sprintf( __( '404 lockout alert for %s', 'defender-security' ), $network_site_url );
	327	+ $subject = wp_specialchars_decode( $subject, ENT_QUOTES );
309	328	$settings = wd_di()->get( Notfound_Lockout::class );
310	329	/* translators: 1: IP address, 2: Site URL, 3: Total attempt from an IP, 4: Tried, 5. Translation string. */
311	330	$text = __(
312	331	'The host %1$s has been locked out of %2$s due to more than %3$s 404 requests for the file %4$s. %5$s',
		@@ -313,12 +332,12 @@
313	332	'defender-security'
314	333	);
315	334	$text = sprintf(
316	335	$text,
317		- '<strong>' . $model->ip . '</strong>',
318		- '<a href="' . $network_site_url . '">' . $network_site_url . '</a>',
	336	+ '<strong>' . esc_html( $model->ip ) . '</strong>',
	337	+ '<a href="' . esc_url( $network_site_url ) . '">' . esc_html( $network_site_url ) . '</a>',
319	338	'<strong>' . $settings->attempt . '</strong>',
320		- '<strong>' . $model->tried . '</strong>',
	339	+ '<strong>' . esc_html( $model->tried ) . '</strong>',
321	340	$this->get_lockout_duration_text( $settings->lockout_type, $settings->duration . ' ' . $settings->duration_unit )
322	341	);
323	342
324	343	return compact( 'subject', 'text' );