PluginProbe
Loginizer / 1.4.2
Loginizer v1.4.2
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | init.php +329 -57 1.3.2 → 1.4.2 View file →
@@ -4,13 +4,13 @@
4 4 echo 'You are not allowed to access this page directly.';
5 5 exit;
6 6 }
7 7
8 -define('LOGINIZER_VERSION', '1.3.2');
8 +define('LOGINIZER_VERSION', '1.4.2');
9 9 define('LOGINIZER_DIR', WP_PLUGIN_DIR.'/'.basename(dirname(LOGINIZER_FILE)));
10 10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12 -define('LOGINIZER_DOCS', 'https://loginizer.com/wiki/');
12 +define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
13 13
14 14 include_once(LOGINIZER_DIR.'/functions.php');
15 15
16 16 // Ok so we are now ready to go
@@ -30,8 +30,9 @@
30 30 `time` int(10) NOT NULL DEFAULT '0',
31 31 `count` int(10) NOT NULL DEFAULT '0',
32 32 `lockout` int(10) NOT NULL DEFAULT '0',
33 33 `ip` varchar(255) NOT NULL DEFAULT '',
34 + `url` varchar(255) NOT NULL DEFAULT '',
34 35 UNIQUE KEY `ip` (`ip`)
35 36 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
36 37
37 38 foreach($sql as $sk => $sv){
@@ -158,8 +159,15 @@
158 159 }
159 160
160 161 }
161 162
163 + // Is it less than 1.3.9 ?
164 + if($version < 139){
165 +
166 + $wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
167 +
168 + }
169 +
162 170 // Save the new Version
163 171 update_option('loginizer_version', LOGINIZER_VERSION);
164 172
165 173 }
@@ -179,8 +187,11 @@
179 187 $loginizer = array();
180 188
181 189 // The IP Method to use
182 190 $loginizer['ip_method'] = get_option('loginizer_ip_method');
191 + if($loginizer['ip_method'] == 3){
192 + $loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
193 + }
183 194
184 195 // Load settings
185 196 $options = get_option('loginizer_options');
186 197 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
@@ -188,8 +199,21 @@
188 199 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
189 200 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
190 201 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
191 202 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
203 +
204 + // Default messages
205 + $loginizer['d_msg']['inv_userpass'] = 'Incorrect Username or Password';
206 + $loginizer['d_msg']['ip_blacklisted'] = 'Your IP has been blacklisted';
207 +
208 + // Message Strings
209 + $loginizer['msg'] = get_option('loginizer_msg');
210 +
211 + foreach($loginizer['d_msg'] as $lk => $lv){
212 + if(empty($loginizer['msg'][$lk])){
213 + $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
214 + }
215 + }
192 216
193 217 // Load the blacklist and whitelist
194 218 $loginizer['blacklist'] = get_option('loginizer_blacklist');
195 219 $loginizer['whitelist'] = get_option('loginizer_whitelist');
@@ -212,24 +236,31 @@
212 236 $loginizer['ins_time'] = $ins_time;
213 237
214 238 // Set the current IP
215 239 $loginizer['current_ip'] = lz_getip();
240 +
241 + // Is Brute Force Disabled ?
242 + $loginizer['disable_brute'] = get_option('loginizer_disable_brute');
216 243
217 - /* Filters and actions */
244 + // Filters and actions
245 + if(empty($loginizer['disable_brute'])){
218 246
219 - // Use this to verify before WP tries to login
220 - // Is always called and is the first function to be called
221 - //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
222 - add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
247 + // Use this to verify before WP tries to login
248 + // Is always called and is the first function to be called
249 + //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
250 + add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
251 +
252 + // Is called when a login attempt fails
253 + // Hence Update our records that the login failed
254 + add_action('wp_login_failed', 'loginizer_login_failed');
255 +
256 + // Is called before displaying the error message so that we dont show that the username is wrong or the password
257 + // Update Error message
258 + add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
259 + add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
223 260
224 - // Is called when a login attempt fails
225 - // Hence Update our records that the login failed
226 - add_action('wp_login_failed', 'loginizer_login_failed');
261 + }
227 262
228 - // Is called before displaying the error message so that we dont show that the username is wrong or the password
229 - // Update Error message
230 - add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
231 -
232 263 // Is the premium features there ?
233 264 if(file_exists(LOGINIZER_DIR.'/premium.php')){
234 265
235 266 // Include the file
@@ -461,22 +492,22 @@
461 492
462 493 foreach($blacklist as $k => $v){
463 494
464 495 // Is the IP in the blacklist ?
465 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
496 + if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
466 497 $result = 1;
467 498 break;
468 499 }
469 500
470 501 // Is it in a wider range ?
471 - if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
502 + if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
472 503
473 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
504 + // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
474 505 // if the current IP is <= than the start of the range, it is within the range
475 506 // OR
476 507 // if the current IP is <= than the end of the range, it is within the range
477 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
478 - || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
508 + if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
509 + || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
479 510 $result = 1;
480 511 break;
481 512 }
482 513
@@ -485,9 +516,9 @@
485 516 }
486 517
487 518 // You are blacklisted
488 519 if(!empty($result)){
489 - $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
520 + $lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
490 521 return true;
491 522 }
492 523
493 524 return false;
@@ -502,22 +533,22 @@
502 533
503 534 foreach($whitelist as $k => $v){
504 535
505 536 // Is the IP in the blacklist ?
506 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
537 + if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
507 538 $result = 1;
508 539 break;
509 540 }
510 541
511 542 // Is it in a wider range ?
512 - if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
543 + if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
513 544
514 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
545 + // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
515 546 // if the current IP is <= than the start of the range, it is within the range
516 547 // OR
517 548 // if the current IP is <= than the end of the range, it is within the range
518 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
519 - || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
549 + if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
550 + || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
520 551 $result = 1;
521 552 break;
522 553 }
523 554
@@ -542,13 +573,16 @@
542 573 global $wpdb, $loginizer, $lz_cannot_login;
543 574
544 575 if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
545 576
577 + $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
578 + $url = esc_url($url);
579 +
546 580 $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
547 581
548 582 if(!empty($result)){
549 583 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
550 - $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
584 + $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."', `url` = '".$url."' WHERE `ip` = '".$loginizer['current_ip']."';");
551 585
552 586 // Do we need to email admin ?
553 587 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
554 588
@@ -569,9 +603,9 @@
569 603
570 604 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
571 605 }
572 606 }else{
573 - $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
607 + $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0', `url` = '".$url."';");
574 608 }
575 609
576 610 // We need to add one as this is a failed attempt as well
577 611 $result['count'] = $result['count'] + 1;
@@ -605,9 +639,9 @@
605 639 }
606 640
607 641 // Add the error
608 642 if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
609 - $errors->add('invalid_userpass', '<b>ERROR:</b> Incorrect Username or Password');
643 + $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
610 644 }
611 645
612 646 // Add the number of retires left as well
613 647 if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
@@ -617,8 +651,21 @@
617 651 return $errors;
618 652
619 653 }
620 654
655 +
656 +
657 +// Handles the error of the password not being there
658 +function loginizer_woocommerce_error_handler(){
659 +
660 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
661 +
662 + if(function_exists('wc_add_notice')){
663 + wc_add_notice( loginizer_retries_left(), 'error' );
664 + }
665 +
666 +}
667 +
621 668 // Returns a string with the number of retries left
622 669 function loginizer_retries_left(){
623 670
624 671 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
@@ -801,9 +848,9 @@
801 848 </table>
802 849 <br />
803 850 <div style="width:45%;background:#FFF;padding:15px; margin:auto">
804 851 <b>Let your friends know that you have secured your website :</b>
805 - <form method="get" action="http://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
852 + <form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
806 853 <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
807 854 &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
808 855 </form>
809 856
@@ -842,17 +889,22 @@
842 889 $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
843 890 return loginizer_page_dashboard_T();
844 891 }
845 892
846 - $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license);
893 + $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license, array('timeout' => 30));
847 894
848 895 if(is_array($resp)){
849 896 $json = json_decode($resp['body'], true);
850 897 //print_r($json);
898 + }else{
899 +
900 + $lz_error['resp_invalid'] = __('The response was malformed<br>'.var_export($resp, true), 'loginizer');
901 + return loginizer_page_dashboard_T();
902 +
851 903 }
852 904
853 905 // Save the License
854 - if(empty($json)){
906 + if(empty($json['license'])){
855 907
856 908 $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
857 909 return loginizer_page_dashboard_T();
858 910
@@ -870,13 +922,19 @@
870 922 // Is there a IP Method ?
871 923 if(isset($_POST['save_lz_ip_method'])){
872 924
873 925 $ip_method = (int) lz_optpost('lz_ip_method');
926 + $custom_ip_method = lz_optpost('lz_custom_ip_method');
874 927
875 - if($ip_method >= 0 && $ip_method <= 2){
928 + if($ip_method >= 0 && $ip_method <= 3){
876 929 update_option('loginizer_ip_method', $ip_method);
877 930 }
878 931
932 + // Custom Method name ?
933 + if($ip_method == 3){
934 + update_option('loginizer_custom_ip_method', $custom_ip_method);
935 + }
936 +
879 937 }
880 938
881 939 loginizer_page_dashboard_T();
882 940
@@ -1019,13 +1077,15 @@
1019 1077 <th align="left">'.__('Your IP Address', 'loginizer').'</th>
1020 1078 <td>'.lz_getip().'
1021 1079 <div style="float:right">
1022 1080 Method :
1023 - <select name="lz_ip_method" style="font-size:11px; width:150px">
1081 + <select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1024 1082 <option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1025 1083 <option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1026 1084 <option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1085 + <option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1027 1086 </select>
1087 + <input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1028 1088 <input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1029 1089 </div>
1030 1090 </td>
1031 1091 </tr>
@@ -1048,8 +1108,23 @@
1048 1108 </form>
1049 1109
1050 1110 </div>
1051 1111 </div>
1112 +
1113 +<script type="text/javascript">
1114 +
1115 +function lz_ip_method_handle(){
1116 + var ele = jQuery('#lz_ip_method');
1117 + if(ele.val() == 3){
1118 + jQuery('#lz_custom_ip_method').show();
1119 + }else{
1120 + jQuery('#lz_custom_ip_method').hide();
1121 + }
1122 +};
1123 +
1124 +lz_ip_method_handle();
1125 +
1126 +</script>
1052 1127
1053 1128 <div id="" class="postbox">
1054 1129
1055 1130 <button class="handlediv button-link" aria-expanded="true" type="button">
@@ -1137,8 +1212,37 @@
1137 1212 // Load the blacklist and whitelist
1138 1213 $loginizer['blacklist'] = get_option('loginizer_blacklist');
1139 1214 $loginizer['whitelist'] = get_option('loginizer_whitelist');
1140 1215
1216 + // Disable Brute Force
1217 + if(isset($_POST['disable_brute_lz'])){
1218 +
1219 + // Save the options
1220 + update_option('loginizer_disable_brute', 1);
1221 +
1222 + $loginizer['disable_brute'] = 1;
1223 +
1224 + echo '<div id="message" class="updated"><p>'
1225 + . __('The Brute Force Protection feature is now disabled', 'loginizer')
1226 + . '</p></div><br />';
1227 +
1228 + }
1229 +
1230 + // Enable brute force
1231 + if(isset($_POST['enable_brute_lz'])){
1232 +
1233 + // Save the options
1234 + update_option('loginizer_disable_brute', 0);
1235 +
1236 + $loginizer['disable_brute'] = 0;
1237 +
1238 + echo '<div id="message" class="updated"><p>'
1239 + . __('The Brute Force Protection feature is now enabled', 'loginizer')
1240 + . '</p></div><br />';
1241 +
1242 + }
1243 +
1244 + // The Brute Force Settings
1141 1245 if(isset($_POST['save_lz'])){
1142 1246
1143 1247 $max_retries = (int) lz_optpost('max_retries');
1144 1248 $lockout_time = (int) lz_optpost('lockout_time');
@@ -1181,9 +1285,9 @@
1181 1285
1182 1286 }
1183 1287
1184 1288 // Delete a Blackist IP range
1185 - if(isset($_GET['bdelid'])){
1289 + if(isset($_POST['bdelid'])){
1186 1290
1187 1291 $delid = (int) lz_optreq('bdelid');
1188 1292
1189 1293 // Unset and save
@@ -1196,10 +1300,22 @@
1196 1300 . '</p></div><br />';
1197 1301
1198 1302 }
1199 1303
1304 + // Delete all Blackist IP ranges
1305 + if(isset($_POST['del_all_blacklist'])){
1306 +
1307 + // Unset and save
1308 + update_option('loginizer_blacklist', array());
1309 +
1310 + echo '<div id="message" class="updated fade"><p>'
1311 + . __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1312 + . '</p></div><br />';
1313 +
1314 + }
1315 +
1200 1316 // Delete a Whitelist IP range
1201 - if(isset($_GET['delid'])){
1317 + if(isset($_POST['delid'])){
1202 1318
1203 1319 $delid = (int) lz_optreq('delid');
1204 1320
1205 1321 // Unset and save
@@ -1212,8 +1328,20 @@
1212 1328 . '</p></div><br />';
1213 1329
1214 1330 }
1215 1331
1332 + // Delete all Blackist IP ranges
1333 + if(isset($_POST['del_all_whitelist'])){
1334 +
1335 + // Unset and save
1336 + update_option('loginizer_whitelist', array());
1337 +
1338 + echo '<div id="message" class="updated fade"><p>'
1339 + . __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1340 + . '</p></div><br />';
1341 +
1342 + }
1343 +
1216 1344 // Reset All Logs
1217 1345 if(isset($_POST['lz_reset_all_ip'])){
1218 1346
1219 1347 $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
@@ -1283,12 +1411,12 @@
1283 1411 $error[] = 'Please provide a valid end IP';
1284 1412 }
1285 1413
1286 1414 // Regular ranges will work
1287 - if(ip2long($start_ip) > ip2long($end_ip)){
1415 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1288 1416
1289 1417 // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1290 - if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1418 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1291 1419 // This is right
1292 1420 }else{
1293 1421 $error[] = 'The End IP cannot be smaller than the Start IP';
1294 1422 }
@@ -1301,10 +1429,10 @@
1301 1429
1302 1430 foreach($blacklist as $k => $v){
1303 1431
1304 1432 // This is to check if there is any other range exists with the same Start or End IP
1305 - if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1306 - || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1433 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1434 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1307 1435 ){
1308 1436 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1309 1437 break;
1310 1438 }
@@ -1309,15 +1437,15 @@
1309 1437 break;
1310 1438 }
1311 1439
1312 1440 // This is to check if there is any other range exists with the same Start IP
1313 - if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1441 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1314 1442 $error[] = 'The Start IP is present in an existing range !';
1315 1443 break;
1316 1444 }
1317 1445
1318 1446 // This is to check if there is any other range exists with the same End IP
1319 - if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1447 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1320 1448 $error[] = 'The End IP is present in an existing range!';
1321 1449 break;
1322 1450 }
1323 1451
@@ -1369,12 +1497,12 @@
1369 1497 if(!lz_valid_ip($end_ip)){
1370 1498 $error[] = 'Please provide a valid end IP';
1371 1499 }
1372 1500
1373 - if(ip2long($start_ip) > ip2long($end_ip)){
1501 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1374 1502
1375 1503 // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1376 - if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1504 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1377 1505 // This is right
1378 1506 }else{
1379 1507 $error[] = 'The End IP cannot be smaller than the Start IP';
1380 1508 }
@@ -1387,10 +1515,10 @@
1387 1515
1388 1516 foreach($whitelist as $k => $v){
1389 1517
1390 1518 // This is to check if there is any other range exists with the same Start or End IP
1391 - if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1392 - || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1519 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1520 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1393 1521 ){
1394 1522 $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1395 1523 break;
1396 1524 }
@@ -1395,15 +1523,15 @@
1395 1523 break;
1396 1524 }
1397 1525
1398 1526 // This is to check if there is any other range exists with the same Start IP
1399 - if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1527 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1400 1528 $error[] = 'The Start IP is present in an existing range !';
1401 1529 break;
1402 1530 }
1403 1531
1404 1532 // This is to check if there is any other range exists with the same End IP
1405 - if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1533 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1406 1534 $error[] = 'The End IP is present in an existing range!';
1407 1535 break;
1408 1536 }
1409 1537
@@ -1431,9 +1559,24 @@
1431 1559 if(!empty($error)){
1432 1560 lz_report_error($error);echo '<br />';
1433 1561 }
1434 1562 }
1435 -
1563 +
1564 + // Save the messages
1565 + if(isset($_POST['save_err_msgs_lz'])){
1566 +
1567 + $msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1568 + $msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1569 +
1570 + // Update them
1571 + update_option('loginizer_msg', $msgs);
1572 +
1573 + echo '<div id="message" class="updated fade"><p>'
1574 + . __('Error messages were saved successfully', 'loginizer')
1575 + . '</p></div><br />';
1576 +
1577 + }
1578 +
1436 1579 // Count the Results
1437 1580 $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1438 1581 //print_r($tmp);
1439 1582
@@ -1457,8 +1600,10 @@
1457 1600 // Reload the settings
1458 1601 $loginizer['blacklist'] = get_option('loginizer_blacklist');
1459 1602 $loginizer['whitelist'] = get_option('loginizer_whitelist');
1460 1603
1604 + $saved_msgs = get_option('loginizer_msg');
1605 +
1461 1606 ?>
1462 1607
1463 1608 <div id="" class="postbox">
1464 1609
@@ -1502,11 +1647,13 @@
1502 1647 <table class="wp-list-table widefat fixed users" border="0">
1503 1648 <tr>
1504 1649 <th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
1505 1650 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1651 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
1506 1652 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1507 1653 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1508 - <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('Lockouts Count','loginizer'); ?></th>
1654 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
1655 + <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
1509 1656 </tr>
1510 1657 <?php
1511 1658
1512 1659 if(empty($result)){
@@ -1527,8 +1674,11 @@
1527 1674 <td>
1528 1675 '.$iv['ip'].'
1529 1676 </td>
1530 1677 <td>
1678 + '.$iv['username'].'
1679 + </td>
1680 + <td>
1531 1681 '.date('d/m/Y H:i:s', $iv['time']).'
1532 1682 </td>
1533 1683 <td>
1534 1684 '.$iv['count'].'
@@ -1535,8 +1685,11 @@
1535 1685 </td>
1536 1686 <td>
1537 1687 '.$iv['lockout'].'
1538 1688 </td>
1689 + <td>
1690 + '.$iv['url'].'
1691 + </td>
1539 1692 </tr>';
1540 1693 }
1541 1694 }
1542 1695
@@ -1606,8 +1759,21 @@
1606 1759 </td>
1607 1760 </tr>
1608 1761 </table><br />
1609 1762 <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1763 + <?php
1764 +
1765 + if(empty($loginizer['disable_brute'])){
1766 +
1767 + echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1768 +
1769 + }else{
1770 +
1771 + echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1772 +
1773 + }
1774 +
1775 + ?>
1610 1776 </form>
1611 1777
1612 1778 </div>
1613 1779 </div>
@@ -1612,8 +1778,69 @@
1612 1778 </div>
1613 1779 </div>
1614 1780 <br />
1615 1781
1782 +<?php
1783 +
1784 + wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
1785 +
1786 +?>
1787 +
1788 +<style>
1789 +.page-navigation a {
1790 +margin: 5px 2px;
1791 +display: inline-block;
1792 +padding: 5px 8px;
1793 +color: #0073aa;
1794 +background: #e5e5e5 none repeat scroll 0 0;
1795 +border: 1px solid #ccc;
1796 +text-decoration: none;
1797 +transition-duration: 0.05s;
1798 +transition-property: border, background, color;
1799 +transition-timing-function: ease-in-out;
1800 +}
1801 +
1802 +.page-navigation a[data-selected] {
1803 +background-color: #00a0d2;
1804 +color: #fff;
1805 +}
1806 +</style>
1807 +
1808 +<script>
1809 +
1810 +jQuery(document).ready(function(){
1811 + jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
1812 + jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
1813 +});
1814 +
1815 +// Delete a Blacklist / Whitelist IP Range
1816 +function del_confirm(field, todo_id, msg){
1817 + var ret = confirm(msg);
1818 +
1819 + if(ret){
1820 + jQuery('#lz_bl_wl_todo').attr('name', field);
1821 + jQuery('#lz_bl_wl_todo').val(todo_id);
1822 + jQuery('#lz_bl_wl_form').submit();
1823 + }
1824 +
1825 + return false;
1826 +
1827 +}
1828 +
1829 +// Delete all Blacklist / Whitelist IP Ranges
1830 +function del_confirm_all(msg){
1831 + var ret = confirm(msg);
1832 +
1833 + if(ret){
1834 + return true;
1835 + }
1836 +
1837 + return false;
1838 +
1839 +}
1840 +
1841 +</script>
1842 +
1616 1843 <div id="" class="postbox">
1617 1844
1618 1845 <button class="handlediv button-link" aria-expanded="true" type="button">
1619 1846 <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
@@ -1643,13 +1870,15 @@
1643 1870 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1644 1871 </td>
1645 1872 </tr>
1646 1873 </table><br />
1647 - <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1874 + <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1875 + <input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
1648 1876 </form>
1649 1877 </div>
1650 1878
1651 - <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1879 + <div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
1880 + <table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1652 1881 <tr>
1653 1882 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1654 1883 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1655 1884 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
@@ -1676,9 +1905,9 @@
1676 1905 <td>
1677 1906 '.date('d/m/Y', $iv['time']).'
1678 1907 </td>
1679 1908 <td>
1680 - <a class="submitdelete" href="admin.php?page=loginizer_brute_force&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1909 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
1681 1910 </td>
1682 1911 </tr>';
1683 1912 }
1684 1913 }
@@ -1684,9 +1913,12 @@
1684 1913 }
1685 1914 ?>
1686 1915 </table>
1687 1916 <br />
1688 -
1917 + <form action="" method="post" id="lz_bl_wl_form">
1918 + <?php wp_nonce_field('loginizer-options'); ?>
1919 + <input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
1920 + </form>
1689 1921 </div>
1690 1922
1691 1923 <br />
1692 1924
@@ -1719,13 +1951,15 @@
1719 1951 <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
1720 1952 </td>
1721 1953 </tr>
1722 1954 </table><br />
1723 - <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1955 + <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1956 + <input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
1724 1957 </form>
1725 1958 </div>
1726 1959
1727 - <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1960 + <div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
1961 + <table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1728 1962 <tr>
1729 1963 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1730 1964 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1731 1965 <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
@@ -1752,9 +1986,9 @@
1752 1986 <td>
1753 1987 '.date('d/m/Y', $iv['time']).'
1754 1988 </td>
1755 1989 <td>
1756 - <a class="submitdelete" href="admin.php?page=loginizer_brute_force&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1990 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
1757 1991 </td>
1758 1992 </tr>';
1759 1993 }
1760 1994 }
@@ -1762,9 +1996,44 @@
1762 1996 </table>
1763 1997 <br />
1764 1998
1765 1999 </div>
1766 -
2000 +
2001 + <div id="" class="postbox">
2002 +
2003 + <button class="handlediv button-link" aria-expanded="true" type="button">
2004 + <span class="screen-reader-text">Toggle panel: Error Messages</span>
2005 + <span class="toggle-indicator" aria-hidden="true"></span>
2006 + </button>
2007 +
2008 + <h2 class="hndle ui-sortable-handle">
2009 + <span><?php echo __('Error Messages', 'loginizer'); ?></span>
2010 + </h2>
2011 +
2012 + <div class="inside">
2013 +
2014 + <form action="" method="post" enctype="multipart/form-data">
2015 + <?php wp_nonce_field('loginizer-options'); ?>
2016 + <table class="form-table">
2017 + <tr>
2018 + <th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2019 + <td>
2020 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2021 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['inv_userpass']. '&quot;</em>', 'loginizer'); ?><br />
2022 + </td>
2023 + </tr>
2024 + <tr>
2025 + <th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2026 + <td>
2027 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2028 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['ip_blacklisted']. '&quot;</em>', 'loginizer'); ?><br />
2029 + </td>
2030 + </tr>
2031 + </table><br />
2032 + <input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2033 + </form>
2034 + </div>
2035 + </div>
1767 2036 <?php
1768 2037
1769 2038 loginizer_page_footer();
1770 2039
@@ -1789,7 +2058,10 @@
1789 2058 delete_option('loginizer_options');
1790 2059 delete_option('loginizer_last_reset');
1791 2060 delete_option('loginizer_whitelist');
1792 2061 delete_option('loginizer_blacklist');
2062 + delete_option('loginizer_msg');
2063 + delete_option('loginizer_security');
2064 + delete_option('loginizer_wp_admin');
1793 2065
1794 2066 }
1795 2067