PluginProbe
Loginizer / 1.3.0
Loginizer v1.3.0
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | init.php +1085 -558 2.0.2 → 1.3.0 View file →
@@ -4,14 +4,12 @@
4 4 echo 'You are not allowed to access this page directly.';
5 5 exit;
6 6 }
7 7
8 -define('LOGINIZER_VERSION', '2.0.2');
9 -define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
8 +define('LOGINIZER_VERSION', '1.3.0');
9 +define('LOGINIZER_DIR', WP_PLUGIN_DIR.'/'.basename(dirname(LOGINIZER_FILE)));
10 10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12 -define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13 -define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14 12
15 13 include_once(LOGINIZER_DIR.'/functions.php');
16 14
17 15 // Ok so we are now ready to go
@@ -24,9 +22,9 @@
24 22
25 23 $sql = array();
26 24
27 25 $sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28 -
26 +
29 27 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30 28 `username` varchar(255) NOT NULL DEFAULT '',
31 29 `time` int(10) NOT NULL DEFAULT '0',
32 30 `count` int(10) NOT NULL DEFAULT '0',
@@ -31,11 +29,10 @@
31 29 `time` int(10) NOT NULL DEFAULT '0',
32 30 `count` int(10) NOT NULL DEFAULT '0',
33 31 `lockout` int(10) NOT NULL DEFAULT '0',
34 32 `ip` varchar(255) NOT NULL DEFAULT '',
35 - `url` varchar(255) NOT NULL DEFAULT '',
36 33 UNIQUE KEY `ip` (`ip`)
37 - ) DEFAULT CHARSET=utf8;";
34 + ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
38 35
39 36 foreach($sql as $sk => $sv){
40 37 $wpdb->query($sv);
41 38 }
@@ -44,24 +41,12 @@
44 41 add_option('loginizer_options', array());
45 42 add_option('loginizer_last_reset', 0);
46 43 add_option('loginizer_whitelist', array());
47 44 add_option('loginizer_blacklist', array());
48 - add_option('loginizer_2fa_whitelist', array());
49 -
50 - // TODO:: REMOVE THIS AFTER MARCH 2025
51 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
52 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
53 - loginizer_check_softaculous();
54 - }
45 +
55 46 }
56 47
57 -/**
58 - * Updates the database structure for Loginizer
59 - *
60 - * If the plugin files are updated but database structure is not updated
61 - * this function will update the database structure as per the plugin version
62 - * NOTE: This does not update plugin files it just updates the database structure
63 - */
48 +// Checks if we are to update ?
64 49 function loginizer_update_check(){
65 50
66 51 global $wpdb;
67 52
@@ -89,9 +74,9 @@
89 74 // Trick the following if conditions to not run
90 75 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
91 76
92 77 }
93 -
78 +
94 79 // Is it less than 1.0.1 ?
95 80 if($version < 101){
96 81
97 82 // TODO : GET the existing settings
@@ -121,17 +106,9 @@
121 106
122 107 // Update the existing failed logs to new table
123 108 if(is_array($lz_failed_logs)){
124 109 foreach($lz_failed_logs as $fk => $fv){
125 - $insert_data = array('username' => $fv['username'],
126 - 'time' => $fv['time'],
127 - 'count' => $fv['count'],
128 - 'lockout' => $fv['lockout'],
129 - 'ip' => $fv['ip']);
130 -
131 - $format = array('%s','%d','%d','%d','%s');
132 -
133 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
110 + $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
134 111 }
135 112 }
136 113
137 114 // Update the existing options to new structure
@@ -180,51 +157,11 @@
180 157 }
181 158
182 159 }
183 160
184 - // Is it less than 1.3.9 ?
185 - if($version < 139){
186 -
187 - $wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188 -
189 - }
190 -
191 - // Setting alignment to left in social login ?
192 - if($version < 201){
193 - $social_settings = get_option('loginizer_social_settings', []);
194 -
195 - if(!empty($social_settings)){
196 - if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
197 - $social_settings['login']['button_alignment'] = 'left';
198 - }
199 -
200 - if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
201 - $social_settings['woocommerce']['button_alignment'] = 'left';
202 - }
203 -
204 - if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
205 - $social_settings['comment']['button_alignment'] = 'left';
206 - }
207 -
208 - update_option('loginizer_social_settings', $social_settings);
209 - }
210 - }
211 -
212 161 // Save the new Version
213 162 update_option('loginizer_version', LOGINIZER_VERSION);
214 163
215 - // TODO:: REMOVE THIS AFTER MARCH 2025
216 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
217 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
218 - loginizer_check_softaculous();
219 - }
220 -
221 - // In Sitepad Math Captcha is enabled by default
222 - if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
223 - $option['captcha_no_google'] = 1;
224 - add_option('loginizer_captcha', $option);
225 - }
226 -
227 164 }
228 165
229 166 // Add the action to load the plugin
230 167 add_action('plugins_loaded', 'loginizer_load_plugin');
@@ -235,27 +172,12 @@
235 172 global $loginizer;
236 173
237 174 // Check if the installed version is outdated
238 175 loginizer_update_check();
239 -
240 - // Set the array
241 - if(empty($loginizer)){
242 - $loginizer = array();
243 - }
244 176
245 - $loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
246 - $loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
247 - $loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
248 - $loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
177 + $options = get_option('loginizer_options');
249 178
250 - // The IP Method to use
251 - $loginizer['ip_method'] = get_option('loginizer_ip_method');
252 - if($loginizer['ip_method'] == 3){
253 - $loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
254 - }
255 -
256 - // Load settings
257 - $options = get_option('loginizer_options');
179 + $loginizer = array();
258 180 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
259 181 $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
260 182 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
261 183 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
@@ -260,43 +182,15 @@
260 182 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
261 183 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
262 184 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
263 185 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
264 - $loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
265 - $loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
266 - $loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
267 - $loginizer['social_settings'] = get_option('loginizer_social_settings', []);
268 -
269 - if(!empty($options['notify_email_address'])){
270 - $loginizer['notify_email_address'] = $options['notify_email_address'];
271 - $loginizer['custom_notify_email'] = 1;
272 - }
273 -
274 - // Login Success Email Notification.
275 - $loginizer['login_mail'] = get_option('loginizer_login_mail', []);
276 - add_action('init', 'loginizer_load_translation_vars', 0);
277 -
278 - $loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
279 - $loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];
280 -
186 +
281 187 // Load the blacklist and whitelist
282 - $loginizer['blacklist'] = get_option('loginizer_blacklist', []);
283 - $loginizer['whitelist'] = get_option('loginizer_whitelist', []);
284 - $loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
188 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
189 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
285 190
286 - // It should not be false
287 - if(empty($loginizer['2fa_whitelist'])){
288 - $loginizer['2fa_whitelist'] = array();
289 - }
290 -
291 191 // When was the database cleared last time
292 192 $loginizer['last_reset'] = get_option('loginizer_last_reset');
293 -
294 - if(!isset($loginizer['ultimate-member-active'])){
295 - $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
296 -
297 - $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
298 - }
299 193
300 194 //print_r($loginizer);
301 195
302 196 // Clear retries
@@ -312,63 +206,34 @@
312 206 $loginizer['ins_time'] = $ins_time;
313 207
314 208 // Set the current IP
315 209 $loginizer['current_ip'] = lz_getip();
210 +
211 + /* Filters and actions */
316 212
317 - // Is Brute Force Disabled ?
318 - $loginizer['disable_brute'] = get_option('loginizer_disable_brute');
319 -
320 - // Filters and actions
321 - if(empty($loginizer['disable_brute'])){
213 + // Use this to verify before WP tries to login
214 + // Is always called and is the first function to be called
215 + //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
216 + add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
322 217
323 - // Use this to verify before WP tries to login
324 - // Is always called and is the first function to be called
325 - //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
326 - add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
218 + // Is called when a login attempt fails
219 + // Hence Update our records that the login failed
220 + add_action('wp_login_failed', 'loginizer_login_failed');
221 +
222 + // Is called before displaying the error message so that we dont show that the username is wrong or the password
223 + // Update Error message
224 + add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
225 +
226 + // Is the premium features there ?
227 + if(file_exists(LOGINIZER_DIR.'/premium.php')){
327 228
328 - // Is called when a login attempt fails
329 - // Hence Update our records that the login failed
330 - add_action('wp_login_failed', 'loginizer_login_failed');
229 + // Include the file
230 + include_once(LOGINIZER_DIR.'/premium.php');
331 231
332 - // Is called before displaying the error message so that we dont show that the username is wrong or the password
333 - // Update Error message
334 - add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335 - add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336 - add_action('wp_login', 'loginizer_login_success', 10, 2);
232 + loginizer_security_init();
337 233
338 - if(!empty($loginizer['ultimate-member-active'])){
339 - add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
340 - }
341 -
342 - if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
343 - add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
344 - }
345 234 }
346 -
347 - // Social Login Form Actions
348 - if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
349 - if(!empty($loginizer['social_settings']['login']['login_form'])){
350 - add_action('login_form', 'loginizer_social_btn_login');
351 - }
352 - }
353 235
354 - if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){
355 - include_once LOGINIZER_DIR . '/main/ajax.php';
356 - }
357 -
358 - if(is_admin()){
359 - include_once LOGINIZER_DIR . '/main/admin.php';
360 - }
361 -
362 - // ----------------
363 - // PRO INIT END
364 - // ----------------
365 -
366 - // Secuity checks for social login.
367 - if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
368 - add_action('init', 'loginizer_social_login_load');
369 - return;
370 - }
371 236 }
372 237
373 238 // Should return NULL if everything is fine
374 239 function loginizer_wp_authenticate($user, $username, $password){
@@ -382,67 +247,24 @@
382 247 // Are you whitelisted ?
383 248 if(loginizer_is_whitelisted()){
384 249 $loginizer['ip_is_whitelisted'] = 1;
385 250 return $user;
386 -
387 - } else if (!empty($loginizer['trusted_ips'])){
388 - $lz_cannot_login = 1;
389 -
390 - // This is used by WP Activity Log
391 - apply_filters( 'wp_login_blocked', $username );
392 -
393 - // Shows a blocked screen
394 - if(!empty($loginizer['blocked_screen'])){
395 - $lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
396 - loginizer_blocked_page($lz_error);
397 - }
398 -
399 - return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
400 251 }
401 252
402 253 // Are you blacklisted ?
403 254 if(loginizer_is_blacklisted()){
404 255 $lz_cannot_login = 1;
405 -
406 - // This is used by WP Activity Log
407 - apply_filters( 'wp_login_blocked', $username );
408 -
409 - // Shows a blocked screen
410 - if(!empty($loginizer['blocked_screen'])){
411 - loginizer_blocked_page($lz_error);
412 - }
413 -
414 256 return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
415 257 }
416 258
417 - // Is the username blacklisted ?
418 - if(function_exists('loginizer_user_blacklisted')){
419 - if(loginizer_user_blacklisted($username)){
420 - $lz_cannot_login = 1;
421 -
422 - // This is used by WP Activity Log
423 - apply_filters( 'wp_login_blocked', $username );
424 -
425 - return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
426 - }
427 - }
428 -
429 259 if(loginizer_can_login()){
430 260 return $user;
431 261 }
432 262
433 263 $lz_cannot_login = 1;
434 -
435 - // This is used by WP Activity Log
436 - apply_filters( 'wp_login_blocked', $username );
437 264
438 - // Shows a blocked screen
439 - if(!empty($loginizer['blocked_screen'])){
440 - loginizer_blocked_page($lz_error);
441 - }
265 + return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
442 266
443 - return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
444 -
445 267 }
446 268
447 269 function loginizer_can_login(){
448 270
@@ -448,13 +270,12 @@
448 270
449 271 global $wpdb, $loginizer, $lz_error;
450 272
451 273 // Get the logs
452 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
453 - $result = lz_selectquery($sel_query);
274 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
454 275
455 276 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
456 -
277 +
457 278 // Has he reached max lockouts ?
458 279 if($result['lockout'] >= $loginizer['max_lockouts']){
459 280 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
460 281 }
@@ -462,24 +283,21 @@
462 283 // Is he in the lockout time ?
463 284 if($result['time'] >= (time() - $loginizer['lockout_time'])){
464 285 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
465 286
466 - //echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
467 - //echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
468 - //echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
287 + //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
288 + //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
289 + //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
469 290
470 - $_time = $banlift.' '.$loginizer['msg']['minutes_err'];
291 + $_time = $banlift.' minute(s)';
471 292
472 293 if($banlift > 60){
473 294 $banlift = ceil($banlift / 60);
474 - $_time = $banlift.' '.$loginizer['msg']['hours_err'];
295 + $_time = $banlift.' hour(s)';
475 296 }
476 297
477 - $lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
298 + $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
478 299
479 - if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
480 - \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
481 - }
482 300 return false;
483 301 }
484 302 }
485 303
@@ -489,31 +307,27 @@
489 307 function loginizer_is_blacklisted(){
490 308
491 309 global $wpdb, $loginizer, $lz_error;
492 310
493 - $blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
494 -
495 - if(empty($blacklist)){
496 - return false;
497 - }
498 -
311 + $blacklist = $loginizer['blacklist'];
312 +
499 313 foreach($blacklist as $k => $v){
500 314
501 315 // Is the IP in the blacklist ?
502 - if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
316 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
503 317 $result = 1;
504 318 break;
505 319 }
506 320
507 321 // Is it in a wider range ?
508 - if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
322 + if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
509 323
510 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
324 + // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
511 325 // if the current IP is <= than the start of the range, it is within the range
512 326 // OR
513 327 // if the current IP is <= than the end of the range, it is within the range
514 - if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
515 - || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
328 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
329 + || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
516 330 $result = 1;
517 331 break;
518 332 }
519 333
@@ -522,9 +336,9 @@
522 336 }
523 337
524 338 // You are blacklisted
525 339 if(!empty($result)){
526 - $lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
340 + $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
527 341 return true;
528 342 }
529 343
530 344 return false;
@@ -536,29 +350,25 @@
536 350 global $wpdb, $loginizer, $lz_error;
537 351
538 352 $whitelist = $loginizer['whitelist'];
539 353
540 - if(empty($whitelist)){
541 - return false;
542 - }
543 -
544 354 foreach($whitelist as $k => $v){
545 355
546 356 // Is the IP in the blacklist ?
547 - if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
357 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
548 358 $result = 1;
549 359 break;
550 360 }
551 361
552 362 // Is it in a wider range ?
553 - if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
363 + if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
554 364
555 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
365 + // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
556 366 // if the current IP is <= than the start of the range, it is within the range
557 367 // OR
558 368 // if the current IP is <= than the end of the range, it is within the range
559 - if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
560 - || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
369 + if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
370 + || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
561 371 $result = 1;
562 372 break;
563 373 }
564 374
@@ -574,78 +384,37 @@
574 384 return false;
575 385
576 386 }
577 387
388 +
578 389 // When the login fails, then this is called
579 390 // We need to update the database
580 -function loginizer_login_failed($username, $is_2fa = ''){
391 +function loginizer_login_failed($username){
581 392
582 393 global $wpdb, $loginizer, $lz_cannot_login;
583 -
584 - // Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
585 - if(empty($username) || is_null($username)){
586 - $username = '';
587 - }
588 -
589 - $fail_type = 'Login';
590 -
591 - if(!empty($is_2fa)){
592 - $fail_type = '2FA';
593 - }
594 394
595 395 if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
596 396
597 - // The params which comes when social login returns an error, have some characters, which WordPress could not save.
598 - $server_uri = $_SERVER['REQUEST_URI'];
599 - if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
600 - $request_uri = explode('=', $_SERVER['REQUEST_URI']);
601 - $server_uri = $request_uri[0];
602 - }
603 -
604 - $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
605 - $url = esc_url($url);
397 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
606 398
607 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
608 - $result = lz_selectquery($sel_query);
609 -
610 399 if(!empty($result)){
611 400 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
401 + $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
612 402
613 - $update_data = array('username' => $username,
614 - 'time' => time(),
615 - 'count' => $result['count']+1,
616 - 'lockout' => $lockout,
617 - 'url' => $url);
618 -
619 - $where_data = array('ip' => $loginizer['current_ip']);
620 -
621 - $format = array('%s','%d','%d','%d','%s');
622 - $where_format = array('%s');
623 -
624 - $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
625 -
626 403 // Do we need to email admin ?
627 404 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
628 405
629 - $lockout_time = $loginizer['lockout_time'];
630 -
631 - if($lockout >= $loginizer['max_lockouts']){
632 - // extended lockout is in hours so we have to convert to minute
633 - $lockout_time = $loginizer['lockouts_extend'];
634 - }
635 -
636 406 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
637 407 $mail = array();
638 - $mail['to'] = $loginizer['notify_email_address'];
639 - $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
408 + $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
409 + $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
640 410 $mail['message'] = 'Hi,
641 411
642 -'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
643 -'.home_url().'
412 +'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
644 413
645 -Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
414 +Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
646 415 Last User Attempt : '.$username.'
647 -IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
416 +IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
648 417
649 418 Regards,
650 419 Loginizer';
651 420
@@ -651,26 +420,13 @@
651 420
652 421 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
653 422 }
654 423 }else{
655 - $result = array();
656 - $result['count'] = 0;
657 -
658 - $insert_data = array('username' => $username,
659 - 'time' => time(),
660 - 'count' => 1,
661 - 'ip' => $loginizer['current_ip'],
662 - 'lockout' => 0,
663 - 'url' => $url);
664 -
665 - $format = array('%s','%d','%d','%s','%d','%s');
666 -
667 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
424 + $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
668 425 }
669 426
670 427 // We need to add one as this is a failed attempt as well
671 428 $result['count'] = $result['count'] + 1;
672 - loginizer_update_attempt_stats(0);
673 429 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
674 430 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
675 431
676 432 }
@@ -675,123 +431,15 @@
675 431
676 432 }
677 433 }
678 434
679 -function loginizer_login_success($user_login, $user) {
680 - global $wp_version, $loginizer;
681 -
682 - loginizer_update_attempt_stats(1);
683 -
684 - if(empty($loginizer['login_mail'])){
685 - return;
686 - }
687 -
688 - if(empty($loginizer['login_mail']['enable'])){
689 - return;
690 - }
691 -
692 - if(!empty($loginizer['login_mail']['disable_whitelist'])){
693 - // Check its whitelist ip
694 - if(loginizer_is_whitelisted()){
695 - return;
696 - }
697 - }
698 -
699 - if(empty($user_login) && empty($user)){
700 - error_log('Loginizer: No user information to send email');
701 - return;
702 - }
703 -
704 - if(empty($user)){
705 - $user = get_user_by('login', $user_login);
706 - }
707 -
708 - if(empty($user)){
709 - error_log('Loginizer: Unable to get the user');
710 - return;
711 - }
712 -
713 - if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
714 - return;
715 - }
716 -
717 - // Check if the user role is enabled for email notification.
718 - if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){
719 - return;
720 - }
721 -
722 - // current_datetime & wp_timezone_string were introduced in WordPress 5.3
723 - if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){
724 - $time_zone = wp_timezone_string();
725 -
726 - if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){
727 - $time_zone = 'UTC'.$time_zone;
728 - }
729 -
730 - // Setting up data variables.
731 - $date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone;
732 - } else {
733 - $date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get();
734 - }
735 -
736 - $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
737 - $email = $user->data->user_email;
738 -
739 - $vars = array(
740 - 'date' => $date,
741 - 'ip' => esc_html($loginizer['current_ip']),
742 - 'sitename' => $sitename,
743 - 'user_login' => $user_login
744 - );
745 -
746 - $message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
747 - $subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
748 -
749 - $headers = [];
750 -
751 - // Do we need to send the email as HTML ?
752 - if(!empty($loginizer['login_mail']['html_mail'])){
753 - $headers[] = 'Content-Type: text/html; charset=UTF-8';
754 -
755 - if(!empty($loginizer['login_mail']['body'])){
756 - $message = html_entity_decode($message);
757 - }else{
758 - $message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message);
759 - $message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message);
760 - }
761 - }
762 -
763 - // Sending notification
764 - if(empty(wp_mail($email, $subject, $message, $headers))){
765 - error_log(__('There was a problem sending your email.', 'loginizer'));
766 - return;
767 - }
768 -}
769 -
770 -function loginizer_update_attempt_stats($type){
771 -
772 - $stats = get_option('loginizer_login_attempt_stats', []);
773 - $time = strtotime(date('Y-m-d H:00:00'));
774 -
775 - if(empty($stats[$time][$type])){
776 - $stats[$time][$type] = 0;
777 - }
778 -
779 - $stats[$time][$type] += 1;
780 -
781 - update_option('loginizer_login_attempt_stats', $stats, false);
782 -}
783 -
784 435 // Handles the error of the password not being there
785 436 function loginizer_error_handler($errors, $redirect_to){
786 437
787 438 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
788 -
439 +
789 440 //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
790 - if(is_null($errors) || empty($errors)){
791 - return true;
792 - }
793 -
441 +
794 442 // Remove the empty password error
795 443 if(is_wp_error($errors)){
796 444
797 445 $codes = $errors->get_error_codes();
@@ -803,197 +451,1091 @@
803 451 }
804 452
805 453 $errors->remove('invalid_username');
806 454 $errors->remove('incorrect_password');
455 +
456 + }
807 457
808 - // Add the error
809 - if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
810 - $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
811 - }
812 -
813 - // Add the number of retires left as well
814 - if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
815 - $errors->add('retries_left', loginizer_retries_left());
816 - }
458 + // Add the error
459 + if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
460 + $errors->add('invalid_userpass', '<b>ERROR:</b> Incorrect Username or Password');
461 + }
462 +
463 + // Add the number of retires left as well
464 + if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
465 + $errors->add('retries_left', loginizer_retries_left());
466 + }
467 +
468 + return $errors;
469 +
470 +}
817 471
472 +// Returns a string with the number of retries left
473 +function loginizer_retries_left(){
474 +
475 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
476 +
477 + // If we are to show the number of retries left
478 + if(isset($loginizer['retries_left'])){
479 + return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
818 480 }
819 481
820 - return $errors;
482 +}
483 +
484 +function loginizer_reset_retries(){
821 485
486 + global $wpdb, $loginizer;
487 +
488 + $deltime = time() - $loginizer['reset_retries'];
489 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
490 +
491 + update_option('loginizer_last_reset', time());
492 +
822 493 }
823 494
824 -// Handles the error of the password not being there
825 -function loginizer_woocommerce_error_handler(){
495 +add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
826 496
827 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
497 +// Add settings link on plugin page
498 +function loginizer_plugin_action_links($links) {
828 499
829 - if(function_exists('wc_add_notice')){
830 - wc_add_notice( loginizer_retries_left(), 'error' );
500 + if(!defined('LOGINIZER_PREMIUM')){
501 + $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
831 502 }
503 +
504 + $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
505 + array_unshift($links, $settings_link);
506 +
507 + return $links;
832 508 }
833 509
834 -function loginizer_ultimatemember_error_handler(){
510 +add_action('admin_menu', 'loginizer_admin_menu');
511 +
512 +// Shows the admin menu of Loginizer
513 +function loginizer_admin_menu() {
835 514
836 - if(class_exists('UM')){
837 - \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
515 + global $wp_version, $loginizer;
516 +
517 + // Add the menu page
518 + add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
519 +
520 + // Dashboard
521 + add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
522 +
523 + // Brute Force
524 + add_submenu_page('loginizer', __('Loginizer Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
525 +
526 + if(defined('LOGINIZER_PREMIUM')){
527 +
528 + // PasswordLess
529 + add_submenu_page('loginizer', __('Loginizer PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
530 +
531 + // Two Factor Auth
532 + add_submenu_page('loginizer', __('Loginizer Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
533 +
534 + // reCaptcha
535 + add_submenu_page('loginizer', __('Loginizer reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
536 +
537 + // Security Settings
538 + add_submenu_page('loginizer', __('Loginizer Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
539 +
540 + // Security Settings
541 + add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
542 +
543 + }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
544 +
545 + // Go Pro link
546 + add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
547 +
838 548 }
549 +
839 550 }
840 551
841 -// Handles social login URL
842 -function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
843 - global $loginizer;
552 +// The Loginizer Admin Options Page
553 +function loginizer_page_header($title = 'Loginizer'){
554 + /*wp_enqueue_script('common');
555 + wp_enqueue_script('wp-lists');
556 + wp_enqueue_script('postbox');
557 + wp_nonce_field('closedpostboxes', 'closedpostboxesnonce', false);
558 +
559 + echo '
560 +<script>
561 +jQuery(document).ready( function() {
562 + //add_postbox_toggles("loginizer");
563 +});
564 +</script>';*/
844 565
845 - loginizer_get_social_error();
566 +?>
567 +<style>
568 +.lz-right-ul{
569 + padding-left: 10px !important;
570 +}
846 571
847 - if(empty($loginizer['social_errors'])){
848 - return $errors;
572 +.lz-right-ul li{
573 + list-style: circle !important;
574 +}
575 +</style>
576 +<?php
577 +
578 + echo '<div style="margin: 10px 20px 0 2px;">
579 +<div class="metabox-holder columns-2">
580 +<div class="postbox-container">
581 +<div id="top-sortables" class="meta-box-sortables ui-sortable">
582 +
583 + <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
584 + <tr>
585 + <td valign="top"><h3>'.$title.'</h3></td>
586 + <td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
587 + </tr>
588 + </table>
589 + <hr />
590 +
591 + <!--Main Table-->
592 + <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
593 + <tr>
594 + <td valign="top">';
595 +
596 +}
597 +
598 +// The Loginizer Theme footer
599 +function loginizer_page_footer(){
600 +
601 + echo '</td>
602 + <td width="200" valign="top" id="loginizer-right-bar">';
603 +
604 + if(!defined('LOGINIZER_PREMIUM')){
605 +
606 + echo '
607 + <div class="postbox" style="min-width:0px !important;">
608 + <h2 class="hndle ui-sortable-handle">
609 + <span>Premium Version</span>
610 + </h2>
611 + <div class="inside">
612 + <i>Upgrade to the premium version and get the following features </i>:<br>
613 + <ul class="lz-right-ul">
614 + <li>PasswordLess Login</li>
615 + <li>Two Factor Auth - Email</li>
616 + <li>Two Factor Auth - App</li>
617 + <li>Login Challenge Question</li>
618 + <li>reCAPTCHA</li>
619 + <li>Rename Login Page</li>
620 + <li>Disable XML-RPC</li>
621 + <li>And many more ...</li>
622 + </ul>
623 + <center><a class="button button-primary" href="https://loginizer.com/members/cart.php">Upgrade</a></center>
624 + </div>
625 + </div>';
626 +
627 + }else{
628 +
629 + echo '
630 + <div class="postbox" style="min-width:0px !important;">
631 + <h2 class="hndle ui-sortable-handle">
632 + <span>Recommedations</span>
633 + </h2>
634 + <div class="inside">
635 + <i>We recommed that you enable atleast one of the following security features</i>:<br>
636 + <ul class="lz-right-ul">
637 + <li>Rename Login Page</li>
638 + <li>Login Challenge Question</li>
639 + <li>reCAPTCHA</li>
640 + <li>Two Factor Auth - Email</li>
641 + <li>Two Factor Auth - App</li>
642 + </ul>
643 + </div>
644 + </div>';
849 645 }
850 -
851 - if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
852 - $errors = new WP_Error();
646 +
647 + echo '</td>
648 + </tr>
649 + </table>
650 + <br />
651 + <div style="width:45%;background:#FFF;padding:15px; margin:auto">
652 + <b>Let your friends know that you have secured your website :</b>
653 + <form method="get" action="http://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
654 + <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
655 + &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
656 + </form>
657 +
658 + </div>
659 + <br />
660 +
661 + <script>
662 + function dotweet(ele){
663 + window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
664 + return false;
853 665 }
666 + </script>
667 +
668 + <hr />
669 + <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.
854 670
855 - foreach($loginizer['social_errors'] as $key => $text){
856 - $errors->add($key, $text);
857 - }
671 +</div>
672 +</div>
673 +</div>
674 +</div>';
858 675
859 - return $errors;
860 676 }
861 677
862 -// Returns a string with the number of retries left
863 -function loginizer_retries_left(){
678 +// The Loginizer Admin Options Page
679 +function loginizer_page_dashboard(){
864 680
865 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
681 + global $loginizer, $lz_error, $lz_env;
866 682
867 - // If we are to show the number of retries left
868 - if(isset($loginizer['retries_left'])){
869 - $retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
683 + // Is there a license key ?
684 + if(isset($_POST['save_lz'])){
685 +
686 + $license = lz_optpost('lz_license');
870 687
871 - return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
688 + // Check if its a valid license
689 + if(empty($license)){
690 + $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
691 + return loginizer_page_dashboard_T();
692 + }
693 +
694 + $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license);
695 +
696 + if(is_array($resp)){
697 + $json = json_decode($resp['body'], true);
698 + //print_r($json);
699 + }
700 +
701 + // Save the License
702 + if(empty($json)){
703 +
704 + $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
705 + return loginizer_page_dashboard_T();
706 +
707 + }else{
708 +
709 + update_option('loginizer_license', $json);
710 +
711 + // Mark as saved
712 + $GLOBALS['lz_saved'] = true;
713 + }
714 +
872 715 }
873 716
717 + loginizer_page_dashboard_T();
718 +
874 719 }
875 720
876 -function loginizer_reset_retries(){
721 +// The Loginizer Admin Options Page - THEME
722 +function loginizer_page_dashboard_T(){
723 +
724 + global $loginizer, $lz_error, $lz_env;
877 725
878 - global $wpdb, $loginizer;
726 + loginizer_page_header('Loginizer Dashboard');
727 +?>
728 +<style>
729 +.welcome-panel{
730 + margin: 0px;
731 + padding: 10px;
732 +}
879 733
880 - $deltime = time() - $loginizer['reset_retries'];
734 +input[type="text"], textarea, select {
735 + width: 70%;
736 +}
881 737
882 - $del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
883 - $result = $wpdb->query($del_query);
738 +.form-table label{
739 + font-weight:bold;
740 +}
884 741
885 - update_option('loginizer_last_reset', time());
886 -
742 +.exp{
743 + font-size:12px;
887 744 }
888 -
889 -function loginizer_load_translation_vars(){
890 - global $loginizer;
745 +</style>
891 746
892 - $loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
893 - $loginizer['login_mail_default_msg'] = __('Hello $user_login,
747 + <?php
748 + echo '<script src="http://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
894 749
895 -Your account was recently logged in from the IP : $ip
896 -Time : $date
897 -If it was not you who logged in then please report this to us immediately.
898 -
899 -Regards,
900 -$sitename','loginizer');
901 -
902 - if(empty($loginizer['login_mail_subject'])){
903 - $loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
750 + // Saved ?
751 + if(!empty($GLOBALS['lz_saved'])){
752 + echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
904 753 }
905 754
906 - if(empty($loginizer['login_mail_body'])){
907 - $loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
755 + // Any errors ?
756 + if(!empty($lz_error)){
757 + lz_report_error($lz_error);echo '<br />';
908 758 }
909 759
910 - // Default messages
911 - $loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
912 - $loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
913 - $loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
914 - $loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
915 - $loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
916 - $loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
760 + ?>
917 761
918 - // Message Strings
919 - $loginizer['msg'] = get_option('loginizer_msg', []);
762 + <div class="postbox">
920 763
921 - foreach($loginizer['d_msg'] as $lk => $lv){
922 - if(empty($loginizer['msg'][$lk])){
923 - $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
924 - }
925 - }
764 + <button class="handlediv button-link" aria-expanded="true" type="button">
765 + <span class="screen-reader-text">Toggle panel: Getting Started</span>
766 + <span class="toggle-indicator" aria-hidden="true"></span>
767 + </button>
768 +
769 + <h2 class="hndle ui-sortable-handle">
770 + <span><?php echo __('Getting Started', 'loginizer'); ?></span>
771 + </h2>
772 +
773 + <div class="inside">
774 +
775 + <form action="" method="post" enctype="multipart/form-data">
776 + <?php wp_nonce_field('loginizer-options'); ?>
777 + <table class="form-table">
778 + <tr>
779 + <td scope="row" valign="top" colspan="2" style="line-height:150%">
780 + <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
781 + <?php
782 + if(defined('LOGINIZER_PREMIUM')){
783 + echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
784 + }
785 + ?>
786 + </td>
787 + </tr>
788 + </table>
789 + </form>
790 +
791 + </div>
792 + </div>
926 793
927 - $loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
928 - $loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
929 - $loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
930 - $loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
931 - $loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
794 + <div class="postbox">
932 795
933 - // Message Strings
934 - $loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
796 + <button class="handlediv button-link" aria-expanded="true" type="button">
797 + <span class="screen-reader-text">Toggle panel: System Information</span>
798 + <span class="toggle-indicator" aria-hidden="true"></span>
799 + </button>
800 +
801 + <h2 class="hndle ui-sortable-handle">
802 + <span><?php echo __('System Information', 'loginizer'); ?></span>
803 + </h2>
804 +
805 + <div class="inside">
806 +
807 + <form action="" method="post" enctype="multipart/form-data">
808 + <?php wp_nonce_field('loginizer-options'); ?>
809 + <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
810 + <?php
811 + echo '
812 + <tr>
813 + <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
814 + <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
815 + </tr>';
816 +
817 + if(defined('LOGINIZER_PREMIUM')){
818 + echo '
819 + <tr>
820 + <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
821 + <td align="left">
822 + '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
823 + <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
824 + <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
825 +
826 + if(!empty($loginizer['license'])){
827 +
828 + $expires = $loginizer['license']['expires'];
829 + $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
830 +
831 + echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
832 + License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
833 + </div>';
834 + }
835 +
836 +
837 + echo
838 + '</td>
839 + </tr>';
840 + }
841 +
842 + echo '<tr>
843 + <th align="left">'.__('URL', 'loginizer').'</th>
844 + <td>'.get_site_url().'</td>
845 + </tr>
846 + <tr>
847 + <th align="left">'.__('Path', 'loginizer').'</th>
848 + <td>'.ABSPATH.'</td>
849 + </tr>
850 + <tr>
851 + <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
852 + <td>'.$_SERVER['SERVER_ADDR'].'</td>
853 + </tr>
854 + <tr>
855 + <th align="left">'.__('Your IP Address', 'loginizer').'</th>
856 + <td>'.$_SERVER['REMOTE_ADDR'].'</td>
857 + </tr>
858 + <tr>
859 + <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
860 + <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
861 + </tr>';
862 +
863 + if(file_exists(ABSPATH.'/.htaccess')){
864 + echo '
865 + <tr>
866 + <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
867 + <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
868 + </tr>';
869 +
870 + }
871 +
872 + ?>
873 + </table>
874 + </form>
875 +
876 + </div>
877 + </div>
935 878
936 - foreach($loginizer['2fa_d_msg'] as $lk => $lv){
937 - if(empty($loginizer['2fa_msg'][$lk])){
938 - $loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
939 - }
940 - }
879 + <div id="" class="postbox">
941 880
942 -}
881 + <button class="handlediv button-link" aria-expanded="true" type="button">
882 + <span class="screen-reader-text">Toggle panel: File Permissions</span>
883 + <span class="toggle-indicator" aria-hidden="true"></span>
884 + </button>
885 +
886 + <h2 class="hndle ui-sortable-handle">
887 + <span><?php echo __('File Permissions', 'loginizer'); ?></span>
888 + </h2>
889 +
890 + <div class="inside">
891 +
892 + <form action="" method="post" enctype="multipart/form-data">
893 + <?php wp_nonce_field('loginizer-options'); ?>
894 + <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
895 + <?php
896 +
897 + echo '
898 + <tr>
899 + <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
900 + <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
901 + <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
902 + </tr>';
903 +
904 + $wp_content = basename(dirname(dirname(dirname(__FILE__))));
905 +
906 + $files_to_check = array('/' => '0755',
907 + '/wp-admin' => '0755',
908 + '/wp-includes' => '0755',
909 + '/wp-config.php' => '0444',
910 + '/'.$wp_content => '0755',
911 + '/'.$wp_content.'/themes' => '0755',
912 + '/'.$wp_content.'/plugins' => '0755',
913 + '.htaccess' => '0444');
914 +
915 + $root = ABSPATH;
916 +
917 + foreach($files_to_check as $k => $v){
918 +
919 + $path = $root.'/'.$k;
920 + $stat = @stat($path);
921 + $suggested = $v;
922 + $actual = substr(sprintf('%o', $stat['mode']), -4);
923 +
924 + echo '
925 + <tr>
926 + <td>'.$k.'</td>
927 + <td>'.$suggested.'</td>
928 + <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
929 + </tr>';
930 +
931 + }
932 +
933 + ?>
934 + </table>
935 + </form>
936 +
937 + </div>
938 + </div>
943 939
944 -function loginizer_social_login_load(){
945 - include_once LOGINIZER_DIR . '/main/social-login.php';
940 +<?php
941 +
942 + loginizer_page_footer();
943 +
946 944 }
947 945
948 -// Checks if softaculous is installed on the server.
949 -function loginizer_check_softaculous(){
946 +// The Loginizer Admin Options Page
947 +function loginizer_page_brute_force(){
950 948
951 - // Checking if we have Softaculous installed?
952 - if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
953 - return false;
949 + global $wpdb, $wp_roles, $loginizer;
950 +
951 + if(!current_user_can('manage_options')){
952 + wp_die('Sorry, but you do not have permissions to change settings.');
954 953 }
955 954
956 - if(empty($matches) || empty($matches[0])){
957 - return false;
955 + /* Make sure post was from this page */
956 + if(count($_POST) > 0){
957 + check_admin_referer('loginizer-options');
958 958 }
959 -
960 - $softaculous_path = $matches[0] . '.softaculous/installations.php';
961 - if(!file_exists($softaculous_path)){
962 - return false;
959 +
960 + // BEGIN THEME
961 + loginizer_page_header('Loginizer - Brute Force Settings');
962 +
963 + // Load the blacklist and whitelist
964 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
965 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
966 +
967 + if(isset($_POST['save_lz'])){
968 +
969 + $max_retries = (int) lz_optpost('max_retries');
970 + $lockout_time = (int) lz_optpost('lockout_time');
971 + $max_lockouts = (int) lz_optpost('max_lockouts');
972 + $lockouts_extend = (int) lz_optpost('lockouts_extend');
973 + $reset_retries = (int) lz_optpost('reset_retries');
974 + $notify_email = (int) lz_optpost('notify_email');
975 +
976 + $lockout_time = $lockout_time * 60;
977 + $lockouts_extend = $lockouts_extend * 60 * 60;
978 + $reset_retries = $reset_retries * 60 * 60;
979 +
980 + if(empty($error)){
981 +
982 + $option['max_retries'] = $max_retries;
983 + $option['lockout_time'] = $lockout_time;
984 + $option['max_lockouts'] = $max_lockouts;
985 + $option['lockouts_extend'] = $lockouts_extend;
986 + $option['reset_retries'] = $reset_retries;
987 + $option['notify_email'] = $notify_email;
988 +
989 + // Save the options
990 + update_option('loginizer_options', $option);
991 +
992 + $saved = true;
993 +
994 + }else{
995 + lz_report_error($error);
996 + }
997 +
998 + if(!empty($notice)){
999 + lz_report_notice($notice);
1000 + }
1001 +
1002 + if(!empty($saved)){
1003 + echo '<div id="message" class="updated"><p>'
1004 + . __('The settings were saved successfully', 'loginizer')
1005 + . '</p></div><br />';
1006 + }
1007 +
963 1008 }
964 1009
965 - // Checking if users has changed the branding of Softaculous.
966 - $universal_file = '';
967 - // Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
968 - if(file_exists('/usr/local/softaculous/enduser/universal.php')){
969 - $universal_file = '/usr/local/softaculous/enduser/universal.php';
970 - }else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
971 - $universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
972 - }else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
973 - $universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
974 - }else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
975 - $universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
1010 + // Delete a Blackist IP range
1011 + if(isset($_GET['bdelid'])){
1012 +
1013 + $delid = (int) lz_optreq('bdelid');
1014 +
1015 + // Unset and save
1016 + $blacklist = $loginizer['blacklist'];
1017 + unset($blacklist[$delid]);
1018 + update_option('loginizer_blacklist', $blacklist);
1019 +
1020 + echo '<div id="message" class="updated fade"><p>'
1021 + . __('The Blacklist IP range has been deleted successfully', 'loginizer')
1022 + . '</p></div><br />';
1023 +
976 1024 }
1025 +
1026 + // Delete a Whitelist IP range
1027 + if(isset($_GET['delid'])){
1028 +
1029 + $delid = (int) lz_optreq('delid');
1030 +
1031 + // Unset and save
1032 + $whitelist = $loginizer['whitelist'];
1033 + unset($whitelist[$delid]);
1034 + update_option('loginizer_whitelist', $whitelist);
1035 +
1036 + echo '<div id="message" class="updated fade"><p>'
1037 + . __('The Whitelist IP range has been deleted successfully', 'loginizer')
1038 + . '</p></div><br />';
1039 +
1040 + }
1041 +
1042 + if(isset($_POST['blacklist_iprange'])){
977 1043
978 - if(empty($universal_file)){
979 - return false;
1044 + $start_ip = lz_optpost('start_ip');
1045 + $end_ip = lz_optpost('end_ip');
1046 +
1047 + if(empty($start_ip)){
1048 + $error[] = 'Please enter the Start IP';
1049 + }
1050 +
1051 + // If no end IP we consider only 1 IP
1052 + if(empty($end_ip)){
1053 + $end_ip = $start_ip;
1054 + }
1055 +
1056 + if(!lz_valid_ip($start_ip)){
1057 + $error[] = 'Please provide a valid start IP';
1058 + }
1059 +
1060 + if(!lz_valid_ip($end_ip)){
1061 + $error[] = 'Please provide a valid end IP';
1062 + }
1063 +
1064 + // Regular ranges will work
1065 + if(ip2long($start_ip) > ip2long($end_ip)){
1066 +
1067 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1068 + if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1069 + // This is right
1070 + }else{
1071 + $error[] = 'The End IP cannot be smaller than the Start IP';
1072 + }
1073 +
1074 + }
1075 +
1076 + if(empty($error)){
1077 +
1078 + $blacklist = $loginizer['blacklist'];
1079 +
1080 + foreach($blacklist as $k => $v){
1081 +
1082 + // This is to check if there is any other range exists with the same Start or End IP
1083 + if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1084 + || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1085 + ){
1086 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1087 + break;
1088 + }
1089 +
1090 + // This is to check if there is any other range exists with the same Start IP
1091 + if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1092 + $error[] = 'The Start IP is present in an existing range !';
1093 + break;
1094 + }
1095 +
1096 + // This is to check if there is any other range exists with the same End IP
1097 + if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1098 + $error[] = 'The End IP is present in an existing range!';
1099 + break;
1100 + }
1101 +
1102 + }
1103 +
1104 + $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1105 +
1106 + if(empty($error)){
1107 +
1108 + $blacklist[$newid] = array();
1109 + $blacklist[$newid]['start'] = $start_ip;
1110 + $blacklist[$newid]['end'] = $end_ip;
1111 + $blacklist[$newid]['time'] = time();
1112 +
1113 + update_option('loginizer_blacklist', $blacklist);
1114 +
1115 + echo '<div id="message" class="updated fade"><p>'
1116 + . __('Blacklist IP range added successfully', 'loginizer')
1117 + . '</p></div><br />';
1118 +
1119 + }
1120 +
1121 + }
1122 +
1123 + if(!empty($error)){
1124 + lz_report_error($error);echo '<br />';
1125 + }
1126 +
980 1127 }
1128 +
1129 + if(isset($_POST['whitelist_iprange'])){
981 1130
982 - $universal = file_get_contents($universal_file);
1131 + $start_ip = lz_optpost('start_ip_w');
1132 + $end_ip = lz_optpost('end_ip_w');
1133 +
1134 + if(empty($start_ip)){
1135 + $error[] = 'Please enter the Start IP';
1136 + }
1137 +
1138 + // If no end IP we consider only 1 IP
1139 + if(empty($end_ip)){
1140 + $end_ip = $start_ip;
1141 + }
1142 +
1143 + if(!lz_valid_ip($start_ip)){
1144 + $error[] = 'Please provide a valid start IP';
1145 + }
1146 +
1147 + if(!lz_valid_ip($end_ip)){
1148 + $error[] = 'Please provide a valid end IP';
1149 + }
1150 +
1151 + if(ip2long($start_ip) > ip2long($end_ip)){
1152 +
1153 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1154 + if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1155 + // This is right
1156 + }else{
1157 + $error[] = 'The End IP cannot be smaller than the Start IP';
1158 + }
1159 +
1160 + }
1161 +
1162 + if(empty($error)){
1163 +
1164 + $whitelist = $loginizer['whitelist'];
1165 +
1166 + foreach($whitelist as $k => $v){
1167 +
1168 + // This is to check if there is any other range exists with the same Start or End IP
1169 + if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1170 + || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1171 + ){
1172 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1173 + break;
1174 + }
1175 +
1176 + // This is to check if there is any other range exists with the same Start IP
1177 + if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1178 + $error[] = 'The Start IP is present in an existing range !';
1179 + break;
1180 + }
1181 +
1182 + // This is to check if there is any other range exists with the same End IP
1183 + if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1184 + $error[] = 'The End IP is present in an existing range!';
1185 + break;
1186 + }
1187 +
1188 + }
1189 +
1190 + $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1191 +
1192 + if(empty($error)){
1193 +
1194 + $whitelist[$newid] = array();
1195 + $whitelist[$newid]['start'] = $start_ip;
1196 + $whitelist[$newid]['end'] = $end_ip;
1197 + $whitelist[$newid]['time'] = time();
1198 +
1199 + update_option('loginizer_whitelist', $whitelist);
1200 +
1201 + echo '<div id="message" class="updated fade"><p>'
1202 + . __('Whitelist IP range added successfully', 'loginizer')
1203 + . '</p></div><br />';
1204 +
1205 + }
1206 +
1207 + }
1208 +
1209 + if(!empty($error)){
1210 + lz_report_error($error);echo '<br />';
1211 + }
1212 + }
1213 +
1214 + // Count the Results
1215 + $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1216 + //print_r($tmp);
1217 +
1218 + // Which Page is it
1219 + $lz_env['res_len'] = 10;
1220 + $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1221 + $lz_env['num_res'] = $tmp['num'];
1222 + $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1223 +
1224 + // Get the logs
1225 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1226 + ORDER BY `time` DESC
1227 + LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1228 + //print_r($result);
1229 +
1230 + $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1231 + $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1232 + $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1233 + $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1234 +
1235 + // Reload the settings
1236 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
1237 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
1238 +
1239 + ?>
983 1240
984 - if(empty($universal)){
985 - return false;
986 - }
1241 + <div id="" class="postbox">
1242 +
1243 + <button class="handlediv button-link" aria-expanded="true" type="button">
1244 + <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
1245 + <span class="toggle-indicator" aria-hidden="true"></span>
1246 + </button>
1247 +
1248 + <h2 class="hndle ui-sortable-handle">
1249 + <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1250 + </h2>
1251 +
1252 + <script>
1253 + function yesdsd(){
1254 + window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1255 + return false;
1256 + }
1257 + </script>
1258 +
1259 + <form method="get" onsubmit="return yesdsd();">
1260 + <div class="tablenav">
1261 + <p class="tablenav-pages" style="margin: 5px 10px" align="right">
1262 + <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1263 + <span class="pagination-links">
1264 + <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1265 + <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1266 + <span class="paging-input">
1267 + <label for="current-page-selector" class="screen-reader-text">Current Page</label>
1268 + <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1269 + </span>
1270 + <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1271 + <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1272 + </span>
1273 + </p>
1274 + </div>
1275 + </form>
1276 +
1277 + <div class="inside">
1278 + <table class="wp-list-table widefat fixed users" border="0">
1279 + <tr>
1280 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1281 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1282 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1283 + <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('Lockouts Count','loginizer'); ?></th>
1284 + </tr>
1285 + <?php
1286 + if(empty($result)){
1287 + echo '
1288 + <tr>
1289 + <td colspan="4">
1290 + No Logs. You will see logs about failed login attempts here.
1291 + </td>
1292 + </tr>';
1293 + }else{
1294 + foreach($result as $ik => $iv){
1295 + $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1296 + echo '
1297 + <tr>
1298 + <td>
1299 + '.$iv['ip'].'
1300 + </td>
1301 + <td>
1302 + '.date('d/m/Y H:i:s', $iv['time']).'
1303 + </td>
1304 + <td>
1305 + '.$iv['count'].'
1306 + </td>
1307 + <td>
1308 + '.$iv['lockout'].'
1309 + </td>
1310 + </tr>';
1311 + }
1312 + }
1313 + ?>
1314 + </table>
1315 + </div>
1316 + </div>
1317 + <br />
1318 +
1319 + <div id="" class="postbox">
1320 +
1321 + <button class="handlediv button-link" aria-expanded="true" type="button">
1322 + <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
1323 + <span class="toggle-indicator" aria-hidden="true"></span>
1324 + </button>
1325 +
1326 + <h2 class="hndle ui-sortable-handle">
1327 + <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1328 + </h2>
1329 +
1330 + <div class="inside">
1331 +
1332 + <form action="" method="post" enctype="multipart/form-data">
1333 + <?php wp_nonce_field('loginizer-options'); ?>
1334 + <table class="form-table">
1335 + <tr>
1336 + <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1337 + <td>
1338 + <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1339 + </td>
1340 + </tr>
1341 + <tr>
1342 + <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1343 + <td>
1344 + <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1345 + </td>
1346 + </tr>
1347 + <tr>
1348 + <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1349 + <td>
1350 + <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1351 + </td>
1352 + </tr>
1353 + <tr>
1354 + <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
1355 + <td>
1356 + <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
1357 + </td>
1358 + </tr>
1359 + <tr>
1360 + <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
1361 + <td>
1362 + <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
1363 + </td>
1364 + </tr>
1365 + <tr>
1366 + <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
1367 + <td>
1368 + <?php echo __('after ','loginizer'); ?>
1369 + <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
1370 + </td>
1371 + </tr>
1372 + </table><br />
1373 + <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1374 + </form>
1375 +
1376 + </div>
1377 + </div>
1378 + <br />
1379 +
1380 + <div id="" class="postbox">
1381 +
1382 + <button class="handlediv button-link" aria-expanded="true" type="button">
1383 + <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
1384 + <span class="toggle-indicator" aria-hidden="true"></span>
1385 + </button>
1386 +
1387 + <h2 class="hndle ui-sortable-handle">
1388 + <span><?php echo __('Blacklist IP','loginizer'); ?></span>
1389 + </h2>
1390 +
1391 + <div class="inside">
1392 +
1393 + <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
1394 +
1395 + <form action="" method="post">
1396 + <?php wp_nonce_field('loginizer-options'); ?>
1397 + <table class="form-table">
1398 + <tr>
1399 + <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
1400 + <td>
1401 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1402 + </td>
1403 + </tr>
1404 + <tr>
1405 + <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1406 + <td>
1407 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1408 + </td>
1409 + </tr>
1410 + </table><br />
1411 + <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1412 + </form>
1413 + </div>
1414 +
1415 + <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1416 + <tr>
1417 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1418 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1419 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1420 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1421 + </tr>
1422 + <?php
1423 + if(empty($loginizer['blacklist'])){
1424 + echo '
1425 + <tr>
1426 + <td colspan="4">
1427 + No Blacklist IPs. You will see blacklisted IP ranges here.
1428 + </td>
1429 + </tr>';
1430 + }else{
1431 + foreach($loginizer['blacklist'] as $ik => $iv){
1432 + echo '
1433 + <tr>
1434 + <td>
1435 + '.$iv['start'].'
1436 + </td>
1437 + <td>
1438 + '.$iv['end'].'
1439 + </td>
1440 + <td>
1441 + '.date('d/m/Y', $iv['time']).'
1442 + </td>
1443 + <td>
1444 + <a class="submitdelete" href="admin.php?page=loginizer_brute_force&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1445 + </td>
1446 + </tr>';
1447 + }
1448 + }
1449 + ?>
1450 + </table>
1451 + <br />
1452 +
1453 + </div>
1454 +
1455 + <br />
1456 +
1457 + <div id="" class="postbox">
1458 +
1459 + <button class="handlediv button-link" aria-expanded="true" type="button">
1460 + <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
1461 + <span class="toggle-indicator" aria-hidden="true"></span>
1462 + </button>
1463 +
1464 + <h2 class="hndle ui-sortable-handle">
1465 + <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
1466 + </h2>
1467 +
1468 + <div class="inside">
1469 +
1470 + <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
1471 + <form action="" method="post">
1472 + <?php wp_nonce_field('loginizer-options'); ?>
1473 + <table class="form-table">
1474 + <tr>
1475 + <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
1476 + <td>
1477 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1478 + </td>
1479 + </tr>
1480 + <tr>
1481 + <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1482 + <td>
1483 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
1484 + </td>
1485 + </tr>
1486 + </table><br />
1487 + <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1488 + </form>
1489 + </div>
1490 +
1491 + <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1492 + <tr>
1493 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1494 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1495 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1496 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1497 + </tr>
1498 + <?php
1499 + if(empty($loginizer['whitelist'])){
1500 + echo '
1501 + <tr>
1502 + <td colspan="4">
1503 + No Whitelist IPs. You will see whitelisted IP ranges here.
1504 + </td>
1505 + </tr>';
1506 + }else{
1507 + foreach($loginizer['whitelist'] as $ik => $iv){
1508 + echo '
1509 + <tr>
1510 + <td>
1511 + '.$iv['start'].'
1512 + </td>
1513 + <td>
1514 + '.$iv['end'].'
1515 + </td>
1516 + <td>
1517 + '.date('d/m/Y', $iv['time']).'
1518 + </td>
1519 + <td>
1520 + <a class="submitdelete" href="admin.php?page=loginizer_brute_force&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1521 + </td>
1522 + </tr>';
1523 + }
1524 + }
1525 + ?>
1526 + </table>
1527 + <br />
1528 +
1529 + </div>
1530 +
1531 +<?php
987 1532
988 - // Checking if Softaculous is being whitelabeled
989 - if(preg_match('/\$globals\[["\']sn["\']\]\s.?=\s.?["\']Softaculous["\']/', $universal)){
990 - update_option('loginizer_softwp_upgrade', time());
991 - }
1533 +loginizer_page_footer();
992 1534
993 - return false;
994 1535 }
995 1536
1537 +
996 1538 // Sorry to see you going
997 1539 register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
998 1540
999 1541 function loginizer_deactivation(){
@@ -1011,22 +1553,7 @@
1011 1553 delete_option('loginizer_options');
1012 1554 delete_option('loginizer_last_reset');
1013 1555 delete_option('loginizer_whitelist');
1014 1556 delete_option('loginizer_blacklist');
1015 - delete_option('loginizer_msg');
1016 - delete_option('loginizer_2fa_msg');
1017 - delete_option('loginizer_2fa_email_template');
1018 - delete_option('loginizer_security');
1019 - delete_option('loginizer_wp_admin');
1020 - delete_option('loginizer_csrf_promo_time');
1021 - delete_option('loginizer_backuply_promo_time');
1022 - delete_option('loginizer_promo_time');
1023 - delete_option('loginizer_ins_time');
1024 - delete_option('loginizer_2fa_whitelist');
1025 - delete_option('loginizer_checksums_last_run');
1026 - delete_option('loginizer_checksums_diff');
1027 - delete_option('loginizer_ip_method');
1028 - delete_option('loginizer_2fa_custom_redirect');
1029 - delete_option('external_updates-loginizer-security');
1030 - delete_option('loginizer_login_attempt_stats');
1031 1557
1032 -}
1558 +}
1559 +