← All changes | class/easy-basic-authentication-class.php +365 -214 1.3.5 → 4.2.0 View file →

		@@ -1,271 +1,422 @@
1		-<?php
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit;
	4	+}
2	5
	6	+
	7	+require_once (dirname(__FILE__).'/easy-basic-authentication-log-class.php');
	8	+require_once (dirname(__FILE__).'/easy-basic-authentication-emailalert-class.php');
	9	+require_once (dirname(__FILE__).'/easy-basic-authentication-form-class.php');
	10	+require_once (dirname(__FILE__).'/easy-basic-authentication-notice-class.php');
	11	+require_once (dirname(__FILE__).'/easy-basic-authentication-compatcheck-class.php');
	12	+
3	13	class easy_basic_authentication_class {
4	14
	15	+ private $log;
	16	+ private $email;
	17	+ private $form;
	18	+ private $compatcheck;
5	19
6	20	public function __construct()
7	21	{
8		- if(get_option( 'basic_auth_plugin_admin_enable' )) {
9		- if (in_array($GLOBALS['pagenow'], array('wp-login.php', 'wp-register.php'))) {
10		- add_action( 'init', array($this,'basic_auth_admin') );
	22	+ $this->log = new easy_basic_authentication_log_class();
	23	+ $this->email = new easy_basic_authentication_emailalert_class();
	24	+ $this->form = new easy_basic_authentication_form_class();
	25	+ $notice = new easy_basic_authentication_notice_class();
	26	+ $this->compatcheck = new easy_basic_authentication_compatcheck_class();
	27	+ $this->compatcheck->register_hooks();
	28	+
	29	+ // Fuori da una richiesta HTTP la sfida 401 non ha alcun senso: da riga di comando
	30	+ // diventa un exit() silenzioso che blocca WP-CLI, il cron di sistema e qualunque
	31	+ // script che faccia require di wp-load.php.
	32	+ if ( ! self::is_cli() ) {
	33	+ $pagenow = isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '';
	34	+
	35	+ if(get_option( 'basic_auth_plugin_admin_enable' )) {
	36	+ if (in_array($pagenow, array('wp-login.php', 'wp-register.php'))) {
	37	+ add_action( 'init', array($this,'basic_auth_root') );
	38	+ }
11	39	}
12		- }
13	40
14		- if(get_option( 'basic_auth_plugin_enable' ) && get_option( 'basic_auth_plugin_admin_enable' )){
15		- add_action( 'init', array($this,'basic_auth_root') );
	41	+ if(get_option( 'basic_auth_plugin_enable' ) && get_option( 'basic_auth_plugin_admin_enable' )){
	42	+ add_action( 'init', array($this,'basic_auth_root') );
	43	+ }
16	44	}
17	45
	46	+ add_action( 'init', array($this, 'maybe_upgrade'), 1 );
	47	+
18	48	add_action( 'admin_menu', array($this,'basic_auth_plugin_menu' ));
19		- add_action( 'admin_init', array($this,'basic_auth_plugin_settings_init' ));
	49	+ add_action( 'admin_init', array($this->form,'basic_auth_plugin_settings_init' ));
20	50
21		- add_action( 'admin_init', array($this,'basic_auth_plugin_save_settings') );
	51	+ add_action('admin_init', function () {
	52	+ if ( ! current_user_can( 'manage_options' ) ) {
	53	+ return;
	54	+ }
	55	+
	56	+ // Il nonce e verificato dentro basic_auth_plugin_save_settings(), che riceve
	57	+ // i dati grezzi perche deve distinguere un campo assente da uno vuoto (le
	58	+ // checkbox non spuntate non vengono inviate).
	59	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	60	+ $post_data = $_POST;
	61	+ $this->form->basic_auth_plugin_save_settings($post_data);
	62	+ });
22	63
23	64	}
24	65
25		- public function basic_auth_root() {
26		- $user = get_option( 'basic_auth_plugin_username' );
27		- $pass = get_option( 'basic_auth_plugin_password' );
28		-
29		- if ( !isset( $_SERVER['PHP_AUTH_USER'] ) || !isset( $_SERVER['PHP_AUTH_PW'] ) ||
30		- $_SERVER['PHP_AUTH_USER'] != $user || !wp_check_password( $_SERVER['PHP_AUTH_PW'], $pass ) ) {
31		-
32		- $this->basic_auth_log_failed_access();
	66	+ /**
	67	+ * Se stiamo girando fuori da una richiesta HTTP (WP-CLI, cron di sistema, script).
	68	+ *
	69	+ * @return bool
	70	+ */
	71	+ public static function is_cli() {
	72	+ if ( defined( 'WP_CLI' ) && WP_CLI ) {
	73	+ return true;
	74	+ }
33	75
34		- do_action('basic_auth_before_401');
35		-
36		- header( 'WWW-Authenticate: Basic realm="My Website"' );
37		- header( 'HTTP/1.0 401 Unauthorized' );
38		- echo 'Autenticazione richiesta';
39		- exit;
	76	+ return 'cli' === PHP_SAPI || 'phpdbg' === PHP_SAPI;
	77	+ }
	78	+
	79	+ public function basic_auth_root()
	80	+ {
	81	+ if ( self::is_cli() ) {
	82	+ return;
40	83	}
41		- }
42		-
43		- public function basic_auth_admin() {
44		- $user = get_option( 'basic_auth_plugin_username' );
45		- $pass = get_option( 'basic_auth_plugin_password' );
46		-
47		- if ( !isset( $_SERVER['PHP_AUTH_USER'] ) || !isset( $_SERVER['PHP_AUTH_PW'] ) ||
48		- $_SERVER['PHP_AUTH_USER'] != $user || !wp_check_password( $_SERVER['PHP_AUTH_PW'], $pass ) ) {
49		-
50		- $this->basic_auth_log_failed_access();
51		-
52		- do_action('basic_auth_before_401');
53	84
54		- header( 'HTTP/1.1 401 Unauthorized' );
55		- header( 'WWW-Authenticate: Basic realm="Admin Area"' );
56		- exit;
57		- }
58		- }
59		-
60		-
61		- public function basic_auth_plugin_menu() {
62		- $access_count = $this->basic_auth_count_not_viewed_log_failed_access();
63		- add_menu_page(
64		- __('Configurations for Easy Basic Authentication', 'easy-basic-authentication'),
65		- __('Easy Basic A.', 'easy-basic-authentication'),
66		- 'manage_options',
67		- 'basic-auth-plugin',
68		- array($this, 'basic_auth_plugin_settings_page'),
69		- 'dashicons-lock'
70		- );
71		- if($this->log_is_enabled()) {
72		- $access_count = $this->basic_auth_count_not_viewed_log_failed_access();
73		- add_submenu_page(
74		- 'basic-auth-plugin',
75		- __('Log Page', 'easy-basic-authentication'),
76		- __('Log Page', 'easy-basic-authentication'). '<span class="update-plugins count-' . $access_count . '"><span class="plugin-count">' . $access_count . '</span></span>',
77		- 'manage_options',
78		- 'basic-auth-login',
79		- array($this, 'basic_auth_login_page')
80		- );
	85	+ // wp-cron.php chiude la risposta con fastcgi_finish_request() prima ancora di
	86	+ // caricare WordPress: quando arriviamo qui gli header sono gia partiti. La sfida
	87	+ // 401 non raggiunge nessuno, lascia un warning "headers already sent" nel log a
	88	+ // ogni giro, e l'exit che la segue ferma tutte le azioni pianificate del sito.
	89	+ if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
	90	+ return;
81	91	}
	92	+
	93	+ $user = get_option('basic_auth_plugin_username');
	94	+ $pass = get_option('basic_auth_plugin_password');
82	95
	96	+ if ($this->whiteListChecker()) {
	97	+ return;
	98	+ }
	99	+
	100	+ if ($this->urlWhiteListChecker()) {
	101	+ return;
	102	+ }
	103	+
	104	+ if ($this->tokenChecker()) {
	105	+ return;
	106	+ }
	107	+
	108	+ // Alcuni server (nginx + FastCGI su tutti) non popolano PHP_AUTH_USER da soli:
	109	+ // le credenziali arrivano solo nell'header Authorization e vanno estratte a mano.
	110	+ if (!isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['HTTP_AUTHORIZATION'])) {
	111	+ $authorization = sanitize_text_field( wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ) );
	112	+
	113	+ if ( preg_match( '#^Basic\s+([A-Za-z0-9+/=]+)$#i', $authorization, $matches ) ) {
	114	+ $decoded = base64_decode( $matches[1], true );
	115	+
	116	+ // Senza i due punti non ci sono due campi: la list() originale
	117	+ // generava un warning "Undefined array key 1" su PHP 8.
	118	+ if ( false !== $decoded && false !== strpos( $decoded, ':' ) ) {
	119	+ list( $sent_user, $sent_pass ) = explode( ':', $decoded, 2 );
	120	+ $_SERVER['PHP_AUTH_USER'] = $sent_user;
	121	+ $_SERVER['PHP_AUTH_PW'] = $sent_pass;
	122	+ }
	123	+ }
	124	+ }
	125	+
	126	+ // Basic Auth prevede sempre un primo giro senza credenziali: il browser chiede,
	127	+ // riceve 401, e solo allora rimanda con utente e password. Quel 401 non e un
	128	+ // tentativo fallito, e registrarlo significherebbe una voce di log (e una mail)
	129	+ // per ogni visitatore e ogni bot che passa.
	130	+ $credentials_sent = isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']);
	131	+
	132	+ if (!$credentials_sent) {
	133	+ $this->do_exit(true, false);
	134	+ return;
	135	+ }
	136	+
	137	+ // L'utente e salvato passando per sanitize_text_field(), quindi quello in arrivo
	138	+ // va normalizzato allo stesso modo perche il confronto sia sensato.
	139	+ $sent_user = sanitize_text_field( wp_unslash( $_SERVER['PHP_AUTH_USER'] ) );
	140	+
	141	+ // La password invece NON va sanitizzata: alterarla farebbe fallire l'accesso a
	142	+ // chiunque ne usi una con caratteri speciali. Non viene mai stampata, solo
	143	+ // confrontata con l'hash.
	144	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	145	+ $sent_pass = wp_unslash( $_SERVER['PHP_AUTH_PW'] );
	146	+
	147	+ $credentials_valid = hash_equals( (string) $user, $sent_user )
	148	+ && wp_check_password( $sent_pass, $pass );
	149	+
	150	+ if (!$credentials_valid) {
	151	+ // Credenziali inviate e sbagliate: questo si che va segnalato.
	152	+ $this->do_exit(true, true);
	153	+ }
83	154	}
84		-
85		- public function basic_auth_login_page() {
86		- if(array_key_exists('clear_mode',$_POST)) {
87		- update_option('basic_auth_failure_logs', array());
	155	+
	156	+ public function urlWhiteListChecker() {
	157	+ if (empty($_SERVER['HTTP_HOST']) || empty($_SERVER['REQUEST_URI'])) {
	158	+ return false;
88	159	}
89		- $user_log_data = array_reverse($this->basic_auth_get_log_failed_access());
90		- include plugin_dir_path( __FILE__ ) . '../template/log_page.php';
91		- $this->update_view();
	160	+
	161	+ $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
	162	+
	163	+ $host = sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) );
	164	+
	165	+ // L'URI serve solo al confronto con la whitelist, non viene mai stampato.
	166	+ // sanitize_text_field() qui sarebbe dannoso: rimuove le sequenze %xx e
	167	+ // cambierebbe il confronto su qualsiasi percorso con caratteri codificati.
	168	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	169	+ $request_uri = wp_unslash( $_SERVER['REQUEST_URI'] );
	170	+
	171	+ $currentUrl = $scheme . '://' . $host . $request_uri;
	172	+
	173	+ $whitelist = $this->getUrlWhiteList();
	174	+
	175	+ foreach ($whitelist as $entry) {
	176	+ if ($this->isUrlAllowed($currentUrl, $entry)) {
	177	+ return true;
	178	+ }
	179	+ }
	180	+
	181	+ return false;
92	182	}
93		-
94	183
95		- public function basic_auth_plugin_settings_page() {
96		- include plugin_dir_path( __FILE__ ) . '../template/settings_page.php';
	184	+ private function isUrlAllowed($currentUrl, $entry) {
	185	+ $currentUrl = rtrim($currentUrl, '/');
	186	+ $entry = rtrim($entry, '/');
	187	+
	188	+ if (strpos($entry, '/') === 0) {
	189	+ $path = wp_parse_url($currentUrl, PHP_URL_PATH);
	190	+ return stripos($path, $entry) === 0;
	191	+ }
	192	+
	193	+ if (!preg_match('#^https?://#i', $entry)) {
	194	+ $scheme = wp_parse_url($currentUrl, PHP_URL_SCHEME) ?: 'https';
	195	+ $entry = $scheme . '://' . $entry;
	196	+ }
	197	+
	198	+ return stripos($currentUrl, $entry) === 0;
97	199	}
	200	+
	201	+ public function whiteListChecker() {
	202	+ if (!isset($_SERVER['REMOTE_ADDR'])) {
	203	+ return false;
	204	+ }
98	205
99		- public function basic_auth_plugin_settings_init() {
100		- register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_enable' );
101		- register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_enable' );
102		- register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_username' );
103		- register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_log_enable' );
104		-
105		- add_settings_section(
106		- 'basic-auth-plugin-section',
107		- __('Configurations for Easy Basic Authentication', 'easy-basic-authentication'),
108		- array($this,'basic_auth_plugin_section_cb'),
109		- 'basic-auth-plugin-settings'
110		- );
111		-
112		- add_settings_field(
113		- 'basic-auth-plugin-admin-enable',
114		- __('Enable for wp-admin', 'easy-basic-authentication'),
115		- array($this,'basic_auth_plugin_admin_enable_cb'),
116		- 'basic-auth-plugin-settings',
117		- 'basic-auth-plugin-section'
118		- );
119		-
120		- add_settings_field(
121		- 'basic-auth-plugin-enable',
122		- __('Enable for the entire site (only if wp-admin is enabled)', 'easy-basic-authentication'),
123		- array($this,'basic_auth_plugin_enable_cb'),
124		- 'basic-auth-plugin-settings',
125		- 'basic-auth-plugin-section'
126		- );
127		-
128		- add_settings_field(
129		- 'basic-auth-plugin-username',
130		- __('Username', 'easy-basic-authentication'),
131		- array($this,'basic_auth_plugin_username_cb'),
132		- 'basic-auth-plugin-settings',
133		- 'basic-auth-plugin-section'
134		- );
135		-
136		- add_settings_field(
137		- 'basic-auth-plugin-password',
138		- __('Password', 'easy-basic-authentication'),
139		- array($this,'basic_auth_plugin_password_cb'),
140		- 'basic-auth-plugin-settings',
141		- 'basic-auth-plugin-section'
142		- );
143		-
144		- add_settings_field(
145		- 'basic-auth-plugin-admin-log-enable',
146		- __('Enable access logs', 'easy-basic-authentication'),
147		- array($this,'basic_auth_plugin_admin_log_enable_cb'),
148		- 'basic-auth-plugin-settings',
149		- 'basic-auth-plugin-section'
150		- );
151		-
	206	+ // Un REMOTE_ADDR malformato non deve arrivare ai confronti della whitelist:
	207	+ // ip2long() restituirebbe false e il risultato sarebbe imprevedibile.
	208	+ $ip = filter_var( wp_unslash( $_SERVER['REMOTE_ADDR'] ), FILTER_VALIDATE_IP );
	209	+
	210	+ if ( false === $ip ) {
	211	+ return false;
	212	+ }
	213	+
	214	+ $whitelist = $this->getWhiteList();
	215	+
	216	+ foreach ($whitelist as $entry) {
	217	+ if ($this->isIpAllowed($ip, $entry)) {
	218	+ return true;
	219	+ }
	220	+ }
	221	+ return false;
152	222	}
153	223
154		- public function basic_auth_plugin_section_cb() {
155		- echo __('Configure basic authentication', 'easy-basic-authentication');
	224	+ private function isIpAllowed($ip, $entry) {
	225	+ if (filter_var($entry, FILTER_VALIDATE_IP)) {
	226	+ return $ip === $entry;
	227	+ } elseif (strpos($entry, '/') !== false) {
	228	+ return $this->isIpInCidr($ip, $entry);
	229	+ } elseif (strpos($entry, '-') !== false) {
	230	+ return $this->isIpInRange($ip, $entry);
	231	+ }
	232	+ return false;
156	233	}
157	234
158		- public function basic_auth_plugin_enable_cb() {
159		- $admin_enable = get_option( 'basic_auth_plugin_admin_enable' );
160		- $enable = get_option( 'basic_auth_plugin_enable' );
161		- ?>
162		- <input type="checkbox" name="basic_auth_plugin_enable" value="1" <?php checked( $enable, 1 ); ?><?php disabled( !$admin_enable ); ?>>
163		- <?php
	235	+ private function isIpInCidr($ip, $cidr) {
	236	+ list($subnet, $mask) = explode('/', $cidr);
	237	+ $ipLong = ip2long($ip);
	238	+ $subnetLong = ip2long($subnet);
	239	+ $maskLong = -1 << (32 - $mask);
	240	+ return ($ipLong & $maskLong) === ($subnetLong & $maskLong);
164	241	}
165	242
166		- public function basic_auth_plugin_admin_enable_cb() {
167		- $enable = get_option( 'basic_auth_plugin_admin_enable' );
168		- ?>
169		- <input type="checkbox" name="basic_auth_plugin_admin_enable" value="1" <?php checked( $enable, 1 ); ?>>
170		- <?php
	243	+ private function isIpInRange($ip, $range) {
	244	+ list($start, $end) = array_map('trim', explode('-', $range));
	245	+ $ipLong = ip2long($ip);
	246	+ $startLong = ip2long($start);
	247	+ $endLong = ip2long($end);
	248	+ return ($ipLong >= $startLong && $ipLong <= $endLong);
171	249	}
172		-
173		- public function basic_auth_plugin_username_cb() {
174		- $username = get_option( 'basic_auth_plugin_username' );
175		- ?>
176		- <input type="text" name="basic_auth_plugin_username" value="<?php echo esc_attr( $username ); ?>">
177		- <?php
	250	+
	251	+ /**
	252	+ * Un crawler o un servizio esterno sta passando col token d'accesso?
	253	+ *
	254	+ * Serve a far entrare chi non puo usare l'autenticazione HTTP: un crawler, un
	255	+ * controllo di raggiungibilita, un front-end headless. Il token vale solo per
	256	+ * il sito: l'amministrazione e la pagina di accesso restano protette, perche
	257	+ * un crawler non ha motivo di entrarci e aprirgliele sarebbe rischio gratuito.
	258	+ *
	259	+ * @return bool
	260	+ */
	261	+ public function tokenChecker() {
	262	+ $token = (string) get_option('basic_auth_plugin_access_token', '');
	263	+
	264	+ // Funzione spenta finche non si genera un token.
	265	+ if ('' === $token) {
	266	+ return false;
	267	+ }
	268	+
	269	+ // Mai per l'amministrazione o la pagina di accesso.
	270	+ if (is_admin() || $this->isLoginRequest()) {
	271	+ return false;
	272	+ }
	273	+
	274	+ $sent = $this->getRequestToken();
	275	+
	276	+ if ('' === $sent) {
	277	+ return false;
	278	+ }
	279	+
	280	+ // hash_equals: il confronto non deve rivelare quanti caratteri erano giusti.
	281	+ if (!hash_equals($token, $sent)) {
	282	+ // Un token sbagliato e un tentativo deliberato, non il primo giro a vuoto
	283	+ // del protocollo: va segnalato come una password sbagliata.
	284	+ $this->basic_auth_action_failed_access();
	285	+
	286	+ return false;
	287	+ }
	288	+
	289	+ /**
	290	+ * Scatta quando una richiesta entra col token invece che con le credenziali.
	291	+ */
	292	+ do_action('basic_auth_token_access_granted');
	293	+
	294	+ return true;
178	295	}
179		-
180		- public function basic_auth_plugin_password_cb() {
181		- $password = get_option( 'basic_auth_plugin_password' )
182		- ? __('Password entered', 'easy-basic-authentication')
183		- : __('Enter the password', 'easy-basic-authentication');
184		- ?>
185		- <input type="password" name="basic_auth_plugin_password" value="" placeholder="<?php echo $password; ?>">
186		- <?php
187		- }
188		-
189		- public function basic_auth_plugin_admin_log_enable_cb() {
190		- $enable = get_option( 'basic_auth_plugin_admin_log_enable' );
191		- ?>
192		- <input type="checkbox" name="basic_auth_plugin_admin_log_enable" value="1" <?php checked( $enable, 1 ); ?>>
193		- <?php
194		- }
195		-
196		-
197		- public function basic_auth_plugin_save_settings() {
198		- if ( isset( $_POST['eba_submit'] ) ) {
199		- $admin_enable = isset( $_POST['basic_auth_plugin_admin_enable'] ) ? 1 : 0;
200		- $enable = isset( $_POST['basic_auth_plugin_enable'] ) ? 1 : 0;
201		- $username = sanitize_text_field( $_POST['basic_auth_plugin_username'] );
202		- $password = sanitize_text_field( $_POST['basic_auth_plugin_password'] );
203		- $log_enable = isset( $_POST['basic_auth_plugin_admin_log_enable'] ) ? 1 : 0;
204		-
205		- update_option( 'basic_auth_plugin_admin_enable', $admin_enable );
206		- update_option( 'basic_auth_plugin_enable', $enable );
207		- update_option( 'basic_auth_plugin_username', $username );
208		- update_option( 'basic_auth_plugin_admin_log_enable', $log_enable );
209		-
210		- if ( ! empty( $password ) ) {
211		- $hashed_password = wp_hash_password( $password );
212		- update_option( 'basic_auth_plugin_password', $hashed_password );
	296	+
	297	+ /**
	298	+ * Il token inviato con la richiesta, da uno dei due header accettati.
	299	+ *
	300	+ * @return string
	301	+ */
	302	+ private function getRequestToken() {
	303	+ // Header dedicato: la strada piu pulita.
	304	+ if (!empty($_SERVER['HTTP_X_BASIC_AUTH_TOKEN'])) {
	305	+ return trim(sanitize_text_field(wp_unslash($_SERVER['HTTP_X_BASIC_AUTH_TOKEN'])));
	306	+ }
	307	+
	308	+ // Authorization: Bearer, per i servizi che sanno mandare solo questo.
	309	+ if (!empty($_SERVER['HTTP_AUTHORIZATION'])) {
	310	+ $header = sanitize_text_field(wp_unslash($_SERVER['HTTP_AUTHORIZATION']));
	311	+
	312	+ if (preg_match('#^Bearer\s+(\S+)$#i', $header, $matches)) {
	313	+ return $matches[1];
213	314	}
214	315	}
	316	+
	317	+ return '';
215	318	}
216	319
217		- public function basic_auth_log_failed_access() {
218		- if($this->log_is_enabled()) {
219		- $logs = get_option('basic_auth_failure_logs', array());
	320	+ /**
	321	+ * Se la richiesta corrente e la pagina di accesso.
	322	+ *
	323	+ * @return bool
	324	+ */
	325	+ private function isLoginRequest() {
	326	+ $pagenow = isset($GLOBALS['pagenow']) ? $GLOBALS['pagenow'] : '';
220	327
221		- $log_entry = array(
222		- 'id' => uniqid(),
223		- 'ip' => esc_attr($_SERVER['REMOTE_ADDR']),
224		- 'data' => current_time('mysql'),
225		- 'browser' => esc_attr($_SERVER['HTTP_USER_AGENT']),
226		- 'request_uri' => esc_attr($_SERVER["REQUEST_URI"]),
227		- 'viewed' => 0
228		- );
	328	+ if (in_array($pagenow, array('wp-login.php', 'wp-register.php'), true)) {
	329	+ return true;
	330	+ }
229	331
230		- $log_entry = apply_filters('basic_auth_single_log_entry', $log_entry);
	332	+ if (empty($_SERVER['REQUEST_URI'])) {
	333	+ return false;
	334	+ }
231	335
232		- $logs[] = $log_entry;
	336	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- solo confronto, mai stampato.
	337	+ $uri = wp_unslash($_SERVER['REQUEST_URI']);
233	338
234		- $logs = apply_filters('basic_auth_logs_entry', $logs);
	339	+ return false !== stripos($uri, 'wp-login.php') || false !== stripos($uri, 'wp-register.php');
	340	+ }
235	341
236		- update_option('basic_auth_failure_logs', $logs);
	342	+ /**
	343	+ * Manda la sfida 401.
	344	+ *
	345	+ * @param bool $admin_area Se la richiesta riguarda l'area di amministrazione.
	346	+ * @param bool $log_attempt Se registrare l'accesso fra i tentativi falliti.
	347	+ * False per il 401 iniziale, che fa parte del protocollo.
	348	+ */
	349	+ public function do_exit($admin_area = false, $log_attempt = true) {
	350	+
	351	+ if ($log_attempt) {
	352	+ $this->basic_auth_action_failed_access();
237	353	}
	354	+
	355	+ do_action('basic_auth_before_401');
	356	+
	357	+ if ($admin_area) {
	358	+ do_action('basic_auth_before_401_admin_area');
	359	+ }
	360	+
	361	+ // I browser memorizzano le credenziali per realm: cambiare questa stringa fa
	362	+ // ricomparire la richiesta di accesso a chi era gia autenticato. Il valore
	363	+ // predefinito resta quello storico; chi vuole cambiarlo usa il filtro.
	364	+ $realm = apply_filters('basic_auth_realm', 'My Website', $admin_area);
	365	+ $realm = str_replace(array('"', "\r", "\n"), '', (string) $realm);
	366	+
	367	+ header('WWW-Authenticate: Basic realm="' . $realm . '"');
	368	+ status_header(401);
	369	+ exit;
238	370	}
239	371
240		- public function basic_auth_get_log_failed_access() {
241		- return get_option('basic_auth_failure_logs', array());
	372	+ public function getWhiteList() {
	373	+ return get_option( 'basic_auth_plugin_whitelist' )?explode(',',get_option( 'basic_auth_plugin_whitelist' )):[];
242	374	}
243	375
244		- public function basic_auth_count_log_failed_access() {
245		- return count($this->basic_auth_get_log_failed_access());
	376	+ public function getUrlWhiteList() {
	377	+ return get_option( 'basic_auth_plugin_urlwhitelist' )?explode(',',get_option( 'basic_auth_plugin_urlwhitelist' )):[];
246	378	}
247	379
248		- public function basic_auth_not_viewed_log_failed_access() {
249		- $return_not_viewed = array_filter($this->basic_auth_get_log_failed_access(), function ($entry) {
250		- return isset($entry['viewed']) && $entry['viewed'] === 0;
251		- });
252		- return $return_not_viewed;
253		- }
	380	+ public function basic_auth_plugin_menu() {
	381	+ add_menu_page(
	382	+ __('Configurations for Easy Basic Authentication', 'easy-basic-authentication'),
	383	+ __('Easy Basic A.', 'easy-basic-authentication'),
	384	+ 'manage_options',
	385	+ 'basic-auth-plugin',
	386	+ array($this->form, 'basic_auth_plugin_settings_page'),
	387	+ 'dashicons-lock'
	388	+ );
	389	+ if($this->log->is_enabled()) {
	390	+ $this->log->getMenu();
	391	+ }
	392	+ }
	393	+
	394	+ /**
	395	+ * Migrazioni una tantum, eseguite quando cambia la versione del plugin.
	396	+ *
	397	+ * Fino alla 4.0.0 il log degli accessi stava in un'opzione in autoload: fino a
	398	+ * 500 voci, circa 144 KB, deserializzate a ogni richiesta del sito.
	399	+ */
	400	+ public function maybe_upgrade() {
	401	+ if ( get_option( 'basic_auth_plugin_db_version' ) === EASY_BASIC_AUTHENTICATION_VERSION ) {
	402	+ return;
	403	+ }
254	404
255		- public function basic_auth_count_not_viewed_log_failed_access() {
256		- return count($this->basic_auth_not_viewed_log_failed_access());
	405	+ $logs = get_option( 'basic_auth_failure_logs', null );
	406	+ if ( null !== $logs ) {
	407	+ update_option( 'basic_auth_failure_logs', $logs, false );
	408	+ }
	409	+
	410	+ update_option( 'basic_auth_plugin_db_version', EASY_BASIC_AUTHENTICATION_VERSION, false );
257	411	}
258	412
259		- public function update_view() {
260		- $logs = get_option('basic_auth_failure_logs', array());
261		- foreach ($logs as &$entry) {
262		- $entry['viewed'] = 1;
	413	+ public function basic_auth_action_failed_access() {
	414	+ if($this->log->is_enabled()) {
	415	+ $this->log->update_status($_SERVER);
263	416	}
264		- update_option('basic_auth_failure_logs', $logs);
265		- }
266		-
267		- public function log_is_enabled() {
268		- return get_option( 'basic_auth_plugin_admin_log_enable' );
	417	+ if($this->email->is_enabled()) {
	418	+ $this->email->sendAlert($_SERVER);
	419	+ }
269	420	}
270	421
271	422	}