← All changes | init.php +1661 -500 trunk → 1.4.7 View file →

		@@ -4,13 +4,12 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '2.1.0');
	8	+define('LOGINIZER_VERSION', '1.4.7');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12		-define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	12	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14	13
15	14	include_once(LOGINIZER_DIR.'/functions.php');
16	15
		@@ -24,9 +23,9 @@
24	23
25	24	$sql = array();
26	25
27	26	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28		-
	27	+
29	28	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	29	`username` varchar(255) NOT NULL DEFAULT '',
31	30	`time` int(10) NOT NULL DEFAULT '0',
32	31	`count` int(10) NOT NULL DEFAULT '0',
		@@ -33,9 +32,9 @@
33	32	`lockout` int(10) NOT NULL DEFAULT '0',
34	33	`ip` varchar(255) NOT NULL DEFAULT '',
35	34	`url` varchar(255) NOT NULL DEFAULT '',
36	35	UNIQUE KEY `ip` (`ip`)
37		- ) DEFAULT CHARSET=utf8;";
	36	+ ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
38	37
39	38	foreach($sql as $sk => $sv){
40	39	$wpdb->query($sv);
41	40	}
		@@ -44,24 +43,12 @@
44	43	add_option('loginizer_options', array());
45	44	add_option('loginizer_last_reset', 0);
46	45	add_option('loginizer_whitelist', array());
47	46	add_option('loginizer_blacklist', array());
48		- add_option('loginizer_2fa_whitelist', array());
49		-
50		- // TODO:: REMOVE THIS AFTER MARCH 2025
51		- $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
52		- if(!defined('SITEPAD') && empty($softwp_upgrade)){
53		- loginizer_check_softaculous();
54		- }
	47	+
55	48	}
56	49
57		-/**
58		- * Updates the database structure for Loginizer
59		- *
60		- * If the plugin files are updated but database structure is not updated
61		- * this function will update the database structure as per the plugin version
62		- * NOTE: This does not update plugin files it just updates the database structure
63		- */
	50	+// Checks if we are to update ?
64	51	function loginizer_update_check(){
65	52
66	53	global $wpdb;
67	54
		@@ -89,9 +76,9 @@
89	76	// Trick the following if conditions to not run
90	77	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
91	78
92	79	}
93		-
	80	+
94	81	// Is it less than 1.0.1 ?
95	82	if($version < 101){
96	83
97	84	// TODO : GET the existing settings
		@@ -121,17 +108,9 @@
121	108
122	109	// Update the existing failed logs to new table
123	110	if(is_array($lz_failed_logs)){
124	111	foreach($lz_failed_logs as $fk => $fv){
125		- $insert_data = array('username' => $fv['username'],
126		- 'time' => $fv['time'],
127		- 'count' => $fv['count'],
128		- 'lockout' => $fv['lockout'],
129		- 'ip' => $fv['ip']);
130		-
131		- $format = array('%s','%d','%d','%d','%s');
132		-
133		- $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
	112	+ $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
134	113	}
135	114	}
136	115
137	116	// Update the existing options to new structure
		@@ -187,38 +166,11 @@
187	166	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188	167
189	168	}
190	169
191		- // Setting alignment to left in social login ?
192		- if($version < 201){
193		- $social_settings = get_option('loginizer_social_settings', []);
194		-
195		- if(!empty($social_settings)){
196		- if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
197		- $social_settings['login']['button_alignment'] = 'left';
198		- }
199		-
200		- if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
201		- $social_settings['woocommerce']['button_alignment'] = 'left';
202		- }
203		-
204		- if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
205		- $social_settings['comment']['button_alignment'] = 'left';
206		- }
207		-
208		- update_option('loginizer_social_settings', $social_settings);
209		- }
210		- }
211		-
212	170	// Save the new Version
213	171	update_option('loginizer_version', LOGINIZER_VERSION);
214	172
215		- // TODO:: REMOVE THIS AFTER MARCH 2025
216		- $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
217		- if(!defined('SITEPAD') && empty($softwp_upgrade)){
218		- loginizer_check_softaculous();
219		- }
220		-
221	173	// In Sitepad Math Captcha is enabled by default
222	174	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
223	175	$option['captcha_no_google'] = 1;
224	176	add_option('loginizer_captcha', $option);
		@@ -235,13 +187,11 @@
235	187	global $loginizer;
236	188
237	189	// Check if the installed version is outdated
238	190	loginizer_update_check();
239		-
	191	+
240	192	// Set the array
241		- if(empty($loginizer)){
242		- $loginizer = array();
243		- }
	193	+ $loginizer = array();
244	194
245	195	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
246	196	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
247	197	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
		@@ -260,43 +210,28 @@
260	210	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
261	211	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
262	212	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
263	213	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
264		- $loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
265		- $loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
266		- $loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
267		- $loginizer['social_settings'] = get_option('loginizer_social_settings', []);
268	214
269		- if(!empty($options['notify_email_address'])){
270		- $loginizer['notify_email_address'] = $options['notify_email_address'];
271		- $loginizer['custom_notify_email'] = 1;
272		- }
	215	+ // Default messages
	216	+ $loginizer['d_msg']['inv_userpass'] = 'Incorrect Username or Password';
	217	+ $loginizer['d_msg']['ip_blacklisted'] = 'Your IP has been blacklisted';
273	218
274		- // Login Success Email Notification.
275		- $loginizer['login_mail'] = get_option('loginizer_login_mail', []);
276		- add_action('init', 'loginizer_load_translation_vars', 0);
277		-
278		- $loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
279		- $loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];
280		-
281		- // Load the blacklist and whitelist
282		- $loginizer['blacklist'] = get_option('loginizer_blacklist', []);
283		- $loginizer['whitelist'] = get_option('loginizer_whitelist', []);
284		- $loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
	219	+ // Message Strings
	220	+ $loginizer['msg'] = get_option('loginizer_msg');
285	221
286		- // It should not be false
287		- if(empty($loginizer['2fa_whitelist'])){
288		- $loginizer['2fa_whitelist'] = array();
	222	+ foreach($loginizer['d_msg'] as $lk => $lv){
	223	+ if(empty($loginizer['msg'][$lk])){
	224	+ $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
	225	+ }
289	226	}
	227	+
	228	+ // Load the blacklist and whitelist
	229	+ $loginizer['blacklist'] = get_option('loginizer_blacklist');
	230	+ $loginizer['whitelist'] = get_option('loginizer_whitelist');
290	231
291	232	// When was the database cleared last time
292	233	$loginizer['last_reset'] = get_option('loginizer_last_reset');
293		-
294		- if(!isset($loginizer['ultimate-member-active'])){
295		- $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
296		-
297		- $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
298		- }
299	234
300	235	//print_r($loginizer);
301	236
302	237	// Clear retries
		@@ -332,46 +267,158 @@
332	267	// Is called before displaying the error message so that we dont show that the username is wrong or the password
333	268	// Update Error message
334	269	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335	270	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336		- add_action('wp_login', 'loginizer_login_success', 11, 2);
337		- add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
	271	+
	272	+ }
	273	+
	274	+ // Is the premium features there ?
	275	+ if(file_exists(LOGINIZER_DIR.'/premium.php')){
338	276
339		- if(!empty($loginizer['ultimate-member-active'])){
340		- add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
	277	+ // Include the file
	278	+ include_once(LOGINIZER_DIR.'/premium.php');
	279	+
	280	+ loginizer_security_init();
	281	+
	282	+ // Its the free version
	283	+ }else{
	284	+
	285	+ // The promo time
	286	+ $loginizer['promo_time'] = get_option('loginizer_promo_time');
	287	+ if(empty($loginizer['promo_time'])){
	288	+ $loginizer['promo_time'] = time();
	289	+ update_option('loginizer_promo_time', $loginizer['promo_time']);
341	290	}
342		-
343		- if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings'])){
344		- add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
	291	+
	292	+ // Are we to show the loginizer promo
	293	+ if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
	294	+
	295	+ add_action('admin_notices', 'loginizer_promo');
	296	+
345	297	}
346		- }
347		-
348		- // Social Login Form Actions
349		- if(!empty($loginizer['social_settings'])){
350		- if(!empty($loginizer['social_settings']['login']['login_form'])){
351		- add_action('login_form', 'loginizer_social_btn_login');
	298	+
	299	+ // Are we to disable the promo
	300	+ if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
	301	+ update_option('loginizer_promo_time', (0 - time()) );
	302	+ die('DONE');
352	303	}
	304	+
353	305	}
354	306
355		- if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){
356		- include_once LOGINIZER_DIR . '/main/ajax.php';
357		- }
	307	+}
358	308
359		- if(is_admin()){
360		- include_once LOGINIZER_DIR . '/main/admin.php';
361		- }
	309	+// Show the promo
	310	+function loginizer_promo(){
362	311
363		- // ----------------
364		- // PRO INIT END
365		- // ----------------
366		-
367		- // Secuity checks for social login.
368		- if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
369		- add_action('init', 'loginizer_social_login_load');
370		- return;
371		- }
	312	+ echo '
	313	+<style>
	314	+.lz_button {
	315	+background-color: #4CAF50; /* Green */
	316	+border: none;
	317	+color: white;
	318	+padding: 8px 16px;
	319	+text-align: center;
	320	+text-decoration: none;
	321	+display: inline-block;
	322	+font-size: 16px;
	323	+margin: 4px 2px;
	324	+-webkit-transition-duration: 0.4s; /* Safari */
	325	+transition-duration: 0.4s;
	326	+cursor: pointer;
372	327	}
373	328
	329	+.lz_button:focus{
	330	+border: none;
	331	+color: white;
	332	+}
	333	+
	334	+.lz_button1 {
	335	+color: white;
	336	+background-color: #4CAF50;
	337	+border:3px solid #4CAF50;
	338	+}
	339	+
	340	+.lz_button1:hover {
	341	+box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
	342	+color: white;
	343	+border:3px solid #4CAF50;
	344	+}
	345	+
	346	+.lz_button2 {
	347	+color: white;
	348	+background-color: #0085ba;
	349	+}
	350	+
	351	+.lz_button2:hover {
	352	+box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
	353	+color: white;
	354	+}
	355	+
	356	+.lz_button3 {
	357	+color: white;
	358	+background-color: #365899;
	359	+}
	360	+
	361	+.lz_button3:hover {
	362	+box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
	363	+color: white;
	364	+}
	365	+
	366	+.lz_button4 {
	367	+color: white;
	368	+background-color: rgb(66, 184, 221);
	369	+}
	370	+
	371	+.lz_button4:hover {
	372	+box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
	373	+color: white;
	374	+}
	375	+
	376	+.loginizer_promo-close{
	377	+float:right;
	378	+text-decoration:none;
	379	+margin: 5px 10px 0px 0px;
	380	+}
	381	+
	382	+.loginizer_promo-close:hover{
	383	+color: red;
	384	+}
	385	+</style>
	386	+
	387	+<script>
	388	+jQuery(document).ready( function() {
	389	+ (function($) {
	390	+ $("#loginizer_promo .loginizer_promo-close").click(function(){
	391	+ var data;
	392	+
	393	+ // Hide it
	394	+ $("#loginizer_promo").hide();
	395	+
	396	+ // Save this preference
	397	+ $.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
	398	+ //alert(response);
	399	+ });
	400	+ });
	401	+ })(jQuery);
	402	+});
	403	+</script>
	404	+
	405	+<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
	406	+ <a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
	407	+ <span class="dashicons dashicons-dismiss"></span> Dismiss
	408	+ </a>
	409	+ <img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
	410	+ <p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
	411	+ <p>
	412	+ <a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
	413	+ <a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5★\'s</a>
	414	+ <a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
	415	+ <a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
	416	+ </p>
	417	+</div>';
	418	+
	419	+}
	420	+
374	421	// Should return NULL if everything is fine
375	422	function loginizer_wp_authenticate($user, $username, $password){
376	423
377	424	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
		@@ -383,36 +430,13 @@
383	430	// Are you whitelisted ?
384	431	if(loginizer_is_whitelisted()){
385	432	$loginizer['ip_is_whitelisted'] = 1;
386	433	return $user;
387		-
388		- } else if (!empty($loginizer['trusted_ips'])){
389		- $lz_cannot_login = 1;
390		-
391		- // This is used by WP Activity Log
392		- apply_filters( 'wp_login_blocked', $username );
393		-
394		- // Shows a blocked screen
395		- if(!empty($loginizer['blocked_screen'])){
396		- $lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
397		- loginizer_blocked_page($lz_error);
398		- }
399		-
400		- return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
401	434	}
402	435
403	436	// Are you blacklisted ?
404	437	if(loginizer_is_blacklisted()){
405	438	$lz_cannot_login = 1;
406		-
407		- // This is used by WP Activity Log
408		- apply_filters( 'wp_login_blocked', $username );
409		-
410		- // Shows a blocked screen
411		- if(!empty($loginizer['blocked_screen'])){
412		- loginizer_blocked_page($lz_error);
413		- }
414		-
415	439	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
416	440	}
417	441
418	442	// Is the username blacklisted ?
		@@ -418,12 +442,8 @@
418	442	// Is the username blacklisted ?
419	443	if(function_exists('loginizer_user_blacklisted')){
420	444	if(loginizer_user_blacklisted($username)){
421	445	$lz_cannot_login = 1;
422		-
423		- // This is used by WP Activity Log
424		- apply_filters( 'wp_login_blocked', $username );
425		-
426	446	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
427	447	}
428	448	}
429	449
		@@ -431,19 +451,11 @@
431	451	return $user;
432	452	}
433	453
434	454	$lz_cannot_login = 1;
435		-
436		- // This is used by WP Activity Log
437		- apply_filters( 'wp_login_blocked', $username );
438	455
439		- // Shows a blocked screen
440		- if(!empty($loginizer['blocked_screen'])){
441		- loginizer_blocked_page($lz_error);
442		- }
	456	+ return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
443	457
444		- return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
445		-
446	458	}
447	459
448	460	function loginizer_can_login(){
449	461
		@@ -449,13 +461,12 @@
449	461
450	462	global $wpdb, $loginizer, $lz_error;
451	463
452	464	// Get the logs
453		- $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
454		- $result = lz_selectquery($sel_query);
	465	+ $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
455	466
456	467	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
457		-
	468	+
458	469	// Has he reached max lockouts ?
459	470	if($result['lockout'] >= $loginizer['max_lockouts']){
460	471	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
461	472	}
		@@ -467,20 +478,17 @@
467	478	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
468	479	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
469	480	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
470	481
471		- $_time = $banlift.' '.$loginizer['msg']['minutes_err'];
	482	+ $_time = $banlift.' minute(s)';
472	483
473	484	if($banlift > 60){
474	485	$banlift = ceil($banlift / 60);
475		- $_time = $banlift.' '.$loginizer['msg']['hours_err'];
	486	+ $_time = $banlift.' hour(s)';
476	487	}
477	488
478		- $lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
	489	+ $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
479	490
480		- if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
481		- \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
482		- }
483	491	return false;
484	492	}
485	493	}
486	494
		@@ -490,36 +498,27 @@
490	498	function loginizer_is_blacklisted(){
491	499
492	500	global $wpdb, $loginizer, $lz_error;
493	501
494		- $blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
495		-
496		- if(empty($blacklist)){
497		- return false;
498		- }
499		-
500		- $current_ip_inet = inet_ptoi($loginizer['current_ip']);
501		-
	502	+ $blacklist = $loginizer['blacklist'];
	503	+
502	504	foreach($blacklist as $k => $v){
503		-
504		- $start_inet = inet_ptoi($v['start']);
505		- $end_inet = inet_ptoi($v['end']);
506		-
	505	+
507	506	// Is the IP in the blacklist ?
508		- if($start_inet <= $current_ip_inet && $current_ip_inet <= $end_inet){
	507	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
509	508	$result = 1;
510	509	break;
511	510	}
512		-
	511	+
513	512	// Is it in a wider range ?
514		- if($start_inet >= 0 && $end_inet < 0){
	513	+ if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
515	514
516	515	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
517	516	// if the current IP is <= than the start of the range, it is within the range
518	517	// OR
519	518	// if the current IP is <= than the end of the range, it is within the range
520		- if($start_inet <= $current_ip_inet
521		- || $current_ip_inet <= $end_inet){
	519	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
	520	+ || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
522	521	$result = 1;
523	522	break;
524	523	}
525	524
		@@ -525,9 +524,9 @@
525	524
526	525	}
527	526
528	527	}
529		-
	528	+
530	529	// You are blacklisted
531	530	if(!empty($result)){
532	531	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
533	532	return true;
		@@ -536,442 +535,1616 @@
536	535	return false;
537	536
538	537	}
539	538
540		-// When the login fails, then this is called
541		-// We need to update the database
542		-function loginizer_login_failed($username, $is_2fa = ''){
	539	+function loginizer_is_whitelisted(){
543	540
544		- global $wpdb, $loginizer, $lz_cannot_login;
	541	+ global $wpdb, $loginizer, $lz_error;
545	542
546		- // Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
547		- if(empty($username) || is_null($username)){
548		- $username = '';
	543	+ $whitelist = $loginizer['whitelist'];
	544	+
	545	+ foreach($whitelist as $k => $v){
	546	+
	547	+ // Is the IP in the blacklist ?
	548	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	549	+ $result = 1;
	550	+ break;
	551	+ }
	552	+
	553	+ // Is it in a wider range ?
	554	+ if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
	555	+
	556	+ // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
	557	+ // if the current IP is <= than the start of the range, it is within the range
	558	+ // OR
	559	+ // if the current IP is <= than the end of the range, it is within the range
	560	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
	561	+ || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	562	+ $result = 1;
	563	+ break;
	564	+ }
	565	+
	566	+ }
	567	+
549	568	}
	569	+
	570	+ // You are whitelisted
	571	+ if(!empty($result)){
	572	+ return true;
	573	+ }
550	574
551		- $fail_type = 'Login';
	575	+ return false;
552	576
553		- if(!empty($is_2fa)){
554		- $fail_type = '2FA';
555		- }
	577	+}
556	578
	579	+
	580	+// When the login fails, then this is called
	581	+// We need to update the database
	582	+function loginizer_login_failed($username){
	583	+
	584	+ global $wpdb, $loginizer, $lz_cannot_login;
	585	+
557	586	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
558	587
559		- // The params which comes when social login returns an error, have some characters, which WordPress could not save.
560		- // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
561		- $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
562		- $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
	588	+ $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
	589	+ $url = esc_url($url);
563	590
564		- if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
565		- $request_uri = explode('=', $server_uri);
566		- $server_uri = $request_uri[0];
567		- }
568		-
569		- // No addslashes() here, $wpdb->prepare() below does the escaping
570		- $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
	591	+ $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
571	592
572		- // Must never be 0, we divide by it below
573		- $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
574		-
575		- // This way is atomic now, the earlier one were causing race condition.
576		- // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
577		- // evaluate the assignments from left to right, so lockout must NOT add 1 again
578		- $upsert = $wpdb->prepare(
579		- "INSERT INTO `".$wpdb->prefix."loginizer_logs`
580		- (username, time, count, ip, lockout, url)
581		- VALUES
582		- (%s, %d, 1, %s, FLOOR(1 / %d), %s)
583		- ON DUPLICATE KEY UPDATE
584		- username = VALUES(username),
585		- time = VALUES(time),
586		- count = count + 1,
587		- lockout = FLOOR(count / %d),
588		- url = VALUES(url)",
589		- $username,
590		- time(),
591		- $loginizer['current_ip'],
592		- $max_retries,
593		- $url,
594		- $max_retries
595		- );
596		- $wpdb->query($upsert);
	593	+ if(!empty($result)){
	594	+ $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
	595	+ $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."', `url` = '".$url."' WHERE `ip` = '".$loginizer['current_ip']."';");
	596	+
	597	+ // Do we need to email admin ?
	598	+ if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
	599	+
	600	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	601	+ $mail = array();
	602	+ $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
	603	+ $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	604	+ $mail['message'] = 'Hi,
597	605
598		- // Re-read the persisted row so email/retries-left reflect the actual count
599		- $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
600		- $result = lz_selectquery($sel_query);
	606	+'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
601	607
602		- if(empty($result)){
603		- $result = array('count' => 0);
604		- }
605		-
606		- $count = (int) $result['count'];
607		- $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
608		-
609		- // The lockout goes up only on every max_retries'th failure, which is the
610		- // attempt that actually locks the IP out. On the failures in between there
611		- // is nothing new to report, so we must not email on each one of them
612		- $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
613		-
614		- // Do we need to email admin ?
615		- if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
616		-
617		- $lockout_time = $loginizer['lockout_time'];
618		-
619		- if($lockout >= $loginizer['max_lockouts']){
620		- $lockout_time = $loginizer['lockouts_extend'];
621		- }
622		-
623		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
624		- $mail = array();
625		- $mail['to'] = $loginizer['notify_email_address'];
626		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
627		- $mail['message'] = 'Hi,
628		-
629		-'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
630		-'.home_url().'
631		-
632		-Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
	608	+Last Login Attempt : '.date('d/M/Y H:i:s P', time()).'
633	609	Last User Attempt : '.$username.'
634		-IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
	610	+IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $loginizer['lockout_time']).'
635	611
636	612	Regards,
637	613	Loginizer';
638	614
639		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	615	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	616	+ }
	617	+ }else{
	618	+ $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0', `url` = '".$url."';");
640	619	}
	620	+
	621	+ // We need to add one as this is a failed attempt as well
	622	+ $result['count'] = $result['count'] + 1;
	623	+ $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
	624	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
	625	+
	626	+ }
	627	+}
641	628
642		- loginizer_update_attempt_stats(0);
643		- $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
644		- $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
	629	+// Handles the error of the password not being there
	630	+function loginizer_error_handler($errors, $redirect_to){
	631	+
	632	+ global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	633	+
	634	+ //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
	635	+
	636	+ // Remove the empty password error
	637	+ if(is_wp_error($errors)){
645	638
	639	+ $codes = $errors->get_error_codes();
	640	+
	641	+ foreach($codes as $k => $v){
	642	+ if($v == 'invalid_username' || $v == 'incorrect_password'){
	643	+ $show_error = 1;
	644	+ }
	645	+ }
	646	+
	647	+ $errors->remove('invalid_username');
	648	+ $errors->remove('incorrect_password');
	649	+
646	650	}
	651	+
	652	+ // Add the error
	653	+ if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
	654	+ $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
	655	+ }
	656	+
	657	+ // Add the number of retires left as well
	658	+ if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
	659	+ $errors->add('retries_left', loginizer_retries_left());
	660	+ }
	661	+
	662	+ return $errors;
	663	+
647	664	}
648	665
649		-function loginizer_rsssl_2fa_success($user){
650		- loginizer_login_success('', $user);
651		-}
652	666
653		-function loginizer_login_success($user_login, $user) {
654		- global $wp_version, $loginizer;
655	667
656		- loginizer_update_attempt_stats(1);
	668	+// Handles the error of the password not being there
	669	+function loginizer_woocommerce_error_handler(){
657	670
658		- if(empty($loginizer['login_mail'])){
659		- return;
	671	+ global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	672	+
	673	+ if(function_exists('wc_add_notice')){
	674	+ wc_add_notice( loginizer_retries_left(), 'error' );
660	675	}
	676	+
	677	+}
661	678
662		- if(empty($loginizer['login_mail']['enable'])){
663		- return;
	679	+// Returns a string with the number of retries left
	680	+function loginizer_retries_left(){
	681	+
	682	+ global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	683	+
	684	+ // If we are to show the number of retries left
	685	+ if(isset($loginizer['retries_left'])){
	686	+ return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
664	687	}
	688	+
	689	+}
665	690
666		- if(!empty($loginizer['login_mail']['disable_whitelist'])){
667		- // Check its whitelist ip
668		- if(loginizer_is_whitelisted()){
669		- return;
670		- }
671		- }
	691	+function loginizer_reset_retries(){
	692	+
	693	+ global $wpdb, $loginizer;
	694	+
	695	+ $deltime = time() - $loginizer['reset_retries'];
	696	+ $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
	697	+
	698	+ update_option('loginizer_last_reset', time());
	699	+
	700	+}
672	701
673		- if(empty($user_login) && empty($user)){
674		- error_log('Loginizer: No user information to send email');
675		- return;
	702	+add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
	703	+
	704	+// Add settings link on plugin page
	705	+function loginizer_plugin_action_links($links) {
	706	+
	707	+ if(!defined('LOGINIZER_PREMIUM')){
	708	+ $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
676	709	}
677	710
678		- if(empty($user)){
679		- $user = get_user_by('login', $user_login);
680		- }
	711	+ $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
	712	+ array_unshift($links, $settings_link);
	713	+
	714	+ return $links;
	715	+}
681	716
682		- if(empty($user)){
683		- error_log('Loginizer: Unable to get the user');
684		- return;
685		- }
	717	+add_action('admin_menu', 'loginizer_admin_menu');
686	718
687		- if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
688		- return;
	719	+// Shows the admin menu of Loginizer
	720	+function loginizer_admin_menu() {
	721	+
	722	+ global $wp_version, $loginizer;
	723	+
	724	+ if(!defined('SITEPAD')){
	725	+
	726	+ // Add the menu page
	727	+ add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
	728	+
	729	+ // Dashboard
	730	+ add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
	731	+
	732	+ }else{
	733	+
	734	+ // Add the menu page
	735	+ add_menu_page(__('Security'), __('Security'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
	736	+
	737	+ // Rename Login
	738	+ add_submenu_page('loginizer', __('Security Settings'), __('Rename Login'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
	739	+
689	740	}
690		-
691		- // Check if the user role is enabled for email notification.
692		- if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){
693		- return;
	741	+
	742	+ // Brute Force
	743	+ add_submenu_page('loginizer', __('Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
	744	+
	745	+ if(defined('LOGINIZER_PREMIUM')){
	746	+
	747	+ // PasswordLess
	748	+ add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
	749	+
	750	+ // Security Settings
	751	+ if(!defined('SITEPAD')){
	752	+
	753	+ // Two Factor Auth
	754	+ add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
	755	+
	756	+ }
	757	+
	758	+ // reCaptcha
	759	+ add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
	760	+
	761	+ // Security Settings
	762	+ if(!defined('SITEPAD')){
	763	+
	764	+ // Security Settings
	765	+ add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
	766	+
	767	+ // File Checksums
	768	+ add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
	769	+
	770	+ }
	771	+
	772	+ }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
	773	+
	774	+ // Go Pro link
	775	+ add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
	776	+
694	777	}
	778	+
	779	+}
695	780
696		- // current_datetime & wp_timezone_string were introduced in WordPress 5.3
697		- if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){
698		- $time_zone = wp_timezone_string();
	781	+// The Loginizer Admin Options Page
	782	+function loginizer_page_header($title = 'Loginizer'){
	783	+
	784	+ global $loginizer;
699	785
700		- if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){
701		- $time_zone = 'UTC'.$time_zone;
702		- }
	786	+?>
	787	+<style>
	788	+.lz-right-ul{
	789	+ padding-left: 10px !important;
	790	+}
703	791
704		- // Setting up data variables.
705		- $date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone;
706		- } else {
707		- $date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get();
	792	+.lz-right-ul li{
	793	+ list-style: circle !important;
	794	+}
	795	+</style>
	796	+<?php
	797	+
	798	+ echo '<div style="margin: 10px 20px 0 2px;">
	799	+<div class="metabox-holder columns-2">
	800	+<div class="postbox-container">
	801	+<div id="top-sortables" class="meta-box-sortables ui-sortable">
	802	+
	803	+ <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
	804	+ <tr>
	805	+ <td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
	806	+
	807	+ if(!defined('SITEPAD')){
	808	+
	809	+ echo '<td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
	810	+ <td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
	811	+ <td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
	812	+
708	813	}
	814	+
	815	+ echo '
	816	+ </tr>
	817	+ </table>
	818	+ <hr />
	819	+
	820	+ <!--Main Table-->
	821	+ <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
	822	+ <tr>
	823	+ <td valign="top">';
709	824
710		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
711		- $email = $user->data->user_email;
	825	+}
712	826
713		- $vars = array(
714		- 'date' => $date,
715		- 'ip' => esc_html($loginizer['current_ip']),
716		- 'sitename' => $sitename,
717		- 'user_login' => $user_login
718		- );
719		-
720		- $message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
721		- $subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
	827	+// The Loginizer Theme footer
	828	+function loginizer_page_footer(){
722	829
723		- $headers = [];
	830	+ echo '</td>
	831	+ <td width="200" valign="top" id="loginizer-right-bar">';
	832	+
	833	+ if(!defined('SITEPAD')){
724	834
725		- // Do we need to send the email as HTML ?
726		- if(!empty($loginizer['login_mail']['html_mail'])){
727		- $headers[] = 'Content-Type: text/html; charset=UTF-8';
	835	+ if(!defined('LOGINIZER_PREMIUM')){
728	836
729		- if(!empty($loginizer['login_mail']['body'])){
730		- $message = html_entity_decode($message);
	837	+ echo '
	838	+ <div class="postbox" style="min-width:0px !important;">
	839	+ <h2 class="hndle ui-sortable-handle">
	840	+ <span>Premium Version</span>
	841	+ </h2>
	842	+ <div class="inside">
	843	+ <i>Upgrade to the premium version and get the following features </i>:<br>
	844	+ <ul class="lz-right-ul">
	845	+ <li>PasswordLess Login</li>
	846	+ <li>Two Factor Auth - Email</li>
	847	+ <li>Two Factor Auth - App</li>
	848	+ <li>Login Challenge Question</li>
	849	+ <li>reCAPTCHA</li>
	850	+ <li>Rename Login Page</li>
	851	+ <li>Disable XML-RPC</li>
	852	+ <li>And many more ...</li>
	853	+ </ul>
	854	+ <center><a class="button button-primary" href="https://loginizer.com/pricing">Upgrade</a></center>
	855	+ </div>
	856	+ </div>';
	857	+
731	858	}else{
732		- $message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message);
733		- $message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message);
	859	+
	860	+ echo '
	861	+ <div class="postbox" style="min-width:0px !important;">
	862	+ <h2 class="hndle ui-sortable-handle">
	863	+ <span>Recommendations</span>
	864	+ </h2>
	865	+ <div class="inside">
	866	+ <i>We recommed that you enable atleast one of the following security features</i>:<br>
	867	+ <ul class="lz-right-ul">
	868	+ <li>Rename Login Page</li>
	869	+ <li>Login Challenge Question</li>
	870	+ <li>reCAPTCHA</li>
	871	+ <li>Two Factor Auth - Email</li>
	872	+ <li>Two Factor Auth - App</li>
	873	+ <li>Change \'admin\' Username</li>
	874	+ </ul>
	875	+ </div>
	876	+ </div>';
734	877	}
	878	+
	879	+ echo '
	880	+ <div class="postbox" style="min-width:0px !important;">
	881	+ <h2 class="hndle ui-sortable-handle">
	882	+ <span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
	883	+ </h2>
	884	+ <div class="inside">
	885	+ <i>Easily manage and make professional pages and content with our Pagelayer builder </i>:<br>
	886	+ <ul class="lz-right-ul">
	887	+ <li>30+ Free Widgets</li>
	888	+ <li>60+ Premium Widgets</li>
	889	+ <li>400+ Premium Sections</li>
	890	+ <li>Theme Builder</li>
	891	+ <li>WooCommerce Builder</li>
	892	+ <li>Theme Creator and Exporter</li>
	893	+ <li>Form Builder</li>
	894	+ <li>Popup Builder</li>
	895	+ <li>And many more ...</li>
	896	+ </ul>
	897	+ <center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">Visit Pagelayer</a></center>
	898	+ </div>
	899	+ </div>';
	900	+
	901	+ echo '
	902	+ <div class="postbox" style="min-width:0px !important;">
	903	+ <h2 class="hndle ui-sortable-handle">
	904	+ <span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
	905	+ </h2>
	906	+ <div class="inside">
	907	+ <i>Manage all your WordPress sites from <b>1 dashboard</b> </i>:<br>
	908	+ <ul class="lz-right-ul">
	909	+ <li>1-click Admin Access</li>
	910	+ <li>Update WordPress</li>
	911	+ <li>Update Themes</li>
	912	+ <li>Update Plugins</li>
	913	+ <li>Backup your WordPress Site</li>
	914	+ <li>Plugins & Theme Management</li>
	915	+ <li>Post Management</li>
	916	+ <li>And many more ...</li>
	917	+ </ul>
	918	+ <center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">Visit wpCentral</a></center>
	919	+ </div>
	920	+ </div>';
	921	+
735	922	}
736		-
737		- // Sending notification
738		- if(empty(wp_mail($email, $subject, $message, $headers))){
739		- error_log(__('There was a problem sending your email.', 'loginizer'));
740		- return;
	923	+
	924	+ echo '</td>
	925	+ </tr>
	926	+ </table>';
	927	+
	928	+ if(!defined('SITEPAD')){
	929	+
	930	+ echo '<br />
	931	+ <div style="width:45%;background:#FFF;padding:15px; margin:auto">
	932	+ <b>Let your friends know that you have secured your website :</b>
	933	+ <form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
	934	+ <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
	935	+ &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
	936	+ </form>
	937	+
	938	+ </div>
	939	+ <br />
	940	+
	941	+ <script>
	942	+ function dotweet(ele){
	943	+ window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
	944	+ return false;
741	945	}
742		-}
743		-
744		-function loginizer_update_attempt_stats($type){
745		-
746		- $stats = get_option('loginizer_login_attempt_stats', []);
747		- $time = strtotime(date('Y-m-d H:00:00'));
	946	+ </script>
748	947
749		- if(empty($stats[$time][$type])){
750		- $stats[$time][$type] = 0;
	948	+ <hr />
	949	+ <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
	950	+
751	951	}
	952	+
	953	+ echo '
	954	+</div>
	955	+</div>
	956	+</div>
	957	+</div>';
752	958
753		- $stats[$time][$type] += 1;
754		-
755		- update_option('loginizer_login_attempt_stats', $stats, false);
756	959	}
757	960
758		-// Handles the error of the password not being there
759		-function loginizer_error_handler($errors, $redirect_to){
	961	+// The Loginizer Admin Options Page
	962	+function loginizer_page_dashboard(){
760	963
761		- global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	964	+ global $loginizer, $lz_error, $lz_env;
	965	+
	966	+ if(!current_user_can('manage_options')){
	967	+ wp_die('Sorry, but you do not have permissions to change settings.');
	968	+ }
	969	+
	970	+ // Dismiss the announcement
	971	+ if(isset($_GET['dismiss_announcement'])){
	972	+ update_option('loginizer_no_announcement', 1);
	973	+ }
762	974
763		- //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
764		- if(is_null($errors) || empty($errors)){
765		- return true;
	975	+ /* Make sure post was from this page */
	976	+ if(count($_POST) > 0){
	977	+ check_admin_referer('loginizer-options');
766	978	}
767	979
768		- // Remove the empty password error
769		- if(is_wp_error($errors)){
	980	+ // Is there a license key ?
	981	+ if(isset($_POST['save_lz'])){
	982	+
	983	+ $license = lz_optpost('lz_license');
770	984
771		- $codes = $errors->get_error_codes();
	985	+ // Check if its a valid license
	986	+ if(empty($license)){
	987	+ $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
	988	+ return loginizer_page_dashboard_T();
	989	+ }
772	990
773		- foreach($codes as $k => $v){
774		- if($v == 'invalid_username' || $v == 'incorrect_password'){
775		- $show_error = 1;
776		- }
	991	+ $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license, array('timeout' => 30));
	992	+
	993	+ if(is_array($resp)){
	994	+ $json = json_decode($resp['body'], true);
	995	+ //print_r($json);
	996	+ }else{
	997	+
	998	+ $lz_error['resp_invalid'] = __('The response was malformed<br>'.var_export($resp, true), 'loginizer');
	999	+ return loginizer_page_dashboard_T();
	1000	+
777	1001	}
778	1002
779		- $errors->remove('invalid_username');
780		- $errors->remove('incorrect_password');
	1003	+ // Save the License
	1004	+ if(empty($json['license'])){
	1005	+
	1006	+ $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
	1007	+ return loginizer_page_dashboard_T();
	1008	+
	1009	+ }else{
	1010	+
	1011	+ update_option('loginizer_license', $json);
	1012	+
	1013	+ // Mark as saved
	1014	+ $GLOBALS['lz_saved'] = true;
	1015	+ }
	1016	+
	1017	+ }
781	1018
782		- // Add the error
783		- if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
784		- $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
	1019	+
	1020	+ // Is there a IP Method ?
	1021	+ if(isset($_POST['save_lz_ip_method'])){
	1022	+
	1023	+ $ip_method = (int) lz_optpost('lz_ip_method');
	1024	+ $custom_ip_method = lz_optpost('lz_custom_ip_method');
	1025	+
	1026	+ if($ip_method >= 0 && $ip_method <= 3){
	1027	+ update_option('loginizer_ip_method', $ip_method);
785	1028	}
786	1029
787		- // Add the number of retires left as well
788		- if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
789		- $errors->add('retries_left', loginizer_retries_left());
	1030	+ // Custom Method name ?
	1031	+ if($ip_method == 3){
	1032	+ update_option('loginizer_custom_ip_method', $custom_ip_method);
790	1033	}
791		-
	1034	+
792	1035	}
793	1036
794		- return $errors;
	1037	+ loginizer_page_dashboard_T();
795	1038
796	1039	}
797	1040
798		-// Handles the error of the password not being there
799		-function loginizer_woocommerce_error_handler(){
	1041	+// The Loginizer Admin Options Page - THEME
	1042	+function loginizer_page_dashboard_T(){
	1043	+
	1044	+ global $loginizer, $lz_error, $lz_env;
800	1045
801		- global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
802		-
803		- if(function_exists('wc_add_notice')){
804		- wc_add_notice( loginizer_retries_left(), 'error' );
805		- }
	1046	+ loginizer_page_header('Dashboard');
	1047	+?>
	1048	+<style>
	1049	+.welcome-panel{
	1050	+ margin: 0px;
	1051	+ padding: 10px;
806	1052	}
807	1053
808		-function loginizer_ultimatemember_error_handler(){
809		-
810		- if(class_exists('UM')){
811		- \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
812		- }
	1054	+input[type="text"], textarea, select {
	1055	+ width: 70%;
813	1056	}
814	1057
815		-// Handles social login URL
816		-function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
817		- global $loginizer;
	1058	+.form-table label{
	1059	+ font-weight:bold;
	1060	+}
	1061	+
	1062	+.exp{
	1063	+ font-size:12px;
	1064	+}
	1065	+</style>
818	1066
819		- if(loginizer_is_blacklisted()){
820		- return $errors;
	1067	+ <?php
	1068	+
	1069	+ $hide_announcement = get_option('loginizer_no_announcement');
	1070	+ if(empty($hide_announcement)){
	1071	+ echo '<div id="message" class="welcome-panel">'. __('<a href="https://loginizer.com/blog/loginizer-has-been-acquired-by-softaculous/" target="_blank" style="text-decoration:none;">We are excited to announce that we have joined forces with Softaculous and have been acquired by them 😊. Read full announcement here.</a>', 'loginizer'). '<a class="welcome-panel-close" style="top:3px;right:2px;" href="'.menu_page_url('loginizer', false).'&dismiss_announcement=1" aria-label="Dismiss announcement"></a></div><br />';
821	1072	}
	1073	+
	1074	+ echo '<script src="https://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
822	1075
823		- loginizer_get_social_error();
824		-
825		- if(empty($loginizer['social_errors'])){
826		- return $errors;
	1076	+ // Saved ?
	1077	+ if(!empty($GLOBALS['lz_saved'])){
	1078	+ echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
827	1079	}
828		-
829		- if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
830		- $errors = new WP_Error();
	1080	+
	1081	+ // Any errors ?
	1082	+ if(!empty($lz_error)){
	1083	+ lz_report_error($lz_error);echo '<br />';
831	1084	}
832		-
833		- foreach($loginizer['social_errors'] as $key => $text){
834		- $errors->add($key, $text);
835		- }
836		-
837		- return $errors;
838		-}
839		-
840		-// Returns a string with the number of retries left
841		-function loginizer_retries_left(){
842	1085
843		- global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	1086	+ ?>
844	1087
845		- // If we are to show the number of retries left
846		- if(isset($loginizer['retries_left'])){
847		- $retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
	1088	+ <div class="postbox">
	1089	+
	1090	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1091	+ <span class="screen-reader-text">Toggle panel: Getting Started</span>
	1092	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1093	+ </button>
848	1094
849		- return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
850		- }
	1095	+ <h2 class="hndle ui-sortable-handle">
	1096	+ <span><?php echo __('Getting Started', 'loginizer'); ?></span>
	1097	+ </h2>
	1098	+
	1099	+ <div class="inside">
	1100	+
	1101	+ <form action="" method="post" enctype="multipart/form-data">
	1102	+ <?php wp_nonce_field('loginizer-options'); ?>
	1103	+ <table class="form-table">
	1104	+ <tr>
	1105	+ <td scope="row" valign="top" colspan="2" style="line-height:150%">
	1106	+ <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
	1107	+ <?php
	1108	+ if(defined('LOGINIZER_PREMIUM')){
	1109	+ echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
	1110	+ }
	1111	+ ?>
	1112	+ </td>
	1113	+ </tr>
	1114	+ </table>
	1115	+ </form>
	1116	+
	1117	+ </div>
	1118	+ </div>
851	1119
852		-}
	1120	+ <div class="postbox">
	1121	+
	1122	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1123	+ <span class="screen-reader-text">Toggle panel: System Information</span>
	1124	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1125	+ </button>
	1126	+
	1127	+ <h2 class="hndle ui-sortable-handle">
	1128	+ <span><?php echo __('System Information', 'loginizer'); ?></span>
	1129	+ </h2>
	1130	+
	1131	+ <div class="inside">
	1132	+
	1133	+ <form action="" method="post" enctype="multipart/form-data">
	1134	+ <?php wp_nonce_field('loginizer-options'); ?>
	1135	+ <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
	1136	+ <?php
	1137	+ echo '
	1138	+ <tr>
	1139	+ <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
	1140	+ <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
	1141	+ </tr>';
	1142	+
	1143	+ if(defined('LOGINIZER_PREMIUM')){
	1144	+ echo '
	1145	+ <tr>
	1146	+ <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
	1147	+ <td align="left">
	1148	+ '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
	1149	+ <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
	1150	+ <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
	1151	+
	1152	+ if(!empty($loginizer['license'])){
	1153	+
	1154	+ $expires = $loginizer['license']['expires'];
	1155	+ $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
	1156	+
	1157	+ echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
	1158	+ License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
	1159	+ </div>';
	1160	+ }
	1161	+
	1162	+
	1163	+ echo
	1164	+ '</td>
	1165	+ </tr>';
	1166	+ }
	1167	+
	1168	+ echo '<tr>
	1169	+ <th align="left">'.__('URL', 'loginizer').'</th>
	1170	+ <td>'.get_site_url().'</td>
	1171	+ </tr>
	1172	+ <tr>
	1173	+ <th align="left">'.__('Path', 'loginizer').'</th>
	1174	+ <td>'.ABSPATH.'</td>
	1175	+ </tr>
	1176	+ <tr>
	1177	+ <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
	1178	+ <td>'.@$_SERVER['SERVER_ADDR'].'</td>
	1179	+ </tr>
	1180	+ <tr>
	1181	+ <th align="left">'.__('Your IP Address', 'loginizer').'</th>
	1182	+ <td>'.lz_getip().'
	1183	+ <div style="float:right">
	1184	+ Method :
	1185	+ <select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
	1186	+ <option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
	1187	+ <option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
	1188	+ <option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
	1189	+ <option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
	1190	+ </select>
	1191	+ <input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
	1192	+ <input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
	1193	+ </div>
	1194	+ </td>
	1195	+ </tr>
	1196	+ <tr>
	1197	+ <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
	1198	+ <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
	1199	+ </tr>';
	1200	+
	1201	+ if(file_exists(ABSPATH.'/.htaccess')){
	1202	+ echo '
	1203	+ <tr>
	1204	+ <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
	1205	+ <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
	1206	+ </tr>';
	1207	+
	1208	+ }
	1209	+
	1210	+ ?>
	1211	+ </table>
	1212	+ </form>
	1213	+
	1214	+ </div>
	1215	+ </div>
853	1216
854		-function loginizer_reset_retries(){
	1217	+<script type="text/javascript">
855	1218
856		- global $wpdb, $loginizer;
	1219	+function lz_ip_method_handle(){
	1220	+ var ele = jQuery('#lz_ip_method');
	1221	+ if(ele.val() == 3){
	1222	+ jQuery('#lz_custom_ip_method').show();
	1223	+ }else{
	1224	+ jQuery('#lz_custom_ip_method').hide();
	1225	+ }
	1226	+};
857	1227
858		- $deltime = time() - $loginizer['reset_retries'];
	1228	+lz_ip_method_handle();
859	1229
860		- $del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
861		- $result = $wpdb->query($del_query);
	1230	+</script>
	1231	+
	1232	+ <div id="" class="postbox">
	1233	+
	1234	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1235	+ <span class="screen-reader-text">Toggle panel: File Permissions</span>
	1236	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1237	+ </button>
	1238	+
	1239	+ <h2 class="hndle ui-sortable-handle">
	1240	+ <span><?php echo __('File Permissions', 'loginizer'); ?></span>
	1241	+ </h2>
	1242	+
	1243	+ <div class="inside">
	1244	+
	1245	+ <form action="" method="post" enctype="multipart/form-data">
	1246	+ <?php wp_nonce_field('loginizer-options'); ?>
	1247	+ <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
	1248	+ <?php
	1249	+
	1250	+ echo '
	1251	+ <tr>
	1252	+ <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
	1253	+ <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
	1254	+ <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
	1255	+ </tr>';
	1256	+
	1257	+ $wp_content = basename(dirname(dirname(dirname(__FILE__))));
	1258	+
	1259	+ $files_to_check = array('/' => '0755',
	1260	+ '/wp-admin' => '0755',
	1261	+ '/wp-includes' => '0755',
	1262	+ '/wp-config.php' => '0444',
	1263	+ '/'.$wp_content => '0755',
	1264	+ '/'.$wp_content.'/themes' => '0755',
	1265	+ '/'.$wp_content.'/plugins' => '0755',
	1266	+ '.htaccess' => '0444');
	1267	+
	1268	+ $root = ABSPATH;
	1269	+
	1270	+ foreach($files_to_check as $k => $v){
	1271	+
	1272	+ $path = $root.'/'.$k;
	1273	+ $stat = @stat($path);
	1274	+ $suggested = $v;
	1275	+ $actual = substr(sprintf('%o', $stat['mode']), -4);
	1276	+
	1277	+ echo '
	1278	+ <tr>
	1279	+ <td>'.$k.'</td>
	1280	+ <td>'.$suggested.'</td>
	1281	+ <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
	1282	+ </tr>';
	1283	+
	1284	+ }
	1285	+
	1286	+ ?>
	1287	+ </table>
	1288	+ </form>
	1289	+
	1290	+ </div>
	1291	+ </div>
862	1292
863		- update_option('loginizer_last_reset', time());
	1293	+<?php
	1294	+
	1295	+ loginizer_page_footer();
864	1296
865	1297	}
866	1298
867		-function loginizer_load_translation_vars(){
868		- global $loginizer;
869		-
870		- $loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
871		- $loginizer['login_mail_default_msg'] = __('Hello $user_login,
	1299	+// The Loginizer Admin Options Page
	1300	+function loginizer_page_brute_force(){
872	1301
873		-Your account was recently logged in from the IP : $ip
874		-Time : $date
875		-If it was not you who logged in then please report this to us immediately.
	1302	+ global $wpdb, $wp_roles, $loginizer;
	1303	+
	1304	+ if(!current_user_can('manage_options')){
	1305	+ wp_die('Sorry, but you do not have permissions to change settings.');
	1306	+ }
876	1307
877		-Regards,
878		-$sitename','loginizer');
879		-
880		- if(empty($loginizer['login_mail_subject'])){
881		- $loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
	1308	+ /* Make sure post was from this page */
	1309	+ if(count($_POST) > 0){
	1310	+ check_admin_referer('loginizer-options');
882	1311	}
883	1312
884		- if(empty($loginizer['login_mail_body'])){
885		- $loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
	1313	+ // BEGIN THEME
	1314	+ loginizer_page_header('Brute Force Settings');
	1315	+
	1316	+ // Load the blacklist and whitelist
	1317	+ $loginizer['blacklist'] = get_option('loginizer_blacklist');
	1318	+ $loginizer['whitelist'] = get_option('loginizer_whitelist');
	1319	+
	1320	+ // Disable Brute Force
	1321	+ if(isset($_POST['disable_brute_lz'])){
	1322	+
	1323	+ // Save the options
	1324	+ update_option('loginizer_disable_brute', 1);
	1325	+
	1326	+ $loginizer['disable_brute'] = 1;
	1327	+
	1328	+ echo '<div id="message" class="updated"><p>'
	1329	+ . __('The Brute Force Protection feature is now disabled', 'loginizer')
	1330	+ . '</p></div><br />';
	1331	+
886	1332	}
887	1333
888		- // Default messages
889		- $loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
890		- $loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
891		- $loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
892		- $loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
893		- $loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
894		- $loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
	1334	+ // Enable brute force
	1335	+ if(isset($_POST['enable_brute_lz'])){
	1336	+
	1337	+ // Save the options
	1338	+ update_option('loginizer_disable_brute', 0);
	1339	+
	1340	+ $loginizer['disable_brute'] = 0;
	1341	+
	1342	+ echo '<div id="message" class="updated"><p>'
	1343	+ . __('The Brute Force Protection feature is now enabled', 'loginizer')
	1344	+ . '</p></div><br />';
	1345	+
	1346	+ }
895	1347
896		- // Message Strings
897		- $loginizer['msg'] = get_option('loginizer_msg', []);
	1348	+ // The Brute Force Settings
	1349	+ if(isset($_POST['save_lz'])){
	1350	+
	1351	+ $max_retries = (int) lz_optpost('max_retries');
	1352	+ $lockout_time = (int) lz_optpost('lockout_time');
	1353	+ $max_lockouts = (int) lz_optpost('max_lockouts');
	1354	+ $lockouts_extend = (int) lz_optpost('lockouts_extend');
	1355	+ $reset_retries = (int) lz_optpost('reset_retries');
	1356	+ $notify_email = (int) lz_optpost('notify_email');
	1357	+
	1358	+ $lockout_time = $lockout_time * 60;
	1359	+ $lockouts_extend = $lockouts_extend * 60 * 60;
	1360	+ $reset_retries = $reset_retries * 60 * 60;
	1361	+
	1362	+ if(empty($error)){
	1363	+
	1364	+ $option['max_retries'] = $max_retries;
	1365	+ $option['lockout_time'] = $lockout_time;
	1366	+ $option['max_lockouts'] = $max_lockouts;
	1367	+ $option['lockouts_extend'] = $lockouts_extend;
	1368	+ $option['reset_retries'] = $reset_retries;
	1369	+ $option['notify_email'] = $notify_email;
	1370	+
	1371	+ // Save the options
	1372	+ update_option('loginizer_options', $option);
	1373	+
	1374	+ $saved = true;
	1375	+
	1376	+ }else{
	1377	+ lz_report_error($error);
	1378	+ }
898	1379
899		- foreach($loginizer['d_msg'] as $lk => $lv){
900		- if(empty($loginizer['msg'][$lk])){
901		- $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
	1380	+ if(!empty($notice)){
	1381	+ lz_report_notice($notice);
902	1382	}
	1383	+
	1384	+ if(!empty($saved)){
	1385	+ echo '<div id="message" class="updated"><p>'
	1386	+ . __('The settings were saved successfully', 'loginizer')
	1387	+ . '</p></div><br />';
	1388	+ }
	1389	+
903	1390	}
904	1391
905		- $loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
906		- $loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
907		- $loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
908		- $loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
909		- $loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
	1392	+ // Delete a Blackist IP range
	1393	+ if(isset($_POST['bdelid'])){
	1394	+
	1395	+ $delid = (int) lz_optreq('bdelid');
	1396	+
	1397	+ // Unset and save
	1398	+ $blacklist = $loginizer['blacklist'];
	1399	+ unset($blacklist[$delid]);
	1400	+ update_option('loginizer_blacklist', $blacklist);
	1401	+
	1402	+ echo '<div id="message" class="updated fade"><p>'
	1403	+ . __('The Blacklist IP range has been deleted successfully', 'loginizer')
	1404	+ . '</p></div><br />';
	1405	+
	1406	+ }
910	1407
911		- // Message Strings
912		- $loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
	1408	+ // Delete all Blackist IP ranges
	1409	+ if(isset($_POST['del_all_blacklist'])){
	1410	+
	1411	+ // Unset and save
	1412	+ update_option('loginizer_blacklist', array());
	1413	+
	1414	+ echo '<div id="message" class="updated fade"><p>'
	1415	+ . __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
	1416	+ . '</p></div><br />';
	1417	+
	1418	+ }
913	1419
914		- foreach($loginizer['2fa_d_msg'] as $lk => $lv){
915		- if(empty($loginizer['2fa_msg'][$lk])){
916		- $loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
	1420	+ // Delete a Whitelist IP range
	1421	+ if(isset($_POST['delid'])){
	1422	+
	1423	+ $delid = (int) lz_optreq('delid');
	1424	+
	1425	+ // Unset and save
	1426	+ $whitelist = $loginizer['whitelist'];
	1427	+ unset($whitelist[$delid]);
	1428	+ update_option('loginizer_whitelist', $whitelist);
	1429	+
	1430	+ echo '<div id="message" class="updated fade"><p>'
	1431	+ . __('The Whitelist IP range has been deleted successfully', 'loginizer')
	1432	+ . '</p></div><br />';
	1433	+
	1434	+ }
	1435	+
	1436	+ // Delete all Blackist IP ranges
	1437	+ if(isset($_POST['del_all_whitelist'])){
	1438	+
	1439	+ // Unset and save
	1440	+ update_option('loginizer_whitelist', array());
	1441	+
	1442	+ echo '<div id="message" class="updated fade"><p>'
	1443	+ . __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
	1444	+ . '</p></div><br />';
	1445	+
	1446	+ }
	1447	+
	1448	+ // Reset All Logs
	1449	+ if(isset($_POST['lz_reset_all_ip'])){
	1450	+
	1451	+ $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
	1452	+ WHERE `time` > 0");
	1453	+
	1454	+ echo '<div id="message" class="updated fade"><p>'
	1455	+ . __('All the IP Logs have been cleared', 'loginizer')
	1456	+ . '</p></div><br />';
	1457	+ }
	1458	+
	1459	+ // Reset Logs
	1460	+ if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
	1461	+
	1462	+ $ips = $_POST['lz_reset_ips'];
	1463	+
	1464	+ foreach($ips as $ip){
	1465	+ if(!lz_valid_ip($ip)){
	1466	+ $error[] = 'The IP - '.$ip.' is invalid !';
	1467	+ }
917	1468	}
	1469	+
	1470	+ if(count($ips) < 1){
	1471	+ $error[] = 'There are no IPs submitted';
	1472	+ }
	1473	+
	1474	+ // Should we start deleting logs
	1475	+ if(empty($error)){
	1476	+
	1477	+ $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
	1478	+ WHERE `ip` IN ('".implode("', '", $ips)."')");
	1479	+
	1480	+ if(empty($error)){
	1481	+
	1482	+ echo '<div id="message" class="updated fade"><p>'
	1483	+ . __('The selected IP Logs have been reset', 'loginizer')
	1484	+ . '</p></div><br />';
	1485	+
	1486	+ }
	1487	+
	1488	+ }
	1489	+
	1490	+ if(!empty($error)){
	1491	+ lz_report_error($error);echo '<br />';
	1492	+ }
	1493	+
918	1494	}
919	1495
	1496	+ if(isset($_POST['blacklist_iprange'])){
	1497	+
	1498	+ $start_ip = lz_optpost('start_ip');
	1499	+ $end_ip = lz_optpost('end_ip');
	1500	+
	1501	+ if(empty($start_ip)){
	1502	+ $error[] = 'Please enter the Start IP';
	1503	+ }
	1504	+
	1505	+ // If no end IP we consider only 1 IP
	1506	+ if(empty($end_ip)){
	1507	+ $end_ip = $start_ip;
	1508	+ }
	1509	+
	1510	+ if(!lz_valid_ip($start_ip)){
	1511	+ $error[] = 'Please provide a valid start IP';
	1512	+ }
	1513	+
	1514	+ if(!lz_valid_ip($end_ip)){
	1515	+ $error[] = 'Please provide a valid end IP';
	1516	+ }
	1517	+
	1518	+ // Regular ranges will work
	1519	+ if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
	1520	+
	1521	+ // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
	1522	+ if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
	1523	+ // This is right
	1524	+ }else{
	1525	+ $error[] = 'The End IP cannot be smaller than the Start IP';
	1526	+ }
	1527	+
	1528	+ }
	1529	+
	1530	+ if(empty($error)){
	1531	+
	1532	+ $blacklist = $loginizer['blacklist'];
	1533	+
	1534	+ foreach($blacklist as $k => $v){
	1535	+
	1536	+ // This is to check if there is any other range exists with the same Start or End IP
	1537	+ if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
	1538	+ || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
	1539	+ ){
	1540	+ $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
	1541	+ break;
	1542	+ }
	1543	+
	1544	+ // This is to check if there is any other range exists with the same Start IP
	1545	+ if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
	1546	+ $error[] = 'The Start IP is present in an existing range !';
	1547	+ break;
	1548	+ }
	1549	+
	1550	+ // This is to check if there is any other range exists with the same End IP
	1551	+ if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
	1552	+ $error[] = 'The End IP is present in an existing range!';
	1553	+ break;
	1554	+ }
	1555	+
	1556	+ }
	1557	+
	1558	+ $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
	1559	+
	1560	+ if(empty($error)){
	1561	+
	1562	+ $blacklist[$newid] = array();
	1563	+ $blacklist[$newid]['start'] = $start_ip;
	1564	+ $blacklist[$newid]['end'] = $end_ip;
	1565	+ $blacklist[$newid]['time'] = time();
	1566	+
	1567	+ update_option('loginizer_blacklist', $blacklist);
	1568	+
	1569	+ echo '<div id="message" class="updated fade"><p>'
	1570	+ . __('Blacklist IP range added successfully', 'loginizer')
	1571	+ . '</p></div><br />';
	1572	+
	1573	+ }
	1574	+
	1575	+ }
	1576	+
	1577	+ if(!empty($error)){
	1578	+ lz_report_error($error);echo '<br />';
	1579	+ }
	1580	+
	1581	+ }
	1582	+
	1583	+ if(isset($_POST['whitelist_iprange'])){
	1584	+
	1585	+ $start_ip = lz_optpost('start_ip_w');
	1586	+ $end_ip = lz_optpost('end_ip_w');
	1587	+
	1588	+ if(empty($start_ip)){
	1589	+ $error[] = 'Please enter the Start IP';
	1590	+ }
	1591	+
	1592	+ // If no end IP we consider only 1 IP
	1593	+ if(empty($end_ip)){
	1594	+ $end_ip = $start_ip;
	1595	+ }
	1596	+
	1597	+ if(!lz_valid_ip($start_ip)){
	1598	+ $error[] = 'Please provide a valid start IP';
	1599	+ }
	1600	+
	1601	+ if(!lz_valid_ip($end_ip)){
	1602	+ $error[] = 'Please provide a valid end IP';
	1603	+ }
	1604	+
	1605	+ if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
	1606	+
	1607	+ // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
	1608	+ if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
	1609	+ // This is right
	1610	+ }else{
	1611	+ $error[] = 'The End IP cannot be smaller than the Start IP';
	1612	+ }
	1613	+
	1614	+ }
	1615	+
	1616	+ if(empty($error)){
	1617	+
	1618	+ $whitelist = $loginizer['whitelist'];
	1619	+
	1620	+ foreach($whitelist as $k => $v){
	1621	+
	1622	+ // This is to check if there is any other range exists with the same Start or End IP
	1623	+ if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
	1624	+ || ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
	1625	+ ){
	1626	+ $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
	1627	+ break;
	1628	+ }
	1629	+
	1630	+ // This is to check if there is any other range exists with the same Start IP
	1631	+ if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
	1632	+ $error[] = 'The Start IP is present in an existing range !';
	1633	+ break;
	1634	+ }
	1635	+
	1636	+ // This is to check if there is any other range exists with the same End IP
	1637	+ if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
	1638	+ $error[] = 'The End IP is present in an existing range!';
	1639	+ break;
	1640	+ }
	1641	+
	1642	+ }
	1643	+
	1644	+ $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
	1645	+
	1646	+ if(empty($error)){
	1647	+
	1648	+ $whitelist[$newid] = array();
	1649	+ $whitelist[$newid]['start'] = $start_ip;
	1650	+ $whitelist[$newid]['end'] = $end_ip;
	1651	+ $whitelist[$newid]['time'] = time();
	1652	+
	1653	+ update_option('loginizer_whitelist', $whitelist);
	1654	+
	1655	+ echo '<div id="message" class="updated fade"><p>'
	1656	+ . __('Whitelist IP range added successfully', 'loginizer')
	1657	+ . '</p></div><br />';
	1658	+
	1659	+ }
	1660	+
	1661	+ }
	1662	+
	1663	+ if(!empty($error)){
	1664	+ lz_report_error($error);echo '<br />';
	1665	+ }
	1666	+ }
	1667	+
	1668	+ // Save the messages
	1669	+ if(isset($_POST['save_err_msgs_lz'])){
	1670	+
	1671	+ $msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
	1672	+ $msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
	1673	+
	1674	+ // Update them
	1675	+ update_option('loginizer_msg', $msgs);
	1676	+
	1677	+ echo '<div id="message" class="updated fade"><p>'
	1678	+ . __('Error messages were saved successfully', 'loginizer')
	1679	+ . '</p></div><br />';
	1680	+
	1681	+ }
	1682	+
	1683	+ // Count the Results
	1684	+ $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
	1685	+ //print_r($tmp);
	1686	+
	1687	+ // Which Page is it
	1688	+ $lz_env['res_len'] = 10;
	1689	+ $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
	1690	+ $lz_env['num_res'] = $tmp['num'];
	1691	+ $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
	1692	+
	1693	+ // Get the logs
	1694	+ $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
	1695	+ ORDER BY `time` DESC
	1696	+ LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
	1697	+ //print_r($result);
	1698	+
	1699	+ $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
	1700	+ $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
	1701	+ $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
	1702	+ $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
	1703	+
	1704	+ // Reload the settings
	1705	+ $loginizer['blacklist'] = get_option('loginizer_blacklist');
	1706	+ $loginizer['whitelist'] = get_option('loginizer_whitelist');
	1707	+
	1708	+ $saved_msgs = get_option('loginizer_msg');
	1709	+
	1710	+ ?>
	1711	+
	1712	+ <div id="" class="postbox">
	1713	+
	1714	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1715	+ <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
	1716	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1717	+ </button>
	1718	+
	1719	+ <h2 class="hndle ui-sortable-handle">
	1720	+ <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
	1721	+ </h2>
	1722	+
	1723	+ <script>
	1724	+ function yesdsd(){
	1725	+ window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
	1726	+ return false;
	1727	+ }
	1728	+ </script>
	1729	+
	1730	+ <form method="get" onsubmit="return yesdsd();">
	1731	+ <div class="tablenav">
	1732	+ <p class="tablenav-pages" style="margin: 5px 10px" align="right">
	1733	+ <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
	1734	+ <span class="pagination-links">
	1735	+ <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
	1736	+ <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
	1737	+ <span class="paging-input">
	1738	+ <label for="current-page-selector" class="screen-reader-text">Current Page</label>
	1739	+ <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
	1740	+ </span>
	1741	+ <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
	1742	+ <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
	1743	+ </span>
	1744	+ </p>
	1745	+ </div>
	1746	+ </form>
	1747	+
	1748	+ <form action="" method="post" enctype="multipart/form-data">
	1749	+ <?php wp_nonce_field('loginizer-options'); ?>
	1750	+ <div class="inside">
	1751	+ <table class="wp-list-table widefat fixed users" border="0">
	1752	+ <tr>
	1753	+ <th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
	1754	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
	1755	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
	1756	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
	1757	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
	1758	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
	1759	+ <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
	1760	+ </tr>
	1761	+ <?php
	1762	+
	1763	+ if(empty($result)){
	1764	+ echo '
	1765	+ <tr>
	1766	+ <td colspan="4">
	1767	+ No Logs. You will see logs about failed login attempts here.
	1768	+ </td>
	1769	+ </tr>';
	1770	+ }else{
	1771	+ foreach($result as $ik => $iv){
	1772	+ $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
	1773	+ echo '
	1774	+ <tr>
	1775	+ <td>
	1776	+ <input type="checkbox" value="'.$iv['ip'].'" name="lz_reset_ips[]" />
	1777	+ </td>
	1778	+ <td>
	1779	+ '.$iv['ip'].'
	1780	+ </td>
	1781	+ <td>
	1782	+ '.$iv['username'].'
	1783	+ </td>
	1784	+ <td>
	1785	+ '.date('d/M/Y H:i:s P', $iv['time']).'
	1786	+ </td>
	1787	+ <td>
	1788	+ '.$iv['count'].'
	1789	+ </td>
	1790	+ <td>
	1791	+ '.$iv['lockout'].'
	1792	+ </td>
	1793	+ <td>
	1794	+ '.$iv['url'].'
	1795	+ </td>
	1796	+ </tr>';
	1797	+ }
	1798	+ }
	1799	+
	1800	+ ?>
	1801	+ </table>
	1802	+
	1803	+ <br>
	1804	+ <input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
	1805	+ &nbsp; &nbsp;
	1806	+ <input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
	1807	+ </div>
	1808	+ </div>
	1809	+ </form>
	1810	+ <br />
	1811	+
	1812	+ <div id="" class="postbox">
	1813	+
	1814	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1815	+ <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
	1816	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1817	+ </button>
	1818	+
	1819	+ <h2 class="hndle ui-sortable-handle">
	1820	+ <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
	1821	+ </h2>
	1822	+
	1823	+ <div class="inside">
	1824	+
	1825	+ <form action="" method="post" enctype="multipart/form-data">
	1826	+ <?php wp_nonce_field('loginizer-options'); ?>
	1827	+ <table class="form-table">
	1828	+ <tr>
	1829	+ <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
	1830	+ <td>
	1831	+ <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
	1832	+ </td>
	1833	+ </tr>
	1834	+ <tr>
	1835	+ <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
	1836	+ <td>
	1837	+ <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
	1838	+ </td>
	1839	+ </tr>
	1840	+ <tr>
	1841	+ <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
	1842	+ <td>
	1843	+ <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
	1844	+ </td>
	1845	+ </tr>
	1846	+ <tr>
	1847	+ <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
	1848	+ <td>
	1849	+ <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
	1850	+ </td>
	1851	+ </tr>
	1852	+ <tr>
	1853	+ <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
	1854	+ <td>
	1855	+ <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
	1856	+ </td>
	1857	+ </tr>
	1858	+ <tr>
	1859	+ <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
	1860	+ <td>
	1861	+ <?php echo __('after ','loginizer'); ?>
	1862	+ <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
	1863	+ </td>
	1864	+ </tr>
	1865	+ </table><br />
	1866	+ <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
	1867	+ <?php
	1868	+
	1869	+ if(empty($loginizer['disable_brute'])){
	1870	+
	1871	+ echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
	1872	+
	1873	+ }else{
	1874	+
	1875	+ echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
	1876	+
	1877	+ }
	1878	+
	1879	+ ?>
	1880	+ </form>
	1881	+
	1882	+ </div>
	1883	+ </div>
	1884	+ <br />
	1885	+
	1886	+<?php
	1887	+
	1888	+ wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
	1889	+
	1890	+?>
	1891	+
	1892	+<style>
	1893	+.page-navigation a {
	1894	+margin: 5px 2px;
	1895	+display: inline-block;
	1896	+padding: 5px 8px;
	1897	+color: #0073aa;
	1898	+background: #e5e5e5 none repeat scroll 0 0;
	1899	+border: 1px solid #ccc;
	1900	+text-decoration: none;
	1901	+transition-duration: 0.05s;
	1902	+transition-property: border, background, color;
	1903	+transition-timing-function: ease-in-out;
920	1904	}
	1905	+
	1906	+.page-navigation a[data-selected] {
	1907	+background-color: #00a0d2;
	1908	+color: #fff;
	1909	+}
	1910	+</style>
921	1911
922		-function loginizer_social_login_load(){
923		- include_once LOGINIZER_DIR . '/main/social-login.php';
924		-}
	1912	+<script>
925	1913
926		-// Checks if softaculous is installed on the server.
927		-function loginizer_check_softaculous(){
	1914	+jQuery(document).ready(function(){
	1915	+ jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
	1916	+ jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
	1917	+});
928	1918
929		- // Checking if we have Softaculous installed?
930		- if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
931		- return false;
	1919	+// Delete a Blacklist / Whitelist IP Range
	1920	+function del_confirm(field, todo_id, msg){
	1921	+ var ret = confirm(msg);
	1922	+
	1923	+ if(ret){
	1924	+ jQuery('#lz_bl_wl_todo').attr('name', field);
	1925	+ jQuery('#lz_bl_wl_todo').val(todo_id);
	1926	+ jQuery('#lz_bl_wl_form').submit();
932	1927	}
	1928	+
	1929	+ return false;
	1930	+
	1931	+}
933	1932
934		- if(empty($matches) || empty($matches[0])){
935		- return false;
	1933	+// Delete all Blacklist / Whitelist IP Ranges
	1934	+function del_confirm_all(msg){
	1935	+ var ret = confirm(msg);
	1936	+
	1937	+ if(ret){
	1938	+ return true;
936	1939	}
	1940	+
	1941	+ return false;
	1942	+
	1943	+}
937	1944
938		- $softaculous_path = $matches[0] . '.softaculous/installations.php';
939		- if(!file_exists($softaculous_path)){
940		- return false;
941		- }
	1945	+</script>
942	1946
943		- // Checking if users has changed the branding of Softaculous.
944		- $universal_file = '';
945		- // Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
946		- if(file_exists('/usr/local/softaculous/enduser/universal.php')){
947		- $universal_file = '/usr/local/softaculous/enduser/universal.php';
948		- }else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
949		- $universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
950		- }else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
951		- $universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
952		- }else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
953		- $universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
954		- }
	1947	+ <div id="" class="postbox">
	1948	+
	1949	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	1950	+ <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
	1951	+ <span class="toggle-indicator" aria-hidden="true"></span>
	1952	+ </button>
	1953	+
	1954	+ <h2 class="hndle ui-sortable-handle">
	1955	+ <span><?php echo __('Blacklist IP','loginizer'); ?></span>
	1956	+ </h2>
	1957	+
	1958	+ <div class="inside">
	1959	+
	1960	+ <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
	1961	+
	1962	+ <form action="" method="post">
	1963	+ <?php wp_nonce_field('loginizer-options'); ?>
	1964	+ <table class="form-table">
	1965	+ <tr>
	1966	+ <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
	1967	+ <td>
	1968	+ <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
	1969	+ </td>
	1970	+ </tr>
	1971	+ <tr>
	1972	+ <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
	1973	+ <td>
	1974	+ <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
	1975	+ </td>
	1976	+ </tr>
	1977	+ </table><br />
	1978	+ <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
	1979	+ <input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
	1980	+ </form>
	1981	+ </div>
	1982	+
	1983	+ <div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
	1984	+ <table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
	1985	+ <tr>
	1986	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
	1987	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
	1988	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
	1989	+ <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
	1990	+ </tr>
	1991	+ <?php
	1992	+ if(empty($loginizer['blacklist'])){
	1993	+ echo '
	1994	+ <tr>
	1995	+ <td colspan="4">
	1996	+ No Blacklist IPs. You will see blacklisted IP ranges here.
	1997	+ </td>
	1998	+ </tr>';
	1999	+ }else{
	2000	+ foreach($loginizer['blacklist'] as $ik => $iv){
	2001	+ echo '
	2002	+ <tr>
	2003	+ <td>
	2004	+ '.$iv['start'].'
	2005	+ </td>
	2006	+ <td>
	2007	+ '.$iv['end'].'
	2008	+ </td>
	2009	+ <td>
	2010	+ '.date('d/m/Y', $iv['time']).'
	2011	+ </td>
	2012	+ <td>
	2013	+ <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
	2014	+ </td>
	2015	+ </tr>';
	2016	+ }
	2017	+ }
	2018	+ ?>
	2019	+ </table>
	2020	+ <br />
	2021	+ <form action="" method="post" id="lz_bl_wl_form">
	2022	+ <?php wp_nonce_field('loginizer-options'); ?>
	2023	+ <input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
	2024	+ </form>
	2025	+ </div>
	2026	+
	2027	+ <br />
	2028	+
	2029	+ <div id="" class="postbox">
	2030	+
	2031	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	2032	+ <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
	2033	+ <span class="toggle-indicator" aria-hidden="true"></span>
	2034	+ </button>
	2035	+
	2036	+ <h2 class="hndle ui-sortable-handle">
	2037	+ <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
	2038	+ </h2>
	2039	+
	2040	+ <div class="inside">
	2041	+
	2042	+ <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
	2043	+ <form action="" method="post">
	2044	+ <?php wp_nonce_field('loginizer-options'); ?>
	2045	+ <table class="form-table">
	2046	+ <tr>
	2047	+ <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
	2048	+ <td>
	2049	+ <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
	2050	+ </td>
	2051	+ </tr>
	2052	+ <tr>
	2053	+ <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
	2054	+ <td>
	2055	+ <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
	2056	+ </td>
	2057	+ </tr>
	2058	+ </table><br />
	2059	+ <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
	2060	+ <input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
	2061	+ </form>
	2062	+ </div>
	2063	+
	2064	+ <div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
	2065	+ <table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
	2066	+ <tr>
	2067	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
	2068	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
	2069	+ <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
	2070	+ <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
	2071	+ </tr>
	2072	+ <?php
	2073	+ if(empty($loginizer['whitelist'])){
	2074	+ echo '
	2075	+ <tr>
	2076	+ <td colspan="4">
	2077	+ No Whitelist IPs. You will see whitelisted IP ranges here.
	2078	+ </td>
	2079	+ </tr>';
	2080	+ }else{
	2081	+ foreach($loginizer['whitelist'] as $ik => $iv){
	2082	+ echo '
	2083	+ <tr>
	2084	+ <td>
	2085	+ '.$iv['start'].'
	2086	+ </td>
	2087	+ <td>
	2088	+ '.$iv['end'].'
	2089	+ </td>
	2090	+ <td>
	2091	+ '.date('d/m/Y', $iv['time']).'
	2092	+ </td>
	2093	+ <td>
	2094	+ <a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
	2095	+ </td>
	2096	+ </tr>';
	2097	+ }
	2098	+ }
	2099	+ ?>
	2100	+ </table>
	2101	+ <br />
	2102	+
	2103	+ </div>
955	2104
956		- if(empty($universal_file)){
957		- return false;
958		- }
	2105	+ <div id="" class="postbox">
959	2106
960		- $universal = file_get_contents($universal_file);
	2107	+ <button class="handlediv button-link" aria-expanded="true" type="button">
	2108	+ <span class="screen-reader-text">Toggle panel: Error Messages</span>
	2109	+ <span class="toggle-indicator" aria-hidden="true"></span>
	2110	+ </button>
961	2111
962		- if(empty($universal)){
963		- return false;
964		- }
	2112	+ <h2 class="hndle ui-sortable-handle">
	2113	+ <span><?php echo __('Error Messages', 'loginizer'); ?></span>
	2114	+ </h2>
965	2115
966		- // Checking if Softaculous is being whitelabeled
967		- if(preg_match('/\$globals\[["\']sn["\']\]\s.?=\s.?["\']Softaculous["\']/', $universal)){
968		- update_option('loginizer_softwp_upgrade', time());
969		- }
	2116	+ <div class="inside">
970	2117
971		- return false;
	2118	+ <form action="" method="post" enctype="multipart/form-data">
	2119	+ <?php wp_nonce_field('loginizer-options'); ?>
	2120	+ <table class="form-table">
	2121	+ <tr>
	2122	+ <th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
	2123	+ <td>
	2124	+ <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
	2125	+ <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['inv_userpass']. '&quot;</em>', 'loginizer'); ?><br />
	2126	+ </td>
	2127	+ </tr>
	2128	+ <tr>
	2129	+ <th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
	2130	+ <td>
	2131	+ <input type="text" size="25" value="<?php echo esc_attr($saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
	2132	+ <?php echo __('Default: <em>&quot;' . $loginizer['d_msg']['ip_blacklisted']. '&quot;</em>', 'loginizer'); ?><br />
	2133	+ </td>
	2134	+ </tr>
	2135	+ </table><br />
	2136	+ <input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
	2137	+ </form>
	2138	+ </div>
	2139	+ </div>
	2140	+<?php
	2141	+
	2142	+loginizer_page_footer();
	2143	+
972	2144	}
973	2145
	2146	+
974	2147	// Sorry to see you going
975	2148	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
976	2149
977	2150	function loginizer_deactivation(){
		@@ -990,21 +2163,9 @@
990	2163	delete_option('loginizer_last_reset');
991	2164	delete_option('loginizer_whitelist');
992	2165	delete_option('loginizer_blacklist');
993	2166	delete_option('loginizer_msg');
994		- delete_option('loginizer_2fa_msg');
995		- delete_option('loginizer_2fa_email_template');
996	2167	delete_option('loginizer_security');
997	2168	delete_option('loginizer_wp_admin');
998		- delete_option('loginizer_csrf_promo_time');
999		- delete_option('loginizer_backuply_promo_time');
1000		- delete_option('loginizer_promo_time');
1001		- delete_option('loginizer_ins_time');
1002		- delete_option('loginizer_2fa_whitelist');
1003		- delete_option('loginizer_checksums_last_run');
1004		- delete_option('loginizer_checksums_diff');
1005		- delete_option('loginizer_ip_method');
1006		- delete_option('loginizer_2fa_custom_redirect');
1007		- delete_option('external_updates-loginizer-security');
1008		- delete_option('loginizer_login_attempt_stats');
1009	2169
1010		-}
	2170	+}
	2171	+