| 1 |
<?php |
| 2 |
/** |
| 3 |
* Module Name: Protect |
| 4 |
* Module Description: Enabling brute force protection will prevent bots and hackers from attempting to log in to your website with common username and password combinations. |
| 5 |
* Sort Order: 1 |
| 6 |
* Recommendation Order: 4 |
| 7 |
* First Introduced: 3.4 |
| 8 |
* Requires Connection: Yes |
| 9 |
* Auto Activate: Yes |
| 10 |
* Module Tags: Recommended |
| 11 |
* Feature: Security |
| 12 |
* Additional Search Queries: security, jetpack protect, secure, protection, botnet, brute force, protect, login, bot, password, passwords, strong passwords, strong password, wp-login.php, protect admin |
| 13 |
*/ |
| 14 |
|
| 15 |
use Automattic\Jetpack\Constants; |
| 16 |
use Automattic\Jetpack\Connection\Utils as Connection_Utils; |
| 17 |
|
| 18 |
include_once JETPACK__PLUGIN_DIR . 'modules/protect/shared-functions.php'; |
| 19 |
|
| 20 |
class Jetpack_Protect_Module { |
| 21 |
|
| 22 |
private static $__instance = null; |
| 23 |
public $api_key; |
| 24 |
public $api_key_error; |
| 25 |
public $whitelist; |
| 26 |
public $whitelist_error; |
| 27 |
public $whitelist_saved; |
| 28 |
private $local_host; |
| 29 |
public $last_request; |
| 30 |
public $last_response_raw; |
| 31 |
public $last_response; |
| 32 |
private $block_login_with_math; |
| 33 |
|
| 34 |
/** |
| 35 |
* Singleton implementation |
| 36 |
* |
| 37 |
* @return object |
| 38 |
*/ |
| 39 |
public static function instance() { |
| 40 |
if ( ! is_a( self::$__instance, 'Jetpack_Protect_Module' ) ) { |
| 41 |
self::$__instance = new Jetpack_Protect_Module(); |
| 42 |
} |
| 43 |
|
| 44 |
return self::$__instance; |
| 45 |
} |
| 46 |
|
| 47 |
/** |
| 48 |
* Registers actions |
| 49 |
*/ |
| 50 |
private function __construct() { |
| 51 |
add_action( 'jetpack_activate_module_protect', array ( $this, 'on_activation' ) ); |
| 52 |
add_action( 'jetpack_deactivate_module_protect', array ( $this, 'on_deactivation' ) ); |
| 53 |
add_action( 'jetpack_modules_loaded', array ( $this, 'modules_loaded' ) ); |
| 54 |
add_action( 'login_form', array ( $this, 'check_use_math' ), 0 ); |
| 55 |
add_filter( 'authenticate', array ( $this, 'check_preauth' ), 10, 3 ); |
| 56 |
add_action( 'wp_login', array ( $this, 'log_successful_login' ), 10, 2 ); |
| 57 |
add_action( 'wp_login_failed', array ( $this, 'log_failed_attempt' ) ); |
| 58 |
add_action( 'admin_init', array ( $this, 'maybe_update_headers' ) ); |
| 59 |
add_action( 'admin_init', array ( $this, 'maybe_display_security_warning' ) ); |
| 60 |
|
| 61 |
// This is a backup in case $pagenow fails for some reason |
| 62 |
add_action( 'login_form', array ( $this, 'check_login_ability' ), 1 ); |
| 63 |
|
| 64 |
// Load math fallback after math page form submission |
| 65 |
if ( isset( $_POST[ 'jetpack_protect_process_math_form' ] ) ) { |
| 66 |
include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; |
| 67 |
new Jetpack_Protect_Math_Authenticate; |
| 68 |
} |
| 69 |
|
| 70 |
// Runs a script every day to clean up expired transients so they don't |
| 71 |
// clog up our users' databases |
| 72 |
require_once( JETPACK__PLUGIN_DIR . '/modules/protect/transient-cleanup.php' ); |
| 73 |
} |
| 74 |
|
| 75 |
/** |
| 76 |
* On module activation, try to get an api key |
| 77 |
*/ |
| 78 |
public function on_activation() { |
| 79 |
if ( is_multisite() && is_main_site() && get_site_option( 'jetpack_protect_active', 0 ) == 0 ) { |
| 80 |
update_site_option( 'jetpack_protect_active', 1 ); |
| 81 |
} |
| 82 |
|
| 83 |
update_site_option( 'jetpack_protect_activating', 'activating' ); |
| 84 |
|
| 85 |
// Get BruteProtect's counter number |
| 86 |
Jetpack_Protect_Module::protect_call( 'check_key' ); |
| 87 |
} |
| 88 |
|
| 89 |
/** |
| 90 |
* On module deactivation, unset protect_active |
| 91 |
*/ |
| 92 |
public function on_deactivation() { |
| 93 |
if ( is_multisite() && is_main_site() ) { |
| 94 |
update_site_option( 'jetpack_protect_active', 0 ); |
| 95 |
} |
| 96 |
} |
| 97 |
|
| 98 |
public function maybe_get_protect_key() { |
| 99 |
if ( get_site_option( 'jetpack_protect_activating', false ) && ! get_site_option( 'jetpack_protect_key', false ) ) { |
| 100 |
$key = $this->get_protect_key(); |
| 101 |
delete_site_option( 'jetpack_protect_activating' ); |
| 102 |
return $key; |
| 103 |
} |
| 104 |
|
| 105 |
return get_site_option( 'jetpack_protect_key' ); |
| 106 |
} |
| 107 |
|
| 108 |
/** |
| 109 |
* Sends a "check_key" API call once a day. This call allows us to track IP-related |
| 110 |
* headers for this server via the Protect API, in order to better identify the source |
| 111 |
* IP for login attempts |
| 112 |
*/ |
| 113 |
public function maybe_update_headers( $force = false ) { |
| 114 |
$updated_recently = $this->get_transient( 'jpp_headers_updated_recently' ); |
| 115 |
|
| 116 |
if ( ! $force ) { |
| 117 |
if ( isset( $_GET['protect_update_headers'] ) ) { |
| 118 |
$force = true; |
| 119 |
} |
| 120 |
} |
| 121 |
|
| 122 |
// check that current user is admin so we prevent a lower level user from adding |
| 123 |
// a trusted header, allowing them to brute force an admin account |
| 124 |
if ( ( $updated_recently && ! $force ) || ! current_user_can( 'update_plugins' ) ) { |
| 125 |
return; |
| 126 |
} |
| 127 |
|
| 128 |
$response = Jetpack_Protect_Module::protect_call( 'check_key' ); |
| 129 |
$this->set_transient( 'jpp_headers_updated_recently', 1, DAY_IN_SECONDS ); |
| 130 |
|
| 131 |
if ( isset( $response['msg'] ) && $response['msg'] ) { |
| 132 |
update_site_option( 'trusted_ip_header', json_decode( $response['msg'] ) ); |
| 133 |
} |
| 134 |
|
| 135 |
} |
| 136 |
|
| 137 |
public function maybe_display_security_warning() { |
| 138 |
if ( is_multisite() && current_user_can( 'manage_network' ) ) { |
| 139 |
if ( ! function_exists( 'is_plugin_active_for_network' ) ) { |
| 140 |
require_once( ABSPATH . '/wp-admin/includes/plugin.php' ); |
| 141 |
} |
| 142 |
|
| 143 |
if ( ! is_plugin_active_for_network( plugin_basename( JETPACK__PLUGIN_FILE ) ) ) { |
| 144 |
add_action( 'load-index.php', array( $this, 'prepare_jetpack_protect_multisite_notice' ) ); |
| 145 |
add_action( 'wp_ajax_jetpack-protect-dismiss-multisite-banner', array( $this, 'ajax_dismiss_handler' ) ); |
| 146 |
} |
| 147 |
} |
| 148 |
} |
| 149 |
|
| 150 |
public function prepare_jetpack_protect_multisite_notice() { |
| 151 |
$dismissed = get_site_option( 'jetpack_dismissed_protect_multisite_banner' ); |
| 152 |
if ( $dismissed ) { |
| 153 |
return; |
| 154 |
} |
| 155 |
|
| 156 |
add_action( 'admin_notices', array ( $this, 'admin_jetpack_manage_notice' ) ); |
| 157 |
} |
| 158 |
|
| 159 |
public function ajax_dismiss_handler() { |
| 160 |
check_ajax_referer( 'jetpack_protect_multisite_banner_opt_out' ); |
| 161 |
|
| 162 |
if ( ! current_user_can( 'manage_network' ) ) { |
| 163 |
wp_send_json_error( new WP_Error( 'insufficient_permissions' ) ); |
| 164 |
} |
| 165 |
|
| 166 |
update_site_option( 'jetpack_dismissed_protect_multisite_banner', true ); |
| 167 |
|
| 168 |
wp_send_json_success(); |
| 169 |
} |
| 170 |
|
| 171 |
/** |
| 172 |
* Displays a warning about Jetpack Protect's network activation requirement. |
| 173 |
* Attaches some custom JS to Core's `is-dismissible` UI to save the dismissed state. |
| 174 |
*/ |
| 175 |
public function admin_jetpack_manage_notice() { |
| 176 |
?> |
| 177 |
<div class="jetpack-protect-warning notice notice-warning is-dismissible" data-dismiss-nonce="<?php echo esc_attr( wp_create_nonce( 'jetpack_protect_multisite_banner_opt_out' ) ); ?>"> |
| 178 |
<h2><?php esc_html_e( 'Jetpack Brute Force Attack Prevention cannot keep your site secure', 'jetpack' ); ?></h2> |
| 179 |
|
| 180 |
<p><?php esc_html_e( "Thanks for activating Jetpack's brute force attack prevention feature! To start protecting your whole WordPress Multisite Network, please network activate the Jetpack plugin. Due to the way logins are handled on WordPress Multisite Networks, Jetpack must be network activated in order for the brute force attack prevention feature to work properly.", 'jetpack' ); ?></p> |
| 181 |
|
| 182 |
<p> |
| 183 |
<a class="button-primary" href="<?php echo esc_url( network_admin_url( 'plugins.php' ) ); ?>"> |
| 184 |
<?php esc_html_e( 'View Network Admin', 'jetpack' ); ?> |
| 185 |
</a> |
| 186 |
<a class="button" href="<?php echo esc_url( __( 'https://jetpack.com/support/multisite-protect', 'jetpack' ) ); ?>" target="_blank"> |
| 187 |
<?php esc_html_e( 'Learn More' ); ?> |
| 188 |
</a> |
| 189 |
</p> |
| 190 |
</div> |
| 191 |
<script> |
| 192 |
jQuery( function( $ ) { |
| 193 |
$( '.jetpack-protect-warning' ).on( 'click', 'button.notice-dismiss', function( event ) { |
| 194 |
event.preventDefault(); |
| 195 |
|
| 196 |
wp.ajax.post( |
| 197 |
'jetpack-protect-dismiss-multisite-banner', |
| 198 |
{ |
| 199 |
_wpnonce: $( event.delegateTarget ).data( 'dismiss-nonce' ), |
| 200 |
} |
| 201 |
).fail( function( error ) { <?php |
| 202 |
// A failure here is really strange, and there's not really anything a site owner can do to fix one. |
| 203 |
// Just log the error for now to help debugging. ?> |
| 204 |
|
| 205 |
if ( 'function' === typeof error.done && '-1' === error.responseText ) { |
| 206 |
console.error( 'Notice dismissal failed: check_ajax_referer' ); |
| 207 |
} else { |
| 208 |
console.error( 'Notice dismissal failed: ' + JSON.stringify( error ) ); |
| 209 |
} |
| 210 |
} ) |
| 211 |
} ); |
| 212 |
} ); |
| 213 |
</script> |
| 214 |
<?php |
| 215 |
} |
| 216 |
|
| 217 |
/** |
| 218 |
* Request an api key from wordpress.com |
| 219 |
* |
| 220 |
* @return bool | string |
| 221 |
*/ |
| 222 |
public function get_protect_key() { |
| 223 |
|
| 224 |
$protect_blog_id = Jetpack_Protect_Module::get_main_blog_jetpack_id(); |
| 225 |
|
| 226 |
// If we can't find the the blog id, that means we are on multisite, and the main site never connected |
| 227 |
// the protect api key is linked to the main blog id - instruct the user to connect their main blog |
| 228 |
if ( ! $protect_blog_id ) { |
| 229 |
$this->api_key_error = __( 'Your main blog is not connected to WordPress.com. Please connect to get an API key.', 'jetpack' ); |
| 230 |
|
| 231 |
return false; |
| 232 |
} |
| 233 |
|
| 234 |
$request = array ( |
| 235 |
'jetpack_blog_id' => $protect_blog_id, |
| 236 |
'bruteprotect_api_key' => get_site_option( 'bruteprotect_api_key' ), |
| 237 |
'multisite' => '0', |
| 238 |
); |
| 239 |
|
| 240 |
// Send the number of blogs on the network if we are on multisite |
| 241 |
if ( is_multisite() ) { |
| 242 |
$request['multisite'] = get_blog_count(); |
| 243 |
if ( ! $request['multisite'] ) { |
| 244 |
global $wpdb; |
| 245 |
$request['multisite'] = $wpdb->get_var( "SELECT COUNT(blog_id) as c FROM $wpdb->blogs WHERE spam = '0' AND deleted = '0' and archived = '0'" ); |
| 246 |
} |
| 247 |
} |
| 248 |
|
| 249 |
// Request the key |
| 250 |
$xml = new Jetpack_IXR_Client(); |
| 251 |
$xml->query( 'jetpack.protect.requestKey', $request ); |
| 252 |
|
| 253 |
// Hmm, can't talk to wordpress.com |
| 254 |
if ( $xml->isError() ) { |
| 255 |
$code = $xml->getErrorCode(); |
| 256 |
$message = $xml->getErrorMessage(); |
| 257 |
$this->api_key_error = sprintf( __( 'Error connecting to WordPress.com. Code: %1$s, %2$s', 'jetpack' ), $code, $message ); |
| 258 |
|
| 259 |
return false; |
| 260 |
} |
| 261 |
|
| 262 |
$response = $xml->getResponse(); |
| 263 |
|
| 264 |
// Hmm. Can't talk to the protect servers ( api.bruteprotect.com ) |
| 265 |
if ( ! isset( $response['data'] ) ) { |
| 266 |
$this->api_key_error = __( 'No reply from Jetpack servers', 'jetpack' ); |
| 267 |
|
| 268 |
return false; |
| 269 |
} |
| 270 |
|
| 271 |
// There was an issue generating the key |
| 272 |
if ( empty( $response['success'] ) ) { |
| 273 |
$this->api_key_error = $response['data']; |
| 274 |
|
| 275 |
return false; |
| 276 |
} |
| 277 |
|
| 278 |
// Key generation successful! |
| 279 |
$active_plugins = Jetpack::get_active_plugins(); |
| 280 |
|
| 281 |
// We only want to deactivate BruteProtect if we successfully get a key |
| 282 |
if ( in_array( 'bruteprotect/bruteprotect.php', $active_plugins ) ) { |
| 283 |
Jetpack_Client_Server::deactivate_plugin( 'bruteprotect/bruteprotect.php', 'BruteProtect' ); |
| 284 |
} |
| 285 |
|
| 286 |
$key = $response['data']; |
| 287 |
update_site_option( 'jetpack_protect_key', $key ); |
| 288 |
|
| 289 |
return $key; |
| 290 |
} |
| 291 |
|
| 292 |
/** |
| 293 |
* Called via WP action wp_login_failed to log failed attempt with the api |
| 294 |
* |
| 295 |
* Fires custom, plugable action jpp_log_failed_attempt with the IP |
| 296 |
* |
| 297 |
* @return void |
| 298 |
*/ |
| 299 |
function log_failed_attempt( $login_user = null ) { |
| 300 |
|
| 301 |
/** |
| 302 |
* Fires before every failed login attempt. |
| 303 |
* |
| 304 |
* @module protect |
| 305 |
* |
| 306 |
* @since 3.4.0 |
| 307 |
* |
| 308 |
* @param array Information about failed login attempt |
| 309 |
* [ |
| 310 |
* 'login' => (string) Username or email used in failed login attempt |
| 311 |
* ] |
| 312 |
*/ |
| 313 |
do_action( 'jpp_log_failed_attempt', array( 'login' => $login_user ) ); |
| 314 |
|
| 315 |
if ( isset( $_COOKIE['jpp_math_pass'] ) ) { |
| 316 |
|
| 317 |
$transient = $this->get_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); |
| 318 |
$transient--; |
| 319 |
|
| 320 |
if ( ! $transient || $transient < 1 ) { |
| 321 |
$this->delete_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); |
| 322 |
setcookie( 'jpp_math_pass', 0, time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false ); |
| 323 |
} else { |
| 324 |
$this->set_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'], $transient, DAY_IN_SECONDS ); |
| 325 |
} |
| 326 |
|
| 327 |
} |
| 328 |
$this->protect_call( 'failed_attempt' ); |
| 329 |
} |
| 330 |
|
| 331 |
/** |
| 332 |
* Set up the Protect configuration page |
| 333 |
*/ |
| 334 |
public function modules_loaded() { |
| 335 |
Jetpack::enable_module_configurable( __FILE__ ); |
| 336 |
} |
| 337 |
|
| 338 |
/** |
| 339 |
* Logs a successful login back to our servers, this allows us to make sure we're not blocking |
| 340 |
* a busy IP that has a lot of good logins along with some forgotten passwords. Also saves current user's ip |
| 341 |
* to the ip address whitelist |
| 342 |
*/ |
| 343 |
public function log_successful_login( $user_login, $user = null ) { |
| 344 |
if ( ! $user ) { // For do_action( 'wp_login' ) calls that lacked passing the 2nd arg. |
| 345 |
$user = get_user_by( 'login', $user_login ); |
| 346 |
} |
| 347 |
|
| 348 |
$this->protect_call( 'successful_login', array ( 'roles' => $user->roles ) ); |
| 349 |
} |
| 350 |
|
| 351 |
|
| 352 |
/** |
| 353 |
* Checks for loginability BEFORE authentication so that bots don't get to go around the log in form. |
| 354 |
* |
| 355 |
* If we are using our math fallback, authenticate via math-fallback.php |
| 356 |
* |
| 357 |
* @param string $user |
| 358 |
* @param string $username |
| 359 |
* @param string $password |
| 360 |
* |
| 361 |
* @return string $user |
| 362 |
*/ |
| 363 |
function check_preauth( $user = 'Not Used By Protect', $username = 'Not Used By Protect', $password = 'Not Used By Protect' ) { |
| 364 |
$allow_login = $this->check_login_ability( true ); |
| 365 |
$use_math = $this->get_transient( 'brute_use_math' ); |
| 366 |
|
| 367 |
if ( ! $allow_login ) { |
| 368 |
$this->block_with_math(); |
| 369 |
} |
| 370 |
|
| 371 |
if ( ( 1 == $use_math || 1 == $this->block_login_with_math ) && isset( $_POST['log'] ) ) { |
| 372 |
include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; |
| 373 |
Jetpack_Protect_Math_Authenticate::math_authenticate(); |
| 374 |
} |
| 375 |
|
| 376 |
return $user; |
| 377 |
} |
| 378 |
|
| 379 |
/** |
| 380 |
* Get all IP headers so that we can process on our server... |
| 381 |
* |
| 382 |
* @return string |
| 383 |
*/ |
| 384 |
function get_headers() { |
| 385 |
$ip_related_headers = array ( |
| 386 |
'GD_PHP_HANDLER', |
| 387 |
'HTTP_AKAMAI_ORIGIN_HOP', |
| 388 |
'HTTP_CF_CONNECTING_IP', |
| 389 |
'HTTP_CLIENT_IP', |
| 390 |
'HTTP_FASTLY_CLIENT_IP', |
| 391 |
'HTTP_FORWARDED', |
| 392 |
'HTTP_FORWARDED_FOR', |
| 393 |
'HTTP_INCAP_CLIENT_IP', |
| 394 |
'HTTP_TRUE_CLIENT_IP', |
| 395 |
'HTTP_X_CLIENTIP', |
| 396 |
'HTTP_X_CLUSTER_CLIENT_IP', |
| 397 |
'HTTP_X_FORWARDED', |
| 398 |
'HTTP_X_FORWARDED_FOR', |
| 399 |
'HTTP_X_IP_TRAIL', |
| 400 |
'HTTP_X_REAL_IP', |
| 401 |
'HTTP_X_VARNISH', |
| 402 |
'REMOTE_ADDR' |
| 403 |
); |
| 404 |
|
| 405 |
foreach ( $ip_related_headers as $header ) { |
| 406 |
if ( ! empty( $_SERVER[ $header ] ) ) { |
| 407 |
$output[ $header ] = $_SERVER[ $header ]; |
| 408 |
} |
| 409 |
} |
| 410 |
|
| 411 |
return $output; |
| 412 |
} |
| 413 |
|
| 414 |
/* |
| 415 |
* Checks if the IP address has been whitelisted |
| 416 |
* |
| 417 |
* @param string $ip |
| 418 |
* |
| 419 |
* @return bool |
| 420 |
*/ |
| 421 |
function ip_is_whitelisted( $ip ) { |
| 422 |
// If we found an exact match in wp-config |
| 423 |
if ( defined( 'JETPACK_IP_ADDRESS_OK' ) && JETPACK_IP_ADDRESS_OK == $ip ) { |
| 424 |
return true; |
| 425 |
} |
| 426 |
|
| 427 |
$whitelist = jetpack_protect_get_local_whitelist(); |
| 428 |
|
| 429 |
if ( is_multisite() ) { |
| 430 |
$whitelist = array_merge( $whitelist, get_site_option( 'jetpack_protect_global_whitelist', array () ) ); |
| 431 |
} |
| 432 |
|
| 433 |
if ( ! empty( $whitelist ) ) : |
| 434 |
foreach ( $whitelist as $item ) : |
| 435 |
// If the IPs are an exact match |
| 436 |
if ( ! $item->range && isset( $item->ip_address ) && $item->ip_address == $ip ) { |
| 437 |
return true; |
| 438 |
} |
| 439 |
|
| 440 |
if ( $item->range && isset( $item->range_low ) && isset( $item->range_high ) ) { |
| 441 |
if ( jetpack_protect_ip_address_is_in_range( $ip, $item->range_low, $item->range_high ) ) { |
| 442 |
return true; |
| 443 |
} |
| 444 |
} |
| 445 |
endforeach; |
| 446 |
endif; |
| 447 |
|
| 448 |
return false; |
| 449 |
} |
| 450 |
|
| 451 |
/** |
| 452 |
* Checks the status for a given IP. API results are cached as transients |
| 453 |
* |
| 454 |
* @param bool $preauth Whether or not we are checking prior to authorization |
| 455 |
* |
| 456 |
* @return bool Either returns true, fires $this->kill_login, or includes a math fallback and returns false |
| 457 |
*/ |
| 458 |
function check_login_ability( $preauth = false ) { |
| 459 |
|
| 460 |
/** |
| 461 |
* JETPACK_ALWAYS_PROTECT_LOGIN will always disable the login page, and use a page provided by Jetpack. |
| 462 |
*/ |
| 463 |
if ( Constants::is_true( 'JETPACK_ALWAYS_PROTECT_LOGIN' ) ) { |
| 464 |
$this->kill_login(); |
| 465 |
} |
| 466 |
|
| 467 |
if ( $this->is_current_ip_whitelisted() ) { |
| 468 |
return true; |
| 469 |
} |
| 470 |
|
| 471 |
$status = $this->get_cached_status(); |
| 472 |
|
| 473 |
if ( empty( $status ) ) { |
| 474 |
// If we've reached this point, this means that the IP isn't cached. |
| 475 |
// Now we check with the Protect API to see if we should allow login |
| 476 |
$response = $this->protect_call( $action = 'check_ip' ); |
| 477 |
|
| 478 |
if ( isset( $response['math'] ) && ! function_exists( 'brute_math_authenticate' ) ) { |
| 479 |
include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; |
| 480 |
new Jetpack_Protect_Math_Authenticate; |
| 481 |
|
| 482 |
return false; |
| 483 |
} |
| 484 |
|
| 485 |
$status = $response['status']; |
| 486 |
} |
| 487 |
|
| 488 |
if ( 'blocked' == $status ) { |
| 489 |
$this->block_with_math(); |
| 490 |
} |
| 491 |
|
| 492 |
if ( 'blocked-hard' == $status ) { |
| 493 |
$this->kill_login(); |
| 494 |
} |
| 495 |
|
| 496 |
return true; |
| 497 |
} |
| 498 |
|
| 499 |
function is_current_ip_whitelisted() { |
| 500 |
$ip = jetpack_protect_get_ip(); |
| 501 |
|
| 502 |
// Server is misconfigured and we can't get an IP |
| 503 |
if ( ! $ip && class_exists( 'Jetpack' ) ) { |
| 504 |
Jetpack::deactivate_module( 'protect' ); |
| 505 |
ob_start(); |
| 506 |
Jetpack::state( 'message', 'protect_misconfigured_ip' ); |
| 507 |
ob_end_clean(); |
| 508 |
return true; |
| 509 |
} |
| 510 |
|
| 511 |
/** |
| 512 |
* Short-circuit check_login_ability. |
| 513 |
* |
| 514 |
* If there is an alternate way to validate the current IP such as |
| 515 |
* a hard-coded list of IP addresses, we can short-circuit the rest |
| 516 |
* of the login ability checks and return true here. |
| 517 |
* |
| 518 |
* @module protect |
| 519 |
* |
| 520 |
* @since 4.4.0 |
| 521 |
* |
| 522 |
* @param bool false Should we allow all logins for the current ip? Default: false |
| 523 |
*/ |
| 524 |
if ( apply_filters( 'jpp_allow_login', false, $ip ) ) { |
| 525 |
return true; |
| 526 |
} |
| 527 |
|
| 528 |
if ( jetpack_protect_ip_is_private( $ip ) ) { |
| 529 |
return true; |
| 530 |
} |
| 531 |
|
| 532 |
if ( $this->ip_is_whitelisted( $ip ) ) { |
| 533 |
return true; |
| 534 |
} |
| 535 |
} |
| 536 |
|
| 537 |
function has_login_ability() { |
| 538 |
if ( $this->is_current_ip_whitelisted() ) { |
| 539 |
return true; |
| 540 |
} |
| 541 |
$status = $this->get_cached_status(); |
| 542 |
if ( empty( $status ) || $status === 'ok' ) { |
| 543 |
return true; |
| 544 |
} |
| 545 |
return false; |
| 546 |
} |
| 547 |
|
| 548 |
function get_cached_status() { |
| 549 |
$transient_name = $this->get_transient_name(); |
| 550 |
$value = $this->get_transient( $transient_name ); |
| 551 |
if ( isset( $value['status'] ) ) { |
| 552 |
return $value['status']; |
| 553 |
} |
| 554 |
return ''; |
| 555 |
} |
| 556 |
|
| 557 |
function block_with_math() { |
| 558 |
/** |
| 559 |
* By default, Protect will allow a user who has been blocked for too |
| 560 |
* many failed logins to start answering math questions to continue logging in |
| 561 |
* |
| 562 |
* For added security, you can disable this. |
| 563 |
* |
| 564 |
* @module protect |
| 565 |
* |
| 566 |
* @since 3.6.0 |
| 567 |
* |
| 568 |
* @param bool Whether to allow math for blocked users or not. |
| 569 |
*/ |
| 570 |
|
| 571 |
$this->block_login_with_math = 1; |
| 572 |
/** |
| 573 |
* Allow Math fallback for blocked IPs. |
| 574 |
* |
| 575 |
* @module protect |
| 576 |
* |
| 577 |
* @since 3.6.0 |
| 578 |
* |
| 579 |
* @param bool true Should we fallback to the Math questions when an IP is blocked. Default to true. |
| 580 |
*/ |
| 581 |
$allow_math_fallback_on_fail = apply_filters( 'jpp_use_captcha_when_blocked', true ); |
| 582 |
if ( ! $allow_math_fallback_on_fail ) { |
| 583 |
$this->kill_login(); |
| 584 |
} |
| 585 |
include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; |
| 586 |
new Jetpack_Protect_Math_Authenticate; |
| 587 |
|
| 588 |
return false; |
| 589 |
} |
| 590 |
|
| 591 |
/* |
| 592 |
* Kill a login attempt |
| 593 |
*/ |
| 594 |
function kill_login() { |
| 595 |
if ( |
| 596 |
isset( $_GET['action'], $_GET['_wpnonce'] ) && |
| 597 |
'logout' === $_GET['action'] && |
| 598 |
wp_verify_nonce( $_GET['_wpnonce'], 'log-out' ) && |
| 599 |
wp_get_current_user() |
| 600 |
|
| 601 |
) { |
| 602 |
// Allow users to logout |
| 603 |
return; |
| 604 |
} |
| 605 |
|
| 606 |
$ip = jetpack_protect_get_ip(); |
| 607 |
/** |
| 608 |
* Fires before every killed login. |
| 609 |
* |
| 610 |
* @module protect |
| 611 |
* |
| 612 |
* @since 3.4.0 |
| 613 |
* |
| 614 |
* @param string $ip IP flagged by Protect. |
| 615 |
*/ |
| 616 |
do_action( 'jpp_kill_login', $ip ); |
| 617 |
|
| 618 |
if( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { |
| 619 |
$die_string = sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations.', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ) ); |
| 620 |
wp_die( |
| 621 |
$die_string, |
| 622 |
__( 'Login Blocked by Jetpack', 'jetpack' ), |
| 623 |
array ( 'response' => 403 ) |
| 624 |
); |
| 625 |
} |
| 626 |
|
| 627 |
require_once dirname( __FILE__ ) . '/protect/blocked-login-page.php'; |
| 628 |
$blocked_login_page = Jetpack_Protect_Blocked_Login_Page::instance( $ip ); |
| 629 |
|
| 630 |
if ( $blocked_login_page->is_blocked_user_valid() ) { |
| 631 |
return; |
| 632 |
} |
| 633 |
|
| 634 |
$blocked_login_page->render_and_die(); |
| 635 |
} |
| 636 |
|
| 637 |
/* |
| 638 |
* Checks if the protect API call has failed, and if so initiates the math captcha fallback. |
| 639 |
*/ |
| 640 |
public function check_use_math() { |
| 641 |
$use_math = $this->get_transient( 'brute_use_math' ); |
| 642 |
if ( $use_math ) { |
| 643 |
include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; |
| 644 |
new Jetpack_Protect_Math_Authenticate; |
| 645 |
} |
| 646 |
} |
| 647 |
|
| 648 |
/** |
| 649 |
* If we're in a multisite network, return the blog ID of the primary blog |
| 650 |
* |
| 651 |
* @return int |
| 652 |
*/ |
| 653 |
public function get_main_blog_id() { |
| 654 |
if ( ! is_multisite() ) { |
| 655 |
return false; |
| 656 |
} |
| 657 |
|
| 658 |
global $current_site; |
| 659 |
$primary_blog_id = $current_site->blog_id; |
| 660 |
|
| 661 |
return $primary_blog_id; |
| 662 |
} |
| 663 |
|
| 664 |
/** |
| 665 |
* Get jetpack blog id, or the jetpack blog id of the main blog in the main network |
| 666 |
* |
| 667 |
* @return int |
| 668 |
*/ |
| 669 |
public function get_main_blog_jetpack_id() { |
| 670 |
if ( ! is_main_site() ) { |
| 671 |
switch_to_blog( $this->get_main_blog_id() ); |
| 672 |
$id = Jetpack::get_option( 'id', false ); |
| 673 |
restore_current_blog(); |
| 674 |
} else { |
| 675 |
$id = Jetpack::get_option( 'id' ); |
| 676 |
} |
| 677 |
|
| 678 |
return $id; |
| 679 |
} |
| 680 |
|
| 681 |
public function check_api_key() { |
| 682 |
$response = $this->protect_call( 'check_key' ); |
| 683 |
|
| 684 |
if ( isset( $response['ckval'] ) ) { |
| 685 |
return true; |
| 686 |
} |
| 687 |
|
| 688 |
if ( isset( $response['error'] ) ) { |
| 689 |
|
| 690 |
if ( $response['error'] == 'Invalid API Key' ) { |
| 691 |
$this->api_key_error = __( 'Your API key is invalid', 'jetpack' ); |
| 692 |
} |
| 693 |
|
| 694 |
if ( $response['error'] == 'API Key Required' ) { |
| 695 |
$this->api_key_error = __( 'No API key', 'jetpack' ); |
| 696 |
} |
| 697 |
} |
| 698 |
|
| 699 |
$this->api_key_error = __( 'There was an error contacting Jetpack servers.', 'jetpack' ); |
| 700 |
|
| 701 |
return false; |
| 702 |
} |
| 703 |
|
| 704 |
/** |
| 705 |
* Calls over to the api using wp_remote_post |
| 706 |
* |
| 707 |
* @param string $action 'check_ip', 'check_key', or 'failed_attempt' |
| 708 |
* @param array $request Any custom data to post to the api |
| 709 |
* |
| 710 |
* @return array |
| 711 |
*/ |
| 712 |
function protect_call( $action = 'check_ip', $request = array () ) { |
| 713 |
global $wp_version; |
| 714 |
|
| 715 |
$api_key = $this->maybe_get_protect_key(); |
| 716 |
|
| 717 |
$user_agent = "WordPress/{$wp_version} | Jetpack/" . constant( 'JETPACK__VERSION' ); |
| 718 |
|
| 719 |
$request['action'] = $action; |
| 720 |
$request['ip'] = jetpack_protect_get_ip(); |
| 721 |
$request['host'] = $this->get_local_host(); |
| 722 |
$request['headers'] = json_encode( $this->get_headers() ); |
| 723 |
$request['jetpack_version'] = constant( 'JETPACK__VERSION' ); |
| 724 |
$request['wordpress_version'] = (string) $wp_version ; |
| 725 |
$request['api_key'] = $api_key; |
| 726 |
$request['multisite'] = "0"; |
| 727 |
|
| 728 |
if ( is_multisite() ) { |
| 729 |
$request['multisite'] = get_blog_count(); |
| 730 |
} |
| 731 |
|
| 732 |
|
| 733 |
/** |
| 734 |
* Filter controls maximum timeout in waiting for reponse from Protect servers. |
| 735 |
* |
| 736 |
* @module protect |
| 737 |
* |
| 738 |
* @since 4.0.4 |
| 739 |
* |
| 740 |
* @param int $timeout Max time (in seconds) to wait for a response. |
| 741 |
*/ |
| 742 |
$timeout = apply_filters( 'jetpack_protect_connect_timeout', 30 ); |
| 743 |
|
| 744 |
$args = array ( |
| 745 |
'body' => $request, |
| 746 |
'user-agent' => $user_agent, |
| 747 |
'httpversion' => '1.0', |
| 748 |
'timeout' => absint( $timeout ) |
| 749 |
); |
| 750 |
|
| 751 |
$response_json = wp_remote_post( JETPACK_PROTECT__API_HOST, $args ); |
| 752 |
$this->last_response_raw = $response_json; |
| 753 |
|
| 754 |
$transient_name = $this->get_transient_name(); |
| 755 |
$this->delete_transient( $transient_name ); |
| 756 |
|
| 757 |
if ( is_array( $response_json ) ) { |
| 758 |
$response = json_decode( $response_json['body'], true ); |
| 759 |
} |
| 760 |
|
| 761 |
if ( isset( $response['blocked_attempts'] ) && $response['blocked_attempts'] ) { |
| 762 |
update_site_option( 'jetpack_protect_blocked_attempts', $response['blocked_attempts'] ); |
| 763 |
} |
| 764 |
|
| 765 |
if ( isset( $response['status'] ) && ! isset( $response['error'] ) ) { |
| 766 |
$response['expire'] = time() + $response['seconds_remaining']; |
| 767 |
$this->set_transient( $transient_name, $response, $response['seconds_remaining'] ); |
| 768 |
$this->delete_transient( 'brute_use_math' ); |
| 769 |
} else { // Fallback to Math Captcha if no response from API host |
| 770 |
$this->set_transient( 'brute_use_math', 1, 600 ); |
| 771 |
$response['status'] = 'ok'; |
| 772 |
$response['math'] = true; |
| 773 |
} |
| 774 |
|
| 775 |
if ( isset( $response['error'] ) ) { |
| 776 |
update_site_option( 'jetpack_protect_error', $response['error'] ); |
| 777 |
} else { |
| 778 |
delete_site_option( 'jetpack_protect_error' ); |
| 779 |
} |
| 780 |
|
| 781 |
return $response; |
| 782 |
} |
| 783 |
|
| 784 |
function get_transient_name() { |
| 785 |
$headers = $this->get_headers(); |
| 786 |
$header_hash = md5( json_encode( $headers ) ); |
| 787 |
|
| 788 |
return 'jpp_li_' . $header_hash; |
| 789 |
} |
| 790 |
|
| 791 |
/** |
| 792 |
* Wrapper for WordPress set_transient function, our version sets |
| 793 |
* the transient on the main site in the network if this is a multisite network |
| 794 |
* |
| 795 |
* We do it this way (instead of set_site_transient) because of an issue where |
| 796 |
* sitewide transients are always autoloaded |
| 797 |
* https://core.trac.wordpress.org/ticket/22846 |
| 798 |
* |
| 799 |
* @param string $transient Transient name. Expected to not be SQL-escaped. Must be |
| 800 |
* 45 characters or fewer in length. |
| 801 |
* @param mixed $value Transient value. Must be serializable if non-scalar. |
| 802 |
* Expected to not be SQL-escaped. |
| 803 |
* @param int $expiration Optional. Time until expiration in seconds. Default 0. |
| 804 |
* |
| 805 |
* @return bool False if value was not set and true if value was set. |
| 806 |
*/ |
| 807 |
function set_transient( $transient, $value, $expiration ) { |
| 808 |
if ( is_multisite() && ! is_main_site() ) { |
| 809 |
switch_to_blog( $this->get_main_blog_id() ); |
| 810 |
$return = set_transient( $transient, $value, $expiration ); |
| 811 |
restore_current_blog(); |
| 812 |
|
| 813 |
return $return; |
| 814 |
} |
| 815 |
|
| 816 |
return set_transient( $transient, $value, $expiration ); |
| 817 |
} |
| 818 |
|
| 819 |
/** |
| 820 |
* Wrapper for WordPress delete_transient function, our version deletes |
| 821 |
* the transient on the main site in the network if this is a multisite network |
| 822 |
* |
| 823 |
* @param string $transient Transient name. Expected to not be SQL-escaped. |
| 824 |
* |
| 825 |
* @return bool true if successful, false otherwise |
| 826 |
*/ |
| 827 |
function delete_transient( $transient ) { |
| 828 |
if ( is_multisite() && ! is_main_site() ) { |
| 829 |
switch_to_blog( $this->get_main_blog_id() ); |
| 830 |
$return = delete_transient( $transient ); |
| 831 |
restore_current_blog(); |
| 832 |
|
| 833 |
return $return; |
| 834 |
} |
| 835 |
|
| 836 |
return delete_transient( $transient ); |
| 837 |
} |
| 838 |
|
| 839 |
/** |
| 840 |
* Wrapper for WordPress get_transient function, our version gets |
| 841 |
* the transient on the main site in the network if this is a multisite network |
| 842 |
* |
| 843 |
* @param string $transient Transient name. Expected to not be SQL-escaped. |
| 844 |
* |
| 845 |
* @return mixed Value of transient. |
| 846 |
*/ |
| 847 |
function get_transient( $transient ) { |
| 848 |
if ( is_multisite() && ! is_main_site() ) { |
| 849 |
switch_to_blog( $this->get_main_blog_id() ); |
| 850 |
$return = get_transient( $transient ); |
| 851 |
restore_current_blog(); |
| 852 |
|
| 853 |
return $return; |
| 854 |
} |
| 855 |
|
| 856 |
return get_transient( $transient ); |
| 857 |
} |
| 858 |
|
| 859 |
/** |
| 860 |
* Get the API host. |
| 861 |
* |
| 862 |
* @return string |
| 863 |
* |
| 864 |
* @deprecated 9.1.0 Use constant `JETPACK_PROTECT__API_HOST` instead. |
| 865 |
*/ |
| 866 |
function get_api_host() { |
| 867 |
_deprecated_function( __METHOD__, 'jetpack-9.1.0' ); |
| 868 |
|
| 869 |
return JETPACK_PROTECT__API_HOST; |
| 870 |
} |
| 871 |
|
| 872 |
function get_local_host() { |
| 873 |
if ( isset( $this->local_host ) ) { |
| 874 |
return $this->local_host; |
| 875 |
} |
| 876 |
|
| 877 |
$uri = 'http://' . strtolower( $_SERVER['HTTP_HOST'] ); |
| 878 |
|
| 879 |
if ( is_multisite() ) { |
| 880 |
$uri = network_home_url(); |
| 881 |
} |
| 882 |
|
| 883 |
$uridata = wp_parse_url( $uri ); |
| 884 |
|
| 885 |
$domain = $uridata['host']; |
| 886 |
|
| 887 |
// If we still don't have the site_url, get it |
| 888 |
if ( ! $domain ) { |
| 889 |
$uri = get_site_url( 1 ); |
| 890 |
$uridata = wp_parse_url( $uri ); |
| 891 |
$domain = $uridata['host']; |
| 892 |
} |
| 893 |
|
| 894 |
$this->local_host = $domain; |
| 895 |
|
| 896 |
return $this->local_host; |
| 897 |
} |
| 898 |
|
| 899 |
} |
| 900 |
|
| 901 |
$jetpack_protect = Jetpack_Protect_Module::instance(); |
| 902 |
|
| 903 |
global $pagenow; |
| 904 |
if ( isset( $pagenow ) && 'wp-login.php' == $pagenow ) { |
| 905 |
$jetpack_protect->check_login_ability(); |
| 906 |
} |
| 907 |
|
