PluginProbe
Loginizer / 1.0.1
Loginizer v1.0.1
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
loginizer / loginizer.php

loginizer.php in Loginizer 1.0.1, at loginizer.php

1,016 lines 31.7 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 /**
3 * @package loginizer
4 * @version 1.0.1
5 */
6 /*
7 Plugin Name: Loginizer
8 Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9 Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10 Version: 1.0.1
11 Author: Raj Kothari
12 Author URI: http://www.loginizer.com
13 License: GPLv3 or later
14 */
15
16 /*
17 Copyright (C) 2013 Raj Kothari (email : support@loginizer.com)
18 This program is free software: you can redistribute it and/or modify
19 it under the terms of the GNU General Public License as published by
20 the Free Software Foundation, either version 3 of the License, or
21 (at your option) any later version.
22
23 This program is distributed in the hope that it will be useful,
24 but WITHOUT ANY WARRANTY; without even the implied warranty of
25 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 GNU General Public License for more details.
27
28 You should have received a copy of the GNU General Public License
29 along with this program. If not, see <http://www.gnu.org/licenses/>.
30 */
31
32 if(!function_exists('add_action')){
33 echo 'You are not allowed to access this page directly.';
34 exit;
35 }
36
37 define('LOGINIZER_VERSION', '1.0.1');
38
39 include_once('functions.php');
40
41 // Ok so we are now ready to go
42 register_activation_hook( __FILE__, 'loginizer_activation');
43
44 // Is called when the ADMIN enables the plugin
45 function loginizer_activation(){
46
47 global $wpdb;
48
49 $sql = array();
50
51 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
52 `username` varchar(255) NOT NULL DEFAULT '',
53 `time` int(10) NOT NULL DEFAULT '0',
54 `count` int(10) NOT NULL DEFAULT '0',
55 `lockout` int(10) NOT NULL DEFAULT '0',
56 `ip` varchar(255) NOT NULL DEFAULT '',
57 UNIQUE KEY `ip` (`ip`)
58 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
59
60 foreach($sql as $sk => $sv){
61 $wpdb->query($sv);
62 }
63
64 add_option('loginizer_version', LOGINIZER_VERSION);
65 add_option('loginizer_options', array());
66 add_option('loginizer_last_reset', 0);
67 add_option('loginizer_whitelist', array());
68 add_option('loginizer_blacklist', array());
69
70 }
71
72 // Checks if we are to update ?
73 function loginizer_update_check(){
74
75 global $wpdb;
76
77 $sql = array();
78 $current_version = get_option('loginizer_version');
79
80 // It must be the 1.0 pre stuff
81 if(empty($current_version)){
82 $current_version = get_option('lz_version');
83 }
84
85 $version = (int) str_replace('.', '', $current_version);
86
87 // No update required
88 if($current_version == LOGINIZER_VERSION){
89 return true;
90 }
91
92 // Is it first run ?
93 if(empty($current_version)){
94
95 // Reinstall
96 loginizer_activation();
97
98 // Trick the following if conditions to not run
99 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
100
101 }
102
103 // Is it less than 1.0.1 ?
104 if($version < 101){
105
106 // TODO : GET the existing settings
107
108 // Get the existing settings
109 $lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
110 $lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
111 $lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
112
113 // Delete the three tables
114 $sql = array();
115 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
116 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
117 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
118
119 foreach($sql as $sk => $sv){
120 $wpdb->query($sv);
121 }
122
123 // Delete option
124 delete_option('lz_version');
125
126 // Reinstall
127 loginizer_activation();
128
129 // TODO : Save the existing settings
130
131 // Update the existing failed logs to new table
132 if(is_array($lz_failed_logs)){
133 foreach($lz_failed_logs as $fk => $fv){
134 $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
135 }
136 }
137
138 // Update the existing options to new structure
139 if(is_array($lz_options)){
140 foreach($lz_options as $ok => $ov){
141
142 if($ov['option_name'] == 'lz_last_reset'){
143 update_option('loginizer_last_reset', $ov['option_value']);
144 continue;
145 }
146
147 $old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
148 }
149 // Save the options
150 update_option('loginizer_options', $old_option);
151 }
152
153 // Update the existing iprange to new structure
154 if(is_array($lz_iprange)){
155
156 $old_blacklist = array();
157 $old_whitelist = array();
158 $bid = 1;
159 $wid = 1;
160 foreach($lz_iprange as $ik => $iv){
161
162 if(!empty($iv['blacklist'])){
163 $old_blacklist[$bid] = array();
164 $old_blacklist[$bid]['start'] = long2ip($iv['start']);
165 $old_blacklist[$bid]['end'] = long2ip($iv['end']);
166 $old_blacklist[$bid]['time'] = strtotime($iv['date']);
167 $bid = $bid + 1;
168 }
169
170 if(!empty($iv['whitelist'])){
171 $old_whitelist[$wid] = array();
172 $old_whitelist[$wid]['start'] = long2ip($iv['start']);
173 $old_whitelist[$wid]['end'] = long2ip($iv['end']);
174 $old_whitelist[$wid]['time'] = strtotime($iv['date']);
175 $wid = $wid + 1;
176 }
177 }
178
179 if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
180 if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
181 }
182
183 }
184
185 // Save the new Version
186 update_option('loginizer_version', LOGINIZER_VERSION);
187
188 }
189
190 // Add the action to load the plugin
191 add_action('plugins_loaded', 'loginizer_load_plugin');
192
193 // The function that will be called when the plugin is loaded
194 function loginizer_load_plugin(){
195
196 global $loginizer;
197
198 // Check if the installed version is outdated
199 loginizer_update_check();
200
201 $options = get_option('loginizer_options');
202
203 $loginizer = array();
204 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
205 $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
206 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
207 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
208 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
209 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
210
211 $includes = get_included_files();
212 if(basename($includes[0]) != 'wp-login.php'){
213 return false;
214 }
215
216 // Load the blacklist and whitelist
217 $loginizer['blacklist'] = get_option('loginizer_blacklist');
218 $loginizer['whitelist'] = get_option('loginizer_whitelist');
219
220 // When was the database cleared last time
221 $loginizer_last_reset = get_option('loginizer_last_reset');
222
223 //print_r($loginizer);
224
225 // Clear retries
226 if((time() - $loginizer_last_reset) >= $loginizer['reset_retries']){
227 loginizer_reset_retries();
228 }
229
230 // Set the current IP
231 $loginizer['current_ip'] = lz_getip();
232
233 /* Filters and actions */
234
235 // Use this to verify before WP tries to login
236 // Is always called and is the first function to be called
237 add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);
238
239 // This is used for additional validation
240 // This function is called after the form is posted
241 add_filter('wp_authenticate_user', 'loginizer_wp_authenticate_user', 99999, 2);
242
243 // Is called when a login attempt fails
244 // Hence Update our records that the login failed
245 add_action('wp_login_failed', 'loginizer_login_failed');
246
247 // Is called before displaying the error message so that we dont show that the username is wrong or the password
248 // Update Error message
249 add_action('login_errors', 'loginizer_update_error_msg');
250
251 }
252
253 function loginizer_wp_authenticate($username, $password){
254
255 global $lz_error, $lz_cannot_login, $lz_user_pass;
256
257 if(!empty($username) && !empty($password)){
258 $lz_user_pass = 1;
259 }
260
261 // Are you whitelisted ?
262 if(loginizer_is_whitelisted()){
263 return $username;
264 }
265
266 // Are you blacklisted ?
267 if(loginizer_is_blacklisted()){
268 $lz_cannot_login = 1;
269 $error = new WP_Error();
270 $error->add('ip_blacklisted', implode('', $lz_error));
271 return $error;
272 }
273
274 if(loginizer_can_login()){
275 return $username;
276 }
277
278 $lz_cannot_login = 1;
279
280 $error = new WP_Error();
281 $error->add('ip_blocked', implode('', $lz_error));
282 return $error;
283
284 }
285
286 function loginizer_can_login(){
287
288 global $wpdb, $loginizer, $lz_error;
289
290 // Get the logs
291 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
292
293 if(!empty($result['count']) && $result['count'] >= $loginizer['max_retries']){
294
295 // Has he reached max lockouts ?
296 if($result['lockout'] >= $loginizer['max_lockouts']){
297 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
298 }
299
300 // Is he in the lockout time ?
301 if($result['time'] >= (time() - $loginizer['lockout_time'])){
302 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
303
304 //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
305 //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
306 //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
307
308 $_time = $banlift.' minute(s)';
309
310 if($banlift > 60){
311 $banlift = ceil($banlift / 60);
312 $_time = $banlift.' hour(s)';
313 }
314
315 $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
316
317 return false;
318 }
319 }
320
321 // We need to add one as this is a failed attempt as well
322 $result['count'] = $result['count'] + 1;
323
324 if(!empty($result['count']) && $result['count'] <= $loginizer['max_retries']){
325 $loginizer['retries_left'] = $loginizer['max_retries'] - $result['count'];
326 }
327
328 return true;
329 }
330
331 function loginizer_is_blacklisted(){
332
333 global $wpdb, $loginizer, $lz_error;
334
335 $blacklist = $loginizer['blacklist'];
336
337 foreach($blacklist as $k => $v){
338
339 // Is the IP in the blacklist ?
340 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
341 $result = 1;
342 break;
343 }
344
345 }
346
347 // You are blacklisted
348 if(!empty($result)){
349 $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
350 return true;
351 }
352
353 return false;
354
355 }
356
357 function loginizer_is_whitelisted(){
358
359 global $wpdb, $loginizer, $lz_error;
360
361 $whitelist = $loginizer['whitelist'];
362
363 foreach($whitelist as $k => $v){
364
365 // Is the IP in the blacklist ?
366 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
367 $result = 1;
368 break;
369 }
370
371 }
372
373 // You are whitelisted
374 if(!empty($result)){
375 return true;
376 }
377
378 return false;
379
380 }
381
382 // Returns an error if the users IP is blocked
383 function loginizer_wp_authenticate_user($user, $username){
384
385 global $lz_error, $lz_cannot_login;
386
387 // Is there a regulare error ?
388 if(is_wp_error($user)){
389 return $user;
390 }
391
392 // If we havent blocked it yet, just return $user
393 if(empty($lz_cannot_login)){
394 return $user;
395 }
396
397 // We have blocked the IP
398 $error = new WP_Error();
399 $error->add('ip_blocked', implode('', $lz_error));
400 return $error;
401
402 }
403
404 // When the login fails, then this is called
405 // We need to update the database
406 function loginizer_login_failed($username){
407
408 global $wpdb, $loginizer, $lz_cannot_login;
409
410 if(empty($lz_cannot_login)){
411
412 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
413
414 if(!empty($result)){
415 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
416 $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
417
418 // Do we need to email admin ?
419 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
420
421 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
422 $mail = array();
423 $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
424 $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
425 $mail['message'] = 'Hi,
426
427 '.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
428
429 Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
430 Last User Attempt : '.$username.'
431 IP has been blocked until : '.date('m/d/Y H:i:s', time() + $loginizer['lockout_time']).'
432
433 Regards,
434 Loginizer';
435
436 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
437 }
438 }else{
439 $result = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
440 }
441 }
442 }
443
444 // Modifies the default error messages shown
445 function loginizer_update_error_msg($default_msg){
446
447 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
448
449 $msg = '';
450
451 if(!empty($lz_user_pass) && empty($lz_cannot_login)){
452
453 $msg = '<b>ERROR:</b> Incorrect Username or Password';
454
455 // If we are to show the number of retries left
456 if(isset($loginizer['retries_left'])){
457 $msg .= '<br /><b>'.$loginizer['retries_left'].'</b> attempt(s) left';
458 }
459 }
460
461 if(!empty($msg)){
462 return $msg;
463 }else{
464 return $default_msg;
465 }
466
467 }
468
469 function loginizer_reset_retries(){
470
471 global $wpdb, $loginizer;
472
473 $deltime = time() - $loginizer['reset_retries'];
474 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
475
476 update_option('loginizer_last_reset', time());
477
478 }
479
480 // Add settings link on plugin page
481 function loginizer_settings_link($links) {
482 $settings_link = '<a href="options-general.php?page=loginizer">Settings</a>';
483 array_unshift($links, $settings_link);
484 return $links;
485 }
486
487 $plugin = plugin_basename(__FILE__);
488 add_filter("plugin_action_links_$plugin", 'loginizer_settings_link' );
489
490 add_action('admin_menu', 'loginizer_admin_menu');
491
492 // Shows the admin menu of Loginizer
493 function loginizer_admin_menu() {
494 global $wp_version;
495
496 // Modern WP?
497 if (version_compare($wp_version, '3.0', '>=')) {
498 add_options_page('Loginizer', 'Loginizer', 'manage_options', 'loginizer', 'loginizer_option_page');
499 return;
500 }
501
502 // Older WPMU?
503 if (function_exists("get_current_site")) {
504 add_submenu_page('wpmu-admin.php', 'Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
505 return;
506 }
507
508 // Older WP
509 add_options_page('Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
510 }
511
512 // The Loginizer Admin Options Page
513 function loginizer_option_page(){
514
515 global $wpdb, $wp_roles, $loginizer;
516
517 if(!current_user_can('manage_options')){
518 wp_die('Sorry, but you do not have permissions to change settings.');
519 }
520
521 /* Make sure post was from this page */
522 if(count($_POST) > 0){
523 check_admin_referer('loginizer-options');
524 }
525
526 // Load the blacklist and whitelist
527 $loginizer['blacklist'] = get_option('loginizer_blacklist');
528 $loginizer['whitelist'] = get_option('loginizer_whitelist');
529
530 if(isset($_POST['save_lz'])){
531
532 $max_retries = (int) lz_optpost('max_retries');
533 $lockout_time = (int) lz_optpost('lockout_time');
534 $max_lockouts = (int) lz_optpost('max_lockouts');
535 $lockouts_extend = (int) lz_optpost('lockouts_extend');
536 $reset_retries = (int) lz_optpost('reset_retries');
537 $notify_email = (int) lz_optpost('notify_email');
538
539 $lockout_time = $lockout_time * 60;
540 $lockouts_extend = $lockouts_extend * 60 * 60;
541 $reset_retries = $reset_retries * 60 * 60;
542
543 if(empty($error)){
544
545 $option['max_retries'] = $max_retries;
546 $option['lockout_time'] = $lockout_time;
547 $option['max_lockouts'] = $max_lockouts;
548 $option['lockouts_extend'] = $lockouts_extend;
549 $option['reset_retries'] = $reset_retries;
550 $option['notify_email'] = $notify_email;
551
552 // Save the options
553 update_option('loginizer_options', $option);
554
555 $saved = true;
556
557 }else{
558 lz_report_error($error);
559 }
560
561 if(!empty($notice)){
562 lz_report_notice($notice);
563 }
564
565 if(!empty($saved)){
566 echo '<div id="message" class="updated fade"><p>'
567 . __('The settings were saved successfully', 'loginizer')
568 . '</p></div>';
569 }
570
571 }
572
573 // Delete a Blackist IP range
574 if(isset($_GET['bdelid'])){
575
576 $delid = (int) lz_optreq('bdelid');
577
578 // Unset and save
579 $blacklist = $loginizer['blacklist'];
580 unset($blacklist[$delid]);
581 update_option('loginizer_blacklist', $blacklist);
582
583 echo '<div id="message" class="updated fade"><p>'
584 . __('The Blacklist IP range has been deleted successfully', 'loginizer')
585 . '</p></div>';
586
587 }
588
589 // Delete a Whitelist IP range
590 if(isset($_GET['delid'])){
591
592 $delid = (int) lz_optreq('delid');
593
594 // Unset and save
595 $whitelist = $loginizer['whitelist'];
596 unset($whitelist[$delid]);
597 update_option('loginizer_whitelist', $whitelist);
598
599 echo '<div id="message" class="updated fade"><p>'
600 . __('The Whitelist IP range has been deleted successfully', 'loginizer')
601 . '</p></div>';
602
603 }
604
605 if(isset($_POST['blacklist_iprange'])){
606
607 $start_ip = lz_optpost('start_ip');
608 $end_ip = lz_optpost('end_ip');
609
610 if(empty($start_ip)){
611 $error[] = 'Please enter the Start IP';
612 }
613
614 // If no end IP we consider only 1 IP
615 if(empty($end_ip)){
616 $end_ip = $start_ip;
617 }
618
619 if(!lz_valid_ip($start_ip)){
620 $error[] = 'Please provide a valid start IP';
621 }
622
623 if(!lz_valid_ip($end_ip)){
624 $error[] = 'Please provide a valid end IP';
625 }
626
627 if(ip2long($start_ip) > ip2long($end_ip)){
628 $error[] = 'The End IP cannot be smaller than the Start IP';
629 }
630
631 if(empty($error)){
632
633 $blacklist = $loginizer['blacklist'];
634
635 foreach($blacklist as $k => $v){
636
637 // This is to check if there is any other range exists with the same Start or End IP
638 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
639 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
640 ){
641 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
642 break;
643 }
644
645 // This is to check if there is any other range exists with the same Start IP
646 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
647 $error[] = 'The Start IP is present in an existing range !';
648 break;
649 }
650
651 // This is to check if there is any other range exists with the same End IP
652 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
653 $error[] = 'The End IP is present in an existing range!';
654 break;
655 }
656
657 }
658
659 $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
660
661 if(empty($error)){
662
663 $blacklist[$newid] = array();
664 $blacklist[$newid]['start'] = $start_ip;
665 $blacklist[$newid]['end'] = $end_ip;
666 $blacklist[$newid]['time'] = time();
667
668 update_option('loginizer_blacklist', $blacklist);
669
670 echo '<div id="message" class="updated fade"><p>'
671 . __('Blacklist IP range added successfully', 'loginizer')
672 . '</p></div>';
673
674 }
675
676 }
677
678 if(!empty($error)){
679 lz_report_error($error);
680 }
681
682 }
683
684 if(isset($_POST['whitelist_iprange'])){
685
686 $start_ip = lz_optpost('start_ip_w');
687 $end_ip = lz_optpost('end_ip_w');
688
689 if(empty($start_ip)){
690 $error[] = 'Please enter the Start IP';
691 }
692
693 // If no end IP we consider only 1 IP
694 if(empty($end_ip)){
695 $end_ip = $start_ip;
696 }
697
698 if(!lz_valid_ip($start_ip)){
699 $error[] = 'Please provide a valid start IP';
700 }
701
702 if(!lz_valid_ip($end_ip)){
703 $error[] = 'Please provide a valid end IP';
704 }
705
706 if(ip2long($start_ip) > ip2long($end_ip)){
707 $error[] = 'The End IP cannot be smaller than the Start IP';
708 }
709
710 if(empty($error)){
711
712 $whitelist = $loginizer['whitelist'];
713
714 foreach($whitelist as $k => $v){
715
716 // This is to check if there is any other range exists with the same Start or End IP
717 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
718 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
719 ){
720 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
721 break;
722 }
723
724 // This is to check if there is any other range exists with the same Start IP
725 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
726 $error[] = 'The Start IP is present in an existing range !';
727 break;
728 }
729
730 // This is to check if there is any other range exists with the same End IP
731 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
732 $error[] = 'The End IP is present in an existing range!';
733 break;
734 }
735
736 }
737
738 $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
739
740 if(empty($error)){
741
742 $whitelist[$newid] = array();
743 $whitelist[$newid]['start'] = $start_ip;
744 $whitelist[$newid]['end'] = $end_ip;
745 $whitelist[$newid]['time'] = time();
746
747 update_option('loginizer_whitelist', $whitelist);
748
749 echo '<div id="message" class="updated fade"><p>'
750 . __('Whitelist IP range added successfully', 'loginizer')
751 . '</p></div>';
752
753 }
754
755 }
756
757 if(!empty($error)){
758 lz_report_error($error);
759 }
760 }
761
762 // Get the logs
763 $result = array();
764 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `count` DESC LIMIT 0, 10;", 1);
765 //print_r($result);
766
767 // Reload the settings
768 $loginizer['blacklist'] = get_option('loginizer_blacklist');
769 $loginizer['whitelist'] = get_option('loginizer_whitelist');
770
771 ?>
772 <div class="wrap">
773 <!--This is intentional-->
774 <h2></h2>
775
776 <h1><center><?php echo __('Loginizer','loginizer'); ?></center></h1><hr /><br />
777
778 <script src="http://api.loginizer.com/news.js""></script>
779
780 <h2><?php echo __('Failed Login Attempts Logs &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?></h2><hr /><br />
781
782 <table class="wp-list-table widefat fixed users" border="0">
783 <tr>
784 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
785 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
786 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
787 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
788 </tr>
789 <?php
790 if(empty($result)){
791 echo '
792 <tr>
793 <td colspan="4">
794 No Logs. You will see logs about failed login attempts here.
795 </td>
796 </tr>';
797 }else{
798 foreach($result as $ik => $iv){
799 $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
800 echo '
801 <tr>
802 <td>
803 '.$iv['ip'].'
804 </td>
805 <td>
806 '.date('d/m/Y H:i:s', $iv['time']).'
807 </td>
808 <td>
809 '.$iv['count'].'
810 </td>
811 <td>
812 '.$iv['lockout'].'
813 </td>
814 </tr>';
815 }
816 }
817 ?>
818 </table>
819 <br />
820 <h2><?php echo __('Loginizer Settings','loginizer'); ?></h2><hr /><br />
821
822 <form action="options-general.php?page=loginizer" method="post" enctype="multipart/form-data">
823 <?php wp_nonce_field('loginizer-options'); ?>
824 <table class="form-table">
825 <tr>
826 <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
827 <td>
828 <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
829 </td>
830 </tr>
831 <tr>
832 <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
833 <td>
834 <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
835 </td>
836 </tr>
837 <tr>
838 <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
839 <td>
840 <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
841 </td>
842 </tr>
843 <tr>
844 <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
845 <td>
846 <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
847 </td>
848 </tr>
849 <tr>
850 <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
851 <td>
852 <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
853 </td>
854 </tr>
855 <tr>
856 <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
857 <td>
858 <?php echo __('after ','loginizer'); ?>
859 <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
860 </td>
861 </tr>
862 </table><br />
863 <input name="save_lz" class="button action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
864 </form>
865
866 <br /><br />
867 <hr />
868 <h2><?php echo __('Blacklist IP','loginizer'); ?></h2>
869 <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
870 <form action="options-general.php?page=loginizer" method="post">
871 <?php wp_nonce_field('loginizer-options'); ?>
872 <table class="form-table">
873 <tr>
874 <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
875 <td>
876 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
877 </td>
878 </tr>
879 <tr>
880 <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
881 <td>
882 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
883 </td>
884 </tr>
885 </table><br />
886 <input name="blacklist_iprange" class="button action" value="<?php echo __('Blacklist IP range','loginizer'); ?>" type="submit" />
887 </form>
888 <br />
889 <table class="wp-list-table widefat fixed users" border="0">
890 <tr>
891 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
892 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
893 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
894 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
895 </tr>
896 <?php
897 if(empty($loginizer['blacklist'])){
898 echo '
899 <tr>
900 <td colspan="4">
901 No Blacklist IPs. You will see blacklisted IP ranges here.
902 </td>
903 </tr>';
904 }else{
905 foreach($loginizer['blacklist'] as $ik => $iv){
906 echo '
907 <tr>
908 <td>
909 '.$iv['start'].'
910 </td>
911 <td>
912 '.$iv['end'].'
913 </td>
914 <td>
915 '.date('d/m/Y', $iv['time']).'
916 </td>
917 <td>
918 <a class="submitdelete" href="options-general.php?page=loginizer&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
919 </td>
920 </tr>';
921 }
922 }
923 ?>
924 </table>
925 <br />
926 <hr />
927 <h2><?php echo __('Whitelist IP','loginizer'); ?></h2>
928 <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
929 <form action="options-general.php?page=loginizer" method="post">
930 <?php wp_nonce_field('loginizer-options'); ?>
931 <table class="form-table">
932 <tr>
933 <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
934 <td>
935 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
936 </td>
937 </tr>
938 <tr>
939 <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
940 <td>
941 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
942 </td>
943 </tr>
944 </table><br />
945 <input name="whitelist_iprange" class="button action" value="<?php echo __('Whitelist IP range','loginizer'); ?>" type="submit" />
946 </form>
947 <br />
948 <table class="wp-list-table widefat fixed users" border="0">
949 <tr>
950 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
951 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
952 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
953 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
954 </tr>
955 <?php
956 if(empty($loginizer['whitelist'])){
957 echo '
958 <tr>
959 <td colspan="4">
960 No Whitelist IPs. You will see whitelisted IP ranges here.
961 </td>
962 </tr>';
963 }else{
964 foreach($loginizer['whitelist'] as $ik => $iv){
965 echo '
966 <tr>
967 <td>
968 '.$iv['start'].'
969 </td>
970 <td>
971 '.$iv['end'].'
972 </td>
973 <td>
974 '.date('d/m/Y', $iv['time']).'
975 </td>
976 <td>
977 <a class="submitdelete" href="options-general.php?page=loginizer&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
978 </td>
979 </tr>';
980 }
981 }
982 ?>
983 </table>
984 <br />
985 </div>
986 <?php
987
988 echo '<br /><br /><hr />
989 <a href="http://www.loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.' <br />
990 You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
991
992 }
993
994 // Sorry to see you going
995 register_uninstall_hook( __FILE__, 'loginizer_deactivation');
996
997 function loginizer_deactivation(){
998
999 global $wpdb;
1000
1001 $sql = array();
1002 $sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
1003
1004 foreach($sql as $sk => $sv){
1005 $wpdb->query($sv);
1006 }
1007
1008 delete_option('loginizer_version');
1009 delete_option('loginizer_options');
1010 delete_option('loginizer_last_reset');
1011 delete_option('loginizer_whitelist');
1012 delete_option('loginizer_blacklist');
1013
1014 }
1015
1016