| @@ -26,9 +26,9 @@ | ||
| 26 | 26 | use WP_Defender\Component\IP\Antibot_Global_Firewall as Antibot_Global_Firewall_Component; |
| 27 | 27 | use WP_Defender\Component\IP\Global_IP as Global_IP_Component; |
| 28 | 28 | use WP_Defender\Component\Blacklist_Lockout; |
| 29 | 29 | use WP_Defender\Component\Http\Remote_Address; |
| 30 | -use MaxMind\Db\Reader\InvalidDatabaseException; | |
| 30 | +use WP_DEFENDER_VENDOR\MaxMind\Db\Reader\InvalidDatabaseException; | |
| 31 | 31 | use WP_Defender\Model\Setting\Notfound_Lockout; |
| 32 | 32 | use WP_Defender\Model\Setting\Global_Ip_Lockout; |
| 33 | 33 | use WP_Defender\Model\Setting\User_Agent_Lockout; |
| 34 | 34 | use WP_Defender\Component\Config\Config_Hub_Helper; |
| @@ -423,9 +423,9 @@ | ||
| 423 | 423 | ); |
| 424 | 424 | |
| 425 | 425 | wp_enqueue_style( |
| 426 | 426 | $handle, |
| 427 | - WP_DEFENDER_BASE_URL . 'assets/css/showcase.css', | |
| 427 | + WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css', | |
| 428 | 428 | array(), |
| 429 | 429 | DEFENDER_VERSION |
| 430 | 430 | ); |
| 431 | 431 | |
| @@ -529,12 +529,9 @@ | ||
| 529 | 529 | ), |
| 530 | 530 | ) |
| 531 | 531 | ); |
| 532 | 532 | $maybe_email = isset( $data['user_data'] ) ? $data['user_data'] : ''; |
| 533 | - if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) { | |
| 534 | - return new Response( false, array() ); | |
| 535 | - } | |
| 536 | - $ips = $this->get_user_ip(); | |
| 533 | + $ips = $this->get_user_ip(); | |
| 537 | 534 | // Check if at least one IP is blocked. |
| 538 | 535 | $blocked_ip = $this->service->get_blocked_ip( $ips ); |
| 539 | 536 | // If nothing, just return. |
| 540 | 537 | if ( '' === $blocked_ip ) { |
| @@ -539,8 +536,17 @@ | ||
| 539 | 536 | // If nothing, just return. |
| 540 | 537 | if ( '' === $blocked_ip ) { |
| 541 | 538 | return new Response( false, array() ); |
| 542 | 539 | } |
| 540 | + // Count every verification attempt and stop before account lookup or side effects when the limit is reached. | |
| 541 | + if ( $this->check_attempt_counter_by( $blocked_ip ) ) { | |
| 542 | + return new Response( false, array() ); | |
| 543 | + } | |
| 544 | + | |
| 545 | + // Always return the same response for accepted attempts to avoid exposing account existence or role. | |
| 546 | + if ( ! is_string( $maybe_email ) || '' === trim( $maybe_email ) ) { | |
| 547 | + return new Response( true, array() ); | |
| 548 | + } | |
| 543 | 549 | // Maybe is it a user email? |
| 544 | 550 | $user = get_user_by( 'email', $maybe_email ); |
| 545 | 551 | if ( ! is_object( $user ) ) { |
| 546 | 552 | // Maybe is it a username? |
| @@ -545,21 +551,21 @@ | ||
| 545 | 551 | if ( ! is_object( $user ) ) { |
| 546 | 552 | // Maybe is it a username? |
| 547 | 553 | $user = get_user_by( 'login', $maybe_email ); |
| 548 | 554 | if ( ! is_object( $user ) ) { |
| 549 | - $this->check_attempt_counter_by( $blocked_ip ); | |
| 550 | - | |
| 551 | - return new Response( false, array() ); | |
| 555 | + return new Response( true, array() ); | |
| 552 | 556 | } |
| 553 | 557 | } |
| 554 | 558 | // Send email only for admins. |
| 555 | 559 | if ( ! $this->is_admin( $user ) ) { |
| 556 | - // No need to count attempts for existed user but non-admin. | |
| 557 | - return new Response( false, array() ); | |
| 560 | + return new Response( true, array() ); | |
| 558 | 561 | } |
| 559 | 562 | // Create Unlockout records. |
| 560 | 563 | $arr_uids = array(); |
| 561 | 564 | foreach ( $ips as $ip ) { |
| 565 | + if ( Unlockout::has_pending_request( $ip, $user->user_email ) ) { | |
| 566 | + continue; | |
| 567 | + } | |
| 562 | 568 | // Collect blocked IP's. |
| 563 | 569 | $created_id = wd_di()->get( Unlockout::class )->create( $ip, $user->user_email ); |
| 564 | 570 | if ( $created_id ) { |
| 565 | 571 | $arr_uids[] = $created_id; |
| @@ -565,9 +571,11 @@ | ||
| 565 | 571 | $arr_uids[] = $created_id; |
| 566 | 572 | } |
| 567 | 573 | } |
| 568 | 574 | |
| 569 | - $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids ); | |
| 575 | + if ( array() !== $arr_uids ) { | |
| 576 | + $this->send_unlock_email( $user->user_email, $user->user_login, $arr_uids ); | |
| 577 | + } | |
| 570 | 578 | |
| 571 | 579 | return new Response( true, array() ); |
| 572 | 580 | } |
| 573 | 581 | |
