| 1 |
<?php |
| 2 |
/** |
| 3 |
* @package loginizer |
| 4 |
* @version 1.4.2 |
| 5 |
*/ |
| 6 |
/* |
| 7 |
Plugin Name: Loginizer |
| 8 |
Plugin URI: http://wordpress.org/extend/plugins/loginizer/ |
| 9 |
Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer. |
| 10 |
Version: 1.0 |
| 11 |
Author: Raj Kothari |
| 12 |
Author URI: http://www.loginizer.com |
| 13 |
License: GPLv3 or later |
| 14 |
*/ |
| 15 |
|
| 16 |
/* |
| 17 |
Copyright (C) 2013 Raj Kothari (email : support@loginizer.com) |
| 18 |
This program is free software: you can redistribute it and/or modify |
| 19 |
it under the terms of the GNU General Public License as published by |
| 20 |
the Free Software Foundation, either version 3 of the License, or |
| 21 |
(at your option) any later version. |
| 22 |
|
| 23 |
This program is distributed in the hope that it will be useful, |
| 24 |
but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 25 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 26 |
GNU General Public License for more details. |
| 27 |
|
| 28 |
You should have received a copy of the GNU General Public License |
| 29 |
along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 30 |
*/ |
| 31 |
|
| 32 |
if(!function_exists('add_action')){ |
| 33 |
echo 'You are not allowed to access this page directly.'; |
| 34 |
exit; |
| 35 |
} |
| 36 |
|
| 37 |
define('lz_version', '1.0'); |
| 38 |
|
| 39 |
include_once('functions.php'); |
| 40 |
|
| 41 |
// Ok so we are now ready to go |
| 42 |
register_activation_hook( __FILE__, 'loginizer_activation'); |
| 43 |
|
| 44 |
function loginizer_activation(){ |
| 45 |
|
| 46 |
global $wpdb; |
| 47 |
|
| 48 |
$sql = array(); |
| 49 |
$sql[] = " |
| 50 |
-- |
| 51 |
-- Table structure for table `".$wpdb->prefix."lz_failed_logs` |
| 52 |
-- |
| 53 |
|
| 54 |
CREATE TABLE `".$wpdb->prefix."lz_failed_logs` ( |
| 55 |
`username` varchar(255) NOT NULL DEFAULT '', |
| 56 |
`time` int(10) NOT NULL DEFAULT '0', |
| 57 |
`count` int(10) NOT NULL DEFAULT '0', |
| 58 |
`lockout` int(10) NOT NULL DEFAULT '0', |
| 59 |
`ip` varchar(255) NOT NULL DEFAULT '', |
| 60 |
UNIQUE KEY `ip` (`ip`) |
| 61 |
) ENGINE=MyISAM DEFAULT CHARSET=utf8;"; |
| 62 |
|
| 63 |
$sql[] = " |
| 64 |
-- |
| 65 |
-- Table structure for table `".$wpdb->prefix."lz_options` |
| 66 |
-- |
| 67 |
|
| 68 |
CREATE TABLE IF NOT EXISTS `".$wpdb->prefix."lz_options` ( |
| 69 |
`id` int(11) NOT NULL AUTO_INCREMENT, |
| 70 |
`option_name` varchar(255) NOT NULL, |
| 71 |
`option_value` varchar(255) NOT NULL, |
| 72 |
`updated` int(11) NOT NULL, |
| 73 |
PRIMARY KEY (`id`), |
| 74 |
UNIQUE KEY `option_name` (`option_name`) |
| 75 |
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;"; |
| 76 |
|
| 77 |
$sql[] = " |
| 78 |
-- |
| 79 |
-- Table structure for table `".$wpdb->prefix."lz_iprange` |
| 80 |
-- |
| 81 |
|
| 82 |
CREATE TABLE IF NOT EXISTS `".$wpdb->prefix."lz_iprange` ( |
| 83 |
`rid` int(10) NOT NULL AUTO_INCREMENT, |
| 84 |
`start` bigint(20) NOT NULL, |
| 85 |
`end` bigint(20) NOT NULL, |
| 86 |
`blacklist` tinyint(2) NOT NULL DEFAULT '0', |
| 87 |
`whitelist` tinyint(2) NOT NULL DEFAULT '0', |
| 88 |
`date` int(10) NOT NULL, |
| 89 |
PRIMARY KEY (`rid`) |
| 90 |
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;"; |
| 91 |
|
| 92 |
foreach($sql as $sk => $sv){ |
| 93 |
$wpdb->query($sv); |
| 94 |
} |
| 95 |
|
| 96 |
add_option('lz_version', lz_version); |
| 97 |
|
| 98 |
} |
| 99 |
|
| 100 |
add_action( 'plugins_loaded', 'loginizer_load_plugin' ); |
| 101 |
|
| 102 |
function loginizer_update_check(){ |
| 103 |
|
| 104 |
global $wpdb; |
| 105 |
|
| 106 |
$sql = array(); |
| 107 |
$current_version = get_option('lz_version'); |
| 108 |
|
| 109 |
if($current_version < lz_version){ |
| 110 |
foreach($sql as $sk => $sv){ |
| 111 |
$wpdb->query($sv); |
| 112 |
} |
| 113 |
|
| 114 |
update_option('lz_version', lz_version); |
| 115 |
} |
| 116 |
|
| 117 |
} |
| 118 |
|
| 119 |
function loginizer_load_plugin(){ |
| 120 |
|
| 121 |
global $lz_globals; |
| 122 |
|
| 123 |
loginizer_update_check(); |
| 124 |
|
| 125 |
$lz_globals = array(); |
| 126 |
$lz_globals['lz_max_retries'] = lz_get_option('lz_max_retries', 3); |
| 127 |
$lz_globals['lz_lockout_time'] = lz_get_option('lz_lockout_time', 900); // 15 minutes |
| 128 |
$lz_globals['lz_max_lockouts'] = lz_get_option('lz_max_lockouts', 5); |
| 129 |
$lz_globals['lz_lockouts_extend'] = lz_get_option('lz_lockouts_extend', 86400); // 24 hours |
| 130 |
$lz_globals['lz_reset_retries'] = lz_get_option('lz_reset_retries', 86400); // 24 hours |
| 131 |
$lz_globals['lz_last_reset'] = lz_get_option('lz_last_reset', 0); // 24 hours |
| 132 |
$lz_globals['lz_notify_email'] = lz_get_option('lz_notify_email', 0); |
| 133 |
|
| 134 |
// Clear retries |
| 135 |
if((time() - $lz_globals['lz_last_reset']) >= $lz_globals['lz_reset_retries']){ |
| 136 |
lz_reset_retries(); |
| 137 |
} |
| 138 |
|
| 139 |
$lz_globals['current_ip'] = lz_getip(); |
| 140 |
|
| 141 |
/* Filters and actions */ |
| 142 |
add_filter('wp_authenticate_user', 'lz_wp_authenticate_user', 99999, 2);// This is used for additional validation |
| 143 |
add_action('wp_login_failed', 'lz_login_failed');// Update our records login failed |
| 144 |
add_action('wp_authenticate', 'lz_wp_authenticate', 10, 2);// Use this to verify before WP tries to login |
| 145 |
add_action('login_errors', 'lz_update_error_msg');// Update Error message |
| 146 |
|
| 147 |
} |
| 148 |
|
| 149 |
function lz_wp_authenticate_user($user, $username){ |
| 150 |
|
| 151 |
global $lz_error, $lz_cannot_login; |
| 152 |
|
| 153 |
if(is_wp_error($user) || empty($lz_cannot_login)){ |
| 154 |
return $user; |
| 155 |
} |
| 156 |
|
| 157 |
$error = new WP_Error(); |
| 158 |
$error->add('ip_blocked', implode('', $lz_error)); |
| 159 |
return $error; |
| 160 |
} |
| 161 |
|
| 162 |
function lz_wp_authenticate($username, $password){ |
| 163 |
|
| 164 |
global $lz_error, $lz_cannot_login, $lz_user_pass; |
| 165 |
|
| 166 |
if(!empty($username) && !empty($password)){ |
| 167 |
$lz_user_pass = 1; |
| 168 |
} |
| 169 |
|
| 170 |
// Are you whitelisted ? |
| 171 |
if(lz_is_whitelisted()){ |
| 172 |
return $username; |
| 173 |
} |
| 174 |
|
| 175 |
// Are you blacklisted ? |
| 176 |
if(lz_is_blacklisted()){ |
| 177 |
$lz_cannot_login = 1; |
| 178 |
$error = new WP_Error(); |
| 179 |
$error->add('ip_blacklisted', implode('', $lz_error)); |
| 180 |
return $error; |
| 181 |
} |
| 182 |
|
| 183 |
if(lz_can_login()){ |
| 184 |
return $username; |
| 185 |
} |
| 186 |
|
| 187 |
$lz_cannot_login = 1; |
| 188 |
|
| 189 |
$error = new WP_Error(); |
| 190 |
$error->add('ip_blocked', implode('', $lz_error)); |
| 191 |
return $error; |
| 192 |
} |
| 193 |
|
| 194 |
function lz_can_login(){ |
| 195 |
|
| 196 |
global $wpdb, $lz_globals, $lz_error; |
| 197 |
|
| 198 |
// Get the logs |
| 199 |
$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` WHERE `ip` = '".$lz_globals['current_ip']."';"); |
| 200 |
|
| 201 |
if(!empty($result['count']) && $result['count'] >= $lz_globals['lz_max_retries']){ |
| 202 |
|
| 203 |
// Has he reached max lockouts ? |
| 204 |
if($result['lockout'] >= $lz_globals['lz_max_lockouts']){ |
| 205 |
$lz_globals['lz_lockout_time'] = $lz_globals['lz_lockouts_extend']; |
| 206 |
} |
| 207 |
|
| 208 |
// Is he in the lockout time ? |
| 209 |
if($result['time'] >= time() - $lz_globals['lz_lockout_time']){ |
| 210 |
$banlift = ceil((($result['time'] + $lz_globals['lz_lockout_time']) - time()) / 60); |
| 211 |
|
| 212 |
//echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />'; |
| 213 |
//echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />'; |
| 214 |
//echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $lz_globals['lz_lockout_time']).'<br />'; |
| 215 |
|
| 216 |
$_time = $banlift.' minute(s)'; |
| 217 |
|
| 218 |
if($banlift > 60){ |
| 219 |
$banlift = ceil($banlift / 60); |
| 220 |
$_time = $banlift.' hour(s)'; |
| 221 |
} |
| 222 |
|
| 223 |
$lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time; |
| 224 |
|
| 225 |
return false; |
| 226 |
} |
| 227 |
} |
| 228 |
|
| 229 |
if(!empty($result['count']) && $result['count'] < $lz_globals['lz_max_retries']){ |
| 230 |
$lz_globals['lz_retries_left'] = $lz_globals['lz_max_retries'] - $result['count']; |
| 231 |
} |
| 232 |
|
| 233 |
return true; |
| 234 |
} |
| 235 |
|
| 236 |
function lz_is_blacklisted(){ |
| 237 |
|
| 238 |
global $wpdb, $lz_globals, $lz_error; |
| 239 |
|
| 240 |
// Get the logs |
| 241 |
$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE (".ip2long($lz_globals['current_ip'])." BETWEEN `start` AND `end`) AND `blacklist` = '1';"); |
| 242 |
|
| 243 |
// You are blacklisted |
| 244 |
if(!empty($result)){ |
| 245 |
$lz_error['ip_blacklisted'] = 'Your IP has been blacklisted'; |
| 246 |
return true; |
| 247 |
} |
| 248 |
|
| 249 |
return false; |
| 250 |
} |
| 251 |
|
| 252 |
function lz_is_whitelisted(){ |
| 253 |
|
| 254 |
global $wpdb, $lz_globals, $lz_error; |
| 255 |
|
| 256 |
// Get the logs |
| 257 |
$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE (".ip2long($lz_globals['current_ip'])." BETWEEN `start` AND `end`) AND `whitelist` = '1';"); |
| 258 |
|
| 259 |
// You are whitelisted |
| 260 |
if(!empty($result)){ |
| 261 |
return true; |
| 262 |
} |
| 263 |
|
| 264 |
return false; |
| 265 |
} |
| 266 |
|
| 267 |
function lz_login_failed($username){ |
| 268 |
|
| 269 |
global $wpdb, $lz_globals, $lz_cannot_login; |
| 270 |
|
| 271 |
if(empty($lz_cannot_login)){ |
| 272 |
$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` WHERE `ip` = '".$lz_globals['current_ip']."';"); |
| 273 |
|
| 274 |
if(!empty($result)){ |
| 275 |
$lockout = floor(($result['count'] / $lz_globals['lz_max_retries'])); |
| 276 |
$sresult = $wpdb->query("UPDATE `".$wpdb->prefix."lz_failed_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$lz_globals['current_ip']."';"); |
| 277 |
|
| 278 |
// Do we need to email admin ? |
| 279 |
$lz_globals['lz_notify_email'] = 4; |
| 280 |
if(!empty($lz_globals['lz_notify_email']) && $lockout >= $lz_globals['lz_notify_email']){ |
| 281 |
|
| 282 |
$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname'); |
| 283 |
$mail = array(); |
| 284 |
$mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email'); |
| 285 |
$mail['subject'] = 'Failed Login Attempts from IP '.$lz_globals['current_ip'].' ('.$sitename.')'; |
| 286 |
$mail['message'] = 'Hi, |
| 287 |
|
| 288 |
'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$lz_globals['current_ip'].' |
| 289 |
|
| 290 |
Last Login Attempt : '.date('d/m/Y H:i:s', time()).' |
| 291 |
Last User Attempt : '.$username.' |
| 292 |
IP has been blocked until : '.date('m/d/Y H:i:s', time() + $lz_globals['lz_lockout_time']).' |
| 293 |
|
| 294 |
Regards, |
| 295 |
Loginizer'; |
| 296 |
|
| 297 |
@wp_mail($mail['to'], $mail['subject'], $mail['message']); |
| 298 |
} |
| 299 |
}else{ |
| 300 |
$result = $wpdb->query("INSERT INTO `".$wpdb->prefix."lz_failed_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$lz_globals['current_ip']."', `lockout` = '0';"); |
| 301 |
} |
| 302 |
} |
| 303 |
} |
| 304 |
|
| 305 |
function lz_update_error_msg($default_msg){ |
| 306 |
|
| 307 |
global $wpdb, $lz_globals, $lz_user_pass, $lz_cannot_login; |
| 308 |
|
| 309 |
$msg = ''; |
| 310 |
|
| 311 |
if(!empty($lz_user_pass) && empty($lz_cannot_login)){ |
| 312 |
|
| 313 |
$msg = '<b>ERROR:</b> Incorrect Username or Password'; |
| 314 |
|
| 315 |
if(!empty($lz_globals['lz_retries_left'])){ |
| 316 |
$msg .= '<br /><b>'.$lz_globals['lz_retries_left'].'</b> attempt(s) left'; |
| 317 |
} |
| 318 |
} |
| 319 |
|
| 320 |
if(!empty($msg)){ |
| 321 |
return $msg; |
| 322 |
}else{ |
| 323 |
return $default_msg; |
| 324 |
} |
| 325 |
|
| 326 |
} |
| 327 |
|
| 328 |
function lz_reset_retries(){ |
| 329 |
|
| 330 |
global $wpdb, $lz_globals; |
| 331 |
|
| 332 |
$deltime = time() - $lz_globals['lz_reset_retries']; |
| 333 |
$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."lz_failed_logs` WHERE `time` <= '".$deltime."';"); |
| 334 |
|
| 335 |
lz_update_option('lz_last_reset', time()); |
| 336 |
|
| 337 |
} |
| 338 |
|
| 339 |
// Add settings link on plugin page |
| 340 |
function lz_settings_link($links) { |
| 341 |
$settings_link = '<a href="options-general.php?page=loginizer">Settings</a>'; |
| 342 |
array_unshift($links, $settings_link); |
| 343 |
return $links; |
| 344 |
} |
| 345 |
|
| 346 |
$plugin = plugin_basename(__FILE__); |
| 347 |
add_filter("plugin_action_links_$plugin", 'lz_settings_link' ); |
| 348 |
|
| 349 |
add_action('admin_menu', 'loginizer_admin_menu'); |
| 350 |
|
| 351 |
function loginizer_admin_menu() { |
| 352 |
global $wp_version; |
| 353 |
|
| 354 |
// Modern WP? |
| 355 |
if (version_compare($wp_version, '3.0', '>=')) { |
| 356 |
add_options_page('Loginizer', 'Loginizer', 'manage_options', 'loginizer', 'loginizer_option_page'); |
| 357 |
return; |
| 358 |
} |
| 359 |
|
| 360 |
// Older WPMU? |
| 361 |
if (function_exists("get_current_site")) { |
| 362 |
add_submenu_page('wpmu-admin.php', 'Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page'); |
| 363 |
return; |
| 364 |
} |
| 365 |
|
| 366 |
// Older WP |
| 367 |
add_options_page('Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page'); |
| 368 |
} |
| 369 |
|
| 370 |
function loginizer_option_page(){ |
| 371 |
|
| 372 |
global $wpdb, $wp_roles, $lz_globals; |
| 373 |
|
| 374 |
if(!current_user_can('manage_options')){ |
| 375 |
wp_die('Sorry, but you do not have permissions to change settings.'); |
| 376 |
} |
| 377 |
|
| 378 |
/* Make sure post was from this page */ |
| 379 |
if(count($_POST) > 0){ |
| 380 |
check_admin_referer('loginizer-options'); |
| 381 |
} |
| 382 |
|
| 383 |
if(isset($_POST['save_lz'])){ |
| 384 |
|
| 385 |
$lz_max_retries = (int) lz_optpost('lz_max_retries'); |
| 386 |
$lz_lockout_time = (int) lz_optpost('lz_lockout_time'); |
| 387 |
$lz_max_lockouts = (int) lz_optpost('lz_max_lockouts'); |
| 388 |
$lz_lockouts_extend = (int) lz_optpost('lz_lockouts_extend'); |
| 389 |
$lz_reset_retries = (int) lz_optpost('lz_reset_retries'); |
| 390 |
$lz_notify_email = (int) lz_optpost('lz_notify_email'); |
| 391 |
|
| 392 |
$lz_lockout_time = $lz_lockout_time * 60; |
| 393 |
$lz_lockouts_extend = $lz_lockouts_extend * 60 * 60; |
| 394 |
$lz_reset_retries = $lz_reset_retries * 60 * 60; |
| 395 |
|
| 396 |
if(empty($error)){ |
| 397 |
|
| 398 |
lz_update_option('lz_max_retries', $lz_max_retries); |
| 399 |
lz_update_option('lz_lockout_time', $lz_lockout_time); |
| 400 |
lz_update_option('lz_max_lockouts', $lz_max_lockouts); |
| 401 |
lz_update_option('lz_lockouts_extend', $lz_lockouts_extend); |
| 402 |
lz_update_option('lz_reset_retries', $lz_reset_retries); |
| 403 |
lz_update_option('lz_notify_email', $lz_notify_email); |
| 404 |
|
| 405 |
$saved = true; |
| 406 |
|
| 407 |
}else{ |
| 408 |
lz_report_error($error); |
| 409 |
} |
| 410 |
|
| 411 |
if(!empty($notice)){ |
| 412 |
lz_report_notice($notice); |
| 413 |
} |
| 414 |
|
| 415 |
if(!empty($saved)){ |
| 416 |
echo '<div id="message" class="updated fade"><p>' |
| 417 |
. __('The settings were saved successfully', 'loginizer') |
| 418 |
. '</p></div>'; |
| 419 |
} |
| 420 |
|
| 421 |
} |
| 422 |
|
| 423 |
if(isset($_GET['delid'])){ |
| 424 |
|
| 425 |
$delid = (int) lz_optreq('delid'); |
| 426 |
|
| 427 |
$wpdb->query("DELETE FROM ".$wpdb->prefix."lz_iprange WHERE `rid` = '".$delid."'"); |
| 428 |
echo '<div id="message" class="updated fade"><p>' |
| 429 |
. __('IP range has been deleted successfully', 'loginizer') |
| 430 |
. '</p></div>'; |
| 431 |
} |
| 432 |
|
| 433 |
if(isset($_POST['blacklist_iprange'])){ |
| 434 |
|
| 435 |
$start_ip = lz_optpost('start_ip'); |
| 436 |
$end_ip = lz_optpost('end_ip'); |
| 437 |
|
| 438 |
if(empty($start_ip)){ |
| 439 |
$error[] = 'Please enter the Start IP'; |
| 440 |
} |
| 441 |
|
| 442 |
// If no end IP we consider only 1 IP |
| 443 |
if(empty($end_ip)){ |
| 444 |
$end_ip = $start_ip; |
| 445 |
} |
| 446 |
|
| 447 |
if(!lz_valid_ip($start_ip)){ |
| 448 |
$error[] = 'Please provide a valid start IP'; |
| 449 |
} |
| 450 |
|
| 451 |
if(!lz_valid_ip($end_ip)){ |
| 452 |
$error[] = 'Please provide a valid end IP'; |
| 453 |
} |
| 454 |
|
| 455 |
if(ip2long($start_ip) > ip2long($end_ip)){ |
| 456 |
$error[] = 'The End IP cannot be smaller than the Start IP'; |
| 457 |
} |
| 458 |
|
| 459 |
if(empty($error)){ |
| 460 |
|
| 461 |
// This is to check if there is any other range exists with the same Start or End IP |
| 462 |
$ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 463 |
`blacklist` = '1' AND |
| 464 |
(`start` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."' |
| 465 |
OR `end` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."');"; |
| 466 |
|
| 467 |
$ip_exists = $wpdb->get_results($ip_exists_query); |
| 468 |
//print_r($ip_exists); |
| 469 |
|
| 470 |
if(!empty($ip_exists)){ |
| 471 |
$error[] = 'The Start IP or End IP submitted conflicts with an existing IP range!'; |
| 472 |
} |
| 473 |
|
| 474 |
// This is to check if there is any other range exists with the same Start IP |
| 475 |
$start_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 476 |
`blacklist` = '1' AND |
| 477 |
('".ip2long($start_ip)."' BETWEEN `start` AND `end`);"; |
| 478 |
|
| 479 |
$start_ip_exists = $wpdb->get_results($start_ip_exists_query); |
| 480 |
//print_r($start_ip_exists); |
| 481 |
|
| 482 |
if(!empty($start_ip_exists)){ |
| 483 |
$error[] = 'The Start IP is present in an existing range!'; |
| 484 |
} |
| 485 |
|
| 486 |
// This is to check if there is any other range exists with the same End IP |
| 487 |
$end_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 488 |
`blacklist` = '1' AND |
| 489 |
('".ip2long($end_ip)."' BETWEEN `start` AND `end`);"; |
| 490 |
|
| 491 |
$end_ip_exists = $wpdb->get_results($end_ip_exists_query); |
| 492 |
//print_r($end_ip_exists); |
| 493 |
|
| 494 |
if(!empty($end_ip_exists)){ |
| 495 |
$error[] = 'The End IP is present in an existing range!'; |
| 496 |
} |
| 497 |
|
| 498 |
if(empty($error)){ |
| 499 |
|
| 500 |
$options = array(); |
| 501 |
$options['start'] = ip2long($start_ip); |
| 502 |
$options['end'] = ip2long($end_ip); |
| 503 |
$options['blacklist'] = 1; |
| 504 |
$options['whitelist'] = 0; |
| 505 |
$options['date'] = date('Ymd'); |
| 506 |
|
| 507 |
$wpdb->insert($wpdb->prefix.'lz_iprange', $options); |
| 508 |
|
| 509 |
if(!empty($wpdb->insert_id)){ |
| 510 |
echo '<div id="message" class="updated fade"><p>' |
| 511 |
. __('Blacklist IP range added successfully', 'loginizer') |
| 512 |
. '</p></div>'; |
| 513 |
}else{ |
| 514 |
echo '<div id="message" class="updated fade"><p>' |
| 515 |
. __('There were some errors while adding the blacklist IP range', 'loginizer') |
| 516 |
. '</p></div>'; |
| 517 |
} |
| 518 |
|
| 519 |
} |
| 520 |
|
| 521 |
} |
| 522 |
|
| 523 |
if(!empty($error)){ |
| 524 |
lz_report_error($error); |
| 525 |
} |
| 526 |
} |
| 527 |
|
| 528 |
if(isset($_POST['whitelist_iprange'])){ |
| 529 |
|
| 530 |
$start_ip = lz_optpost('start_ip_w'); |
| 531 |
$end_ip = lz_optpost('end_ip_w'); |
| 532 |
|
| 533 |
if(empty($start_ip)){ |
| 534 |
$error[] = 'Please enter the Start IP'; |
| 535 |
} |
| 536 |
|
| 537 |
// If no end IP we consider only 1 IP |
| 538 |
if(empty($end_ip)){ |
| 539 |
$end_ip = $start_ip; |
| 540 |
} |
| 541 |
|
| 542 |
if(!lz_valid_ip($start_ip)){ |
| 543 |
$error[] = 'Please provide a valid start IP'; |
| 544 |
} |
| 545 |
|
| 546 |
if(!lz_valid_ip($end_ip)){ |
| 547 |
$error[] = 'Please provide a valid end IP'; |
| 548 |
} |
| 549 |
|
| 550 |
if(ip2long($start_ip) > ip2long($end_ip)){ |
| 551 |
$error[] = 'The End IP cannot be smaller than the Start IP'; |
| 552 |
} |
| 553 |
|
| 554 |
if(empty($error)){ |
| 555 |
|
| 556 |
// This is to check if there is any other range exists with the same Start or End IP |
| 557 |
$ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 558 |
`whitelist` = '1' AND |
| 559 |
(`start` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."' |
| 560 |
OR `end` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."');"; |
| 561 |
|
| 562 |
$ip_exists = $wpdb->get_results($ip_exists_query); |
| 563 |
//print_r($ip_exists); |
| 564 |
|
| 565 |
if(!empty($ip_exists)){ |
| 566 |
$error[] = 'The Start IP or End IP submitted conflicts with an existing IP range!'; |
| 567 |
} |
| 568 |
|
| 569 |
// This is to check if there is any other range exists with the same Start IP |
| 570 |
$start_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 571 |
`whitelist` = '1' AND |
| 572 |
('".ip2long($start_ip)."' BETWEEN `start` AND `end`);"; |
| 573 |
|
| 574 |
$start_ip_exists = $wpdb->get_results($start_ip_exists_query); |
| 575 |
//print_r($start_ip_exists); |
| 576 |
|
| 577 |
if(!empty($start_ip_exists)){ |
| 578 |
$error[] = 'The Start IP is present in an existing range!'; |
| 579 |
} |
| 580 |
|
| 581 |
// This is to check if there is any other range exists with the same End IP |
| 582 |
$end_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE |
| 583 |
`whitelist` = '1' AND |
| 584 |
('".ip2long($end_ip)."' BETWEEN `start` AND `end`);"; |
| 585 |
|
| 586 |
$end_ip_exists = $wpdb->get_results($end_ip_exists_query); |
| 587 |
//print_r($end_ip_exists); |
| 588 |
|
| 589 |
if(!empty($end_ip_exists)){ |
| 590 |
$error[] = 'The End IP is present in an existing range!'; |
| 591 |
} |
| 592 |
|
| 593 |
if(empty($error)){ |
| 594 |
|
| 595 |
$options = array(); |
| 596 |
$options['start'] = ip2long($start_ip); |
| 597 |
$options['end'] = ip2long($end_ip); |
| 598 |
$options['blacklist'] = 0; |
| 599 |
$options['whitelist'] = 1; |
| 600 |
$options['date'] = date('Ymd'); |
| 601 |
|
| 602 |
$wpdb->insert($wpdb->prefix.'lz_iprange', $options); |
| 603 |
|
| 604 |
if(!empty($wpdb->insert_id)){ |
| 605 |
echo '<div id="message" class="updated fade"><p>' |
| 606 |
. __('Whitelist IP range added successfully', 'loginizer') |
| 607 |
. '</p></div>'; |
| 608 |
}else{ |
| 609 |
echo '<div id="message" class="updated fade"><p>' |
| 610 |
. __('There were some errors while adding the whitelist IP range', 'loginizer') |
| 611 |
. '</p></div>'; |
| 612 |
} |
| 613 |
|
| 614 |
} |
| 615 |
|
| 616 |
} |
| 617 |
|
| 618 |
if(!empty($error)){ |
| 619 |
lz_report_error($error); |
| 620 |
} |
| 621 |
} |
| 622 |
|
| 623 |
// Get the logs |
| 624 |
$result = array(); |
| 625 |
$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` ORDER BY `count` DESC LIMIT 0, 10;", 1); |
| 626 |
//print_r($result); |
| 627 |
|
| 628 |
// Get the Blacklist IP ranges |
| 629 |
$blacklist_ips = array(); |
| 630 |
$blacklist_ips = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE `blacklist` = 1;", 1); |
| 631 |
//print_r($blacklist_ips); |
| 632 |
|
| 633 |
// Get the Whitelist IP ranges |
| 634 |
$whitelist_ips = array(); |
| 635 |
$whitelist_ips = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE `whitelist` = 1;", 1); |
| 636 |
//print_r($whitelist_ips); |
| 637 |
|
| 638 |
?> |
| 639 |
|
| 640 |
<div class="wrap"> |
| 641 |
<!--This is intentional--> |
| 642 |
<h2></h2> |
| 643 |
|
| 644 |
<h1><center><?php echo __('Loginizer','loginizer'); ?></center></h1><hr /><br /> |
| 645 |
|
| 646 |
<script src="http://api.loginizer.com/news.js""></script> |
| 647 |
|
| 648 |
<h2><?php echo __('Failed Login Attempts Logs (Past '.($lz_globals['lz_reset_retries']/60/60).' hours)','loginizer'); ?></h2><hr /><br /> |
| 649 |
|
| 650 |
<table class="wp-list-table widefat fixed users" border="0"> |
| 651 |
<tr> |
| 652 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th> |
| 653 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th> |
| 654 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th> |
| 655 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th> |
| 656 |
</tr> |
| 657 |
<?php |
| 658 |
if(empty($result)){ |
| 659 |
echo ' |
| 660 |
<tr> |
| 661 |
<td colspan="4"> |
| 662 |
No Logs. You will see logs about failed login attempts here. |
| 663 |
</td> |
| 664 |
</tr>'; |
| 665 |
}else{ |
| 666 |
foreach($result as $ik => $iv){ |
| 667 |
$status_button = (!empty($iv['status']) ? 'disable' : 'enable'); |
| 668 |
echo ' |
| 669 |
<tr> |
| 670 |
<td> |
| 671 |
'.$iv['ip'].' |
| 672 |
</td> |
| 673 |
<td> |
| 674 |
'.date('d/m/Y H:i:s', $iv['time']).' |
| 675 |
</td> |
| 676 |
<td> |
| 677 |
'.$iv['count'].' |
| 678 |
</td> |
| 679 |
<td> |
| 680 |
'.$iv['lockout'].' |
| 681 |
</td> |
| 682 |
</tr>'; |
| 683 |
} |
| 684 |
} |
| 685 |
?> |
| 686 |
</table> |
| 687 |
<br /> |
| 688 |
<h2><?php echo __('Loginizer Settings','loginizer'); ?></h2><hr /><br /> |
| 689 |
|
| 690 |
<form action="options-general.php?page=loginizer" method="post" enctype="multipart/form-data"> |
| 691 |
<?php wp_nonce_field('loginizer-options'); ?> |
| 692 |
<table class="form-table"> |
| 693 |
<tr> |
| 694 |
<th scope="row" valign="top"><label for="lz_max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th> |
| 695 |
<td> |
| 696 |
<input type="text" size="3" value="<?php echo lz_optpost('lz_max_retries', $lz_globals['lz_max_retries']); ?>" name="lz_max_retries" id="lz_max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br /> |
| 697 |
</td> |
| 698 |
</tr> |
| 699 |
<tr> |
| 700 |
<th scope="row" valign="top"><label for="lz_lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th> |
| 701 |
<td> |
| 702 |
<input type="text" size="3" value="<?php echo (!empty($lz_lockout_time) ? $lz_lockout_time : $lz_globals['lz_lockout_time']) / 60; ?>" name="lz_lockout_time" id="lz_lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br /> |
| 703 |
</td> |
| 704 |
</tr> |
| 705 |
<tr> |
| 706 |
<th scope="row" valign="top"><label for="lz_max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th> |
| 707 |
<td> |
| 708 |
<input type="text" size="3" value="<?php echo lz_optpost('lz_max_lockouts', $lz_globals['lz_max_lockouts']); ?>" name="lz_max_lockouts" id="lz_max_lockouts" /> <?php echo __('','loginizer'); ?> <br /> |
| 709 |
</td> |
| 710 |
</tr> |
| 711 |
<tr> |
| 712 |
<th scope="row" valign="top"><label for="lz_lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th> |
| 713 |
<td> |
| 714 |
<input type="text" size="3" value="<?php echo (!empty($lz_lockouts_extend) ? $lz_lockouts_extend : $lz_globals['lz_lockouts_extend']) / 60 / 60; ?>" name="lz_lockouts_extend" id="lz_lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br /> |
| 715 |
</td> |
| 716 |
</tr> |
| 717 |
<tr> |
| 718 |
<th scope="row" valign="top"><label for="lz_reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th> |
| 719 |
<td> |
| 720 |
<input type="text" size="3" value="<?php echo (!empty($lz_reset_retries) ? $lz_reset_retries : $lz_globals['lz_reset_retries']) / 60 / 60; ?>" name="lz_reset_retries" id="lz_reset_retries" /> <?php echo __('hours','loginizer'); ?> <br /> |
| 721 |
</td> |
| 722 |
</tr> |
| 723 |
<tr> |
| 724 |
<th scope="row" valign="top"><label for="lz_notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th> |
| 725 |
<td> |
| 726 |
<?php echo __('after ','loginizer'); ?> |
| 727 |
<input type="text" size="3" value="<?php echo (!empty($lz_notify_email) ? $lz_notify_email : $lz_globals['lz_notify_email']); ?>" name="lz_notify_email" id="lz_notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?> |
| 728 |
</td> |
| 729 |
</tr> |
| 730 |
</table><br /> |
| 731 |
<input name="save_lz" class="button action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" /> |
| 732 |
</form> |
| 733 |
|
| 734 |
<br /><br /> |
| 735 |
<hr /> |
| 736 |
<h2><?php echo __('Blacklist IP','loginizer'); ?></h2> |
| 737 |
<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?> |
| 738 |
<form action="options-general.php?page=loginizer" method="post"> |
| 739 |
<?php wp_nonce_field('loginizer-options'); ?> |
| 740 |
<table class="form-table"> |
| 741 |
<tr> |
| 742 |
<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th> |
| 743 |
<td> |
| 744 |
<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br /> |
| 745 |
</td> |
| 746 |
</tr> |
| 747 |
<tr> |
| 748 |
<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th> |
| 749 |
<td> |
| 750 |
<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br /> |
| 751 |
</td> |
| 752 |
</tr> |
| 753 |
</table><br /> |
| 754 |
<input name="blacklist_iprange" class="button action" value="<?php echo __('Blacklist IP range','loginizer'); ?>" type="submit" /> |
| 755 |
</form> |
| 756 |
<br /> |
| 757 |
<table class="wp-list-table widefat fixed users" border="0"> |
| 758 |
<tr> |
| 759 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th> |
| 760 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th> |
| 761 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th> |
| 762 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th> |
| 763 |
</tr> |
| 764 |
<?php |
| 765 |
if(empty($blacklist_ips)){ |
| 766 |
echo ' |
| 767 |
<tr> |
| 768 |
<td colspan="4"> |
| 769 |
No Blacklist IPs. You will see blacklisted IP ranges here. |
| 770 |
</td> |
| 771 |
</tr>'; |
| 772 |
}else{ |
| 773 |
foreach($blacklist_ips as $ik => $iv){ |
| 774 |
echo ' |
| 775 |
<tr> |
| 776 |
<td> |
| 777 |
'.long2ip($iv['start']).' |
| 778 |
</td> |
| 779 |
<td> |
| 780 |
'.long2ip($iv['end']).' |
| 781 |
</td> |
| 782 |
<td> |
| 783 |
'.date('d/m/Y', strtotime($iv['date'])).' |
| 784 |
</td> |
| 785 |
<td> |
| 786 |
<a class="submitdelete" href="options-general.php?page=loginizer&delid='.$iv['rid'].'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a> |
| 787 |
</td> |
| 788 |
</tr>'; |
| 789 |
} |
| 790 |
} |
| 791 |
?> |
| 792 |
</table> |
| 793 |
<br /> |
| 794 |
<hr /> |
| 795 |
<h2><?php echo __('Whitelist IP','loginizer'); ?></h2> |
| 796 |
<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?> |
| 797 |
<form action="options-general.php?page=loginizer" method="post"> |
| 798 |
<?php wp_nonce_field('loginizer-options'); ?> |
| 799 |
<table class="form-table"> |
| 800 |
<tr> |
| 801 |
<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th> |
| 802 |
<td> |
| 803 |
<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br /> |
| 804 |
</td> |
| 805 |
</tr> |
| 806 |
<tr> |
| 807 |
<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th> |
| 808 |
<td> |
| 809 |
<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br /> |
| 810 |
</td> |
| 811 |
</tr> |
| 812 |
</table><br /> |
| 813 |
<input name="whitelist_iprange" class="button action" value="<?php echo __('Whitelist IP range','loginizer'); ?>" type="submit" /> |
| 814 |
</form> |
| 815 |
<br /> |
| 816 |
<table class="wp-list-table widefat fixed users" border="0"> |
| 817 |
<tr> |
| 818 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th> |
| 819 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th> |
| 820 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th> |
| 821 |
<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th> |
| 822 |
</tr> |
| 823 |
<?php |
| 824 |
if(empty($whitelist_ips)){ |
| 825 |
echo ' |
| 826 |
<tr> |
| 827 |
<td colspan="4"> |
| 828 |
No Whitelist IPs. You will see whitelisted IP ranges here. |
| 829 |
</td> |
| 830 |
</tr>'; |
| 831 |
}else{ |
| 832 |
foreach($whitelist_ips as $ik => $iv){ |
| 833 |
echo ' |
| 834 |
<tr> |
| 835 |
<td> |
| 836 |
'.long2ip($iv['start']).' |
| 837 |
</td> |
| 838 |
<td> |
| 839 |
'.long2ip($iv['end']).' |
| 840 |
</td> |
| 841 |
<td> |
| 842 |
'.date('d/m/Y', strtotime($iv['date'])).' |
| 843 |
</td> |
| 844 |
<td> |
| 845 |
<a class="submitdelete" href="options-general.php?page=loginizer&delid='.$iv['rid'].'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a> |
| 846 |
</td> |
| 847 |
</tr>'; |
| 848 |
} |
| 849 |
} |
| 850 |
?> |
| 851 |
</table> |
| 852 |
<br /> |
| 853 |
</div> |
| 854 |
<?php |
| 855 |
|
| 856 |
echo '<br /><br /><hr /> |
| 857 |
<a href="http://www.loginizer.com" target="_blank">Loginizer</a> v'.lz_version.'. <br /> |
| 858 |
You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.'; |
| 859 |
} |
| 860 |
|
| 861 |
// Sorry to see you going |
| 862 |
register_uninstall_hook( __FILE__, 'loginizer_deactivation'); |
| 863 |
|
| 864 |
function loginizer_deactivation(){ |
| 865 |
|
| 866 |
global $wpdb; |
| 867 |
|
| 868 |
$sql = array(); |
| 869 |
$sql[] = "DROP TABLE ".$wpdb->prefix."lz_failed_logs;"; |
| 870 |
$sql[] = "DROP TABLE ".$wpdb->prefix."lz_options;"; |
| 871 |
$sql[] = "DROP TABLE ".$wpdb->prefix."lz_iprange;"; |
| 872 |
|
| 873 |
foreach($sql as $sk => $sv){ |
| 874 |
$wpdb->query($sv); |
| 875 |
} |
| 876 |
|
| 877 |
|
| 878 |
delete_option('lz_version'); |
| 879 |
|
| 880 |
} |
| 881 |
|
| 882 |
?> |
