PluginProbe
Loginizer / 1.0.2
Loginizer v1.0.2
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
loginizer / loginizer.php

loginizer.php in Loginizer 1.0.2, at loginizer.php

1,011 lines 31.8 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 /**
3 * @package loginizer
4 * @version 1.0.2
5 */
6 /*
7 Plugin Name: Loginizer
8 Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9 Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10 Version: 1.0.2
11 Author: Raj Kothari
12 Author URI: http://www.loginizer.com
13 License: GPLv3 or later
14 */
15
16 /*
17 Copyright (C) 2013 Raj Kothari (email : support@loginizer.com)
18 This program is free software: you can redistribute it and/or modify
19 it under the terms of the GNU General Public License as published by
20 the Free Software Foundation, either version 3 of the License, or
21 (at your option) any later version.
22
23 This program is distributed in the hope that it will be useful,
24 but WITHOUT ANY WARRANTY; without even the implied warranty of
25 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 GNU General Public License for more details.
27
28 You should have received a copy of the GNU General Public License
29 along with this program. If not, see <http://www.gnu.org/licenses/>.
30 */
31
32 if(!function_exists('add_action')){
33 echo 'You are not allowed to access this page directly.';
34 exit;
35 }
36
37 define('LOGINIZER_VERSION', '1.0.2');
38
39 include_once('functions.php');
40
41 // Ok so we are now ready to go
42 register_activation_hook( __FILE__, 'loginizer_activation');
43
44 // Is called when the ADMIN enables the plugin
45 function loginizer_activation(){
46
47 global $wpdb;
48
49 $sql = array();
50
51 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
52 `username` varchar(255) NOT NULL DEFAULT '',
53 `time` int(10) NOT NULL DEFAULT '0',
54 `count` int(10) NOT NULL DEFAULT '0',
55 `lockout` int(10) NOT NULL DEFAULT '0',
56 `ip` varchar(255) NOT NULL DEFAULT '',
57 UNIQUE KEY `ip` (`ip`)
58 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
59
60 foreach($sql as $sk => $sv){
61 $wpdb->query($sv);
62 }
63
64 add_option('loginizer_version', LOGINIZER_VERSION);
65 add_option('loginizer_options', array());
66 add_option('loginizer_last_reset', 0);
67 add_option('loginizer_whitelist', array());
68 add_option('loginizer_blacklist', array());
69
70 }
71
72 // Checks if we are to update ?
73 function loginizer_update_check(){
74
75 global $wpdb;
76
77 $sql = array();
78 $current_version = get_option('loginizer_version');
79
80 // It must be the 1.0 pre stuff
81 if(empty($current_version)){
82 $current_version = get_option('lz_version');
83 }
84
85 $version = (int) str_replace('.', '', $current_version);
86
87 // No update required
88 if($current_version == LOGINIZER_VERSION){
89 return true;
90 }
91
92 // Is it first run ?
93 if(empty($current_version)){
94
95 // Reinstall
96 loginizer_activation();
97
98 // Trick the following if conditions to not run
99 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
100
101 }
102
103 // Is it less than 1.0.1 ?
104 if($version < 101){
105
106 // TODO : GET the existing settings
107
108 // Get the existing settings
109 $lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
110 $lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
111 $lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
112
113 // Delete the three tables
114 $sql = array();
115 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
116 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
117 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
118
119 foreach($sql as $sk => $sv){
120 $wpdb->query($sv);
121 }
122
123 // Delete option
124 delete_option('lz_version');
125
126 // Reinstall
127 loginizer_activation();
128
129 // TODO : Save the existing settings
130
131 // Update the existing failed logs to new table
132 if(is_array($lz_failed_logs)){
133 foreach($lz_failed_logs as $fk => $fv){
134 $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
135 }
136 }
137
138 // Update the existing options to new structure
139 if(is_array($lz_options)){
140 foreach($lz_options as $ok => $ov){
141
142 if($ov['option_name'] == 'lz_last_reset'){
143 update_option('loginizer_last_reset', $ov['option_value']);
144 continue;
145 }
146
147 $old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
148 }
149 // Save the options
150 update_option('loginizer_options', $old_option);
151 }
152
153 // Update the existing iprange to new structure
154 if(is_array($lz_iprange)){
155
156 $old_blacklist = array();
157 $old_whitelist = array();
158 $bid = 1;
159 $wid = 1;
160 foreach($lz_iprange as $ik => $iv){
161
162 if(!empty($iv['blacklist'])){
163 $old_blacklist[$bid] = array();
164 $old_blacklist[$bid]['start'] = long2ip($iv['start']);
165 $old_blacklist[$bid]['end'] = long2ip($iv['end']);
166 $old_blacklist[$bid]['time'] = strtotime($iv['date']);
167 $bid = $bid + 1;
168 }
169
170 if(!empty($iv['whitelist'])){
171 $old_whitelist[$wid] = array();
172 $old_whitelist[$wid]['start'] = long2ip($iv['start']);
173 $old_whitelist[$wid]['end'] = long2ip($iv['end']);
174 $old_whitelist[$wid]['time'] = strtotime($iv['date']);
175 $wid = $wid + 1;
176 }
177 }
178
179 if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
180 if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
181 }
182
183 }
184
185 // Save the new Version
186 update_option('loginizer_version', LOGINIZER_VERSION);
187
188 }
189
190 // Add the action to load the plugin
191 add_action('plugins_loaded', 'loginizer_load_plugin');
192
193 // The function that will be called when the plugin is loaded
194 function loginizer_load_plugin(){
195
196 global $loginizer;
197
198 // Check if the installed version is outdated
199 loginizer_update_check();
200
201 $options = get_option('loginizer_options');
202
203 $loginizer = array();
204 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
205 $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
206 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
207 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
208 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
209 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
210
211 // Load the blacklist and whitelist
212 $loginizer['blacklist'] = get_option('loginizer_blacklist');
213 $loginizer['whitelist'] = get_option('loginizer_whitelist');
214
215 // When was the database cleared last time
216 $loginizer_last_reset = get_option('loginizer_last_reset');
217
218 //print_r($loginizer);
219
220 // Clear retries
221 if((time() - $loginizer_last_reset) >= $loginizer['reset_retries']){
222 loginizer_reset_retries();
223 }
224
225 // Set the current IP
226 $loginizer['current_ip'] = lz_getip();
227
228 /* Filters and actions */
229
230 // Use this to verify before WP tries to login
231 // Is always called and is the first function to be called
232 //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
233 add_filter('authenticate', 'loginizer_wp_authenticate', 10, 3);// This one is called by xmlrpc as well as GUI
234
235 // This is used for additional validation
236 // This function is called after the form is posted
237 add_filter('wp_authenticate_user', 'loginizer_wp_authenticate_user', 99999, 2);
238
239 // Is called when a login attempt fails
240 // Hence Update our records that the login failed
241 add_action('wp_login_failed', 'loginizer_login_failed');
242
243 // Is called before displaying the error message so that we dont show that the username is wrong or the password
244 // Update Error message
245 add_action('login_errors', 'loginizer_update_error_msg');
246
247 }
248
249 function loginizer_wp_authenticate($user, $username, $password){
250
251 global $lz_error, $lz_cannot_login, $lz_user_pass;
252
253 if(!empty($username) && !empty($password)){
254 $lz_user_pass = 1;
255 }
256
257 // Are you whitelisted ?
258 if(loginizer_is_whitelisted()){
259 return $username;
260 }
261
262 // Are you blacklisted ?
263 if(loginizer_is_blacklisted()){
264 $lz_cannot_login = 1;
265 $error = new WP_Error();
266 $error->add('ip_blacklisted', implode('', $lz_error));
267 return $error;
268 }
269
270 if(loginizer_can_login()){
271 return $username;
272 }
273
274 $lz_cannot_login = 1;
275
276 $error = new WP_Error();
277 $error->add('ip_blocked', implode('', $lz_error));
278 return $error;
279
280 }
281
282 function loginizer_can_login(){
283
284 global $wpdb, $loginizer, $lz_error;
285
286 // Get the logs
287 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
288
289 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
290
291 // Has he reached max lockouts ?
292 if($result['lockout'] >= $loginizer['max_lockouts']){
293 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
294 }
295
296 // Is he in the lockout time ?
297 if($result['time'] >= (time() - $loginizer['lockout_time'])){
298 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
299
300 //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
301 //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
302 //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
303
304 $_time = $banlift.' minute(s)';
305
306 if($banlift > 60){
307 $banlift = ceil($banlift / 60);
308 $_time = $banlift.' hour(s)';
309 }
310
311 $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
312
313 return false;
314 }
315 }
316
317 return true;
318 }
319
320 function loginizer_is_blacklisted(){
321
322 global $wpdb, $loginizer, $lz_error;
323
324 $blacklist = $loginizer['blacklist'];
325
326 foreach($blacklist as $k => $v){
327
328 // Is the IP in the blacklist ?
329 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
330 $result = 1;
331 break;
332 }
333
334 }
335
336 // You are blacklisted
337 if(!empty($result)){
338 $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
339 return true;
340 }
341
342 return false;
343
344 }
345
346 function loginizer_is_whitelisted(){
347
348 global $wpdb, $loginizer, $lz_error;
349
350 $whitelist = $loginizer['whitelist'];
351
352 foreach($whitelist as $k => $v){
353
354 // Is the IP in the blacklist ?
355 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
356 $result = 1;
357 break;
358 }
359
360 }
361
362 // You are whitelisted
363 if(!empty($result)){
364 return true;
365 }
366
367 return false;
368
369 }
370
371 // Returns an error if the users IP is blocked
372 function loginizer_wp_authenticate_user($user, $username){
373
374 global $lz_error, $lz_cannot_login;
375
376 // Is there a regulare error ?
377 if(is_wp_error($user)){
378 return $user;
379 }
380
381 // If we havent blocked it yet, just return $user
382 if(empty($lz_cannot_login)){
383 return $user;
384 }
385
386 // We have blocked the IP
387 $error = new WP_Error();
388 $error->add('ip_blocked', implode('', $lz_error));
389 return $error;
390
391 }
392
393 // When the login fails, then this is called
394 // We need to update the database
395 function loginizer_login_failed($username){
396
397 global $wpdb, $loginizer, $lz_cannot_login;
398
399 if(empty($lz_cannot_login)){
400
401 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
402
403 if(!empty($result)){
404 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
405 $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
406
407 // Do we need to email admin ?
408 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
409
410 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
411 $mail = array();
412 $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
413 $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
414 $mail['message'] = 'Hi,
415
416 '.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
417
418 Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
419 Last User Attempt : '.$username.'
420 IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
421
422 Regards,
423 Loginizer';
424
425 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
426 }
427 }else{
428 $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
429 }
430
431 // We need to add one as this is a failed attempt as well
432 $result['count'] = $result['count'] + 1;
433 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
434 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
435
436 }
437 }
438
439 // Modifies the default error messages shown
440 function loginizer_update_error_msg($default_msg){
441
442 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
443
444 $msg = '';
445
446 if(!empty($lz_user_pass) && empty($lz_cannot_login)){
447
448 $msg = '<b>ERROR:</b> Incorrect Username or Password';
449
450 // If we are to show the number of retries left
451 if(isset($loginizer['retries_left'])){
452 $msg .= '<br /><b>'.$loginizer['retries_left'].'</b> attempt(s) left';
453 }
454 }
455
456 if(!empty($msg)){
457 return $msg;
458 }else{
459 return $default_msg;
460 }
461
462 }
463
464 function loginizer_reset_retries(){
465
466 global $wpdb, $loginizer;
467
468 $deltime = time() - $loginizer['reset_retries'];
469 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
470
471 update_option('loginizer_last_reset', time());
472
473 }
474
475 // Add settings link on plugin page
476 function loginizer_settings_link($links) {
477 $settings_link = '<a href="options-general.php?page=loginizer">Settings</a>';
478 array_unshift($links, $settings_link);
479 return $links;
480 }
481
482 $plugin = plugin_basename(__FILE__);
483 add_filter("plugin_action_links_$plugin", 'loginizer_settings_link' );
484
485 add_action('admin_menu', 'loginizer_admin_menu');
486
487 // Shows the admin menu of Loginizer
488 function loginizer_admin_menu() {
489 global $wp_version;
490
491 // Modern WP?
492 if (version_compare($wp_version, '3.0', '>=')) {
493 add_options_page('Loginizer', 'Loginizer', 'manage_options', 'loginizer', 'loginizer_option_page');
494 return;
495 }
496
497 // Older WPMU?
498 if (function_exists("get_current_site")) {
499 add_submenu_page('wpmu-admin.php', 'Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
500 return;
501 }
502
503 // Older WP
504 add_options_page('Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
505 }
506
507 // The Loginizer Admin Options Page
508 function loginizer_option_page(){
509
510 global $wpdb, $wp_roles, $loginizer;
511
512 if(!current_user_can('manage_options')){
513 wp_die('Sorry, but you do not have permissions to change settings.');
514 }
515
516 /* Make sure post was from this page */
517 if(count($_POST) > 0){
518 check_admin_referer('loginizer-options');
519 }
520
521 // Load the blacklist and whitelist
522 $loginizer['blacklist'] = get_option('loginizer_blacklist');
523 $loginizer['whitelist'] = get_option('loginizer_whitelist');
524
525 if(isset($_POST['save_lz'])){
526
527 $max_retries = (int) lz_optpost('max_retries');
528 $lockout_time = (int) lz_optpost('lockout_time');
529 $max_lockouts = (int) lz_optpost('max_lockouts');
530 $lockouts_extend = (int) lz_optpost('lockouts_extend');
531 $reset_retries = (int) lz_optpost('reset_retries');
532 $notify_email = (int) lz_optpost('notify_email');
533
534 $lockout_time = $lockout_time * 60;
535 $lockouts_extend = $lockouts_extend * 60 * 60;
536 $reset_retries = $reset_retries * 60 * 60;
537
538 if(empty($error)){
539
540 $option['max_retries'] = $max_retries;
541 $option['lockout_time'] = $lockout_time;
542 $option['max_lockouts'] = $max_lockouts;
543 $option['lockouts_extend'] = $lockouts_extend;
544 $option['reset_retries'] = $reset_retries;
545 $option['notify_email'] = $notify_email;
546
547 // Save the options
548 update_option('loginizer_options', $option);
549
550 $saved = true;
551
552 }else{
553 lz_report_error($error);
554 }
555
556 if(!empty($notice)){
557 lz_report_notice($notice);
558 }
559
560 if(!empty($saved)){
561 echo '<div id="message" class="updated fade"><p>'
562 . __('The settings were saved successfully', 'loginizer')
563 . '</p></div>';
564 }
565
566 }
567
568 // Delete a Blackist IP range
569 if(isset($_GET['bdelid'])){
570
571 $delid = (int) lz_optreq('bdelid');
572
573 // Unset and save
574 $blacklist = $loginizer['blacklist'];
575 unset($blacklist[$delid]);
576 update_option('loginizer_blacklist', $blacklist);
577
578 echo '<div id="message" class="updated fade"><p>'
579 . __('The Blacklist IP range has been deleted successfully', 'loginizer')
580 . '</p></div>';
581
582 }
583
584 // Delete a Whitelist IP range
585 if(isset($_GET['delid'])){
586
587 $delid = (int) lz_optreq('delid');
588
589 // Unset and save
590 $whitelist = $loginizer['whitelist'];
591 unset($whitelist[$delid]);
592 update_option('loginizer_whitelist', $whitelist);
593
594 echo '<div id="message" class="updated fade"><p>'
595 . __('The Whitelist IP range has been deleted successfully', 'loginizer')
596 . '</p></div>';
597
598 }
599
600 if(isset($_POST['blacklist_iprange'])){
601
602 $start_ip = lz_optpost('start_ip');
603 $end_ip = lz_optpost('end_ip');
604
605 if(empty($start_ip)){
606 $error[] = 'Please enter the Start IP';
607 }
608
609 // If no end IP we consider only 1 IP
610 if(empty($end_ip)){
611 $end_ip = $start_ip;
612 }
613
614 if(!lz_valid_ip($start_ip)){
615 $error[] = 'Please provide a valid start IP';
616 }
617
618 if(!lz_valid_ip($end_ip)){
619 $error[] = 'Please provide a valid end IP';
620 }
621
622 if(ip2long($start_ip) > ip2long($end_ip)){
623 $error[] = 'The End IP cannot be smaller than the Start IP';
624 }
625
626 if(empty($error)){
627
628 $blacklist = $loginizer['blacklist'];
629
630 foreach($blacklist as $k => $v){
631
632 // This is to check if there is any other range exists with the same Start or End IP
633 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
634 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
635 ){
636 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
637 break;
638 }
639
640 // This is to check if there is any other range exists with the same Start IP
641 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
642 $error[] = 'The Start IP is present in an existing range !';
643 break;
644 }
645
646 // This is to check if there is any other range exists with the same End IP
647 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
648 $error[] = 'The End IP is present in an existing range!';
649 break;
650 }
651
652 }
653
654 $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
655
656 if(empty($error)){
657
658 $blacklist[$newid] = array();
659 $blacklist[$newid]['start'] = $start_ip;
660 $blacklist[$newid]['end'] = $end_ip;
661 $blacklist[$newid]['time'] = time();
662
663 update_option('loginizer_blacklist', $blacklist);
664
665 echo '<div id="message" class="updated fade"><p>'
666 . __('Blacklist IP range added successfully', 'loginizer')
667 . '</p></div>';
668
669 }
670
671 }
672
673 if(!empty($error)){
674 lz_report_error($error);
675 }
676
677 }
678
679 if(isset($_POST['whitelist_iprange'])){
680
681 $start_ip = lz_optpost('start_ip_w');
682 $end_ip = lz_optpost('end_ip_w');
683
684 if(empty($start_ip)){
685 $error[] = 'Please enter the Start IP';
686 }
687
688 // If no end IP we consider only 1 IP
689 if(empty($end_ip)){
690 $end_ip = $start_ip;
691 }
692
693 if(!lz_valid_ip($start_ip)){
694 $error[] = 'Please provide a valid start IP';
695 }
696
697 if(!lz_valid_ip($end_ip)){
698 $error[] = 'Please provide a valid end IP';
699 }
700
701 if(ip2long($start_ip) > ip2long($end_ip)){
702 $error[] = 'The End IP cannot be smaller than the Start IP';
703 }
704
705 if(empty($error)){
706
707 $whitelist = $loginizer['whitelist'];
708
709 foreach($whitelist as $k => $v){
710
711 // This is to check if there is any other range exists with the same Start or End IP
712 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
713 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
714 ){
715 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
716 break;
717 }
718
719 // This is to check if there is any other range exists with the same Start IP
720 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
721 $error[] = 'The Start IP is present in an existing range !';
722 break;
723 }
724
725 // This is to check if there is any other range exists with the same End IP
726 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
727 $error[] = 'The End IP is present in an existing range!';
728 break;
729 }
730
731 }
732
733 $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
734
735 if(empty($error)){
736
737 $whitelist[$newid] = array();
738 $whitelist[$newid]['start'] = $start_ip;
739 $whitelist[$newid]['end'] = $end_ip;
740 $whitelist[$newid]['time'] = time();
741
742 update_option('loginizer_whitelist', $whitelist);
743
744 echo '<div id="message" class="updated fade"><p>'
745 . __('Whitelist IP range added successfully', 'loginizer')
746 . '</p></div>';
747
748 }
749
750 }
751
752 if(!empty($error)){
753 lz_report_error($error);
754 }
755 }
756
757 // Get the logs
758 $result = array();
759 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `count` DESC LIMIT 0, 10;", 1);
760 //print_r($result);
761
762 // Reload the settings
763 $loginizer['blacklist'] = get_option('loginizer_blacklist');
764 $loginizer['whitelist'] = get_option('loginizer_whitelist');
765
766 ?>
767 <div class="wrap">
768 <!--This is intentional-->
769 <h2></h2>
770
771 <h1><center><?php echo __('Loginizer','loginizer'); ?></center></h1><hr /><br />
772
773 <script src="http://api.loginizer.com/news.js""></script>
774
775 <h2><?php echo __('Failed Login Attempts Logs &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?></h2><hr /><br />
776
777 <table class="wp-list-table widefat fixed users" border="0">
778 <tr>
779 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
780 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
781 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
782 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
783 </tr>
784 <?php
785 if(empty($result)){
786 echo '
787 <tr>
788 <td colspan="4">
789 No Logs. You will see logs about failed login attempts here.
790 </td>
791 </tr>';
792 }else{
793 foreach($result as $ik => $iv){
794 $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
795 echo '
796 <tr>
797 <td>
798 '.$iv['ip'].'
799 </td>
800 <td>
801 '.date('d/m/Y H:i:s', $iv['time']).'
802 </td>
803 <td>
804 '.$iv['count'].'
805 </td>
806 <td>
807 '.$iv['lockout'].'
808 </td>
809 </tr>';
810 }
811 }
812 ?>
813 </table>
814 <br />
815 <h2><?php echo __('Loginizer Settings','loginizer'); ?></h2><hr /><br />
816
817 <form action="options-general.php?page=loginizer" method="post" enctype="multipart/form-data">
818 <?php wp_nonce_field('loginizer-options'); ?>
819 <table class="form-table">
820 <tr>
821 <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
822 <td>
823 <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
824 </td>
825 </tr>
826 <tr>
827 <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
828 <td>
829 <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
830 </td>
831 </tr>
832 <tr>
833 <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
834 <td>
835 <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
836 </td>
837 </tr>
838 <tr>
839 <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
840 <td>
841 <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
842 </td>
843 </tr>
844 <tr>
845 <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
846 <td>
847 <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
848 </td>
849 </tr>
850 <tr>
851 <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
852 <td>
853 <?php echo __('after ','loginizer'); ?>
854 <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
855 </td>
856 </tr>
857 </table><br />
858 <input name="save_lz" class="button action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
859 </form>
860
861 <br /><br />
862 <hr />
863 <h2><?php echo __('Blacklist IP','loginizer'); ?></h2>
864 <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
865 <form action="options-general.php?page=loginizer" method="post">
866 <?php wp_nonce_field('loginizer-options'); ?>
867 <table class="form-table">
868 <tr>
869 <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
870 <td>
871 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
872 </td>
873 </tr>
874 <tr>
875 <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
876 <td>
877 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
878 </td>
879 </tr>
880 </table><br />
881 <input name="blacklist_iprange" class="button action" value="<?php echo __('Blacklist IP range','loginizer'); ?>" type="submit" />
882 </form>
883 <br />
884 <table class="wp-list-table widefat fixed users" border="0">
885 <tr>
886 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
887 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
888 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
889 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
890 </tr>
891 <?php
892 if(empty($loginizer['blacklist'])){
893 echo '
894 <tr>
895 <td colspan="4">
896 No Blacklist IPs. You will see blacklisted IP ranges here.
897 </td>
898 </tr>';
899 }else{
900 foreach($loginizer['blacklist'] as $ik => $iv){
901 echo '
902 <tr>
903 <td>
904 '.$iv['start'].'
905 </td>
906 <td>
907 '.$iv['end'].'
908 </td>
909 <td>
910 '.date('d/m/Y', $iv['time']).'
911 </td>
912 <td>
913 <a class="submitdelete" href="options-general.php?page=loginizer&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
914 </td>
915 </tr>';
916 }
917 }
918 ?>
919 </table>
920 <br />
921 <hr />
922 <h2><?php echo __('Whitelist IP','loginizer'); ?></h2>
923 <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
924 <form action="options-general.php?page=loginizer" method="post">
925 <?php wp_nonce_field('loginizer-options'); ?>
926 <table class="form-table">
927 <tr>
928 <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
929 <td>
930 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
931 </td>
932 </tr>
933 <tr>
934 <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
935 <td>
936 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
937 </td>
938 </tr>
939 </table><br />
940 <input name="whitelist_iprange" class="button action" value="<?php echo __('Whitelist IP range','loginizer'); ?>" type="submit" />
941 </form>
942 <br />
943 <table class="wp-list-table widefat fixed users" border="0">
944 <tr>
945 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
946 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
947 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
948 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
949 </tr>
950 <?php
951 if(empty($loginizer['whitelist'])){
952 echo '
953 <tr>
954 <td colspan="4">
955 No Whitelist IPs. You will see whitelisted IP ranges here.
956 </td>
957 </tr>';
958 }else{
959 foreach($loginizer['whitelist'] as $ik => $iv){
960 echo '
961 <tr>
962 <td>
963 '.$iv['start'].'
964 </td>
965 <td>
966 '.$iv['end'].'
967 </td>
968 <td>
969 '.date('d/m/Y', $iv['time']).'
970 </td>
971 <td>
972 <a class="submitdelete" href="options-general.php?page=loginizer&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
973 </td>
974 </tr>';
975 }
976 }
977 ?>
978 </table>
979 <br />
980 </div>
981 <?php
982
983 echo '<br /><br /><hr />
984 <a href="http://www.loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.' <br />
985 You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
986
987 }
988
989 // Sorry to see you going
990 register_uninstall_hook( __FILE__, 'loginizer_deactivation');
991
992 function loginizer_deactivation(){
993
994 global $wpdb;
995
996 $sql = array();
997 $sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
998
999 foreach($sql as $sk => $sv){
1000 $wpdb->query($sv);
1001 }
1002
1003 delete_option('loginizer_version');
1004 delete_option('loginizer_options');
1005 delete_option('loginizer_last_reset');
1006 delete_option('loginizer_whitelist');
1007 delete_option('loginizer_blacklist');
1008
1009 }
1010
1011