loginizer / init.php

init.php in Loginizer 1.5.9, at init.php

4,516 lines 149.9 KB

Raw Download Zip

1	<?php
2
3	if(!function_exists('add_action')){
4	echo 'You are not allowed to access this page directly.';
5	exit;
6	}
7
8	define('LOGINIZER_VERSION', '1.5.9');
9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14
15	include_once(LOGINIZER_DIR.'/functions.php');
16
17	// Ok so we are now ready to go
18	register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
19
20	// Is called when the ADMIN enables the plugin
21	function loginizer_activation(){
22
23	global $wpdb;
24
25	$sql = array();
26
27	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28
29	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	`username` varchar(255) NOT NULL DEFAULT '',
31	`time` int(10) NOT NULL DEFAULT '0',
32	`count` int(10) NOT NULL DEFAULT '0',
33	`lockout` int(10) NOT NULL DEFAULT '0',
34	`ip` varchar(255) NOT NULL DEFAULT '',
35	`url` varchar(255) NOT NULL DEFAULT '',
36	UNIQUE KEY `ip` (`ip`)
37	) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
38
39	foreach($sql as $sk => $sv){
40	$wpdb->query($sv);
41	}
42
43	add_option('loginizer_version', LOGINIZER_VERSION);
44	add_option('loginizer_options', array());
45	add_option('loginizer_last_reset', 0);
46	add_option('loginizer_whitelist', array());
47	add_option('loginizer_blacklist', array());
48
49	}
50
51	// Checks if we are to update ?
52	function loginizer_update_check(){
53
54	global $wpdb;
55
56	$sql = array();
57	$current_version = get_option('loginizer_version');
58
59	// It must be the 1.0 pre stuff
60	if(empty($current_version)){
61	$current_version = get_option('lz_version');
62	}
63
64	$version = (int) str_replace('.', '', $current_version);
65
66	// No update required
67	if($current_version == LOGINIZER_VERSION){
68	return true;
69	}
70
71	// Is it first run ?
72	if(empty($current_version)){
73
74	// Reinstall
75	loginizer_activation();
76
77	// Trick the following if conditions to not run
78	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
79
80	}
81
82	// Is it less than 1.0.1 ?
83	if($version < 101){
84
85	// TODO : GET the existing settings
86
87	// Get the existing settings
88	$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
89	$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
90	$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
91
92	// Delete the three tables
93	$sql = array();
94	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
95	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
96	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
97
98	foreach($sql as $sk => $sv){
99	$wpdb->query($sv);
100	}
101
102	// Delete option
103	delete_option('lz_version');
104
105	// Reinstall
106	loginizer_activation();
107
108	// TODO : Save the existing settings
109
110	// Update the existing failed logs to new table
111	if(is_array($lz_failed_logs)){
112	foreach($lz_failed_logs as $fk => $fv){
113	$wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
114	}
115	}
116
117	// Update the existing options to new structure
118	if(is_array($lz_options)){
119	foreach($lz_options as $ok => $ov){
120
121	if($ov['option_name'] == 'lz_last_reset'){
122	update_option('loginizer_last_reset', $ov['option_value']);
123	continue;
124	}
125
126	$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
127	}
128	// Save the options
129	update_option('loginizer_options', $old_option);
130	}
131
132	// Update the existing iprange to new structure
133	if(is_array($lz_iprange)){
134
135	$old_blacklist = array();
136	$old_whitelist = array();
137	$bid = 1;
138	$wid = 1;
139	foreach($lz_iprange as $ik => $iv){
140
141	if(!empty($iv['blacklist'])){
142	$old_blacklist[$bid] = array();
143	$old_blacklist[$bid]['start'] = long2ip($iv['start']);
144	$old_blacklist[$bid]['end'] = long2ip($iv['end']);
145	$old_blacklist[$bid]['time'] = strtotime($iv['date']);
146	$bid = $bid + 1;
147	}
148
149	if(!empty($iv['whitelist'])){
150	$old_whitelist[$wid] = array();
151	$old_whitelist[$wid]['start'] = long2ip($iv['start']);
152	$old_whitelist[$wid]['end'] = long2ip($iv['end']);
153	$old_whitelist[$wid]['time'] = strtotime($iv['date']);
154	$wid = $wid + 1;
155	}
156	}
157
158	if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
159	if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
160	}
161
162	}
163
164	// Is it less than 1.3.9 ?
165	if($version < 139){
166
167	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
168
169	}
170
171	// Save the new Version
172	update_option('loginizer_version', LOGINIZER_VERSION);
173
174	// In Sitepad Math Captcha is enabled by default
175	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
176	$option['captcha_no_google'] = 1;
177	add_option('loginizer_captcha', $option);
178	}
179
180	}
181
182	// Add the action to load the plugin
183	add_action('plugins_loaded', 'loginizer_load_plugin');
184
185	// The function that will be called when the plugin is loaded
186	function loginizer_load_plugin(){
187
188	global $loginizer;
189
190	// Check if the installed version is outdated
191	loginizer_update_check();
192
193	// Set the array
194	$loginizer = array();
195
196	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
197	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
198	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
199	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
200
201	// The IP Method to use
202	$loginizer['ip_method'] = get_option('loginizer_ip_method');
203	if($loginizer['ip_method'] == 3){
204	$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
205	}
206
207	// Load settings
208	$options = get_option('loginizer_options');
209	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
210	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
211	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
212	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
213	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
214	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
215
216	// Default messages
217	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
218	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
219	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
220	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
221	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
222	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
223
224	// Message Strings
225	$loginizer['msg'] = get_option('loginizer_msg');
226
227	foreach($loginizer['d_msg'] as $lk => $lv){
228	if(empty($loginizer['msg'][$lk])){
229	$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
230	}
231	}
232
233	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
234	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
235	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
236	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
237	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
238
239	// Message Strings
240	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg');
241
242	foreach($loginizer['2fa_d_msg'] as $lk => $lv){
243	if(empty($loginizer['2fa_msg'][$lk])){
244	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
245	}
246	}
247
248	// Load the blacklist and whitelist
249	$loginizer['blacklist'] = get_option('loginizer_blacklist');
250	$loginizer['whitelist'] = get_option('loginizer_whitelist');
251
252	// When was the database cleared last time
253	$loginizer['last_reset'] = get_option('loginizer_last_reset');
254
255	//print_r($loginizer);
256
257	// Clear retries
258	if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
259	loginizer_reset_retries();
260	}
261
262	$ins_time = get_option('loginizer_ins_time');
263	if(empty($ins_time)){
264	$ins_time = time();
265	update_option('loginizer_ins_time', $ins_time);
266	}
267	$loginizer['ins_time'] = $ins_time;
268
269	// Set the current IP
270	$loginizer['current_ip'] = lz_getip();
271
272	// Is Brute Force Disabled ?
273	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');
274
275	// Filters and actions
276	if(empty($loginizer['disable_brute'])){
277
278	// Use this to verify before WP tries to login
279	// Is always called and is the first function to be called
280	//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
281	add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
282
283	// Is called when a login attempt fails
284	// Hence Update our records that the login failed
285	add_action('wp_login_failed', 'loginizer_login_failed');
286
287	// Is called before displaying the error message so that we dont show that the username is wrong or the password
288	// Update Error message
289	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
290	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
291
292	}
293
294	// ----------------
295	// PRO INIT
296	// ----------------
297
298	// Email to Login
299	$options = get_option('loginizer_epl');
300	$loginizer['pl_d_sub'] = 'Login at $site_name';
301	$loginizer['pl_d_msg'] = 'Hi,
302
303	A login request was submitted for your account $email at :
304	$site_name - $site_url
305
306	Login at $site_name by visiting this url :
307	$login_url
308
309	If you have not requested for the Login URL, please ignore this email.
310
311	Regards,
312	$site_name';
313	$loginizer['email_pass_less'] = empty($options['email_pass_less']) ? 0 : $options['email_pass_less'];
314	$loginizer['passwordless_sub'] = empty($options['passwordless_sub']) ? $loginizer['pl_d_sub'] : $options['passwordless_sub'];
315	$loginizer['passwordless_msg'] = empty($options['passwordless_msg']) ? $loginizer['pl_d_msg'] : $options['passwordless_msg'];
316
317	// 2FA OTP Email to Login
318	$options = get_option('loginizer_2fa_email_template');
319	$loginizer['2fa_email_d_sub'] = 'OTP : Login at $site_name';
320	$loginizer['2fa_email_d_msg'] = 'Hi,
321
322	A login request was submitted for your account $email at :
323	$site_name - $site_url
324
325	Please use the following One Time password (OTP) to login :
326	$otp
327
328	Note : The OTP expires after 10 minutes.
329
330	If you haven\'t requested for the OTP, please ignore this email.
331
332	Regards,
333	$site_name';
334
335	$loginizer['2fa_email_sub'] = empty($options['2fa_email_sub']) ? $loginizer['2fa_email_d_sub'] : $options['2fa_email_sub'];
336	$loginizer['2fa_email_msg'] = empty($options['2fa_email_msg']) ? $loginizer['2fa_email_d_msg'] : $options['2fa_email_msg'];
337
338	// For SitePad its always on
339	if(defined('SITEPAD')){
340	$loginizer['email_pass_less'] = 1;
341	}
342
343	// Captcha
344	$options = get_option('loginizer_captcha');
345	$loginizer['captcha_type'] = empty($options['captcha_type']) ? '' : $options['captcha_type'];
346	$loginizer['captcha_key'] = empty($options['captcha_key']) ? '' : $options['captcha_key'];
347	$loginizer['captcha_secret'] = empty($options['captcha_secret']) ? '' : $options['captcha_secret'];
348	$loginizer['captcha_theme'] = empty($options['captcha_theme']) ? 'light' : $options['captcha_theme'];
349	$loginizer['captcha_size'] = empty($options['captcha_size']) ? 'normal' : $options['captcha_size'];
350	$loginizer['captcha_lang'] = empty($options['captcha_lang']) ? '' : $options['captcha_lang'];
351	$loginizer['captcha_user_hide'] = !isset($options['captcha_user_hide']) ? 0 : $options['captcha_user_hide'];
352	$loginizer['captcha_no_css_login'] = !isset($options['captcha_no_css_login']) ? 0 : $options['captcha_no_css_login'];
353	$loginizer['captcha_no_js'] = 1;
354	$loginizer['captcha_login'] = !isset($options['captcha_login']) ? 1 : $options['captcha_login'];
355	$loginizer['captcha_lostpass'] = !isset($options['captcha_lostpass']) ? 1 : $options['captcha_lostpass'];
356	$loginizer['captcha_resetpass'] = !isset($options['captcha_resetpass']) ? 1 : $options['captcha_resetpass'];
357	$loginizer['captcha_register'] = !isset($options['captcha_register']) ? 1 : $options['captcha_register'];
358	$loginizer['captcha_comment'] = !isset($options['captcha_comment']) ? 1 : $options['captcha_comment'];
359	$loginizer['captcha_wc_checkout'] = !isset($options['captcha_wc_checkout']) ? 1 : $options['captcha_wc_checkout'];
360
361	$loginizer['captcha_no_google'] = !isset($options['captcha_no_google']) ? 0 : $options['captcha_no_google'];
362	$loginizer['captcha_text'] = empty($options['captcha_text']) ? __('Math Captcha', 'loginizer') : $options['captcha_text'];
363	$loginizer['captcha_time'] = empty($options['captcha_time']) ? 300 : $options['captcha_time'];
364	$loginizer['captcha_words'] = !isset($options['captcha_words']) ? 0 : $options['captcha_words'];
365	$loginizer['captcha_add'] = !isset($options['captcha_add']) ? 1 : $options['captcha_add'];
366	$loginizer['captcha_subtract'] = !isset($options['captcha_subtract']) ? 1 : $options['captcha_subtract'];
367	$loginizer['captcha_multiply'] = !isset($options['captcha_multiply']) ? 0 : $options['captcha_multiply'];
368	$loginizer['captcha_divide'] = !isset($options['captcha_divide']) ? 0 : $options['captcha_divide'];
369
370	// 2fa/question
371	$options = get_option('loginizer_2fa');
372	$loginizer['2fa_app'] = !isset($options['2fa_app']) ? 0 : $options['2fa_app'];
373	$loginizer['2fa_email'] = !isset($options['2fa_email']) ? 0 : $options['2fa_email'];
374	$loginizer['2fa_email_force'] = !isset($options['2fa_email_force']) ? 0 : $options['2fa_email_force'];
375	$loginizer['2fa_sms'] = !isset($options['2fa_sms']) ? 0 : $options['2fa_sms'];
376	$loginizer['question'] = !isset($options['question']) ? 0 : $options['question'];
377	$loginizer['2fa_default'] = empty($options['2fa_default']) ? 'question' : $options['2fa_default'];
378	$loginizer['2fa_roles'] = empty($options['2fa_roles']) ? array() : $options['2fa_roles'];
379
380	// Security Settings
381	$options = get_option('loginizer_security');
382	$loginizer['login_slug'] = empty($options['login_slug']) ? '' : $options['login_slug'];
383	$loginizer['rename_login_secret'] = empty($options['rename_login_secret']) ? '' : $options['rename_login_secret'];
384	$loginizer['xmlrpc_slug'] = empty($options['xmlrpc_slug']) ? '' : $options['xmlrpc_slug'];
385	$loginizer['xmlrpc_disable'] = empty($options['xmlrpc_disable']) ? '' : $options['xmlrpc_disable'];// Disable XML-RPC
386	$loginizer['pingbacks_disable'] = empty($options['pingbacks_disable']) ? '' : $options['pingbacks_disable'];// Disable Pingbacks
387
388	// Admin Slug Settings
389	$options = get_option('loginizer_wp_admin');
390	$loginizer['admin_slug'] = empty($options['admin_slug']) ? '' : $options['admin_slug'];
391	$loginizer['restrict_wp_admin'] = empty($options['restrict_wp_admin']) ? '' : $options['restrict_wp_admin'];
392	$loginizer['wp_admin_msg'] = empty($options['wp_admin_msg']) ? '' : $options['wp_admin_msg'];
393
394	// Checksum Settings
395	$options = get_option('loginizer_checksums');
396	$loginizer['disable_checksum'] = empty($options['disable_checksum']) ? '' : $options['disable_checksum'];
397	$loginizer['checksum_time'] = empty($options['checksum_time']) ? '' : $options['checksum_time'];
398	$loginizer['checksum_frequency'] = empty($options['checksum_frequency']) ? 7 : $options['checksum_frequency'];
399	$loginizer['no_checksum_email'] = empty($options['no_checksum_email']) ? '' : $options['no_checksum_email'];
400	$loginizer['checksums_last_run'] = get_option('loginizer_checksums_last_run');
401
402	// Auto Blacklist Usernames
403	$loginizer['username_blacklist'] = get_option('loginizer_username_blacklist');
404
405	$loginizer['domains_blacklist'] = get_option('loginizer_domains_blacklist');
406
407	$loginizer['wp_admin_d_msg'] = __('LZ : Not allowed via WP-ADMIN. Please access over the new Admin URL', 'loginizer');
408
409	// ----------------
410	// PRO INIT END
411	// ----------------
412
413	// Is the premium features there ?
414	if(file_exists(LOGINIZER_DIR.'/premium.php')){
415
416	// Include the file
417	include_once(LOGINIZER_DIR.'/premium.php');
418
419	loginizer_security_init();
420
421	// Its the free version
422	}else{
423
424	// The promo time
425	$loginizer['promo_time'] = get_option('loginizer_promo_time');
426	if(empty($loginizer['promo_time'])){
427	$loginizer['promo_time'] = time();
428	update_option('loginizer_promo_time', $loginizer['promo_time']);
429	}
430
431	// Are we to show the loginizer promo
432	if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30243600))){
433
434	add_action('admin_notices', 'loginizer_promo');
435
436	}
437
438	// Are we to disable the promo
439	if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
440	update_option('loginizer_promo_time', (0 - time()) );
441	die('DONE');
442	}
443
444	}
445
446	}
447
448	// Show the promo
449	function loginizer_promo(){
450
451	echo '
452	<style>
453	.lz_button {
454	background-color: #4CAF50; /* Green */
455	border: none;
456	color: white;
457	padding: 8px 16px;
458	text-align: center;
459	text-decoration: none;
460	display: inline-block;
461	font-size: 16px;
462	margin: 4px 2px;
463	-webkit-transition-duration: 0.4s; /* Safari */
464	transition-duration: 0.4s;
465	cursor: pointer;
466	}
467
468	.lz_button:focus{
469	border: none;
470	color: white;
471	}
472
473	.lz_button1 {
474	color: white;
475	background-color: #4CAF50;
476	border:3px solid #4CAF50;
477	}
478
479	.lz_button1:hover {
480	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
481	color: white;
482	border:3px solid #4CAF50;
483	}
484
485	.lz_button2 {
486	color: white;
487	background-color: #0085ba;
488	}
489
490	.lz_button2:hover {
491	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
492	color: white;
493	}
494
495	.lz_button3 {
496	color: white;
497	background-color: #365899;
498	}
499
500	.lz_button3:hover {
501	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
502	color: white;
503	}
504
505	.lz_button4 {
506	color: white;
507	background-color: rgb(66, 184, 221);
508	}
509
510	.lz_button4:hover {
511	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
512	color: white;
513	}
514
515	.loginizer_promo-close{
516	float:right;
517	text-decoration:none;
518	margin: 5px 10px 0px 0px;
519	}
520
521	.loginizer_promo-close:hover{
522	color: red;
523	}
524	</style>
525
526	<script>
527	jQuery(document).ready( function() {
528	(function($) {
529	$("#loginizer_promo .loginizer_promo-close").click(function(){
530	var data;
531
532	// Hide it
533	$("#loginizer_promo").hide();
534
535	// Save this preference
536	$.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
537	//alert(response);
538	});
539	});
540	})(jQuery);
541	});
542	</script>
543
544	<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
545	<a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
546	<span class="dashicons dashicons-dismiss"></span> Dismiss
547	</a>
548	<img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
549	<p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
550	<p>
551	<a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
552	<a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
553	\'s</a>
554	<a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
555	<a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
556	</p>
557	</div>';
558
559	}
560
561	// Should return NULL if everything is fine
562	function loginizer_wp_authenticate($user, $username, $password){
563
564	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
565
566	if(!empty($username) && !empty($password)){
567	$lz_user_pass = 1;
568	}
569
570	// Are you whitelisted ?
571	if(loginizer_is_whitelisted()){
572	$loginizer['ip_is_whitelisted'] = 1;
573	return $user;
574	}
575
576	// Are you blacklisted ?
577	if(loginizer_is_blacklisted()){
578	$lz_cannot_login = 1;
579	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
580	}
581
582	// Is the username blacklisted ?
583	if(function_exists('loginizer_user_blacklisted')){
584	if(loginizer_user_blacklisted($username)){
585	$lz_cannot_login = 1;
586	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
587	}
588	}
589
590	if(loginizer_can_login()){
591	return $user;
592	}
593
594	$lz_cannot_login = 1;
595
596	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
597
598	}
599
600	function loginizer_can_login(){
601
602	global $wpdb, $loginizer, $lz_error;
603
604	// Get the logs
605	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
606
607	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
608
609	// Has he reached max lockouts ?
610	if($result['lockout'] >= $loginizer['max_lockouts']){
611	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
612	}
613
614	// Is he in the lockout time ?
615	if($result['time'] >= (time() - $loginizer['lockout_time'])){
616	$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
617
618	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
619	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
620	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
621
622	$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
623
624	if($banlift > 60){
625	$banlift = ceil($banlift / 60);
626	$_time = $banlift.' '.$loginizer['msg']['hours_err'];
627	}
628
629	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
630
631	return false;
632	}
633	}
634
635	return true;
636	}
637
638	function loginizer_is_blacklisted(){
639
640	global $wpdb, $loginizer, $lz_error;
641
642	$blacklist = $loginizer['blacklist'];
643
644	foreach($blacklist as $k => $v){
645
646	// Is the IP in the blacklist ?
647	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
648	$result = 1;
649	break;
650	}
651
652	// Is it in a wider range ?
653	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
654
655	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
656	// if the current IP is <= than the start of the range, it is within the range
657	// OR
658	// if the current IP is <= than the end of the range, it is within the range
659	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
660	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
661	$result = 1;
662	break;
663	}
664
665	}
666
667	}
668
669	// You are blacklisted
670	if(!empty($result)){
671	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
672	return true;
673	}
674
675	return false;
676
677	}
678
679	function loginizer_is_whitelisted(){
680
681	global $wpdb, $loginizer, $lz_error;
682
683	$whitelist = $loginizer['whitelist'];
684
685	foreach($whitelist as $k => $v){
686
687	// Is the IP in the blacklist ?
688	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
689	$result = 1;
690	break;
691	}
692
693	// Is it in a wider range ?
694	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
695
696	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
697	// if the current IP is <= than the start of the range, it is within the range
698	// OR
699	// if the current IP is <= than the end of the range, it is within the range
700	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
701	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
702	$result = 1;
703	break;
704	}
705
706	}
707
708	}
709
710	// You are whitelisted
711	if(!empty($result)){
712	return true;
713	}
714
715	return false;
716
717	}
718
719
720	// When the login fails, then this is called
721	// We need to update the database
722	function loginizer_login_failed($username, $is_2fa = ''){
723
724	global $wpdb, $loginizer, $lz_cannot_login;
725
726	$fail_type = 'Login';
727
728	if(!empty($is_2fa)){
729	$fail_type = '2FA';
730	}
731
732	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
733
734	$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
735	$url = esc_url($url);
736
737	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
738
739	if(!empty($result)){
740	$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
741	$sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."', `url` = '".$url."' WHERE `ip` = '".$loginizer['current_ip']."';");
742
743	// Do we need to email admin ?
744	if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
745
746	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
747	$mail = array();
748	$mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
749	$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
750	$mail['message'] = 'Hi,
751
752	'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
753
754	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
755	Last User Attempt : '.$username.'
756	IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $loginizer['lockout_time']).'
757
758	Regards,
759	Loginizer';
760
761	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
762	}
763	}else{
764	$result = array();
765	$result['count'] = 0;
766	$insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0', `url` = '".$url."';");
767	}
768
769	// We need to add one as this is a failed attempt as well
770	$result['count'] = $result['count'] + 1;
771	$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
772	$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
773
774	}
775	}
776
777	// Handles the error of the password not being there
778	function loginizer_error_handler($errors, $redirect_to){
779
780	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
781
782	//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
783
784	// Remove the empty password error
785	if(is_wp_error($errors)){
786
787	$codes = $errors->get_error_codes();
788
789	foreach($codes as $k => $v){
790	if($v == 'invalid_username' \|\| $v == 'incorrect_password'){
791	$show_error = 1;
792	}
793	}
794
795	$errors->remove('invalid_username');
796	$errors->remove('incorrect_password');
797
798	}
799
800	// Add the error
801	if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
802	$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
803	}
804
805	// Add the number of retires left as well
806	if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
807	$errors->add('retries_left', loginizer_retries_left());
808	}
809
810	return $errors;
811
812	}
813
814
815
816	// Handles the error of the password not being there
817	function loginizer_woocommerce_error_handler(){
818
819	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
820
821	if(function_exists('wc_add_notice')){
822	wc_add_notice( loginizer_retries_left(), 'error' );
823	}
824
825	}
826
827	// Returns a string with the number of retries left
828	function loginizer_retries_left(){
829
830	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
831
832	// If we are to show the number of retries left
833	if(isset($loginizer['retries_left'])){
834	return '<b>'.$loginizer['retries_left'].'</b> '.$loginizer['msg']['attempts_left'];
835	}
836
837	}
838
839	function loginizer_reset_retries(){
840
841	global $wpdb, $loginizer;
842
843	$deltime = time() - $loginizer['reset_retries'];
844	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
845
846	update_option('loginizer_last_reset', time());
847
848	}
849
850	add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
851
852	// Add settings link on plugin page
853	function loginizer_plugin_action_links($links) {
854
855	if(!defined('LOGINIZER_PREMIUM')){
856	$links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
857	}
858
859	$settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
860	array_unshift($links, $settings_link);
861
862	return $links;
863	}
864
865	add_action('admin_menu', 'loginizer_admin_menu');
866
867	// Shows the admin menu of Loginizer
868	function loginizer_admin_menu() {
869
870	global $wp_version, $loginizer;
871
872	if(!defined('SITEPAD')){
873
874	// Add the menu page
875	add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
876
877	// Dashboard
878	add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
879
880	}else{
881
882	// Add the menu page
883	add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
884
885	// Rename Login
886	add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
887
888	}
889
890	// Brute Force
891	add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
892
893	// PasswordLess
894	add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
895
896	// Security Settings
897	if(!defined('SITEPAD')){
898
899	// Two Factor Auth
900	add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
901
902	}
903
904	// reCaptcha
905	add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
906
907	// Security Settings
908	if(!defined('SITEPAD')){
909
910	// Security Settings
911	add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
912
913	// File Checksums
914	add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
915
916	}
917
918	if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30243600))){
919
920	// Go Pro link
921	add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
922
923	}
924
925	}
926
927	// The Loginizer Admin Options Page
928	function loginizer_page_header($title = 'Loginizer'){
929
930	global $loginizer;
931
932	?>
933	<style>
934	.lz-right-ul{
935	padding-left: 10px !important;
936	}
937
938	.lz-right-ul li{
939	list-style: circle !important;
940	}
941	</style>
942	<?php
943
944	echo '<div style="margin: 10px 20px 0 2px;">
945	<div class="metabox-holder columns-2">
946	<div class="postbox-container">
947	<div id="top-sortables" class="meta-box-sortables ui-sortable">
948
949	<table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
950	<tr>
951	<td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
952
953	if(!defined('SITEPAD')){
954
955	echo '<td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">'.__('Review Loginizer', 'loginizer').'</a></td>
956	<td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
957	<td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
958
959	}
960
961	echo '
962	</tr>
963	</table>
964	<hr />
965
966	<!--Main Table-->
967	<table cellpadding="8" cellspacing="1" width="100%" class="fixed">
968	<tr>
969	<td valign="top">';
970
971	}
972
973	// The Loginizer Theme footer
974	function loginizer_page_footer(){
975
976	if(!loginizer_is_premium()){
977	echo '<script>
978	jQuery("[loginizer-premium-only]").each(function(index) {
979	jQuery(this).find( "input, textarea, select" ).attr("disabled", true);
980	});
981	</script>';
982	}
983
984	echo '</td>
985	<td width="200" valign="top" id="loginizer-right-bar">';
986
987	if(!defined('SITEPAD')){
988
989	if(!defined('LOGINIZER_PREMIUM')){
990
991	echo '
992	<div class="postbox" style="min-width:0px !important;">
993	<div class="postbox-header">
994	<h2 class="hndle ui-sortable-handle">
995	<span>Premium Version</span>
996	</h2>
997	</div>
998
999	<div class="inside">
1000	<i>Upgrade to the premium version and get the following features </i>:<br>
1001	<ul class="lz-right-ul">
1002	<li>PasswordLess Login</li>
1003	<li>Two Factor Auth - Email</li>
1004	<li>Two Factor Auth - App</li>
1005	<li>Login Challenge Question</li>
1006	<li>reCAPTCHA</li>
1007	<li>Rename Login Page</li>
1008	<li>Disable XML-RPC</li>
1009	<li>And many more ...</li>
1010	</ul>
1011	<center><a class="button button-primary" target="_blank" href="'.LOGINIZER_PRICING_URL.'">Upgrade</a></center>
1012	</div>
1013	</div>';
1014
1015	}else{
1016
1017	echo '
1018	<div class="postbox" style="min-width:0px !important;">
1019	<div class="postbox-header">
1020	<h2 class="hndle ui-sortable-handle">
1021	<span>Recommendations</span>
1022	</h2>
1023	</div>
1024	<div class="inside">
1025	<i>We recommed that you enable atleast one of the following security features</i>:<br>
1026	<ul class="lz-right-ul">
1027	<li>Rename Login Page</li>
1028	<li>Login Challenge Question</li>
1029	<li>reCAPTCHA</li>
1030	<li>Two Factor Auth - Email</li>
1031	<li>Two Factor Auth - App</li>
1032	<li>Change \'admin\' Username</li>
1033	</ul>
1034	</div>
1035	</div>';
1036	}
1037
1038	echo '
1039	<div class="postbox" style="min-width:0px !important;">
1040	<div class="postbox-header">
1041	<h2 class="hndle ui-sortable-handle">
1042	<span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
1043	</h2>
1044	</div>
1045	<div class="inside">
1046	<i>Easily manage and make professional pages and content with our Pagelayer builder </i>:<br>
1047	<ul class="lz-right-ul">
1048	<li>30+ Free Widgets</li>
1049	<li>60+ Premium Widgets</li>
1050	<li>400+ Premium Sections</li>
1051	<li>Theme Builder</li>
1052	<li>WooCommerce Builder</li>
1053	<li>Theme Creator and Exporter</li>
1054	<li>Form Builder</li>
1055	<li>Popup Builder</li>
1056	<li>And many more ...</li>
1057	</ul>
1058	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">Visit Pagelayer</a></center>
1059	</div>
1060	</div>';
1061
1062	echo '
1063	<div class="postbox" style="min-width:0px !important;">
1064	<div class="postbox-header">
1065	<h2 class="hndle ui-sortable-handle">
1066	<span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
1067	</h2>
1068	</div>
1069	<div class="inside">
1070	<i>Manage all your WordPress sites from <b>1 dashboard</b> </i>:<br>
1071	<ul class="lz-right-ul">
1072	<li>1-click Admin Access</li>
1073	<li>Update WordPress</li>
1074	<li>Update Themes</li>
1075	<li>Update Plugins</li>
1076	<li>Backup your WordPress Site</li>
1077	<li>Plugins & Theme Management</li>
1078	<li>Post Management</li>
1079	<li>And many more ...</li>
1080	</ul>
1081	<center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">Visit wpCentral</a></center>
1082	</div>
1083	</div>';
1084
1085	}
1086
1087	echo '</td>
1088	</tr>
1089	</table>';
1090
1091	if(!defined('SITEPAD')){
1092
1093	echo '<br />
1094	<div style="width:45%;background:#FFF;padding:15px; margin:auto">
1095	<b>Let your friends know that you have secured your website :</b>
1096	<form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
1097	<textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
1098	<input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
1099	</form>
1100
1101	</div>
1102	<br />
1103
1104	<script>
1105	function dotweet(ele){
1106	window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
1107	return false;
1108	}
1109	</script>
1110
1111	<hr />
1112	<a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
1113
1114	}
1115
1116	echo '
1117	</div>
1118	</div>
1119	</div>
1120	</div>';
1121
1122	}
1123
1124	// The Loginizer Admin Options Page
1125	function loginizer_page_dashboard(){
1126
1127	global $loginizer, $lz_error, $lz_env;
1128
1129	if(!current_user_can('manage_options')){
1130	wp_die('Sorry, but you do not have permissions to change settings.');
1131	}
1132
1133	// Dismiss the announcement
1134	if(isset($_GET['dismiss_announcement'])){
1135	update_option('loginizer_no_announcement', 1);
1136	}
1137
1138	/* Make sure post was from this page */
1139	if(count($_POST) > 0){
1140	check_admin_referer('loginizer-options');
1141	}
1142
1143	// Is there a license key ?
1144	if(isset($_POST['save_lz'])){
1145
1146	$license = lz_optpost('lz_license');
1147
1148	// Check if its a valid license
1149	if(empty($license)){
1150	$lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
1151	return loginizer_page_dashboard_T();
1152	}
1153
1154	$resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license, array('timeout' => 30));
1155
1156	if(is_array($resp)){
1157	$json = json_decode($resp['body'], true);
1158	//print_r($json);
1159	}else{
1160
1161	$lz_error['resp_invalid'] = __('The response was malformed<br>'.var_export($resp, true), 'loginizer');
1162	return loginizer_page_dashboard_T();
1163
1164	}
1165
1166	// Save the License
1167	if(empty($json['license'])){
1168
1169	$lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
1170	return loginizer_page_dashboard_T();
1171
1172	}else{
1173
1174	update_option('loginizer_license', $json);
1175
1176	// Mark as saved
1177	$GLOBALS['lz_saved'] = true;
1178	}
1179
1180	}
1181
1182
1183	// Is there a IP Method ?
1184	if(isset($_POST['save_lz_ip_method'])){
1185
1186	$ip_method = (int) lz_optpost('lz_ip_method');
1187	$custom_ip_method = lz_optpost('lz_custom_ip_method');
1188
1189	if($ip_method >= 0 && $ip_method <= 3){
1190	update_option('loginizer_ip_method', $ip_method);
1191	}
1192
1193	// Custom Method name ?
1194	if($ip_method == 3){
1195	update_option('loginizer_custom_ip_method', $custom_ip_method);
1196	}
1197
1198	}
1199
1200	loginizer_page_dashboard_T();
1201
1202	}
1203
1204	// The Loginizer Admin Options Page - THEME
1205	function loginizer_page_dashboard_T(){
1206
1207	global $loginizer, $lz_error, $lz_env;
1208
1209	loginizer_page_header('Dashboard');
1210	?>
1211	<style>
1212	.welcome-panel{
1213	margin: 0px;
1214	padding: 10px;
1215	}
1216
1217	input[type="text"], textarea, select {
1218	width: 70%;
1219	}
1220
1221	.form-table label{
1222	font-weight:bold;
1223	}
1224
1225	.exp{
1226	font-size:12px;
1227	}
1228	</style>
1229
1230	<?php
1231
1232	loginizer_newsletter_subscribe();
1233
1234	$hide_announcement = get_option('loginizer_no_announcement');
1235	if(empty($hide_announcement)){
1236	echo '<div id="message" class="welcome-panel">'. __('<a href="https://loginizer.com/blog/loginizer-has-been-acquired-by-softaculous/" target="_blank" style="text-decoration:none;">We are excited to announce that we have joined forces with Softaculous and have been acquired by them 😊. Read full announcement here.</a>', 'loginizer'). '<a class="welcome-panel-close" style="top:3px;right:2px;" href="'.menu_page_url('loginizer', false).'&dismiss_announcement=1" aria-label="Dismiss announcement"></a></div><br />';
1237	}
1238
1239	echo '<div class="welcome-panel">Thank you for choosing Loginizer! Many more features coming soon...   Review Loginizer at WordPress     <a href="https://wordpress.org/support/view/plugin-reviews/loginizer" class="button button-primary" target="_blank">Add Review</a></div><br />';
1240
1241	// Saved ?
1242	if(!empty($GLOBALS['lz_saved'])){
1243	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
1244	}
1245
1246	// Any errors ?
1247	if(!empty($lz_error)){
1248	lz_report_error($lz_error);echo '<br />';
1249	}
1250
1251	?>
1252
1253	<div class="postbox">
1254
1255	<div class="postbox-header">
1256	<h2 class="hndle ui-sortable-handle">
1257	<span><?php echo __('Getting Started', 'loginizer'); ?></span>
1258	</h2>
1259	</div>
1260
1261	<div class="inside">
1262
1263	<form action="" method="post" enctype="multipart/form-data">
1264	<?php wp_nonce_field('loginizer-options'); ?>
1265	<table class="form-table">
1266	<tr>
1267	<td scope="row" valign="top" colspan="2" style="line-height:150%">
1268	<i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
1269	<?php
1270	if(defined('LOGINIZER_PREMIUM')){
1271	echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
1272	}else{
1273	echo '<br><i><a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none;color:red;">Upgrade to Pro</a> for more features like <b>reCAPTCHA, Two Factor Auth, Rename wp-admin and wp-login.php pages, Email based PasswordLess</b> login and more. These features will improve your website\'s security.</i>';
1274	}
1275	?>
1276	</td>
1277	</tr>
1278	</table>
1279	</form>
1280
1281	</div>
1282	</div>
1283
1284	<div class="postbox">
1285
1286	<div class="postbox-header">
1287	<h2 class="hndle ui-sortable-handle">
1288	<span><?php echo __('System Information', 'loginizer'); ?></span>
1289	</h2>
1290	</div>
1291	<div class="inside">
1292
1293	<form action="" method="post" enctype="multipart/form-data">
1294	<?php wp_nonce_field('loginizer-options'); ?>
1295	<table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1296	<?php
1297	echo '
1298	<tr>
1299	<th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1300	<td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (<font color="green">Security PRO Version</font>)' : '').'</td>
1301	</tr>';
1302
1303	if(defined('LOGINIZER_PREMIUM')){
1304	echo '
1305	<tr>
1306	<th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
1307	<td align="left">
1308	'.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span>    ' : '').'
1309	<input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" />
1310	<input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
1311
1312	if(!empty($loginizer['license'])){
1313
1314	$expires = $loginizer['license']['expires'];
1315	$expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
1316
1317	echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : '<span style="color:green">Yes</span>').'
1318	License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
1319	</div>';
1320	}
1321
1322
1323	echo
1324	'</td>
1325	</tr>';
1326	}
1327
1328	echo '<tr>
1329	<th align="left">'.__('URL', 'loginizer').'</th>
1330	<td>'.get_site_url().'</td>
1331	</tr>
1332	<tr>
1333	<th align="left">'.__('Path', 'loginizer').'</th>
1334	<td>'.ABSPATH.'</td>
1335	</tr>
1336	<tr>
1337	<th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1338	<td>'.@$_SERVER['SERVER_ADDR'].'</td>
1339	</tr>
1340	<tr>
1341	<th align="left">'.__('Your IP Address', 'loginizer').'</th>
1342	<td>'.lz_getip().'
1343	<div style="float:right">
1344	Method :
1345	<select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1346	<option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1347	<option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1348	<option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1349	<option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1350	</select>
1351	<input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1352	<input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1353	</div>
1354	</td>
1355	</tr>
1356	<tr>
1357	<th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1358	<td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1359	</tr>';
1360
1361	if(file_exists(ABSPATH.'/.htaccess')){
1362	echo '
1363	<tr>
1364	<th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1365	<td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1366	</tr>';
1367
1368	}
1369
1370	?>
1371	</table>
1372	</form>
1373
1374	</div>
1375	</div>
1376
1377	<script type="text/javascript">
1378
1379	function lz_ip_method_handle(){
1380	var ele = jQuery('#lz_ip_method');
1381	if(ele.val() == 3){
1382	jQuery('#lz_custom_ip_method').show();
1383	}else{
1384	jQuery('#lz_custom_ip_method').hide();
1385	}
1386	};
1387
1388	lz_ip_method_handle();
1389
1390	</script>
1391
1392	<div id="" class="postbox">
1393
1394	<div class="postbox-header">
1395	<h2 class="hndle ui-sortable-handle">
1396	<span><?php echo __('File Permissions', 'loginizer'); ?></span>
1397	</h2>
1398	</div>
1399
1400	<div class="inside">
1401
1402	<form action="" method="post" enctype="multipart/form-data">
1403	<?php wp_nonce_field('loginizer-options'); ?>
1404	<table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1405	<?php
1406
1407	echo '
1408	<tr>
1409	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1410	<th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1411	<th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1412	</tr>';
1413
1414	$wp_content = basename(dirname(dirname(dirname(__FILE__))));
1415
1416	$files_to_check = array('/' => array('0755', '0750'),
1417	'/wp-admin' => array('0755'),
1418	'/wp-includes' => array('0755'),
1419	'/wp-config.php' => array('0444'),
1420	'/'.$wp_content => array('0755'),
1421	'/'.$wp_content.'/themes' => array('0755'),
1422	'/'.$wp_content.'/plugins' => array('0755'),
1423	'.htaccess' => array('0444'));
1424
1425	$root = ABSPATH;
1426
1427	foreach($files_to_check as $k => $v){
1428
1429	$path = $root.'/'.$k;
1430	$stat = @stat($path);
1431	$suggested = $v;
1432	$actual = substr(sprintf('%o', $stat['mode']), -4);
1433
1434	echo '
1435	<tr>
1436	<td>'.$k.'</td>
1437	<td>'.current($suggested).'</td>
1438	<td><span '.(!in_array($actual, $suggested) ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1439	</tr>';
1440
1441	}
1442
1443	?>
1444	</table>
1445	</form>
1446
1447	</div>
1448	</div>
1449
1450	<?php
1451
1452	loginizer_page_footer();
1453
1454	}
1455
1456	// The Loginizer Admin Options Page
1457	function loginizer_page_brute_force(){
1458
1459	global $wpdb, $wp_roles, $loginizer;
1460
1461	if(!current_user_can('manage_options')){
1462	wp_die('Sorry, but you do not have permissions to change settings.');
1463	}
1464
1465	/* Make sure post was from this page */
1466	if(count($_POST) > 0){
1467	check_admin_referer('loginizer-options');
1468	}
1469
1470	// BEGIN THEME
1471	loginizer_page_header('Brute Force Settings');
1472
1473	// Load the blacklist and whitelist
1474	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1475	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1476
1477	// Disable Brute Force
1478	if(isset($_POST['disable_brute_lz'])){
1479
1480	// Save the options
1481	update_option('loginizer_disable_brute', 1);
1482
1483	$loginizer['disable_brute'] = 1;
1484
1485	echo '<div id="message" class="updated"><p>'
1486	. __('The Brute Force Protection feature is now disabled', 'loginizer')
1487	. '</p></div><br />';
1488
1489	}
1490
1491	// Enable brute force
1492	if(isset($_POST['enable_brute_lz'])){
1493
1494	// Save the options
1495	update_option('loginizer_disable_brute', 0);
1496
1497	$loginizer['disable_brute'] = 0;
1498
1499	echo '<div id="message" class="updated"><p>'
1500	. __('The Brute Force Protection feature is now enabled', 'loginizer')
1501	. '</p></div><br />';
1502
1503	}
1504
1505	// The Brute Force Settings
1506	if(isset($_POST['save_lz'])){
1507
1508	$max_retries = (int) lz_optpost('max_retries');
1509	$lockout_time = (int) lz_optpost('lockout_time');
1510	$max_lockouts = (int) lz_optpost('max_lockouts');
1511	$lockouts_extend = (int) lz_optpost('lockouts_extend');
1512	$reset_retries = (int) lz_optpost('reset_retries');
1513	$notify_email = (int) lz_optpost('notify_email');
1514
1515	$lockout_time = $lockout_time * 60;
1516	$lockouts_extend = $lockouts_extend * 60 * 60;
1517	$reset_retries = $reset_retries * 60 * 60;
1518
1519	if(empty($error)){
1520
1521	$option['max_retries'] = $max_retries;
1522	$option['lockout_time'] = $lockout_time;
1523	$option['max_lockouts'] = $max_lockouts;
1524	$option['lockouts_extend'] = $lockouts_extend;
1525	$option['reset_retries'] = $reset_retries;
1526	$option['notify_email'] = $notify_email;
1527
1528	// Save the options
1529	update_option('loginizer_options', $option);
1530
1531	$saved = true;
1532
1533	}else{
1534	lz_report_error($error);
1535	}
1536
1537	if(!empty($notice)){
1538	lz_report_notice($notice);
1539	}
1540
1541	if(!empty($saved)){
1542	echo '<div id="message" class="updated"><p>'
1543	. __('The settings were saved successfully', 'loginizer')
1544	. '</p></div><br />';
1545	}
1546
1547	}
1548
1549	// Delete a Blackist IP range
1550	if(isset($_POST['bdelid'])){
1551
1552	$delid = (int) lz_optreq('bdelid');
1553
1554	// Unset and save
1555	$blacklist = $loginizer['blacklist'];
1556	unset($blacklist[$delid]);
1557	update_option('loginizer_blacklist', $blacklist);
1558
1559	echo '<div id="message" class="updated fade"><p>'
1560	. __('The Blacklist IP range has been deleted successfully', 'loginizer')
1561	. '</p></div><br />';
1562
1563	}
1564
1565	// Delete all Blackist IP ranges
1566	if(isset($_POST['del_all_blacklist'])){
1567
1568	// Unset and save
1569	update_option('loginizer_blacklist', array());
1570
1571	echo '<div id="message" class="updated fade"><p>'
1572	. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1573	. '</p></div><br />';
1574
1575	}
1576
1577	// Delete a Whitelist IP range
1578	if(isset($_POST['delid'])){
1579
1580	$delid = (int) lz_optreq('delid');
1581
1582	// Unset and save
1583	$whitelist = $loginizer['whitelist'];
1584	unset($whitelist[$delid]);
1585	update_option('loginizer_whitelist', $whitelist);
1586
1587	echo '<div id="message" class="updated fade"><p>'
1588	. __('The Whitelist IP range has been deleted successfully', 'loginizer')
1589	. '</p></div><br />';
1590
1591	}
1592
1593	// Delete all Blackist IP ranges
1594	if(isset($_POST['del_all_whitelist'])){
1595
1596	// Unset and save
1597	update_option('loginizer_whitelist', array());
1598
1599	echo '<div id="message" class="updated fade"><p>'
1600	. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1601	. '</p></div><br />';
1602
1603	}
1604
1605	// Reset All Logs
1606	if(isset($_POST['lz_reset_all_ip'])){
1607
1608	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1609	WHERE `time` > 0");
1610
1611	echo '<div id="message" class="updated fade"><p>'
1612	. __('All the IP Logs have been cleared', 'loginizer')
1613	. '</p></div><br />';
1614	}
1615
1616	// Reset Logs
1617	if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1618
1619	$ips = $_POST['lz_reset_ips'];
1620
1621	foreach($ips as $ip){
1622	if(!lz_valid_ip($ip)){
1623	$error[] = 'The IP - '.$ip.' is invalid !';
1624	}
1625	}
1626
1627	if(count($ips) < 1){
1628	$error[] = __('There are no IPs submitted', 'loginizer');
1629	}
1630
1631	// Should we start deleting logs
1632	if(empty($error)){
1633
1634	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs`
1635	WHERE `ip` IN ('".implode("', '", $ips)."')");
1636
1637	if(empty($error)){
1638
1639	echo '<div id="message" class="updated fade"><p>'
1640	. __('The selected IP Logs have been reset', 'loginizer')
1641	. '</p></div><br />';
1642
1643	}
1644
1645	}
1646
1647	if(!empty($error)){
1648	lz_report_error($error);echo '<br />';
1649	}
1650
1651	}
1652
1653	if(isset($_POST['blacklist_iprange'])){
1654
1655	$start_ip = lz_optpost('start_ip');
1656	$end_ip = lz_optpost('end_ip');
1657
1658	if(empty($start_ip)){
1659	$error[] = __('Please enter the Start IP', 'loginizer');
1660	}
1661
1662	// If no end IP we consider only 1 IP
1663	if(empty($end_ip)){
1664	$end_ip = $start_ip;
1665	}
1666
1667	if(!lz_valid_ip($start_ip)){
1668	$error[] = __('Please provide a valid start IP', 'loginizer');
1669	}
1670
1671	if(!lz_valid_ip($end_ip)){
1672	$error[] = __('Please provide a valid end IP', 'loginizer');
1673	}
1674
1675	// Regular ranges will work
1676	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1677
1678	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1679	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1680	// This is right
1681	}else{
1682	$error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
1683	}
1684
1685	}
1686
1687	if(empty($error)){
1688
1689	$blacklist = $loginizer['blacklist'];
1690
1691	foreach($blacklist as $k => $v){
1692
1693	// This is to check if there is any other range exists with the same Start or End IP
1694	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1695	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1696	){
1697	$error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
1698	break;
1699	}
1700
1701	// This is to check if there is any other range exists with the same Start IP
1702	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1703	$error[] = __('The Start IP is present in an existing range !', 'loginizer');
1704	break;
1705	}
1706
1707	// This is to check if there is any other range exists with the same End IP
1708	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1709	$error[] = __('The End IP is present in an existing range!', 'loginizer');
1710	break;
1711	}
1712
1713	}
1714
1715	$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1716
1717	if(empty($error)){
1718
1719	$blacklist[$newid] = array();
1720	$blacklist[$newid]['start'] = $start_ip;
1721	$blacklist[$newid]['end'] = $end_ip;
1722	$blacklist[$newid]['time'] = time();
1723
1724	update_option('loginizer_blacklist', $blacklist);
1725
1726	echo '<div id="message" class="updated fade"><p>'
1727	. __('Blacklist IP range added successfully', 'loginizer')
1728	. '</p></div><br />';
1729
1730	}
1731
1732	}
1733
1734	if(!empty($error)){
1735	lz_report_error($error);echo '<br />';
1736	}
1737
1738	}
1739
1740	if(isset($_POST['whitelist_iprange'])){
1741
1742	$start_ip = lz_optpost('start_ip_w');
1743	$end_ip = lz_optpost('end_ip_w');
1744
1745	if(empty($start_ip)){
1746	$error[] = __('Please enter the Start IP', 'loginizer');
1747	}
1748
1749	// If no end IP we consider only 1 IP
1750	if(empty($end_ip)){
1751	$end_ip = $start_ip;
1752	}
1753
1754	if(!lz_valid_ip($start_ip)){
1755	$error[] = __('Please provide a valid start IP', 'loginizer');
1756	}
1757
1758	if(!lz_valid_ip($end_ip)){
1759	$error[] = __('Please provide a valid end IP', 'loginizer');
1760	}
1761
1762	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
1763
1764	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1765	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
1766	// This is right
1767	}else{
1768	$error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
1769	}
1770
1771	}
1772
1773	if(empty($error)){
1774
1775	$whitelist = $loginizer['whitelist'];
1776
1777	foreach($whitelist as $k => $v){
1778
1779	// This is to check if there is any other range exists with the same Start or End IP
1780	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
1781	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
1782	){
1783	$error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
1784	break;
1785	}
1786
1787	// This is to check if there is any other range exists with the same Start IP
1788	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
1789	$error[] = __('The Start IP is present in an existing range !', 'loginizer');
1790	break;
1791	}
1792
1793	// This is to check if there is any other range exists with the same End IP
1794	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
1795	$error[] = __('The End IP is present in an existing range!', 'loginizer');
1796	break;
1797	}
1798
1799	}
1800
1801	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1802
1803	if(empty($error)){
1804
1805	$whitelist[$newid] = array();
1806	$whitelist[$newid]['start'] = $start_ip;
1807	$whitelist[$newid]['end'] = $end_ip;
1808	$whitelist[$newid]['time'] = time();
1809
1810	update_option('loginizer_whitelist', $whitelist);
1811
1812	echo '<div id="message" class="updated fade"><p>'
1813	. __('Whitelist IP range added successfully', 'loginizer')
1814	. '</p></div><br />';
1815
1816	}
1817
1818	}
1819
1820	if(!empty($error)){
1821	lz_report_error($error);echo '<br />';
1822	}
1823	}
1824
1825	// Save the messages
1826	if(isset($_POST['save_err_msgs_lz'])){
1827
1828	$msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1829	$msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1830	$msgs['attempts_left'] = lz_optpost('msg_attempts_left');
1831	$msgs['lockout_err'] = lz_optpost('msg_lockout_err');
1832	$msgs['minutes_err'] = lz_optpost('msg_minutes_err');
1833	$msgs['hours_err'] = lz_optpost('msg_hours_err');
1834
1835	// Update them
1836	update_option('loginizer_msg', $msgs);
1837
1838	echo '<div id="message" class="updated fade"><p>'
1839	. __('Error messages were saved successfully', 'loginizer')
1840	. '</p></div><br />';
1841
1842	}
1843
1844	// Count the Results
1845	$tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1846	//print_r($tmp);
1847
1848	// Which Page is it
1849	$lz_env['res_len'] = 10;
1850	$lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1851	$lz_env['num_res'] = $tmp['num'];
1852	$lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1853
1854	// Get the logs
1855	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1856	ORDER BY `time` DESC
1857	LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1858	//print_r($result);
1859
1860	$lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1861	$lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1862	$lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1863	$lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1864
1865	// Reload the settings
1866	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1867	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1868
1869	$saved_msgs = get_option('loginizer_msg');
1870
1871	?>
1872
1873	<div id="" class="postbox">
1874
1875	<div class="postbox-header">
1876	<h2 class="hndle ui-sortable-handle">
1877	<?php echo __('<span>Failed Login Attempts Logs</span>   (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1878	</h2>
1879	</div>
1880
1881	<script>
1882	function yesdsd(){
1883	window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1884	return false;
1885	}
1886	</script>
1887
1888	<form method="get" onsubmit="return yesdsd();">
1889	<div class="tablenav">
1890	<p class="tablenav-pages" style="margin: 5px 10px" align="right">
1891	<span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1892	<span class="pagination-links">
1893	<a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1894	<a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1895	<span class="paging-input">
1896	<label for="current-page-selector" class="screen-reader-text">Current Page</label>
1897	<input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1898	</span>
1899	<a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1900	<a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1901	</span>
1902	</p>
1903	</div>
1904	</form>
1905
1906	<form action="" method="post" enctype="multipart/form-data">
1907	<?php wp_nonce_field('loginizer-options'); ?>
1908	<div class="inside">
1909	<table class="wp-list-table widefat fixed users" border="0">
1910	<tr>
1911	<th scope="row" valign="top" style="background:#EFEFEF;" width="20">#</th>
1912	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1913	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
1914	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1915	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1916	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
1917	<th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
1918	</tr>
1919	<?php
1920
1921	if(empty($result)){
1922	echo '
1923	<tr>
1924	<td colspan="4">
1925	'.__('No Logs. You will see logs about failed login attempts here.', 'loginizer').'
1926	</td>
1927	</tr>';
1928	}else{
1929	foreach($result as $ik => $iv){
1930	$status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1931	echo '
1932	<tr>
1933	<td>
1934	<input type="checkbox" value="'.$iv['ip'].'" name="lz_reset_ips[]" />
1935	</td>
1936	<td>
1937	'.$iv['ip'].'
1938	</td>
1939	<td>
1940	'.$iv['username'].'
1941	</td>
1942	<td>
1943	'.date('d/M/Y H:i:s P', $iv['time']).'
1944	</td>
1945	<td>
1946	'.$iv['count'].'
1947	</td>
1948	<td>
1949	'.$iv['lockout'].'
1950	</td>
1951	<td>
1952	'.$iv['url'].'
1953	</td>
1954	</tr>';
1955	}
1956	}
1957
1958	?>
1959	</table>
1960
1961	<br>
1962	<input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
1963
1964	<input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
1965	</div>
1966	</div>
1967	</form>
1968	<br />
1969
1970	<div id="" class="postbox">
1971
1972	<div class="postbox-header">
1973	<h2 class="hndle ui-sortable-handle">
1974	<span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1975	</h2>
1976	</div>
1977
1978	<div class="inside">
1979
1980	<form action="" method="post" enctype="multipart/form-data">
1981	<?php wp_nonce_field('loginizer-options'); ?>
1982	<table class="form-table">
1983	<tr>
1984	<th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1985	<td>
1986	<input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1987	</td>
1988	</tr>
1989	<tr>
1990	<th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1991	<td>
1992	<input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1993	</td>
1994	</tr>
1995	<tr>
1996	<th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1997	<td>
1998	<input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1999	</td>
2000	</tr>
2001	<tr>
2002	<th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
2003	<td>
2004	<input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
2005	</td>
2006	</tr>
2007	<tr>
2008	<th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
2009	<td>
2010	<input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
2011	</td>
2012	</tr>
2013	<tr>
2014	<th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
2015	<td>
2016	<?php echo __('after ','loginizer'); ?>
2017	<input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
2018	</td>
2019	</tr>
2020	</table><br />
2021	<input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2022	<?php
2023
2024	if(empty($loginizer['disable_brute'])){
2025
2026	echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2027
2028	}else{
2029
2030	echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2031
2032	}
2033
2034	?>
2035	</form>
2036
2037	</div>
2038	</div>
2039	<br />
2040
2041	<?php
2042
2043	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
2044
2045	?>
2046
2047	<style>
2048	.page-navigation a {
2049	margin: 5px 2px;
2050	display: inline-block;
2051	padding: 5px 8px;
2052	color: #0073aa;
2053	background: #e5e5e5 none repeat scroll 0 0;
2054	border: 1px solid #ccc;
2055	text-decoration: none;
2056	transition-duration: 0.05s;
2057	transition-property: border, background, color;
2058	transition-timing-function: ease-in-out;
2059	}
2060
2061	.page-navigation a[data-selected] {
2062	background-color: #00a0d2;
2063	color: #fff;
2064	}
2065	</style>
2066
2067	<script>
2068
2069	jQuery(document).ready(function(){
2070	jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
2071	jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
2072	});
2073
2074	// Delete a Blacklist / Whitelist IP Range
2075	function del_confirm(field, todo_id, msg){
2076	var ret = confirm(msg);
2077
2078	if(ret){
2079	jQuery('#lz_bl_wl_todo').attr('name', field);
2080	jQuery('#lz_bl_wl_todo').val(todo_id);
2081	jQuery('#lz_bl_wl_form').submit();
2082	}
2083
2084	return false;
2085
2086	}
2087
2088	// Delete all Blacklist / Whitelist IP Ranges
2089	function del_confirm_all(msg){
2090	var ret = confirm(msg);
2091
2092	if(ret){
2093	return true;
2094	}
2095
2096	return false;
2097
2098	}
2099
2100	</script>
2101
2102	<div id="" class="postbox">
2103
2104	<div class="postbox-header">
2105	<h2 class="hndle ui-sortable-handle">
2106	<span><?php echo __('Blacklist IP','loginizer'); ?></span>
2107	</h2>
2108	</div>
2109
2110	<div class="inside">
2111
2112	<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
2113
2114	<form action="" method="post">
2115	<?php wp_nonce_field('loginizer-options'); ?>
2116	<table class="form-table">
2117	<tr>
2118	<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
2119	<td>
2120	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2121	</td>
2122	</tr>
2123	<tr>
2124	<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2125	<td>
2126	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
2127	</td>
2128	</tr>
2129	</table><br />
2130	<input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
2131	<input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
2132	</form>
2133	</div>
2134
2135	<div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
2136	<table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2137	<tr>
2138	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2139	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2140	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2141	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2142	</tr>
2143	<?php
2144	if(empty($loginizer['blacklist'])){
2145	echo '
2146	<tr>
2147	<td colspan="4">
2148	'.__('No Blacklist IPs. You will see blacklisted IP ranges here.', 'loginizer').'
2149	</td>
2150	</tr>';
2151	}else{
2152	foreach($loginizer['blacklist'] as $ik => $iv){
2153	echo '
2154	<tr>
2155	<td>
2156	'.$iv['start'].'
2157	</td>
2158	<td>
2159	'.$iv['end'].'
2160	</td>
2161	<td>
2162	'.date('d/m/Y', $iv['time']).'
2163	</td>
2164	<td>
2165	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2166	</td>
2167	</tr>';
2168	}
2169	}
2170	?>
2171	</table>
2172	<br />
2173	<form action="" method="post" id="lz_bl_wl_form">
2174	<?php wp_nonce_field('loginizer-options'); ?>
2175	<input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2176	</form>
2177	</div>
2178
2179	<br />
2180
2181	<div id="" class="postbox">
2182
2183	<div class="postbox-header">
2184	<h2 class="hndle ui-sortable-handle">
2185	<span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2186	</h2>
2187	</div>
2188
2189	<div class="inside">
2190
2191	<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2192	<form action="" method="post">
2193	<?php wp_nonce_field('loginizer-options'); ?>
2194	<table class="form-table">
2195	<tr>
2196	<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2197	<td>
2198	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2199	</td>
2200	</tr>
2201	<tr>
2202	<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2203	<td>
2204	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2205	</td>
2206	</tr>
2207	</table><br />
2208	<input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2209	<input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2210	</form>
2211	</div>
2212
2213	<div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2214	<table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2215	<tr>
2216	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2217	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2218	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2219	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2220	</tr>
2221	<?php
2222	if(empty($loginizer['whitelist'])){
2223	echo '
2224	<tr>
2225	<td colspan="4">
2226	'.__('No Whitelist IPs. You will see whitelisted IP ranges here.', 'loginizer').'
2227	</td>
2228	</tr>';
2229	}else{
2230	foreach($loginizer['whitelist'] as $ik => $iv){
2231	echo '
2232	<tr>
2233	<td>
2234	'.$iv['start'].'
2235	</td>
2236	<td>
2237	'.$iv['end'].'
2238	</td>
2239	<td>
2240	'.date('d/m/Y', $iv['time']).'
2241	</td>
2242	<td>
2243	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2244	</td>
2245	</tr>';
2246	}
2247	}
2248	?>
2249	</table>
2250	<br />
2251
2252	</div>
2253
2254	<div id="" class="postbox">
2255
2256	<div class="postbox-header">
2257	<h2 class="hndle ui-sortable-handle">
2258	<span><?php echo __('Error Messages', 'loginizer'); ?></span>
2259	</h2>
2260	</div>
2261
2262	<div class="inside">
2263
2264	<form action="" method="post" enctype="multipart/form-data">
2265	<?php wp_nonce_field('loginizer-options'); ?>
2266	<table class="form-table">
2267	<tr>
2268	<th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2269	<td>
2270	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2271	<?php echo __('Default: <em>"' . $loginizer['d_msg']['inv_userpass']. '"</em>', 'loginizer'); ?><br />
2272	</td>
2273	</tr>
2274	<tr>
2275	<th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2276	<td>
2277	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2278	<?php echo __('Default: <em>"' . $loginizer['d_msg']['ip_blacklisted']. '"</em>', 'loginizer'); ?><br />
2279	</td>
2280	</tr>
2281	<tr>
2282	<th scope="row" valign="top"><label for="msg_attempts_left"><?php echo __('Attempts Left','loginizer'); ?></label></th>
2283	<td>
2284	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['attempts_left']); ?>" name="msg_attempts_left" id="msg_attempts_left" />
2285	<?php echo __('Default: <em>"' . $loginizer['d_msg']['attempts_left']. '"</em>', 'loginizer'); ?><br />
2286	</td>
2287	</tr>
2288	<tr>
2289	<th scope="row" valign="top"><label for="msg_lockout_err"><?php echo __('Lockout Error','loginizer'); ?></label></th>
2290	<td>
2291	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['lockout_err']); ?>" name="msg_lockout_err" id="msg_lockout_err" />
2292	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['lockout_err']). '"</em>', 'loginizer'); ?><br />
2293	</td>
2294	</tr>
2295	<tr>
2296	<th scope="row" valign="top"><label for="msg_minutes_err"><?php echo __('Minutes','loginizer'); ?></label></th>
2297	<td>
2298	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['minutes_err']); ?>" name="msg_minutes_err" id="msg_minutes_err" />
2299	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['minutes_err']). '"</em>', 'loginizer'); ?><br />
2300	</td>
2301	</tr>
2302	<tr>
2303	<th scope="row" valign="top"><label for="msg_hours_err"><?php echo __('Hours','loginizer'); ?></label></th>
2304	<td>
2305	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['hours_err']); ?>" name="msg_hours_err" id="msg_hours_err" />
2306	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['hours_err']). '"</em>', 'loginizer'); ?><br />
2307	</td>
2308	</tr>
2309	</table><br />
2310	<input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2311	</form>
2312	</div>
2313	</div>
2314	<?php
2315
2316	loginizer_page_footer();
2317
2318	}
2319
2320	//---------------------
2321	// Admin Menu Pro Pages
2322	//---------------------
2323
2324	// Loginizer - reCaptcha Page
2325	function loginizer_page_recaptcha(){
2326
2327	global $loginizer, $lz_error, $lz_env;
2328
2329	if(!current_user_can('manage_options')){
2330	wp_die('Sorry, but you do not have permissions to change settings.');
2331	}
2332
2333	if(!loginizer_is_premium() && count($_POST) > 0){
2334	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
2335	return loginizer_page_recaptcha_T();
2336	}
2337
2338	/* Make sure post was from this page */
2339	if(count($_POST) > 0){
2340	check_admin_referer('loginizer-options');
2341	}
2342
2343	// Themes
2344	$lz_env['theme']['light'] = 'Light';
2345	$lz_env['theme']['dark'] = 'Dark';
2346
2347	// Langs
2348	$lz_env['lang'][''] = 'Auto Detect';
2349	$lz_env['lang']['ar'] = 'Arabic';
2350	$lz_env['lang']['bg'] = 'Bulgarian';
2351	$lz_env['lang']['ca'] = 'Catalan';
2352	$lz_env['lang']['zh-CN'] = 'Chinese (Simplified)';
2353	$lz_env['lang']['zh-TW'] = 'Chinese (Traditional)';
2354	$lz_env['lang']['hr'] = 'Croatian';
2355	$lz_env['lang']['cs'] = 'Czech';
2356	$lz_env['lang']['da'] = 'Danish';
2357	$lz_env['lang']['nl'] = 'Dutch';
2358	$lz_env['lang']['en-GB'] = 'English (UK)';
2359	$lz_env['lang']['en'] = 'English (US)';
2360	$lz_env['lang']['fil'] = 'Filipino';
2361	$lz_env['lang']['fi'] = 'Finnish';
2362	$lz_env['lang']['fr'] = 'French';
2363	$lz_env['lang']['fr-CA'] = 'French (Canadian)';
2364	$lz_env['lang']['de'] = 'German';
2365	$lz_env['lang']['de-AT'] = 'German (Austria)';
2366	$lz_env['lang']['de-CH'] = 'German (Switzerland)';
2367	$lz_env['lang']['el'] = 'Greek';
2368	$lz_env['lang']['iw'] = 'Hebrew';
2369	$lz_env['lang']['hi'] = 'Hindi';
2370	$lz_env['lang']['hu'] = 'Hungarain';
2371	$lz_env['lang']['id'] = 'Indonesian';
2372	$lz_env['lang']['it'] = 'Italian';
2373	$lz_env['lang']['ja'] = 'Japanese';
2374	$lz_env['lang']['ko'] = 'Korean';
2375	$lz_env['lang']['lv'] = 'Latvian';
2376	$lz_env['lang']['lt'] = 'Lithuanian';
2377	$lz_env['lang']['no'] = 'Norwegian';
2378	$lz_env['lang']['fa'] = 'Persian';
2379	$lz_env['lang']['pl'] = 'Polish';
2380	$lz_env['lang']['pt'] = 'Portuguese';
2381	$lz_env['lang']['pt-BR'] = 'Portuguese (Brazil)';
2382	$lz_env['lang']['pt-PT'] = 'Portuguese (Portugal)';
2383	$lz_env['lang']['ro'] = 'Romanian';
2384	$lz_env['lang']['ru'] = 'Russian';
2385	$lz_env['lang']['sr'] = 'Serbian';
2386	$lz_env['lang']['sk'] = 'Slovak';
2387	$lz_env['lang']['sl'] = 'Slovenian';
2388	$lz_env['lang']['es'] = 'Spanish';
2389	$lz_env['lang']['es-419'] = 'Spanish (Latin America)';
2390	$lz_env['lang']['sv'] = 'Swedish';
2391	$lz_env['lang']['th'] = 'Thai';
2392	$lz_env['lang']['tr'] = 'Turkish';
2393	$lz_env['lang']['uk'] = 'Ukrainian';
2394	$lz_env['lang']['vi'] = 'Vietnamese';
2395
2396	// Sizes
2397	$lz_env['size']['normal'] = 'Normal';
2398	$lz_env['size']['compact'] = 'Compact';
2399
2400	if(isset($_POST['save_lz'])){
2401
2402	// Google Captcha
2403	$option['captcha_type'] = lz_optpost('captcha_type');
2404	$option['captcha_key'] = lz_optpost('captcha_key');
2405	$option['captcha_secret'] = lz_optpost('captcha_secret');
2406	$option['captcha_theme'] = lz_optpost('captcha_theme');
2407	$option['captcha_size'] = lz_optpost('captcha_size');
2408	$option['captcha_lang'] = lz_optpost('captcha_lang');
2409
2410	// No Google Captcha
2411	$option['captcha_text'] = lz_optpost('captcha_text');
2412	$option['captcha_time'] = (int) lz_optpost('captcha_time');
2413	$option['captcha_words'] = (int) lz_optpost('captcha_words');
2414	$option['captcha_add'] = (int) lz_optpost('captcha_add');
2415	$option['captcha_subtract'] = (int) lz_optpost('captcha_subtract');
2416	$option['captcha_multiply'] = (int) lz_optpost('captcha_multiply');
2417	$option['captcha_divide'] = (int) lz_optpost('captcha_divide');
2418
2419	// Checkboxes
2420	$option['captcha_user_hide'] = (int) lz_optpost('captcha_user_hide');
2421	$option['captcha_no_css_login'] = (int) lz_optpost('captcha_no_css_login');
2422	$option['captcha_login'] = (int) lz_optpost('captcha_login');
2423	$option['captcha_lostpass'] = (int) lz_optpost('captcha_lostpass');
2424	$option['captcha_resetpass'] = (int) lz_optpost('captcha_resetpass');
2425	$option['captcha_register'] = (int) lz_optpost('captcha_register');
2426	$option['captcha_comment'] = (int) lz_optpost('captcha_comment');
2427	$option['captcha_wc_checkout'] = (int) lz_optpost('captcha_wc_checkout');
2428
2429	// Are we to use Math Captcha ?
2430	if(isset($_POST['captcha_no_google'])){
2431
2432	$option['captcha_no_google'] = 1;
2433
2434	// Make the checks
2435	if(strlen($option['captcha_text']) < 1){
2436	$lz_error['captcha_text'] = __('The Captcha key was not submitted', 'loginizer');
2437	}
2438
2439	}else{
2440
2441	// Make the checks
2442	if(strlen($option['captcha_key']) < 32 \|\| strlen($option['captcha_key']) > 50){
2443	$lz_error['captcha_key'] = __('The reCAPTCHA key is invalid', 'loginizer');
2444	}
2445
2446	// Is secret valid ?
2447	if(strlen($option['captcha_secret']) < 32 \|\| strlen($option['captcha_secret']) > 50){
2448	$lz_error['captcha_secret'] = __('The reCAPTCHA secret is invalid', 'loginizer');
2449	}
2450
2451	// Is theme valid ?
2452	if(empty($lz_env['theme'][$option['captcha_theme']])){
2453	$lz_error['captcha_theme'] = __('The reCAPTCHA theme is invalid', 'loginizer');
2454	}
2455
2456	// Is size valid ?
2457	if(empty($lz_env['size'][$option['captcha_size']])){
2458	$lz_error['captcha_size'] = __('The reCAPTCHA size is invalid', 'loginizer');
2459	}
2460
2461	// Is lang valid ?
2462	if(empty($lz_env['lang'][$option['captcha_lang']])){
2463	$lz_error['captcha_lang'] = __('The reCAPTCHA language is invalid', 'loginizer');
2464	}
2465
2466	}
2467
2468	// Is there an error ?
2469	if(!empty($lz_error)){
2470	return loginizer_page_recaptcha_T();
2471	}
2472
2473	// Save the options
2474	update_option('loginizer_captcha', $option);
2475
2476	// Mark as saved
2477	$GLOBALS['lz_saved'] = true;
2478
2479	}
2480
2481	// Clear this
2482	if(isset($_POST['clear_captcha_lz'])){
2483
2484	// Save the options
2485	update_option('loginizer_captcha', '');
2486
2487	// Mark as saved
2488	$GLOBALS['lz_cleared'] = true;
2489
2490	}
2491
2492	// Call the theme
2493	loginizer_page_recaptcha_T();
2494
2495	}
2496
2497	// Loginizer - reCaptcha Page Theme
2498	function loginizer_page_recaptcha_T(){
2499
2500	global $loginizer, $lz_error, $lz_env;
2501
2502	// Universal header
2503	loginizer_page_header('reCAPTCHA Settings');
2504
2505	loginizer_feature_available('reCAPTCHA');
2506
2507	// Saved ?
2508	if(!empty($GLOBALS['lz_saved'])){
2509	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
2510	}
2511
2512	// Cleared ?
2513	if(!empty($GLOBALS['lz_cleared'])){
2514	echo '<div id="message" class="updated"><p>'. __('reCAPTCHA has been disabled !', 'loginizer'). '</p></div><br />';
2515	}
2516
2517	// Any errors ?
2518	if(!empty($lz_error)){
2519	lz_report_error($lz_error);echo '<br />';
2520	}
2521
2522	?>
2523
2524	<style>
2525	input[type="text"], textarea, select {
2526	width: 70%;
2527	}
2528	</style>
2529
2530	<div id="" class="postbox">
2531
2532	<div class="postbox-header">
2533	<h2 class="hndle ui-sortable-handle">
2534	<span><?php echo __('reCAPTCHA Settings', 'loginizer'); ?></span>
2535	</h2>
2536	</div>
2537
2538	<div class="inside">
2539
2540	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
2541	<?php wp_nonce_field('loginizer-options'); ?>
2542	<table class="form-table">
2543	<tr class="lz_google_cap">
2544	<td scope="row" valign="top" style="width:300px !important; padding-left:0px"><label><b><?php echo __('reCAPTCHA type', 'loginizer'); ?></b></label><br>
2545	<?php echo __('Choose the type of reCAPTCHA', 'loginizer'); ?><br />
2546	<?php echo __('<a href="https://g.co/recaptcha/sitetypes/" target="_blank">See Site Types for more details</a>', 'loginizer'); ?>
2547	</td>
2548	<td>
2549	<input type="radio" value="v3" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', 'v3', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v3" /> <label for="captcha_type_v3"><?php echo __('reCAPTCHA v3', 'loginizer'); ?></label><br /><br />
2550	<input type="radio" value="" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', '', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2" /> <label for="captcha_type_v2"><?php echo __('reCAPTCHA v2 - Checkbox', 'loginizer'); ?></label><br /><br />
2551	<input type="radio" value="v2_invisible" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', 'v2_invisible', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2_invisible" /> <label for="captcha_type_v2_invisible"><?php echo __('reCAPTCHA v2 - Invisible', 'loginizer'); ?></label><br />
2552	</td>
2553	</tr>
2554	<tr class="lz_google_cap">
2555	<td scope="row" valign="top" style="width:300px !important; padding-left:0px"><label><b><?php echo __('Site Key', 'loginizer'); ?></b></label><br>
2556	<?php echo __('Make sure you enter the correct keys as per the reCAPTCHA type selected above', 'loginizer'); ?>
2557	</td>
2558	<td>
2559	<input type="text" size="50" value="<?php echo lz_optpost('captcha_key', $loginizer['captcha_key']); ?>" name="captcha_key" /><br />
2560	<?php echo __('Get the Site Key and Secret Key from <a href="https://www.google.com/recaptcha/" target="_blank">Google</a>', 'loginizer'); ?>
2561	</td>
2562	</tr>
2563	<tr class="lz_google_cap">
2564	<th scope="row" valign="top"><label><?php echo __('Secret Key', 'loginizer'); ?></label></th>
2565	<td>
2566	<input type="text" size="50" value="<?php echo lz_optpost('captcha_secret', $loginizer['captcha_secret']); ?>" name="captcha_secret" />
2567	</td>
2568	</tr>
2569	<tr class="lz_google_cap">
2570	<th scope="row" valign="top"><label><?php echo __('Theme', 'loginizer'); ?></label></th>
2571	<td>
2572	<select name="captcha_theme">
2573	<?php
2574	foreach($lz_env['theme'] as $k => $v){
2575	echo '<option '.lz_POSTselect('captcha_theme', $k, ($loginizer['captcha_theme'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2576	}
2577	?>
2578	</select>
2579	</td>
2580	</tr>
2581	<tr class="lz_google_cap">
2582	<th scope="row" valign="top"><label><?php echo __('Language', 'loginizer'); ?></label></th>
2583	<td>
2584	<select name="captcha_lang">
2585	<?php
2586	foreach($lz_env['lang'] as $k => $v){
2587	echo '<option '.lz_POSTselect('captcha_lang', $k, ($loginizer['captcha_lang'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2588	}
2589	?>
2590	</select>
2591	</td>
2592	</tr>
2593	<tr class="lz_google_cap lz_google_cap_size">
2594	<th scope="row" valign="top"><label><?php echo __('Size', 'loginizer'); ?></label></th>
2595	<td>
2596	<select name="captcha_size">
2597	<?php
2598	foreach($lz_env['size'] as $k => $v){
2599	echo '<option '.lz_POSTselect('captcha_size', $k, ($loginizer['captcha_size'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2600	}
2601	?>
2602	</select>
2603	</td>
2604	</tr>
2605	<tr>
2606	<td scope="row" valign="top" style="padding-left:0px">
2607	<label><b><?php echo __('Don\'t use Google reCAPTCHA', 'loginizer'); ?></b></label><br>
2608	<?php echo __('If selected, '.$loginizer['prefix'].' will use a simple Math Captcha instead of Google reCAPTCHA', 'loginizer'); ?>
2609	</td>
2610	<td>
2611	<input type="checkbox" onclick="no_google_recaptcha(this)" id="captcha_no_google" value="1" name="captcha_no_google" <?php echo lz_POSTchecked('captcha_no_google', (empty($loginizer['captcha_no_google']) ? false : true)); ?> />
2612	</td>
2613	</tr>
2614	<tr class="lz_math_cap">
2615	<td scope="row" valign="top" style="width:300px !important; padding-left:0px">
2616	<label><b><?php echo __('Captcha Text', 'loginizer'); ?></b></label><br>
2617	<?php echo __('The text to be shown for the Captcha Field', 'loginizer'); ?>
2618	</td>
2619	<td>
2620	<input type="text" size="30" value="<?php echo lz_optpost('captcha_text', @$loginizer['captcha_text']); ?>" name="captcha_text" />
2621	</td>
2622	</tr>
2623	<tr class="lz_math_cap">
2624	<td scope="row" valign="top" style="padding-left:0px">
2625	<label><b><?php echo __('Captcha Time', 'loginizer'); ?></b></label><br>
2626	<?php echo __('Enter the number of seconds, a user has to enter captcha value.', 'loginizer'); ?>
2627	</td>
2628	<td>
2629	<input type="text" size="30" value="<?php echo lz_optpost('captcha_time', @$loginizer['captcha_time']); ?>" name="captcha_time" />
2630	</td>
2631	</tr>
2632	<tr class="lz_math_cap">
2633	<td scope="row" valign="top" style="padding-left:0px">
2634	<label><b><?php echo __('Display Captcha in Words', 'loginizer'); ?></b></label><br>
2635	<?php echo __('If selected the Captcha will be displayed in words rather than numbers', 'loginizer'); ?>
2636	</td>
2637	<td>
2638	<input type="checkbox" value="1" name="captcha_words" <?php echo lz_POSTchecked('captcha_words', (empty($loginizer['captcha_words']) ? false : true));?> />
2639	</td>
2640	</tr>
2641	<tr class="lz_math_cap">
2642	<td scope="row" valign="top" style="vertical-align: top !important; padding-left:0px">
2643	<label><b><?php echo __('Mathematical operations', 'loginizer'); ?></b></label><br>
2644	<?php echo __('The Mathematical operations to use for Captcha', 'loginizer'); ?>
2645	</td>
2646	<td valign="top">
2647	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
2648	<?php echo '
2649	<tr>
2650	<td>'.__('Addition (+)', 'loginizer').'</td>
2651	<td><input type="checkbox" value="1" name="captcha_add" '.lz_POSTchecked('captcha_add', (empty($loginizer['captcha_add']) ? false : true)).' /></td>
2652	</tr>
2653	<tr>
2654	<td>'.__('Subtraction (-)', 'loginizer').'</td>
2655	<td><input type="checkbox" value="1" name="captcha_subtract" '.lz_POSTchecked('captcha_subtract', (empty($loginizer['captcha_subtract']) ? false : true)).' /></td>
2656	</tr>
2657	<tr>
2658	<td>'.__('Multiplication (x)', 'loginizer').'</td>
2659	<td><input type="checkbox" value="1" name="captcha_multiply" '.lz_POSTchecked('captcha_multiply', (empty($loginizer['captcha_multiply']) ? false : true)).' /></td>
2660	</tr>
2661	<tr>
2662	<td>'.__('Division (รท)', 'loginizer').'</td>
2663	<td><input type="checkbox" value="1" name="captcha_divide" '.lz_POSTchecked('captcha_divide', (empty($loginizer['captcha_divide']) ? false : true)).' /></td>
2664	</tr>';
2665	?>
2666	</table>
2667	</td>
2668	</tr>
2669	<tr>
2670	<th scope="row" valign="top"><label><?php echo __('Show Captcha On', 'loginizer'); ?></label></th>
2671	<td valign="top">
2672	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
2673	<?php echo '
2674	<tr>
2675	<td>'.__('Login Form', 'loginizer').'</td>
2676	<td><input type="checkbox" value="1" name="captcha_login" '.lz_POSTchecked('captcha_login', (empty($loginizer['captcha_login']) ? false : true)).' /></td>
2677	</tr>
2678	<tr>
2679	<td>'.__('Lost Password Form', 'loginizer').'</td>
2680	<td><input type="checkbox" value="1" name="captcha_lostpass" '.lz_POSTchecked('captcha_lostpass', (empty($loginizer['captcha_lostpass']) ? false : true)).' /></td>
2681	</tr>
2682	<tr>
2683	<td>'.__('Reset Password Form', 'loginizer').'</td>
2684	<td><input type="checkbox" value="1" name="captcha_resetpass" '.lz_POSTchecked('captcha_resetpass', (empty($loginizer['captcha_resetpass']) ? false : true)).' /></td>
2685	</tr>
2686	<tr>
2687	<td>'.__('Registration Form', 'loginizer').'</td>
2688	<td><input type="checkbox" value="1" name="captcha_register" '.lz_POSTchecked('captcha_register', (empty($loginizer['captcha_register']) ? false : true)).' /></td>
2689	</tr>
2690	<tr>
2691	<td>'.__('Comment Form', 'loginizer').'</td>
2692	<td><input type="checkbox" value="1" name="captcha_comment" '.lz_POSTchecked('captcha_comment', (empty($loginizer['captcha_comment']) ? false : true)).' /></td>
2693	</tr>';
2694
2695	if(!defined('SITEPAD')){
2696
2697	echo '<tr>
2698	<td>'.__('WooCommerce Checkout', 'loginizer').'</td>
2699	<td><input type="checkbox" value="1" name="captcha_wc_checkout" '.lz_POSTchecked('captcha_wc_checkout', (empty($loginizer['captcha_wc_checkout']) ? false : true)).' /></td>
2700	</tr>';
2701
2702	}
2703
2704	?>
2705	</table>
2706	</td>
2707	</tr>
2708	<tr>
2709	<th scope="row" valign="top"><label><?php echo __('Hide CAPTCHA for logged in Users', 'loginizer'); ?></label></th>
2710	<td>
2711	<input type="checkbox" value="1" name="captcha_user_hide" <?php echo lz_POSTchecked('captcha_user_hide', (empty($loginizer['captcha_user_hide']) ? false : true)); ?> />
2712	</td>
2713	</tr>
2714	<tr class="lz_google_cap">
2715	<th scope="row" valign="top"><label><?php echo __('Disable CSS inserted on Login Page', 'loginizer'); ?></label></th>
2716	<td>
2717	<input type="checkbox" value="1" name="captcha_no_css_login" <?php echo lz_POSTchecked('captcha_no_css_login', (empty($loginizer['captcha_no_css_login']) ? false : true)); ?> />
2718	</td>
2719	</tr>
2720	</table><br />
2721	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2722	<input style="float:right" name="clear_captcha_lz" class="button action" value="<?php echo __('Disable reCAPTCHA','loginizer'); ?>" type="submit" /></center>
2723	</form>
2724
2725	</div>
2726	</div>
2727	<br />
2728
2729	<script type="text/javascript">
2730
2731	function no_google_recaptcha(obj){
2732
2733	if(obj.checked){
2734	jQuery(".lz_google_cap").hide();
2735	jQuery(".lz_math_cap").show();
2736	}else{
2737	jQuery(".lz_google_cap").show();
2738	jQuery(".lz_math_cap").hide();
2739	}
2740
2741	var cur_captcha_type = jQuery("input:radio[name='captcha_type']:checked").val();
2742
2743	if(cur_captcha_type == 'v3' \|\| cur_captcha_type == 'v2_invisible'){
2744	jQuery(".lz_google_cap_size").hide();
2745	}else{
2746	jQuery(".lz_google_cap_size").show();
2747	}
2748
2749	}
2750
2751	no_google_recaptcha(jQuery("#captcha_no_google")[0]);
2752
2753	function google_recaptcha_type(obj){
2754	if(obj.value == 'v3' \|\| obj.value == 'v2_invisible'){
2755	jQuery(".lz_google_cap_size").hide();
2756	}else{
2757	jQuery(".lz_google_cap_size").show();
2758	}
2759	}
2760
2761
2762	</script>
2763
2764	<?php
2765	loginizer_page_footer();
2766
2767	}
2768
2769
2770	// Loginizer - Two Factor Auth Page
2771	function loginizer_page_2fa(){
2772
2773	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
2774
2775	if(!current_user_can('manage_options')){
2776	wp_die('Sorry, but you do not have permissions to change settings.');
2777	}
2778
2779	if(!loginizer_is_premium() && count($_POST) > 0){
2780	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
2781	return loginizer_page_2fa_T();
2782	}
2783
2784	$lz_roles = get_editable_roles();
2785
2786	/* Make sure post was from this page */
2787	if(count($_POST) > 0){
2788	check_admin_referer('loginizer-options');
2789	}
2790
2791	// Settings submitted
2792	if(isset($_POST['save_lz'])){
2793
2794	// In the future there can be more settings
2795	$option['2fa_app'] = (int) lz_optpost('2fa_app');
2796	$option['2fa_email'] = (int) lz_optpost('2fa_email');
2797	$option['question'] = (int) lz_optpost('question');
2798	$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
2799
2800	// Any roles to apply to ?
2801	foreach($lz_roles as $k => $v){
2802
2803	if(lz_optpost('2fa_roles_'.$k)){
2804	$option['2fa_roles'][$k] = 1;
2805	}
2806
2807	}
2808
2809	// If its all, then blank it
2810	if(lz_optpost('2fa_roles_all') \|\| empty($option['2fa_roles'])){
2811	$option['2fa_roles'] = '';
2812	}
2813
2814	// Is there an error ?
2815	if(!empty($lz_error)){
2816	return loginizer_page_2fa_T();
2817	}
2818
2819	// Save the options
2820	update_option('loginizer_2fa', $option);
2821
2822	// Mark as saved
2823	$GLOBALS['lz_saved'] = true;
2824
2825	}
2826
2827	// Reset a users 2FA
2828	if(isset($_POST['reset_user_lz'])){
2829
2830	$_username = lz_optpost('lz_user_2fa_disable');
2831
2832	// Try to get the user
2833	$user_search = get_user_by('login', $_username);
2834
2835	// If not found then search by email
2836	if(empty($user_search)){
2837	$user_search = get_user_by('email', $_username);
2838	}
2839
2840	// If not found then give error
2841	if(empty($user_search)){
2842	$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
2843	return loginizer_page_2fa_T();
2844	}
2845
2846	// Get the user prefences
2847	$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
2848
2849	// Blank it
2850	$user_pref['pref'] = 'none';
2851
2852	// Save it
2853	update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
2854
2855	// Mark as saved
2856	$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
2857
2858	}
2859
2860	if(isset($_POST['save_2fa_email_template_lz'])){
2861
2862	// In the future there can be more settings
2863	$option['2fa_email_sub'] = lz_optpost('lz_2fa_email_sub');
2864	$option['2fa_email_msg'] = lz_optpost('lz_2fa_email_msg');
2865
2866	// Is there an error ?
2867	if(!empty($lz_error)){
2868	return loginizer_page_2fa_T();
2869	}
2870
2871	// Save the options
2872	update_option('loginizer_2fa_email_template', $option);
2873
2874	// Mark as saved
2875	$GLOBALS['lz_saved'] = true;
2876
2877	}
2878
2879	// Save the messages
2880	if(isset($_POST['save_msgs_lz'])){
2881
2882	$msgs['otp_app'] = lz_optpost('msg_otp_app');
2883	$msgs['otp_email'] = lz_optpost('msg_otp_email');
2884	$msgs['otp_field'] = lz_optpost('msg_otp_field');
2885	$msgs['otp_question'] = lz_optpost('msg_otp_question');
2886	$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
2887
2888	// Update them
2889	update_option('loginizer_2fa_msg', $msgs);
2890
2891	echo '<div id="message" class="updated fade"><p>'
2892	. __('Messages were saved successfully', 'loginizer')
2893	. '</p></div><br />';
2894
2895	}
2896
2897
2898	$lz_options = get_option('loginizer_2fa_email_template');
2899	$saved_msgs = get_option('loginizer_2fa_msg');
2900
2901	// Call theme
2902	loginizer_page_2fa_T();
2903
2904	}
2905
2906
2907	// Loginizer - Two Factor Auth Page
2908	function loginizer_page_2fa_T(){
2909
2910	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
2911
2912	// Universal header
2913	loginizer_page_header('Two Factor Authentication');
2914
2915	loginizer_feature_available('Two-Factor Authentication');
2916
2917	// Saved ?
2918	if(!empty($GLOBALS['lz_saved'])){
2919	echo '<div id="message" class="updated"><p>'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '</p></div><br />';
2920	}
2921
2922	// Any errors ?
2923	if(!empty($lz_error)){
2924	lz_report_error($lz_error);echo '<br />';
2925	}
2926
2927	?>
2928
2929	<style>
2930	input[type="text"], textarea, select {
2931	width: 70%;
2932	}
2933
2934	.form-table label{
2935	font-weight:bold;
2936	}
2937
2938	.exp{
2939	font-size:12px;
2940	}
2941	</style>
2942
2943	<div id="" class="postbox">
2944
2945	<div class="postbox-header">
2946	<h2 class="hndle ui-sortable-handle">
2947	<span><?php echo __('Two Factor Authentication Settings', 'loginizer'); ?></span>
2948	</h2>
2949	</div>
2950
2951	<div class="inside">
2952
2953	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
2954	<?php wp_nonce_field('loginizer-options'); ?>
2955	<table class="form-table">
2956	<tr>
2957	<td scope="row" valign="top" colspan="2">
2958	<i><?php echo __('Please choose from the following Two Factor Authentication methods. Each user can choose any one method from the ones enabled by you. You can enable all or anyone that you would like.', 'loginizer'); ?></i>
2959	</td>
2960	</tr>
2961	<tr>
2962	<td scope="row" valign="top" style="width:70% !important">
2963	<label><?php echo __('OTP via App', 'loginizer'); ?></label><br>
2964	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be obtained from the users mobile app e.g. <b>Google Authenticator, Authy, etc.</b>', 'loginizer'); ?></span>
2965	</td>
2966	<td>
2967	<input type="checkbox" value="1" name="2fa_app" <?php echo lz_POSTchecked('2fa_app', (empty($loginizer['2fa_app']) ? false : true)); ?> />
2968	</td>
2969	</tr>
2970	<tr>
2971	<td scope="row" valign="top">
2972	<label><?php echo __('OTP via Email', 'loginizer'); ?></label><br>
2973	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be emailed to the user.', 'loginizer'); ?></span>
2974	</td>
2975	<td>
2976	<input type="checkbox" value="1" name="2fa_email" <?php echo lz_POSTchecked('2fa_email', (empty($loginizer['2fa_email']) ? false : true)); ?> />
2977	</td>
2978	</tr>
2979	<tr>
2980	<td scope="row" valign="top">
2981	<label><?php echo __('User Defined Question & Answer', 'loginizer'); ?></label><br>
2982	<span class="exp"><?php echo __('In this method the user will be asked to set a secret personal question and answer. After entering the correct login credentials, the user will be asked to answer the question set by them, thus increasing the security', 'loginizer'); ?></span>
2983	</td>
2984	<td>
2985	<input type="checkbox" value="1" name="question" <?php echo lz_POSTchecked('question', (empty($loginizer['question']) ? false : true)); ?> />
2986	</td>
2987	</tr>
2988	</table><br />
2989
2990	<table class="form-table">
2991	<tr>
2992	<td scope="row" valign="top" style="width:70% !important">
2993	<label><?php echo __('Force OTP via Email', 'loginizer'); ?></label><br>
2994	<span class="exp"><?php echo __('If the user does not have any 2FA method selected, this will enforce the OTP via Email for the users.', 'loginizer'); ?></span>
2995	</td>
2996	<td>
2997	<input type="checkbox" value="1" name="2fa_email_force" <?php echo lz_POSTchecked('2fa_email_force', (empty($loginizer['2fa_email_force']) ? false : true)); ?> />
2998	</td>
2999	</tr>
3000	<tr>
3001	<td scope="row" valign="top" style="width:70% !important">
3002	<label><?php echo __('Apply 2FA to Roles', 'loginizer'); ?></label><br>
3003	<span class="exp"><?php echo __('Select the Roles to which 2FA should be applied.', 'loginizer'); ?></span>
3004	</td>
3005	<td>
3006	<input type="checkbox" value="1" onchange="lz_roles_handle()" name="2fa_roles_all" id="2fa_roles_all" <?php echo lz_POSTchecked('2fa_roles_all', (empty($loginizer['2fa_roles']) ? true : false)); ?> /> All<br />
3007	<?php
3008
3009	foreach($lz_roles as $k => $v){
3010	echo '<span class="lz_roles"><input type="checkbox" value="1" name="2fa_roles_'.$k.'" '.lz_POSTchecked('2fa_roles_'.$k, (empty($loginizer['2fa_roles'][$k]) ? false : true)).' /> '.$v['name'].'<br /></span>';
3011	}
3012
3013	?>
3014	</td>
3015	</tr>
3016	</table><br />
3017	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3018	</form>
3019
3020	</div>
3021	</div>
3022
3023	<script type="text/javascript">
3024
3025	function lz_roles_handle(){
3026
3027	var obj = jQuery("#2fa_roles_all")[0];
3028
3029	if(obj.checked){
3030	jQuery(".lz_roles").hide();
3031	}else{
3032	jQuery(".lz_roles").show();
3033	}
3034
3035	}
3036
3037	lz_roles_handle();
3038
3039	</script>
3040
3041	<div id="" class="postbox">
3042
3043	<div class="postbox-header">
3044	<h2 class="hndle ui-sortable-handle">
3045	<span><?php echo __('OTP via Email Template', 'loginizer'); ?></span>
3046	</h2>
3047	</div>
3048
3049	<div class="inside">
3050
3051	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3052	<?php wp_nonce_field('loginizer-options'); ?>
3053	<table class="form-table">
3054	<tr>
3055	<td colspan="2" valign="top">
3056	<?php echo __('Customize the email template to be used when sending the OTP to login via Email for 2FA.', 'loginizer'); ?><br>
3057	<?php echo __('If you do not make changes below the default email template will be used !', 'loginizer'); ?>
3058	</td>
3059	</tr>
3060	<tr>
3061	<td scope="row" valign="top" style="width:350px !important">
3062	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3063	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3064	<br />Default : <?php echo @$loginizer['2fa_email_d_sub']; ?>
3065	</td>
3066	<td valign="top">
3067	<input type="text" size="40" value="<?php echo lz_optpost('lz_2fa_email_sub', @$lz_options['2fa_email_sub']); ?>" name="lz_2fa_email_sub" />
3068	</td>
3069	</tr>
3070	<tr>
3071	<td scope="row" valign="top">
3072	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3073	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3074	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['2fa_email_d_msg']; ?></pre>
3075	</td>
3076	<td valign="top">
3077	<textarea rows="10" name="lz_2fa_email_msg"><?php echo lz_optpost('lz_2fa_email_msg', @$lz_options['2fa_email_msg']); ?></textarea>
3078	<br />
3079	Variables :
3080	<br />$otp - The OTP for login
3081	<br />$email - Users Email
3082	<br />$site_name - The Site Name
3083	<br />$site_url - The Site URL
3084	</td>
3085	</tr>
3086	</table><br />
3087	<center><input name="save_2fa_email_template_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3088	</form>
3089
3090	</div>
3091	</div>
3092
3093	<div id="" class="postbox">
3094
3095	<div class="postbox-header">
3096	<h2 class="hndle ui-sortable-handle">
3097	<span><?php echo __('Custom Messages for OTP', 'loginizer'); ?></span>
3098	</h2>
3099	</div>
3100
3101	<div class="inside">
3102
3103	<form action="" method="post" enctype="multipart/form-data">
3104	<?php wp_nonce_field('loginizer-options'); ?>
3105	<table class="form-table">
3106	<tr>
3107	<td colspan="2" valign="top">
3108	<?php echo __('Customize the title for OTP field displayed to the user on the login form.', 'loginizer'); ?><br>
3109	<?php echo __('If you do not make changes below the default messages will be used !', 'loginizer'); ?>
3110	</td>
3111	</tr>
3112	<tr>
3113	<td scope="row" valign="top" style="width:350px !important">
3114	<label for="msg_otp_app"><?php echo __('OTP via APP','loginizer'); ?></label><br />
3115	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_app']. '"</em>', 'loginizer'); ?>
3116	</td>
3117	<td>
3118	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_app']); ?>" name="msg_otp_app" id="msg_otp_app" style="width:auto !important;" />
3119	<br />
3120	</td>
3121	</tr>
3122	<tr>
3123	<td scope="row" valign="top" style="width:350px !important">
3124	<label for="msg_otp_email"><?php echo __('OTP via Email','loginizer'); ?></label><br />
3125	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_email']. '"</em>', 'loginizer'); ?>
3126	</td>
3127	<td>
3128	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_email']); ?>" name="msg_otp_email" id="msg_otp_email" style="width:auto !important;" />
3129	<br />
3130	</td>
3131	</tr>
3132	<tr>
3133	<td scope="row" valign="top" style="width:350px !important">
3134	<label for="msg_otp_field"><?php echo __('Title for OTP field','loginizer'); ?></label><br />
3135	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_field']. '"</em>', 'loginizer'); ?>
3136	</td>
3137	<td>
3138	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_field']); ?>" name="msg_otp_field" id="msg_otp_field" style="width:auto !important;" />
3139	<br />
3140	</td>
3141	</tr>
3142	<tr>
3143	<td scope="row" valign="top" style="width:350px !important">
3144	<label for="msg_otp_question"><?php echo __('Title for Security Question','loginizer'); ?></label><br />
3145	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_question']. '"</em>', 'loginizer'); ?>
3146	</td>
3147	<td>
3148	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_question']); ?>" name="msg_otp_question" id="msg_otp_question" style="width:auto !important;" />
3149	<br />
3150	</td>
3151	</tr>
3152	<tr>
3153	<td scope="row" valign="top" style="width:350px !important">
3154	<label for="msg_otp_answer"><?php echo __('Title for Security Answer','loginizer'); ?></label><br />
3155	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_answer']. '"</em>', 'loginizer'); ?>
3156	</td>
3157	<td>
3158	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_answer']); ?>" name="msg_otp_answer" id="msg_otp_answer" style="width:auto !important;" />
3159	<br />
3160	</td>
3161	</tr>
3162	</table><br />
3163	<center><input name="save_msgs_lz" class="button button-primary action" value="<?php echo __('Save Messages','loginizer'); ?>" type="submit" /></center>
3164	</form>
3165	</div>
3166	</div>
3167
3168	<!--Bypass a single user-->
3169	<div id="" class="postbox">
3170
3171	<div class="postbox-header">
3172	<h2 class="hndle ui-sortable-handle">
3173	<span><?php echo __('Disable Two Factor Authentication for a User', 'loginizer'); ?></span>
3174	</h2>
3175	</div>
3176
3177	<div class="inside">
3178
3179	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3180	<?php wp_nonce_field('loginizer-options'); ?>
3181	<table class="form-table">
3182	<tr>
3183	<td scope="row" valign="top" colspan="2">
3184	<i><?php echo __('Here you can disable the Two Factor Authentication settings of a user. In the event a user has forgotten his secret answer or lost his Device App, he will not be able to login. You can reset such a users settings from here.', 'loginizer'); ?></i>
3185	</td>
3186	</tr>
3187	<tr>
3188	<td scope="row" valign="top">
3189	<label><?php echo __('Username / Email', 'loginizer'); ?></label><br>
3190	<span class="exp"><?php echo __('The username or email of the user whose 2FA you would like to disable', 'loginizer'); ?></span>
3191	</td>
3192	<td>
3193	<input type="text" size="50" value="<?php echo lz_optpost('lz_user_2fa_disable', ''); ?>" name="lz_user_2fa_disable" />
3194	</td>
3195	</tr>
3196	</table><br />
3197
3198	<center><input name="reset_user_lz" class="button button-primary action" value="<?php echo __('Reset 2FA for User', 'loginizer'); ?>" type="submit" /></center>
3199	</form>
3200
3201	</div>
3202	</div>
3203
3204	<br />
3205
3206	<?php
3207	loginizer_page_footer();
3208
3209	}
3210
3211	// Loginizer - PasswordLess Page
3212	function loginizer_page_passwordless(){
3213
3214	global $loginizer, $lz_error, $lz_env;
3215
3216	if(!current_user_can('manage_options')){
3217	wp_die('Sorry, but you do not have permissions to change settings.');
3218	}
3219
3220	if(!loginizer_is_premium() && count($_POST) > 0){
3221	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3222	return loginizer_page_passwordless_T();
3223	}
3224
3225	/* Make sure post was from this page */
3226	if(count($_POST) > 0){
3227	check_admin_referer('loginizer-options');
3228	}
3229
3230	if(isset($_POST['save_lz'])){
3231
3232	// In the future there can be more settings
3233	$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
3234	$option['passwordless_sub'] = lz_optpost('lz_passwordless_sub');
3235	$option['passwordless_msg'] = lz_optpost('lz_passwordless_msg');
3236
3237	// Is there an error ?
3238	if(!empty($lz_error)){
3239	return loginizer_page_passwordless_T();
3240	}
3241
3242	// Save the options
3243	update_option('loginizer_epl', $option);
3244
3245	// Mark as saved
3246	$GLOBALS['lz_saved'] = true;
3247
3248	}
3249
3250	// Call theme
3251	loginizer_page_passwordless_T();
3252	}
3253
3254	// Loginizer - PasswordLess Page Theme
3255	function loginizer_page_passwordless_T(){
3256
3257	global $loginizer, $lz_error, $lz_env;
3258
3259	$lz_options = get_option('loginizer_epl');
3260
3261	// Universal header
3262	loginizer_page_header('PasswordLess Settings');
3263
3264	loginizer_feature_available('PasswordLess Login');
3265
3266	// Saved ?
3267	if(!empty($GLOBALS['lz_saved'])){
3268	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3269	}
3270
3271	// Any errors ?
3272	if(!empty($lz_error)){
3273	lz_report_error($lz_error);echo '<br />';
3274	}
3275
3276	?>
3277
3278	<style>
3279	input[type="text"], textarea, select {
3280	width: 90%;
3281	}
3282
3283	.form-table label{
3284	font-weight:bold;
3285	}
3286
3287	.form-table td{
3288	vertical-align:top;
3289	}
3290
3291	.exp{
3292	font-size:12px;
3293	}
3294	</style>
3295
3296	<div id="" class="postbox">
3297
3298	<div class="postbox-header">
3299	<h2 class="hndle ui-sortable-handle">
3300	<span><?php echo __('PasswordLess Settings', 'loginizer'); ?></span>
3301	</h2>
3302	</div>
3303
3304	<div class="inside">
3305
3306	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3307	<?php wp_nonce_field('loginizer-options'); ?>
3308	<table class="form-table">
3309	<tr>
3310	<th scope="row" valign="top" style="width:350px !important"><label><?php echo __('Enable PasswordLess Login', 'loginizer'); ?></label></th>
3311	<td>
3312	<input type="checkbox" value="1" name="email_pass_less" <?php echo lz_POSTchecked('email_pass_less', (empty($loginizer['email_pass_less']) ? false : true)); echo (defined('SITEPAD') ? 'disabled="disabled"' : '') ?> />
3313	</td>
3314	</tr>
3315	<tr>
3316	<td colspan="2" valign="top">
3317	<?php echo __('If enabled, the login screen will just ask for the username <b>OR</b> email address of the user. If such a user exists, an email with a <b>One Time Login </b> link will be sent to the email address of the user. The link will be valid for 10 minutes only.', 'loginizer'); ?><br><br>
3318	<?php echo __('If a wrong username/email is given, the brute force checker will prevent any brute force attempt !', 'loginizer'); ?>
3319	</td>
3320	</tr>
3321	<tr>
3322	<td scope="row" valign="top">
3323	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3324	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3325	<br />Default : <?php echo @$loginizer['pl_d_sub']; ?>
3326	</td>
3327	<td valign="top">
3328	<input type="text" size="40" value="<?php echo lz_optpost('lz_passwordless_sub', @$lz_options['passwordless_sub']); ?>" name="lz_passwordless_sub" />
3329	</td>
3330	</tr>
3331	<tr>
3332	<td scope="row" valign="top">
3333	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3334	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3335	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['pl_d_msg']; ?></pre>
3336	</td>
3337	<td valign="top">
3338	<textarea rows="10" name="lz_passwordless_msg"><?php echo lz_optpost('lz_passwordless_msg', @$lz_options['passwordless_msg']); ?></textarea>
3339	<br />
3340	Variables :
3341	<br />$email - Users Email
3342	<br />$site_name - The Site Name
3343	<br />$site_url - The Site URL
3344	<br />$login_url - The Login URL
3345	</td>
3346	</tr>
3347	</table><br />
3348	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3349	</form>
3350
3351	</div>
3352	</div>
3353	<br />
3354
3355	<?php
3356	loginizer_page_footer();
3357
3358	}
3359
3360	// Loginizer - Security Settings Page
3361	function loginizer_page_security(){
3362
3363	global $loginizer, $lz_error, $lz_env, $wpdb;
3364
3365	if(!current_user_can('manage_options')){
3366	wp_die('Sorry, but you do not have permissions to change settings.');
3367	}
3368
3369	if(!loginizer_is_premium() && count($_POST) > 0){
3370	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3371	return loginizer_page_security_T();
3372	}
3373
3374	/* Make sure post was from this page */
3375	if(count($_POST) > 0){
3376	check_admin_referer('loginizer-options');
3377	}
3378
3379	if(isset($_POST['save_lz'])){
3380
3381	$option['login_slug'] = lz_optpost('login_slug');
3382	$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
3383	$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
3384	$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
3385	$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
3386
3387	// Login Slug Valid ?
3388	if(!empty($option['login_slug'])){
3389	if(strlen($option['login_slug']) <= 4 \|\| strlen($option['login_slug']) > 50){
3390	$lz_error['login_slug'] = __('The Login slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
3391	}
3392	}
3393
3394	// XML-RPC Slug Valid ?
3395	if(!empty($option['xmlrpc_slug'])){
3396	if(strlen($option['xmlrpc_slug']) <= 4 \|\| strlen($option['xmlrpc_slug']) > 50){
3397	$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
3398	}
3399	}
3400
3401	// Is there an error ?
3402	if(!empty($lz_error)){
3403	return loginizer_page_security_T();
3404	}
3405
3406	// Save the options
3407	update_option('loginizer_security', $option);
3408
3409	// Mark as saved
3410	$GLOBALS['lz_saved'] = true;
3411
3412	}
3413
3414	// Reset the username
3415	if(isset($_POST['save_lz_admin'])){
3416
3417	// Get the new username
3418	$current_username = lz_optpost('current_username');
3419	$new_username = lz_optpost('new_username');
3420
3421	if(empty($current_username)){
3422	$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
3423	return loginizer_page_security_T();
3424	}
3425
3426	if(empty($new_username)){
3427	$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
3428	return loginizer_page_security_T();
3429	}
3430
3431	// Is the starting of the username having 'admin' ?
3432	if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
3433	$lz_error['user_exists'] = __('The username begins with <b>admin</b>. Please change it !', 'loginizer');
3434	return loginizer_page_security_T();
3435	}
3436
3437	// Lets check if there is such a user
3438	$found = get_user_by('login', $new_username);
3439
3440	// Found one !
3441	if(!empty($found->ID)){
3442	$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
3443	return loginizer_page_security_T();
3444	}
3445
3446	$old_user = get_user_by('login', $current_username);
3447
3448	if(empty($old_user->ID)){
3449	$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
3450	return loginizer_page_security_T();
3451	}
3452
3453	if(empty($old_user->caps['administrator'])){
3454	$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
3455	return loginizer_page_security_T();
3456	}
3457
3458	// Update the username
3459	$wpdb->query("UPDATE `".$wpdb->prefix."users`
3460	SET user_login = '$new_username'
3461	WHERE `ID` = '".$old_user->ID."'");
3462
3463	// Mark as saved
3464	$GLOBALS['lz_saved'] = true;
3465
3466	}
3467
3468	// Change the wp-admin slug
3469	if(isset($_POST['save_lz_wp_admin'])){
3470
3471	// Get the new username
3472	$option['admin_slug'] = lz_optpost('admin_slug');
3473	$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
3474	$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
3475	$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
3476
3477	// Did you agree to this ?
3478	if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
3479	$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
3480	return loginizer_page_security_T();
3481	}
3482
3483	// Length
3484	if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 \|\| strlen($option['admin_slug']) > 50)){
3485	$lz_error['admin_slug'] = __('The new Admin slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
3486	return loginizer_page_security_T();
3487	}
3488
3489	// Only regular characters
3490	if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
3491	$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
3492	return loginizer_page_security_T();
3493	}
3494
3495	// Update the option
3496	update_option('loginizer_wp_admin', $option);
3497
3498	// Mark as saved
3499	$GLOBALS['lz_saved'] = true;
3500
3501	}
3502
3503
3504	// Save blacklisted usernames
3505	if(isset($_POST['save_lz_bl_users'])){
3506
3507	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
3508
3509	// Process the usernames i.e. remove blanks
3510	foreach($usernames as $k => $v){
3511	$v = trim($v);
3512
3513	// Unset blank values
3514	if(empty($v)){
3515	unset($usernames[$k]);
3516	}
3517
3518	// Disallow these special characters to avoid XSS or any other security vulnerability
3519	if(preg_match('/[\<\>\"\']/', $v)){
3520	unset($usernames[$k]);
3521	}
3522	}
3523
3524	// Update the blacklist
3525	update_option('loginizer_username_blacklist', array_values($usernames));
3526
3527	// Mark as saved
3528	$GLOBALS['lz_saved'] = true;
3529
3530	}
3531
3532
3533	// Save blacklisted domains
3534	if(isset($_POST['save_lz_bl_domains'])){
3535
3536	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
3537
3538	// Process the domains i.e. remove blanks
3539	foreach($domains as $k => $v){
3540	$v = trim($v);
3541
3542	// Unset blank values
3543	if(empty($v)){
3544	unset($domains[$k]);
3545	}
3546
3547	// Disallow these special characters to avoid XSS or any other security vulnerability
3548	if(preg_match('/[\<\>\"\']/', $v)){
3549	unset($domains[$k]);
3550	}
3551	}
3552
3553	// Update the blacklist
3554	update_option('loginizer_domains_blacklist', array_values($domains));
3555
3556	// Mark as saved
3557	$GLOBALS['lz_saved'] = true;
3558
3559	}
3560
3561	// Call theme
3562	loginizer_page_security_T();
3563
3564	}
3565
3566	// Loginizer - Security Settings Page Theme
3567	function loginizer_page_security_T(){
3568
3569	global $loginizer, $lz_error, $lz_env;
3570
3571	// Universal header
3572	loginizer_page_header('Security Settings');
3573
3574	loginizer_feature_available('Security Settings');
3575
3576	// Saved ?
3577	if(!empty($GLOBALS['lz_saved'])){
3578	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3579	}
3580
3581	// Any errors ?
3582	if(!empty($lz_error)){
3583	lz_report_error($lz_error);echo '<br />';
3584	}
3585
3586	$current_admin = get_user_by('id', 1);
3587
3588	?>
3589
3590	<style>
3591	input[type="text"], textarea, select {
3592	width: 70%;
3593	}
3594
3595	.form-table label{
3596	font-weight:bold;
3597	}
3598
3599	.exp{
3600	font-size:12px;
3601	}
3602	</style>
3603
3604	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3605
3606	<div id="" class="postbox">
3607
3608	<div class="postbox-header">
3609	<h2 class="hndle ui-sortable-handle">
3610	<span><?php echo __('Rename Login Page', 'loginizer'); ?></span>
3611	</h2>
3612	</div>
3613
3614	<div class="inside">
3615
3616	<?php wp_nonce_field('loginizer-options'); ?>
3617	<table class="form-table">
3618	<tr>
3619	<td scope="row" valign="top" colspan="2">
3620	<i>You can rename your Login page from <b><?php echo $loginizer['login_basename']; ?></b> to anything of your choice e.g. mylogin. This would make it very difficult for automated attack bots to know where to login !</i>
3621	</td>
3622	</tr>
3623	<tr>
3624	<td scope="row" valign="top" style="width:40% !important">
3625	<label><?php echo __('New Login Slug', 'loginizer'); ?></label><br>
3626	<span class="exp"><?php echo __('Set blank to reset to the original login URL', 'loginizer'); ?></span>
3627	</td>
3628	<td>
3629	<input type="text" size="50" value="<?php echo lz_POSTval('login_slug', $loginizer['login_slug']); ?>" name="login_slug" />
3630	</td>
3631	</tr>
3632
3633	<?php
3634
3635	if(!defined('SITEPAD')){
3636
3637	?>
3638	<tr>
3639	<td scope="row" valign="top" style="width:200px !important">
3640	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
3641	<span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
3642	</td>
3643	<td>
3644	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
3645	</td>
3646	</tr>
3647
3648	<?php
3649
3650	}
3651
3652	?>
3653	</table><br />
3654	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3655
3656	</div>
3657	</div>
3658	<br />
3659
3660	<?php
3661
3662	if(!defined('SITEPAD')){
3663
3664	?>
3665
3666	<div id="" class="postbox">
3667
3668	<div class="postbox-header">
3669	<h2 class="hndle ui-sortable-handle">
3670	<span><?php echo __('XML-RPC Settings', 'loginizer'); ?></span>
3671	</h2>
3672	</div>
3673
3674	<div class="inside">
3675
3676	<?php wp_nonce_field('loginizer-options'); ?>
3677	<table class="form-table">
3678	<tr>
3679	<td scope="row" valign="top" colspan="2">
3680	<i><?php echo __('WordPress\'s XML-RPC feature allows external services to access and modify content on the site. Services like the Jetpack plugin, the WordPress mobile app, pingbacks, etc make use of the XML-RPC feature. If this site does not use a service that requires XML-RPC, please <b>disable</b> the XML-RPC feature as it prevents attackers from using the feature to attack the site. If your service can use a custom XML-RPC URL, you can also <b>rename</b> the XML-RPC page to a <b>custom slug</b>.', 'loginizer'); ?></i>
3681	</td>
3682	</tr>
3683	<tr>
3684	<td scope="row" valign="top" style="width:40% !important">
3685	<label><?php echo __('Disable XML-RPC', 'loginizer'); ?></label>
3686	</td>
3687	<td>
3688	<input type="checkbox" value="1" name="xmlrpc_disable" <?php echo lz_POSTchecked('xmlrpc_disable', (empty($loginizer['xmlrpc_disable']) ? false : true)); ?> />
3689	</td>
3690	</tr>
3691	<tr>
3692	<td scope="row" valign="top" style="width:40% !important">
3693	<label><?php echo __('Disable Pingbacks', 'loginizer'); ?></label>
3694	</td>
3695	<td>
3696	<input type="checkbox" value="1" name="pingbacks_disable" <?php echo lz_POSTchecked('pingbacks_disable', (empty($loginizer['pingbacks_disable']) ? false : true)); ?> />
3697	</td>
3698	</tr>
3699	<tr>
3700	<td scope="row" valign="top">
3701	<label><?php echo __('New XML-RPC Slug', 'loginizer'); ?></label><br>
3702	<span class="exp"><?php echo __('Set blank to reset to the original XML-RPC URL', 'loginizer'); ?></span>
3703	</td>
3704	<td>
3705	<input type="text" size="50" value="<?php echo lz_optpost('xmlrpc_slug', $loginizer['xmlrpc_slug']); ?>" name="xmlrpc_slug" />
3706	</td>
3707	</tr>
3708	</table><br />
3709	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3710
3711	</div>
3712	</div>
3713	<br />
3714
3715	<?php
3716
3717	}
3718
3719	?>
3720
3721	</form>
3722
3723	<?php
3724
3725	if(!defined('SITEPAD')){
3726
3727	?>
3728
3729	<script type="text/javascript">
3730
3731
3732	function dirname(path) {
3733	return path.replace(/\\/g, '/').replace(/\/[^/]*\/?$/, '');
3734	}
3735
3736	function lz_test_wp_admin(){
3737
3738	var data = new Object();
3739	data["action"] = "loginizer_wp_admin";
3740	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax');?>";
3741
3742	var new_ajaxurl = dirname(dirname(ajaxurl))+'/'+jQuery('#lz_admin_slug').val()+'/admin-ajax.php';
3743
3744	// AJAX and on success function
3745	jQuery.post(new_ajaxurl, data, function(response){
3746
3747	if(response['result'] == 1){
3748	alert("<?php echo __('Everything seems to be good. You can proceed to save the settings !', 'loginizer'); ?>");
3749	}
3750
3751	// Throw an error for failures
3752	}).fail(function() {
3753	alert("<?php echo __('There was an error connecting to WordPress with the new Admin Slug. Did you configure everything properly ?', 'loginizer'); ?>");
3754	});
3755	//jQuery.ajax('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
3756	return false;
3757	};
3758
3759	</script>
3760
3761	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3762	<div id="" class="postbox">
3763
3764	<div class="postbox-header">
3765	<h2 class="hndle ui-sortable-handle">
3766	<span><?php echo __('Rename wp-admin access', 'loginizer'); ?></span>
3767	</h2>
3768	</div>
3769
3770	<div class="inside">
3771
3772	<?php wp_nonce_field('loginizer-options'); ?>
3773	<table class="form-table">
3774	<?php
3775	if(preg_match('/(apache\|litespeed\|lsws)/is', $_SERVER["SERVER_SOFTWARE"])){
3776	// Supported. Do nothing
3777	}else{
3778	echo '<tr>
3779	<td scope="row" valign="top" colspan="2">
3780	<div style="color:#a94442; background-color:#f2dede; border-color:#ebccd1; padding:15px; border:1px solid transparent; border-radius:4px;">'.__('Rename wp-admin access feature is supported only on Apache and Litespeed', 'loginizer').'</div>
3781	</td>
3782	</tr>';
3783	}
3784	?>
3785	<tr>
3786	<td scope="row" valign="top" colspan="2">
3787	<i>You can rename your WordPress Admin access URL <b>wp-admin</b> to anything of your choice e.g. my-admin. This will require you to change .htaccess, so please follow <a href="<?php echo LOGINIZER_DOCS;?>Renaming_the_WP-Admin_Area" target="_blank">our guide</a> on how to do so !</i>
3788	</td>
3789	</tr>
3790	<tr>
3791	<td scope="row" valign="top" style="width:40% !important">
3792	<label><?php echo __('New wp-admin Slug', 'loginizer'); ?></label><br>
3793	<span class="exp"><?php echo __('Set blank to reset to the original wp-admin URL', 'loginizer'); ?></span>
3794	</td>
3795	<td>
3796	<input type="text" size="50" value="<?php echo lz_optpost('admin_slug', $loginizer['admin_slug']); ?>" name="admin_slug" id="lz_admin_slug" />
3797	</td>
3798	</tr>
3799	<tr>
3800	<td scope="row" valign="top" style="width:200px !important">
3801	<label><?php echo __('Disable wp-admin access', 'loginizer'); ?></label><br>
3802	<span class="exp"><?php echo __('If set, then only the new admin slug will work and access to the Old Admin Slug i.e. wp-admin will be disabled. If anyone accesses wp-admin, a warning will be shown.<br><label>NOTE: Please use this option cautiously !</label>', 'loginizer'); ?></span>
3803	</td>
3804	<td>
3805	<input type="checkbox" id="lz_restrict_wp_admin" onchange="lz_wp_admin_msg_toggle()" value="1" name="restrict_wp_admin" <?php echo lz_POSTchecked('restrict_wp_admin', (empty($loginizer['restrict_wp_admin']) ? false : true)); ?> />
3806	</td>
3807	</tr>
3808	<tr id="lz_wp_admin_msg_row" style="display:none">
3809	<td scope="row" valign="top">
3810	<label><?php echo __('WP-Admin Error Message', 'loginizer'); ?></label><br>
3811	<span class="exp"><?php echo __('Error message to show if someone accesses wp-admin', 'loginizer'); ?></span> Default : <?php echo $loginizer['wp_admin_d_msg']; ?>
3812	</td>
3813	<td>
3814	<input type="text" size="50" value="<?php echo lz_htmlizer(!empty($_POST['wp_admin_msg']) ? stripslashes($_POST['wp_admin_msg']) : @$loginizer['wp_admin_msg']); ?>" name="wp_admin_msg" id="lz_wp_admin_msg" />
3815	</td>
3816	</tr>
3817	<tr>
3818	<td scope="row" valign="top" style="width:200px !important">
3819	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
3820	<span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
3821	</td>
3822	<td>
3823	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
3824	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
3825	</td>
3826	</tr>
3827	</table><br />
3828	<center><input name="save_lz_wp_admin" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3829
3830	</div>
3831	</div>
3832	<br />
3833	</form>
3834
3835	<script type="text/javascript">
3836
3837	function lz_wp_admin_msg_toggle(){
3838	var ele = jQuery('#lz_restrict_wp_admin')[0];
3839	if(ele.checked){
3840	jQuery('#lz_wp_admin_msg_row').show();
3841	}else{
3842	jQuery('#lz_wp_admin_msg_row').hide();
3843	}
3844	};
3845
3846	lz_wp_admin_msg_toggle();
3847
3848	</script>
3849
3850
3851	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3852	<div id="" class="postbox">
3853
3854	<div class="postbox-header">
3855	<h2 class="hndle ui-sortable-handle">
3856	<span><?php echo __('Change Admin Username', 'loginizer'); ?></span>
3857	</h2>
3858	</div>
3859
3860	<div class="inside">
3861
3862	<?php wp_nonce_field('loginizer-options'); ?>
3863	<table class="form-table">
3864	<tr>
3865	<td scope="row" valign="top" colspan="2">
3866	<i><?php echo __('You can change the Admin Username from here to anything of your choice e.g. iamtheboss. This would make it very difficult for automated attack bots to know what is the admin username !', 'loginizer'); ?></i>
3867	</td>
3868	</tr>
3869	<tr>
3870	<td scope="row" valign="top" style="width:40% !important">
3871	<label for="current_username"><?php echo __('Current Username', 'loginizer'); ?></label><br>
3872	<span class="exp"><?php echo __('The current username you want to change', 'loginizer'); ?></span>
3873	</td>
3874	<td>
3875	<input type="text" size="50" value="<?php echo lz_optpost('current_username', (!empty($current_admin->user_login) ? $current_admin->user_login : '')); ?>" name="current_username" id="current_username" />
3876	</td>
3877	</tr>
3878	<tr>
3879	<td scope="row" valign="top" style="width:40% !important">
3880	<label for="new_username"><?php echo __('New Username', 'loginizer'); ?></label><br>
3881	<span class="exp"><?php echo __('The new username you want to set', 'loginizer'); ?></span>
3882	</td>
3883	<td>
3884	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
3885	</td>
3886	</tr>
3887	</table><br />
3888	<i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
3889	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
3890
3891	</div>
3892	</div>
3893	</form>
3894
3895	<script type="text/javascript">
3896	function add_lz_bl_users(){
3897	jQuery("#lz_bl_users").append('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
3898	return false;
3899	};
3900	</script>
3901
3902	<style>
3903	.lz_bl_users, .lz_bl_domains{
3904	margin-bottom:20px;
3905	}
3906	</style>
3907
3908	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3909	<div id="" class="postbox">
3910
3911	<div class="postbox-header">
3912	<h2 class="hndle ui-sortable-handle">
3913	<span><?php echo __('Username Auto Blacklist', 'loginizer'); ?></span>
3914	</h2>
3915	</div>
3916
3917	<div class="inside">
3918
3919	<?php wp_nonce_field('loginizer-options'); ?>
3920	<table class="form-table">
3921	<tr>
3922	<td scope="row" valign="top" colspan="2">
3923	<i><?php echo __('Attackers generally use common usernames like <b>admin, administrator, or variations of your domain name / business name</b>. You can specify such username here and Loginizer will auto-blacklist the IP Address(s) of clients who try to use such username(s).', 'loginizer'); ?></i>
3924	</td>
3925	</tr>
3926	<tr>
3927	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
3928	<label><?php echo __('Username(s)', 'loginizer'); ?></label><br>
3929	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
3930	</td>
3931	<td>
3932	<div id="lz_bl_users">
3933	<?php
3934
3935	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : $loginizer['username_blacklist'];
3936
3937	if(empty($usernames)){
3938	$usernames[] = '';
3939	}
3940
3941	foreach($usernames as $_user){
3942	echo '<input type="text" size="30" value="'.$_user.'" name="lz_bl_users[]" class="lz_bl_users" />';
3943	}
3944
3945	?>
3946	</div>
3947	<br />
3948	<input class="button" type="button" value="<?php echo __('Add New Username', 'loginizer'); ?>" onclick="return add_lz_bl_users();" style="float:right" />
3949	</td>
3950	</tr>
3951	</table><br />
3952	<center><input name="save_lz_bl_users" class="button button-primary action" value="<?php echo __('Save Username(s)', 'loginizer'); ?>" type="submit" /></center>
3953
3954	</div>
3955	</div>
3956	</form>
3957
3958	<script type="text/javascript">
3959	function add_lz_bl_domains(){
3960	jQuery("#lz_bl_domains").append('<input type="text" size="30" value="" name="lz_bl_domains[]" class="lz_bl_domains" />');
3961	return false;
3962	};
3963	</script>
3964
3965
3966	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3967	<div id="" class="postbox">
3968
3969	<div class="postbox-header">
3970	<h2 class="hndle ui-sortable-handle">
3971	<span><?php echo __('New Registration Domain Blacklist', 'loginizer'); ?></span>
3972	</h2>
3973	</div>
3974
3975	<div class="inside">
3976
3977	<?php wp_nonce_field('loginizer-options'); ?>
3978	<table class="form-table">
3979	<tr>
3980	<td scope="row" valign="top" colspan="2">
3981	<i>If you would like to ban new registrations from a particular domain, you can use this utility to do so.</i>
3982	</td>
3983	</tr>
3984	<tr>
3985	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
3986	<label><?php echo __('Domain(s)', 'loginizer'); ?></label><br>
3987	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
3988	</td>
3989	<td>
3990	<div id="lz_bl_domains">
3991	<?php
3992
3993	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : $loginizer['domains_blacklist'];
3994
3995	if(empty($domains)){
3996	$domains[] = '';
3997	}
3998
3999	foreach($domains as $_domain){
4000	echo '<input type="text" size="30" value="'.$_domain.'" name="lz_bl_domains[]" class="lz_bl_domains" />';
4001	}
4002
4003	?>
4004	</div>
4005	<br />
4006	<input class="button" type="button" value="<?php echo __('Add New Domain', 'loginizer'); ?>" onclick="return add_lz_bl_domains();" style="float:right" />
4007	</td>
4008	</tr>
4009	</table><br />
4010	<center><input name="save_lz_bl_domains" class="button button-primary action" value="<?php echo __('Save Domains(s)', 'loginizer'); ?>" type="submit" /></center>
4011
4012	</div>
4013	</div>
4014	</form>
4015
4016	<?php
4017
4018	}
4019
4020	loginizer_page_footer();
4021
4022	}
4023
4024	// Loginizer - Checksum load data
4025	function loginizer_page_checksums_L(&$files, &$_ignores){
4026
4027	global $loginizer, $lz_error, $lz_env;
4028
4029	// Load any mismatched files and ignores
4030	$files = get_option('loginizer_checksums_diff');
4031	$_ignores = get_option('loginizer_checksums_ignore');
4032	$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
4033	$ignores = array();
4034
4035	foreach($_ignores as $ik => $iv){
4036	$ignores[$iv] = array();
4037	if(!empty($files[$iv])){
4038	$ignores[$iv] = $files[$iv];
4039	}
4040	}
4041
4042	$lz_env['files'] = $files;
4043	$lz_env['ignores'] = $ignores;
4044
4045	}
4046
4047	// Loginizer - PasswordLess Page
4048	function loginizer_page_checksums(){
4049
4050	global $loginizer, $lz_error, $lz_env;
4051
4052	if(!current_user_can('manage_options')){
4053	wp_die('Sorry, but you do not have permissions to change settings.');
4054	}
4055
4056	if(!loginizer_is_premium() && count($_POST) > 0){
4057	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4058	return loginizer_page_checksums_T();
4059	}
4060
4061	/* Make sure post was from this page */
4062	if(count($_POST) > 0){
4063	check_admin_referer('loginizer-options');
4064	}
4065
4066	// Are we to run it ?
4067	if(isset($_REQUEST['lz_run_checksum'])){
4068	loginizer_checksums();
4069	}
4070
4071	loginizer_page_checksums_L($files, $_ignores);
4072
4073	$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
4074	$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
4075	$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
4076
4077	if(isset($_POST['save_lz'])){
4078
4079	// In the future there can be more settings
4080	$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
4081	$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
4082	$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
4083	$option['checksum_time'] = lz_optpost('checksum_time');
4084
4085	// Is there an error ?
4086	if(!empty($lz_error)){
4087	return loginizer_page_checksums_T();
4088	}
4089
4090	// Save the options
4091	update_option('loginizer_checksums', $option);
4092
4093	// Mark as saved
4094	$GLOBALS['lz_saved'] = true;
4095
4096	}
4097
4098	// Add or remove from ignore list
4099	if(isset($_POST['save_lz_csum_ig'])){
4100
4101	if(@is_array($_POST['checksum_del_ignore'])){
4102
4103	foreach($_POST['checksum_del_ignore'] as $k => $v){
4104	$key = array_search($v, $_ignores);
4105	if($key !== false){
4106	unset($_ignores[$key]);
4107	}
4108	}
4109
4110	// Save it
4111	update_option('loginizer_checksums_ignore', $_ignores);
4112
4113	}
4114
4115	if(@is_array($_POST['checksum_add_ignore'])){
4116
4117	foreach($_POST['checksum_add_ignore'] as $k => $v){
4118	if(!empty($files[$v])){
4119	$_ignores[] = $v;
4120	}
4121	}
4122
4123	// Save it
4124	update_option('loginizer_checksums_ignore', $_ignores);
4125
4126	}
4127
4128	// Reload
4129	loginizer_page_checksums_L($files, $_ignores);
4130
4131	// Mark as saved
4132	$GLOBALS['lz_saved'] = true;
4133
4134	}
4135
4136	// Call theme
4137	loginizer_page_checksums_T();
4138	}
4139
4140	// Loginizer - PasswordLess Page Theme
4141	function loginizer_page_checksums_T(){
4142
4143	global $loginizer, $lz_error, $lz_env;
4144
4145	// Universal header
4146	loginizer_page_header('File Checksum Settings');
4147
4148	loginizer_feature_available('File Checksum');
4149
4150	wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
4151	wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
4152
4153	// Saved ?
4154	if(!empty($GLOBALS['lz_saved'])){
4155	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4156	}
4157
4158	// Did we just run the checksums
4159	if(isset($_REQUEST['lz_run_checksum'])){
4160	echo '<div id="message" class="updated"><p>'. __('The Checksum process was executed successfully', 'loginizer'). '</p></div><br />';
4161	}
4162
4163	// Any errors ?
4164	if(!empty($lz_error)){
4165	lz_report_error($lz_error);echo '<br />';
4166	}
4167
4168	?>
4169
4170	<style>
4171	input[type="text"], textarea, select {
4172	width: 70%;
4173	}
4174
4175	.form-table label{
4176	font-weight:bold;
4177	}
4178
4179	.exp{
4180	font-size:12px;
4181	}
4182	</style>
4183
4184	<script>
4185	function lz_apply_status(ele, the_class){
4186
4187	var status = ele.checked;
4188	jQuery(the_class).each(function(){
4189	this.checked = status;
4190	});
4191
4192	}
4193	</script>
4194
4195	<div id="" class="postbox">
4196	<div class="postbox-header">
4197	<h2 class="hndle ui-sortable-handle">
4198	<span><?php echo __('Checksum Settings', 'loginizer'); ?></span>
4199	</h2>
4200	</div>
4201	<div class="inside">
4202
4203	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4204	<?php wp_nonce_field('loginizer-options'); ?>
4205	<table class="form-table">
4206	<tr>
4207	<td scope="row" valign="top" style="width:400px !important">
4208	<label><?php echo __('Disable Checksum of WP Core', 'loginizer'); ?></label><br>
4209	<span class="exp"><?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?></span>
4210	</td>
4211	<td valign="top">
4212	<input type="checkbox" value="1" name="disable_checksum" <?php echo lz_POSTchecked('disable_checksum', (empty($loginizer['disable_checksum']) ? false : true)); ?> />
4213	</td>
4214	</tr>
4215	<tr>
4216	<td scope="row" valign="top" style="width:400px !important">
4217	<label><?php echo __('Disable Email of Checksum Results', 'loginizer'); ?></label><br>
4218	<span class="exp"><?php echo __('If checked, Loginizer will not email you the checksum results.', 'loginizer'); ?></span>
4219	</td>
4220	<td valign="top">
4221	<input type="checkbox" value="1" name="no_checksum_email" <?php echo lz_POSTchecked('no_checksum_email', (empty($loginizer['no_checksum_email']) ? false : true)); ?> />
4222	</td>
4223	</tr>
4224	<tr>
4225	<td scope="row" valign="top" style="width:400px !important">
4226	<label><?php echo __('Checksum Frequency', 'loginizer'); ?></label><br>
4227	<span class="exp"><?php echo __('If Checksum is enabled, at what frequency should the checksums be performed.', 'loginizer'); ?></span>
4228	</td>
4229	<td valign="top">
4230	<select name="checksum_frequency">
4231	<?php
4232	foreach($lz_env['csum_freq'] as $k => $v){
4233	echo '<option '.lz_POSTselect('checksum_frequency', $k, ($loginizer['checksum_frequency'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
4234	}
4235	?>
4236	</select>
4237	</td>
4238	</tr>
4239	<tr id="lz_checksum_time">
4240	<td scope="row" valign="top" style="width:400px !important">
4241	<label><?php echo __('Time of Day', 'loginizer'); ?></label><br>
4242	<span class="exp"><?php echo __('If Checksum is enabled, what time of day should Loginizer do the check. Note : The check will be done on or after this time has elapsed as per the accesses being made.', 'loginizer'); ?></span>
4243	</td>
4244	<td valign="top">
4245	<div class="input-group clockpicker" data-autoclose="true">
4246	<input type="text" name="checksum_time" class="form-control" value="<?php echo (empty($loginizer['checksum_time']) ? '00:00' : $loginizer['checksum_time']);?>">
4247	<span class="input-group-addon">
4248	<span class="glyphicon glyphicon-time"></span>
4249	</span>
4250	</div>
4251	<script type="text/javascript">
4252	jQuery(document).ready(function(){
4253	(function($) {
4254	$('.clockpicker').clockpicker({donetext: 'Done'});
4255	})(jQuery);
4256	});
4257	</script>
4258	</td>
4259	</tr>
4260	<tr>
4261	<td colspan="2">
4262	<?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?>
4263	</td>
4264	</tr>
4265	</table><br />
4266	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /><input name="lz_run_checksum" style="float:right; background: #5cb85c; color:white; border:#5cb85c" class="button button-secondary" value="<?php echo __('Do a Checksum Now', 'loginizer'); ?>" type="submit" /></center>
4267	</form>
4268
4269	</div>
4270	</div>
4271
4272	<div id="" class="postbox">
4273
4274	<div class="postbox-header">
4275	<h2 class="hndle ui-sortable-handle">
4276	<span><?php echo __('Mismatching Files', 'loginizer'); ?></span>
4277	</h2>
4278	</div>
4279
4280	<div class="inside">
4281
4282	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4283	<?php wp_nonce_field('loginizer-options'); ?>
4284	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
4285	<?php
4286
4287	$files = $lz_env['files'];
4288
4289	// Avoid undefined notice for $files
4290	if(!empty($files)){
4291	foreach($files as $k => $v){
4292	if(!empty($lz_env['ignores'][$k])){
4293	unset($files[$k]);
4294	}
4295	}
4296	}
4297
4298	echo '
4299	<tr>
4300	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
4301	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
4302	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
4303	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_add_ig\');" /></th>
4304	</tr>';
4305
4306	if(is_array($files) && count($files) > 0){
4307
4308	foreach($files as $k => $v){
4309
4310	echo '
4311	<tr>
4312	<td>'.$k.'</td>
4313	<td>'.$v['cur_md5'].'</td>
4314	<td>'.$v['md5'].'</td>
4315	<td><input type="checkbox" name="checksum_add_ignore[]" class="csum_add_ig" value="'.$k.'" /></td>
4316	</tr>';
4317
4318	}
4319
4320	}else{
4321
4322	echo '
4323	<tr>
4324	<td colspan="4" align="center">'.__('This is great ! No file with any wrong checksum has been found.').'</td>
4325	</tr>';
4326
4327	}
4328
4329	?>
4330	</table><br />
4331	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Add Selected to Ignore List', 'loginizer'); ?>" type="submit" /></center>
4332	</form>
4333	</div>
4334
4335	</div>
4336	<br />
4337
4338	<div id="" class="postbox">
4339
4340	<div class="postbox-header">
4341	<h2 class="hndle ui-sortable-handle">
4342	<span><?php echo __('Ignore List', 'loginizer'); ?></span>
4343	</h2>
4344	</div>
4345
4346	<div class="inside">
4347
4348	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4349	<?php wp_nonce_field('loginizer-options'); ?>
4350	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
4351	<?php
4352
4353	$ignores = $lz_env['ignores'];
4354
4355	echo '
4356	<tr>
4357	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
4358	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
4359	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
4360	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_del_ig\');" /></th>
4361	</tr>';
4362
4363	// Load any mismatched files
4364	$files = $ignores;
4365
4366	if(is_array($files) && count($files) > 0){
4367
4368	foreach($files as $k => $v){
4369
4370	echo '
4371	<tr>
4372	<td>'.$k.'</td>
4373	<td>'.$v['cur_md5'].'</td>
4374	<td>'.$v['md5'].'</td>
4375	<td><input type="checkbox" name="checksum_del_ignore[]" class="csum_del_ig" value="'.$k.'" /></td>
4376	</tr>';
4377
4378	}
4379
4380	}else{
4381
4382	echo '
4383	<tr>
4384	<td colspan="4" align="center">'.__('No files have been added to the ignore list').'</td>
4385	</tr>';
4386
4387	}
4388
4389	?>
4390	</table><br />
4391	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Remove Selected from Ignore List', 'loginizer'); ?>" type="submit" /></center>
4392	</form>
4393	</div>
4394
4395	</div>
4396	<br />
4397
4398	<?php
4399	loginizer_page_footer();
4400
4401	}
4402
4403	function loginizer_dismiss_newsletter(){
4404
4405	// Some AJAX security
4406	check_ajax_referer('loginizer_admin_ajax', 'nonce');
4407
4408	if(!current_user_can('manage_options')){
4409	wp_die('Sorry, but you do not have permissions to change settings.');
4410	}
4411
4412	update_option('loginizer_dismiss_newsletter', time());
4413	echo 1;
4414	wp_die();
4415	}
4416
4417	add_action('wp_ajax_loginizer_dismiss_newsletter', 'loginizer_dismiss_newsletter');
4418
4419	function loginizer_newsletter_subscribe(){
4420
4421	$newsletter_dismiss = get_option('loginizer_dismiss_newsletter');
4422
4423	if(!empty($newsletter_dismiss)){
4424	return;
4425	}
4426
4427	$env['url'] = 'https://loginizer.com/';
4428
4429	echo '
4430	<style>
4431	.newsletter_container{
4432	color: #000000;
4433	background: #FFFFFF;
4434	text-align:center;
4435	}
4436	.subscribe_form_row{
4437	color: #000000;
4438	padding-bottom:0px !important;
4439	}
4440	.subscribe_heading{
4441	font-size:22px;
4442	}
4443	</style>
4444
4445	<div class="notice my-loginizer-dismiss-notice is-dismissible" style="background:#FFF;padding:15px; border: 1px solid #ccd0d4; width:80%;margin-left:0px;margin:auto;">
4446	<div class="container">
4447	<div class="col-md-6 col-md-offset-3 text-center newsletter_container">
4448	<h2 style="font-weight:100; margin-bottom:20px; margin-top:5px;" class="subscribe_heading">Subscribe to our Newsletter</h2>
4449	<form class="form-inline" action="" method="POST">
4450	<div class="row subscribe_form_row">
4451	<div class="col-md-12">
4452	<input type="email" name="email" size="40" id="subscribe_email" class="" placeholder="email@example.com" value="">
4453	<input type="button" name="subscribe" id="subscribe_button" class="button button-primary" value="Subscribe" onclick="loginizer_email_subscribe();" style="margin-top:0px;">
4454	</div>
4455	<div class="col-md-3">
4456	</div>
4457	</div>
4458	</form>
4459	<p><b>Note :</b> If a Loginizer account does not exist it will be created.</p>
4460	</div>
4461	</div>
4462	</div><br />
4463
4464	<script type="text/javascript">
4465	function loginizer_dismiss_newsletter(){
4466
4467	var data = new Object();
4468	data["action"] = "loginizer_dismiss_newsletter";
4469	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
4470
4471	var admin_url = "'.admin_url().'"+"admin-ajax.php";
4472	jQuery.post(admin_url, data, function(response){
4473
4474	});
4475
4476	}
4477
4478	function loginizer_email_subscribe(){
4479	var subs_location = "'.$env['url'].'?email="+encodeURIComponent(jQuery("#subscribe_email").val());
4480	window.open(subs_location, "_blank");
4481	}
4482	jQuery(document).on("click", ".my-loginizer-dismiss-notice .notice-dismiss", loginizer_dismiss_newsletter);
4483	</script>';
4484
4485	return true;
4486	}
4487
4488
4489	// Sorry to see you going
4490	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
4491
4492	function loginizer_deactivation(){
4493
4494	global $wpdb;
4495
4496	$sql = array();
4497	$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
4498
4499	foreach($sql as $sk => $sv){
4500	$wpdb->query($sv);
4501	}
4502
4503	delete_option('loginizer_version');
4504	delete_option('loginizer_options');
4505	delete_option('loginizer_last_reset');
4506	delete_option('loginizer_whitelist');
4507	delete_option('loginizer_blacklist');
4508	delete_option('loginizer_msg');
4509	delete_option('loginizer_2fa_msg');
4510	delete_option('loginizer_2fa_email_template');
4511	delete_option('loginizer_security');
4512	delete_option('loginizer_wp_admin');
4513
4514	}
4515
4516