← All changes | loginizer.php +22 -17 1.0.2 → 1.0.1 View file →

		@@ -1,14 +1,14 @@
1	1	<?php
2	2	/**
3	3	* @package loginizer
4		- * @version 1.0.2
	4	+ * @version 1.0.1
5	5	*/
6	6	/*
7	7	Plugin Name: Loginizer
8	8	Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9	9	Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10		-Version: 1.0.2
	10	+Version: 1.0.1
11	11	Author: Raj Kothari
12	12	Author URI: http://www.loginizer.com
13	13	License: GPLv3 or later
14	14	*/
		@@ -33,9 +33,9 @@
33	33	echo 'You are not allowed to access this page directly.';
34	34	exit;
35	35	}
36	36
37		-define('LOGINIZER_VERSION', '1.0.2');
	37	+define('LOGINIZER_VERSION', '1.0.1');
38	38
39	39	include_once('functions.php');
40	40
41	41	// Ok so we are now ready to go
		@@ -207,8 +207,13 @@
207	207	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
208	208	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
209	209	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
210	210
	211	+ $includes = get_included_files();
	212	+ if(basename($includes[0]) != 'wp-login.php'){
	213	+ return false;
	214	+ }
	215	+
211	216	// Load the blacklist and whitelist
212	217	$loginizer['blacklist'] = get_option('loginizer_blacklist');
213	218	$loginizer['whitelist'] = get_option('loginizer_whitelist');
214	219
		@@ -228,10 +233,9 @@
228	233	/* Filters and actions */
229	234
230	235	// Use this to verify before WP tries to login
231	236	// Is always called and is the first function to be called
232		- //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
233		- add_filter('authenticate', 'loginizer_wp_authenticate', 10, 3);// This one is called by xmlrpc as well as GUI
	237	+ add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);
234	238
235	239	// This is used for additional validation
236	240	// This function is called after the form is posted
237	241	add_filter('wp_authenticate_user', 'loginizer_wp_authenticate_user', 99999, 2);
		@@ -245,13 +249,13 @@
245	249	add_action('login_errors', 'loginizer_update_error_msg');
246	250
247	251	}
248	252
249		-function loginizer_wp_authenticate($user, $username, $password){
	253	+function loginizer_wp_authenticate($username, $password){
250	254
251	255	global $lz_error, $lz_cannot_login, $lz_user_pass;
252	256
253		- if(!empty($username) && !empty($password)){
	257	+ if(!empty($username) && !empty($password)){
254	258	$lz_user_pass = 1;
255	259	}
256	260
257	261	// Are you whitelisted ?
		@@ -284,11 +288,11 @@
284	288	global $wpdb, $loginizer, $lz_error;
285	289
286	290	// Get the logs
287	291	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
288		-
289		- if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
290	292
	293	+ if(!empty($result['count']) && $result['count'] >= $loginizer['max_retries']){
	294	+
291	295	// Has he reached max lockouts ?
292	296	if($result['lockout'] >= $loginizer['max_lockouts']){
293	297	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
294	298	}
		@@ -313,8 +317,15 @@
313	317	return false;
314	318	}
315	319	}
316	320
	321	+ // We need to add one as this is a failed attempt as well
	322	+ $result['count'] = $result['count'] + 1;
	323	+
	324	+ if(!empty($result['count']) && $result['count'] <= $loginizer['max_retries']){
	325	+ $loginizer['retries_left'] = $loginizer['max_retries'] - $result['count'];
	326	+ }
	327	+
317	328	return true;
318	329	}
319	330
320	331	function loginizer_is_blacklisted(){
		@@ -416,9 +427,9 @@
416	427	'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
417	428
418	429	Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
419	430	Last User Attempt : '.$username.'
420		-IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
	431	+IP has been blocked until : '.date('m/d/Y H:i:s', time() + $loginizer['lockout_time']).'
421	432
422	433	Regards,
423	434	Loginizer';
424	435
		@@ -424,16 +435,10 @@
424	435
425	436	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
426	437	}
427	438	}else{
428		- $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
	439	+ $result = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
429	440	}
430		-
431		- // We need to add one as this is a failed attempt as well
432		- $result['count'] = $result['count'] + 1;
433		- $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
434		- $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
435		-
436	441	}
437	442	}
438	443
439	444	// Modifies the default error messages shown