PluginProbe
Loginizer / 1.4.2
Loginizer v1.4.2
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | init.php +1513 -480 2.0.0 → 1.4.2 View file →
@@ -4,13 +4,12 @@
4 4 echo 'You are not allowed to access this page directly.';
5 5 exit;
6 6 }
7 7
8 -define('LOGINIZER_VERSION', '2.0.0');
9 -define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
8 +define('LOGINIZER_VERSION', '1.4.2');
9 +define('LOGINIZER_DIR', WP_PLUGIN_DIR.'/'.basename(dirname(LOGINIZER_FILE)));
10 10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12 -define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13 12 define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14 13
15 14 include_once(LOGINIZER_DIR.'/functions.php');
16 15
@@ -24,9 +23,9 @@
24 23
25 24 $sql = array();
26 25
27 26 $sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28 -
27 +
29 28 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30 29 `username` varchar(255) NOT NULL DEFAULT '',
31 30 `time` int(10) NOT NULL DEFAULT '0',
32 31 `count` int(10) NOT NULL DEFAULT '0',
@@ -33,9 +32,9 @@
33 32 `lockout` int(10) NOT NULL DEFAULT '0',
34 33 `ip` varchar(255) NOT NULL DEFAULT '',
35 34 `url` varchar(255) NOT NULL DEFAULT '',
36 35 UNIQUE KEY `ip` (`ip`)
37 - ) DEFAULT CHARSET=utf8;";
36 + ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
38 37
39 38 foreach($sql as $sk => $sv){
40 39 $wpdb->query($sv);
41 40 }
@@ -44,24 +43,12 @@
44 43 add_option('loginizer_options', array());
45 44 add_option('loginizer_last_reset', 0);
46 45 add_option('loginizer_whitelist', array());
47 46 add_option('loginizer_blacklist', array());
48 - add_option('loginizer_2fa_whitelist', array());
49 -
50 - // TODO:: REMOVE THIS AFTER MARCH 2025
51 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
52 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
53 - loginizer_check_softaculous();
54 - }
47 +
55 48 }
56 49
57 -/**
58 - * Updates the database structure for Loginizer
59 - *
60 - * If the plugin files are updated but database structure is not updated
61 - * this function will update the database structure as per the plugin version
62 - * NOTE: This does not update plugin files it just updates the database structure
63 - */
50 +// Checks if we are to update ?
64 51 function loginizer_update_check(){
65 52
66 53 global $wpdb;
67 54
@@ -89,9 +76,9 @@
89 76 // Trick the following if conditions to not run
90 77 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
91 78
92 79 }
93 -
80 +
94 81 // Is it less than 1.0.1 ?
95 82 if($version < 101){
96 83
97 84 // TODO : GET the existing settings
@@ -121,17 +108,9 @@
121 108
122 109 // Update the existing failed logs to new table
123 110 if(is_array($lz_failed_logs)){
124 111 foreach($lz_failed_logs as $fk => $fv){
125 - $insert_data = array('username' => $fv['username'],
126 - 'time' => $fv['time'],
127 - 'count' => $fv['count'],
128 - 'lockout' => $fv['lockout'],
129 - 'ip' => $fv['ip']);
130 -
131 - $format = array('%s','%d','%d','%d','%s');
132 -
133 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
112 + $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
134 113 }
135 114 }
136 115
137 116 // Update the existing options to new structure
@@ -190,20 +169,8 @@
190 169
191 170 // Save the new Version
192 171 update_option('loginizer_version', LOGINIZER_VERSION);
193 172
194 - // TODO:: REMOVE THIS AFTER MARCH 2025
195 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
196 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
197 - loginizer_check_softaculous();
198 - }
199 -
200 - // In Sitepad Math Captcha is enabled by default
201 - if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
202 - $option['captcha_no_google'] = 1;
203 - add_option('loginizer_captcha', $option);
204 - }
205 -
206 173 }
207 174
208 175 // Add the action to load the plugin
209 176 add_action('plugins_loaded', 'loginizer_load_plugin');
@@ -214,19 +181,12 @@
214 181 global $loginizer;
215 182
216 183 // Check if the installed version is outdated
217 184 loginizer_update_check();
218 -
185 +
219 186 // Set the array
220 - if(empty($loginizer)){
221 - $loginizer = array();
222 - }
187 + $loginizer = array();
223 188
224 - $loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
225 - $loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
226 - $loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
227 - $loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
228 -
229 189 // The IP Method to use
230 190 $loginizer['ip_method'] = get_option('loginizer_ip_method');
231 191 if($loginizer['ip_method'] == 3){
232 192 $loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
@@ -239,34 +199,25 @@
239 199 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
240 200 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
241 201 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
242 202 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
243 - $loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
244 - $loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
245 - $loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
246 - $loginizer['social_settings'] = get_option('loginizer_social_settings', []);
247 203
248 - if(!empty($options['notify_email_address'])){
249 - $loginizer['notify_email_address'] = $options['notify_email_address'];
250 - $loginizer['custom_notify_email'] = 1;
251 - }
204 + // Default messages
205 + $loginizer['d_msg']['inv_userpass'] = 'Incorrect Username or Password';
206 + $loginizer['d_msg']['ip_blacklisted'] = 'Your IP has been blacklisted';
252 207
253 - // Login Success Email Notification.
254 - $loginizer['login_mail'] = get_option('loginizer_login_mail', []);
255 - add_action('init', 'loginizer_load_translation_vars', 0);
256 -
257 - $loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
258 - $loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];
259 -
260 - // Load the blacklist and whitelist
261 - $loginizer['blacklist'] = get_option('loginizer_blacklist', []);
262 - $loginizer['whitelist'] = get_option('loginizer_whitelist', []);
263 - $loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
208 + // Message Strings
209 + $loginizer['msg'] = get_option('loginizer_msg');
264 210
265 - // It should not be false
266 - if(empty($loginizer['2fa_whitelist'])){
267 - $loginizer['2fa_whitelist'] = array();
211 + foreach($loginizer['d_msg'] as $lk => $lv){
212 + if(empty($loginizer['msg'][$lk])){
213 + $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
214 + }
268 215 }
216 +
217 + // Load the blacklist and whitelist
218 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
219 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
269 220
270 221 // When was the database cleared last time
271 222 $loginizer['last_reset'] = get_option('loginizer_last_reset');
272 223
@@ -305,86 +256,156 @@
305 256 // Is called before displaying the error message so that we dont show that the username is wrong or the password
306 257 // Update Error message
307 258 add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
308 259 add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
309 - add_action('wp_login', 'loginizer_login_success', 10, 2);
310 -
311 - if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
312 - add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
313 - }
260 +
314 261 }
315 262
316 - // Social Login Form Actions
317 - if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
318 - if(!empty($loginizer['social_settings']['login']['login_form'])){
319 - add_action('login_form', 'loginizer_social_btn_login');
263 + // Is the premium features there ?
264 + if(file_exists(LOGINIZER_DIR.'/premium.php')){
265 +
266 + // Include the file
267 + include_once(LOGINIZER_DIR.'/premium.php');
268 +
269 + loginizer_security_init();
270 +
271 + // Its the free version
272 + }else{
273 +
274 + // The promo time
275 + $loginizer['promo_time'] = get_option('loginizer_promo_time');
276 + if(empty($loginizer['promo_time'])){
277 + $loginizer['promo_time'] = time();
278 + update_option('loginizer_promo_time', $loginizer['promo_time']);
320 279 }
280 +
281 + // Are we to show the loginizer promo
282 + if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
283 +
284 + add_action('admin_notices', 'loginizer_promo');
285 +
286 + }
287 +
288 + // Are we to disable the promo
289 + if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
290 + update_option('loginizer_promo_time', (0 - time()) );
291 + die('DONE');
292 + }
293 +
321 294 }
322 295
323 - if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){
324 - include_once LOGINIZER_DIR . '/main/ajax.php';
325 - }
296 +}
326 297
327 - if(is_admin()){
328 - include_once LOGINIZER_DIR . '/main/admin.php';
329 - }
298 +// Show the promo
299 +function loginizer_promo(){
300 +
301 + echo '
302 +<style>
303 +.lz_button {
304 +background-color: #4CAF50; /* Green */
305 +border: none;
306 +color: white;
307 +padding: 8px 16px;
308 +text-align: center;
309 +text-decoration: none;
310 +display: inline-block;
311 +font-size: 16px;
312 +margin: 4px 2px;
313 +-webkit-transition-duration: 0.4s; /* Safari */
314 +transition-duration: 0.4s;
315 +cursor: pointer;
316 +}
330 317
331 - // ----------------
332 - // PRO INIT END
333 - // ----------------
334 -
335 - // Is the premium features there ?
336 - if(!defined('LOGINIZER_PREMIUM')){
337 -
338 - if(current_user_can('activate_plugins')){
339 - // The promo time
340 - $loginizer['promo_time'] = get_option('loginizer_promo_time');
341 - if(empty($loginizer['promo_time'])){
342 - $loginizer['promo_time'] = time();
343 - update_option('loginizer_promo_time', $loginizer['promo_time']);
344 - }
318 +.lz_button:focus{
319 +border: none;
320 +color: white;
321 +}
322 +
323 +.lz_button1 {
324 +color: white;
325 +background-color: #4CAF50;
326 +border:3px solid #4CAF50;
327 +}
328 +
329 +.lz_button1:hover {
330 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
331 +color: white;
332 +border:3px solid #4CAF50;
333 +}
334 +
335 +.lz_button2 {
336 +color: white;
337 +background-color: #0085ba;
338 +}
339 +
340 +.lz_button2:hover {
341 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
342 +color: white;
343 +}
344 +
345 +.lz_button3 {
346 +color: white;
347 +background-color: #365899;
348 +}
349 +
350 +.lz_button3:hover {
351 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
352 +color: white;
353 +}
354 +
355 +.lz_button4 {
356 +color: white;
357 +background-color: rgb(66, 184, 221);
358 +}
359 +
360 +.lz_button4:hover {
361 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
362 +color: white;
363 +}
364 +
365 +.loginizer_promo-close{
366 +float:right;
367 +text-decoration:none;
368 +margin: 5px 10px 0px 0px;
369 +}
370 +
371 +.loginizer_promo-close:hover{
372 +color: red;
373 +}
374 +</style>
375 +
376 +<script>
377 +jQuery(document).ready( function() {
378 + (function($) {
379 + $("#loginizer_promo .loginizer_promo-close").click(function(){
380 + var data;
345 381
346 - // Are we to show the loginizer promo
347 - if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
382 + // Hide it
383 + $("#loginizer_promo").hide();
348 384
349 - add_action('admin_notices', 'loginizer_promo');
350 -
351 - }
352 -
353 - if(!empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
354 -
355 - add_action('admin_notices', 'loginizer_csrf_promo');
356 -
357 - }
358 -
359 - // Are we to disable the promo
360 - if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
361 - update_option('loginizer_promo_time', (0 - time()) );
362 - die('DONE');
363 - }
364 -
365 - $loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
366 -
367 - if(empty($loginizer['backuply_promo'])){
368 - $loginizer['backuply_promo'] = abs($loginizer['promo_time']);
369 - update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
370 - }
371 -
372 - // Setting CSRF Promo time
373 - $loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
374 -
375 - if(empty($loginizer['csrf_promo'])){
376 - $loginizer['csrf_promo'] = abs($loginizer['promo_time']);
377 - update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
378 - }
379 - }
380 - }
381 -
382 - // Secuity checks for social login.
383 - if(!empty($_GET['lz_social_provider']) && loginizer_can_login()){
384 - include_once LOGINIZER_DIR . '/main/social-login.php';
385 - return;
386 - }
385 + // Save this preference
386 + $.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
387 + //alert(response);
388 + });
389 + });
390 + })(jQuery);
391 +});
392 +</script>
393 +
394 +<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
395 + <a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
396 + <span class="dashicons dashicons-dismiss"></span> Dismiss
397 + </a>
398 + <img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
399 + <p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
400 + <p>
401 + <a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
402 + <a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5★\'s</a>
403 + <a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
404 + <a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
405 + </p>
406 +</div>';
407 +
387 408 }
388 409
389 410 // Should return NULL if everything is fine
390 411 function loginizer_wp_authenticate($user, $username, $password){
@@ -398,36 +419,13 @@
398 419 // Are you whitelisted ?
399 420 if(loginizer_is_whitelisted()){
400 421 $loginizer['ip_is_whitelisted'] = 1;
401 422 return $user;
402 -
403 - } else if (!empty($loginizer['trusted_ips'])){
404 - $lz_cannot_login = 1;
405 -
406 - // This is used by WP Activity Log
407 - apply_filters( 'wp_login_blocked', $username );
408 -
409 - // Shows a blocked screen
410 - if(!empty($loginizer['blocked_screen'])){
411 - $lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
412 - loginizer_blocked_page($lz_error);
413 - }
414 -
415 - return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
416 423 }
417 424
418 425 // Are you blacklisted ?
419 426 if(loginizer_is_blacklisted()){
420 427 $lz_cannot_login = 1;
421 -
422 - // This is used by WP Activity Log
423 - apply_filters( 'wp_login_blocked', $username );
424 -
425 - // Shows a blocked screen
426 - if(!empty($loginizer['blocked_screen'])){
427 - loginizer_blocked_page($lz_error);
428 - }
429 -
430 428 return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
431 429 }
432 430
433 431 // Is the username blacklisted ?
@@ -433,12 +431,8 @@
433 431 // Is the username blacklisted ?
434 432 if(function_exists('loginizer_user_blacklisted')){
435 433 if(loginizer_user_blacklisted($username)){
436 434 $lz_cannot_login = 1;
437 -
438 - // This is used by WP Activity Log
439 - apply_filters( 'wp_login_blocked', $username );
440 -
441 435 return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
442 436 }
443 437 }
444 438
@@ -446,19 +440,11 @@
446 440 return $user;
447 441 }
448 442
449 443 $lz_cannot_login = 1;
450 -
451 - // This is used by WP Activity Log
452 - apply_filters( 'wp_login_blocked', $username );
453 444
454 - // Shows a blocked screen
455 - if(!empty($loginizer['blocked_screen'])){
456 - loginizer_blocked_page($lz_error);
457 - }
445 + return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
458 446
459 - return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
460 -
461 447 }
462 448
463 449 function loginizer_can_login(){
464 450
@@ -464,13 +450,12 @@
464 450
465 451 global $wpdb, $loginizer, $lz_error;
466 452
467 453 // Get the logs
468 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
469 - $result = lz_selectquery($sel_query);
454 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
470 455
471 456 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
472 -
457 +
473 458 // Has he reached max lockouts ?
474 459 if($result['lockout'] >= $loginizer['max_lockouts']){
475 460 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
476 461 }
@@ -478,20 +463,20 @@
478 463 // Is he in the lockout time ?
479 464 if($result['time'] >= (time() - $loginizer['lockout_time'])){
480 465 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
481 466
482 - //echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
483 - //echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
484 - //echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
467 + //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
468 + //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
469 + //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
485 470
486 - $_time = $banlift.' '.$loginizer['msg']['minutes_err'];
471 + $_time = $banlift.' minute(s)';
487 472
488 473 if($banlift > 60){
489 474 $banlift = ceil($banlift / 60);
490 - $_time = $banlift.' '.$loginizer['msg']['hours_err'];
475 + $_time = $banlift.' hour(s)';
491 476 }
492 477
493 - $lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
478 + $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
494 479
495 480 return false;
496 481 }
497 482 }
@@ -502,14 +487,10 @@
502 487 function loginizer_is_blacklisted(){
503 488
504 489 global $wpdb, $loginizer, $lz_error;
505 490
506 - $blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
507 -
508 - if(empty($blacklist)){
509 - return false;
510 - }
511 -
491 + $blacklist = $loginizer['blacklist'];
492 +
512 493 foreach($blacklist as $k => $v){
513 494
514 495 // Is the IP in the blacklist ?
515 496 if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
@@ -549,12 +530,8 @@
549 530 global $wpdb, $loginizer, $lz_error;
550 531
551 532 $whitelist = $loginizer['whitelist'];
552 533
553 - if(empty($whitelist)){
554 - return false;
555 - }
556 -
557 534 foreach($whitelist as $k => $v){
558 535
559 536 // Is the IP in the blacklist ?
560 537 if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
@@ -587,78 +564,40 @@
587 564 return false;
588 565
589 566 }
590 567
568 +
591 569 // When the login fails, then this is called
592 570 // We need to update the database
593 -function loginizer_login_failed($username, $is_2fa = ''){
571 +function loginizer_login_failed($username){
594 572
595 573 global $wpdb, $loginizer, $lz_cannot_login;
596 -
597 - // Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
598 - if(empty($username) || is_null($username)){
599 - $username = '';
600 - }
601 -
602 - $fail_type = 'Login';
603 -
604 - if(!empty($is_2fa)){
605 - $fail_type = '2FA';
606 - }
607 574
608 575 if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
609 576
610 - // The params which comes when social login returns an error, have some characters, which WordPress could not save.
611 - $server_uri = $_SERVER['REQUEST_URI'];
612 - if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
613 - $request_uri = explode('=', $_SERVER['REQUEST_URI']);
614 - $server_uri = $request_uri[0];
615 - }
616 -
617 - $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
577 + $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
618 578 $url = esc_url($url);
619 579
620 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
621 - $result = lz_selectquery($sel_query);
580 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
622 581
623 582 if(!empty($result)){
624 583 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
584 + $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."', `url` = '".$url."' WHERE `ip` = '".$loginizer['current_ip']."';");
625 585
626 - $update_data = array('username' => $username,
627 - 'time' => time(),
628 - 'count' => $result['count']+1,
629 - 'lockout' => $lockout,
630 - 'url' => $url);
631 -
632 - $where_data = array('ip' => $loginizer['current_ip']);
633 -
634 - $format = array('%s','%d','%d','%d','%s');
635 - $where_format = array('%s');
636 -
637 - $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
638 -
639 586 // Do we need to email admin ?
640 587 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
641 588
642 - $lockout_time = $loginizer['lockout_time'];
643 -
644 - if($lockout >= $loginizer['max_lockouts']){
645 - // extended lockout is in hours so we have to convert to minute
646 - $lockout_time = $loginizer['lockouts_extend'];
647 - }
648 -
649 589 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
650 590 $mail = array();
651 - $mail['to'] = $loginizer['notify_email_address'];
652 - $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
591 + $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
592 + $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
653 593 $mail['message'] = 'Hi,
654 594
655 -'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
656 -'.home_url().'
595 +'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
657 596
658 -Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
597 +Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
659 598 Last User Attempt : '.$username.'
660 -IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
599 +IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
661 600
662 601 Regards,
663 602 Loginizer';
664 603
@@ -664,26 +603,13 @@
664 603
665 604 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
666 605 }
667 606 }else{
668 - $result = array();
669 - $result['count'] = 0;
670 -
671 - $insert_data = array('username' => $username,
672 - 'time' => time(),
673 - 'count' => 1,
674 - 'ip' => $loginizer['current_ip'],
675 - 'lockout' => 0,
676 - 'url' => $url);
677 -
678 - $format = array('%s','%d','%d','%s','%d','%s');
679 -
680 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
607 + $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0', `url` = '".$url."';");
681 608 }
682 609
683 610 // We need to add one as this is a failed attempt as well
684 611 $result['count'] = $result['count'] + 1;
685 - loginizer_update_attempt_stats(0);
686 612 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
687 613 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
688 614
689 615 }
@@ -688,314 +614,1433 @@
688 614
689 615 }
690 616 }
691 617
692 -function loginizer_login_success($user_login, $user) {
693 - global $wp_version, $loginizer;
694 -
695 - loginizer_update_attempt_stats(1);
618 +// Handles the error of the password not being there
619 +function loginizer_error_handler($errors, $redirect_to){
696 620
697 - if(empty($loginizer['login_mail'])){
698 - return;
621 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
622 +
623 + //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
624 +
625 + // Remove the empty password error
626 + if(is_wp_error($errors)){
627 +
628 + $codes = $errors->get_error_codes();
629 +
630 + foreach($codes as $k => $v){
631 + if($v == 'invalid_username' || $v == 'incorrect_password'){
632 + $show_error = 1;
633 + }
634 + }
635 +
636 + $errors->remove('invalid_username');
637 + $errors->remove('incorrect_password');
638 +
699 639 }
700 -
701 - if(empty($loginizer['login_mail']['enable'])){
702 - return;
640 +
641 + // Add the error
642 + if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
643 + $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
703 644 }
704 -
705 - if(!empty($loginizer['login_mail']['disable_whitelist'])){
706 - // Check its whitelist ip
707 - if(loginizer_is_whitelisted()){
708 - return;
709 - }
645 +
646 + // Add the number of retires left as well
647 + if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
648 + $errors->add('retries_left', loginizer_retries_left());
710 649 }
650 +
651 + return $errors;
652 +
653 +}
711 654
712 - if(empty($user_login) && empty($user)){
713 - error_log('Loginizer: No user information to send email');
714 - return;
715 - }
716 655
717 - if(empty($user)){
718 - $user = get_user_by('login', $user_login);
719 - }
720 656
721 - if(empty($user)){
722 - error_log('Loginizer: Unable to get the user');
723 - return;
657 +// Handles the error of the password not being there
658 +function loginizer_woocommerce_error_handler(){
659 +
660 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
661 +
662 + if(function_exists('wc_add_notice')){
663 + wc_add_notice( loginizer_retries_left(), 'error' );
724 664 }
665 +
666 +}
725 667
726 - if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
727 - return;
668 +// Returns a string with the number of retries left
669 +function loginizer_retries_left(){
670 +
671 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
672 +
673 + // If we are to show the number of retries left
674 + if(isset($loginizer['retries_left'])){
675 + return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
728 676 }
677 +
678 +}
729 679
730 - // Check if the user role is enabled for email notification.
731 - if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){
732 - return;
733 - }
680 +function loginizer_reset_retries(){
681 +
682 + global $wpdb, $loginizer;
683 +
684 + $deltime = time() - $loginizer['reset_retries'];
685 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
686 +
687 + update_option('loginizer_last_reset', time());
688 +
689 +}
734 690
735 - // current_datetime & wp_timezone_string were introduced in WordPress 5.3
736 - if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){
737 - $time_zone = wp_timezone_string();
691 +add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
738 692
739 - if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){
740 - $time_zone = 'UTC'.$time_zone;
741 - }
742 -
743 - // Setting up data variables.
744 - $date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone;
745 - } else {
746 - $date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get();
693 +// Add settings link on plugin page
694 +function loginizer_plugin_action_links($links) {
695 +
696 + if(!defined('LOGINIZER_PREMIUM')){
697 + $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
747 698 }
748 699
749 - $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
750 - $email = $user->data->user_email;
700 + $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
701 + array_unshift($links, $settings_link);
702 +
703 + return $links;
704 +}
751 705
752 - $vars = array(
753 - 'date' => $date,
754 - 'ip' => esc_html($loginizer['current_ip']),
755 - 'sitename' => $sitename,
756 - 'user_login' => $user_login
757 - );
706 +add_action('admin_menu', 'loginizer_admin_menu');
758 707
759 - $message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
760 - $subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
708 +// Shows the admin menu of Loginizer
709 +function loginizer_admin_menu() {
761 710
762 - $headers = [];
711 + global $wp_version, $loginizer;
763 712
764 - // Do we need to send the email as HTML ?
765 - if(!empty($loginizer['login_mail']['html_mail'])){
766 - $headers[] = 'Content-Type: text/html; charset=UTF-8';
713 + // Add the menu page
714 + add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
715 +
716 + // Dashboard
717 + add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
718 +
719 + // Brute Force
720 + add_submenu_page('loginizer', __('Loginizer Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
721 +
722 + if(defined('LOGINIZER_PREMIUM')){
723 +
724 + // PasswordLess
725 + add_submenu_page('loginizer', __('Loginizer PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
767 726
768 - if(!empty($loginizer['login_mail']['body'])){
769 - $message = html_entity_decode($message);
770 - }else{
771 - $message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message);
772 - $message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message);
773 - }
727 + // Two Factor Auth
728 + add_submenu_page('loginizer', __('Loginizer Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
729 +
730 + // reCaptcha
731 + add_submenu_page('loginizer', __('Loginizer reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
732 +
733 + // Security Settings
734 + add_submenu_page('loginizer', __('Loginizer Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
735 +
736 + // Security Settings
737 + add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
738 +
739 + }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
740 +
741 + // Go Pro link
742 + add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
743 +
774 744 }
745 +
746 +}
775 747
776 - // Sending notification
777 - if(empty(wp_mail($email, $subject, $message, $headers))){
778 - error_log(__('There was a problem sending your email.', 'loginizer'));
779 - return;
780 - }
748 +// The Loginizer Admin Options Page
749 +function loginizer_page_header($title = 'Loginizer'){
750 + /*wp_enqueue_script('common');
751 + wp_enqueue_script('wp-lists');
752 + wp_enqueue_script('postbox');
753 + wp_nonce_field('closedpostboxes', 'closedpostboxesnonce', false);
754 +
755 + echo '
756 +<script>
757 +jQuery(document).ready( function() {
758 + //add_postbox_toggles("loginizer");
759 +});
760 +</script>';*/
761 +
762 +?>
763 +<style>
764 +.lz-right-ul{
765 + padding-left: 10px !important;
781 766 }
782 767
783 -function loginizer_update_attempt_stats($type){
768 +.lz-right-ul li{
769 + list-style: circle !important;
770 +}
771 +</style>
772 +<?php
773 +
774 + echo '<div style="margin: 10px 20px 0 2px;">
775 +<div class="metabox-holder columns-2">
776 +<div class="postbox-container">
777 +<div id="top-sortables" class="meta-box-sortables ui-sortable">
778 +
779 + <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
780 + <tr>
781 + <td valign="top"><h3>'.$title.'</h3></td>
782 + <td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
783 + <td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
784 + <td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>
785 + </tr>
786 + </table>
787 + <hr />
788 +
789 + <!--Main Table-->
790 + <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
791 + <tr>
792 + <td valign="top">';
784 793
785 - $stats = get_option('loginizer_login_attempt_stats', []);
786 - $time = strtotime(date('Y-m-d H:00:00'));
794 +}
795 +
796 +// The Loginizer Theme footer
797 +function loginizer_page_footer(){
787 798
788 - if(empty($stats[$time][$type])){
789 - $stats[$time][$type] = 0;
799 + echo '</td>
800 + <td width="200" valign="top" id="loginizer-right-bar">';
801 +
802 + if(!defined('LOGINIZER_PREMIUM')){
803 +
804 + echo '
805 + <div class="postbox" style="min-width:0px !important;">
806 + <h2 class="hndle ui-sortable-handle">
807 + <span>Premium Version</span>
808 + </h2>
809 + <div class="inside">
810 + <i>Upgrade to the premium version and get the following features </i>:<br>
811 + <ul class="lz-right-ul">
812 + <li>PasswordLess Login</li>
813 + <li>Two Factor Auth - Email</li>
814 + <li>Two Factor Auth - App</li>
815 + <li>Login Challenge Question</li>
816 + <li>reCAPTCHA</li>
817 + <li>Rename Login Page</li>
818 + <li>Disable XML-RPC</li>
819 + <li>And many more ...</li>
820 + </ul>
821 + <center><a class="button button-primary" href="https://loginizer.com/members/cart.php">Upgrade</a></center>
822 + </div>
823 + </div>';
824 +
825 + }else{
826 +
827 + echo '
828 + <div class="postbox" style="min-width:0px !important;">
829 + <h2 class="hndle ui-sortable-handle">
830 + <span>Recommendations</span>
831 + </h2>
832 + <div class="inside">
833 + <i>We recommed that you enable atleast one of the following security features</i>:<br>
834 + <ul class="lz-right-ul">
835 + <li>Rename Login Page</li>
836 + <li>Login Challenge Question</li>
837 + <li>reCAPTCHA</li>
838 + <li>Two Factor Auth - Email</li>
839 + <li>Two Factor Auth - App</li>
840 + <li>Change \'admin\' Username</li>
841 + </ul>
842 + </div>
843 + </div>';
790 844 }
845 +
846 + echo '</td>
847 + </tr>
848 + </table>
849 + <br />
850 + <div style="width:45%;background:#FFF;padding:15px; margin:auto">
851 + <b>Let your friends know that you have secured your website :</b>
852 + <form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
853 + <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
854 + &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
855 + </form>
856 +
857 + </div>
858 + <br />
859 +
860 + <script>
861 + function dotweet(ele){
862 + window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
863 + return false;
864 + }
865 + </script>
866 +
867 + <hr />
868 + <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.
791 869
792 - $stats[$time][$type] += 1;
870 +</div>
871 +</div>
872 +</div>
873 +</div>';
793 874
794 - update_option('loginizer_login_attempt_stats', $stats, false);
795 875 }
796 876
797 -// Handles the error of the password not being there
798 -function loginizer_error_handler($errors, $redirect_to){
877 +// The Loginizer Admin Options Page
878 +function loginizer_page_dashboard(){
799 879
800 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
880 + global $loginizer, $lz_error, $lz_env;
801 881
802 - //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
803 - if(is_null($errors) || empty($errors)){
804 - return true;
805 - }
806 -
807 - // Remove the empty password error
808 - if(is_wp_error($errors)){
882 + // Is there a license key ?
883 + if(isset($_POST['save_lz'])){
884 +
885 + $license = lz_optpost('lz_license');
809 886
810 - $codes = $errors->get_error_codes();
887 + // Check if its a valid license
888 + if(empty($license)){
889 + $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
890 + return loginizer_page_dashboard_T();
891 + }
811 892
812 - foreach($codes as $k => $v){
813 - if($v == 'invalid_username' || $v == 'incorrect_password'){
814 - $show_error = 1;
815 - }
893 + $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license, array('timeout' => 30));
894 +
895 + if(is_array($resp)){
896 + $json = json_decode($resp['body'], true);
897 + //print_r($json);
898 + }else{
899 +
900 + $lz_error['resp_invalid'] = __('The response was malformed<br>'.var_export($resp, true), 'loginizer');
901 + return loginizer_page_dashboard_T();
902 +
816 903 }
817 904
818 - $errors->remove('invalid_username');
819 - $errors->remove('incorrect_password');
905 + // Save the License
906 + if(empty($json['license'])){
907 +
908 + $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
909 + return loginizer_page_dashboard_T();
910 +
911 + }else{
912 +
913 + update_option('loginizer_license', $json);
914 +
915 + // Mark as saved
916 + $GLOBALS['lz_saved'] = true;
917 + }
918 +
919 + }
820 920
821 - // Add the error
822 - if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
823 - $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
921 +
922 + // Is there a IP Method ?
923 + if(isset($_POST['save_lz_ip_method'])){
924 +
925 + $ip_method = (int) lz_optpost('lz_ip_method');
926 + $custom_ip_method = lz_optpost('lz_custom_ip_method');
927 +
928 + if($ip_method >= 0 && $ip_method <= 3){
929 + update_option('loginizer_ip_method', $ip_method);
824 930 }
825 931
826 - // Add the number of retires left as well
827 - if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
828 - $errors->add('retries_left', loginizer_retries_left());
932 + // Custom Method name ?
933 + if($ip_method == 3){
934 + update_option('loginizer_custom_ip_method', $custom_ip_method);
829 935 }
830 -
936 +
831 937 }
832 938
833 - return $errors;
939 + loginizer_page_dashboard_T();
834 940
835 941 }
836 942
837 -// Handles the error of the password not being there
838 -function loginizer_woocommerce_error_handler(){
943 +// The Loginizer Admin Options Page - THEME
944 +function loginizer_page_dashboard_T(){
945 +
946 + global $loginizer, $lz_error, $lz_env;
839 947
840 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
841 -
842 - if(function_exists('wc_add_notice')){
843 - wc_add_notice( loginizer_retries_left(), 'error' );
844 - }
948 + loginizer_page_header('Loginizer Dashboard');
949 +?>
950 +<style>
951 +.welcome-panel{
952 + margin: 0px;
953 + padding: 10px;
845 954 }
846 955
847 -// Handles social login URL
848 -function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
849 - global $loginizer;
956 +input[type="text"], textarea, select {
957 + width: 70%;
958 +}
850 959
851 - loginizer_get_social_error();
960 +.form-table label{
961 + font-weight:bold;
962 +}
852 963
853 - if(empty($loginizer['social_errors'])){
854 - return $errors;
855 - }
964 +.exp{
965 + font-size:12px;
966 +}
967 +</style>
968 +
969 + <?php
970 + echo '<script src="https://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
856 971
857 - if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
858 - $errors = new WP_Error();
972 + // Saved ?
973 + if(!empty($GLOBALS['lz_saved'])){
974 + echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
859 975 }
860 -
861 - foreach($loginizer['social_errors'] as $key => $text){
862 - $errors->add($key, $text);
976 +
977 + // Any errors ?
978 + if(!empty($lz_error)){
979 + lz_report_error($lz_error);echo '<br />';
863 980 }
864 -
865 - return $errors;
866 -}
867 -
868 -// Returns a string with the number of retries left
869 -function loginizer_retries_left(){
870 981
871 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
982 + ?>
872 983
873 - // If we are to show the number of retries left
874 - if(isset($loginizer['retries_left'])){
875 - $retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
984 + <div class="postbox">
985 +
986 + <button class="handlediv button-link" aria-expanded="true" type="button">
987 + <span class="screen-reader-text">Toggle panel: Getting Started</span>
988 + <span class="toggle-indicator" aria-hidden="true"></span>
989 + </button>
876 990
877 - return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
878 - }
991 + <h2 class="hndle ui-sortable-handle">
992 + <span><?php echo __('Getting Started', 'loginizer'); ?></span>
993 + </h2>
994 +
995 + <div class="inside">
996 +
997 + <form action="" method="post" enctype="multipart/form-data">
998 + <?php wp_nonce_field('loginizer-options'); ?>
999 + <table class="form-table">
1000 + <tr>
1001 + <td scope="row" valign="top" colspan="2" style="line-height:150%">
1002 + <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
1003 + <?php
1004 + if(defined('LOGINIZER_PREMIUM')){
1005 + echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
1006 + }
1007 + ?>
1008 + </td>
1009 + </tr>
1010 + </table>
1011 + </form>
1012 +
1013 + </div>
1014 + </div>
879 1015
880 -}
1016 + <div class="postbox">
1017 +
1018 + <button class="handlediv button-link" aria-expanded="true" type="button">
1019 + <span class="screen-reader-text">Toggle panel: System Information</span>
1020 + <span class="toggle-indicator" aria-hidden="true"></span>
1021 + </button>
1022 +
1023 + <h2 class="hndle ui-sortable-handle">
1024 + <span><?php echo __('System Information', 'loginizer'); ?></span>
1025 + </h2>
1026 +
1027 + <div class="inside">
1028 +
1029 + <form action="" method="post" enctype="multipart/form-data">
1030 + <?php wp_nonce_field('loginizer-options'); ?>
1031 + <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1032 + <?php
1033 + echo '
1034 + <tr>
1035 + <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1036 + <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
1037 + </tr>';
1038 +
1039 + if(defined('LOGINIZER_PREMIUM')){
1040 + echo '
1041 + <tr>
1042 + <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
1043 + <td align="left">
1044 + '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
1045 + <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
1046 + <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
1047 +
1048 + if(!empty($loginizer['license'])){
1049 +
1050 + $expires = $loginizer['license']['expires'];
1051 + $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
1052 +
1053 + echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
1054 + License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
1055 + </div>';
1056 + }
1057 +
1058 +
1059 + echo
1060 + '</td>
1061 + </tr>';
1062 + }
1063 +
1064 + echo '<tr>
1065 + <th align="left">'.__('URL', 'loginizer').'</th>
1066 + <td>'.get_site_url().'</td>
1067 + </tr>
1068 + <tr>
1069 + <th align="left">'.__('Path', 'loginizer').'</th>
1070 + <td>'.ABSPATH.'</td>
1071 + </tr>
1072 + <tr>
1073 + <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1074 + <td>'.$_SERVER['SERVER_ADDR'].'</td>
1075 + </tr>
1076 + <tr>
1077 + <th align="left">'.__('Your IP Address', 'loginizer').'</th>
1078 + <td>'.lz_getip().'
1079 + <div style="float:right">
1080 + Method :
1081 + <select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1082 + <option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1083 + <option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1084 + <option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1085 + <option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1086 + </select>
1087 + <input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1088 + <input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1089 + </div>
1090 + </td>
1091 + </tr>
1092 + <tr>
1093 + <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1094 + <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1095 + </tr>';
1096 +
1097 + if(file_exists(ABSPATH.'/.htaccess')){
1098 + echo '
1099 + <tr>
1100 + <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1101 + <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1102 + </tr>';
1103 +
1104 + }
1105 +
1106 + ?>
1107 + </table>
1108 + </form>
1109 +
1110 + </div>
1111 + </div>
881 1112
882 -function loginizer_reset_retries(){
1113 +<script type="text/javascript">
883 1114
884 - global $wpdb, $loginizer;
1115 +function lz_ip_method_handle(){
1116 + var ele = jQuery('#lz_ip_method');
1117 + if(ele.val() == 3){
1118 + jQuery('#lz_custom_ip_method').show();
1119 + }else{
1120 + jQuery('#lz_custom_ip_method').hide();
1121 + }
1122 +};
885 1123
886 - $deltime = time() - $loginizer['reset_retries'];
1124 +lz_ip_method_handle();
887 1125
888 - $del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
889 - $result = $wpdb->query($del_query);
1126 +</script>
1127 +
1128 + <div id="" class="postbox">
1129 +
1130 + <button class="handlediv button-link" aria-expanded="true" type="button">
1131 + <span class="screen-reader-text">Toggle panel: File Permissions</span>
1132 + <span class="toggle-indicator" aria-hidden="true"></span>
1133 + </button>
1134 +
1135 + <h2 class="hndle ui-sortable-handle">
1136 + <span><?php echo __('File Permissions', 'loginizer'); ?></span>
1137 + </h2>
1138 +
1139 + <div class="inside">
1140 +
1141 + <form action="" method="post" enctype="multipart/form-data">
1142 + <?php wp_nonce_field('loginizer-options'); ?>
1143 + <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1144 + <?php
1145 +
1146 + echo '
1147 + <tr>
1148 + <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1149 + <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1150 + <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1151 + </tr>';
1152 +
1153 + $wp_content = basename(dirname(dirname(dirname(__FILE__))));
1154 +
1155 + $files_to_check = array('/' => '0755',
1156 + '/wp-admin' => '0755',
1157 + '/wp-includes' => '0755',
1158 + '/wp-config.php' => '0444',
1159 + '/'.$wp_content => '0755',
1160 + '/'.$wp_content.'/themes' => '0755',
1161 + '/'.$wp_content.'/plugins' => '0755',
1162 + '.htaccess' => '0444');
1163 +
1164 + $root = ABSPATH;
1165 +
1166 + foreach($files_to_check as $k => $v){
1167 +
1168 + $path = $root.'/'.$k;
1169 + $stat = @stat($path);
1170 + $suggested = $v;
1171 + $actual = substr(sprintf('%o', $stat['mode']), -4);
1172 +
1173 + echo '
1174 + <tr>
1175 + <td>'.$k.'</td>
1176 + <td>'.$suggested.'</td>
1177 + <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1178 + </tr>';
1179 +
1180 + }
1181 +
1182 + ?>
1183 + </table>
1184 + </form>
1185 +
1186 + </div>
1187 + </div>
890 1188
891 - update_option('loginizer_last_reset', time());
1189 +<?php
1190 +
1191 + loginizer_page_footer();
892 1192
893 1193 }
894 1194
895 -function loginizer_load_translation_vars(){
896 - global $loginizer;
897 -
898 - $loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
899 - $loginizer['login_mail_default_msg'] = __('Hello $user_login,
1195 +// The Loginizer Admin Options Page
1196 +function loginizer_page_brute_force(){
900 1197
901 -Your account was recently logged in from the IP : $ip
902 -Time : $date
903 -If it was not you who logged in then please report this to us immediately.
1198 + global $wpdb, $wp_roles, $loginizer;
1199 +
1200 + if(!current_user_can('manage_options')){
1201 + wp_die('Sorry, but you do not have permissions to change settings.');
1202 + }
904 1203
905 -Regards,
906 -$sitename','loginizer');
907 -
908 - if(empty($loginizer['login_mail_subject'])){
909 - $loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
1204 + /* Make sure post was from this page */
1205 + if(count($_POST) > 0){
1206 + check_admin_referer('loginizer-options');
910 1207 }
911 1208
912 - if(empty($loginizer['login_mail_body'])){
913 - $loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
1209 + // BEGIN THEME
1210 + loginizer_page_header('Loginizer - Brute Force Settings');
1211 +
1212 + // Load the blacklist and whitelist
1213 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
1214 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
1215 +
1216 + // Disable Brute Force
1217 + if(isset($_POST['disable_brute_lz'])){
1218 +
1219 + // Save the options
1220 + update_option('loginizer_disable_brute', 1);
1221 +
1222 + $loginizer['disable_brute'] = 1;
1223 +
1224 + echo '<div id="message" class="updated"><p>'
1225 + . __('The Brute Force Protection feature is now disabled', 'loginizer')
1226 + . '</p></div><br />';
1227 +
914 1228 }
915 1229
916 - // Default messages
917 - $loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
918 - $loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
919 - $loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
920 - $loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
921 - $loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
922 - $loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
1230 + // Enable brute force
1231 + if(isset($_POST['enable_brute_lz'])){
1232 +
1233 + // Save the options
1234 + update_option('loginizer_disable_brute', 0);
1235 +
1236 + $loginizer['disable_brute'] = 0;
1237 +
1238 + echo '<div id="message" class="updated"><p>'
1239 + . __('The Brute Force Protection feature is now enabled', 'loginizer')
1240 + . '</p></div><br />';
1241 +
1242 + }
923 1243
924 - // Message Strings
925 - $loginizer['msg'] = get_option('loginizer_msg', []);
1244 + // The Brute Force Settings
1245 + if(isset($_POST['save_lz'])){
1246 +
1247 + $max_retries = (int) lz_optpost('max_retries');
1248 + $lockout_time = (int) lz_optpost('lockout_time');
1249 + $max_lockouts = (int) lz_optpost('max_lockouts');
1250 + $lockouts_extend = (int) lz_optpost('lockouts_extend');
1251 + $reset_retries = (int) lz_optpost('reset_retries');
1252 + $notify_email = (int) lz_optpost('notify_email');
1253 +
1254 + $lockout_time = $lockout_time * 60;
1255 + $lockouts_extend = $lockouts_extend * 60 * 60;
1256 + $reset_retries = $reset_retries * 60 * 60;
1257 +
1258 + if(empty($error)){
1259 +
1260 + $option['max_retries'] = $max_retries;
1261 + $option['lockout_time'] = $lockout_time;
1262 + $option['max_lockouts'] = $max_lockouts;
1263 + $option['lockouts_extend'] = $lockouts_extend;
1264 + $option['reset_retries'] = $reset_retries;
1265 + $option['notify_email'] = $notify_email;
1266 +
1267 + // Save the options
1268 + update_option('loginizer_options', $option);
1269 +
1270 + $saved = true;
1271 +
1272 + }else{
1273 + lz_report_error($error);
1274 + }
926 1275
927 - foreach($loginizer['d_msg'] as $lk => $lv){
928 - if(empty($loginizer['msg'][$lk])){
929 - $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
1276 + if(!empty($notice)){
1277 + lz_report_notice($notice);
930 1278 }
1279 +
1280 + if(!empty($saved)){
1281 + echo '<div id="message" class="updated"><p>'
1282 + . __('The settings were saved successfully', 'loginizer')
1283 + . '</p></div><br />';
1284 + }
1285 +
931 1286 }
932 1287
933 - $loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
934 - $loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
935 - $loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
936 - $loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
937 - $loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
1288 + // Delete a Blackist IP range
1289 + if(isset($_POST['bdelid'])){
1290 +
1291 + $delid = (int) lz_optreq('bdelid');
1292 +
1293 + // Unset and save
1294 + $blacklist = $loginizer['blacklist'];
1295 + unset($blacklist[$delid]);
1296 + update_option('loginizer_blacklist', $blacklist);
1297 +
1298 + echo '<div id="message" class="updated fade"><p>'
1299 + . __('The Blacklist IP range has been deleted successfully', 'loginizer')
1300 + . '</p></div><br />';
1301 +
1302 + }
938 1303
939 - // Message Strings
940 - $loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
1304 + // Delete all Blackist IP ranges
1305 + if(isset($_POST['del_all_blacklist'])){
1306 +
1307 + // Unset and save
1308 + update_option('loginizer_blacklist', array());
1309 +
1310 + echo '<div id="message" class="updated fade"><p>'
1311 + . __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1312 + . '</p></div><br />';
1313 +
1314 + }
941 1315
942 - foreach($loginizer['2fa_d_msg'] as $lk => $lv){
943 - if(empty($loginizer['2fa_msg'][$lk])){
944 - $loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
945 - }
1316 + // Delete a Whitelist IP range
1317 + if(isset($_POST['delid'])){
1318 +
1319 + $delid = (int) lz_optreq('delid');
1320 +
1321 + // Unset and save
1322 + $whitelist = $loginizer['whitelist'];
1323 + unset($whitelist[$delid]);
1324 + update_option('loginizer_whitelist', $whitelist);
1325 +
1326 + echo '<div id="message" class="updated fade"><p>'
1327 + . __('The Whitelist IP range has been deleted successfully', 'loginizer')
1328 + . '</p></div><br />';
1329 +
946 1330 }
947 1331
948 -}
1332 + // Delete all Blackist IP ranges
1333 + if(isset($_POST['del_all_whitelist'])){
1334 +
1335 + // Unset and save
1336 + update_option('loginizer_whitelist', array());
1337 +
1338 + echo '<div id="message" class="updated fade"><p>'
1339 + . __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1340 + . '</p></div><br />';
1341 +
1342 + }
1343 +
1344 + // Reset All Logs
1345 + if(isset($_POST['lz_reset_all_ip'])){
1346 +
1347 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1348 + WHERE `time` > 0");
1349 +
1350 + echo '<div id="message" class="updated fade"><p>'
1351 + . __('All the IP Logs have been cleared', 'loginizer')
1352 + . '</p></div><br />';
1353 + }
1354 +
1355 + // Reset Logs
1356 + if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
949 1357
950 -// Checks if softaculous is installed on the server.
951 -function loginizer_check_softaculous(){
952 -
953 - // Checking if we have Softaculous installed?
954 - if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
955 - return false;
1358 + $ips = $_POST['lz_reset_ips'];
1359 +
1360 + foreach($ips as $ip){
1361 + if(!lz_valid_ip($ip)){
1362 + $error[] = 'The IP - '.$ip.' is invalid !';
1363 + }
1364 + }
1365 +
1366 + if(count($ips) < 1){
1367 + $error[] = 'There are no IPs submitted';
1368 + }
1369 +
1370 + // Should we start deleting logs
1371 + if(empty($error)){
1372 +
1373 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1374 + WHERE `ip` IN ('".implode("', '", $ips)."')");
1375 +
1376 + if(empty($error)){
1377 +
1378 + echo '<div id="message" class="updated fade"><p>'
1379 + . __('The selected IP Logs have been reset', 'loginizer')
1380 + . '</p></div><br />';
1381 +
1382 + }
1383 +
1384 + }
1385 +
1386 + if(!empty($error)){
1387 + lz_report_error($error);echo '<br />';
1388 + }
1389 +
956 1390 }
1391 +
1392 + if(isset($_POST['blacklist_iprange'])){
957 1393
958 - if(empty($matches) || empty($matches[0])){
959 - return false;
1394 + $start_ip = lz_optpost('start_ip');
1395 + $end_ip = lz_optpost('end_ip');
1396 +
1397 + if(empty($start_ip)){
1398 + $error[] = 'Please enter the Start IP';
1399 + }
1400 +
1401 + // If no end IP we consider only 1 IP
1402 + if(empty($end_ip)){
1403 + $end_ip = $start_ip;
1404 + }
1405 +
1406 + if(!lz_valid_ip($start_ip)){
1407 + $error[] = 'Please provide a valid start IP';
1408 + }
1409 +
1410 + if(!lz_valid_ip($end_ip)){
1411 + $error[] = 'Please provide a valid end IP';
1412 + }
1413 +
1414 + // Regular ranges will work
1415 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1416 +
1417 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1418 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1419 + // This is right
1420 + }else{
1421 + $error[] = 'The End IP cannot be smaller than the Start IP';
1422 + }
1423 +
1424 + }
1425 +
1426 + if(empty($error)){
1427 +
1428 + $blacklist = $loginizer['blacklist'];
1429 +
1430 + foreach($blacklist as $k => $v){
1431 +
1432 + // This is to check if there is any other range exists with the same Start or End IP
1433 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1434 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1435 + ){
1436 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1437 + break;
1438 + }
1439 +
1440 + // This is to check if there is any other range exists with the same Start IP
1441 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1442 + $error[] = 'The Start IP is present in an existing range !';
1443 + break;
1444 + }
1445 +
1446 + // This is to check if there is any other range exists with the same End IP
1447 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1448 + $error[] = 'The End IP is present in an existing range!';
1449 + break;
1450 + }
1451 +
1452 + }
1453 +
1454 + $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1455 +
1456 + if(empty($error)){
1457 +
1458 + $blacklist[$newid] = array();
1459 + $blacklist[$newid]['start'] = $start_ip;
1460 + $blacklist[$newid]['end'] = $end_ip;
1461 + $blacklist[$newid]['time'] = time();
1462 +
1463 + update_option('loginizer_blacklist', $blacklist);
1464 +
1465 + echo '<div id="message" class="updated fade"><p>'
1466 + . __('Blacklist IP range added successfully', 'loginizer')
1467 + . '</p></div><br />';
1468 +
1469 + }
1470 +
1471 + }
1472 +
1473 + if(!empty($error)){
1474 + lz_report_error($error);echo '<br />';
1475 + }
1476 +
960 1477 }
1478 +
1479 + if(isset($_POST['whitelist_iprange'])){
961 1480
962 - $softaculous_path = $matches[0] . '.softaculous/installations.php';
963 - if(!file_exists($softaculous_path)){
964 - return false;
1481 + $start_ip = lz_optpost('start_ip_w');
1482 + $end_ip = lz_optpost('end_ip_w');
1483 +
1484 + if(empty($start_ip)){
1485 + $error[] = 'Please enter the Start IP';
1486 + }
1487 +
1488 + // If no end IP we consider only 1 IP
1489 + if(empty($end_ip)){
1490 + $end_ip = $start_ip;
1491 + }
1492 +
1493 + if(!lz_valid_ip($start_ip)){
1494 + $error[] = 'Please provide a valid start IP';
1495 + }
1496 +
1497 + if(!lz_valid_ip($end_ip)){
1498 + $error[] = 'Please provide a valid end IP';
1499 + }
1500 +
1501 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1502 +
1503 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1504 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1505 + // This is right
1506 + }else{
1507 + $error[] = 'The End IP cannot be smaller than the Start IP';
1508 + }
1509 +
1510 + }
1511 +
1512 + if(empty($error)){
1513 +
1514 + $whitelist = $loginizer['whitelist'];
1515 +
1516 + foreach($whitelist as $k => $v){
1517 +
1518 + // This is to check if there is any other range exists with the same Start or End IP
1519 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1520 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1521 + ){
1522 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1523 + break;
1524 + }
1525 +
1526 + // This is to check if there is any other range exists with the same Start IP
1527 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1528 + $error[] = 'The Start IP is present in an existing range !';
1529 + break;
1530 + }
1531 +
1532 + // This is to check if there is any other range exists with the same End IP
1533 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1534 + $error[] = 'The End IP is present in an existing range!';
1535 + break;
1536 + }
1537 +
1538 + }
1539 +
1540 + $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1541 +
1542 + if(empty($error)){
1543 +
1544 + $whitelist[$newid] = array();
1545 + $whitelist[$newid]['start'] = $start_ip;
1546 + $whitelist[$newid]['end'] = $end_ip;
1547 + $whitelist[$newid]['time'] = time();
1548 +
1549 + update_option('loginizer_whitelist', $whitelist);
1550 +
1551 + echo '<div id="message" class="updated fade"><p>'
1552 + . __('Whitelist IP range added successfully', 'loginizer')
1553 + . '</p></div><br />';
1554 +
1555 + }
1556 +
1557 + }
1558 +
1559 + if(!empty($error)){
1560 + lz_report_error($error);echo '<br />';
1561 + }
965 1562 }
966 1563
967 - // Checking if users has changed the branding of Softaculous.
968 - $universal_file = '';
969 - // Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
970 - if(file_exists('/usr/local/softaculous/enduser/universal.php')){
971 - $universal_file = '/usr/local/softaculous/enduser/universal.php';
972 - }else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
973 - $universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
974 - }else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
975 - $universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
976 - }else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
977 - $universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
1564 + // Save the messages
1565 + if(isset($_POST['save_err_msgs_lz'])){
1566 +
1567 + $msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1568 + $msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1569 +
1570 + // Update them
1571 + update_option('loginizer_msg', $msgs);
1572 +
1573 + echo '<div id="message" class="updated fade"><p>'
1574 + . __('Error messages were saved successfully', 'loginizer')
1575 + . '</p></div><br />';
1576 +
978 1577 }
979 1578
980 - if(empty($universal_file)){
981 - return false;
982 - }
1579 + // Count the Results
1580 + $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1581 + //print_r($tmp);
1582 +
1583 + // Which Page is it
1584 + $lz_env['res_len'] = 10;
1585 + $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1586 + $lz_env['num_res'] = $tmp['num'];
1587 + $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1588 +
1589 + // Get the logs
1590 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1591 + ORDER BY `time` DESC
1592 + LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1593 + //print_r($result);
1594 +
1595 + $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1596 + $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1597 + $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1598 + $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1599 +
1600 + // Reload the settings
1601 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
1602 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
1603 +
1604 + $saved_msgs = get_option('loginizer_msg');
1605 +
1606 + ?>
983 1607
984 - $universal = file_get_contents($universal_file);
1608 + <div id="" class="postbox">
1609 +
1610 + <button class="handlediv button-link" aria-expanded="true" type="button">
1611 + <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
1612 + <span class="toggle-indicator" aria-hidden="true"></span>
1613 + </button>
1614 +
1615 + <h2 class="hndle ui-sortable-handle">
1616 + <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1617 + </h2>
1618 +
1619 + <script>
1620 + function yesdsd(){
1621 + window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1622 + return false;
1623 + }
1624 + </script>
1625 +
1626 + <form method="get" onsubmit="return yesdsd();">
1627 + <div class="tablenav">
1628 + <p class="tablenav-pages" style="margin: 5px 10px" align="right">
1629 + <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1630 + <span class="pagination-links">
1631 + <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1632 + <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1633 + <span class="paging-input">
1634 + <label for="current-page-selector" class="screen-reader-text">Current Page</label>
1635 + <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1636 + </span>
1637 + <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1638 + <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1639 + </span>
1640 + </p>
1641 + </div>
1642 + </form>
1643 +
1644 + <form action="" method="post" enctype="multipart/form-data">
1645 + <?php wp_nonce_field('loginizer-options'); ?>
1646 + <div class="inside">
1647 + <table class="wp-list-table widefat fixed users" border="0">
1648 + <tr>
1649 + <th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
1650 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1651 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
1652 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1653 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1654 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
1655 + <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
1656 + </tr>
1657 + <?php
1658 +
1659 + if(empty($result)){
1660 + echo '
1661 + <tr>
1662 + <td colspan="4">
1663 + No Logs. You will see logs about failed login attempts here.
1664 + </td>
1665 + </tr>';
1666 + }else{
1667 + foreach($result as $ik => $iv){
1668 + $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1669 + echo '
1670 + <tr>
1671 + <td>
1672 + <input type="checkbox" value="'.$iv['ip'].'" name="lz_reset_ips[]" />
1673 + </td>
1674 + <td>
1675 + '.$iv['ip'].'
1676 + </td>
1677 + <td>
1678 + '.$iv['username'].'
1679 + </td>
1680 + <td>
1681 + '.date('d/m/Y H:i:s', $iv['time']).'
1682 + </td>
1683 + <td>
1684 + '.$iv['count'].'
1685 + </td>
1686 + <td>
1687 + '.$iv['lockout'].'
1688 + </td>
1689 + <td>
1690 + '.$iv['url'].'
1691 + </td>
1692 + </tr>';
1693 + }
1694 + }
1695 +
1696 + ?>
1697 + </table>
1698 +
1699 + <br>
1700 + <input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
1701 + &nbsp; &nbsp;
1702 + <input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
1703 + </div>
1704 + </div>
1705 + </form>
1706 + <br />
1707 +
1708 + <div id="" class="postbox">
1709 +
1710 + <button class="handlediv button-link" aria-expanded="true" type="button">
1711 + <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
1712 + <span class="toggle-indicator" aria-hidden="true"></span>
1713 + </button>
1714 +
1715 + <h2 class="hndle ui-sortable-handle">
1716 + <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1717 + </h2>
1718 +
1719 + <div class="inside">
1720 +
1721 + <form action="" method="post" enctype="multipart/form-data">
1722 + <?php wp_nonce_field('loginizer-options'); ?>
1723 + <table class="form-table">
1724 + <tr>
1725 + <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1726 + <td>
1727 + <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1728 + </td>
1729 + </tr>
1730 + <tr>
1731 + <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1732 + <td>
1733 + <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1734 + </td>
1735 + </tr>
1736 + <tr>
1737 + <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1738 + <td>
1739 + <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1740 + </td>
1741 + </tr>
1742 + <tr>
1743 + <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
1744 + <td>
1745 + <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
1746 + </td>
1747 + </tr>
1748 + <tr>
1749 + <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
1750 + <td>
1751 + <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
1752 + </td>
1753 + </tr>
1754 + <tr>
1755 + <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
1756 + <td>
1757 + <?php echo __('after ','loginizer'); ?>
1758 + <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
1759 + </td>
1760 + </tr>
1761 + </table><br />
1762 + <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1763 + <?php
1764 +
1765 + if(empty($loginizer['disable_brute'])){
1766 +
1767 + echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1768 +
1769 + }else{
1770 +
1771 + echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1772 +
1773 + }
1774 +
1775 + ?>
1776 + </form>
1777 +
1778 + </div>
1779 + </div>
1780 + <br />
1781 +
1782 +<?php
1783 +
1784 + wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
1785 +
1786 +?>
985 1787
986 - if(empty($universal)){
987 - return false;
1788 +<style>
1789 +.page-navigation a {
1790 +margin: 5px 2px;
1791 +display: inline-block;
1792 +padding: 5px 8px;
1793 +color: #0073aa;
1794 +background: #e5e5e5 none repeat scroll 0 0;
1795 +border: 1px solid #ccc;
1796 +text-decoration: none;
1797 +transition-duration: 0.05s;
1798 +transition-property: border, background, color;
1799 +transition-timing-function: ease-in-out;
1800 +}
1801 +
1802 +.page-navigation a[data-selected] {
1803 +background-color: #00a0d2;
1804 +color: #fff;
1805 +}
1806 +</style>
1807 +
1808 +<script>
1809 +
1810 +jQuery(document).ready(function(){
1811 + jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
1812 + jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
1813 +});
1814 +
1815 +// Delete a Blacklist / Whitelist IP Range
1816 +function del_confirm(field, todo_id, msg){
1817 + var ret = confirm(msg);
1818 +
1819 + if(ret){
1820 + jQuery('#lz_bl_wl_todo').attr('name', field);
1821 + jQuery('#lz_bl_wl_todo').val(todo_id);
1822 + jQuery('#lz_bl_wl_form').submit();
988 1823 }
1824 +
1825 + return false;
1826 +
1827 +}
989 1828
990 - // Checking if Softaculous is being whitelabeled
991 - if(preg_match('/\$globals\[["\']sn["\']\]\s.?=\s.?["\']Softaculous["\']/', $universal)){
992 - update_option('loginizer_softwp_upgrade', time());
1829 +// Delete all Blacklist / Whitelist IP Ranges
1830 +function del_confirm_all(msg){
1831 + var ret = confirm(msg);
1832 +
1833 + if(ret){
1834 + return true;
993 1835 }
1836 +
1837 + return false;
1838 +
1839 +}
994 1840
995 - return false;
1841 +</script>
1842 +
1843 + <div id="" class="postbox">
1844 +
1845 + <button class="handlediv button-link" aria-expanded="true" type="button">
1846 + <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
1847 + <span class="toggle-indicator" aria-hidden="true"></span>
1848 + </button>
1849 +
1850 + <h2 class="hndle ui-sortable-handle">
1851 + <span><?php echo __('Blacklist IP','loginizer'); ?></span>
1852 + </h2>
1853 +
1854 + <div class="inside">
1855 +
1856 + <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
1857 +
1858 + <form action="" method="post">
1859 + <?php wp_nonce_field('loginizer-options'); ?>
1860 + <table class="form-table">
1861 + <tr>
1862 + <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
1863 + <td>
1864 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1865 + </td>
1866 + </tr>
1867 + <tr>
1868 + <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1869 + <td>
1870 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1871 + </td>
1872 + </tr>
1873 + </table><br />
1874 + <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1875 + <input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
1876 + </form>
1877 + </div>
1878 +
1879 + <div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
1880 + <table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1881 + <tr>
1882 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1883 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1884 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1885 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1886 + </tr>
1887 + <?php
1888 + if(empty($loginizer['blacklist'])){
1889 + echo '
1890 + <tr>
1891 + <td colspan="4">
1892 + No Blacklist IPs. You will see blacklisted IP ranges here.
1893 + </td>
1894 + </tr>';
1895 + }else{
1896 + foreach($loginizer['blacklist'] as $ik => $iv){
1897 + echo '
1898 + <tr>
1899 + <td>
1900 + '.$iv['start'].'
1901 + </td>
1902 + <td>
1903 + '.$iv['end'].'
1904 + </td>
1905 + <td>
1906 + '.date('d/m/Y', $iv['time']).'
1907 + </td>
1908 + <td>
1909 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
1910 + </td>
1911 + </tr>';
1912 + }
1913 + }
1914 + ?>
1915 + </table>
1916 + <br />
1917 + <form action="" method="post" id="lz_bl_wl_form">
1918 + <?php wp_nonce_field('loginizer-options'); ?>
1919 + <input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
1920 + </form>
1921 + </div>
1922 +
1923 + <br />
1924 +
1925 + <div id="" class="postbox">
1926 +
1927 + <button class="handlediv button-link" aria-expanded="true" type="button">
1928 + <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
1929 + <span class="toggle-indicator" aria-hidden="true"></span>
1930 + </button>
1931 +
1932 + <h2 class="hndle ui-sortable-handle">
1933 + <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
1934 + </h2>
1935 +
1936 + <div class="inside">
1937 +
1938 + <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
1939 + <form action="" method="post">
1940 + <?php wp_nonce_field('loginizer-options'); ?>
1941 + <table class="form-table">
1942 + <tr>
1943 + <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
1944 + <td>
1945 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1946 + </td>
1947 + </tr>
1948 + <tr>
1949 + <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1950 + <td>
1951 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
1952 + </td>
1953 + </tr>
1954 + </table><br />
1955 + <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1956 + <input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
1957 + </form>
1958 + </div>
1959 +
1960 + <div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
1961 + <table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1962 + <tr>
1963 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1964 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1965 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1966 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1967 + </tr>
1968 + <?php
1969 + if(empty($loginizer['whitelist'])){
1970 + echo '
1971 + <tr>
1972 + <td colspan="4">
1973 + No Whitelist IPs. You will see whitelisted IP ranges here.
1974 + </td>
1975 + </tr>';
1976 + }else{
1977 + foreach($loginizer['whitelist'] as $ik => $iv){
1978 + echo '
1979 + <tr>
1980 + <td>
1981 + '.$iv['start'].'
1982 + </td>
1983 + <td>
1984 + '.$iv['end'].'
1985 + </td>
1986 + <td>
1987 + '.date('d/m/Y', $iv['time']).'
1988 + </td>
1989 + <td>
1990 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
1991 + </td>
1992 + </tr>';
1993 + }
1994 + }
1995 + ?>
1996 + </table>
1997 + <br />
1998 +
1999 + </div>
2000 +
2001 + <div id="" class="postbox">
2002 +
2003 + <button class="handlediv button-link" aria-expanded="true" type="button">
2004 + <span class="screen-reader-text">Toggle panel: Error Messages</span>
2005 + <span class="toggle-indicator" aria-hidden="true"></span>
2006 + </button>
2007 +
2008 + <h2 class="hndle ui-sortable-handle">
2009 + <span><?php echo __('Error Messages', 'loginizer'); ?></span>
2010 + </h2>
2011 +
2012 + <div class="inside">
2013 +
2014 + <form action="" method="post" enctype="multipart/form-data">
2015 + <?php wp_nonce_field('loginizer-options'); ?>
2016 + <table class="form-table">
2017 + <tr>
2018 + <th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2019 + <td>
2020 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2021 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['inv_userpass']. '&quot;</em>', 'loginizer'); ?><br />
2022 + </td>
2023 + </tr>
2024 + <tr>
2025 + <th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2026 + <td>
2027 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2028 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['ip_blacklisted']. '&quot;</em>', 'loginizer'); ?><br />
2029 + </td>
2030 + </tr>
2031 + </table><br />
2032 + <input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2033 + </form>
2034 + </div>
2035 + </div>
2036 +<?php
2037 +
2038 +loginizer_page_footer();
2039 +
996 2040 }
997 2041
2042 +
998 2043 // Sorry to see you going
999 2044 register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
1000 2045
1001 2046 function loginizer_deactivation(){
@@ -1014,21 +2059,9 @@
1014 2059 delete_option('loginizer_last_reset');
1015 2060 delete_option('loginizer_whitelist');
1016 2061 delete_option('loginizer_blacklist');
1017 2062 delete_option('loginizer_msg');
1018 - delete_option('loginizer_2fa_msg');
1019 - delete_option('loginizer_2fa_email_template');
1020 2063 delete_option('loginizer_security');
1021 2064 delete_option('loginizer_wp_admin');
1022 - delete_option('loginizer_csrf_promo_time');
1023 - delete_option('loginizer_backuply_promo_time');
1024 - delete_option('loginizer_promo_time');
1025 - delete_option('loginizer_ins_time');
1026 - delete_option('loginizer_2fa_whitelist');
1027 - delete_option('loginizer_checksums_last_run');
1028 - delete_option('loginizer_checksums_diff');
1029 - delete_option('loginizer_ip_method');
1030 - delete_option('loginizer_2fa_custom_redirect');
1031 - delete_option('external_updates-loginizer-security');
1032 - delete_option('loginizer_login_attempt_stats');
1033 2065
1034 -}
2066 +}
2067 +