PluginProbe
Loginizer / 1.0.1
Loginizer v1.0.1
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | loginizer.php +1015 -77 trunk → 1.0.1 View file →
@@ -1,77 +1,1015 @@
1 -<?php
2 -/*
3 -Plugin Name: Loginizer
4 -Plugin URI: https://wordpress.org/extend/plugins/loginizer/
5 -Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
6 -Version: 2.1.0
7 -Text Domain: loginizer
8 -Author: Softaculous
9 -Author URI: https://www.loginizer.com
10 -License: LGPLv2.1
11 -*/
12 -
13 -/*
14 -Copyright (C) 2013 Loginizer (email : support@loginizer.com)
15 -This program is free software: you can redistribute it and/or modify
16 -it under the terms of the GNU General Public License as published by
17 -the Free Software Foundation, either version 3 of the License, or
18 -(at your option) any later version.
19 -
20 -This program is distributed in the hope that it will be useful,
21 -but WITHOUT ANY WARRANTY; without even the implied warranty of
22 -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 -GNU General Public License for more details.
24 -
25 -You should have received a copy of the GNU General Public License
26 -along with this program. If not, see <http://www.gnu.org/licenses/>.
27 -*/
28 -
29 -if(!function_exists('add_action')){
30 - echo 'You are not allowed to access this page directly.';
31 - exit;
32 -}
33 -
34 -$_tmp_plugins = get_option('active_plugins', []);
35 -
36 -if(!defined('SITEPAD') && in_array('loginizer-security/loginizer-security.php', $_tmp_plugins)){
37 -
38 - // Was introduced in 1.9.0
39 - $loginizer_pro_info = get_option('loginizer_pro_version');
40 -
41 - if(!empty($loginizer_pro_info) && version_compare($loginizer_pro_info, '1.9.0', '>=')){
42 - // Let Loginizer load
43 -
44 - // Lets check for older versions
45 - }else{
46 -
47 - if(!function_exists('get_plugin_data')){
48 - include_once ABSPATH . 'wp-admin/includes/plugin.php';
49 - }
50 -
51 - $loginizer_pro_info = get_plugin_data(WP_PLUGIN_DIR . '/loginizer-security/loginizer-security.php');
52 -
53 - if(!empty($loginizer_pro_info) && version_compare($loginizer_pro_info['Version'], '1.8.9', '<')){
54 - return;
55 - }
56 - }
57 -}
58 -
59 -
60 -function loginizer_load_plugin_textdomain(){
61 - if(defined('LOGINIZER_PREMIUM')){
62 - return;
63 - }
64 - load_plugin_textdomain('loginizer', FALSE, basename( dirname( __FILE__ ) ) . '/languages/');
65 -}
66 -
67 -add_action('init', 'loginizer_load_plugin_textdomain', 0);
68 -
69 -// Is the premium plugin active ?
70 -if(defined('LOGINIZER_VERSION')){
71 - return;
72 -}
73 -
74 -define('LOGINIZER_FILE', __FILE__);
75 -
76 -include_once(dirname(__FILE__).'/init.php');
77 -
1 +<?php
2 +/**
3 + * @package loginizer
4 + * @version 1.0.1
5 + */
6 +/*
7 +Plugin Name: Loginizer
8 +Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9 +Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10 +Version: 1.0.1
11 +Author: Raj Kothari
12 +Author URI: http://www.loginizer.com
13 +License: GPLv3 or later
14 +*/
15 +
16 +/*
17 +Copyright (C) 2013 Raj Kothari (email : support@loginizer.com)
18 +This program is free software: you can redistribute it and/or modify
19 +it under the terms of the GNU General Public License as published by
20 +the Free Software Foundation, either version 3 of the License, or
21 +(at your option) any later version.
22 +
23 +This program is distributed in the hope that it will be useful,
24 +but WITHOUT ANY WARRANTY; without even the implied warranty of
25 +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 +GNU General Public License for more details.
27 +
28 +You should have received a copy of the GNU General Public License
29 +along with this program. If not, see <http://www.gnu.org/licenses/>.
30 +*/
31 +
32 +if(!function_exists('add_action')){
33 + echo 'You are not allowed to access this page directly.';
34 + exit;
35 +}
36 +
37 +define('LOGINIZER_VERSION', '1.0.1');
38 +
39 +include_once('functions.php');
40 +
41 +// Ok so we are now ready to go
42 +register_activation_hook( __FILE__, 'loginizer_activation');
43 +
44 +// Is called when the ADMIN enables the plugin
45 +function loginizer_activation(){
46 +
47 + global $wpdb;
48 +
49 + $sql = array();
50 +
51 + $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
52 + `username` varchar(255) NOT NULL DEFAULT '',
53 + `time` int(10) NOT NULL DEFAULT '0',
54 + `count` int(10) NOT NULL DEFAULT '0',
55 + `lockout` int(10) NOT NULL DEFAULT '0',
56 + `ip` varchar(255) NOT NULL DEFAULT '',
57 + UNIQUE KEY `ip` (`ip`)
58 + ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
59 +
60 + foreach($sql as $sk => $sv){
61 + $wpdb->query($sv);
62 + }
63 +
64 + add_option('loginizer_version', LOGINIZER_VERSION);
65 + add_option('loginizer_options', array());
66 + add_option('loginizer_last_reset', 0);
67 + add_option('loginizer_whitelist', array());
68 + add_option('loginizer_blacklist', array());
69 +
70 +}
71 +
72 +// Checks if we are to update ?
73 +function loginizer_update_check(){
74 +
75 +global $wpdb;
76 +
77 + $sql = array();
78 + $current_version = get_option('loginizer_version');
79 +
80 + // It must be the 1.0 pre stuff
81 + if(empty($current_version)){
82 + $current_version = get_option('lz_version');
83 + }
84 +
85 + $version = (int) str_replace('.', '', $current_version);
86 +
87 + // No update required
88 + if($current_version == LOGINIZER_VERSION){
89 + return true;
90 + }
91 +
92 + // Is it first run ?
93 + if(empty($current_version)){
94 +
95 + // Reinstall
96 + loginizer_activation();
97 +
98 + // Trick the following if conditions to not run
99 + $version = (int) str_replace('.', '', LOGINIZER_VERSION);
100 +
101 + }
102 +
103 + // Is it less than 1.0.1 ?
104 + if($version < 101){
105 +
106 + // TODO : GET the existing settings
107 +
108 + // Get the existing settings
109 + $lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
110 + $lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
111 + $lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
112 +
113 + // Delete the three tables
114 + $sql = array();
115 + $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
116 + $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
117 + $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
118 +
119 + foreach($sql as $sk => $sv){
120 + $wpdb->query($sv);
121 + }
122 +
123 + // Delete option
124 + delete_option('lz_version');
125 +
126 + // Reinstall
127 + loginizer_activation();
128 +
129 + // TODO : Save the existing settings
130 +
131 + // Update the existing failed logs to new table
132 + if(is_array($lz_failed_logs)){
133 + foreach($lz_failed_logs as $fk => $fv){
134 + $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
135 + }
136 + }
137 +
138 + // Update the existing options to new structure
139 + if(is_array($lz_options)){
140 + foreach($lz_options as $ok => $ov){
141 +
142 + if($ov['option_name'] == 'lz_last_reset'){
143 + update_option('loginizer_last_reset', $ov['option_value']);
144 + continue;
145 + }
146 +
147 + $old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
148 + }
149 + // Save the options
150 + update_option('loginizer_options', $old_option);
151 + }
152 +
153 + // Update the existing iprange to new structure
154 + if(is_array($lz_iprange)){
155 +
156 + $old_blacklist = array();
157 + $old_whitelist = array();
158 + $bid = 1;
159 + $wid = 1;
160 + foreach($lz_iprange as $ik => $iv){
161 +
162 + if(!empty($iv['blacklist'])){
163 + $old_blacklist[$bid] = array();
164 + $old_blacklist[$bid]['start'] = long2ip($iv['start']);
165 + $old_blacklist[$bid]['end'] = long2ip($iv['end']);
166 + $old_blacklist[$bid]['time'] = strtotime($iv['date']);
167 + $bid = $bid + 1;
168 + }
169 +
170 + if(!empty($iv['whitelist'])){
171 + $old_whitelist[$wid] = array();
172 + $old_whitelist[$wid]['start'] = long2ip($iv['start']);
173 + $old_whitelist[$wid]['end'] = long2ip($iv['end']);
174 + $old_whitelist[$wid]['time'] = strtotime($iv['date']);
175 + $wid = $wid + 1;
176 + }
177 + }
178 +
179 + if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
180 + if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
181 + }
182 +
183 + }
184 +
185 + // Save the new Version
186 + update_option('loginizer_version', LOGINIZER_VERSION);
187 +
188 +}
189 +
190 +// Add the action to load the plugin
191 +add_action('plugins_loaded', 'loginizer_load_plugin');
192 +
193 +// The function that will be called when the plugin is loaded
194 +function loginizer_load_plugin(){
195 +
196 + global $loginizer;
197 +
198 + // Check if the installed version is outdated
199 + loginizer_update_check();
200 +
201 + $options = get_option('loginizer_options');
202 +
203 + $loginizer = array();
204 + $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
205 + $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
206 + $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
207 + $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
208 + $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
209 + $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
210 +
211 + $includes = get_included_files();
212 + if(basename($includes[0]) != 'wp-login.php'){
213 + return false;
214 + }
215 +
216 + // Load the blacklist and whitelist
217 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
218 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
219 +
220 + // When was the database cleared last time
221 + $loginizer_last_reset = get_option('loginizer_last_reset');
222 +
223 + //print_r($loginizer);
224 +
225 + // Clear retries
226 + if((time() - $loginizer_last_reset) >= $loginizer['reset_retries']){
227 + loginizer_reset_retries();
228 + }
229 +
230 + // Set the current IP
231 + $loginizer['current_ip'] = lz_getip();
232 +
233 + /* Filters and actions */
234 +
235 + // Use this to verify before WP tries to login
236 + // Is always called and is the first function to be called
237 + add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);
238 +
239 + // This is used for additional validation
240 + // This function is called after the form is posted
241 + add_filter('wp_authenticate_user', 'loginizer_wp_authenticate_user', 99999, 2);
242 +
243 + // Is called when a login attempt fails
244 + // Hence Update our records that the login failed
245 + add_action('wp_login_failed', 'loginizer_login_failed');
246 +
247 + // Is called before displaying the error message so that we dont show that the username is wrong or the password
248 + // Update Error message
249 + add_action('login_errors', 'loginizer_update_error_msg');
250 +
251 +}
252 +
253 +function loginizer_wp_authenticate($username, $password){
254 +
255 + global $lz_error, $lz_cannot_login, $lz_user_pass;
256 +
257 + if(!empty($username) && !empty($password)){
258 + $lz_user_pass = 1;
259 + }
260 +
261 + // Are you whitelisted ?
262 + if(loginizer_is_whitelisted()){
263 + return $username;
264 + }
265 +
266 + // Are you blacklisted ?
267 + if(loginizer_is_blacklisted()){
268 + $lz_cannot_login = 1;
269 + $error = new WP_Error();
270 + $error->add('ip_blacklisted', implode('', $lz_error));
271 + return $error;
272 + }
273 +
274 + if(loginizer_can_login()){
275 + return $username;
276 + }
277 +
278 + $lz_cannot_login = 1;
279 +
280 + $error = new WP_Error();
281 + $error->add('ip_blocked', implode('', $lz_error));
282 + return $error;
283 +
284 +}
285 +
286 +function loginizer_can_login(){
287 +
288 + global $wpdb, $loginizer, $lz_error;
289 +
290 + // Get the logs
291 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
292 +
293 + if(!empty($result['count']) && $result['count'] >= $loginizer['max_retries']){
294 +
295 + // Has he reached max lockouts ?
296 + if($result['lockout'] >= $loginizer['max_lockouts']){
297 + $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
298 + }
299 +
300 + // Is he in the lockout time ?
301 + if($result['time'] >= (time() - $loginizer['lockout_time'])){
302 + $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
303 +
304 + //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
305 + //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
306 + //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
307 +
308 + $_time = $banlift.' minute(s)';
309 +
310 + if($banlift > 60){
311 + $banlift = ceil($banlift / 60);
312 + $_time = $banlift.' hour(s)';
313 + }
314 +
315 + $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
316 +
317 + return false;
318 + }
319 + }
320 +
321 + // We need to add one as this is a failed attempt as well
322 + $result['count'] = $result['count'] + 1;
323 +
324 + if(!empty($result['count']) && $result['count'] <= $loginizer['max_retries']){
325 + $loginizer['retries_left'] = $loginizer['max_retries'] - $result['count'];
326 + }
327 +
328 + return true;
329 +}
330 +
331 +function loginizer_is_blacklisted(){
332 +
333 + global $wpdb, $loginizer, $lz_error;
334 +
335 + $blacklist = $loginizer['blacklist'];
336 +
337 + foreach($blacklist as $k => $v){
338 +
339 + // Is the IP in the blacklist ?
340 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
341 + $result = 1;
342 + break;
343 + }
344 +
345 + }
346 +
347 + // You are blacklisted
348 + if(!empty($result)){
349 + $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
350 + return true;
351 + }
352 +
353 + return false;
354 +
355 +}
356 +
357 +function loginizer_is_whitelisted(){
358 +
359 + global $wpdb, $loginizer, $lz_error;
360 +
361 + $whitelist = $loginizer['whitelist'];
362 +
363 + foreach($whitelist as $k => $v){
364 +
365 + // Is the IP in the blacklist ?
366 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
367 + $result = 1;
368 + break;
369 + }
370 +
371 + }
372 +
373 + // You are whitelisted
374 + if(!empty($result)){
375 + return true;
376 + }
377 +
378 + return false;
379 +
380 +}
381 +
382 +// Returns an error if the users IP is blocked
383 +function loginizer_wp_authenticate_user($user, $username){
384 +
385 + global $lz_error, $lz_cannot_login;
386 +
387 + // Is there a regulare error ?
388 + if(is_wp_error($user)){
389 + return $user;
390 + }
391 +
392 + // If we havent blocked it yet, just return $user
393 + if(empty($lz_cannot_login)){
394 + return $user;
395 + }
396 +
397 + // We have blocked the IP
398 + $error = new WP_Error();
399 + $error->add('ip_blocked', implode('', $lz_error));
400 + return $error;
401 +
402 +}
403 +
404 +// When the login fails, then this is called
405 +// We need to update the database
406 +function loginizer_login_failed($username){
407 +
408 + global $wpdb, $loginizer, $lz_cannot_login;
409 +
410 + if(empty($lz_cannot_login)){
411 +
412 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
413 +
414 + if(!empty($result)){
415 + $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
416 + $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
417 +
418 + // Do we need to email admin ?
419 + if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
420 +
421 + $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
422 + $mail = array();
423 + $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
424 + $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
425 + $mail['message'] = 'Hi,
426 +
427 +'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
428 +
429 +Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
430 +Last User Attempt : '.$username.'
431 +IP has been blocked until : '.date('m/d/Y H:i:s', time() + $loginizer['lockout_time']).'
432 +
433 +Regards,
434 +Loginizer';
435 +
436 + @wp_mail($mail['to'], $mail['subject'], $mail['message']);
437 + }
438 + }else{
439 + $result = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
440 + }
441 + }
442 +}
443 +
444 +// Modifies the default error messages shown
445 +function loginizer_update_error_msg($default_msg){
446 +
447 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
448 +
449 + $msg = '';
450 +
451 + if(!empty($lz_user_pass) && empty($lz_cannot_login)){
452 +
453 + $msg = '<b>ERROR:</b> Incorrect Username or Password';
454 +
455 + // If we are to show the number of retries left
456 + if(isset($loginizer['retries_left'])){
457 + $msg .= '<br /><b>'.$loginizer['retries_left'].'</b> attempt(s) left';
458 + }
459 + }
460 +
461 + if(!empty($msg)){
462 + return $msg;
463 + }else{
464 + return $default_msg;
465 + }
466 +
467 +}
468 +
469 +function loginizer_reset_retries(){
470 +
471 + global $wpdb, $loginizer;
472 +
473 + $deltime = time() - $loginizer['reset_retries'];
474 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
475 +
476 + update_option('loginizer_last_reset', time());
477 +
478 +}
479 +
480 +// Add settings link on plugin page
481 +function loginizer_settings_link($links) {
482 + $settings_link = '<a href="options-general.php?page=loginizer">Settings</a>';
483 + array_unshift($links, $settings_link);
484 + return $links;
485 +}
486 +
487 +$plugin = plugin_basename(__FILE__);
488 +add_filter("plugin_action_links_$plugin", 'loginizer_settings_link' );
489 +
490 +add_action('admin_menu', 'loginizer_admin_menu');
491 +
492 +// Shows the admin menu of Loginizer
493 +function loginizer_admin_menu() {
494 + global $wp_version;
495 +
496 + // Modern WP?
497 + if (version_compare($wp_version, '3.0', '>=')) {
498 + add_options_page('Loginizer', 'Loginizer', 'manage_options', 'loginizer', 'loginizer_option_page');
499 + return;
500 + }
501 +
502 + // Older WPMU?
503 + if (function_exists("get_current_site")) {
504 + add_submenu_page('wpmu-admin.php', 'Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
505 + return;
506 + }
507 +
508 + // Older WP
509 + add_options_page('Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
510 +}
511 +
512 +// The Loginizer Admin Options Page
513 +function loginizer_option_page(){
514 +
515 + global $wpdb, $wp_roles, $loginizer;
516 +
517 + if(!current_user_can('manage_options')){
518 + wp_die('Sorry, but you do not have permissions to change settings.');
519 + }
520 +
521 + /* Make sure post was from this page */
522 + if(count($_POST) > 0){
523 + check_admin_referer('loginizer-options');
524 + }
525 +
526 + // Load the blacklist and whitelist
527 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
528 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
529 +
530 + if(isset($_POST['save_lz'])){
531 +
532 + $max_retries = (int) lz_optpost('max_retries');
533 + $lockout_time = (int) lz_optpost('lockout_time');
534 + $max_lockouts = (int) lz_optpost('max_lockouts');
535 + $lockouts_extend = (int) lz_optpost('lockouts_extend');
536 + $reset_retries = (int) lz_optpost('reset_retries');
537 + $notify_email = (int) lz_optpost('notify_email');
538 +
539 + $lockout_time = $lockout_time * 60;
540 + $lockouts_extend = $lockouts_extend * 60 * 60;
541 + $reset_retries = $reset_retries * 60 * 60;
542 +
543 + if(empty($error)){
544 +
545 + $option['max_retries'] = $max_retries;
546 + $option['lockout_time'] = $lockout_time;
547 + $option['max_lockouts'] = $max_lockouts;
548 + $option['lockouts_extend'] = $lockouts_extend;
549 + $option['reset_retries'] = $reset_retries;
550 + $option['notify_email'] = $notify_email;
551 +
552 + // Save the options
553 + update_option('loginizer_options', $option);
554 +
555 + $saved = true;
556 +
557 + }else{
558 + lz_report_error($error);
559 + }
560 +
561 + if(!empty($notice)){
562 + lz_report_notice($notice);
563 + }
564 +
565 + if(!empty($saved)){
566 + echo '<div id="message" class="updated fade"><p>'
567 + . __('The settings were saved successfully', 'loginizer')
568 + . '</p></div>';
569 + }
570 +
571 + }
572 +
573 + // Delete a Blackist IP range
574 + if(isset($_GET['bdelid'])){
575 +
576 + $delid = (int) lz_optreq('bdelid');
577 +
578 + // Unset and save
579 + $blacklist = $loginizer['blacklist'];
580 + unset($blacklist[$delid]);
581 + update_option('loginizer_blacklist', $blacklist);
582 +
583 + echo '<div id="message" class="updated fade"><p>'
584 + . __('The Blacklist IP range has been deleted successfully', 'loginizer')
585 + . '</p></div>';
586 +
587 + }
588 +
589 + // Delete a Whitelist IP range
590 + if(isset($_GET['delid'])){
591 +
592 + $delid = (int) lz_optreq('delid');
593 +
594 + // Unset and save
595 + $whitelist = $loginizer['whitelist'];
596 + unset($whitelist[$delid]);
597 + update_option('loginizer_whitelist', $whitelist);
598 +
599 + echo '<div id="message" class="updated fade"><p>'
600 + . __('The Whitelist IP range has been deleted successfully', 'loginizer')
601 + . '</p></div>';
602 +
603 + }
604 +
605 + if(isset($_POST['blacklist_iprange'])){
606 +
607 + $start_ip = lz_optpost('start_ip');
608 + $end_ip = lz_optpost('end_ip');
609 +
610 + if(empty($start_ip)){
611 + $error[] = 'Please enter the Start IP';
612 + }
613 +
614 + // If no end IP we consider only 1 IP
615 + if(empty($end_ip)){
616 + $end_ip = $start_ip;
617 + }
618 +
619 + if(!lz_valid_ip($start_ip)){
620 + $error[] = 'Please provide a valid start IP';
621 + }
622 +
623 + if(!lz_valid_ip($end_ip)){
624 + $error[] = 'Please provide a valid end IP';
625 + }
626 +
627 + if(ip2long($start_ip) > ip2long($end_ip)){
628 + $error[] = 'The End IP cannot be smaller than the Start IP';
629 + }
630 +
631 + if(empty($error)){
632 +
633 + $blacklist = $loginizer['blacklist'];
634 +
635 + foreach($blacklist as $k => $v){
636 +
637 + // This is to check if there is any other range exists with the same Start or End IP
638 + if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
639 + || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
640 + ){
641 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
642 + break;
643 + }
644 +
645 + // This is to check if there is any other range exists with the same Start IP
646 + if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
647 + $error[] = 'The Start IP is present in an existing range !';
648 + break;
649 + }
650 +
651 + // This is to check if there is any other range exists with the same End IP
652 + if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
653 + $error[] = 'The End IP is present in an existing range!';
654 + break;
655 + }
656 +
657 + }
658 +
659 + $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
660 +
661 + if(empty($error)){
662 +
663 + $blacklist[$newid] = array();
664 + $blacklist[$newid]['start'] = $start_ip;
665 + $blacklist[$newid]['end'] = $end_ip;
666 + $blacklist[$newid]['time'] = time();
667 +
668 + update_option('loginizer_blacklist', $blacklist);
669 +
670 + echo '<div id="message" class="updated fade"><p>'
671 + . __('Blacklist IP range added successfully', 'loginizer')
672 + . '</p></div>';
673 +
674 + }
675 +
676 + }
677 +
678 + if(!empty($error)){
679 + lz_report_error($error);
680 + }
681 +
682 + }
683 +
684 + if(isset($_POST['whitelist_iprange'])){
685 +
686 + $start_ip = lz_optpost('start_ip_w');
687 + $end_ip = lz_optpost('end_ip_w');
688 +
689 + if(empty($start_ip)){
690 + $error[] = 'Please enter the Start IP';
691 + }
692 +
693 + // If no end IP we consider only 1 IP
694 + if(empty($end_ip)){
695 + $end_ip = $start_ip;
696 + }
697 +
698 + if(!lz_valid_ip($start_ip)){
699 + $error[] = 'Please provide a valid start IP';
700 + }
701 +
702 + if(!lz_valid_ip($end_ip)){
703 + $error[] = 'Please provide a valid end IP';
704 + }
705 +
706 + if(ip2long($start_ip) > ip2long($end_ip)){
707 + $error[] = 'The End IP cannot be smaller than the Start IP';
708 + }
709 +
710 + if(empty($error)){
711 +
712 + $whitelist = $loginizer['whitelist'];
713 +
714 + foreach($whitelist as $k => $v){
715 +
716 + // This is to check if there is any other range exists with the same Start or End IP
717 + if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
718 + || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
719 + ){
720 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
721 + break;
722 + }
723 +
724 + // This is to check if there is any other range exists with the same Start IP
725 + if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
726 + $error[] = 'The Start IP is present in an existing range !';
727 + break;
728 + }
729 +
730 + // This is to check if there is any other range exists with the same End IP
731 + if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
732 + $error[] = 'The End IP is present in an existing range!';
733 + break;
734 + }
735 +
736 + }
737 +
738 + $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
739 +
740 + if(empty($error)){
741 +
742 + $whitelist[$newid] = array();
743 + $whitelist[$newid]['start'] = $start_ip;
744 + $whitelist[$newid]['end'] = $end_ip;
745 + $whitelist[$newid]['time'] = time();
746 +
747 + update_option('loginizer_whitelist', $whitelist);
748 +
749 + echo '<div id="message" class="updated fade"><p>'
750 + . __('Whitelist IP range added successfully', 'loginizer')
751 + . '</p></div>';
752 +
753 + }
754 +
755 + }
756 +
757 + if(!empty($error)){
758 + lz_report_error($error);
759 + }
760 + }
761 +
762 + // Get the logs
763 + $result = array();
764 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `count` DESC LIMIT 0, 10;", 1);
765 + //print_r($result);
766 +
767 + // Reload the settings
768 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
769 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
770 +
771 + ?>
772 +<div class="wrap">
773 + <!--This is intentional-->
774 + <h2></h2>
775 +
776 + <h1><center><?php echo __('Loginizer','loginizer'); ?></center></h1><hr /><br />
777 +
778 + <script src="http://api.loginizer.com/news.js""></script>
779 +
780 + <h2><?php echo __('Failed Login Attempts Logs &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?></h2><hr /><br />
781 +
782 + <table class="wp-list-table widefat fixed users" border="0">
783 + <tr>
784 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
785 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
786 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
787 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
788 + </tr>
789 + <?php
790 + if(empty($result)){
791 + echo '
792 + <tr>
793 + <td colspan="4">
794 + No Logs. You will see logs about failed login attempts here.
795 + </td>
796 + </tr>';
797 + }else{
798 + foreach($result as $ik => $iv){
799 + $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
800 + echo '
801 + <tr>
802 + <td>
803 + '.$iv['ip'].'
804 + </td>
805 + <td>
806 + '.date('d/m/Y H:i:s', $iv['time']).'
807 + </td>
808 + <td>
809 + '.$iv['count'].'
810 + </td>
811 + <td>
812 + '.$iv['lockout'].'
813 + </td>
814 + </tr>';
815 + }
816 + }
817 + ?>
818 + </table>
819 + <br />
820 + <h2><?php echo __('Loginizer Settings','loginizer'); ?></h2><hr /><br />
821 +
822 + <form action="options-general.php?page=loginizer" method="post" enctype="multipart/form-data">
823 + <?php wp_nonce_field('loginizer-options'); ?>
824 + <table class="form-table">
825 + <tr>
826 + <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
827 + <td>
828 + <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
829 + </td>
830 + </tr>
831 + <tr>
832 + <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
833 + <td>
834 + <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
835 + </td>
836 + </tr>
837 + <tr>
838 + <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
839 + <td>
840 + <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
841 + </td>
842 + </tr>
843 + <tr>
844 + <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
845 + <td>
846 + <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
847 + </td>
848 + </tr>
849 + <tr>
850 + <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
851 + <td>
852 + <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
853 + </td>
854 + </tr>
855 + <tr>
856 + <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
857 + <td>
858 + <?php echo __('after ','loginizer'); ?>
859 + <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
860 + </td>
861 + </tr>
862 + </table><br />
863 + <input name="save_lz" class="button action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
864 + </form>
865 +
866 + <br /><br />
867 + <hr />
868 + <h2><?php echo __('Blacklist IP','loginizer'); ?></h2>
869 + <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
870 + <form action="options-general.php?page=loginizer" method="post">
871 + <?php wp_nonce_field('loginizer-options'); ?>
872 + <table class="form-table">
873 + <tr>
874 + <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
875 + <td>
876 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
877 + </td>
878 + </tr>
879 + <tr>
880 + <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
881 + <td>
882 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
883 + </td>
884 + </tr>
885 + </table><br />
886 + <input name="blacklist_iprange" class="button action" value="<?php echo __('Blacklist IP range','loginizer'); ?>" type="submit" />
887 + </form>
888 + <br />
889 + <table class="wp-list-table widefat fixed users" border="0">
890 + <tr>
891 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
892 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
893 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
894 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
895 + </tr>
896 + <?php
897 + if(empty($loginizer['blacklist'])){
898 + echo '
899 + <tr>
900 + <td colspan="4">
901 + No Blacklist IPs. You will see blacklisted IP ranges here.
902 + </td>
903 + </tr>';
904 + }else{
905 + foreach($loginizer['blacklist'] as $ik => $iv){
906 + echo '
907 + <tr>
908 + <td>
909 + '.$iv['start'].'
910 + </td>
911 + <td>
912 + '.$iv['end'].'
913 + </td>
914 + <td>
915 + '.date('d/m/Y', $iv['time']).'
916 + </td>
917 + <td>
918 + <a class="submitdelete" href="options-general.php?page=loginizer&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
919 + </td>
920 + </tr>';
921 + }
922 + }
923 + ?>
924 + </table>
925 + <br />
926 + <hr />
927 + <h2><?php echo __('Whitelist IP','loginizer'); ?></h2>
928 + <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
929 + <form action="options-general.php?page=loginizer" method="post">
930 + <?php wp_nonce_field('loginizer-options'); ?>
931 + <table class="form-table">
932 + <tr>
933 + <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
934 + <td>
935 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
936 + </td>
937 + </tr>
938 + <tr>
939 + <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
940 + <td>
941 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
942 + </td>
943 + </tr>
944 + </table><br />
945 + <input name="whitelist_iprange" class="button action" value="<?php echo __('Whitelist IP range','loginizer'); ?>" type="submit" />
946 + </form>
947 + <br />
948 + <table class="wp-list-table widefat fixed users" border="0">
949 + <tr>
950 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
951 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
952 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
953 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
954 + </tr>
955 + <?php
956 + if(empty($loginizer['whitelist'])){
957 + echo '
958 + <tr>
959 + <td colspan="4">
960 + No Whitelist IPs. You will see whitelisted IP ranges here.
961 + </td>
962 + </tr>';
963 + }else{
964 + foreach($loginizer['whitelist'] as $ik => $iv){
965 + echo '
966 + <tr>
967 + <td>
968 + '.$iv['start'].'
969 + </td>
970 + <td>
971 + '.$iv['end'].'
972 + </td>
973 + <td>
974 + '.date('d/m/Y', $iv['time']).'
975 + </td>
976 + <td>
977 + <a class="submitdelete" href="options-general.php?page=loginizer&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
978 + </td>
979 + </tr>';
980 + }
981 + }
982 + ?>
983 + </table>
984 + <br />
985 +</div>
986 + <?php
987 +
988 + echo '<br /><br /><hr />
989 + <a href="http://www.loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.' <br />
990 + You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
991 +
992 +}
993 +
994 +// Sorry to see you going
995 +register_uninstall_hook( __FILE__, 'loginizer_deactivation');
996 +
997 +function loginizer_deactivation(){
998 +
999 +global $wpdb;
1000 +
1001 + $sql = array();
1002 + $sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
1003 +
1004 + foreach($sql as $sk => $sv){
1005 + $wpdb->query($sv);
1006 + }
1007 +
1008 + delete_option('loginizer_version');
1009 + delete_option('loginizer_options');
1010 + delete_option('loginizer_last_reset');
1011 + delete_option('loginizer_whitelist');
1012 + delete_option('loginizer_blacklist');
1013 +
1014 +}
1015 +