PluginProbe
Loginizer / 1.3.1
Loginizer v1.3.1
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
loginizer / init.php

init.php in Loginizer 1.3.1, at init.php

1,769 lines 53.8 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2
3 if(!function_exists('add_action')){
4 echo 'You are not allowed to access this page directly.';
5 exit;
6 }
7
8 define('LOGINIZER_VERSION', '1.3.1');
9 define('LOGINIZER_DIR', WP_PLUGIN_DIR.'/'.basename(dirname(LOGINIZER_FILE)));
10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12
13 include_once(LOGINIZER_DIR.'/functions.php');
14
15 // Ok so we are now ready to go
16 register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
17
18 // Is called when the ADMIN enables the plugin
19 function loginizer_activation(){
20
21 global $wpdb;
22
23 $sql = array();
24
25 $sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
26
27 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
28 `username` varchar(255) NOT NULL DEFAULT '',
29 `time` int(10) NOT NULL DEFAULT '0',
30 `count` int(10) NOT NULL DEFAULT '0',
31 `lockout` int(10) NOT NULL DEFAULT '0',
32 `ip` varchar(255) NOT NULL DEFAULT '',
33 UNIQUE KEY `ip` (`ip`)
34 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
35
36 foreach($sql as $sk => $sv){
37 $wpdb->query($sv);
38 }
39
40 add_option('loginizer_version', LOGINIZER_VERSION);
41 add_option('loginizer_options', array());
42 add_option('loginizer_last_reset', 0);
43 add_option('loginizer_whitelist', array());
44 add_option('loginizer_blacklist', array());
45
46 }
47
48 // Checks if we are to update ?
49 function loginizer_update_check(){
50
51 global $wpdb;
52
53 $sql = array();
54 $current_version = get_option('loginizer_version');
55
56 // It must be the 1.0 pre stuff
57 if(empty($current_version)){
58 $current_version = get_option('lz_version');
59 }
60
61 $version = (int) str_replace('.', '', $current_version);
62
63 // No update required
64 if($current_version == LOGINIZER_VERSION){
65 return true;
66 }
67
68 // Is it first run ?
69 if(empty($current_version)){
70
71 // Reinstall
72 loginizer_activation();
73
74 // Trick the following if conditions to not run
75 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
76
77 }
78
79 // Is it less than 1.0.1 ?
80 if($version < 101){
81
82 // TODO : GET the existing settings
83
84 // Get the existing settings
85 $lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
86 $lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
87 $lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
88
89 // Delete the three tables
90 $sql = array();
91 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
92 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
93 $sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
94
95 foreach($sql as $sk => $sv){
96 $wpdb->query($sv);
97 }
98
99 // Delete option
100 delete_option('lz_version');
101
102 // Reinstall
103 loginizer_activation();
104
105 // TODO : Save the existing settings
106
107 // Update the existing failed logs to new table
108 if(is_array($lz_failed_logs)){
109 foreach($lz_failed_logs as $fk => $fv){
110 $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
111 }
112 }
113
114 // Update the existing options to new structure
115 if(is_array($lz_options)){
116 foreach($lz_options as $ok => $ov){
117
118 if($ov['option_name'] == 'lz_last_reset'){
119 update_option('loginizer_last_reset', $ov['option_value']);
120 continue;
121 }
122
123 $old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
124 }
125 // Save the options
126 update_option('loginizer_options', $old_option);
127 }
128
129 // Update the existing iprange to new structure
130 if(is_array($lz_iprange)){
131
132 $old_blacklist = array();
133 $old_whitelist = array();
134 $bid = 1;
135 $wid = 1;
136 foreach($lz_iprange as $ik => $iv){
137
138 if(!empty($iv['blacklist'])){
139 $old_blacklist[$bid] = array();
140 $old_blacklist[$bid]['start'] = long2ip($iv['start']);
141 $old_blacklist[$bid]['end'] = long2ip($iv['end']);
142 $old_blacklist[$bid]['time'] = strtotime($iv['date']);
143 $bid = $bid + 1;
144 }
145
146 if(!empty($iv['whitelist'])){
147 $old_whitelist[$wid] = array();
148 $old_whitelist[$wid]['start'] = long2ip($iv['start']);
149 $old_whitelist[$wid]['end'] = long2ip($iv['end']);
150 $old_whitelist[$wid]['time'] = strtotime($iv['date']);
151 $wid = $wid + 1;
152 }
153 }
154
155 if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
156 if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
157 }
158
159 }
160
161 // Save the new Version
162 update_option('loginizer_version', LOGINIZER_VERSION);
163
164 }
165
166 // Add the action to load the plugin
167 add_action('plugins_loaded', 'loginizer_load_plugin');
168
169 // The function that will be called when the plugin is loaded
170 function loginizer_load_plugin(){
171
172 global $loginizer;
173
174 // Check if the installed version is outdated
175 loginizer_update_check();
176
177 $options = get_option('loginizer_options');
178
179 $loginizer = array();
180 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
181 $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
182 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
183 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
184 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
185 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
186
187 // Load the blacklist and whitelist
188 $loginizer['blacklist'] = get_option('loginizer_blacklist');
189 $loginizer['whitelist'] = get_option('loginizer_whitelist');
190
191 // When was the database cleared last time
192 $loginizer['last_reset'] = get_option('loginizer_last_reset');
193
194 //print_r($loginizer);
195
196 // Clear retries
197 if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
198 loginizer_reset_retries();
199 }
200
201 $ins_time = get_option('loginizer_ins_time');
202 if(empty($ins_time)){
203 $ins_time = time();
204 update_option('loginizer_ins_time', $ins_time);
205 }
206 $loginizer['ins_time'] = $ins_time;
207
208 // Set the current IP
209 $loginizer['current_ip'] = lz_getip();
210
211 /* Filters and actions */
212
213 // Use this to verify before WP tries to login
214 // Is always called and is the first function to be called
215 //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
216 add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
217
218 // Is called when a login attempt fails
219 // Hence Update our records that the login failed
220 add_action('wp_login_failed', 'loginizer_login_failed');
221
222 // Is called before displaying the error message so that we dont show that the username is wrong or the password
223 // Update Error message
224 add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
225
226 // Is the premium features there ?
227 if(file_exists(LOGINIZER_DIR.'/premium.php')){
228
229 // Include the file
230 include_once(LOGINIZER_DIR.'/premium.php');
231
232 loginizer_security_init();
233
234 // Its the free version
235 }else{
236
237 // The promo time
238 $loginizer['promo_time'] = get_option('loginizer_promo_time');
239 if(empty($loginizer['promo_time'])){
240 $loginizer['promo_time'] = time();
241 update_option('loginizer_promo_time', $loginizer['promo_time']);
242 }
243
244 // Are we to show the loginizer promo
245 if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
246
247 add_action('admin_notices', 'loginizer_promo');
248
249 }
250
251 // Are we to disable the promo
252 if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
253 update_option('loginizer_promo_time', (0 - time()) );
254 die('DONE');
255 }
256
257 }
258
259 }
260
261 // Show the promo
262 function loginizer_promo(){
263
264 echo '
265 <style>
266 .lz_button {
267 background-color: #4CAF50; /* Green */
268 border: none;
269 color: white;
270 padding: 8px 16px;
271 text-align: center;
272 text-decoration: none;
273 display: inline-block;
274 font-size: 16px;
275 margin: 4px 2px;
276 -webkit-transition-duration: 0.4s; /* Safari */
277 transition-duration: 0.4s;
278 cursor: pointer;
279 }
280
281 .lz_button:focus{
282 border: none;
283 color: white;
284 }
285
286 .lz_button1 {
287 color: white;
288 background-color: #4CAF50;
289 border:3px solid #4CAF50;
290 }
291
292 .lz_button1:hover {
293 box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
294 color: white;
295 border:3px solid #4CAF50;
296 }
297
298 .lz_button2 {
299 color: white;
300 background-color: #0085ba;
301 }
302
303 .lz_button2:hover {
304 box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
305 color: white;
306 }
307
308 .lz_button3 {
309 color: white;
310 background-color: #365899;
311 }
312
313 .lz_button3:hover {
314 box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
315 color: white;
316 }
317
318 .lz_button4 {
319 color: white;
320 background-color: rgb(66, 184, 221);
321 }
322
323 .lz_button4:hover {
324 box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
325 color: white;
326 }
327
328 .loginizer_promo-close{
329 float:right;
330 text-decoration:none;
331 margin: 5px 10px 0px 0px;
332 }
333
334 .loginizer_promo-close:hover{
335 color: red;
336 }
337 </style>
338
339 <script>
340 jQuery(document).ready( function() {
341 (function($) {
342 $("#loginizer_promo .loginizer_promo-close").click(function(){
343 var data;
344
345 // Hide it
346 $("#loginizer_promo").hide();
347
348 // Save this preference
349 $.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
350 //alert(response);
351 });
352 });
353 })(jQuery);
354 });
355 </script>
356
357 <div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
358 <a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
359 <span class="dashicons dashicons-dismiss"></span> Dismiss
360 </a>
361 <img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
362 <p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
363 <p>
364 <a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
365 <a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
366 \'s</a>
367 <a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
368 <a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
369 </p>
370 </div>';
371
372 }
373
374 // Should return NULL if everything is fine
375 function loginizer_wp_authenticate($user, $username, $password){
376
377 global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
378
379 if(!empty($username) && !empty($password)){
380 $lz_user_pass = 1;
381 }
382
383 // Are you whitelisted ?
384 if(loginizer_is_whitelisted()){
385 $loginizer['ip_is_whitelisted'] = 1;
386 return $user;
387 }
388
389 // Are you blacklisted ?
390 if(loginizer_is_blacklisted()){
391 $lz_cannot_login = 1;
392 return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
393 }
394
395 // Is the username blacklisted ?
396 if(function_exists('loginizer_user_blacklisted')){
397 if(loginizer_user_blacklisted($username)){
398 $lz_cannot_login = 1;
399 return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
400 }
401 }
402
403 if(loginizer_can_login()){
404 return $user;
405 }
406
407 $lz_cannot_login = 1;
408
409 return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
410
411 }
412
413 function loginizer_can_login(){
414
415 global $wpdb, $loginizer, $lz_error;
416
417 // Get the logs
418 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
419
420 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
421
422 // Has he reached max lockouts ?
423 if($result['lockout'] >= $loginizer['max_lockouts']){
424 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
425 }
426
427 // Is he in the lockout time ?
428 if($result['time'] >= (time() - $loginizer['lockout_time'])){
429 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
430
431 //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
432 //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
433 //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
434
435 $_time = $banlift.' minute(s)';
436
437 if($banlift > 60){
438 $banlift = ceil($banlift / 60);
439 $_time = $banlift.' hour(s)';
440 }
441
442 $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
443
444 return false;
445 }
446 }
447
448 return true;
449 }
450
451 function loginizer_is_blacklisted(){
452
453 global $wpdb, $loginizer, $lz_error;
454
455 $blacklist = $loginizer['blacklist'];
456
457 foreach($blacklist as $k => $v){
458
459 // Is the IP in the blacklist ?
460 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
461 $result = 1;
462 break;
463 }
464
465 // Is it in a wider range ?
466 if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
467
468 // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
469 // if the current IP is <= than the start of the range, it is within the range
470 // OR
471 // if the current IP is <= than the end of the range, it is within the range
472 if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
473 || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
474 $result = 1;
475 break;
476 }
477
478 }
479
480 }
481
482 // You are blacklisted
483 if(!empty($result)){
484 $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
485 return true;
486 }
487
488 return false;
489
490 }
491
492 function loginizer_is_whitelisted(){
493
494 global $wpdb, $loginizer, $lz_error;
495
496 $whitelist = $loginizer['whitelist'];
497
498 foreach($whitelist as $k => $v){
499
500 // Is the IP in the blacklist ?
501 if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
502 $result = 1;
503 break;
504 }
505
506 // Is it in a wider range ?
507 if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
508
509 // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
510 // if the current IP is <= than the start of the range, it is within the range
511 // OR
512 // if the current IP is <= than the end of the range, it is within the range
513 if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
514 || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
515 $result = 1;
516 break;
517 }
518
519 }
520
521 }
522
523 // You are whitelisted
524 if(!empty($result)){
525 return true;
526 }
527
528 return false;
529
530 }
531
532
533 // When the login fails, then this is called
534 // We need to update the database
535 function loginizer_login_failed($username){
536
537 global $wpdb, $loginizer, $lz_cannot_login;
538
539 if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
540
541 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
542
543 if(!empty($result)){
544 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
545 $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
546
547 // Do we need to email admin ?
548 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
549
550 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
551 $mail = array();
552 $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
553 $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
554 $mail['message'] = 'Hi,
555
556 '.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
557
558 Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
559 Last User Attempt : '.$username.'
560 IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
561
562 Regards,
563 Loginizer';
564
565 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
566 }
567 }else{
568 $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
569 }
570
571 // We need to add one as this is a failed attempt as well
572 $result['count'] = $result['count'] + 1;
573 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
574 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
575
576 }
577 }
578
579 // Handles the error of the password not being there
580 function loginizer_error_handler($errors, $redirect_to){
581
582 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
583
584 //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
585
586 // Remove the empty password error
587 if(is_wp_error($errors)){
588
589 $codes = $errors->get_error_codes();
590
591 foreach($codes as $k => $v){
592 if($v == 'invalid_username' || $v == 'incorrect_password'){
593 $show_error = 1;
594 }
595 }
596
597 $errors->remove('invalid_username');
598 $errors->remove('incorrect_password');
599
600 }
601
602 // Add the error
603 if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
604 $errors->add('invalid_userpass', '<b>ERROR:</b> Incorrect Username or Password');
605 }
606
607 // Add the number of retires left as well
608 if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
609 $errors->add('retries_left', loginizer_retries_left());
610 }
611
612 return $errors;
613
614 }
615
616 // Returns a string with the number of retries left
617 function loginizer_retries_left(){
618
619 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
620
621 // If we are to show the number of retries left
622 if(isset($loginizer['retries_left'])){
623 return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
624 }
625
626 }
627
628 function loginizer_reset_retries(){
629
630 global $wpdb, $loginizer;
631
632 $deltime = time() - $loginizer['reset_retries'];
633 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
634
635 update_option('loginizer_last_reset', time());
636
637 }
638
639 add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
640
641 // Add settings link on plugin page
642 function loginizer_plugin_action_links($links) {
643
644 if(!defined('LOGINIZER_PREMIUM')){
645 $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
646 }
647
648 $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
649 array_unshift($links, $settings_link);
650
651 return $links;
652 }
653
654 add_action('admin_menu', 'loginizer_admin_menu');
655
656 // Shows the admin menu of Loginizer
657 function loginizer_admin_menu() {
658
659 global $wp_version, $loginizer;
660
661 // Add the menu page
662 add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
663
664 // Dashboard
665 add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
666
667 // Brute Force
668 add_submenu_page('loginizer', __('Loginizer Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
669
670 if(defined('LOGINIZER_PREMIUM')){
671
672 // PasswordLess
673 add_submenu_page('loginizer', __('Loginizer PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
674
675 // Two Factor Auth
676 add_submenu_page('loginizer', __('Loginizer Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
677
678 // reCaptcha
679 add_submenu_page('loginizer', __('Loginizer reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
680
681 // Security Settings
682 add_submenu_page('loginizer', __('Loginizer Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
683
684 // Security Settings
685 add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
686
687 }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
688
689 // Go Pro link
690 add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
691
692 }
693
694 }
695
696 // The Loginizer Admin Options Page
697 function loginizer_page_header($title = 'Loginizer'){
698 /*wp_enqueue_script('common');
699 wp_enqueue_script('wp-lists');
700 wp_enqueue_script('postbox');
701 wp_nonce_field('closedpostboxes', 'closedpostboxesnonce', false);
702
703 echo '
704 <script>
705 jQuery(document).ready( function() {
706 //add_postbox_toggles("loginizer");
707 });
708 </script>';*/
709
710 ?>
711 <style>
712 .lz-right-ul{
713 padding-left: 10px !important;
714 }
715
716 .lz-right-ul li{
717 list-style: circle !important;
718 }
719 </style>
720 <?php
721
722 echo '<div style="margin: 10px 20px 0 2px;">
723 <div class="metabox-holder columns-2">
724 <div class="postbox-container">
725 <div id="top-sortables" class="meta-box-sortables ui-sortable">
726
727 <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
728 <tr>
729 <td valign="top"><h3>'.$title.'</h3></td>
730 <td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
731 <td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
732 <td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>
733 </tr>
734 </table>
735 <hr />
736
737 <!--Main Table-->
738 <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
739 <tr>
740 <td valign="top">';
741
742 }
743
744 // The Loginizer Theme footer
745 function loginizer_page_footer(){
746
747 echo '</td>
748 <td width="200" valign="top" id="loginizer-right-bar">';
749
750 if(!defined('LOGINIZER_PREMIUM')){
751
752 echo '
753 <div class="postbox" style="min-width:0px !important;">
754 <h2 class="hndle ui-sortable-handle">
755 <span>Premium Version</span>
756 </h2>
757 <div class="inside">
758 <i>Upgrade to the premium version and get the following features </i>:<br>
759 <ul class="lz-right-ul">
760 <li>PasswordLess Login</li>
761 <li>Two Factor Auth - Email</li>
762 <li>Two Factor Auth - App</li>
763 <li>Login Challenge Question</li>
764 <li>reCAPTCHA</li>
765 <li>Rename Login Page</li>
766 <li>Disable XML-RPC</li>
767 <li>And many more ...</li>
768 </ul>
769 <center><a class="button button-primary" href="https://loginizer.com/members/cart.php">Upgrade</a></center>
770 </div>
771 </div>';
772
773 }else{
774
775 echo '
776 <div class="postbox" style="min-width:0px !important;">
777 <h2 class="hndle ui-sortable-handle">
778 <span>Recommendations</span>
779 </h2>
780 <div class="inside">
781 <i>We recommed that you enable atleast one of the following security features</i>:<br>
782 <ul class="lz-right-ul">
783 <li>Rename Login Page</li>
784 <li>Login Challenge Question</li>
785 <li>reCAPTCHA</li>
786 <li>Two Factor Auth - Email</li>
787 <li>Two Factor Auth - App</li>
788 <li>Change \'admin\' Username</li>
789 </ul>
790 </div>
791 </div>';
792 }
793
794 echo '</td>
795 </tr>
796 </table>
797 <br />
798 <div style="width:45%;background:#FFF;padding:15px; margin:auto">
799 <b>Let your friends know that you have secured your website :</b>
800 <form method="get" action="http://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
801 <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
802 &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
803 </form>
804
805 </div>
806 <br />
807
808 <script>
809 function dotweet(ele){
810 window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
811 return false;
812 }
813 </script>
814
815 <hr />
816 <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.
817
818 </div>
819 </div>
820 </div>
821 </div>';
822
823 }
824
825 // The Loginizer Admin Options Page
826 function loginizer_page_dashboard(){
827
828 global $loginizer, $lz_error, $lz_env;
829
830 // Is there a license key ?
831 if(isset($_POST['save_lz'])){
832
833 $license = lz_optpost('lz_license');
834
835 // Check if its a valid license
836 if(empty($license)){
837 $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
838 return loginizer_page_dashboard_T();
839 }
840
841 $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license);
842
843 if(is_array($resp)){
844 $json = json_decode($resp['body'], true);
845 //print_r($json);
846 }
847
848 // Save the License
849 if(empty($json)){
850
851 $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
852 return loginizer_page_dashboard_T();
853
854 }else{
855
856 update_option('loginizer_license', $json);
857
858 // Mark as saved
859 $GLOBALS['lz_saved'] = true;
860 }
861
862 }
863
864 loginizer_page_dashboard_T();
865
866 }
867
868 // The Loginizer Admin Options Page - THEME
869 function loginizer_page_dashboard_T(){
870
871 global $loginizer, $lz_error, $lz_env;
872
873 loginizer_page_header('Loginizer Dashboard');
874 ?>
875 <style>
876 .welcome-panel{
877 margin: 0px;
878 padding: 10px;
879 }
880
881 input[type="text"], textarea, select {
882 width: 70%;
883 }
884
885 .form-table label{
886 font-weight:bold;
887 }
888
889 .exp{
890 font-size:12px;
891 }
892 </style>
893
894 <?php
895 echo '<script src="http://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
896
897 // Saved ?
898 if(!empty($GLOBALS['lz_saved'])){
899 echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
900 }
901
902 // Any errors ?
903 if(!empty($lz_error)){
904 lz_report_error($lz_error);echo '<br />';
905 }
906
907 ?>
908
909 <div class="postbox">
910
911 <button class="handlediv button-link" aria-expanded="true" type="button">
912 <span class="screen-reader-text">Toggle panel: Getting Started</span>
913 <span class="toggle-indicator" aria-hidden="true"></span>
914 </button>
915
916 <h2 class="hndle ui-sortable-handle">
917 <span><?php echo __('Getting Started', 'loginizer'); ?></span>
918 </h2>
919
920 <div class="inside">
921
922 <form action="" method="post" enctype="multipart/form-data">
923 <?php wp_nonce_field('loginizer-options'); ?>
924 <table class="form-table">
925 <tr>
926 <td scope="row" valign="top" colspan="2" style="line-height:150%">
927 <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
928 <?php
929 if(defined('LOGINIZER_PREMIUM')){
930 echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
931 }
932 ?>
933 </td>
934 </tr>
935 </table>
936 </form>
937
938 </div>
939 </div>
940
941 <div class="postbox">
942
943 <button class="handlediv button-link" aria-expanded="true" type="button">
944 <span class="screen-reader-text">Toggle panel: System Information</span>
945 <span class="toggle-indicator" aria-hidden="true"></span>
946 </button>
947
948 <h2 class="hndle ui-sortable-handle">
949 <span><?php echo __('System Information', 'loginizer'); ?></span>
950 </h2>
951
952 <div class="inside">
953
954 <form action="" method="post" enctype="multipart/form-data">
955 <?php wp_nonce_field('loginizer-options'); ?>
956 <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
957 <?php
958 echo '
959 <tr>
960 <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
961 <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
962 </tr>';
963
964 if(defined('LOGINIZER_PREMIUM')){
965 echo '
966 <tr>
967 <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
968 <td align="left">
969 '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
970 <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
971 <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
972
973 if(!empty($loginizer['license'])){
974
975 $expires = $loginizer['license']['expires'];
976 $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
977
978 echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
979 License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
980 </div>';
981 }
982
983
984 echo
985 '</td>
986 </tr>';
987 }
988
989 echo '<tr>
990 <th align="left">'.__('URL', 'loginizer').'</th>
991 <td>'.get_site_url().'</td>
992 </tr>
993 <tr>
994 <th align="left">'.__('Path', 'loginizer').'</th>
995 <td>'.ABSPATH.'</td>
996 </tr>
997 <tr>
998 <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
999 <td>'.$_SERVER['SERVER_ADDR'].'</td>
1000 </tr>
1001 <tr>
1002 <th align="left">'.__('Your IP Address', 'loginizer').'</th>
1003 <td>'.$_SERVER['REMOTE_ADDR'].'</td>
1004 </tr>
1005 <tr>
1006 <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1007 <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1008 </tr>';
1009
1010 if(file_exists(ABSPATH.'/.htaccess')){
1011 echo '
1012 <tr>
1013 <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1014 <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1015 </tr>';
1016
1017 }
1018
1019 ?>
1020 </table>
1021 </form>
1022
1023 </div>
1024 </div>
1025
1026 <div id="" class="postbox">
1027
1028 <button class="handlediv button-link" aria-expanded="true" type="button">
1029 <span class="screen-reader-text">Toggle panel: File Permissions</span>
1030 <span class="toggle-indicator" aria-hidden="true"></span>
1031 </button>
1032
1033 <h2 class="hndle ui-sortable-handle">
1034 <span><?php echo __('File Permissions', 'loginizer'); ?></span>
1035 </h2>
1036
1037 <div class="inside">
1038
1039 <form action="" method="post" enctype="multipart/form-data">
1040 <?php wp_nonce_field('loginizer-options'); ?>
1041 <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1042 <?php
1043
1044 echo '
1045 <tr>
1046 <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1047 <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1048 <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1049 </tr>';
1050
1051 $wp_content = basename(dirname(dirname(dirname(__FILE__))));
1052
1053 $files_to_check = array('/' => '0755',
1054 '/wp-admin' => '0755',
1055 '/wp-includes' => '0755',
1056 '/wp-config.php' => '0444',
1057 '/'.$wp_content => '0755',
1058 '/'.$wp_content.'/themes' => '0755',
1059 '/'.$wp_content.'/plugins' => '0755',
1060 '.htaccess' => '0444');
1061
1062 $root = ABSPATH;
1063
1064 foreach($files_to_check as $k => $v){
1065
1066 $path = $root.'/'.$k;
1067 $stat = @stat($path);
1068 $suggested = $v;
1069 $actual = substr(sprintf('%o', $stat['mode']), -4);
1070
1071 echo '
1072 <tr>
1073 <td>'.$k.'</td>
1074 <td>'.$suggested.'</td>
1075 <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1076 </tr>';
1077
1078 }
1079
1080 ?>
1081 </table>
1082 </form>
1083
1084 </div>
1085 </div>
1086
1087 <?php
1088
1089 loginizer_page_footer();
1090
1091 }
1092
1093 // The Loginizer Admin Options Page
1094 function loginizer_page_brute_force(){
1095
1096 global $wpdb, $wp_roles, $loginizer;
1097
1098 if(!current_user_can('manage_options')){
1099 wp_die('Sorry, but you do not have permissions to change settings.');
1100 }
1101
1102 /* Make sure post was from this page */
1103 if(count($_POST) > 0){
1104 check_admin_referer('loginizer-options');
1105 }
1106
1107 // BEGIN THEME
1108 loginizer_page_header('Loginizer - Brute Force Settings');
1109
1110 // Load the blacklist and whitelist
1111 $loginizer['blacklist'] = get_option('loginizer_blacklist');
1112 $loginizer['whitelist'] = get_option('loginizer_whitelist');
1113
1114 if(isset($_POST['save_lz'])){
1115
1116 $max_retries = (int) lz_optpost('max_retries');
1117 $lockout_time = (int) lz_optpost('lockout_time');
1118 $max_lockouts = (int) lz_optpost('max_lockouts');
1119 $lockouts_extend = (int) lz_optpost('lockouts_extend');
1120 $reset_retries = (int) lz_optpost('reset_retries');
1121 $notify_email = (int) lz_optpost('notify_email');
1122
1123 $lockout_time = $lockout_time * 60;
1124 $lockouts_extend = $lockouts_extend * 60 * 60;
1125 $reset_retries = $reset_retries * 60 * 60;
1126
1127 if(empty($error)){
1128
1129 $option['max_retries'] = $max_retries;
1130 $option['lockout_time'] = $lockout_time;
1131 $option['max_lockouts'] = $max_lockouts;
1132 $option['lockouts_extend'] = $lockouts_extend;
1133 $option['reset_retries'] = $reset_retries;
1134 $option['notify_email'] = $notify_email;
1135
1136 // Save the options
1137 update_option('loginizer_options', $option);
1138
1139 $saved = true;
1140
1141 }else{
1142 lz_report_error($error);
1143 }
1144
1145 if(!empty($notice)){
1146 lz_report_notice($notice);
1147 }
1148
1149 if(!empty($saved)){
1150 echo '<div id="message" class="updated"><p>'
1151 . __('The settings were saved successfully', 'loginizer')
1152 . '</p></div><br />';
1153 }
1154
1155 }
1156
1157 // Delete a Blackist IP range
1158 if(isset($_GET['bdelid'])){
1159
1160 $delid = (int) lz_optreq('bdelid');
1161
1162 // Unset and save
1163 $blacklist = $loginizer['blacklist'];
1164 unset($blacklist[$delid]);
1165 update_option('loginizer_blacklist', $blacklist);
1166
1167 echo '<div id="message" class="updated fade"><p>'
1168 . __('The Blacklist IP range has been deleted successfully', 'loginizer')
1169 . '</p></div><br />';
1170
1171 }
1172
1173 // Delete a Whitelist IP range
1174 if(isset($_GET['delid'])){
1175
1176 $delid = (int) lz_optreq('delid');
1177
1178 // Unset and save
1179 $whitelist = $loginizer['whitelist'];
1180 unset($whitelist[$delid]);
1181 update_option('loginizer_whitelist', $whitelist);
1182
1183 echo '<div id="message" class="updated fade"><p>'
1184 . __('The Whitelist IP range has been deleted successfully', 'loginizer')
1185 . '</p></div><br />';
1186
1187 }
1188
1189 // Reset All Logs
1190 if(isset($_POST['lz_reset_all_ip'])){
1191
1192 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1193 WHERE `time` > 0");
1194
1195 echo '<div id="message" class="updated fade"><p>'
1196 . __('All the IP Logs have been cleared', 'loginizer')
1197 . '</p></div><br />';
1198 }
1199
1200 // Reset Logs
1201 if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1202
1203 $ips = $_POST['lz_reset_ips'];
1204
1205 foreach($ips as $ip){
1206 if(!lz_valid_ip($ip)){
1207 $error[] = 'The IP - '.$ip.' is invalid !';
1208 }
1209 }
1210
1211 if(count($ips) < 1){
1212 $error[] = 'There are no IPs submitted';
1213 }
1214
1215 // Should we start deleting logs
1216 if(empty($error)){
1217
1218 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1219 WHERE `ip` IN ('".implode("', '", $ips)."')");
1220
1221 if(empty($error)){
1222
1223 echo '<div id="message" class="updated fade"><p>'
1224 . __('The selected IP Logs have been reset', 'loginizer')
1225 . '</p></div><br />';
1226
1227 }
1228
1229 }
1230
1231 if(!empty($error)){
1232 lz_report_error($error);echo '<br />';
1233 }
1234
1235 }
1236
1237 if(isset($_POST['blacklist_iprange'])){
1238
1239 $start_ip = lz_optpost('start_ip');
1240 $end_ip = lz_optpost('end_ip');
1241
1242 if(empty($start_ip)){
1243 $error[] = 'Please enter the Start IP';
1244 }
1245
1246 // If no end IP we consider only 1 IP
1247 if(empty($end_ip)){
1248 $end_ip = $start_ip;
1249 }
1250
1251 if(!lz_valid_ip($start_ip)){
1252 $error[] = 'Please provide a valid start IP';
1253 }
1254
1255 if(!lz_valid_ip($end_ip)){
1256 $error[] = 'Please provide a valid end IP';
1257 }
1258
1259 // Regular ranges will work
1260 if(ip2long($start_ip) > ip2long($end_ip)){
1261
1262 // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1263 if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1264 // This is right
1265 }else{
1266 $error[] = 'The End IP cannot be smaller than the Start IP';
1267 }
1268
1269 }
1270
1271 if(empty($error)){
1272
1273 $blacklist = $loginizer['blacklist'];
1274
1275 foreach($blacklist as $k => $v){
1276
1277 // This is to check if there is any other range exists with the same Start or End IP
1278 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1279 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1280 ){
1281 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1282 break;
1283 }
1284
1285 // This is to check if there is any other range exists with the same Start IP
1286 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1287 $error[] = 'The Start IP is present in an existing range !';
1288 break;
1289 }
1290
1291 // This is to check if there is any other range exists with the same End IP
1292 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1293 $error[] = 'The End IP is present in an existing range!';
1294 break;
1295 }
1296
1297 }
1298
1299 $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1300
1301 if(empty($error)){
1302
1303 $blacklist[$newid] = array();
1304 $blacklist[$newid]['start'] = $start_ip;
1305 $blacklist[$newid]['end'] = $end_ip;
1306 $blacklist[$newid]['time'] = time();
1307
1308 update_option('loginizer_blacklist', $blacklist);
1309
1310 echo '<div id="message" class="updated fade"><p>'
1311 . __('Blacklist IP range added successfully', 'loginizer')
1312 . '</p></div><br />';
1313
1314 }
1315
1316 }
1317
1318 if(!empty($error)){
1319 lz_report_error($error);echo '<br />';
1320 }
1321
1322 }
1323
1324 if(isset($_POST['whitelist_iprange'])){
1325
1326 $start_ip = lz_optpost('start_ip_w');
1327 $end_ip = lz_optpost('end_ip_w');
1328
1329 if(empty($start_ip)){
1330 $error[] = 'Please enter the Start IP';
1331 }
1332
1333 // If no end IP we consider only 1 IP
1334 if(empty($end_ip)){
1335 $end_ip = $start_ip;
1336 }
1337
1338 if(!lz_valid_ip($start_ip)){
1339 $error[] = 'Please provide a valid start IP';
1340 }
1341
1342 if(!lz_valid_ip($end_ip)){
1343 $error[] = 'Please provide a valid end IP';
1344 }
1345
1346 if(ip2long($start_ip) > ip2long($end_ip)){
1347
1348 // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1349 if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1350 // This is right
1351 }else{
1352 $error[] = 'The End IP cannot be smaller than the Start IP';
1353 }
1354
1355 }
1356
1357 if(empty($error)){
1358
1359 $whitelist = $loginizer['whitelist'];
1360
1361 foreach($whitelist as $k => $v){
1362
1363 // This is to check if there is any other range exists with the same Start or End IP
1364 if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1365 || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1366 ){
1367 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1368 break;
1369 }
1370
1371 // This is to check if there is any other range exists with the same Start IP
1372 if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1373 $error[] = 'The Start IP is present in an existing range !';
1374 break;
1375 }
1376
1377 // This is to check if there is any other range exists with the same End IP
1378 if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1379 $error[] = 'The End IP is present in an existing range!';
1380 break;
1381 }
1382
1383 }
1384
1385 $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1386
1387 if(empty($error)){
1388
1389 $whitelist[$newid] = array();
1390 $whitelist[$newid]['start'] = $start_ip;
1391 $whitelist[$newid]['end'] = $end_ip;
1392 $whitelist[$newid]['time'] = time();
1393
1394 update_option('loginizer_whitelist', $whitelist);
1395
1396 echo '<div id="message" class="updated fade"><p>'
1397 . __('Whitelist IP range added successfully', 'loginizer')
1398 . '</p></div><br />';
1399
1400 }
1401
1402 }
1403
1404 if(!empty($error)){
1405 lz_report_error($error);echo '<br />';
1406 }
1407 }
1408
1409 // Count the Results
1410 $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1411 //print_r($tmp);
1412
1413 // Which Page is it
1414 $lz_env['res_len'] = 10;
1415 $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1416 $lz_env['num_res'] = $tmp['num'];
1417 $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1418
1419 // Get the logs
1420 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1421 ORDER BY `time` DESC
1422 LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1423 //print_r($result);
1424
1425 $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1426 $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1427 $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1428 $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1429
1430 // Reload the settings
1431 $loginizer['blacklist'] = get_option('loginizer_blacklist');
1432 $loginizer['whitelist'] = get_option('loginizer_whitelist');
1433
1434 ?>
1435
1436 <div id="" class="postbox">
1437
1438 <button class="handlediv button-link" aria-expanded="true" type="button">
1439 <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
1440 <span class="toggle-indicator" aria-hidden="true"></span>
1441 </button>
1442
1443 <h2 class="hndle ui-sortable-handle">
1444 <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1445 </h2>
1446
1447 <script>
1448 function yesdsd(){
1449 window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1450 return false;
1451 }
1452 </script>
1453
1454 <form method="get" onsubmit="return yesdsd();">
1455 <div class="tablenav">
1456 <p class="tablenav-pages" style="margin: 5px 10px" align="right">
1457 <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1458 <span class="pagination-links">
1459 <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1460 <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1461 <span class="paging-input">
1462 <label for="current-page-selector" class="screen-reader-text">Current Page</label>
1463 <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1464 </span>
1465 <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1466 <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1467 </span>
1468 </p>
1469 </div>
1470 </form>
1471
1472 <form action="" method="post" enctype="multipart/form-data">
1473 <?php wp_nonce_field('loginizer-options'); ?>
1474 <div class="inside">
1475 <table class="wp-list-table widefat fixed users" border="0">
1476 <tr>
1477 <th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
1478 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1479 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1480 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1481 <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('Lockouts Count','loginizer'); ?></th>
1482 </tr>
1483 <?php
1484
1485 if(empty($result)){
1486 echo '
1487 <tr>
1488 <td colspan="4">
1489 No Logs. You will see logs about failed login attempts here.
1490 </td>
1491 </tr>';
1492 }else{
1493 foreach($result as $ik => $iv){
1494 $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1495 echo '
1496 <tr>
1497 <td>
1498 <input type="checkbox" value="'.$iv['ip'].'" name="lz_reset_ips[]" />
1499 </td>
1500 <td>
1501 '.$iv['ip'].'
1502 </td>
1503 <td>
1504 '.date('d/m/Y H:i:s', $iv['time']).'
1505 </td>
1506 <td>
1507 '.$iv['count'].'
1508 </td>
1509 <td>
1510 '.$iv['lockout'].'
1511 </td>
1512 </tr>';
1513 }
1514 }
1515
1516 ?>
1517 </table>
1518
1519 <br>
1520 <input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
1521 &nbsp; &nbsp;
1522 <input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
1523 </div>
1524 </div>
1525 </form>
1526 <br />
1527
1528 <div id="" class="postbox">
1529
1530 <button class="handlediv button-link" aria-expanded="true" type="button">
1531 <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
1532 <span class="toggle-indicator" aria-hidden="true"></span>
1533 </button>
1534
1535 <h2 class="hndle ui-sortable-handle">
1536 <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1537 </h2>
1538
1539 <div class="inside">
1540
1541 <form action="" method="post" enctype="multipart/form-data">
1542 <?php wp_nonce_field('loginizer-options'); ?>
1543 <table class="form-table">
1544 <tr>
1545 <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1546 <td>
1547 <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1548 </td>
1549 </tr>
1550 <tr>
1551 <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1552 <td>
1553 <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1554 </td>
1555 </tr>
1556 <tr>
1557 <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1558 <td>
1559 <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1560 </td>
1561 </tr>
1562 <tr>
1563 <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
1564 <td>
1565 <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
1566 </td>
1567 </tr>
1568 <tr>
1569 <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
1570 <td>
1571 <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
1572 </td>
1573 </tr>
1574 <tr>
1575 <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
1576 <td>
1577 <?php echo __('after ','loginizer'); ?>
1578 <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
1579 </td>
1580 </tr>
1581 </table><br />
1582 <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1583 </form>
1584
1585 </div>
1586 </div>
1587 <br />
1588
1589 <div id="" class="postbox">
1590
1591 <button class="handlediv button-link" aria-expanded="true" type="button">
1592 <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
1593 <span class="toggle-indicator" aria-hidden="true"></span>
1594 </button>
1595
1596 <h2 class="hndle ui-sortable-handle">
1597 <span><?php echo __('Blacklist IP','loginizer'); ?></span>
1598 </h2>
1599
1600 <div class="inside">
1601
1602 <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
1603
1604 <form action="" method="post">
1605 <?php wp_nonce_field('loginizer-options'); ?>
1606 <table class="form-table">
1607 <tr>
1608 <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
1609 <td>
1610 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1611 </td>
1612 </tr>
1613 <tr>
1614 <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1615 <td>
1616 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1617 </td>
1618 </tr>
1619 </table><br />
1620 <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1621 </form>
1622 </div>
1623
1624 <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1625 <tr>
1626 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1627 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1628 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1629 <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1630 </tr>
1631 <?php
1632 if(empty($loginizer['blacklist'])){
1633 echo '
1634 <tr>
1635 <td colspan="4">
1636 No Blacklist IPs. You will see blacklisted IP ranges here.
1637 </td>
1638 </tr>';
1639 }else{
1640 foreach($loginizer['blacklist'] as $ik => $iv){
1641 echo '
1642 <tr>
1643 <td>
1644 '.$iv['start'].'
1645 </td>
1646 <td>
1647 '.$iv['end'].'
1648 </td>
1649 <td>
1650 '.date('d/m/Y', $iv['time']).'
1651 </td>
1652 <td>
1653 <a class="submitdelete" href="admin.php?page=loginizer_brute_force&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1654 </td>
1655 </tr>';
1656 }
1657 }
1658 ?>
1659 </table>
1660 <br />
1661
1662 </div>
1663
1664 <br />
1665
1666 <div id="" class="postbox">
1667
1668 <button class="handlediv button-link" aria-expanded="true" type="button">
1669 <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
1670 <span class="toggle-indicator" aria-hidden="true"></span>
1671 </button>
1672
1673 <h2 class="hndle ui-sortable-handle">
1674 <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
1675 </h2>
1676
1677 <div class="inside">
1678
1679 <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
1680 <form action="" method="post">
1681 <?php wp_nonce_field('loginizer-options'); ?>
1682 <table class="form-table">
1683 <tr>
1684 <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
1685 <td>
1686 <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1687 </td>
1688 </tr>
1689 <tr>
1690 <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1691 <td>
1692 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
1693 </td>
1694 </tr>
1695 </table><br />
1696 <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1697 </form>
1698 </div>
1699
1700 <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1701 <tr>
1702 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1703 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1704 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1705 <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1706 </tr>
1707 <?php
1708 if(empty($loginizer['whitelist'])){
1709 echo '
1710 <tr>
1711 <td colspan="4">
1712 No Whitelist IPs. You will see whitelisted IP ranges here.
1713 </td>
1714 </tr>';
1715 }else{
1716 foreach($loginizer['whitelist'] as $ik => $iv){
1717 echo '
1718 <tr>
1719 <td>
1720 '.$iv['start'].'
1721 </td>
1722 <td>
1723 '.$iv['end'].'
1724 </td>
1725 <td>
1726 '.date('d/m/Y', $iv['time']).'
1727 </td>
1728 <td>
1729 <a class="submitdelete" href="admin.php?page=loginizer_brute_force&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1730 </td>
1731 </tr>';
1732 }
1733 }
1734 ?>
1735 </table>
1736 <br />
1737
1738 </div>
1739
1740 <?php
1741
1742 loginizer_page_footer();
1743
1744 }
1745
1746
1747 // Sorry to see you going
1748 register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
1749
1750 function loginizer_deactivation(){
1751
1752 global $wpdb;
1753
1754 $sql = array();
1755 $sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
1756
1757 foreach($sql as $sk => $sv){
1758 $wpdb->query($sv);
1759 }
1760
1761 delete_option('loginizer_version');
1762 delete_option('loginizer_options');
1763 delete_option('loginizer_last_reset');
1764 delete_option('loginizer_whitelist');
1765 delete_option('loginizer_blacklist');
1766
1767 }
1768
1769