PluginProbe
Loginizer / 1.4.2
Loginizer v1.4.2
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | loginizer.php +54 -873 1.0 → 1.4.2 View file →
@@ -1,882 +1,54 @@
1 -<?php
2 -/**
3 - * @package loginizer
4 - * @version 1.4.2
5 - */
6 -/*
7 -Plugin Name: Loginizer
8 -Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9 -Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10 -Version: 1.0
11 -Author: Raj Kothari
12 -Author URI: http://www.loginizer.com
13 -License: GPLv3 or later
14 -*/
15 -
16 -/*
17 -Copyright (C) 2013 Raj Kothari (email : support@loginizer.com)
18 -This program is free software: you can redistribute it and/or modify
19 -it under the terms of the GNU General Public License as published by
20 -the Free Software Foundation, either version 3 of the License, or
21 -(at your option) any later version.
22 -
23 -This program is distributed in the hope that it will be useful,
24 -but WITHOUT ANY WARRANTY; without even the implied warranty of
25 -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 -GNU General Public License for more details.
27 -
28 -You should have received a copy of the GNU General Public License
29 -along with this program. If not, see <http://www.gnu.org/licenses/>.
30 -*/
31 -
32 -if(!function_exists('add_action')){
33 - echo 'You are not allowed to access this page directly.';
34 - exit;
35 -}
36 -
37 -define('lz_version', '1.0');
38 -
39 -include_once('functions.php');
40 -
41 -// Ok so we are now ready to go
42 -register_activation_hook( __FILE__, 'loginizer_activation');
43 -
44 -function loginizer_activation(){
45 -
46 -global $wpdb;
47 -
48 -$sql = array();
49 -$sql[] = "
50 -
51 -CREATE TABLE `".$wpdb->prefix."lz_failed_logs` (
52 - `username` varchar(255) NOT NULL DEFAULT '',
53 - `time` int(10) NOT NULL DEFAULT '0',
54 - `count` int(10) NOT NULL DEFAULT '0',
55 - `lockout` int(10) NOT NULL DEFAULT '0',
56 - `ip` varchar(255) NOT NULL DEFAULT '',
57 - UNIQUE KEY `ip` (`ip`)
58 -) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
59 -
60 -$sql[] = "
61 -
62 -CREATE TABLE IF NOT EXISTS `".$wpdb->prefix."lz_options` (
63 - `id` int(11) NOT NULL AUTO_INCREMENT,
64 - `option_name` varchar(255) NOT NULL,
65 - `option_value` varchar(255) NOT NULL,
66 - `updated` int(11) NOT NULL,
67 - PRIMARY KEY (`id`),
68 - UNIQUE KEY `option_name` (`option_name`)
69 -) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;";
70 -
71 -$sql[] = "
72 -
73 -CREATE TABLE IF NOT EXISTS `".$wpdb->prefix."lz_iprange` (
74 - `rid` int(10) NOT NULL AUTO_INCREMENT,
75 - `start` bigint(20) NOT NULL,
76 - `end` bigint(20) NOT NULL,
77 - `blacklist` tinyint(2) NOT NULL DEFAULT '0',
78 - `whitelist` tinyint(2) NOT NULL DEFAULT '0',
79 - `date` int(10) NOT NULL,
80 - PRIMARY KEY (`rid`)
81 -) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;";
82 -
83 - foreach($sql as $sk => $sv){
84 - $wpdb->query($sv);
85 - }
86 -
87 - add_option('lz_version', lz_version);
88 -
89 -}
90 -
91 -add_action( 'plugins_loaded', 'loginizer_load_plugin' );
92 -
93 -function loginizer_update_check(){
94 -
95 -global $wpdb;
96 -
97 - $sql = array();
98 - $current_version = get_option('lz_version');
99 -
100 - if($current_version < lz_version){
101 - foreach($sql as $sk => $sv){
102 - $wpdb->query($sv);
103 - }
104 -
105 - update_option('lz_version', lz_version);
106 - }
107 -
108 -}
109 -
110 -function loginizer_load_plugin(){
111 -
112 - global $lz_globals;
113 -
114 - loginizer_update_check();
115 -
116 - $lz_globals = array();
117 - $lz_globals['lz_max_retries'] = lz_get_option('lz_max_retries', 3);
118 - $lz_globals['lz_lockout_time'] = lz_get_option('lz_lockout_time', 900); // 15 minutes
119 - $lz_globals['lz_max_lockouts'] = lz_get_option('lz_max_lockouts', 5);
120 - $lz_globals['lz_lockouts_extend'] = lz_get_option('lz_lockouts_extend', 86400); // 24 hours
121 - $lz_globals['lz_reset_retries'] = lz_get_option('lz_reset_retries', 86400); // 24 hours
122 - $lz_globals['lz_last_reset'] = lz_get_option('lz_last_reset', 0); // 24 hours
123 - $lz_globals['lz_notify_email'] = lz_get_option('lz_notify_email', 0);
124 -
125 - // Clear retries
126 - if((time() - $lz_globals['lz_last_reset']) >= $lz_globals['lz_reset_retries']){
127 - lz_reset_retries();
128 - }
129 -
130 - $lz_globals['current_ip'] = lz_getip();
131 -
132 - /* Filters and actions */
133 - add_filter('wp_authenticate_user', 'lz_wp_authenticate_user', 99999, 2);// This is used for additional validation
134 - add_action('wp_login_failed', 'lz_login_failed');// Update our records login failed
135 - add_action('wp_authenticate', 'lz_wp_authenticate', 10, 2);// Use this to verify before WP tries to login
136 - add_action('login_errors', 'lz_update_error_msg');// Update Error message
137 -
138 -}
139 -
140 -function lz_wp_authenticate_user($user, $username){
141 -
142 - global $lz_error, $lz_cannot_login;
143 -
144 - if(is_wp_error($user) || empty($lz_cannot_login)){
145 - return $user;
146 - }
147 -
148 - $error = new WP_Error();
149 - $error->add('ip_blocked', implode('', $lz_error));
150 - return $error;
151 -}
152 -
153 -function lz_wp_authenticate($username, $password){
154 -
155 - global $lz_error, $lz_cannot_login, $lz_user_pass;
156 -
157 - if(!empty($username) && !empty($password)){
158 - $lz_user_pass = 1;
159 - }
160 -
161 - // Are you whitelisted ?
162 - if(lz_is_whitelisted()){
163 - return $username;
164 - }
165 -
166 - // Are you blacklisted ?
167 - if(lz_is_blacklisted()){
168 - $lz_cannot_login = 1;
169 - $error = new WP_Error();
170 - $error->add('ip_blacklisted', implode('', $lz_error));
171 - return $error;
172 - }
173 -
174 - if(lz_can_login()){
175 - return $username;
176 - }
177 -
178 - $lz_cannot_login = 1;
179 -
180 - $error = new WP_Error();
181 - $error->add('ip_blocked', implode('', $lz_error));
182 - return $error;
183 -}
184 -
185 -function lz_can_login(){
186 -
187 - global $wpdb, $lz_globals, $lz_error;
188 -
189 - // Get the logs
190 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` WHERE `ip` = '".$lz_globals['current_ip']."';");
191 -
192 - if(!empty($result['count']) && $result['count'] >= $lz_globals['lz_max_retries']){
193 -
194 - // Has he reached max lockouts ?
195 - if($result['lockout'] >= $lz_globals['lz_max_lockouts']){
196 - $lz_globals['lz_lockout_time'] = $lz_globals['lz_lockouts_extend'];
197 - }
198 -
199 - // Is he in the lockout time ?
200 - if($result['time'] >= time() - $lz_globals['lz_lockout_time']){
201 - $banlift = ceil((($result['time'] + $lz_globals['lz_lockout_time']) - time()) / 60);
202 -
203 - //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
204 - //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
205 - //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $lz_globals['lz_lockout_time']).'<br />';
206 -
207 - $_time = $banlift.' minute(s)';
208 -
209 - if($banlift > 60){
210 - $banlift = ceil($banlift / 60);
211 - $_time = $banlift.' hour(s)';
212 - }
213 -
214 - $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
215 -
216 - return false;
217 - }
218 - }
219 -
220 - if(!empty($result['count']) && $result['count'] < $lz_globals['lz_max_retries']){
221 - $lz_globals['lz_retries_left'] = $lz_globals['lz_max_retries'] - $result['count'];
222 - }
223 -
224 - return true;
225 -}
226 -
227 -function lz_is_blacklisted(){
228 -
229 - global $wpdb, $lz_globals, $lz_error;
230 -
231 - // Get the logs
232 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE (".ip2long($lz_globals['current_ip'])." BETWEEN `start` AND `end`) AND `blacklist` = '1';");
233 -
234 - // You are blacklisted
235 - if(!empty($result)){
236 - $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
237 - return true;
238 - }
239 -
240 - return false;
241 -}
242 -
243 -function lz_is_whitelisted(){
244 -
245 - global $wpdb, $lz_globals, $lz_error;
246 -
247 - // Get the logs
248 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE (".ip2long($lz_globals['current_ip'])." BETWEEN `start` AND `end`) AND `whitelist` = '1';");
249 -
250 - // You are whitelisted
251 - if(!empty($result)){
252 - return true;
253 - }
254 -
255 - return false;
256 -}
257 -
258 -function lz_login_failed($username){
259 -
260 - global $wpdb, $lz_globals, $lz_cannot_login;
261 -
262 - if(empty($lz_cannot_login)){
263 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` WHERE `ip` = '".$lz_globals['current_ip']."';");
264 -
265 - if(!empty($result)){
266 - $lockout = floor(($result['count'] / $lz_globals['lz_max_retries']));
267 - $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."lz_failed_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$lz_globals['current_ip']."';");
268 -
269 - // Do we need to email admin ?
270 - $lz_globals['lz_notify_email'] = 4;
271 - if(!empty($lz_globals['lz_notify_email']) && $lockout >= $lz_globals['lz_notify_email']){
272 -
273 - $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
274 - $mail = array();
275 - $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
276 - $mail['subject'] = 'Failed Login Attempts from IP '.$lz_globals['current_ip'].' ('.$sitename.')';
277 - $mail['message'] = 'Hi,
278 -
279 -'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$lz_globals['current_ip'].'
280 -
281 -Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
282 -Last User Attempt : '.$username.'
283 -IP has been blocked until : '.date('m/d/Y H:i:s', time() + $lz_globals['lz_lockout_time']).'
284 -
285 -Regards,
286 -Loginizer';
287 -
288 - @wp_mail($mail['to'], $mail['subject'], $mail['message']);
289 - }
290 - }else{
291 - $result = $wpdb->query("INSERT INTO `".$wpdb->prefix."lz_failed_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$lz_globals['current_ip']."', `lockout` = '0';");
292 - }
293 - }
294 -}
295 -
296 -function lz_update_error_msg($default_msg){
297 -
298 - global $wpdb, $lz_globals, $lz_user_pass, $lz_cannot_login;
299 -
300 - $msg = '';
301 -
302 - if(!empty($lz_user_pass) && empty($lz_cannot_login)){
303 -
304 - $msg = '<b>ERROR:</b> Incorrect Username or Password';
305 -
306 - if(!empty($lz_globals['lz_retries_left'])){
307 - $msg .= '<br /><b>'.$lz_globals['lz_retries_left'].'</b> attempt(s) left';
308 - }
309 - }
310 -
311 - if(!empty($msg)){
312 - return $msg;
313 - }else{
314 - return $default_msg;
315 - }
316 -
317 -}
318 -
319 -function lz_reset_retries(){
320 -
321 - global $wpdb, $lz_globals;
322 -
323 - $deltime = time() - $lz_globals['lz_reset_retries'];
324 - $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."lz_failed_logs` WHERE `time` <= '".$deltime."';");
325 -
326 - lz_update_option('lz_last_reset', time());
327 -
328 -}
329 -
330 -// Add settings link on plugin page
331 -function lz_settings_link($links) {
332 - $settings_link = '<a href="options-general.php?page=loginizer">Settings</a>';
333 - array_unshift($links, $settings_link);
334 - return $links;
335 -}
336 -
337 -$plugin = plugin_basename(__FILE__);
338 -add_filter("plugin_action_links_$plugin", 'lz_settings_link' );
339 -
340 -add_action('admin_menu', 'loginizer_admin_menu');
341 -
342 -function loginizer_admin_menu() {
343 - global $wp_version;
344 -
345 - // Modern WP?
346 - if (version_compare($wp_version, '3.0', '>=')) {
347 - add_options_page('Loginizer', 'Loginizer', 'manage_options', 'loginizer', 'loginizer_option_page');
348 - return;
349 - }
350 -
351 - // Older WPMU?
352 - if (function_exists("get_current_site")) {
353 - add_submenu_page('wpmu-admin.php', 'Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
354 - return;
355 - }
356 -
357 - // Older WP
358 - add_options_page('Loginizer', 'Loginizer', 9, 'loginizer', 'loginizer_option_page');
359 -}
360 -
361 -function loginizer_option_page(){
362 -
363 - global $wpdb, $wp_roles, $lz_globals;
364 -
365 - if(!current_user_can('manage_options')){
366 - wp_die('Sorry, but you do not have permissions to change settings.');
367 - }
368 -
369 - /* Make sure post was from this page */
370 - if(count($_POST) > 0){
371 - check_admin_referer('loginizer-options');
372 - }
373 -
374 - if(isset($_POST['save_lz'])){
375 -
376 - $lz_max_retries = (int) lz_optpost('lz_max_retries');
377 - $lz_lockout_time = (int) lz_optpost('lz_lockout_time');
378 - $lz_max_lockouts = (int) lz_optpost('lz_max_lockouts');
379 - $lz_lockouts_extend = (int) lz_optpost('lz_lockouts_extend');
380 - $lz_reset_retries = (int) lz_optpost('lz_reset_retries');
381 - $lz_notify_email = (int) lz_optpost('lz_notify_email');
382 -
383 - $lz_lockout_time = $lz_lockout_time * 60;
384 - $lz_lockouts_extend = $lz_lockouts_extend * 60 * 60;
385 - $lz_reset_retries = $lz_reset_retries * 60 * 60;
386 -
387 - if(empty($error)){
388 -
389 - lz_update_option('lz_max_retries', $lz_max_retries);
390 - lz_update_option('lz_lockout_time', $lz_lockout_time);
391 - lz_update_option('lz_max_lockouts', $lz_max_lockouts);
392 - lz_update_option('lz_lockouts_extend', $lz_lockouts_extend);
393 - lz_update_option('lz_reset_retries', $lz_reset_retries);
394 - lz_update_option('lz_notify_email', $lz_notify_email);
395 -
396 - $saved = true;
397 -
398 - }else{
399 - lz_report_error($error);
400 - }
401 -
402 - if(!empty($notice)){
403 - lz_report_notice($notice);
404 - }
405 -
406 - if(!empty($saved)){
407 - echo '<div id="message" class="updated fade"><p>'
408 - . __('The settings were saved successfully', 'loginizer')
409 - . '</p></div>';
410 - }
411 -
412 - }
413 -
414 - if(isset($_GET['delid'])){
415 -
416 - $delid = (int) lz_optreq('delid');
417 -
418 - $wpdb->query("DELETE FROM ".$wpdb->prefix."lz_iprange WHERE `rid` = '".$delid."'");
419 - echo '<div id="message" class="updated fade"><p>'
420 - . __('IP range has been deleted successfully', 'loginizer')
421 - . '</p></div>';
422 - }
423 -
424 - if(isset($_POST['blacklist_iprange'])){
425 -
426 - $start_ip = lz_optpost('start_ip');
427 - $end_ip = lz_optpost('end_ip');
428 -
429 - if(empty($start_ip)){
430 - $error[] = 'Please enter the Start IP';
431 - }
432 -
433 - // If no end IP we consider only 1 IP
434 - if(empty($end_ip)){
435 - $end_ip = $start_ip;
436 - }
437 -
438 - if(!lz_valid_ip($start_ip)){
439 - $error[] = 'Please provide a valid start IP';
440 - }
441 -
442 - if(!lz_valid_ip($end_ip)){
443 - $error[] = 'Please provide a valid end IP';
444 - }
445 -
446 - if(ip2long($start_ip) > ip2long($end_ip)){
447 - $error[] = 'The End IP cannot be smaller than the Start IP';
448 - }
449 -
450 - if(empty($error)){
451 -
452 - // This is to check if there is any other range exists with the same Start or End IP
453 - $ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
454 - `blacklist` = '1' AND
455 - (`start` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."'
456 - OR `end` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."');";
457 -
458 - $ip_exists = $wpdb->get_results($ip_exists_query);
459 - //print_r($ip_exists);
460 -
461 - if(!empty($ip_exists)){
462 - $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range!';
463 - }
464 -
465 - // This is to check if there is any other range exists with the same Start IP
466 - $start_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
467 - `blacklist` = '1' AND
468 - ('".ip2long($start_ip)."' BETWEEN `start` AND `end`);";
469 -
470 - $start_ip_exists = $wpdb->get_results($start_ip_exists_query);
471 - //print_r($start_ip_exists);
472 -
473 - if(!empty($start_ip_exists)){
474 - $error[] = 'The Start IP is present in an existing range!';
475 - }
476 -
477 - // This is to check if there is any other range exists with the same End IP
478 - $end_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
479 - `blacklist` = '1' AND
480 - ('".ip2long($end_ip)."' BETWEEN `start` AND `end`);";
481 -
482 - $end_ip_exists = $wpdb->get_results($end_ip_exists_query);
483 - //print_r($end_ip_exists);
484 -
485 - if(!empty($end_ip_exists)){
486 - $error[] = 'The End IP is present in an existing range!';
487 - }
488 -
489 - if(empty($error)){
490 -
491 - $options = array();
492 - $options['start'] = ip2long($start_ip);
493 - $options['end'] = ip2long($end_ip);
494 - $options['blacklist'] = 1;
495 - $options['whitelist'] = 0;
496 - $options['date'] = date('Ymd');
497 -
498 - $wpdb->insert($wpdb->prefix.'lz_iprange', $options);
499 -
500 - if(!empty($wpdb->insert_id)){
501 - echo '<div id="message" class="updated fade"><p>'
502 - . __('Blacklist IP range added successfully', 'loginizer')
503 - . '</p></div>';
504 - }else{
505 - echo '<div id="message" class="updated fade"><p>'
506 - . __('There were some errors while adding the blacklist IP range', 'loginizer')
507 - . '</p></div>';
508 - }
509 -
510 - }
511 -
512 - }
513 -
514 - if(!empty($error)){
515 - lz_report_error($error);
516 - }
517 - }
518 -
519 - if(isset($_POST['whitelist_iprange'])){
520 -
521 - $start_ip = lz_optpost('start_ip_w');
522 - $end_ip = lz_optpost('end_ip_w');
523 -
524 - if(empty($start_ip)){
525 - $error[] = 'Please enter the Start IP';
526 - }
527 -
528 - // If no end IP we consider only 1 IP
529 - if(empty($end_ip)){
530 - $end_ip = $start_ip;
531 - }
532 -
533 - if(!lz_valid_ip($start_ip)){
534 - $error[] = 'Please provide a valid start IP';
535 - }
536 -
537 - if(!lz_valid_ip($end_ip)){
538 - $error[] = 'Please provide a valid end IP';
539 - }
540 -
541 - if(ip2long($start_ip) > ip2long($end_ip)){
542 - $error[] = 'The End IP cannot be smaller than the Start IP';
543 - }
544 -
545 - if(empty($error)){
546 -
547 - // This is to check if there is any other range exists with the same Start or End IP
548 - $ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
549 - `whitelist` = '1' AND
550 - (`start` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."'
551 - OR `end` BETWEEN '".ip2long($start_ip)."' AND '".ip2long($end_ip)."');";
552 -
553 - $ip_exists = $wpdb->get_results($ip_exists_query);
554 - //print_r($ip_exists);
555 -
556 - if(!empty($ip_exists)){
557 - $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range!';
558 - }
559 -
560 - // This is to check if there is any other range exists with the same Start IP
561 - $start_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
562 - `whitelist` = '1' AND
563 - ('".ip2long($start_ip)."' BETWEEN `start` AND `end`);";
564 -
565 - $start_ip_exists = $wpdb->get_results($start_ip_exists_query);
566 - //print_r($start_ip_exists);
567 -
568 - if(!empty($start_ip_exists)){
569 - $error[] = 'The Start IP is present in an existing range!';
570 - }
571 -
572 - // This is to check if there is any other range exists with the same End IP
573 - $end_ip_exists_query = "SELECT * FROM ".$wpdb->prefix."lz_iprange WHERE
574 - `whitelist` = '1' AND
575 - ('".ip2long($end_ip)."' BETWEEN `start` AND `end`);";
576 -
577 - $end_ip_exists = $wpdb->get_results($end_ip_exists_query);
578 - //print_r($end_ip_exists);
579 -
580 - if(!empty($end_ip_exists)){
581 - $error[] = 'The End IP is present in an existing range!';
582 - }
583 -
584 - if(empty($error)){
585 -
586 - $options = array();
587 - $options['start'] = ip2long($start_ip);
588 - $options['end'] = ip2long($end_ip);
589 - $options['blacklist'] = 0;
590 - $options['whitelist'] = 1;
591 - $options['date'] = date('Ymd');
592 -
593 - $wpdb->insert($wpdb->prefix.'lz_iprange', $options);
594 -
595 - if(!empty($wpdb->insert_id)){
596 - echo '<div id="message" class="updated fade"><p>'
597 - . __('Whitelist IP range added successfully', 'loginizer')
598 - . '</p></div>';
599 - }else{
600 - echo '<div id="message" class="updated fade"><p>'
601 - . __('There were some errors while adding the whitelist IP range', 'loginizer')
602 - . '</p></div>';
603 - }
604 -
605 - }
606 -
607 - }
608 -
609 - if(!empty($error)){
610 - lz_report_error($error);
611 - }
612 - }
613 -
614 - // Get the logs
615 - $result = array();
616 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs` ORDER BY `count` DESC LIMIT 0, 10;", 1);
617 - //print_r($result);
618 -
619 - // Get the Blacklist IP ranges
620 - $blacklist_ips = array();
621 - $blacklist_ips = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE `blacklist` = 1;", 1);
622 - //print_r($blacklist_ips);
623 -
624 - // Get the Whitelist IP ranges
625 - $whitelist_ips = array();
626 - $whitelist_ips = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange` WHERE `whitelist` = 1;", 1);
627 - //print_r($whitelist_ips);
628 -
629 - ?>
630 -
631 - <div class="wrap">
632 - <!--This is intentional-->
633 - <h2></h2>
634 -
635 - <h1><center><?php echo __('Loginizer','loginizer'); ?></center></h1><hr /><br />
636 -
637 - <script src="http://api.loginizer.com/news.js""></script>
638 -
639 - <h2><?php echo __('Failed Login Attempts Logs &nbsp; (Past '.($lz_globals['lz_reset_retries']/60/60).' hours)','loginizer'); ?></h2><hr /><br />
640 -
641 - <table class="wp-list-table widefat fixed users" border="0">
642 - <tr>
643 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
644 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
645 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
646 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
647 - </tr>
648 - <?php
649 - if(empty($result)){
650 - echo '
651 - <tr>
652 - <td colspan="4">
653 - No Logs. You will see logs about failed login attempts here.
654 - </td>
655 - </tr>';
656 - }else{
657 - foreach($result as $ik => $iv){
658 - $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
659 - echo '
660 - <tr>
661 - <td>
662 - '.$iv['ip'].'
663 - </td>
664 - <td>
665 - '.date('d/m/Y H:i:s', $iv['time']).'
666 - </td>
667 - <td>
668 - '.$iv['count'].'
669 - </td>
670 - <td>
671 - '.$iv['lockout'].'
672 - </td>
673 - </tr>';
674 - }
675 - }
676 - ?>
677 - </table>
678 - <br />
679 - <h2><?php echo __('Loginizer Settings','loginizer'); ?></h2><hr /><br />
680 -
681 - <form action="options-general.php?page=loginizer" method="post" enctype="multipart/form-data">
682 - <?php wp_nonce_field('loginizer-options'); ?>
683 - <table class="form-table">
684 - <tr>
685 - <th scope="row" valign="top"><label for="lz_max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
686 - <td>
687 - <input type="text" size="3" value="<?php echo lz_optpost('lz_max_retries', $lz_globals['lz_max_retries']); ?>" name="lz_max_retries" id="lz_max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
688 - </td>
689 - </tr>
690 - <tr>
691 - <th scope="row" valign="top"><label for="lz_lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
692 - <td>
693 - <input type="text" size="3" value="<?php echo (!empty($lz_lockout_time) ? $lz_lockout_time : $lz_globals['lz_lockout_time']) / 60; ?>" name="lz_lockout_time" id="lz_lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
694 - </td>
695 - </tr>
696 - <tr>
697 - <th scope="row" valign="top"><label for="lz_max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
698 - <td>
699 - <input type="text" size="3" value="<?php echo lz_optpost('lz_max_lockouts', $lz_globals['lz_max_lockouts']); ?>" name="lz_max_lockouts" id="lz_max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
700 - </td>
701 - </tr>
702 - <tr>
703 - <th scope="row" valign="top"><label for="lz_lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
704 - <td>
705 - <input type="text" size="3" value="<?php echo (!empty($lz_lockouts_extend) ? $lz_lockouts_extend : $lz_globals['lz_lockouts_extend']) / 60 / 60; ?>" name="lz_lockouts_extend" id="lz_lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
706 - </td>
707 - </tr>
708 - <tr>
709 - <th scope="row" valign="top"><label for="lz_reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
710 - <td>
711 - <input type="text" size="3" value="<?php echo (!empty($lz_reset_retries) ? $lz_reset_retries : $lz_globals['lz_reset_retries']) / 60 / 60; ?>" name="lz_reset_retries" id="lz_reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
712 - </td>
713 - </tr>
714 - <tr>
715 - <th scope="row" valign="top"><label for="lz_notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
716 - <td>
717 - <?php echo __('after ','loginizer'); ?>
718 - <input type="text" size="3" value="<?php echo (!empty($lz_notify_email) ? $lz_notify_email : $lz_globals['lz_notify_email']); ?>" name="lz_notify_email" id="lz_notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
719 - </td>
720 - </tr>
721 - </table><br />
722 - <input name="save_lz" class="button action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
723 - </form>
724 -
725 - <br /><br />
726 - <hr />
727 - <h2><?php echo __('Blacklist IP','loginizer'); ?></h2>
728 - <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
729 - <form action="options-general.php?page=loginizer" method="post">
730 - <?php wp_nonce_field('loginizer-options'); ?>
731 - <table class="form-table">
732 - <tr>
733 - <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
734 - <td>
735 - <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
736 - </td>
737 - </tr>
738 - <tr>
739 - <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
740 - <td>
741 - <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
742 - </td>
743 - </tr>
744 - </table><br />
745 - <input name="blacklist_iprange" class="button action" value="<?php echo __('Blacklist IP range','loginizer'); ?>" type="submit" />
746 - </form>
747 - <br />
748 - <table class="wp-list-table widefat fixed users" border="0">
749 - <tr>
750 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
751 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
752 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
753 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
754 - </tr>
755 - <?php
756 - if(empty($blacklist_ips)){
757 - echo '
758 - <tr>
759 - <td colspan="4">
760 - No Blacklist IPs. You will see blacklisted IP ranges here.
761 - </td>
762 - </tr>';
763 - }else{
764 - foreach($blacklist_ips as $ik => $iv){
765 - echo '
766 - <tr>
767 - <td>
768 - '.long2ip($iv['start']).'
769 - </td>
770 - <td>
771 - '.long2ip($iv['end']).'
772 - </td>
773 - <td>
774 - '.date('d/m/Y', strtotime($iv['date'])).'
775 - </td>
776 - <td>
777 - <a class="submitdelete" href="options-general.php?page=loginizer&delid='.$iv['rid'].'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
778 - </td>
779 - </tr>';
780 - }
781 - }
782 - ?>
783 - </table>
784 - <br />
785 - <hr />
786 - <h2><?php echo __('Whitelist IP','loginizer'); ?></h2>
787 - <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
788 - <form action="options-general.php?page=loginizer" method="post">
789 - <?php wp_nonce_field('loginizer-options'); ?>
790 - <table class="form-table">
791 - <tr>
792 - <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
793 - <td>
794 - <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
795 - </td>
796 - </tr>
797 - <tr>
798 - <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
799 - <td>
800 - <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
801 - </td>
802 - </tr>
803 - </table><br />
804 - <input name="whitelist_iprange" class="button action" value="<?php echo __('Whitelist IP range','loginizer'); ?>" type="submit" />
805 - </form>
806 - <br />
807 - <table class="wp-list-table widefat fixed users" border="0">
808 - <tr>
809 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
810 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
811 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
812 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Options','loginizer'); ?></th>
813 - </tr>
814 - <?php
815 - if(empty($whitelist_ips)){
816 - echo '
817 - <tr>
818 - <td colspan="4">
819 - No Whitelist IPs. You will see whitelisted IP ranges here.
820 - </td>
821 - </tr>';
822 - }else{
823 - foreach($whitelist_ips as $ik => $iv){
824 - echo '
825 - <tr>
826 - <td>
827 - '.long2ip($iv['start']).'
828 - </td>
829 - <td>
830 - '.long2ip($iv['end']).'
831 - </td>
832 - <td>
833 - '.date('d/m/Y', strtotime($iv['date'])).'
834 - </td>
835 - <td>
836 - <a class="submitdelete" href="options-general.php?page=loginizer&delid='.$iv['rid'].'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
837 - </td>
838 - </tr>';
839 - }
840 - }
841 - ?>
842 - </table>
843 - <br />
844 - </div>
845 - <?php
846 -
847 - echo '<br /><br /><hr />
848 - <a href="http://www.loginizer.com" target="_blank">Loginizer</a> v'.lz_version.'. <br />
849 - You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
850 -}
851 -
852 -// Sorry to see you going
853 -register_uninstall_hook( __FILE__, 'loginizer_deactivation');
854 -
855 -function loginizer_deactivation(){
856 -
857 -global $wpdb;
858 -
859 - $sql = array();
860 - $sql[] = "DROP TABLE ".$wpdb->prefix."lz_failed_logs;";
861 - $sql[] = "DROP TABLE ".$wpdb->prefix."lz_options;";
862 - $sql[] = "DROP TABLE ".$wpdb->prefix."lz_iprange;";
863 -
864 - foreach($sql as $sk => $sv){
865 - $wpdb->query($sv);
866 - }
867 -
868 -
869 -delete_option('lz_version');
870 -
871 -}
872 -
873 -?>
1 +<?php
2 +/**
3 + * @package loginizer
4 + * @version 1.4.2
5 + */
6 +/*
7 +Plugin Name: Loginizer
8 +Plugin URI: http://wordpress.org/extend/plugins/loginizer/
9 +Description: Loginizer is a WordPress plugin which helps you fight against bruteforce attack by blocking login for the IP after it reaches maximum retries allowed. You can blacklist or whitelist IPs for login using Loginizer.
10 +Version: 1.4.2
11 +Author: Raj Kothari
12 +Author URI: http://www.loginizer.com
13 +License: GPLv3 or later
14 +*/
15 +
16 +/*
17 +Copyright (C) 2013 Raj Kothari (email : support@loginizer.com)
18 +This program is free software: you can redistribute it and/or modify
19 +it under the terms of the GNU General Public License as published by
20 +the Free Software Foundation, either version 3 of the License, or
21 +(at your option) any later version.
22 +
23 +This program is distributed in the hope that it will be useful,
24 +but WITHOUT ANY WARRANTY; without even the implied warranty of
25 +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 +GNU General Public License for more details.
27 +
28 +You should have received a copy of the GNU General Public License
29 +along with this program. If not, see <http://www.gnu.org/licenses/>.
30 +*/
31 +
32 +if(!function_exists('add_action')){
33 + echo 'You are not allowed to access this page directly.';
34 + exit;
35 +}
36 +
37 +$_ltmp_plugins = get_option('active_plugins');
38 +
39 +// Is the premium plugin loaded ?
40 +if(in_array('loginizer-security/loginizer-security.php', $_ltmp_plugins)){
41 + return;
42 +}
43 +
44 +// Is the premium plugin active ?
45 +if(defined('LOGINIZER_VERSION')){
46 + return;
47 +}
48 +
49 +$plugin_loginizer = plugin_basename(__FILE__);
50 +define('LOGINIZER_FILE', __FILE__);
51 +define('LOGINIZER_API', 'http://api.loginizer.com/');
52 +
53 +include_once(dirname(__FILE__).'/init.php');
54 +