PluginProbe
Loginizer / 1.4.7
Loginizer v1.4.7
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | init.php +1599 -460 2.0.2 → 1.4.7 View file →
@@ -4,13 +4,12 @@
4 4 echo 'You are not allowed to access this page directly.';
5 5 exit;
6 6 }
7 7
8 -define('LOGINIZER_VERSION', '2.0.2');
8 +define('LOGINIZER_VERSION', '1.4.7');
9 9 define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10 10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12 -define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13 12 define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14 13
15 14 include_once(LOGINIZER_DIR.'/functions.php');
16 15
@@ -24,9 +23,9 @@
24 23
25 24 $sql = array();
26 25
27 26 $sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28 -
27 +
29 28 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30 29 `username` varchar(255) NOT NULL DEFAULT '',
31 30 `time` int(10) NOT NULL DEFAULT '0',
32 31 `count` int(10) NOT NULL DEFAULT '0',
@@ -33,9 +32,9 @@
33 32 `lockout` int(10) NOT NULL DEFAULT '0',
34 33 `ip` varchar(255) NOT NULL DEFAULT '',
35 34 `url` varchar(255) NOT NULL DEFAULT '',
36 35 UNIQUE KEY `ip` (`ip`)
37 - ) DEFAULT CHARSET=utf8;";
36 + ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
38 37
39 38 foreach($sql as $sk => $sv){
40 39 $wpdb->query($sv);
41 40 }
@@ -44,24 +43,12 @@
44 43 add_option('loginizer_options', array());
45 44 add_option('loginizer_last_reset', 0);
46 45 add_option('loginizer_whitelist', array());
47 46 add_option('loginizer_blacklist', array());
48 - add_option('loginizer_2fa_whitelist', array());
49 -
50 - // TODO:: REMOVE THIS AFTER MARCH 2025
51 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
52 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
53 - loginizer_check_softaculous();
54 - }
47 +
55 48 }
56 49
57 -/**
58 - * Updates the database structure for Loginizer
59 - *
60 - * If the plugin files are updated but database structure is not updated
61 - * this function will update the database structure as per the plugin version
62 - * NOTE: This does not update plugin files it just updates the database structure
63 - */
50 +// Checks if we are to update ?
64 51 function loginizer_update_check(){
65 52
66 53 global $wpdb;
67 54
@@ -89,9 +76,9 @@
89 76 // Trick the following if conditions to not run
90 77 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
91 78
92 79 }
93 -
80 +
94 81 // Is it less than 1.0.1 ?
95 82 if($version < 101){
96 83
97 84 // TODO : GET the existing settings
@@ -121,17 +108,9 @@
121 108
122 109 // Update the existing failed logs to new table
123 110 if(is_array($lz_failed_logs)){
124 111 foreach($lz_failed_logs as $fk => $fv){
125 - $insert_data = array('username' => $fv['username'],
126 - 'time' => $fv['time'],
127 - 'count' => $fv['count'],
128 - 'lockout' => $fv['lockout'],
129 - 'ip' => $fv['ip']);
130 -
131 - $format = array('%s','%d','%d','%d','%s');
132 -
133 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
112 + $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
134 113 }
135 114 }
136 115
137 116 // Update the existing options to new structure
@@ -187,38 +166,11 @@
187 166 $wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188 167
189 168 }
190 169
191 - // Setting alignment to left in social login ?
192 - if($version < 201){
193 - $social_settings = get_option('loginizer_social_settings', []);
194 -
195 - if(!empty($social_settings)){
196 - if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
197 - $social_settings['login']['button_alignment'] = 'left';
198 - }
199 -
200 - if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
201 - $social_settings['woocommerce']['button_alignment'] = 'left';
202 - }
203 -
204 - if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
205 - $social_settings['comment']['button_alignment'] = 'left';
206 - }
207 -
208 - update_option('loginizer_social_settings', $social_settings);
209 - }
210 - }
211 -
212 170 // Save the new Version
213 171 update_option('loginizer_version', LOGINIZER_VERSION);
214 172
215 - // TODO:: REMOVE THIS AFTER MARCH 2025
216 - $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
217 - if(!defined('SITEPAD') && empty($softwp_upgrade)){
218 - loginizer_check_softaculous();
219 - }
220 -
221 173 // In Sitepad Math Captcha is enabled by default
222 174 if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
223 175 $option['captcha_no_google'] = 1;
224 176 add_option('loginizer_captcha', $option);
@@ -235,13 +187,11 @@
235 187 global $loginizer;
236 188
237 189 // Check if the installed version is outdated
238 190 loginizer_update_check();
239 -
191 +
240 192 // Set the array
241 - if(empty($loginizer)){
242 - $loginizer = array();
243 - }
193 + $loginizer = array();
244 194
245 195 $loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
246 196 $loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
247 197 $loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
@@ -260,43 +210,28 @@
260 210 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
261 211 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
262 212 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
263 213 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
264 - $loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
265 - $loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
266 - $loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
267 - $loginizer['social_settings'] = get_option('loginizer_social_settings', []);
268 214
269 - if(!empty($options['notify_email_address'])){
270 - $loginizer['notify_email_address'] = $options['notify_email_address'];
271 - $loginizer['custom_notify_email'] = 1;
272 - }
215 + // Default messages
216 + $loginizer['d_msg']['inv_userpass'] = 'Incorrect Username or Password';
217 + $loginizer['d_msg']['ip_blacklisted'] = 'Your IP has been blacklisted';
273 218
274 - // Login Success Email Notification.
275 - $loginizer['login_mail'] = get_option('loginizer_login_mail', []);
276 - add_action('init', 'loginizer_load_translation_vars', 0);
277 -
278 - $loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
279 - $loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];
280 -
281 - // Load the blacklist and whitelist
282 - $loginizer['blacklist'] = get_option('loginizer_blacklist', []);
283 - $loginizer['whitelist'] = get_option('loginizer_whitelist', []);
284 - $loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
219 + // Message Strings
220 + $loginizer['msg'] = get_option('loginizer_msg');
285 221
286 - // It should not be false
287 - if(empty($loginizer['2fa_whitelist'])){
288 - $loginizer['2fa_whitelist'] = array();
222 + foreach($loginizer['d_msg'] as $lk => $lv){
223 + if(empty($loginizer['msg'][$lk])){
224 + $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
225 + }
289 226 }
227 +
228 + // Load the blacklist and whitelist
229 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
230 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
290 231
291 232 // When was the database cleared last time
292 233 $loginizer['last_reset'] = get_option('loginizer_last_reset');
293 -
294 - if(!isset($loginizer['ultimate-member-active'])){
295 - $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
296 -
297 - $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
298 - }
299 234
300 235 //print_r($loginizer);
301 236
302 237 // Clear retries
@@ -332,45 +267,158 @@
332 267 // Is called before displaying the error message so that we dont show that the username is wrong or the password
333 268 // Update Error message
334 269 add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335 270 add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336 - add_action('wp_login', 'loginizer_login_success', 10, 2);
271 +
272 + }
273 +
274 + // Is the premium features there ?
275 + if(file_exists(LOGINIZER_DIR.'/premium.php')){
337 276
338 - if(!empty($loginizer['ultimate-member-active'])){
339 - add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
277 + // Include the file
278 + include_once(LOGINIZER_DIR.'/premium.php');
279 +
280 + loginizer_security_init();
281 +
282 + // Its the free version
283 + }else{
284 +
285 + // The promo time
286 + $loginizer['promo_time'] = get_option('loginizer_promo_time');
287 + if(empty($loginizer['promo_time'])){
288 + $loginizer['promo_time'] = time();
289 + update_option('loginizer_promo_time', $loginizer['promo_time']);
340 290 }
341 -
342 - if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
343 - add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
291 +
292 + // Are we to show the loginizer promo
293 + if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
294 +
295 + add_action('admin_notices', 'loginizer_promo');
296 +
344 297 }
345 - }
346 -
347 - // Social Login Form Actions
348 - if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
349 - if(!empty($loginizer['social_settings']['login']['login_form'])){
350 - add_action('login_form', 'loginizer_social_btn_login');
298 +
299 + // Are we to disable the promo
300 + if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
301 + update_option('loginizer_promo_time', (0 - time()) );
302 + die('DONE');
351 303 }
304 +
352 305 }
353 306
354 - if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){
355 - include_once LOGINIZER_DIR . '/main/ajax.php';
356 - }
307 +}
357 308
358 - if(is_admin()){
359 - include_once LOGINIZER_DIR . '/main/admin.php';
360 - }
309 +// Show the promo
310 +function loginizer_promo(){
361 311
362 - // ----------------
363 - // PRO INIT END
364 - // ----------------
365 -
366 - // Secuity checks for social login.
367 - if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
368 - add_action('init', 'loginizer_social_login_load');
369 - return;
370 - }
312 + echo '
313 +<style>
314 +.lz_button {
315 +background-color: #4CAF50; /* Green */
316 +border: none;
317 +color: white;
318 +padding: 8px 16px;
319 +text-align: center;
320 +text-decoration: none;
321 +display: inline-block;
322 +font-size: 16px;
323 +margin: 4px 2px;
324 +-webkit-transition-duration: 0.4s; /* Safari */
325 +transition-duration: 0.4s;
326 +cursor: pointer;
371 327 }
372 328
329 +.lz_button:focus{
330 +border: none;
331 +color: white;
332 +}
333 +
334 +.lz_button1 {
335 +color: white;
336 +background-color: #4CAF50;
337 +border:3px solid #4CAF50;
338 +}
339 +
340 +.lz_button1:hover {
341 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
342 +color: white;
343 +border:3px solid #4CAF50;
344 +}
345 +
346 +.lz_button2 {
347 +color: white;
348 +background-color: #0085ba;
349 +}
350 +
351 +.lz_button2:hover {
352 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
353 +color: white;
354 +}
355 +
356 +.lz_button3 {
357 +color: white;
358 +background-color: #365899;
359 +}
360 +
361 +.lz_button3:hover {
362 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
363 +color: white;
364 +}
365 +
366 +.lz_button4 {
367 +color: white;
368 +background-color: rgb(66, 184, 221);
369 +}
370 +
371 +.lz_button4:hover {
372 +box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
373 +color: white;
374 +}
375 +
376 +.loginizer_promo-close{
377 +float:right;
378 +text-decoration:none;
379 +margin: 5px 10px 0px 0px;
380 +}
381 +
382 +.loginizer_promo-close:hover{
383 +color: red;
384 +}
385 +</style>
386 +
387 +<script>
388 +jQuery(document).ready( function() {
389 + (function($) {
390 + $("#loginizer_promo .loginizer_promo-close").click(function(){
391 + var data;
392 +
393 + // Hide it
394 + $("#loginizer_promo").hide();
395 +
396 + // Save this preference
397 + $.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
398 + //alert(response);
399 + });
400 + });
401 + })(jQuery);
402 +});
403 +</script>
404 +
405 +<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
406 + <a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
407 + <span class="dashicons dashicons-dismiss"></span> Dismiss
408 + </a>
409 + <img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
410 + <p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
411 + <p>
412 + <a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
413 + <a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5★\'s</a>
414 + <a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
415 + <a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
416 + </p>
417 +</div>';
418 +
419 +}
420 +
373 421 // Should return NULL if everything is fine
374 422 function loginizer_wp_authenticate($user, $username, $password){
375 423
376 424 global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
@@ -382,36 +430,13 @@
382 430 // Are you whitelisted ?
383 431 if(loginizer_is_whitelisted()){
384 432 $loginizer['ip_is_whitelisted'] = 1;
385 433 return $user;
386 -
387 - } else if (!empty($loginizer['trusted_ips'])){
388 - $lz_cannot_login = 1;
389 -
390 - // This is used by WP Activity Log
391 - apply_filters( 'wp_login_blocked', $username );
392 -
393 - // Shows a blocked screen
394 - if(!empty($loginizer['blocked_screen'])){
395 - $lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
396 - loginizer_blocked_page($lz_error);
397 - }
398 -
399 - return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
400 434 }
401 435
402 436 // Are you blacklisted ?
403 437 if(loginizer_is_blacklisted()){
404 438 $lz_cannot_login = 1;
405 -
406 - // This is used by WP Activity Log
407 - apply_filters( 'wp_login_blocked', $username );
408 -
409 - // Shows a blocked screen
410 - if(!empty($loginizer['blocked_screen'])){
411 - loginizer_blocked_page($lz_error);
412 - }
413 -
414 439 return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
415 440 }
416 441
417 442 // Is the username blacklisted ?
@@ -417,12 +442,8 @@
417 442 // Is the username blacklisted ?
418 443 if(function_exists('loginizer_user_blacklisted')){
419 444 if(loginizer_user_blacklisted($username)){
420 445 $lz_cannot_login = 1;
421 -
422 - // This is used by WP Activity Log
423 - apply_filters( 'wp_login_blocked', $username );
424 -
425 446 return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
426 447 }
427 448 }
428 449
@@ -430,19 +451,11 @@
430 451 return $user;
431 452 }
432 453
433 454 $lz_cannot_login = 1;
434 -
435 - // This is used by WP Activity Log
436 - apply_filters( 'wp_login_blocked', $username );
437 455
438 - // Shows a blocked screen
439 - if(!empty($loginizer['blocked_screen'])){
440 - loginizer_blocked_page($lz_error);
441 - }
456 + return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
442 457
443 - return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
444 -
445 458 }
446 459
447 460 function loginizer_can_login(){
448 461
@@ -448,13 +461,12 @@
448 461
449 462 global $wpdb, $loginizer, $lz_error;
450 463
451 464 // Get the logs
452 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
453 - $result = lz_selectquery($sel_query);
465 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
454 466
455 467 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
456 -
468 +
457 469 // Has he reached max lockouts ?
458 470 if($result['lockout'] >= $loginizer['max_lockouts']){
459 471 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
460 472 }
@@ -466,20 +478,17 @@
466 478 //echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
467 479 //echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
468 480 //echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
469 481
470 - $_time = $banlift.' '.$loginizer['msg']['minutes_err'];
482 + $_time = $banlift.' minute(s)';
471 483
472 484 if($banlift > 60){
473 485 $banlift = ceil($banlift / 60);
474 - $_time = $banlift.' '.$loginizer['msg']['hours_err'];
486 + $_time = $banlift.' hour(s)';
475 487 }
476 488
477 - $lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
489 + $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
478 490
479 - if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
480 - \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
481 - }
482 491 return false;
483 492 }
484 493 }
485 494
@@ -489,14 +498,10 @@
489 498 function loginizer_is_blacklisted(){
490 499
491 500 global $wpdb, $loginizer, $lz_error;
492 501
493 - $blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
494 -
495 - if(empty($blacklist)){
496 - return false;
497 - }
498 -
502 + $blacklist = $loginizer['blacklist'];
503 +
499 504 foreach($blacklist as $k => $v){
500 505
501 506 // Is the IP in the blacklist ?
502 507 if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
@@ -536,12 +541,8 @@
536 541 global $wpdb, $loginizer, $lz_error;
537 542
538 543 $whitelist = $loginizer['whitelist'];
539 544
540 - if(empty($whitelist)){
541 - return false;
542 - }
543 -
544 545 foreach($whitelist as $k => $v){
545 546
546 547 // Is the IP in the blacklist ?
547 548 if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
@@ -574,78 +575,40 @@
574 575 return false;
575 576
576 577 }
577 578
579 +
578 580 // When the login fails, then this is called
579 581 // We need to update the database
580 -function loginizer_login_failed($username, $is_2fa = ''){
582 +function loginizer_login_failed($username){
581 583
582 584 global $wpdb, $loginizer, $lz_cannot_login;
583 -
584 - // Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
585 - if(empty($username) || is_null($username)){
586 - $username = '';
587 - }
588 -
589 - $fail_type = 'Login';
590 -
591 - if(!empty($is_2fa)){
592 - $fail_type = '2FA';
593 - }
594 585
595 586 if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
596 587
597 - // The params which comes when social login returns an error, have some characters, which WordPress could not save.
598 - $server_uri = $_SERVER['REQUEST_URI'];
599 - if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
600 - $request_uri = explode('=', $_SERVER['REQUEST_URI']);
601 - $server_uri = $request_uri[0];
602 - }
603 -
604 - $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
588 + $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
605 589 $url = esc_url($url);
606 590
607 - $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
608 - $result = lz_selectquery($sel_query);
591 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
609 592
610 593 if(!empty($result)){
611 594 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
595 + $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."', `url` = '".$url."' WHERE `ip` = '".$loginizer['current_ip']."';");
612 596
613 - $update_data = array('username' => $username,
614 - 'time' => time(),
615 - 'count' => $result['count']+1,
616 - 'lockout' => $lockout,
617 - 'url' => $url);
618 -
619 - $where_data = array('ip' => $loginizer['current_ip']);
620 -
621 - $format = array('%s','%d','%d','%d','%s');
622 - $where_format = array('%s');
623 -
624 - $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
625 -
626 597 // Do we need to email admin ?
627 598 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
628 599
629 - $lockout_time = $loginizer['lockout_time'];
630 -
631 - if($lockout >= $loginizer['max_lockouts']){
632 - // extended lockout is in hours so we have to convert to minute
633 - $lockout_time = $loginizer['lockouts_extend'];
634 - }
635 -
636 600 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
637 601 $mail = array();
638 - $mail['to'] = $loginizer['notify_email_address'];
639 - $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
602 + $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
603 + $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
640 604 $mail['message'] = 'Hi,
641 605
642 -'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
643 -'.home_url().'
606 +'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
644 607
645 -Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
608 +Last Login Attempt : '.date('d/M/Y H:i:s P', time()).'
646 609 Last User Attempt : '.$username.'
647 -IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
610 +IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $loginizer['lockout_time']).'
648 611
649 612 Regards,
650 613 Loginizer';
651 614
@@ -651,26 +614,13 @@
651 614
652 615 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
653 616 }
654 617 }else{
655 - $result = array();
656 - $result['count'] = 0;
657 -
658 - $insert_data = array('username' => $username,
659 - 'time' => time(),
660 - 'count' => 1,
661 - 'ip' => $loginizer['current_ip'],
662 - 'lockout' => 0,
663 - 'url' => $url);
664 -
665 - $format = array('%s','%d','%d','%s','%d','%s');
666 -
667 - $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
618 + $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0', `url` = '".$url."';");
668 619 }
669 620
670 621 // We need to add one as this is a failed attempt as well
671 622 $result['count'] = $result['count'] + 1;
672 - loginizer_update_attempt_stats(0);
673 623 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
674 624 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
675 625
676 626 }
@@ -675,325 +625,1526 @@
675 625
676 626 }
677 627 }
678 628
679 -function loginizer_login_success($user_login, $user) {
680 - global $wp_version, $loginizer;
629 +// Handles the error of the password not being there
630 +function loginizer_error_handler($errors, $redirect_to){
631 +
632 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
633 +
634 + //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
635 +
636 + // Remove the empty password error
637 + if(is_wp_error($errors)){
638 +
639 + $codes = $errors->get_error_codes();
640 +
641 + foreach($codes as $k => $v){
642 + if($v == 'invalid_username' || $v == 'incorrect_password'){
643 + $show_error = 1;
644 + }
645 + }
646 +
647 + $errors->remove('invalid_username');
648 + $errors->remove('incorrect_password');
649 +
650 + }
651 +
652 + // Add the error
653 + if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
654 + $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
655 + }
656 +
657 + // Add the number of retires left as well
658 + if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
659 + $errors->add('retries_left', loginizer_retries_left());
660 + }
661 +
662 + return $errors;
663 +
664 +}
681 665
682 - loginizer_update_attempt_stats(1);
666 +
667 +
668 +// Handles the error of the password not being there
669 +function loginizer_woocommerce_error_handler(){
683 670
684 - if(empty($loginizer['login_mail'])){
685 - return;
671 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
672 +
673 + if(function_exists('wc_add_notice')){
674 + wc_add_notice( loginizer_retries_left(), 'error' );
686 675 }
676 +
677 +}
687 678
688 - if(empty($loginizer['login_mail']['enable'])){
689 - return;
679 +// Returns a string with the number of retries left
680 +function loginizer_retries_left(){
681 +
682 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
683 +
684 + // If we are to show the number of retries left
685 + if(isset($loginizer['retries_left'])){
686 + return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
690 687 }
688 +
689 +}
691 690
692 - if(!empty($loginizer['login_mail']['disable_whitelist'])){
693 - // Check its whitelist ip
694 - if(loginizer_is_whitelisted()){
695 - return;
696 - }
697 - }
691 +function loginizer_reset_retries(){
692 +
693 + global $wpdb, $loginizer;
694 +
695 + $deltime = time() - $loginizer['reset_retries'];
696 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
697 +
698 + update_option('loginizer_last_reset', time());
699 +
700 +}
698 701
699 - if(empty($user_login) && empty($user)){
700 - error_log('Loginizer: No user information to send email');
701 - return;
702 +add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
703 +
704 +// Add settings link on plugin page
705 +function loginizer_plugin_action_links($links) {
706 +
707 + if(!defined('LOGINIZER_PREMIUM')){
708 + $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
702 709 }
703 710
704 - if(empty($user)){
705 - $user = get_user_by('login', $user_login);
706 - }
711 + $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
712 + array_unshift($links, $settings_link);
713 +
714 + return $links;
715 +}
707 716
708 - if(empty($user)){
709 - error_log('Loginizer: Unable to get the user');
710 - return;
711 - }
717 +add_action('admin_menu', 'loginizer_admin_menu');
712 718
713 - if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
714 - return;
719 +// Shows the admin menu of Loginizer
720 +function loginizer_admin_menu() {
721 +
722 + global $wp_version, $loginizer;
723 +
724 + if(!defined('SITEPAD')){
725 +
726 + // Add the menu page
727 + add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
728 +
729 + // Dashboard
730 + add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
731 +
732 + }else{
733 +
734 + // Add the menu page
735 + add_menu_page(__('Security'), __('Security'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
736 +
737 + // Rename Login
738 + add_submenu_page('loginizer', __('Security Settings'), __('Rename Login'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
739 +
715 740 }
716 -
717 - // Check if the user role is enabled for email notification.
718 - if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){
719 - return;
741 +
742 + // Brute Force
743 + add_submenu_page('loginizer', __('Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
744 +
745 + if(defined('LOGINIZER_PREMIUM')){
746 +
747 + // PasswordLess
748 + add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
749 +
750 + // Security Settings
751 + if(!defined('SITEPAD')){
752 +
753 + // Two Factor Auth
754 + add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
755 +
756 + }
757 +
758 + // reCaptcha
759 + add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
760 +
761 + // Security Settings
762 + if(!defined('SITEPAD')){
763 +
764 + // Security Settings
765 + add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
766 +
767 + // File Checksums
768 + add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
769 +
770 + }
771 +
772 + }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
773 +
774 + // Go Pro link
775 + add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
776 +
720 777 }
778 +
779 +}
721 780
722 - // current_datetime & wp_timezone_string were introduced in WordPress 5.3
723 - if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){
724 - $time_zone = wp_timezone_string();
781 +// The Loginizer Admin Options Page
782 +function loginizer_page_header($title = 'Loginizer'){
783 +
784 + global $loginizer;
725 785
726 - if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){
727 - $time_zone = 'UTC'.$time_zone;
728 - }
786 +?>
787 +<style>
788 +.lz-right-ul{
789 + padding-left: 10px !important;
790 +}
729 791
730 - // Setting up data variables.
731 - $date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone;
732 - } else {
733 - $date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get();
792 +.lz-right-ul li{
793 + list-style: circle !important;
794 +}
795 +</style>
796 +<?php
797 +
798 + echo '<div style="margin: 10px 20px 0 2px;">
799 +<div class="metabox-holder columns-2">
800 +<div class="postbox-container">
801 +<div id="top-sortables" class="meta-box-sortables ui-sortable">
802 +
803 + <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
804 + <tr>
805 + <td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
806 +
807 + if(!defined('SITEPAD')){
808 +
809 + echo '<td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
810 + <td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
811 + <td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
812 +
734 813 }
814 +
815 + echo '
816 + </tr>
817 + </table>
818 + <hr />
819 +
820 + <!--Main Table-->
821 + <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
822 + <tr>
823 + <td valign="top">';
735 824
736 - $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
737 - $email = $user->data->user_email;
825 +}
738 826
739 - $vars = array(
740 - 'date' => $date,
741 - 'ip' => esc_html($loginizer['current_ip']),
742 - 'sitename' => $sitename,
743 - 'user_login' => $user_login
744 - );
745 -
746 - $message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
747 - $subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
827 +// The Loginizer Theme footer
828 +function loginizer_page_footer(){
748 829
749 - $headers = [];
830 + echo '</td>
831 + <td width="200" valign="top" id="loginizer-right-bar">';
832 +
833 + if(!defined('SITEPAD')){
750 834
751 - // Do we need to send the email as HTML ?
752 - if(!empty($loginizer['login_mail']['html_mail'])){
753 - $headers[] = 'Content-Type: text/html; charset=UTF-8';
835 + if(!defined('LOGINIZER_PREMIUM')){
754 836
755 - if(!empty($loginizer['login_mail']['body'])){
756 - $message = html_entity_decode($message);
837 + echo '
838 + <div class="postbox" style="min-width:0px !important;">
839 + <h2 class="hndle ui-sortable-handle">
840 + <span>Premium Version</span>
841 + </h2>
842 + <div class="inside">
843 + <i>Upgrade to the premium version and get the following features </i>:<br>
844 + <ul class="lz-right-ul">
845 + <li>PasswordLess Login</li>
846 + <li>Two Factor Auth - Email</li>
847 + <li>Two Factor Auth - App</li>
848 + <li>Login Challenge Question</li>
849 + <li>reCAPTCHA</li>
850 + <li>Rename Login Page</li>
851 + <li>Disable XML-RPC</li>
852 + <li>And many more ...</li>
853 + </ul>
854 + <center><a class="button button-primary" href="https://loginizer.com/pricing">Upgrade</a></center>
855 + </div>
856 + </div>';
857 +
757 858 }else{
758 - $message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message);
759 - $message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message);
859 +
860 + echo '
861 + <div class="postbox" style="min-width:0px !important;">
862 + <h2 class="hndle ui-sortable-handle">
863 + <span>Recommendations</span>
864 + </h2>
865 + <div class="inside">
866 + <i>We recommed that you enable atleast one of the following security features</i>:<br>
867 + <ul class="lz-right-ul">
868 + <li>Rename Login Page</li>
869 + <li>Login Challenge Question</li>
870 + <li>reCAPTCHA</li>
871 + <li>Two Factor Auth - Email</li>
872 + <li>Two Factor Auth - App</li>
873 + <li>Change \'admin\' Username</li>
874 + </ul>
875 + </div>
876 + </div>';
760 877 }
878 +
879 + echo '
880 + <div class="postbox" style="min-width:0px !important;">
881 + <h2 class="hndle ui-sortable-handle">
882 + <span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
883 + </h2>
884 + <div class="inside">
885 + <i>Easily manage and make professional pages and content with our Pagelayer builder </i>:<br>
886 + <ul class="lz-right-ul">
887 + <li>30+ Free Widgets</li>
888 + <li>60+ Premium Widgets</li>
889 + <li>400+ Premium Sections</li>
890 + <li>Theme Builder</li>
891 + <li>WooCommerce Builder</li>
892 + <li>Theme Creator and Exporter</li>
893 + <li>Form Builder</li>
894 + <li>Popup Builder</li>
895 + <li>And many more ...</li>
896 + </ul>
897 + <center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">Visit Pagelayer</a></center>
898 + </div>
899 + </div>';
900 +
901 + echo '
902 + <div class="postbox" style="min-width:0px !important;">
903 + <h2 class="hndle ui-sortable-handle">
904 + <span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
905 + </h2>
906 + <div class="inside">
907 + <i>Manage all your WordPress sites from <b>1 dashboard</b> </i>:<br>
908 + <ul class="lz-right-ul">
909 + <li>1-click Admin Access</li>
910 + <li>Update WordPress</li>
911 + <li>Update Themes</li>
912 + <li>Update Plugins</li>
913 + <li>Backup your WordPress Site</li>
914 + <li>Plugins & Theme Management</li>
915 + <li>Post Management</li>
916 + <li>And many more ...</li>
917 + </ul>
918 + <center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">Visit wpCentral</a></center>
919 + </div>
920 + </div>';
921 +
761 922 }
762 -
763 - // Sending notification
764 - if(empty(wp_mail($email, $subject, $message, $headers))){
765 - error_log(__('There was a problem sending your email.', 'loginizer'));
766 - return;
923 +
924 + echo '</td>
925 + </tr>
926 + </table>';
927 +
928 + if(!defined('SITEPAD')){
929 +
930 + echo '<br />
931 + <div style="width:45%;background:#FFF;padding:15px; margin:auto">
932 + <b>Let your friends know that you have secured your website :</b>
933 + <form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
934 + <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
935 + &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
936 + </form>
937 +
938 + </div>
939 + <br />
940 +
941 + <script>
942 + function dotweet(ele){
943 + window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
944 + return false;
767 945 }
768 -}
769 -
770 -function loginizer_update_attempt_stats($type){
771 -
772 - $stats = get_option('loginizer_login_attempt_stats', []);
773 - $time = strtotime(date('Y-m-d H:00:00'));
946 + </script>
774 947
775 - if(empty($stats[$time][$type])){
776 - $stats[$time][$type] = 0;
948 + <hr />
949 + <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
950 +
777 951 }
952 +
953 + echo '
954 +</div>
955 +</div>
956 +</div>
957 +</div>';
778 958
779 - $stats[$time][$type] += 1;
780 -
781 - update_option('loginizer_login_attempt_stats', $stats, false);
782 959 }
783 960
784 -// Handles the error of the password not being there
785 -function loginizer_error_handler($errors, $redirect_to){
961 +// The Loginizer Admin Options Page
962 +function loginizer_page_dashboard(){
786 963
787 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
964 + global $loginizer, $lz_error, $lz_env;
965 +
966 + if(!current_user_can('manage_options')){
967 + wp_die('Sorry, but you do not have permissions to change settings.');
968 + }
969 +
970 + // Dismiss the announcement
971 + if(isset($_GET['dismiss_announcement'])){
972 + update_option('loginizer_no_announcement', 1);
973 + }
788 974
789 - //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
790 - if(is_null($errors) || empty($errors)){
791 - return true;
975 + /* Make sure post was from this page */
976 + if(count($_POST) > 0){
977 + check_admin_referer('loginizer-options');
792 978 }
793 979
794 - // Remove the empty password error
795 - if(is_wp_error($errors)){
980 + // Is there a license key ?
981 + if(isset($_POST['save_lz'])){
982 +
983 + $license = lz_optpost('lz_license');
796 984
797 - $codes = $errors->get_error_codes();
985 + // Check if its a valid license
986 + if(empty($license)){
987 + $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
988 + return loginizer_page_dashboard_T();
989 + }
798 990
799 - foreach($codes as $k => $v){
800 - if($v == 'invalid_username' || $v == 'incorrect_password'){
801 - $show_error = 1;
802 - }
991 + $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license, array('timeout' => 30));
992 +
993 + if(is_array($resp)){
994 + $json = json_decode($resp['body'], true);
995 + //print_r($json);
996 + }else{
997 +
998 + $lz_error['resp_invalid'] = __('The response was malformed<br>'.var_export($resp, true), 'loginizer');
999 + return loginizer_page_dashboard_T();
1000 +
803 1001 }
804 1002
805 - $errors->remove('invalid_username');
806 - $errors->remove('incorrect_password');
1003 + // Save the License
1004 + if(empty($json['license'])){
1005 +
1006 + $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
1007 + return loginizer_page_dashboard_T();
1008 +
1009 + }else{
1010 +
1011 + update_option('loginizer_license', $json);
1012 +
1013 + // Mark as saved
1014 + $GLOBALS['lz_saved'] = true;
1015 + }
1016 +
1017 + }
807 1018
808 - // Add the error
809 - if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
810 - $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
1019 +
1020 + // Is there a IP Method ?
1021 + if(isset($_POST['save_lz_ip_method'])){
1022 +
1023 + $ip_method = (int) lz_optpost('lz_ip_method');
1024 + $custom_ip_method = lz_optpost('lz_custom_ip_method');
1025 +
1026 + if($ip_method >= 0 && $ip_method <= 3){
1027 + update_option('loginizer_ip_method', $ip_method);
811 1028 }
812 1029
813 - // Add the number of retires left as well
814 - if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
815 - $errors->add('retries_left', loginizer_retries_left());
1030 + // Custom Method name ?
1031 + if($ip_method == 3){
1032 + update_option('loginizer_custom_ip_method', $custom_ip_method);
816 1033 }
817 -
1034 +
818 1035 }
819 1036
820 - return $errors;
1037 + loginizer_page_dashboard_T();
821 1038
822 1039 }
823 1040
824 -// Handles the error of the password not being there
825 -function loginizer_woocommerce_error_handler(){
1041 +// The Loginizer Admin Options Page - THEME
1042 +function loginizer_page_dashboard_T(){
1043 +
1044 + global $loginizer, $lz_error, $lz_env;
826 1045
827 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
828 -
829 - if(function_exists('wc_add_notice')){
830 - wc_add_notice( loginizer_retries_left(), 'error' );
831 - }
1046 + loginizer_page_header('Dashboard');
1047 +?>
1048 +<style>
1049 +.welcome-panel{
1050 + margin: 0px;
1051 + padding: 10px;
832 1052 }
833 1053
834 -function loginizer_ultimatemember_error_handler(){
835 -
836 - if(class_exists('UM')){
837 - \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
838 - }
1054 +input[type="text"], textarea, select {
1055 + width: 70%;
839 1056 }
840 1057
841 -// Handles social login URL
842 -function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
843 - global $loginizer;
1058 +.form-table label{
1059 + font-weight:bold;
1060 +}
844 1061
845 - loginizer_get_social_error();
846 -
847 - if(empty($loginizer['social_errors'])){
848 - return $errors;
1062 +.exp{
1063 + font-size:12px;
1064 +}
1065 +</style>
1066 +
1067 + <?php
1068 +
1069 + $hide_announcement = get_option('loginizer_no_announcement');
1070 + if(empty($hide_announcement)){
1071 + echo '<div id="message" class="welcome-panel">'. __('<a href="https://loginizer.com/blog/loginizer-has-been-acquired-by-softaculous/" target="_blank" style="text-decoration:none;">We are excited to announce that we have joined forces with Softaculous and have been acquired by them 😊. Read full announcement here.</a>', 'loginizer'). '<a class="welcome-panel-close" style="top:3px;right:2px;" href="'.menu_page_url('loginizer', false).'&dismiss_announcement=1" aria-label="Dismiss announcement"></a></div><br />';
849 1072 }
1073 +
1074 + echo '<script src="https://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
850 1075
851 - if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
852 - $errors = new WP_Error();
1076 + // Saved ?
1077 + if(!empty($GLOBALS['lz_saved'])){
1078 + echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
853 1079 }
854 -
855 - foreach($loginizer['social_errors'] as $key => $text){
856 - $errors->add($key, $text);
1080 +
1081 + // Any errors ?
1082 + if(!empty($lz_error)){
1083 + lz_report_error($lz_error);echo '<br />';
857 1084 }
858 -
859 - return $errors;
860 -}
861 -
862 -// Returns a string with the number of retries left
863 -function loginizer_retries_left(){
864 1085
865 - global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
1086 + ?>
866 1087
867 - // If we are to show the number of retries left
868 - if(isset($loginizer['retries_left'])){
869 - $retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
1088 + <div class="postbox">
1089 +
1090 + <button class="handlediv button-link" aria-expanded="true" type="button">
1091 + <span class="screen-reader-text">Toggle panel: Getting Started</span>
1092 + <span class="toggle-indicator" aria-hidden="true"></span>
1093 + </button>
870 1094
871 - return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
872 - }
1095 + <h2 class="hndle ui-sortable-handle">
1096 + <span><?php echo __('Getting Started', 'loginizer'); ?></span>
1097 + </h2>
1098 +
1099 + <div class="inside">
1100 +
1101 + <form action="" method="post" enctype="multipart/form-data">
1102 + <?php wp_nonce_field('loginizer-options'); ?>
1103 + <table class="form-table">
1104 + <tr>
1105 + <td scope="row" valign="top" colspan="2" style="line-height:150%">
1106 + <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
1107 + <?php
1108 + if(defined('LOGINIZER_PREMIUM')){
1109 + echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
1110 + }
1111 + ?>
1112 + </td>
1113 + </tr>
1114 + </table>
1115 + </form>
1116 +
1117 + </div>
1118 + </div>
873 1119
874 -}
1120 + <div class="postbox">
1121 +
1122 + <button class="handlediv button-link" aria-expanded="true" type="button">
1123 + <span class="screen-reader-text">Toggle panel: System Information</span>
1124 + <span class="toggle-indicator" aria-hidden="true"></span>
1125 + </button>
1126 +
1127 + <h2 class="hndle ui-sortable-handle">
1128 + <span><?php echo __('System Information', 'loginizer'); ?></span>
1129 + </h2>
1130 +
1131 + <div class="inside">
1132 +
1133 + <form action="" method="post" enctype="multipart/form-data">
1134 + <?php wp_nonce_field('loginizer-options'); ?>
1135 + <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1136 + <?php
1137 + echo '
1138 + <tr>
1139 + <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1140 + <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
1141 + </tr>';
1142 +
1143 + if(defined('LOGINIZER_PREMIUM')){
1144 + echo '
1145 + <tr>
1146 + <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
1147 + <td align="left">
1148 + '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
1149 + <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
1150 + <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
1151 +
1152 + if(!empty($loginizer['license'])){
1153 +
1154 + $expires = $loginizer['license']['expires'];
1155 + $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
1156 +
1157 + echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
1158 + License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
1159 + </div>';
1160 + }
1161 +
1162 +
1163 + echo
1164 + '</td>
1165 + </tr>';
1166 + }
1167 +
1168 + echo '<tr>
1169 + <th align="left">'.__('URL', 'loginizer').'</th>
1170 + <td>'.get_site_url().'</td>
1171 + </tr>
1172 + <tr>
1173 + <th align="left">'.__('Path', 'loginizer').'</th>
1174 + <td>'.ABSPATH.'</td>
1175 + </tr>
1176 + <tr>
1177 + <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1178 + <td>'.@$_SERVER['SERVER_ADDR'].'</td>
1179 + </tr>
1180 + <tr>
1181 + <th align="left">'.__('Your IP Address', 'loginizer').'</th>
1182 + <td>'.lz_getip().'
1183 + <div style="float:right">
1184 + Method :
1185 + <select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1186 + <option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1187 + <option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1188 + <option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1189 + <option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1190 + </select>
1191 + <input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1192 + <input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1193 + </div>
1194 + </td>
1195 + </tr>
1196 + <tr>
1197 + <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1198 + <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1199 + </tr>';
1200 +
1201 + if(file_exists(ABSPATH.'/.htaccess')){
1202 + echo '
1203 + <tr>
1204 + <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1205 + <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1206 + </tr>';
1207 +
1208 + }
1209 +
1210 + ?>
1211 + </table>
1212 + </form>
1213 +
1214 + </div>
1215 + </div>
875 1216
876 -function loginizer_reset_retries(){
1217 +<script type="text/javascript">
877 1218
878 - global $wpdb, $loginizer;
1219 +function lz_ip_method_handle(){
1220 + var ele = jQuery('#lz_ip_method');
1221 + if(ele.val() == 3){
1222 + jQuery('#lz_custom_ip_method').show();
1223 + }else{
1224 + jQuery('#lz_custom_ip_method').hide();
1225 + }
1226 +};
879 1227
880 - $deltime = time() - $loginizer['reset_retries'];
1228 +lz_ip_method_handle();
881 1229
882 - $del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
883 - $result = $wpdb->query($del_query);
1230 +</script>
1231 +
1232 + <div id="" class="postbox">
1233 +
1234 + <button class="handlediv button-link" aria-expanded="true" type="button">
1235 + <span class="screen-reader-text">Toggle panel: File Permissions</span>
1236 + <span class="toggle-indicator" aria-hidden="true"></span>
1237 + </button>
1238 +
1239 + <h2 class="hndle ui-sortable-handle">
1240 + <span><?php echo __('File Permissions', 'loginizer'); ?></span>
1241 + </h2>
1242 +
1243 + <div class="inside">
1244 +
1245 + <form action="" method="post" enctype="multipart/form-data">
1246 + <?php wp_nonce_field('loginizer-options'); ?>
1247 + <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1248 + <?php
1249 +
1250 + echo '
1251 + <tr>
1252 + <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1253 + <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1254 + <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1255 + </tr>';
1256 +
1257 + $wp_content = basename(dirname(dirname(dirname(__FILE__))));
1258 +
1259 + $files_to_check = array('/' => '0755',
1260 + '/wp-admin' => '0755',
1261 + '/wp-includes' => '0755',
1262 + '/wp-config.php' => '0444',
1263 + '/'.$wp_content => '0755',
1264 + '/'.$wp_content.'/themes' => '0755',
1265 + '/'.$wp_content.'/plugins' => '0755',
1266 + '.htaccess' => '0444');
1267 +
1268 + $root = ABSPATH;
1269 +
1270 + foreach($files_to_check as $k => $v){
1271 +
1272 + $path = $root.'/'.$k;
1273 + $stat = @stat($path);
1274 + $suggested = $v;
1275 + $actual = substr(sprintf('%o', $stat['mode']), -4);
1276 +
1277 + echo '
1278 + <tr>
1279 + <td>'.$k.'</td>
1280 + <td>'.$suggested.'</td>
1281 + <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1282 + </tr>';
1283 +
1284 + }
1285 +
1286 + ?>
1287 + </table>
1288 + </form>
1289 +
1290 + </div>
1291 + </div>
884 1292
885 - update_option('loginizer_last_reset', time());
1293 +<?php
1294 +
1295 + loginizer_page_footer();
886 1296
887 1297 }
888 1298
889 -function loginizer_load_translation_vars(){
890 - global $loginizer;
891 -
892 - $loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
893 - $loginizer['login_mail_default_msg'] = __('Hello $user_login,
1299 +// The Loginizer Admin Options Page
1300 +function loginizer_page_brute_force(){
894 1301
895 -Your account was recently logged in from the IP : $ip
896 -Time : $date
897 -If it was not you who logged in then please report this to us immediately.
1302 + global $wpdb, $wp_roles, $loginizer;
1303 +
1304 + if(!current_user_can('manage_options')){
1305 + wp_die('Sorry, but you do not have permissions to change settings.');
1306 + }
898 1307
899 -Regards,
900 -$sitename','loginizer');
901 -
902 - if(empty($loginizer['login_mail_subject'])){
903 - $loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
1308 + /* Make sure post was from this page */
1309 + if(count($_POST) > 0){
1310 + check_admin_referer('loginizer-options');
904 1311 }
905 1312
906 - if(empty($loginizer['login_mail_body'])){
907 - $loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
1313 + // BEGIN THEME
1314 + loginizer_page_header('Brute Force Settings');
1315 +
1316 + // Load the blacklist and whitelist
1317 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
1318 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
1319 +
1320 + // Disable Brute Force
1321 + if(isset($_POST['disable_brute_lz'])){
1322 +
1323 + // Save the options
1324 + update_option('loginizer_disable_brute', 1);
1325 +
1326 + $loginizer['disable_brute'] = 1;
1327 +
1328 + echo '<div id="message" class="updated"><p>'
1329 + . __('The Brute Force Protection feature is now disabled', 'loginizer')
1330 + . '</p></div><br />';
1331 +
908 1332 }
909 1333
910 - // Default messages
911 - $loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
912 - $loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
913 - $loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
914 - $loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
915 - $loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
916 - $loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
1334 + // Enable brute force
1335 + if(isset($_POST['enable_brute_lz'])){
1336 +
1337 + // Save the options
1338 + update_option('loginizer_disable_brute', 0);
1339 +
1340 + $loginizer['disable_brute'] = 0;
1341 +
1342 + echo '<div id="message" class="updated"><p>'
1343 + . __('The Brute Force Protection feature is now enabled', 'loginizer')
1344 + . '</p></div><br />';
1345 +
1346 + }
917 1347
918 - // Message Strings
919 - $loginizer['msg'] = get_option('loginizer_msg', []);
1348 + // The Brute Force Settings
1349 + if(isset($_POST['save_lz'])){
1350 +
1351 + $max_retries = (int) lz_optpost('max_retries');
1352 + $lockout_time = (int) lz_optpost('lockout_time');
1353 + $max_lockouts = (int) lz_optpost('max_lockouts');
1354 + $lockouts_extend = (int) lz_optpost('lockouts_extend');
1355 + $reset_retries = (int) lz_optpost('reset_retries');
1356 + $notify_email = (int) lz_optpost('notify_email');
1357 +
1358 + $lockout_time = $lockout_time * 60;
1359 + $lockouts_extend = $lockouts_extend * 60 * 60;
1360 + $reset_retries = $reset_retries * 60 * 60;
1361 +
1362 + if(empty($error)){
1363 +
1364 + $option['max_retries'] = $max_retries;
1365 + $option['lockout_time'] = $lockout_time;
1366 + $option['max_lockouts'] = $max_lockouts;
1367 + $option['lockouts_extend'] = $lockouts_extend;
1368 + $option['reset_retries'] = $reset_retries;
1369 + $option['notify_email'] = $notify_email;
1370 +
1371 + // Save the options
1372 + update_option('loginizer_options', $option);
1373 +
1374 + $saved = true;
1375 +
1376 + }else{
1377 + lz_report_error($error);
1378 + }
920 1379
921 - foreach($loginizer['d_msg'] as $lk => $lv){
922 - if(empty($loginizer['msg'][$lk])){
923 - $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
1380 + if(!empty($notice)){
1381 + lz_report_notice($notice);
924 1382 }
1383 +
1384 + if(!empty($saved)){
1385 + echo '<div id="message" class="updated"><p>'
1386 + . __('The settings were saved successfully', 'loginizer')
1387 + . '</p></div><br />';
1388 + }
1389 +
925 1390 }
926 1391
927 - $loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
928 - $loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
929 - $loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
930 - $loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
931 - $loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
1392 + // Delete a Blackist IP range
1393 + if(isset($_POST['bdelid'])){
1394 +
1395 + $delid = (int) lz_optreq('bdelid');
1396 +
1397 + // Unset and save
1398 + $blacklist = $loginizer['blacklist'];
1399 + unset($blacklist[$delid]);
1400 + update_option('loginizer_blacklist', $blacklist);
1401 +
1402 + echo '<div id="message" class="updated fade"><p>'
1403 + . __('The Blacklist IP range has been deleted successfully', 'loginizer')
1404 + . '</p></div><br />';
1405 +
1406 + }
932 1407
933 - // Message Strings
934 - $loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
1408 + // Delete all Blackist IP ranges
1409 + if(isset($_POST['del_all_blacklist'])){
1410 +
1411 + // Unset and save
1412 + update_option('loginizer_blacklist', array());
1413 +
1414 + echo '<div id="message" class="updated fade"><p>'
1415 + . __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1416 + . '</p></div><br />';
1417 +
1418 + }
935 1419
936 - foreach($loginizer['2fa_d_msg'] as $lk => $lv){
937 - if(empty($loginizer['2fa_msg'][$lk])){
938 - $loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
1420 + // Delete a Whitelist IP range
1421 + if(isset($_POST['delid'])){
1422 +
1423 + $delid = (int) lz_optreq('delid');
1424 +
1425 + // Unset and save
1426 + $whitelist = $loginizer['whitelist'];
1427 + unset($whitelist[$delid]);
1428 + update_option('loginizer_whitelist', $whitelist);
1429 +
1430 + echo '<div id="message" class="updated fade"><p>'
1431 + . __('The Whitelist IP range has been deleted successfully', 'loginizer')
1432 + . '</p></div><br />';
1433 +
1434 + }
1435 +
1436 + // Delete all Blackist IP ranges
1437 + if(isset($_POST['del_all_whitelist'])){
1438 +
1439 + // Unset and save
1440 + update_option('loginizer_whitelist', array());
1441 +
1442 + echo '<div id="message" class="updated fade"><p>'
1443 + . __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1444 + . '</p></div><br />';
1445 +
1446 + }
1447 +
1448 + // Reset All Logs
1449 + if(isset($_POST['lz_reset_all_ip'])){
1450 +
1451 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1452 + WHERE `time` > 0");
1453 +
1454 + echo '<div id="message" class="updated fade"><p>'
1455 + . __('All the IP Logs have been cleared', 'loginizer')
1456 + . '</p></div><br />';
1457 + }
1458 +
1459 + // Reset Logs
1460 + if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1461 +
1462 + $ips = $_POST['lz_reset_ips'];
1463 +
1464 + foreach($ips as $ip){
1465 + if(!lz_valid_ip($ip)){
1466 + $error[] = 'The IP - '.$ip.' is invalid !';
1467 + }
939 1468 }
1469 +
1470 + if(count($ips) < 1){
1471 + $error[] = 'There are no IPs submitted';
1472 + }
1473 +
1474 + // Should we start deleting logs
1475 + if(empty($error)){
1476 +
1477 + $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1478 + WHERE `ip` IN ('".implode("', '", $ips)."')");
1479 +
1480 + if(empty($error)){
1481 +
1482 + echo '<div id="message" class="updated fade"><p>'
1483 + . __('The selected IP Logs have been reset', 'loginizer')
1484 + . '</p></div><br />';
1485 +
1486 + }
1487 +
1488 + }
1489 +
1490 + if(!empty($error)){
1491 + lz_report_error($error);echo '<br />';
1492 + }
1493 +
940 1494 }
941 1495
1496 + if(isset($_POST['blacklist_iprange'])){
1497 +
1498 + $start_ip = lz_optpost('start_ip');
1499 + $end_ip = lz_optpost('end_ip');
1500 +
1501 + if(empty($start_ip)){
1502 + $error[] = 'Please enter the Start IP';
1503 + }
1504 +
1505 + // If no end IP we consider only 1 IP
1506 + if(empty($end_ip)){
1507 + $end_ip = $start_ip;
1508 + }
1509 +
1510 + if(!lz_valid_ip($start_ip)){
1511 + $error[] = 'Please provide a valid start IP';
1512 + }
1513 +
1514 + if(!lz_valid_ip($end_ip)){
1515 + $error[] = 'Please provide a valid end IP';
1516 + }
1517 +
1518 + // Regular ranges will work
1519 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1520 +
1521 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1522 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1523 + // This is right
1524 + }else{
1525 + $error[] = 'The End IP cannot be smaller than the Start IP';
1526 + }
1527 +
1528 + }
1529 +
1530 + if(empty($error)){
1531 +
1532 + $blacklist = $loginizer['blacklist'];
1533 +
1534 + foreach($blacklist as $k => $v){
1535 +
1536 + // This is to check if there is any other range exists with the same Start or End IP
1537 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1538 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1539 + ){
1540 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1541 + break;
1542 + }
1543 +
1544 + // This is to check if there is any other range exists with the same Start IP
1545 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1546 + $error[] = 'The Start IP is present in an existing range !';
1547 + break;
1548 + }
1549 +
1550 + // This is to check if there is any other range exists with the same End IP
1551 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1552 + $error[] = 'The End IP is present in an existing range!';
1553 + break;
1554 + }
1555 +
1556 + }
1557 +
1558 + $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1559 +
1560 + if(empty($error)){
1561 +
1562 + $blacklist[$newid] = array();
1563 + $blacklist[$newid]['start'] = $start_ip;
1564 + $blacklist[$newid]['end'] = $end_ip;
1565 + $blacklist[$newid]['time'] = time();
1566 +
1567 + update_option('loginizer_blacklist', $blacklist);
1568 +
1569 + echo '<div id="message" class="updated fade"><p>'
1570 + . __('Blacklist IP range added successfully', 'loginizer')
1571 + . '</p></div><br />';
1572 +
1573 + }
1574 +
1575 + }
1576 +
1577 + if(!empty($error)){
1578 + lz_report_error($error);echo '<br />';
1579 + }
1580 +
1581 + }
1582 +
1583 + if(isset($_POST['whitelist_iprange'])){
1584 +
1585 + $start_ip = lz_optpost('start_ip_w');
1586 + $end_ip = lz_optpost('end_ip_w');
1587 +
1588 + if(empty($start_ip)){
1589 + $error[] = 'Please enter the Start IP';
1590 + }
1591 +
1592 + // If no end IP we consider only 1 IP
1593 + if(empty($end_ip)){
1594 + $end_ip = $start_ip;
1595 + }
1596 +
1597 + if(!lz_valid_ip($start_ip)){
1598 + $error[] = 'Please provide a valid start IP';
1599 + }
1600 +
1601 + if(!lz_valid_ip($end_ip)){
1602 + $error[] = 'Please provide a valid end IP';
1603 + }
1604 +
1605 + if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1606 +
1607 + // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1608 + if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1609 + // This is right
1610 + }else{
1611 + $error[] = 'The End IP cannot be smaller than the Start IP';
1612 + }
1613 +
1614 + }
1615 +
1616 + if(empty($error)){
1617 +
1618 + $whitelist = $loginizer['whitelist'];
1619 +
1620 + foreach($whitelist as $k => $v){
1621 +
1622 + // This is to check if there is any other range exists with the same Start or End IP
1623 + if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1624 + || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1625 + ){
1626 + $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1627 + break;
1628 + }
1629 +
1630 + // This is to check if there is any other range exists with the same Start IP
1631 + if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1632 + $error[] = 'The Start IP is present in an existing range !';
1633 + break;
1634 + }
1635 +
1636 + // This is to check if there is any other range exists with the same End IP
1637 + if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1638 + $error[] = 'The End IP is present in an existing range!';
1639 + break;
1640 + }
1641 +
1642 + }
1643 +
1644 + $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1645 +
1646 + if(empty($error)){
1647 +
1648 + $whitelist[$newid] = array();
1649 + $whitelist[$newid]['start'] = $start_ip;
1650 + $whitelist[$newid]['end'] = $end_ip;
1651 + $whitelist[$newid]['time'] = time();
1652 +
1653 + update_option('loginizer_whitelist', $whitelist);
1654 +
1655 + echo '<div id="message" class="updated fade"><p>'
1656 + . __('Whitelist IP range added successfully', 'loginizer')
1657 + . '</p></div><br />';
1658 +
1659 + }
1660 +
1661 + }
1662 +
1663 + if(!empty($error)){
1664 + lz_report_error($error);echo '<br />';
1665 + }
1666 + }
1667 +
1668 + // Save the messages
1669 + if(isset($_POST['save_err_msgs_lz'])){
1670 +
1671 + $msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1672 + $msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1673 +
1674 + // Update them
1675 + update_option('loginizer_msg', $msgs);
1676 +
1677 + echo '<div id="message" class="updated fade"><p>'
1678 + . __('Error messages were saved successfully', 'loginizer')
1679 + . '</p></div><br />';
1680 +
1681 + }
1682 +
1683 + // Count the Results
1684 + $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1685 + //print_r($tmp);
1686 +
1687 + // Which Page is it
1688 + $lz_env['res_len'] = 10;
1689 + $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1690 + $lz_env['num_res'] = $tmp['num'];
1691 + $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1692 +
1693 + // Get the logs
1694 + $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1695 + ORDER BY `time` DESC
1696 + LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1697 + //print_r($result);
1698 +
1699 + $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1700 + $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1701 + $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1702 + $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1703 +
1704 + // Reload the settings
1705 + $loginizer['blacklist'] = get_option('loginizer_blacklist');
1706 + $loginizer['whitelist'] = get_option('loginizer_whitelist');
1707 +
1708 + $saved_msgs = get_option('loginizer_msg');
1709 +
1710 + ?>
1711 +
1712 + <div id="" class="postbox">
1713 +
1714 + <button class="handlediv button-link" aria-expanded="true" type="button">
1715 + <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
1716 + <span class="toggle-indicator" aria-hidden="true"></span>
1717 + </button>
1718 +
1719 + <h2 class="hndle ui-sortable-handle">
1720 + <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1721 + </h2>
1722 +
1723 + <script>
1724 + function yesdsd(){
1725 + window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1726 + return false;
1727 + }
1728 + </script>
1729 +
1730 + <form method="get" onsubmit="return yesdsd();">
1731 + <div class="tablenav">
1732 + <p class="tablenav-pages" style="margin: 5px 10px" align="right">
1733 + <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1734 + <span class="pagination-links">
1735 + <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1736 + <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1737 + <span class="paging-input">
1738 + <label for="current-page-selector" class="screen-reader-text">Current Page</label>
1739 + <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1740 + </span>
1741 + <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1742 + <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1743 + </span>
1744 + </p>
1745 + </div>
1746 + </form>
1747 +
1748 + <form action="" method="post" enctype="multipart/form-data">
1749 + <?php wp_nonce_field('loginizer-options'); ?>
1750 + <div class="inside">
1751 + <table class="wp-list-table widefat fixed users" border="0">
1752 + <tr>
1753 + <th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
1754 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1755 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
1756 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1757 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1758 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
1759 + <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
1760 + </tr>
1761 + <?php
1762 +
1763 + if(empty($result)){
1764 + echo '
1765 + <tr>
1766 + <td colspan="4">
1767 + No Logs. You will see logs about failed login attempts here.
1768 + </td>
1769 + </tr>';
1770 + }else{
1771 + foreach($result as $ik => $iv){
1772 + $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1773 + echo '
1774 + <tr>
1775 + <td>
1776 + <input type="checkbox" value="'.$iv['ip'].'" name="lz_reset_ips[]" />
1777 + </td>
1778 + <td>
1779 + '.$iv['ip'].'
1780 + </td>
1781 + <td>
1782 + '.$iv['username'].'
1783 + </td>
1784 + <td>
1785 + '.date('d/M/Y H:i:s P', $iv['time']).'
1786 + </td>
1787 + <td>
1788 + '.$iv['count'].'
1789 + </td>
1790 + <td>
1791 + '.$iv['lockout'].'
1792 + </td>
1793 + <td>
1794 + '.$iv['url'].'
1795 + </td>
1796 + </tr>';
1797 + }
1798 + }
1799 +
1800 + ?>
1801 + </table>
1802 +
1803 + <br>
1804 + <input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
1805 + &nbsp; &nbsp;
1806 + <input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
1807 + </div>
1808 + </div>
1809 + </form>
1810 + <br />
1811 +
1812 + <div id="" class="postbox">
1813 +
1814 + <button class="handlediv button-link" aria-expanded="true" type="button">
1815 + <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
1816 + <span class="toggle-indicator" aria-hidden="true"></span>
1817 + </button>
1818 +
1819 + <h2 class="hndle ui-sortable-handle">
1820 + <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1821 + </h2>
1822 +
1823 + <div class="inside">
1824 +
1825 + <form action="" method="post" enctype="multipart/form-data">
1826 + <?php wp_nonce_field('loginizer-options'); ?>
1827 + <table class="form-table">
1828 + <tr>
1829 + <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1830 + <td>
1831 + <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1832 + </td>
1833 + </tr>
1834 + <tr>
1835 + <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1836 + <td>
1837 + <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1838 + </td>
1839 + </tr>
1840 + <tr>
1841 + <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1842 + <td>
1843 + <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1844 + </td>
1845 + </tr>
1846 + <tr>
1847 + <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
1848 + <td>
1849 + <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
1850 + </td>
1851 + </tr>
1852 + <tr>
1853 + <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
1854 + <td>
1855 + <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
1856 + </td>
1857 + </tr>
1858 + <tr>
1859 + <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
1860 + <td>
1861 + <?php echo __('after ','loginizer'); ?>
1862 + <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
1863 + </td>
1864 + </tr>
1865 + </table><br />
1866 + <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1867 + <?php
1868 +
1869 + if(empty($loginizer['disable_brute'])){
1870 +
1871 + echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1872 +
1873 + }else{
1874 +
1875 + echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
1876 +
1877 + }
1878 +
1879 + ?>
1880 + </form>
1881 +
1882 + </div>
1883 + </div>
1884 + <br />
1885 +
1886 +<?php
1887 +
1888 + wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
1889 +
1890 +?>
1891 +
1892 +<style>
1893 +.page-navigation a {
1894 +margin: 5px 2px;
1895 +display: inline-block;
1896 +padding: 5px 8px;
1897 +color: #0073aa;
1898 +background: #e5e5e5 none repeat scroll 0 0;
1899 +border: 1px solid #ccc;
1900 +text-decoration: none;
1901 +transition-duration: 0.05s;
1902 +transition-property: border, background, color;
1903 +transition-timing-function: ease-in-out;
942 1904 }
1905 +
1906 +.page-navigation a[data-selected] {
1907 +background-color: #00a0d2;
1908 +color: #fff;
1909 +}
1910 +</style>
943 1911
944 -function loginizer_social_login_load(){
945 - include_once LOGINIZER_DIR . '/main/social-login.php';
946 -}
1912 +<script>
947 1913
948 -// Checks if softaculous is installed on the server.
949 -function loginizer_check_softaculous(){
1914 +jQuery(document).ready(function(){
1915 + jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
1916 + jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
1917 +});
950 1918
951 - // Checking if we have Softaculous installed?
952 - if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
953 - return false;
1919 +// Delete a Blacklist / Whitelist IP Range
1920 +function del_confirm(field, todo_id, msg){
1921 + var ret = confirm(msg);
1922 +
1923 + if(ret){
1924 + jQuery('#lz_bl_wl_todo').attr('name', field);
1925 + jQuery('#lz_bl_wl_todo').val(todo_id);
1926 + jQuery('#lz_bl_wl_form').submit();
954 1927 }
1928 +
1929 + return false;
1930 +
1931 +}
955 1932
956 - if(empty($matches) || empty($matches[0])){
957 - return false;
1933 +// Delete all Blacklist / Whitelist IP Ranges
1934 +function del_confirm_all(msg){
1935 + var ret = confirm(msg);
1936 +
1937 + if(ret){
1938 + return true;
958 1939 }
1940 +
1941 + return false;
1942 +
1943 +}
959 1944
960 - $softaculous_path = $matches[0] . '.softaculous/installations.php';
961 - if(!file_exists($softaculous_path)){
962 - return false;
963 - }
1945 +</script>
964 1946
965 - // Checking if users has changed the branding of Softaculous.
966 - $universal_file = '';
967 - // Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
968 - if(file_exists('/usr/local/softaculous/enduser/universal.php')){
969 - $universal_file = '/usr/local/softaculous/enduser/universal.php';
970 - }else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
971 - $universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
972 - }else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
973 - $universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
974 - }else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
975 - $universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
976 - }
1947 + <div id="" class="postbox">
1948 +
1949 + <button class="handlediv button-link" aria-expanded="true" type="button">
1950 + <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
1951 + <span class="toggle-indicator" aria-hidden="true"></span>
1952 + </button>
1953 +
1954 + <h2 class="hndle ui-sortable-handle">
1955 + <span><?php echo __('Blacklist IP','loginizer'); ?></span>
1956 + </h2>
1957 +
1958 + <div class="inside">
1959 +
1960 + <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
1961 +
1962 + <form action="" method="post">
1963 + <?php wp_nonce_field('loginizer-options'); ?>
1964 + <table class="form-table">
1965 + <tr>
1966 + <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
1967 + <td>
1968 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1969 + </td>
1970 + </tr>
1971 + <tr>
1972 + <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1973 + <td>
1974 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1975 + </td>
1976 + </tr>
1977 + </table><br />
1978 + <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1979 + <input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
1980 + </form>
1981 + </div>
1982 +
1983 + <div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
1984 + <table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1985 + <tr>
1986 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1987 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1988 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1989 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1990 + </tr>
1991 + <?php
1992 + if(empty($loginizer['blacklist'])){
1993 + echo '
1994 + <tr>
1995 + <td colspan="4">
1996 + No Blacklist IPs. You will see blacklisted IP ranges here.
1997 + </td>
1998 + </tr>';
1999 + }else{
2000 + foreach($loginizer['blacklist'] as $ik => $iv){
2001 + echo '
2002 + <tr>
2003 + <td>
2004 + '.$iv['start'].'
2005 + </td>
2006 + <td>
2007 + '.$iv['end'].'
2008 + </td>
2009 + <td>
2010 + '.date('d/m/Y', $iv['time']).'
2011 + </td>
2012 + <td>
2013 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2014 + </td>
2015 + </tr>';
2016 + }
2017 + }
2018 + ?>
2019 + </table>
2020 + <br />
2021 + <form action="" method="post" id="lz_bl_wl_form">
2022 + <?php wp_nonce_field('loginizer-options'); ?>
2023 + <input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2024 + </form>
2025 + </div>
2026 +
2027 + <br />
2028 +
2029 + <div id="" class="postbox">
2030 +
2031 + <button class="handlediv button-link" aria-expanded="true" type="button">
2032 + <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
2033 + <span class="toggle-indicator" aria-hidden="true"></span>
2034 + </button>
2035 +
2036 + <h2 class="hndle ui-sortable-handle">
2037 + <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2038 + </h2>
2039 +
2040 + <div class="inside">
2041 +
2042 + <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2043 + <form action="" method="post">
2044 + <?php wp_nonce_field('loginizer-options'); ?>
2045 + <table class="form-table">
2046 + <tr>
2047 + <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2048 + <td>
2049 + <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2050 + </td>
2051 + </tr>
2052 + <tr>
2053 + <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2054 + <td>
2055 + <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2056 + </td>
2057 + </tr>
2058 + </table><br />
2059 + <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2060 + <input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2061 + </form>
2062 + </div>
2063 +
2064 + <div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2065 + <table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2066 + <tr>
2067 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2068 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2069 + <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2070 + <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2071 + </tr>
2072 + <?php
2073 + if(empty($loginizer['whitelist'])){
2074 + echo '
2075 + <tr>
2076 + <td colspan="4">
2077 + No Whitelist IPs. You will see whitelisted IP ranges here.
2078 + </td>
2079 + </tr>';
2080 + }else{
2081 + foreach($loginizer['whitelist'] as $ik => $iv){
2082 + echo '
2083 + <tr>
2084 + <td>
2085 + '.$iv['start'].'
2086 + </td>
2087 + <td>
2088 + '.$iv['end'].'
2089 + </td>
2090 + <td>
2091 + '.date('d/m/Y', $iv['time']).'
2092 + </td>
2093 + <td>
2094 + <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2095 + </td>
2096 + </tr>';
2097 + }
2098 + }
2099 + ?>
2100 + </table>
2101 + <br />
2102 +
2103 + </div>
977 2104
978 - if(empty($universal_file)){
979 - return false;
980 - }
2105 + <div id="" class="postbox">
981 2106
982 - $universal = file_get_contents($universal_file);
2107 + <button class="handlediv button-link" aria-expanded="true" type="button">
2108 + <span class="screen-reader-text">Toggle panel: Error Messages</span>
2109 + <span class="toggle-indicator" aria-hidden="true"></span>
2110 + </button>
983 2111
984 - if(empty($universal)){
985 - return false;
986 - }
2112 + <h2 class="hndle ui-sortable-handle">
2113 + <span><?php echo __('Error Messages', 'loginizer'); ?></span>
2114 + </h2>
987 2115
988 - // Checking if Softaculous is being whitelabeled
989 - if(preg_match('/\$globals\[["\']sn["\']\]\s.?=\s.?["\']Softaculous["\']/', $universal)){
990 - update_option('loginizer_softwp_upgrade', time());
991 - }
2116 + <div class="inside">
992 2117
993 - return false;
2118 + <form action="" method="post" enctype="multipart/form-data">
2119 + <?php wp_nonce_field('loginizer-options'); ?>
2120 + <table class="form-table">
2121 + <tr>
2122 + <th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2123 + <td>
2124 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2125 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['inv_userpass']. '&quot;</em>', 'loginizer'); ?><br />
2126 + </td>
2127 + </tr>
2128 + <tr>
2129 + <th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2130 + <td>
2131 + <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2132 + <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['ip_blacklisted']. '&quot;</em>', 'loginizer'); ?><br />
2133 + </td>
2134 + </tr>
2135 + </table><br />
2136 + <input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2137 + </form>
2138 + </div>
2139 + </div>
2140 +<?php
2141 +
2142 +loginizer_page_footer();
2143 +
994 2144 }
995 2145
2146 +
996 2147 // Sorry to see you going
997 2148 register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
998 2149
999 2150 function loginizer_deactivation(){
@@ -1012,21 +2163,9 @@
1012 2163 delete_option('loginizer_last_reset');
1013 2164 delete_option('loginizer_whitelist');
1014 2165 delete_option('loginizer_blacklist');
1015 2166 delete_option('loginizer_msg');
1016 - delete_option('loginizer_2fa_msg');
1017 - delete_option('loginizer_2fa_email_template');
1018 2167 delete_option('loginizer_security');
1019 2168 delete_option('loginizer_wp_admin');
1020 - delete_option('loginizer_csrf_promo_time');
1021 - delete_option('loginizer_backuply_promo_time');
1022 - delete_option('loginizer_promo_time');
1023 - delete_option('loginizer_ins_time');
1024 - delete_option('loginizer_2fa_whitelist');
1025 - delete_option('loginizer_checksums_last_run');
1026 - delete_option('loginizer_checksums_diff');
1027 - delete_option('loginizer_ip_method');
1028 - delete_option('loginizer_2fa_custom_redirect');
1029 - delete_option('external_updates-loginizer-security');
1030 - delete_option('loginizer_login_attempt_stats');
1031 2169
1032 -}
2170 +}
2171 +