easy-basic-authentication / class / easy-basic-authentication-class.php

easy-basic-authentication-class.php in Easy Basic Authentication – Add basic auth to site or admin area trunk, at class/easy-basic-authentication-class.php

199 lines 6.6 KB

Raw Download Zip

1	<?php
2
3	require_once (dirname(__FILE__).'/easy-basic-authentication-log-class.php');
4	require_once (dirname(__FILE__).'/easy-basic-authentication-emailalert-class.php');
5	require_once (dirname(__FILE__).'/easy-basic-authentication-form-class.php');
6	require_once (dirname(__FILE__).'/easy-basic-authentication-notice-class.php');
7	require_once (dirname(__FILE__).'/easy-basic-authentication-compatcheck-class.php');
8
9	class easy_basic_authentication_class {
10
11	private $log;
12	private $email;
13	private $form;
14	private $compatcheck;
15
16	public function __construct()
17	{
18	$this->log = new easy_basic_authentication_log_class();
19	$this->email = new easy_basic_authentication_emailalert_class();
20	$this->form = new easy_basic_authentication_form_class();
21	$notice = new easy_basic_authentication_notice_class();
22	$this->compatcheck = new easy_basic_authentication_compatcheck_class();
23	$this->compatcheck->register_hooks();
24
25	if(get_option( 'basic_auth_plugin_admin_enable' )) {
26	if (in_array($GLOBALS['pagenow'], array('wp-login.php', 'wp-register.php'))) {
27	add_action( 'init', array($this,'basic_auth_root') );
28	}
29	}
30
31	if(get_option( 'basic_auth_plugin_enable' ) && get_option( 'basic_auth_plugin_admin_enable' )){
32	add_action( 'init', array($this,'basic_auth_root') );
33	}
34
35	add_action( 'admin_menu', array($this,'basic_auth_plugin_menu' ));
36	add_action( 'admin_init', array($this->form,'basic_auth_plugin_settings_init' ));
37
38	add_action('admin_init', function () {
39	$post_data = $_POST;
40	$this->form->basic_auth_plugin_save_settings($post_data);
41	});
42
43	}
44
45	public function basic_auth_root()
46	{
47	$user = get_option('basic_auth_plugin_username');
48	$pass = get_option('basic_auth_plugin_password');
49
50	if ($this->whiteListChecker()) {
51	return;
52	}
53
54	if ($this->urlWhiteListChecker()) {
55	return;
56	}
57
58	if (!isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['HTTP_AUTHORIZATION'])) {
59	if (stripos($_SERVER['HTTP_AUTHORIZATION'], 'basic') === 0) {
60	list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)), 2);
61	}
62	}
63
64	if (!isset($_SERVER['PHP_AUTH_USER']) \|\| !isset($_SERVER['PHP_AUTH_PW']) \|\|
65	$_SERVER['PHP_AUTH_USER'] !== $user \|\|
66	!wp_check_password(wp_unslash($_SERVER['PHP_AUTH_PW']), $pass)) {
67	$this->do_exit(true);
68	}
69	}
70
71	public function urlWhiteListChecker() {
72	if (empty($_SERVER['HTTP_HOST']) \|\| empty($_SERVER['REQUEST_URI'])) {
73	return false;
74	}
75
76	$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
77	$currentUrl = $scheme . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
78
79	$whitelist = $this->getUrlWhiteList();
80
81	foreach ($whitelist as $entry) {
82	if ($this->isUrlAllowed($currentUrl, $entry)) {
83	return true;
84	}
85	}
86
87	return false;
88	}
89
90	private function isUrlAllowed($currentUrl, $entry) {
91	$currentUrl = rtrim($currentUrl, '/');
92	$entry = rtrim($entry, '/');
93
94	if (strpos($entry, '/') === 0) {
95	$path = wp_parse_url($currentUrl, PHP_URL_PATH);
96	return stripos($path, $entry) === 0;
97	}
98
99	if (!preg_match('#^https?://#i', $entry)) {
100	$scheme = wp_parse_url($currentUrl, PHP_URL_SCHEME) ?: 'https';
101	$entry = $scheme . '://' . $entry;
102	}
103
104	return stripos($currentUrl, $entry) === 0;
105	}
106
107	public function whiteListChecker() {
108	if (!isset($_SERVER['REMOTE_ADDR'])) {
109	return false;
110	}
111
112	$ip = $_SERVER['REMOTE_ADDR'];
113	$whitelist = $this->getWhiteList();
114
115	foreach ($whitelist as $entry) {
116	if ($this->isIpAllowed($ip, $entry)) {
117	return true;
118	}
119	}
120	return false;
121	}
122
123	private function isIpAllowed($ip, $entry) {
124	if (filter_var($entry, FILTER_VALIDATE_IP)) {
125	return $ip === $entry;
126	} elseif (strpos($entry, '/') !== false) {
127	return $this->isIpInCidr($ip, $entry);
128	} elseif (strpos($entry, '-') !== false) {
129	return $this->isIpInRange($ip, $entry);
130	}
131	return false;
132	}
133
134	private function isIpInCidr($ip, $cidr) {
135	list($subnet, $mask) = explode('/', $cidr);
136	$ipLong = ip2long($ip);
137	$subnetLong = ip2long($subnet);
138	$maskLong = -1 << (32 - $mask);
139	return ($ipLong & $maskLong) === ($subnetLong & $maskLong);
140	}
141
142	private function isIpInRange($ip, $range) {
143	list($start, $end) = array_map('trim', explode('-', $range));
144	$ipLong = ip2long($ip);
145	$startLong = ip2long($start);
146	$endLong = ip2long($end);
147	return ($ipLong >= $startLong && $ipLong <= $endLong);
148	}
149
150	public function do_exit($admin_area = false) {
151
152	$this->basic_auth_action_failed_access();
153	do_action('basic_auth_before_401');
154
155	if($admin_area) {
156	do_action('basic_auth_before_401_admin_area');
157	header( 'WWW-Authenticate: Basic realm="My Website"' );
158	header( 'HTTP/1.0 401 Unauthorized' );
159	exit;
160	} else {
161	header( 'HTTP/1.1 401 Unauthorized' );
162	header( 'WWW-Authenticate: Basic realm="Admin Area"' );
163	exit;
164	}
165	}
166
167	public function getWhiteList() {
168	return get_option( 'basic_auth_plugin_whitelist' )?explode(',',get_option( 'basic_auth_plugin_whitelist' )):[];
169	}
170
171	public function getUrlWhiteList() {
172	return get_option( 'basic_auth_plugin_urlwhitelist' )?explode(',',get_option( 'basic_auth_plugin_urlwhitelist' )):[];
173	}
174
175	public function basic_auth_plugin_menu() {
176	add_menu_page(
177	__('Configurations for Easy Basic Authentication', 'easy-basic-authentication'),
178	__('Easy Basic A.', 'easy-basic-authentication'),
179	'manage_options',
180	'basic-auth-plugin',
181	array($this->form, 'basic_auth_plugin_settings_page'),
182	'dashicons-lock'
183	);
184	if($this->log->is_enabled()) {
185	$this->log->getMenu();
186	}
187	}
188
189	public function basic_auth_action_failed_access() {
190	if($this->log->is_enabled()) {
191	$this->log->update_status($_SERVER);
192	}
193	if($this->email->is_enabled()) {
194	$this->email->sendAlert($_SERVER);
195	}
196	}
197
198	}
199