loginizer / init.php

init.php in Loginizer 1.6.8, at init.php

5,187 lines 170.3 KB

Raw Download Zip

1	<?php
2
3	if(!function_exists('add_action')){
4	echo 'You are not allowed to access this page directly.';
5	exit;
6	}
7
8	define('LOGINIZER_VERSION', '1.6.8');
9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14
15	include_once(LOGINIZER_DIR.'/functions.php');
16
17	// Ok so we are now ready to go
18	register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
19
20	// Is called when the ADMIN enables the plugin
21	function loginizer_activation(){
22
23	global $wpdb;
24
25	$sql = array();
26
27	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28
29	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	`username` varchar(255) NOT NULL DEFAULT '',
31	`time` int(10) NOT NULL DEFAULT '0',
32	`count` int(10) NOT NULL DEFAULT '0',
33	`lockout` int(10) NOT NULL DEFAULT '0',
34	`ip` varchar(255) NOT NULL DEFAULT '',
35	`url` varchar(255) NOT NULL DEFAULT '',
36	UNIQUE KEY `ip` (`ip`)
37	) DEFAULT CHARSET=utf8;";
38
39	foreach($sql as $sk => $sv){
40	$wpdb->query($sv);
41	}
42
43	add_option('loginizer_version', LOGINIZER_VERSION);
44	add_option('loginizer_options', array());
45	add_option('loginizer_last_reset', 0);
46	add_option('loginizer_whitelist', array());
47	add_option('loginizer_blacklist', array());
48	add_option('loginizer_2fa_whitelist', array());
49
50	}
51
52	/**
53	* Updates the database structure for Loginizer
54	*
55	* If the plugin files are updated but database structure is not updated
56	* this function will update the database structure as per the plugin version
57	* NOTE: This does not update plugin files it just updates the database structure
58	*/
59	function loginizer_update_check(){
60
61	global $wpdb;
62
63	$sql = array();
64	$current_version = get_option('loginizer_version');
65
66	// It must be the 1.0 pre stuff
67	if(empty($current_version)){
68	$current_version = get_option('lz_version');
69	}
70
71	$version = (int) str_replace('.', '', $current_version);
72
73	// No update required
74	if($current_version == LOGINIZER_VERSION){
75	return true;
76	}
77
78	// Is it first run ?
79	if(empty($current_version)){
80
81	// Reinstall
82	loginizer_activation();
83
84	// Trick the following if conditions to not run
85	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
86
87	}
88
89	// Is it less than 1.0.1 ?
90	if($version < 101){
91
92	// TODO : GET the existing settings
93
94	// Get the existing settings
95	$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
96	$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
97	$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
98
99	// Delete the three tables
100	$sql = array();
101	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
102	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
103	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
104
105	foreach($sql as $sk => $sv){
106	$wpdb->query($sv);
107	}
108
109	// Delete option
110	delete_option('lz_version');
111
112	// Reinstall
113	loginizer_activation();
114
115	// TODO : Save the existing settings
116
117	// Update the existing failed logs to new table
118	if(is_array($lz_failed_logs)){
119	foreach($lz_failed_logs as $fk => $fv){
120	$insert_data = array('username' => $fv['username'],
121	'time' => $fv['time'],
122	'count' => $fv['count'],
123	'lockout' => $fv['lockout'],
124	'ip' => $fv['ip']);
125
126	$format = array('%s','%d','%d','%d','%s');
127
128	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
129	}
130	}
131
132	// Update the existing options to new structure
133	if(is_array($lz_options)){
134	foreach($lz_options as $ok => $ov){
135
136	if($ov['option_name'] == 'lz_last_reset'){
137	update_option('loginizer_last_reset', $ov['option_value']);
138	continue;
139	}
140
141	$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
142	}
143	// Save the options
144	update_option('loginizer_options', $old_option);
145	}
146
147	// Update the existing iprange to new structure
148	if(is_array($lz_iprange)){
149
150	$old_blacklist = array();
151	$old_whitelist = array();
152	$bid = 1;
153	$wid = 1;
154	foreach($lz_iprange as $ik => $iv){
155
156	if(!empty($iv['blacklist'])){
157	$old_blacklist[$bid] = array();
158	$old_blacklist[$bid]['start'] = long2ip($iv['start']);
159	$old_blacklist[$bid]['end'] = long2ip($iv['end']);
160	$old_blacklist[$bid]['time'] = strtotime($iv['date']);
161	$bid = $bid + 1;
162	}
163
164	if(!empty($iv['whitelist'])){
165	$old_whitelist[$wid] = array();
166	$old_whitelist[$wid]['start'] = long2ip($iv['start']);
167	$old_whitelist[$wid]['end'] = long2ip($iv['end']);
168	$old_whitelist[$wid]['time'] = strtotime($iv['date']);
169	$wid = $wid + 1;
170	}
171	}
172
173	if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
174	if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
175	}
176
177	}
178
179	// Is it less than 1.3.9 ?
180	if($version < 139){
181
182	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
183
184	}
185
186	// Save the new Version
187	update_option('loginizer_version', LOGINIZER_VERSION);
188
189	// In Sitepad Math Captcha is enabled by default
190	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
191	$option['captcha_no_google'] = 1;
192	add_option('loginizer_captcha', $option);
193	}
194
195	}
196
197	// Add the action to load the plugin
198	add_action('plugins_loaded', 'loginizer_load_plugin');
199
200	// The function that will be called when the plugin is loaded
201	function loginizer_load_plugin(){
202
203	global $loginizer;
204
205	// Check if the installed version is outdated
206	loginizer_update_check();
207
208	// Set the array
209	$loginizer = array();
210
211	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
212	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
213	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
214	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
215
216	// The IP Method to use
217	$loginizer['ip_method'] = get_option('loginizer_ip_method');
218	if($loginizer['ip_method'] == 3){
219	$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
220	}
221
222	// Load settings
223	$options = get_option('loginizer_options');
224	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
225	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
226	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
227	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
228	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
229	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
230	$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
231
232	if(!empty($options['notify_email_address'])){
233	$loginizer['notify_email_address'] = $options['notify_email_address'];
234	$loginizer['custom_notify_email'] = 1;
235	}
236
237	// Default messages
238	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
239	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
240	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
241	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
242	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
243	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
244
245	// Message Strings
246	$loginizer['msg'] = get_option('loginizer_msg');
247
248	foreach($loginizer['d_msg'] as $lk => $lv){
249	if(empty($loginizer['msg'][$lk])){
250	$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
251	}
252	}
253
254	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
255	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
256	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
257	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
258	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
259
260	// Message Strings
261	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg');
262
263	foreach($loginizer['2fa_d_msg'] as $lk => $lv){
264	if(empty($loginizer['2fa_msg'][$lk])){
265	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
266	}
267	}
268
269	// Load the blacklist and whitelist
270	$loginizer['blacklist'] = get_option('loginizer_blacklist');
271	$loginizer['whitelist'] = get_option('loginizer_whitelist');
272	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
273
274	// It should not be false
275	if(empty($loginizer['2fa_whitelist'])){
276	$loginizer['2fa_whitelist'] = array();
277	}
278
279	// When was the database cleared last time
280	$loginizer['last_reset'] = get_option('loginizer_last_reset');
281
282	//print_r($loginizer);
283
284	// Clear retries
285	if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
286	loginizer_reset_retries();
287	}
288
289	$ins_time = get_option('loginizer_ins_time');
290	if(empty($ins_time)){
291	$ins_time = time();
292	update_option('loginizer_ins_time', $ins_time);
293	}
294	$loginizer['ins_time'] = $ins_time;
295
296	// Set the current IP
297	$loginizer['current_ip'] = lz_getip();
298
299	// Is Brute Force Disabled ?
300	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');
301
302	// Filters and actions
303	if(empty($loginizer['disable_brute'])){
304
305	// Use this to verify before WP tries to login
306	// Is always called and is the first function to be called
307	//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
308	add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
309
310	// Is called when a login attempt fails
311	// Hence Update our records that the login failed
312	add_action('wp_login_failed', 'loginizer_login_failed');
313
314	// Is called before displaying the error message so that we dont show that the username is wrong or the password
315	// Update Error message
316	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
317	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
318
319	}
320
321	// ----------------
322	// PRO INIT
323	// ----------------
324
325	// Email to Login
326	$options = get_option('loginizer_epl');
327	$loginizer['pl_d_sub'] = 'Login at $site_name';
328	$loginizer['pl_d_msg'] = 'Hi,
329
330	A login request was submitted for your account $email at :
331	$site_name - $site_url
332
333	Login at $site_name by visiting this url :
334	$login_url
335
336	If you have not requested for the Login URL, please ignore this email.
337
338	Regards,
339	$site_name';
340	$loginizer['email_pass_less'] = empty($options['email_pass_less']) ? 0 : $options['email_pass_less'];
341	$loginizer['passwordless_sub'] = empty($options['passwordless_sub']) ? $loginizer['pl_d_sub'] : $options['passwordless_sub'];
342	$loginizer['passwordless_msg'] = empty($options['passwordless_msg']) ? $loginizer['pl_d_msg'] : $options['passwordless_msg'];
343	$loginizer['passwordless_msg_is_custom'] = empty($options['passwordless_msg']) ? 0 : 1;
344	$loginizer['passwordless_html'] = empty($options['passwordless_html']) ? 0 : $options['passwordless_html'];
345
346	// 2FA OTP Email to Login
347	$options = get_option('loginizer_2fa_email_template');
348	$loginizer['2fa_email_d_sub'] = 'OTP : Login at $site_name';
349	$loginizer['2fa_email_d_msg'] = 'Hi,
350
351	A login request was submitted for your account $email at :
352	$site_name - $site_url
353
354	Please use the following One Time password (OTP) to login :
355	$otp
356
357	Note : The OTP expires after 10 minutes.
358
359	If you haven\'t requested for the OTP, please ignore this email.
360
361	Regards,
362	$site_name';
363
364	$loginizer['2fa_email_sub'] = empty($options['2fa_email_sub']) ? $loginizer['2fa_email_d_sub'] : $options['2fa_email_sub'];
365	$loginizer['2fa_email_msg'] = empty($options['2fa_email_msg']) ? $loginizer['2fa_email_d_msg'] : $options['2fa_email_msg'];
366
367	// For SitePad its always on
368	if(defined('SITEPAD')){
369	$loginizer['email_pass_less'] = 1;
370	}
371
372	// Captcha
373	$options = get_option('loginizer_captcha');
374	$loginizer['captcha_type'] = empty($options['captcha_type']) ? '' : $options['captcha_type'];
375	$loginizer['captcha_key'] = empty($options['captcha_key']) ? '' : $options['captcha_key'];
376	$loginizer['captcha_secret'] = empty($options['captcha_secret']) ? '' : $options['captcha_secret'];
377	$loginizer['captcha_theme'] = empty($options['captcha_theme']) ? 'light' : $options['captcha_theme'];
378	$loginizer['captcha_size'] = empty($options['captcha_size']) ? 'normal' : $options['captcha_size'];
379	$loginizer['captcha_lang'] = empty($options['captcha_lang']) ? '' : $options['captcha_lang'];
380	$loginizer['captcha_user_hide'] = !isset($options['captcha_user_hide']) ? 0 : $options['captcha_user_hide'];
381	$loginizer['captcha_no_css_login'] = !isset($options['captcha_no_css_login']) ? 0 : $options['captcha_no_css_login'];
382	$loginizer['captcha_no_js'] = 1;
383	$loginizer['captcha_login'] = !isset($options['captcha_login']) ? 1 : $options['captcha_login'];
384	$loginizer['captcha_lostpass'] = !isset($options['captcha_lostpass']) ? 1 : $options['captcha_lostpass'];
385	$loginizer['captcha_resetpass'] = !isset($options['captcha_resetpass']) ? 1 : $options['captcha_resetpass'];
386	$loginizer['captcha_register'] = !isset($options['captcha_register']) ? 1 : $options['captcha_register'];
387	$loginizer['captcha_comment'] = !isset($options['captcha_comment']) ? 1 : $options['captcha_comment'];
388	$loginizer['captcha_wc_checkout'] = !isset($options['captcha_wc_checkout']) ? 1 : $options['captcha_wc_checkout'];
389
390	$loginizer['captcha_no_google'] = !isset($options['captcha_no_google']) ? 0 : $options['captcha_no_google'];
391	$loginizer['captcha_text'] = empty($options['captcha_text']) ? __('Math Captcha', 'loginizer') : $options['captcha_text'];
392	$loginizer['captcha_time'] = empty($options['captcha_time']) ? 300 : $options['captcha_time'];
393	$loginizer['captcha_words'] = !isset($options['captcha_words']) ? 0 : $options['captcha_words'];
394	$loginizer['captcha_add'] = !isset($options['captcha_add']) ? 1 : $options['captcha_add'];
395	$loginizer['captcha_subtract'] = !isset($options['captcha_subtract']) ? 1 : $options['captcha_subtract'];
396	$loginizer['captcha_multiply'] = !isset($options['captcha_multiply']) ? 0 : $options['captcha_multiply'];
397	$loginizer['captcha_divide'] = !isset($options['captcha_divide']) ? 0 : $options['captcha_divide'];
398
399	// 2fa/question
400	$options = get_option('loginizer_2fa');
401	$loginizer['2fa_app'] = !isset($options['2fa_app']) ? 0 : $options['2fa_app'];
402	$loginizer['2fa_email'] = !isset($options['2fa_email']) ? 0 : $options['2fa_email'];
403	$loginizer['2fa_email_force'] = !isset($options['2fa_email_force']) ? 0 : $options['2fa_email_force'];
404	$loginizer['2fa_sms'] = !isset($options['2fa_sms']) ? 0 : $options['2fa_sms'];
405	$loginizer['question'] = !isset($options['question']) ? 0 : $options['question'];
406	$loginizer['2fa_default'] = empty($options['2fa_default']) ? 'question' : $options['2fa_default'];
407	$loginizer['2fa_roles'] = empty($options['2fa_roles']) ? array() : $options['2fa_roles'];
408
409	// Security Settings
410	$options = get_option('loginizer_security');
411	$loginizer['login_slug'] = empty($options['login_slug']) ? '' : $options['login_slug'];
412	$loginizer['rename_login_secret'] = empty($options['rename_login_secret']) ? '' : $options['rename_login_secret'];
413	$loginizer['xmlrpc_slug'] = empty($options['xmlrpc_slug']) ? '' : $options['xmlrpc_slug'];
414	$loginizer['xmlrpc_disable'] = empty($options['xmlrpc_disable']) ? '' : $options['xmlrpc_disable'];// Disable XML-RPC
415	$loginizer['pingbacks_disable'] = empty($options['pingbacks_disable']) ? '' : $options['pingbacks_disable'];// Disable Pingbacks
416
417	// Admin Slug Settings
418	$options = get_option('loginizer_wp_admin');
419	$loginizer['admin_slug'] = empty($options['admin_slug']) ? '' : $options['admin_slug'];
420	$loginizer['restrict_wp_admin'] = empty($options['restrict_wp_admin']) ? '' : $options['restrict_wp_admin'];
421	$loginizer['wp_admin_msg'] = empty($options['wp_admin_msg']) ? '' : $options['wp_admin_msg'];
422
423	// Checksum Settings
424	$options = get_option('loginizer_checksums');
425	$loginizer['disable_checksum'] = empty($options['disable_checksum']) ? '' : $options['disable_checksum'];
426	$loginizer['checksum_time'] = empty($options['checksum_time']) ? '' : $options['checksum_time'];
427	$loginizer['checksum_frequency'] = empty($options['checksum_frequency']) ? 7 : $options['checksum_frequency'];
428	$loginizer['no_checksum_email'] = empty($options['no_checksum_email']) ? '' : $options['no_checksum_email'];
429	$loginizer['checksums_last_run'] = get_option('loginizer_checksums_last_run');
430
431	// Auto Blacklist Usernames
432	$loginizer['username_blacklist'] = get_option('loginizer_username_blacklist');
433
434	$loginizer['domains_blacklist'] = get_option('loginizer_domains_blacklist');
435
436	$loginizer['wp_admin_d_msg'] = __('LZ : Not allowed via WP-ADMIN. Please access over the new Admin URL', 'loginizer');
437
438	// ----------------
439	// PRO INIT END
440	// ----------------
441
442	// Is the premium features there ?
443	if(file_exists(LOGINIZER_DIR.'/premium.php')){
444
445	// Include the file
446	include_once(LOGINIZER_DIR.'/premium.php');
447
448	loginizer_security_init();
449
450	// Its the free version
451	}else{
452
453	// The promo time
454	$loginizer['promo_time'] = get_option('loginizer_promo_time');
455	if(empty($loginizer['promo_time'])){
456	$loginizer['promo_time'] = time();
457	update_option('loginizer_promo_time', $loginizer['promo_time']);
458	}
459
460	// Are we to show the loginizer promo
461	if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30243600))){
462
463	add_action('admin_notices', 'loginizer_promo');
464
465	}
466
467	// Are we to disable the promo
468	if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
469	update_option('loginizer_promo_time', (0 - time()) );
470	die('DONE');
471	}
472
473	}
474
475	}
476
477	// Show the promo
478	function loginizer_promo(){
479
480	echo '
481	<style>
482	.lz_button {
483	background-color: #4CAF50; /* Green */
484	border: none;
485	color: white;
486	padding: 8px 16px;
487	text-align: center;
488	text-decoration: none;
489	display: inline-block;
490	font-size: 16px;
491	margin: 4px 2px;
492	-webkit-transition-duration: 0.4s; /* Safari */
493	transition-duration: 0.4s;
494	cursor: pointer;
495	}
496
497	.lz_button:focus{
498	border: none;
499	color: white;
500	}
501
502	.lz_button1 {
503	color: white;
504	background-color: #4CAF50;
505	border:3px solid #4CAF50;
506	}
507
508	.lz_button1:hover {
509	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
510	color: white;
511	border:3px solid #4CAF50;
512	}
513
514	.lz_button2 {
515	color: white;
516	background-color: #0085ba;
517	}
518
519	.lz_button2:hover {
520	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
521	color: white;
522	}
523
524	.lz_button3 {
525	color: white;
526	background-color: #365899;
527	}
528
529	.lz_button3:hover {
530	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
531	color: white;
532	}
533
534	.lz_button4 {
535	color: white;
536	background-color: rgb(66, 184, 221);
537	}
538
539	.lz_button4:hover {
540	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
541	color: white;
542	}
543
544	.loginizer_promo-close{
545	float:right;
546	text-decoration:none;
547	margin: 5px 10px 0px 0px;
548	}
549
550	.loginizer_promo-close:hover{
551	color: red;
552	}
553	</style>
554
555	<script>
556	jQuery(document).ready( function() {
557	(function($) {
558	$("#loginizer_promo .loginizer_promo-close").click(function(){
559	var data;
560
561	// Hide it
562	$("#loginizer_promo").hide();
563
564	// Save this preference
565	$.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
566	//alert(response);
567	});
568	});
569	})(jQuery);
570	});
571	</script>
572
573	<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
574	<a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
575	<span class="dashicons dashicons-dismiss"></span> Dismiss
576	</a>
577	<img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
578	<p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
579	<p>
580	<a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
581	<a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
582	\'s</a>
583	<a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
584	<a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
585	</p>
586	</div>';
587
588	}
589
590	// Should return NULL if everything is fine
591	function loginizer_wp_authenticate($user, $username, $password){
592
593	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
594
595	if(!empty($username) && !empty($password)){
596	$lz_user_pass = 1;
597	}
598
599	// Are you whitelisted ?
600	if(loginizer_is_whitelisted()){
601	$loginizer['ip_is_whitelisted'] = 1;
602	return $user;
603	}
604
605	// Are you blacklisted ?
606	if(loginizer_is_blacklisted()){
607	$lz_cannot_login = 1;
608
609	// This is used by WP Activity Log
610	apply_filters( 'wp_login_blocked', $username );
611
612	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
613	}
614
615	// Is the username blacklisted ?
616	if(function_exists('loginizer_user_blacklisted')){
617	if(loginizer_user_blacklisted($username)){
618	$lz_cannot_login = 1;
619
620	// This is used by WP Activity Log
621	apply_filters( 'wp_login_blocked', $username );
622
623	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
624	}
625	}
626
627	if(loginizer_can_login()){
628	return $user;
629	}
630
631	$lz_cannot_login = 1;
632
633	// This is used by WP Activity Log
634	apply_filters( 'wp_login_blocked', $username );
635
636	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
637
638	}
639
640	function loginizer_can_login(){
641
642	global $wpdb, $loginizer, $lz_error;
643
644	// Get the logs
645	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
646	$result = lz_selectquery($sel_query);
647
648	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
649
650	// Has he reached max lockouts ?
651	if($result['lockout'] >= $loginizer['max_lockouts']){
652	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
653	}
654
655	// Is he in the lockout time ?
656	if($result['time'] >= (time() - $loginizer['lockout_time'])){
657	$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
658
659	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
660	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
661	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
662
663	$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
664
665	if($banlift > 60){
666	$banlift = ceil($banlift / 60);
667	$_time = $banlift.' '.$loginizer['msg']['hours_err'];
668	}
669
670	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
671
672	return false;
673	}
674	}
675
676	return true;
677	}
678
679	function loginizer_is_blacklisted(){
680
681	global $wpdb, $loginizer, $lz_error;
682
683	$blacklist = $loginizer['blacklist'];
684
685	if(empty($blacklist)){
686	return false;
687	}
688
689	foreach($blacklist as $k => $v){
690
691	// Is the IP in the blacklist ?
692	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
693	$result = 1;
694	break;
695	}
696
697	// Is it in a wider range ?
698	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
699
700	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
701	// if the current IP is <= than the start of the range, it is within the range
702	// OR
703	// if the current IP is <= than the end of the range, it is within the range
704	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
705	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
706	$result = 1;
707	break;
708	}
709
710	}
711
712	}
713
714	// You are blacklisted
715	if(!empty($result)){
716	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
717	return true;
718	}
719
720	return false;
721
722	}
723
724	function loginizer_is_whitelisted(){
725
726	global $wpdb, $loginizer, $lz_error;
727
728	$whitelist = $loginizer['whitelist'];
729
730	if(empty($whitelist)){
731	return false;
732	}
733
734	foreach($whitelist as $k => $v){
735
736	// Is the IP in the blacklist ?
737	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
738	$result = 1;
739	break;
740	}
741
742	// Is it in a wider range ?
743	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
744
745	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
746	// if the current IP is <= than the start of the range, it is within the range
747	// OR
748	// if the current IP is <= than the end of the range, it is within the range
749	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
750	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
751	$result = 1;
752	break;
753	}
754
755	}
756
757	}
758
759	// You are whitelisted
760	if(!empty($result)){
761	return true;
762	}
763
764	return false;
765
766	}
767
768
769	// When the login fails, then this is called
770	// We need to update the database
771	function loginizer_login_failed($username, $is_2fa = ''){
772
773	global $wpdb, $loginizer, $lz_cannot_login;
774
775	// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
776	if(empty($username) \|\| is_null($username)){
777	$username = '';
778	}
779
780	$fail_type = 'Login';
781
782	if(!empty($is_2fa)){
783	$fail_type = '2FA';
784	}
785
786	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
787
788	$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
789	$url = esc_url($url);
790
791	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
792	$result = lz_selectquery($sel_query);
793
794	if(!empty($result)){
795	$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
796
797	$update_data = array('username' => $username,
798	'time' => time(),
799	'count' => $result['count']+1,
800	'lockout' => $lockout,
801	'url' => $url);
802
803	$where_data = array('ip' => $loginizer['current_ip']);
804
805	$format = array('%s','%d','%d','%d','%s');
806	$where_format = array('%s');
807
808	$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
809
810	// Do we need to email admin ?
811	if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
812
813	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
814	$mail = array();
815	$mail['to'] = $loginizer['notify_email_address'];
816	$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
817	$mail['message'] = 'Hi,
818
819	'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
820	'.home_url().'
821
822	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
823	Last User Attempt : '.$username.'
824	IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $loginizer['lockout_time']).'
825
826	Regards,
827	Loginizer';
828
829	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
830	}
831	}else{
832	$result = array();
833	$result['count'] = 0;
834
835	$insert_data = array('username' => $username,
836	'time' => time(),
837	'count' => 1,
838	'ip' => $loginizer['current_ip'],
839	'lockout' => 0,
840	'url' => $url);
841
842	$format = array('%s','%d','%d','%s','%d','%s');
843
844	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
845	}
846
847	// We need to add one as this is a failed attempt as well
848	$result['count'] = $result['count'] + 1;
849	$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
850	$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
851
852	}
853	}
854
855	// Handles the error of the password not being there
856	function loginizer_error_handler($errors, $redirect_to){
857
858	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
859
860	//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
861
862	// Remove the empty password error
863	if(is_wp_error($errors)){
864
865	$codes = $errors->get_error_codes();
866
867	foreach($codes as $k => $v){
868	if($v == 'invalid_username' \|\| $v == 'incorrect_password'){
869	$show_error = 1;
870	}
871	}
872
873	$errors->remove('invalid_username');
874	$errors->remove('incorrect_password');
875
876	}
877
878	// Add the error
879	if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
880	$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
881	}
882
883	// Add the number of retires left as well
884	if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
885	$errors->add('retries_left', loginizer_retries_left());
886	}
887
888	return $errors;
889
890	}
891
892
893
894	// Handles the error of the password not being there
895	function loginizer_woocommerce_error_handler(){
896
897	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
898
899	if(function_exists('wc_add_notice')){
900	wc_add_notice( loginizer_retries_left(), 'error' );
901	}
902
903	}
904
905	// Returns a string with the number of retries left
906	function loginizer_retries_left(){
907
908	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
909
910	// If we are to show the number of retries left
911	if(isset($loginizer['retries_left'])){
912	return '<b>'.$loginizer['retries_left'].'</b> '.$loginizer['msg']['attempts_left'];
913	}
914
915	}
916
917	function loginizer_reset_retries(){
918
919	global $wpdb, $loginizer;
920
921	$deltime = time() - $loginizer['reset_retries'];
922
923	$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
924	$result = $wpdb->query($del_query);
925
926	update_option('loginizer_last_reset', time());
927
928	}
929
930	add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
931
932	// Add settings link on plugin page
933	function loginizer_plugin_action_links($links) {
934
935	if(!defined('LOGINIZER_PREMIUM')){
936	$links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
937	}
938
939	$settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
940	array_unshift($links, $settings_link);
941
942	return $links;
943	}
944
945	add_action('admin_menu', 'loginizer_admin_menu');
946
947	// Shows the admin menu of Loginizer
948	function loginizer_admin_menu() {
949
950	global $wp_version, $loginizer;
951
952	if(!defined('SITEPAD')){
953
954	// Add the menu page
955	add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
956
957	// Dashboard
958	add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
959
960	}else{
961
962	// Add the menu page
963	add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
964
965	// Rename Login
966	add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
967
968	}
969
970	// Brute Force
971	add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
972
973	// PasswordLess
974	add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
975
976	// Security Settings
977	if(!defined('SITEPAD')){
978
979	// Two Factor Auth
980	add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
981
982	}
983
984	// reCaptcha
985	add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
986
987	// Security Settings
988	if(!defined('SITEPAD')){
989
990	// Security Settings
991	add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
992
993	// File Checksums
994	add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
995
996	}
997
998	if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30243600))){
999
1000	// Go Pro link
1001	add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
1002
1003	}
1004
1005	}
1006
1007	// The Loginizer Admin Options Page
1008	function loginizer_page_header($title = 'Loginizer'){
1009
1010	global $loginizer;
1011
1012	?>
1013	<style>
1014	.lz-right-ul{
1015	padding-left: 10px !important;
1016	}
1017
1018	.lz-right-ul li{
1019	list-style: circle !important;
1020	}
1021	</style>
1022	<?php
1023
1024	echo '<div style="margin: 10px 20px 0 2px;">
1025	<div class="metabox-holder columns-2">
1026	<div class="postbox-container">
1027	<div id="top-sortables" class="meta-box-sortables ui-sortable">
1028
1029	<table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
1030	<tr>
1031	<td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
1032
1033	if(!defined('SITEPAD')){
1034
1035	echo '<td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">'.__('Review Loginizer', 'loginizer').'</a></td>
1036	<td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
1037	<td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
1038
1039	}
1040
1041	echo '
1042	</tr>
1043	</table>
1044	<hr />
1045
1046	<!--Main Table-->
1047	<table cellpadding="8" cellspacing="1" width="100%" class="fixed">
1048	<tr>
1049	<td valign="top">';
1050
1051	}
1052
1053	// The Loginizer Theme footer
1054	function loginizer_page_footer(){
1055
1056	if(!loginizer_is_premium()){
1057	echo '<script>
1058	jQuery("[loginizer-premium-only]").each(function(index) {
1059	jQuery(this).find( "input, textarea, select" ).attr("disabled", true);
1060	});
1061	</script>';
1062	}
1063
1064	echo '</td>
1065	<td width="200" valign="top" id="loginizer-right-bar">';
1066
1067	if(!defined('SITEPAD')){
1068
1069	if(!defined('LOGINIZER_PREMIUM')){
1070
1071	echo '
1072	<div class="postbox" style="min-width:0px !important;">
1073	<div class="postbox-header">
1074	<h2 class="hndle ui-sortable-handle">
1075	<span>Premium Version</span>
1076	</h2>
1077	</div>
1078
1079	<div class="inside">
1080	<i>Upgrade to the premium version and get the following features </i>:<br>
1081	<ul class="lz-right-ul">
1082	<li>PasswordLess Login</li>
1083	<li>Two Factor Auth - Email</li>
1084	<li>Two Factor Auth - App</li>
1085	<li>Login Challenge Question</li>
1086	<li>reCAPTCHA</li>
1087	<li>Rename Login Page</li>
1088	<li>Disable XML-RPC</li>
1089	<li>And many more ...</li>
1090	</ul>
1091	<center><a class="button button-primary" target="_blank" href="'.LOGINIZER_PRICING_URL.'">Upgrade</a></center>
1092	</div>
1093	</div>';
1094
1095	}else{
1096
1097	echo '
1098	<div class="postbox" style="min-width:0px !important;">
1099	<div class="postbox-header">
1100	<h2 class="hndle ui-sortable-handle">
1101	<span>Recommendations</span>
1102	</h2>
1103	</div>
1104	<div class="inside">
1105	<i>We recommed that you enable atleast one of the following security features</i>:<br>
1106	<ul class="lz-right-ul">
1107	<li>Rename Login Page</li>
1108	<li>Login Challenge Question</li>
1109	<li>reCAPTCHA</li>
1110	<li>Two Factor Auth - Email</li>
1111	<li>Two Factor Auth - App</li>
1112	<li>Change \'admin\' Username</li>
1113	</ul>
1114	</div>
1115	</div>';
1116	}
1117
1118	echo '
1119	<div class="postbox" style="min-width:0px !important;">
1120	<div class="postbox-header">
1121	<h2 class="hndle ui-sortable-handle">
1122	<span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
1123	</h2>
1124	</div>
1125	<div class="inside">
1126	<i>Easily manage and make professional pages and content with our Pagelayer builder </i>:<br>
1127	<ul class="lz-right-ul">
1128	<li>30+ Free Widgets</li>
1129	<li>60+ Premium Widgets</li>
1130	<li>400+ Premium Sections</li>
1131	<li>Theme Builder</li>
1132	<li>WooCommerce Builder</li>
1133	<li>Theme Creator and Exporter</li>
1134	<li>Form Builder</li>
1135	<li>Popup Builder</li>
1136	<li>And many more ...</li>
1137	</ul>
1138	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">Visit Pagelayer</a></center>
1139	</div>
1140	</div>';
1141
1142	echo '
1143	<div class="postbox" style="min-width:0px !important;">
1144	<div class="postbox-header">
1145	<h2 class="hndle ui-sortable-handle">
1146	<span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
1147	</h2>
1148	</div>
1149	<div class="inside">
1150	<i>Manage all your WordPress sites from <b>1 dashboard</b> </i>:<br>
1151	<ul class="lz-right-ul">
1152	<li>1-click Admin Access</li>
1153	<li>Update WordPress</li>
1154	<li>Update Themes</li>
1155	<li>Update Plugins</li>
1156	<li>Backup your WordPress Site</li>
1157	<li>Plugins & Theme Management</li>
1158	<li>Post Management</li>
1159	<li>And many more ...</li>
1160	</ul>
1161	<center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">Visit wpCentral</a></center>
1162	</div>
1163	</div>';
1164
1165	}
1166
1167	echo '</td>
1168	</tr>
1169	</table>';
1170
1171	if(!defined('SITEPAD')){
1172
1173	echo '<br />
1174	<div style="width:45%;background:#FFF;padding:15px; margin:auto">
1175	<b>Let your friends know that you have secured your website :</b>
1176	<form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
1177	<textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
1178	<input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
1179	</form>
1180
1181	</div>
1182	<br />
1183
1184	<script>
1185	function dotweet(ele){
1186	window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
1187	return false;
1188	}
1189	</script>
1190
1191	<hr />
1192	<a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
1193
1194	}
1195
1196	echo '
1197	</div>
1198	</div>
1199	</div>
1200	</div>';
1201
1202	}
1203
1204	// The Loginizer Admin Options Page
1205	function loginizer_page_dashboard(){
1206
1207	global $loginizer, $lz_error, $lz_env;
1208
1209	if(!current_user_can('manage_options')){
1210	wp_die('Sorry, but you do not have permissions to change settings.');
1211	}
1212
1213	// Dismiss the announcement
1214	if(isset($_GET['dismiss_announcement'])){
1215	update_option('loginizer_no_announcement', 1);
1216	}
1217
1218	/* Make sure post was from this page */
1219	if(count($_POST) > 0){
1220	check_admin_referer('loginizer-options');
1221	}
1222
1223	do_action('loginizer_pre_page_dashboard');
1224
1225	// Is there a IP Method ?
1226	if(isset($_POST['save_lz_ip_method'])){
1227
1228	$ip_method = (int) lz_optpost('lz_ip_method');
1229	$custom_ip_method = lz_optpost('lz_custom_ip_method');
1230
1231	if($ip_method >= 0 && $ip_method <= 3){
1232	update_option('loginizer_ip_method', $ip_method);
1233	}
1234
1235	// Custom Method name ?
1236	if($ip_method == 3){
1237	update_option('loginizer_custom_ip_method', $custom_ip_method);
1238	}
1239
1240	}
1241
1242	loginizer_page_dashboard_T();
1243
1244	}
1245
1246	// The Loginizer Admin Options Page - THEME
1247	function loginizer_page_dashboard_T(){
1248
1249	global $loginizer, $lz_error, $lz_env;
1250
1251	loginizer_page_header('Dashboard');
1252	?>
1253	<style>
1254	.welcome-panel{
1255	margin: 0px;
1256	padding: 10px;
1257	}
1258
1259	input[type="text"], textarea, select {
1260	width: 70%;
1261	}
1262
1263	.form-table label{
1264	font-weight:bold;
1265	}
1266
1267	.exp{
1268	font-size:12px;
1269	}
1270	</style>
1271
1272	<?php
1273	$lz_ip = lz_getip();
1274
1275	if($lz_ip != '127.0.0.1' && @$_SERVER['SERVER_ADDR'] == $lz_ip){
1276	echo '<div class="update-message notice error inline notice-error notice-alt"><p style="color:red">   Your Server IP Address seems to match the Client IP detected by Loginizer. You might want to change the IP detection method to HTTP_X_FORWARDED_FOR under System Information section.</p></div><br>';
1277	}
1278
1279	loginizer_newsletter_subscribe();
1280
1281	$hide_announcement = get_option('loginizer_no_announcement');
1282	if(empty($hide_announcement)){
1283	echo '<div id="message" class="welcome-panel">'. __('<a href="https://loginizer.com/blog/loginizer-has-been-acquired-by-softaculous/" target="_blank" style="text-decoration:none;">We are excited to announce that we have joined forces with Softaculous and have been acquired by them 😊. Read full announcement here.</a>', 'loginizer'). '<a class="welcome-panel-close" style="top:3px;right:2px;" href="'.menu_page_url('loginizer', false).'&dismiss_announcement=1" aria-label="Dismiss announcement"></a></div><br />';
1284	}
1285
1286	echo '<div class="welcome-panel">Thank you for choosing Loginizer! Many more features coming soon...   Review Loginizer at WordPress     <a href="https://wordpress.org/support/view/plugin-reviews/loginizer" class="button button-primary" target="_blank">Add Review</a></div><br />';
1287
1288	// Saved ?
1289	if(!empty($GLOBALS['lz_saved'])){
1290	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
1291	}
1292
1293	// Any errors ?
1294	if(!empty($lz_error)){
1295	lz_report_error($lz_error);echo '<br />';
1296	}
1297
1298	?>
1299
1300	<div class="postbox">
1301
1302	<div class="postbox-header">
1303	<h2 class="hndle ui-sortable-handle">
1304	<span><?php echo __('Getting Started', 'loginizer'); ?></span>
1305	</h2>
1306	</div>
1307
1308	<div class="inside">
1309
1310	<form action="" method="post" enctype="multipart/form-data">
1311	<?php wp_nonce_field('loginizer-options'); ?>
1312	<table class="form-table">
1313	<tr>
1314	<td scope="row" valign="top" colspan="2" style="line-height:150%">
1315	<i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
1316	<?php
1317	if(defined('LOGINIZER_PREMIUM')){
1318	echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
1319	}else{
1320	echo '<br><i><a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none;color:red;">Upgrade to Pro</a> for more features like <b>reCAPTCHA, Two Factor Auth, Rename wp-admin and wp-login.php pages, Email based PasswordLess</b> login and more. These features will improve your website\'s security.</i>';
1321	}
1322	?>
1323	</td>
1324	</tr>
1325	</table>
1326	</form>
1327
1328	</div>
1329	</div>
1330
1331	<div class="postbox">
1332
1333	<div class="postbox-header">
1334	<h2 class="hndle ui-sortable-handle">
1335	<span><?php echo __('System Information', 'loginizer'); ?></span>
1336	</h2>
1337	</div>
1338	<div class="inside">
1339
1340	<form action="" method="post" enctype="multipart/form-data">
1341	<?php wp_nonce_field('loginizer-options'); ?>
1342	<table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1343	<?php
1344	echo '
1345	<tr>
1346	<th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1347	<td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (<font color="green">Security PRO Version</font>)' : '').'</td>
1348	</tr>';
1349
1350	do_action('loginizer_system_information');
1351
1352	echo '<tr>
1353	<th align="left">'.__('URL', 'loginizer').'</th>
1354	<td>'.get_site_url().'</td>
1355	</tr>
1356	<tr>
1357	<th align="left">'.__('Path', 'loginizer').'</th>
1358	<td>'.ABSPATH.'</td>
1359	</tr>
1360	<tr>
1361	<th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1362	<td>'.@$_SERVER['SERVER_ADDR'].'</td>
1363	</tr>
1364	<tr>
1365	<th align="left">'.__('Your IP Address', 'loginizer').'</th>
1366	<td>'.lz_getip().'
1367	<div style="float:right">
1368	Method :
1369	<select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1370	<option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1371	<option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1372	<option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1373	<option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1374	</select>
1375	<input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1376	<input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1377	</div>
1378	</td>
1379	</tr>
1380	<tr>
1381	<th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1382	<td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1383	</tr>';
1384
1385	if(file_exists(ABSPATH.'/.htaccess')){
1386	echo '
1387	<tr>
1388	<th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1389	<td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1390	</tr>';
1391
1392	}
1393
1394	?>
1395	</table>
1396	</form>
1397
1398	</div>
1399	</div>
1400
1401	<script type="text/javascript">
1402
1403	function lz_ip_method_handle(){
1404	var ele = jQuery('#lz_ip_method');
1405	if(ele.val() == 3){
1406	jQuery('#lz_custom_ip_method').show();
1407	}else{
1408	jQuery('#lz_custom_ip_method').hide();
1409	}
1410	};
1411
1412	lz_ip_method_handle();
1413
1414	</script>
1415
1416	<div id="" class="postbox">
1417
1418	<div class="postbox-header">
1419	<h2 class="hndle ui-sortable-handle">
1420	<span><?php echo __('File Permissions', 'loginizer'); ?></span>
1421	</h2>
1422	</div>
1423
1424	<div class="inside">
1425
1426	<form action="" method="post" enctype="multipart/form-data">
1427	<?php wp_nonce_field('loginizer-options'); ?>
1428	<table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1429	<?php
1430
1431	echo '
1432	<tr>
1433	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1434	<th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1435	<th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1436	</tr>';
1437
1438	$wp_content = basename(dirname(dirname(dirname(__FILE__))));
1439
1440	$files_to_check = array('/' => array('0755', '0750'),
1441	'/wp-admin' => array('0755'),
1442	'/wp-includes' => array('0755'),
1443	'/wp-config.php' => array('0444'),
1444	'/'.$wp_content => array('0755'),
1445	'/'.$wp_content.'/themes' => array('0755'),
1446	'/'.$wp_content.'/plugins' => array('0755'),
1447	'.htaccess' => array('0444'));
1448
1449	$root = ABSPATH;
1450
1451	foreach($files_to_check as $k => $v){
1452
1453	$path = $root.'/'.$k;
1454	$stat = @stat($path);
1455	$suggested = $v;
1456	$actual = substr(sprintf('%o', $stat['mode']), -4);
1457
1458	echo '
1459	<tr>
1460	<td>'.$k.'</td>
1461	<td>'.current($suggested).'</td>
1462	<td><span '.(!in_array($actual, $suggested) ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1463	</tr>';
1464
1465	}
1466
1467	?>
1468	</table>
1469	</form>
1470
1471	</div>
1472	</div>
1473
1474	<?php
1475
1476	loginizer_page_footer();
1477
1478	}
1479
1480	// The Loginizer Admin Options Page
1481	function loginizer_page_brute_force(){
1482
1483	global $wpdb, $wp_roles, $loginizer;
1484
1485	if(!current_user_can('manage_options')){
1486	wp_die('Sorry, but you do not have permissions to change settings.');
1487	}
1488
1489	/* Make sure post was from this page */
1490	if(count($_POST) > 0){
1491	check_admin_referer('loginizer-options');
1492	}
1493
1494	// BEGIN THEME
1495	loginizer_page_header('Brute Force Settings');
1496
1497	// Load the blacklist and whitelist
1498	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1499	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1500
1501	// Disable Brute Force
1502	if(isset($_POST['disable_brute_lz'])){
1503
1504	// Save the options
1505	update_option('loginizer_disable_brute', 1);
1506
1507	$loginizer['disable_brute'] = 1;
1508
1509	echo '<div id="message" class="updated"><p>'
1510	. __('The Brute Force Protection feature is now disabled', 'loginizer')
1511	. '</p></div><br />';
1512
1513	}
1514
1515	// Enable brute force
1516	if(isset($_POST['enable_brute_lz'])){
1517
1518	// Save the options
1519	update_option('loginizer_disable_brute', 0);
1520
1521	$loginizer['disable_brute'] = 0;
1522
1523	echo '<div id="message" class="updated"><p>'
1524	. __('The Brute Force Protection feature is now enabled', 'loginizer')
1525	. '</p></div><br />';
1526
1527	}
1528
1529	// The Brute Force Settings
1530	if(isset($_POST['save_lz'])){
1531
1532	$max_retries = (int) lz_optpost('max_retries');
1533	$lockout_time = (int) lz_optpost('lockout_time');
1534	$max_lockouts = (int) lz_optpost('max_lockouts');
1535	$lockouts_extend = (int) lz_optpost('lockouts_extend');
1536	$reset_retries = (int) lz_optpost('reset_retries');
1537	$notify_email = (int) lz_optpost('notify_email');
1538	$notify_email_address = lz_optpost('notify_email_address');
1539
1540	if(!empty($notify_email_address) && !lz_valid_email($notify_email_address)){
1541	$error[] = __('Email address is invalid', 'loginizer');
1542	}
1543
1544	$lockout_time = $lockout_time * 60;
1545	$lockouts_extend = $lockouts_extend * 60 * 60;
1546	$reset_retries = $reset_retries * 60 * 60;
1547
1548	if(empty($error)){
1549
1550	$option['max_retries'] = $max_retries;
1551	$option['lockout_time'] = $lockout_time;
1552	$option['max_lockouts'] = $max_lockouts;
1553	$option['lockouts_extend'] = $lockouts_extend;
1554	$option['reset_retries'] = $reset_retries;
1555	$option['notify_email'] = $notify_email;
1556	$option['notify_email_address'] = $notify_email_address;
1557
1558	// Save the options
1559	update_option('loginizer_options', $option);
1560
1561	$saved = true;
1562
1563	}else{
1564	lz_report_error($error);
1565	}
1566
1567	if(!empty($notice)){
1568	lz_report_notice($notice);
1569	}
1570
1571	if(!empty($saved)){
1572	echo '<div id="message" class="updated"><p>'
1573	. __('The settings were saved successfully', 'loginizer')
1574	. '</p></div><br />';
1575	}
1576
1577	}
1578
1579	// Delete a Blackist IP range
1580	if(isset($_POST['bdelid'])){
1581
1582	$delid = (int) lz_optreq('bdelid');
1583
1584	// Unset and save
1585	$blacklist = $loginizer['blacklist'];
1586	unset($blacklist[$delid]);
1587	update_option('loginizer_blacklist', $blacklist);
1588
1589	echo '<div id="message" class="updated fade"><p>'
1590	. __('The Blacklist IP range has been deleted successfully', 'loginizer')
1591	. '</p></div><br />';
1592
1593	}
1594
1595	// Delete all Blackist IP ranges
1596	if(isset($_POST['del_all_blacklist'])){
1597
1598	// Unset and save
1599	update_option('loginizer_blacklist', array());
1600
1601	echo '<div id="message" class="updated fade"><p>'
1602	. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1603	. '</p></div><br />';
1604
1605	}
1606
1607	// Delete a Whitelist IP range
1608	if(isset($_POST['delid'])){
1609
1610	$delid = (int) lz_optreq('delid');
1611
1612	// Unset and save
1613	$whitelist = $loginizer['whitelist'];
1614	unset($whitelist[$delid]);
1615	update_option('loginizer_whitelist', $whitelist);
1616
1617	echo '<div id="message" class="updated fade"><p>'
1618	. __('The Whitelist IP range has been deleted successfully', 'loginizer')
1619	. '</p></div><br />';
1620
1621	}
1622
1623	// Delete all Blackist IP ranges
1624	if(isset($_POST['del_all_whitelist'])){
1625
1626	// Unset and save
1627	update_option('loginizer_whitelist', array());
1628
1629	echo '<div id="message" class="updated fade"><p>'
1630	. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1631	. '</p></div><br />';
1632
1633	}
1634
1635	// Reset All Logs
1636	if(isset($_POST['lz_reset_all_ip'])){
1637
1638	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` > 0");
1639
1640	echo '<div id="message" class="updated fade"><p>'
1641	. __('All the IP Logs have been cleared', 'loginizer')
1642	. '</p></div><br />';
1643	}
1644
1645	// Reset Logs
1646	if(isset($_POST['lz_reset_ip']) && isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1647
1648	$ips = $_POST['lz_reset_ips'];
1649
1650	foreach($ips as $ip){
1651	if(!lz_valid_ip($ip)){
1652	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1653	}
1654	}
1655
1656	if(count($ips) < 1){
1657	$error[] = __('There are no IPs submitted', 'loginizer');
1658	}
1659
1660	// Should we start deleting logs
1661	if(empty($error)){
1662
1663	foreach($ips as $ip){
1664	$result = $wpdb->query($wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $ip));
1665	}
1666
1667	if(empty($error)){
1668
1669	echo '<div id="message" class="updated fade"><p>'
1670	. __('The selected IP Logs have been reset', 'loginizer')
1671	. '</p></div><br />';
1672
1673	}
1674
1675	}
1676
1677	if(!empty($error)){
1678	lz_report_error($error);echo '<br />';
1679	}
1680
1681	}
1682
1683	if(isset($_POST['blacklist_iprange'])){
1684
1685	$start_ip = lz_optpost('start_ip');
1686	$end_ip = lz_optpost('end_ip');
1687
1688	// If no end IP we consider only 1 IP
1689	if(empty($end_ip)){
1690	$end_ip = $start_ip;
1691	}
1692
1693	// Validate the IP against all checks
1694	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['blacklist'], $error);
1695
1696	if(empty($error)){
1697
1698	$blacklist = $loginizer['blacklist'];
1699
1700	$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1701
1702	$blacklist[$newid] = array();
1703	$blacklist[$newid]['start'] = $start_ip;
1704	$blacklist[$newid]['end'] = $end_ip;
1705	$blacklist[$newid]['time'] = time();
1706
1707	update_option('loginizer_blacklist', $blacklist);
1708
1709	echo '<div id="message" class="updated fade"><p>'
1710	. __('Blacklist IP range added successfully', 'loginizer')
1711	. '</p></div><br />';
1712
1713	}
1714
1715	if(!empty($error)){
1716	lz_report_error($error);echo '<br />';
1717	}
1718
1719	}
1720
1721	if(isset($_POST['whitelist_iprange'])){
1722
1723	$start_ip = lz_optpost('start_ip_w');
1724	$end_ip = lz_optpost('end_ip_w');
1725
1726	// If no end IP we consider only 1 IP
1727	if(empty($end_ip)){
1728	$end_ip = $start_ip;
1729	}
1730
1731	// Validate the IP against all checks
1732	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['whitelist'], $error);
1733
1734	if(empty($error)){
1735
1736	$whitelist = $loginizer['whitelist'];
1737
1738	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1739
1740	$whitelist[$newid] = array();
1741	$whitelist[$newid]['start'] = $start_ip;
1742	$whitelist[$newid]['end'] = $end_ip;
1743	$whitelist[$newid]['time'] = time();
1744
1745	update_option('loginizer_whitelist', $whitelist);
1746
1747	echo '<div id="message" class="updated fade"><p>'
1748	. __('Whitelist IP range added successfully', 'loginizer')
1749	. '</p></div><br />';
1750
1751	}
1752
1753	if(!empty($error)){
1754	lz_report_error($error);echo '<br />';
1755	}
1756	}
1757
1758	if(isset($_POST['lz_import_csv'])){
1759
1760	if(!empty($_FILES['lz_import_file_csv']['name'])){
1761
1762	$lz_csv_type = lz_optpost('lz_csv_type');
1763
1764	// Is the submitted type in the allowed list ?
1765	if(!in_array($lz_csv_type, array('blacklist', 'whitelist'))){
1766	$error[] = __('Invalid import type', 'loginizer');
1767	}
1768
1769	if(empty($error)){
1770
1771	//Get the extension of the file
1772	$csv_file_name = basename($_FILES['lz_import_file_csv']['name']);
1773	$csv_ext_name = strtolower(pathinfo($csv_file_name, PATHINFO_EXTENSION));
1774
1775	//Check if it's a csv file
1776	if($csv_ext_name == 'csv'){
1777
1778	$file = fopen($_FILES['lz_import_file_csv']['tmp_name'], "r");
1779
1780	$line_count = 0;
1781	$update_record = 0;
1782
1783	while($content = fgetcsv($file)){
1784
1785	//Increment the $line_count
1786	$line_count++;
1787
1788	//Skip the first line
1789	if($line_count <= 1){
1790	continue;
1791	}
1792
1793	if(loginizer_iprange_validate($content[0], $content[1], $loginizer[$lz_csv_type], $error, $line_count)){
1794
1795	$newid = ( empty($loginizer[$lz_csv_type]) ? 0 : max(array_keys($loginizer[$lz_csv_type])) ) + 1;
1796
1797	$loginizer[$lz_csv_type][$newid] = array();
1798	$loginizer[$lz_csv_type][$newid]['start'] = $content[0];
1799	$loginizer[$lz_csv_type][$newid]['end'] = $content[1];
1800	$loginizer[$lz_csv_type][$newid]['time'] = time();
1801
1802	$update_record = 1;
1803
1804	}
1805	}
1806
1807	fclose($file);
1808
1809	if(!empty($update_record)){
1810
1811	update_option('loginizer_'.$lz_csv_type, $loginizer[$lz_csv_type]);
1812
1813	echo '<div id="message" class="updated fade"><p>'
1814	. __('Imported '.ucfirst($lz_csv_type).' IP range(s) successfully', 'loginizer')
1815	. '</p></div><br />';
1816
1817	}
1818
1819	if(!empty($error)){
1820	lz_report_error($error);echo '<br />';
1821	}
1822	}
1823
1824	}
1825	}
1826	}
1827
1828	//Brute Force Bulk Blacklist/ Whitelist Ip
1829	if(isset($_POST['lz_blacklist_selected_ip'])){
1830	if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1831
1832	$ips = $_POST['lz_reset_ips'];
1833
1834	foreach($ips as $ip){
1835	if(!lz_valid_ip($ip)){
1836	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1837	}
1838	}
1839
1840	if(count($ips) < 1){
1841	$error[] = __('There are no IPs submitted', 'loginizer');
1842	}
1843
1844	// Should we start deleting logs
1845	if(empty($error)){
1846
1847	$update_record = 0;
1848
1849	foreach($ips as $ip){
1850
1851	if(loginizer_iprange_validate($ip, '', $loginizer['blacklist'], $error)){
1852
1853	$newid = ( empty($loginizer['blacklist']) ? 0 : max(array_keys($loginizer['blacklist'])) ) + 1;
1854
1855	$loginizer['blacklist'][$newid] = array();
1856	$loginizer['blacklist'][$newid]['start'] = $ip;
1857	$loginizer['blacklist'][$newid]['end'] = $ip;
1858	$loginizer['blacklist'][$newid]['time'] = time();
1859
1860	$update_record = 1;
1861	}
1862	}
1863
1864	if(!empty($update_record)){
1865
1866	update_option('loginizer_blacklist', $loginizer['blacklist']);
1867
1868	echo '<div id="message" class="updated fade"><p>'
1869	. __('The selected IP(s) have been blacklisted', 'loginizer')
1870	. '</p></div><br />';
1871
1872	}
1873
1874	}
1875	}else{
1876	$error[] = __('No IP(s) selected', 'loginizer');
1877	}
1878
1879	if(!empty($error)){
1880	lz_report_error($error);echo '<br />';
1881	}
1882	}
1883
1884	// Save the messages
1885	if(isset($_POST['save_err_msgs_lz'])){
1886
1887	$msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1888	$msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1889	$msgs['attempts_left'] = lz_optpost('msg_attempts_left');
1890	$msgs['lockout_err'] = lz_optpost('msg_lockout_err');
1891	$msgs['minutes_err'] = lz_optpost('msg_minutes_err');
1892	$msgs['hours_err'] = lz_optpost('msg_hours_err');
1893
1894	// Update them
1895	update_option('loginizer_msg', $msgs);
1896
1897	echo '<div id="message" class="updated fade"><p>'
1898	. __('Error messages were saved successfully', 'loginizer')
1899	. '</p></div><br />';
1900
1901	}
1902
1903	// Count the Results
1904	$tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1905	//print_r($tmp);
1906
1907	// Which Page is it
1908	$lz_env['res_len'] = 10;
1909	$lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1910	$lz_env['num_res'] = $tmp['num'];
1911	$lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1912
1913	// Get the logs
1914	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1915	ORDER BY `time` DESC
1916	LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1917	//print_r($result);
1918
1919	$lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1920	$lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1921	$lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1922	$lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1923
1924	// Reload the settings
1925	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1926	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1927
1928	$saved_msgs = get_option('loginizer_msg');
1929
1930	?>
1931
1932	<div id="" class="postbox">
1933
1934	<div class="postbox-header">
1935	<h2 class="hndle ui-sortable-handle">
1936	<?php echo __('<span>Failed Login Attempts Logs</span>   (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1937	</h2>
1938	</div>
1939
1940	<script>
1941	function yesdsd(){
1942	window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1943	return false;
1944	}
1945
1946	function lz_export_ajax(lz_csv_type){
1947
1948	var data = new Object();
1949	data["action"] = lz_csv_type != "failed_login" ? "loginizer_export" : "loginizer_failed_login_export";
1950	data["lz_csv_type"] = lz_csv_type;
1951	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax'); ?>";
1952
1953	var admin_url = "<?php admin_url(); ?>"+"admin-ajax.php";
1954
1955	jQuery.post(admin_url, data, function(response){
1956
1957	// Was the ajax call successful ?
1958	if(response.substring(0,2) == "-1"){
1959
1960	var err_message = response.substring(2);
1961
1962	if(err_message){
1963	alert(err_message);
1964	}else{
1965	alert("Failed to export data");
1966	}
1967
1968	return false;
1969	}
1970
1971	/*
1972	* Make CSV downloadable
1973	*/
1974	var downloadLink = document.createElement("a");
1975	var fileData = ['\ufeff'+response];
1976
1977	var blobObject = new Blob(fileData,{
1978	type: "text/csv;charset=utf-8;"
1979	});
1980
1981	var url = URL.createObjectURL(blobObject);
1982	downloadLink.href = url;
1983	downloadLink.download = "loginizer-"+lz_csv_type+".csv";
1984
1985	/*
1986	* Actually download CSV
1987	*/
1988	document.body.appendChild(downloadLink);
1989	downloadLink.click();
1990	document.body.removeChild(downloadLink);
1991
1992	});
1993
1994	}
1995
1996	</script>
1997
1998	<form method="get" onsubmit="return yesdsd();">
1999	<div class="tablenav">
2000	<p class="tablenav-pages" style="margin: 5px 10px" align="right">
2001	<span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
2002	<span class="pagination-links">
2003	<a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
2004	<a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
2005	<span class="paging-input">
2006	<label for="current-page-selector" class="screen-reader-text">Current Page</label>
2007	<input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
2008	</span>
2009	<a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
2010	<a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
2011	</span>
2012	</p>
2013	</div>
2014	</form>
2015
2016	<form action="" method="post" enctype="multipart/form-data">
2017	<?php wp_nonce_field('loginizer-options'); ?>
2018	<div class="inside">
2019	<table class="wp-list-table widefat fixed users" border="0">
2020	<tr>
2021	<th scope="row" valign="top" style="background:#EFEFEF;" width="20"><input type="checkbox" id="lz_check_all_logs" onchange="lz_multiple_check()" style="margin-left:-1px;"/></th>
2022	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
2023	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
2024	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
2025	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
2026	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
2027	<th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
2028	</tr>
2029	<?php
2030
2031	if(empty($result)){
2032	echo '
2033	<tr>
2034	<td colspan="4">
2035	'.__('No Logs. You will see logs about failed login attempts here.', 'loginizer').'
2036	</td>
2037	</tr>';
2038	}else{
2039	foreach($result as $ik => $iv){
2040	$status_button = (!empty($iv['status']) ? 'disable' : 'enable');
2041	echo '
2042	<tr>
2043	<td>
2044	<input type="checkbox" value="'.esc_attr($iv['ip']).'" name="lz_reset_ips[]" class="lz_shift_select_logs lz_check_all_logs" />
2045	</td>
2046	<td>
2047	<a href="https://ipinfo.io/'.esc_html($iv['ip']).'" target="_blank">'.esc_html($iv['ip']).' <span class="dashicons dashicons-external"></span></a>
2048	</td>
2049	<td>
2050	'.esc_html($iv['username']).'
2051	</td>
2052	<td>
2053	'.date('d/M/Y H:i:s P', $iv['time']).'
2054	</td>
2055	<td>
2056	'.esc_html($iv['count']).'
2057	</td>
2058	<td>
2059	'.esc_html($iv['lockout']).'
2060	</td>
2061	<td>
2062	'.esc_html($iv['url']).'
2063	</td>
2064	</tr>';
2065	}
2066	}
2067
2068	?>
2069	</table>
2070
2071	<br>
2072	<input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
2073
2074	<input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
2075
2076	<input name="lz_blacklist_selected_ip" class="button button-primary action" value="<?php echo __('Blacklist Selected IPs', 'loginizer'); ?>" type="submit" />
2077
2078	<input name="lz_export_csv" onclick="lz_export_ajax('failed_login'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2079	</div>
2080	</div>
2081	</form>
2082	<br />
2083
2084	<div id="" class="postbox">
2085
2086	<div class="postbox-header">
2087	<h2 class="hndle ui-sortable-handle">
2088	<span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
2089	</h2>
2090	</div>
2091
2092	<div class="inside">
2093
2094	<form action="" method="post" enctype="multipart/form-data">
2095	<?php wp_nonce_field('loginizer-options'); ?>
2096	<table class="form-table">
2097	<tr>
2098	<th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
2099	<td>
2100	<input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
2101	</td>
2102	</tr>
2103	<tr>
2104	<th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
2105	<td>
2106	<input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
2107	</td>
2108	</tr>
2109	<tr>
2110	<th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
2111	<td>
2112	<input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
2113	</td>
2114	</tr>
2115	<tr>
2116	<th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
2117	<td>
2118	<input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
2119	</td>
2120	</tr>
2121	<tr>
2122	<th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
2123	<td>
2124	<input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
2125	</td>
2126	</tr>
2127	<tr>
2128	<th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
2129	<td>
2130	<?php echo __('after ','loginizer'); ?>
2131	<input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
2132	</td>
2133	</tr>
2134	<tr>
2135	<th scope="row" valign="top"><label for="notify_email_address"><?php echo __('Email Address','loginizer'); ?></label></th>
2136	<td>
2137	<input type="text" value="<?php echo (!empty($notify_email_address) ? $notify_email_address : (!empty($loginizer['custom_notify_email']) ? $loginizer['notify_email_address'] : '')); ?>" name="notify_email_address" id="notify_email_address" size="30" /> <?php echo __('<br />failed login attempts notifications will be sent to this email','loginizer'); ?>
2138	</td>
2139	</tr>
2140	</table><br />
2141	<input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2142	<?php
2143
2144	if(empty($loginizer['disable_brute'])){
2145
2146	echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2147
2148	}else{
2149
2150	echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2151
2152	}
2153
2154	?>
2155	</form>
2156
2157	</div>
2158	</div>
2159	<br />
2160
2161	<?php
2162
2163	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
2164
2165	?>
2166
2167	<style>
2168	.page-navigation a {
2169	margin: 5px 2px;
2170	display: inline-block;
2171	padding: 5px 8px;
2172	color: #0073aa;
2173	background: #e5e5e5 none repeat scroll 0 0;
2174	border: 1px solid #ccc;
2175	text-decoration: none;
2176	transition-duration: 0.05s;
2177	transition-property: border, background, color;
2178	transition-timing-function: ease-in-out;
2179	}
2180
2181	.page-navigation a[data-selected] {
2182	background-color: #00a0d2;
2183	color: #fff;
2184	}
2185	</style>
2186
2187	<script>
2188
2189	jQuery(document).ready(function(){
2190	jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
2191	jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
2192	lz_multiple_check();
2193	lz_shift_check_all('lz_shift_select_logs');
2194	});
2195
2196	// Delete a Blacklist / Whitelist IP Range
2197	function del_confirm(field, todo_id, msg){
2198	var ret = confirm(msg);
2199
2200	if(ret){
2201	jQuery('#lz_bl_wl_todo').attr('name', field);
2202	jQuery('#lz_bl_wl_todo').val(todo_id);
2203	jQuery('#lz_bl_wl_form').submit();
2204	}
2205
2206	return false;
2207
2208	}
2209
2210	// Delete all Blacklist / Whitelist IP Ranges
2211	function del_confirm_all(msg){
2212	var ret = confirm(msg);
2213
2214	if(ret){
2215	return true;
2216	}
2217
2218	return false;
2219
2220	}
2221
2222	//Check all the failed log attempts
2223	function lz_multiple_check(){
2224	jQuery("#lz_check_all_logs").on("click", function(event){
2225	if(this.checked == true){
2226	jQuery(".lz_check_all_logs").prop("checked", true);
2227	}else{
2228	jQuery(".lz_check_all_logs").prop("checked", false);
2229	}
2230	});
2231	}
2232
2233	//To select the installations/backups using shift key
2234	function lz_shift_check_all(check_class){
2235
2236	var checkboxes = jQuery("."+check_class);
2237	var lastChecked = null;
2238
2239	checkboxes.click(function(event){
2240	if(!lastChecked){
2241	lastChecked = this;
2242	return;
2243	}
2244
2245	if(event.shiftKey){
2246	var start = checkboxes.index(this);
2247	var end = checkboxes.index(lastChecked);
2248
2249	checkboxes.slice(Math.min(start,end), Math.max(start,end)+ 1).prop("checked", this.checked);
2250	}
2251
2252	lastChecked = this;
2253	});
2254	};
2255
2256	</script>
2257
2258	<div id="" class="postbox">
2259
2260	<div class="postbox-header">
2261	<h2 class="hndle ui-sortable-handle">
2262	<span><?php echo __('Blacklist IP','loginizer'); ?></span>
2263	</h2>
2264	</div>
2265
2266	<div class="inside">
2267
2268	<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
2269
2270	<form action="" method="post">
2271	<?php wp_nonce_field('loginizer-options'); ?>
2272	<table class="form-table">
2273	<tr>
2274	<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
2275	<td>
2276	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2277	</td>
2278	</tr>
2279	<tr>
2280	<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2281	<td>
2282	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
2283	</td>
2284	</tr>
2285	</table><br />
2286	<input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
2287	<input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
2288	</form>
2289	</div>
2290
2291	<div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
2292
2293	<!--Brute Force Blacklist Import CSV Form-->
2294	<div class="inside" id="blacklist_csv" style="display:none;">
2295	<form action="" method="post" enctype="multipart/form-data">
2296	<?php wp_nonce_field('loginizer-options'); ?>
2297	<input type="hidden" value="blacklist" name="lz_csv_type" />
2298	<h3><?php echo __('Import Blacklist IPs (CSV)', 'loginizer'); ?>:</h3>
2299	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2300	<br><br>
2301	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2302	</form>
2303	</div>
2304	<!---->
2305
2306	<!--Brute Force Blacklist Export CSV Form-->
2307	<div class="inside" style="float:right;">
2308	<form action="" method="post">
2309	<?php wp_nonce_field('loginizer-options'); ?>
2310	<input type="hidden" value="blacklist" name="lz_csv_type" />
2311	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#blacklist_csv').toggle();"/>
2312	<input name="lz_export_csv" onclick="lz_export_ajax('blacklist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2313	</form>
2314
2315	</div>
2316	<!---->
2317
2318	<table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2319	<tr>
2320	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2321	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2322	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2323	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2324	</tr>
2325	<?php
2326	if(empty($loginizer['blacklist'])){
2327	echo '
2328	<tr>
2329	<td colspan="4">
2330	'.__('No Blacklist IPs. You will see blacklisted IP ranges here.', 'loginizer').'
2331	</td>
2332	</tr>';
2333	}else{
2334	foreach($loginizer['blacklist'] as $ik => $iv){
2335	echo '
2336	<tr>
2337	<td>
2338	'.$iv['start'].'
2339	</td>
2340	<td>
2341	'.$iv['end'].'
2342	</td>
2343	<td>
2344	'.date('d/m/Y', $iv['time']).'
2345	</td>
2346	<td>
2347	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2348	</td>
2349	</tr>';
2350	}
2351	}
2352	?>
2353	</table>
2354	<br />
2355	<form action="" method="post" id="lz_bl_wl_form">
2356	<?php wp_nonce_field('loginizer-options'); ?>
2357	<input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2358	</form>
2359	</div>
2360
2361	<br />
2362
2363	<div id="" class="postbox">
2364
2365	<div class="postbox-header">
2366	<h2 class="hndle ui-sortable-handle">
2367	<span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2368	</h2>
2369	</div>
2370
2371	<div class="inside">
2372
2373	<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2374	<form action="" method="post">
2375	<?php wp_nonce_field('loginizer-options'); ?>
2376	<table class="form-table">
2377	<tr>
2378	<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2379	<td>
2380	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2381	</td>
2382	</tr>
2383	<tr>
2384	<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2385	<td>
2386	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2387	</td>
2388	</tr>
2389	</table><br />
2390	<input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2391	<input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2392	</form>
2393	</div>
2394
2395	<div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2396
2397	<!--Brute Force Whitelist Import CSV Form-->
2398	<div class="inside" id="lz_whitelist_csv_div" style="display:none;">
2399	<form action="" method="post" enctype="multipart/form-data">
2400	<?php wp_nonce_field('loginizer-options'); ?>
2401	<input type="hidden" value="whitelist" name="lz_csv_type" />
2402	<h3><?php echo __('Import Whitelist IPs (CSV)', 'loginizer'); ?>:</h3>
2403	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2404	<br><br>
2405	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2406	</form>
2407	</div>
2408	<!---->
2409
2410	<!--Brute Force Whitelist Export CSV Form-->
2411	<div class="inside" style="float:right;">
2412	<form action="" method="post">
2413	<?php wp_nonce_field('loginizer-options'); ?>
2414	<input type="hidden" value="whitelist" name="lz_csv_type" />
2415	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#lz_whitelist_csv_div').toggle();"/>
2416	<input name="lz_export_csv" onclick="lz_export_ajax('whitelist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2417	</form>
2418	</div>
2419	<!---->
2420
2421	<table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2422	<tr>
2423	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2424	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2425	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2426	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2427	</tr>
2428	<?php
2429	if(empty($loginizer['whitelist'])){
2430	echo '
2431	<tr>
2432	<td colspan="4">
2433	'.__('No Whitelist IPs. You will see whitelisted IP ranges here.', 'loginizer').'
2434	</td>
2435	</tr>';
2436	}else{
2437	foreach($loginizer['whitelist'] as $ik => $iv){
2438	echo '
2439	<tr>
2440	<td>
2441	'.$iv['start'].'
2442	</td>
2443	<td>
2444	'.$iv['end'].'
2445	</td>
2446	<td>
2447	'.date('d/m/Y', $iv['time']).'
2448	</td>
2449	<td>
2450	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2451	</td>
2452	</tr>';
2453	}
2454	}
2455	?>
2456	</table>
2457	<br />
2458
2459	</div>
2460
2461	<div id="" class="postbox">
2462
2463	<div class="postbox-header">
2464	<h2 class="hndle ui-sortable-handle">
2465	<span><?php echo __('Error Messages', 'loginizer'); ?></span>
2466	</h2>
2467	</div>
2468
2469	<div class="inside">
2470
2471	<form action="" method="post" enctype="multipart/form-data">
2472	<?php wp_nonce_field('loginizer-options'); ?>
2473	<table class="form-table">
2474	<tr>
2475	<th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2476	<td>
2477	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2478	<?php echo __('Default: <em>"' . $loginizer['d_msg']['inv_userpass']. '"</em>', 'loginizer'); ?><br />
2479	</td>
2480	</tr>
2481	<tr>
2482	<th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2483	<td>
2484	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2485	<?php echo __('Default: <em>"' . $loginizer['d_msg']['ip_blacklisted']. '"</em>', 'loginizer'); ?><br />
2486	</td>
2487	</tr>
2488	<tr>
2489	<th scope="row" valign="top"><label for="msg_attempts_left"><?php echo __('Attempts Left','loginizer'); ?></label></th>
2490	<td>
2491	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['attempts_left']); ?>" name="msg_attempts_left" id="msg_attempts_left" />
2492	<?php echo __('Default: <em>"' . $loginizer['d_msg']['attempts_left']. '"</em>', 'loginizer'); ?><br />
2493	</td>
2494	</tr>
2495	<tr>
2496	<th scope="row" valign="top"><label for="msg_lockout_err"><?php echo __('Lockout Error','loginizer'); ?></label></th>
2497	<td>
2498	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['lockout_err']); ?>" name="msg_lockout_err" id="msg_lockout_err" />
2499	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['lockout_err']). '"</em>', 'loginizer'); ?><br />
2500	</td>
2501	</tr>
2502	<tr>
2503	<th scope="row" valign="top"><label for="msg_minutes_err"><?php echo __('Minutes','loginizer'); ?></label></th>
2504	<td>
2505	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['minutes_err']); ?>" name="msg_minutes_err" id="msg_minutes_err" />
2506	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['minutes_err']). '"</em>', 'loginizer'); ?><br />
2507	</td>
2508	</tr>
2509	<tr>
2510	<th scope="row" valign="top"><label for="msg_hours_err"><?php echo __('Hours','loginizer'); ?></label></th>
2511	<td>
2512	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['hours_err']); ?>" name="msg_hours_err" id="msg_hours_err" />
2513	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['hours_err']). '"</em>', 'loginizer'); ?><br />
2514	</td>
2515	</tr>
2516	</table><br />
2517	<input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2518	</form>
2519	</div>
2520	</div>
2521	<?php
2522
2523	loginizer_page_footer();
2524
2525	}
2526
2527	add_action('wp_ajax_loginizer_export', 'loginizer_export');
2528
2529	// Export CSV
2530	function loginizer_export(){
2531
2532	// Some AJAX security
2533	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2534
2535	if(!current_user_can('manage_options')){
2536	wp_die('Sorry, but you do not have permissions to change settings.');
2537	}
2538
2539	$lz_csv_type = lz_optpost('lz_csv_type');
2540
2541	switch($lz_csv_type){
2542
2543	case 'blacklist':
2544	$csv_array = get_option('loginizer_blacklist');
2545	$filename = 'loginizer-blacklist';
2546	break;
2547
2548	case 'whitelist':
2549	$csv_array = get_option('loginizer_whitelist');
2550	$filename = 'loginizer-whitelist';
2551	break;
2552	}
2553
2554	if(empty($csv_array)){
2555	echo -1;
2556	echo __('No data to export', 'loginizer');
2557	wp_die();
2558	}
2559
2560	header('Content-Type: text/csv; charset=utf-8');
2561	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2562
2563	$allowed_fields = array('start' => 'Start IP', 'end' => 'End IP', 'time' => 'Time');
2564
2565	$file = fopen("php://output","w");
2566
2567	fputcsv($file, array_values($allowed_fields));
2568
2569	foreach($csv_array as $ik => $iv){
2570
2571	$iv['start'] = $iv['start'];
2572	$iv['end'] = $iv['end'];
2573	$iv['time'] = date('d/m/Y', $iv['time']);
2574
2575	$row = array();
2576	foreach($allowed_fields as $ak => $av){
2577	$row[$ak] = $iv[$ak];
2578	}
2579
2580	fputcsv($file, $row);
2581	}
2582
2583	fclose($file);
2584
2585	wp_die();
2586
2587	}
2588
2589	add_action('wp_ajax_loginizer_failed_login_export', 'loginizer_failed_login_export');
2590
2591	//Export Failed Login Attempts
2592	function loginizer_failed_login_export(){
2593
2594	global $wpdb;
2595	// Some AJAX security
2596	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2597
2598	if(!current_user_can('manage_options')){
2599	wp_die('Sorry, but you do not have permissions to change settings.');
2600	}
2601
2602	$csv_array = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `time` DESC", 1);
2603	$filename = 'loginizer-failed-login-attempts';
2604
2605	if(empty($csv_array)){
2606	echo -1;
2607	echo __('No data to export', 'loginizer');
2608	wp_die();
2609	}
2610
2611	header('Content-Type: text/csv; charset=utf-8');
2612	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2613
2614	$allowed_fields = array('ip' => 'IP', 'attempted_username' => 'Attempted Username', 'last_f_attemp' => 'Last Failed Attempt', 'f_attempts_count' => 'Failed Attempts Count', 'lockouts_count' => 'Lockouts Count', 'url_attacked' => 'URL Attacked');
2615
2616	$file = fopen("php://output","w");
2617
2618	fputcsv($file, array_values($allowed_fields));
2619
2620	foreach($csv_array as $failed_attempts){
2621
2622	$row = array($failed_attempts['ip'], $failed_attempts['username'], date('d/M/Y H:i:s P', $failed_attempts['time']), $failed_attempts['count'], $failed_attempts['lockout'], $failed_attempts['url']);
2623	fputcsv($file, $row);
2624	}
2625
2626
2627	fclose($file);
2628
2629	wp_die();
2630
2631	}
2632
2633	// IP range validations
2634	function loginizer_iprange_validate($start_ip, $end_ip, $cur_list, &$error = array(), $line_count = ''){
2635
2636	$line_error = '';
2637	if(!empty($line_count)){
2638	$line_error = ' '.__('Line no.', 'loginizer').' '.$line_count;
2639	}
2640
2641	if(empty($start_ip)){
2642	$cur_error[] = __('Please enter the Start IP', 'loginizer').$line_error;
2643	}
2644
2645	// If no end IP we consider only 1 IP
2646	if(empty($end_ip)){
2647	$end_ip = $start_ip;
2648	}
2649
2650	if(!lz_valid_ip($start_ip)){
2651	$cur_error[] = __('Please provide a valid start IP', 'loginizer').$line_error;
2652	}
2653
2654	if(!lz_valid_ip($end_ip)){
2655	$cur_error[] = __('Please provide a valid end IP', 'loginizer').$line_error;
2656	}
2657
2658	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
2659
2660	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
2661	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
2662	// This is right
2663	}else{
2664	$cur_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer').$line_error;
2665	}
2666
2667	}
2668
2669	if(!empty($cur_error)){
2670
2671	foreach($cur_error as $rk => $rv){
2672	$error[] = $rv;
2673	}
2674
2675	return false;
2676	}
2677
2678	if(!empty($cur_list)){
2679
2680	foreach($cur_list as $k => $v){
2681
2682	// This is to check if there is any other range exists with the same Start or End IP
2683	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
2684	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
2685	){
2686	$cur_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer').$line_error;
2687	break;
2688	}
2689
2690	// This is to check if there is any other range exists with the same Start IP
2691	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
2692	$cur_error[] = __('The Start IP is present in an existing range !', 'loginizer').$line_error;
2693	break;
2694	}
2695
2696	// This is to check if there is any other range exists with the same End IP
2697	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
2698	$cur_error[] = __('The End IP is present in an existing range!', 'loginizer').$line_error;
2699	break;
2700	}
2701
2702	}
2703
2704	}
2705
2706	if(!empty($cur_error)){
2707
2708	foreach($cur_error as $rk => $rv){
2709	$error[] = $rv;
2710	}
2711
2712	return false;
2713	}
2714
2715	return true;
2716	}
2717
2718	//---------------------
2719	// Admin Menu Pro Pages
2720	//---------------------
2721
2722	// Loginizer - reCaptcha Page
2723	function loginizer_page_recaptcha(){
2724
2725	global $loginizer, $lz_error, $lz_env;
2726
2727	if(!current_user_can('manage_options')){
2728	wp_die('Sorry, but you do not have permissions to change settings.');
2729	}
2730
2731	if(!loginizer_is_premium() && count($_POST) > 0){
2732	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
2733	return loginizer_page_recaptcha_T();
2734	}
2735
2736	/* Make sure post was from this page */
2737	if(count($_POST) > 0){
2738	check_admin_referer('loginizer-options');
2739	}
2740
2741	// Themes
2742	$lz_env['theme']['light'] = 'Light';
2743	$lz_env['theme']['dark'] = 'Dark';
2744
2745	// Langs
2746	$lz_env['lang'][''] = 'Auto Detect';
2747	$lz_env['lang']['ar'] = 'Arabic';
2748	$lz_env['lang']['bg'] = 'Bulgarian';
2749	$lz_env['lang']['ca'] = 'Catalan';
2750	$lz_env['lang']['zh-CN'] = 'Chinese (Simplified)';
2751	$lz_env['lang']['zh-TW'] = 'Chinese (Traditional)';
2752	$lz_env['lang']['hr'] = 'Croatian';
2753	$lz_env['lang']['cs'] = 'Czech';
2754	$lz_env['lang']['da'] = 'Danish';
2755	$lz_env['lang']['nl'] = 'Dutch';
2756	$lz_env['lang']['en-GB'] = 'English (UK)';
2757	$lz_env['lang']['en'] = 'English (US)';
2758	$lz_env['lang']['fil'] = 'Filipino';
2759	$lz_env['lang']['fi'] = 'Finnish';
2760	$lz_env['lang']['fr'] = 'French';
2761	$lz_env['lang']['fr-CA'] = 'French (Canadian)';
2762	$lz_env['lang']['de'] = 'German';
2763	$lz_env['lang']['de-AT'] = 'German (Austria)';
2764	$lz_env['lang']['de-CH'] = 'German (Switzerland)';
2765	$lz_env['lang']['el'] = 'Greek';
2766	$lz_env['lang']['iw'] = 'Hebrew';
2767	$lz_env['lang']['hi'] = 'Hindi';
2768	$lz_env['lang']['hu'] = 'Hungarain';
2769	$lz_env['lang']['id'] = 'Indonesian';
2770	$lz_env['lang']['it'] = 'Italian';
2771	$lz_env['lang']['ja'] = 'Japanese';
2772	$lz_env['lang']['ko'] = 'Korean';
2773	$lz_env['lang']['lv'] = 'Latvian';
2774	$lz_env['lang']['lt'] = 'Lithuanian';
2775	$lz_env['lang']['no'] = 'Norwegian';
2776	$lz_env['lang']['fa'] = 'Persian';
2777	$lz_env['lang']['pl'] = 'Polish';
2778	$lz_env['lang']['pt'] = 'Portuguese';
2779	$lz_env['lang']['pt-BR'] = 'Portuguese (Brazil)';
2780	$lz_env['lang']['pt-PT'] = 'Portuguese (Portugal)';
2781	$lz_env['lang']['ro'] = 'Romanian';
2782	$lz_env['lang']['ru'] = 'Russian';
2783	$lz_env['lang']['sr'] = 'Serbian';
2784	$lz_env['lang']['sk'] = 'Slovak';
2785	$lz_env['lang']['sl'] = 'Slovenian';
2786	$lz_env['lang']['es'] = 'Spanish';
2787	$lz_env['lang']['es-419'] = 'Spanish (Latin America)';
2788	$lz_env['lang']['sv'] = 'Swedish';
2789	$lz_env['lang']['th'] = 'Thai';
2790	$lz_env['lang']['tr'] = 'Turkish';
2791	$lz_env['lang']['uk'] = 'Ukrainian';
2792	$lz_env['lang']['vi'] = 'Vietnamese';
2793
2794	// Sizes
2795	$lz_env['size']['normal'] = 'Normal';
2796	$lz_env['size']['compact'] = 'Compact';
2797
2798	if(isset($_POST['save_lz'])){
2799
2800	// Google Captcha
2801	$option['captcha_type'] = lz_optpost('captcha_type');
2802	$option['captcha_key'] = lz_optpost('captcha_key');
2803	$option['captcha_secret'] = lz_optpost('captcha_secret');
2804	$option['captcha_theme'] = lz_optpost('captcha_theme');
2805	$option['captcha_size'] = lz_optpost('captcha_size');
2806	$option['captcha_lang'] = lz_optpost('captcha_lang');
2807
2808	// No Google Captcha
2809	$option['captcha_text'] = lz_optpost('captcha_text');
2810	$option['captcha_time'] = (int) lz_optpost('captcha_time');
2811	$option['captcha_words'] = (int) lz_optpost('captcha_words');
2812	$option['captcha_add'] = (int) lz_optpost('captcha_add');
2813	$option['captcha_subtract'] = (int) lz_optpost('captcha_subtract');
2814	$option['captcha_multiply'] = (int) lz_optpost('captcha_multiply');
2815	$option['captcha_divide'] = (int) lz_optpost('captcha_divide');
2816
2817	// Checkboxes
2818	$option['captcha_user_hide'] = (int) lz_optpost('captcha_user_hide');
2819	$option['captcha_no_css_login'] = (int) lz_optpost('captcha_no_css_login');
2820	$option['captcha_login'] = (int) lz_optpost('captcha_login');
2821	$option['captcha_lostpass'] = (int) lz_optpost('captcha_lostpass');
2822	$option['captcha_resetpass'] = (int) lz_optpost('captcha_resetpass');
2823	$option['captcha_register'] = (int) lz_optpost('captcha_register');
2824	$option['captcha_comment'] = (int) lz_optpost('captcha_comment');
2825	$option['captcha_wc_checkout'] = (int) lz_optpost('captcha_wc_checkout');
2826
2827	// Are we to use Math Captcha ?
2828	if(isset($_POST['captcha_no_google'])){
2829
2830	$option['captcha_no_google'] = 1;
2831
2832	// Make the checks
2833	if(strlen($option['captcha_text']) < 1){
2834	$lz_error['captcha_text'] = __('The Captcha key was not submitted', 'loginizer');
2835	}
2836
2837	}else{
2838
2839	// Make the checks
2840	if(strlen($option['captcha_key']) < 32 \|\| strlen($option['captcha_key']) > 50){
2841	$lz_error['captcha_key'] = __('The reCAPTCHA key is invalid', 'loginizer');
2842	}
2843
2844	// Is secret valid ?
2845	if(strlen($option['captcha_secret']) < 32 \|\| strlen($option['captcha_secret']) > 50){
2846	$lz_error['captcha_secret'] = __('The reCAPTCHA secret is invalid', 'loginizer');
2847	}
2848
2849	// Is theme valid ?
2850	if(empty($lz_env['theme'][$option['captcha_theme']])){
2851	$lz_error['captcha_theme'] = __('The reCAPTCHA theme is invalid', 'loginizer');
2852	}
2853
2854	// Is size valid ?
2855	if(empty($lz_env['size'][$option['captcha_size']])){
2856	$lz_error['captcha_size'] = __('The reCAPTCHA size is invalid', 'loginizer');
2857	}
2858
2859	// Is lang valid ?
2860	if(empty($lz_env['lang'][$option['captcha_lang']])){
2861	$lz_error['captcha_lang'] = __('The reCAPTCHA language is invalid', 'loginizer');
2862	}
2863
2864	}
2865
2866	// Is there an error ?
2867	if(!empty($lz_error)){
2868	return loginizer_page_recaptcha_T();
2869	}
2870
2871	// Save the options
2872	update_option('loginizer_captcha', $option);
2873
2874	// Mark as saved
2875	$GLOBALS['lz_saved'] = true;
2876
2877	}
2878
2879	// Clear this
2880	if(isset($_POST['clear_captcha_lz'])){
2881
2882	// Save the options
2883	update_option('loginizer_captcha', '');
2884
2885	// Mark as saved
2886	$GLOBALS['lz_cleared'] = true;
2887
2888	}
2889
2890	// Call the theme
2891	loginizer_page_recaptcha_T();
2892
2893	}
2894
2895	// Loginizer - reCaptcha Page Theme
2896	function loginizer_page_recaptcha_T(){
2897
2898	global $loginizer, $lz_error, $lz_env;
2899
2900	// Universal header
2901	loginizer_page_header('reCAPTCHA Settings');
2902
2903	loginizer_feature_available('reCAPTCHA');
2904
2905	// Saved ?
2906	if(!empty($GLOBALS['lz_saved'])){
2907	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
2908	}
2909
2910	// Cleared ?
2911	if(!empty($GLOBALS['lz_cleared'])){
2912	echo '<div id="message" class="updated"><p>'. __('reCAPTCHA has been disabled !', 'loginizer'). '</p></div><br />';
2913	}
2914
2915	// Any errors ?
2916	if(!empty($lz_error)){
2917	lz_report_error($lz_error);echo '<br />';
2918	}
2919
2920	?>
2921
2922	<style>
2923	input[type="text"], textarea, select {
2924	width: 70%;
2925	}
2926	</style>
2927
2928	<div id="" class="postbox">
2929
2930	<div class="postbox-header">
2931	<h2 class="hndle ui-sortable-handle">
2932	<span><?php echo __('reCAPTCHA Settings', 'loginizer'); ?></span>
2933	</h2>
2934	</div>
2935
2936	<div class="inside">
2937
2938	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
2939	<?php wp_nonce_field('loginizer-options'); ?>
2940	<table class="form-table">
2941	<tr class="lz_google_cap">
2942	<td scope="row" valign="top" style="width:300px !important; padding-left:0px"><label><b><?php echo __('reCAPTCHA type', 'loginizer'); ?></b></label><br>
2943	<?php echo __('Choose the type of reCAPTCHA', 'loginizer'); ?><br />
2944	<?php echo __('<a href="https://g.co/recaptcha/sitetypes/" target="_blank">See Site Types for more details</a>', 'loginizer'); ?>
2945	</td>
2946	<td>
2947	<input type="radio" value="v3" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', 'v3', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v3" /> <label for="captcha_type_v3"><?php echo __('reCAPTCHA v3', 'loginizer'); ?></label><br /><br />
2948	<input type="radio" value="" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', '', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2" /> <label for="captcha_type_v2"><?php echo __('reCAPTCHA v2 - Checkbox', 'loginizer'); ?></label><br /><br />
2949	<input type="radio" value="v2_invisible" onchange="google_recaptcha_type(this)" <?php echo lz_POSTradio('captcha_type', 'v2_invisible', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2_invisible" /> <label for="captcha_type_v2_invisible"><?php echo __('reCAPTCHA v2 - Invisible', 'loginizer'); ?></label><br />
2950	</td>
2951	</tr>
2952	<tr class="lz_google_cap">
2953	<td scope="row" valign="top" style="width:300px !important; padding-left:0px"><label><b><?php echo __('Site Key', 'loginizer'); ?></b></label><br>
2954	<?php echo __('Make sure you enter the correct keys as per the reCAPTCHA type selected above', 'loginizer'); ?>
2955	</td>
2956	<td>
2957	<input type="text" size="50" value="<?php echo lz_optpost('captcha_key', $loginizer['captcha_key']); ?>" name="captcha_key" /><br />
2958	<?php echo __('Get the Site Key and Secret Key from <a href="https://www.google.com/recaptcha/admin/" target="_blank">Google</a>', 'loginizer'); ?>
2959	</td>
2960	</tr>
2961	<tr class="lz_google_cap">
2962	<th scope="row" valign="top"><label><?php echo __('Secret Key', 'loginizer'); ?></label></th>
2963	<td>
2964	<input type="text" size="50" value="<?php echo lz_optpost('captcha_secret', $loginizer['captcha_secret']); ?>" name="captcha_secret" />
2965	</td>
2966	</tr>
2967	<tr class="lz_google_cap">
2968	<th scope="row" valign="top"><label><?php echo __('Theme', 'loginizer'); ?></label></th>
2969	<td>
2970	<select name="captcha_theme">
2971	<?php
2972	foreach($lz_env['theme'] as $k => $v){
2973	echo '<option '.lz_POSTselect('captcha_theme', $k, ($loginizer['captcha_theme'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2974	}
2975	?>
2976	</select>
2977	</td>
2978	</tr>
2979	<tr class="lz_google_cap">
2980	<th scope="row" valign="top"><label><?php echo __('Language', 'loginizer'); ?></label></th>
2981	<td>
2982	<select name="captcha_lang">
2983	<?php
2984	foreach($lz_env['lang'] as $k => $v){
2985	echo '<option '.lz_POSTselect('captcha_lang', $k, ($loginizer['captcha_lang'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2986	}
2987	?>
2988	</select>
2989	</td>
2990	</tr>
2991	<tr class="lz_google_cap lz_google_cap_size">
2992	<th scope="row" valign="top"><label><?php echo __('Size', 'loginizer'); ?></label></th>
2993	<td>
2994	<select name="captcha_size">
2995	<?php
2996	foreach($lz_env['size'] as $k => $v){
2997	echo '<option '.lz_POSTselect('captcha_size', $k, ($loginizer['captcha_size'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
2998	}
2999	?>
3000	</select>
3001	</td>
3002	</tr>
3003	<tr>
3004	<td scope="row" valign="top" style="padding-left:0px">
3005	<label><b><?php echo __('Don\'t use Google reCAPTCHA', 'loginizer'); ?></b></label><br>
3006	<?php echo __('If selected, '.$loginizer['prefix'].' will use a simple Math Captcha instead of Google reCAPTCHA', 'loginizer'); ?>
3007	</td>
3008	<td>
3009	<input type="checkbox" onclick="no_google_recaptcha(this)" id="captcha_no_google" value="1" name="captcha_no_google" <?php echo lz_POSTchecked('captcha_no_google', (empty($loginizer['captcha_no_google']) ? false : true)); ?> />
3010	</td>
3011	</tr>
3012	<tr class="lz_math_cap">
3013	<td scope="row" valign="top" style="width:300px !important; padding-left:0px">
3014	<label><b><?php echo __('Captcha Text', 'loginizer'); ?></b></label><br>
3015	<?php echo __('The text to be shown for the Captcha Field', 'loginizer'); ?>
3016	</td>
3017	<td>
3018	<input type="text" size="30" value="<?php echo lz_optpost('captcha_text', @$loginizer['captcha_text']); ?>" name="captcha_text" />
3019	</td>
3020	</tr>
3021	<tr class="lz_math_cap">
3022	<td scope="row" valign="top" style="padding-left:0px">
3023	<label><b><?php echo __('Captcha Time', 'loginizer'); ?></b></label><br>
3024	<?php echo __('Enter the number of seconds, a user has to enter captcha value.', 'loginizer'); ?>
3025	</td>
3026	<td>
3027	<input type="text" size="30" value="<?php echo lz_optpost('captcha_time', @$loginizer['captcha_time']); ?>" name="captcha_time" />
3028	</td>
3029	</tr>
3030	<tr class="lz_math_cap">
3031	<td scope="row" valign="top" style="padding-left:0px">
3032	<label><b><?php echo __('Display Captcha in Words', 'loginizer'); ?></b></label><br>
3033	<?php echo __('If selected the Captcha will be displayed in words rather than numbers', 'loginizer'); ?>
3034	</td>
3035	<td>
3036	<input type="checkbox" value="1" name="captcha_words" <?php echo lz_POSTchecked('captcha_words', (empty($loginizer['captcha_words']) ? false : true));?> />
3037	</td>
3038	</tr>
3039	<tr class="lz_math_cap">
3040	<td scope="row" valign="top" style="vertical-align: top !important; padding-left:0px">
3041	<label><b><?php echo __('Mathematical operations', 'loginizer'); ?></b></label><br>
3042	<?php echo __('The Mathematical operations to use for Captcha', 'loginizer'); ?>
3043	</td>
3044	<td valign="top">
3045	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3046	<?php echo '
3047	<tr>
3048	<td>'.__('Addition (+)', 'loginizer').'</td>
3049	<td><input type="checkbox" value="1" name="captcha_add" '.lz_POSTchecked('captcha_add', (empty($loginizer['captcha_add']) ? false : true)).' /></td>
3050	</tr>
3051	<tr>
3052	<td>'.__('Subtraction (-)', 'loginizer').'</td>
3053	<td><input type="checkbox" value="1" name="captcha_subtract" '.lz_POSTchecked('captcha_subtract', (empty($loginizer['captcha_subtract']) ? false : true)).' /></td>
3054	</tr>
3055	<tr>
3056	<td>'.__('Multiplication (x)', 'loginizer').'</td>
3057	<td><input type="checkbox" value="1" name="captcha_multiply" '.lz_POSTchecked('captcha_multiply', (empty($loginizer['captcha_multiply']) ? false : true)).' /></td>
3058	</tr>
3059	<tr>
3060	<td>'.__('Division (รท)', 'loginizer').'</td>
3061	<td><input type="checkbox" value="1" name="captcha_divide" '.lz_POSTchecked('captcha_divide', (empty($loginizer['captcha_divide']) ? false : true)).' /></td>
3062	</tr>';
3063	?>
3064	</table>
3065	</td>
3066	</tr>
3067	<tr>
3068	<th scope="row" valign="top"><label><?php echo __('Show Captcha On', 'loginizer'); ?></label></th>
3069	<td valign="top">
3070	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3071	<?php echo '
3072	<tr>
3073	<td>'.__('Login Form', 'loginizer').'</td>
3074	<td><input type="checkbox" value="1" name="captcha_login" '.lz_POSTchecked('captcha_login', (empty($loginizer['captcha_login']) ? false : true)).' /></td>
3075	</tr>
3076	<tr>
3077	<td>'.__('Lost Password Form', 'loginizer').'</td>
3078	<td><input type="checkbox" value="1" name="captcha_lostpass" '.lz_POSTchecked('captcha_lostpass', (empty($loginizer['captcha_lostpass']) ? false : true)).' /></td>
3079	</tr>
3080	<tr>
3081	<td>'.__('Reset Password Form', 'loginizer').'</td>
3082	<td><input type="checkbox" value="1" name="captcha_resetpass" '.lz_POSTchecked('captcha_resetpass', (empty($loginizer['captcha_resetpass']) ? false : true)).' /></td>
3083	</tr>
3084	<tr>
3085	<td>'.__('Registration Form', 'loginizer').'</td>
3086	<td><input type="checkbox" value="1" name="captcha_register" '.lz_POSTchecked('captcha_register', (empty($loginizer['captcha_register']) ? false : true)).' /></td>
3087	</tr>
3088	<tr>
3089	<td>'.__('Comment Form', 'loginizer').'</td>
3090	<td><input type="checkbox" value="1" name="captcha_comment" '.lz_POSTchecked('captcha_comment', (empty($loginizer['captcha_comment']) ? false : true)).' /></td>
3091	</tr>';
3092
3093	if(!defined('SITEPAD')){
3094
3095	echo '<tr>
3096	<td>'.__('WooCommerce Checkout', 'loginizer').'</td>
3097	<td><input type="checkbox" value="1" name="captcha_wc_checkout" '.lz_POSTchecked('captcha_wc_checkout', (empty($loginizer['captcha_wc_checkout']) ? false : true)).' /></td>
3098	</tr>';
3099
3100	}
3101
3102	?>
3103	</table>
3104	</td>
3105	</tr>
3106	<tr>
3107	<th scope="row" valign="top"><label><?php echo __('Hide CAPTCHA for logged in Users', 'loginizer'); ?></label></th>
3108	<td>
3109	<input type="checkbox" value="1" name="captcha_user_hide" <?php echo lz_POSTchecked('captcha_user_hide', (empty($loginizer['captcha_user_hide']) ? false : true)); ?> />
3110	</td>
3111	</tr>
3112	<tr class="lz_google_cap">
3113	<th scope="row" valign="top"><label><?php echo __('Disable CSS inserted on Login Page', 'loginizer'); ?></label></th>
3114	<td>
3115	<input type="checkbox" value="1" name="captcha_no_css_login" <?php echo lz_POSTchecked('captcha_no_css_login', (empty($loginizer['captcha_no_css_login']) ? false : true)); ?> />
3116	</td>
3117	</tr>
3118	</table><br />
3119	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
3120	<input style="float:right" name="clear_captcha_lz" class="button action" value="<?php echo __('Disable reCAPTCHA','loginizer'); ?>" type="submit" /></center>
3121	</form>
3122
3123	</div>
3124	</div>
3125	<br />
3126
3127	<script type="text/javascript">
3128
3129	function no_google_recaptcha(obj){
3130
3131	if(obj.checked){
3132	jQuery(".lz_google_cap").hide();
3133	jQuery(".lz_math_cap").show();
3134	}else{
3135	jQuery(".lz_google_cap").show();
3136	jQuery(".lz_math_cap").hide();
3137	}
3138
3139	var cur_captcha_type = jQuery("input:radio[name='captcha_type']:checked").val();
3140
3141	if(cur_captcha_type == 'v3' \|\| cur_captcha_type == 'v2_invisible'){
3142	jQuery(".lz_google_cap_size").hide();
3143	}else{
3144	jQuery(".lz_google_cap_size").show();
3145	}
3146
3147	}
3148
3149	no_google_recaptcha(jQuery("#captcha_no_google")[0]);
3150
3151	function google_recaptcha_type(obj){
3152	if(obj.value == 'v3' \|\| obj.value == 'v2_invisible'){
3153	jQuery(".lz_google_cap_size").hide();
3154	}else{
3155	jQuery(".lz_google_cap_size").show();
3156	}
3157	}
3158
3159
3160	</script>
3161
3162	<?php
3163	loginizer_page_footer();
3164
3165	}
3166
3167
3168	// Loginizer - Two Factor Auth Page
3169	function loginizer_page_2fa(){
3170
3171	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3172
3173	if(!current_user_can('manage_options')){
3174	wp_die('Sorry, but you do not have permissions to change settings.');
3175	}
3176
3177	if(!loginizer_is_premium() && count($_POST) > 0){
3178	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3179	return loginizer_page_2fa_T();
3180	}
3181
3182	$lz_roles = get_editable_roles();
3183
3184	/* Make sure post was from this page */
3185	if(count($_POST) > 0){
3186	check_admin_referer('loginizer-options');
3187	}
3188
3189	// Settings submitted
3190	if(isset($_POST['save_lz'])){
3191
3192	// In the future there can be more settings
3193	$option['2fa_app'] = (int) lz_optpost('2fa_app');
3194	$option['2fa_email'] = (int) lz_optpost('2fa_email');
3195	$option['question'] = (int) lz_optpost('question');
3196	$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
3197
3198	// Any roles to apply to ?
3199	foreach($lz_roles as $k => $v){
3200
3201	if(lz_optpost('2fa_roles_'.$k)){
3202	$option['2fa_roles'][$k] = 1;
3203	}
3204
3205	}
3206
3207	// If its all, then blank it
3208	if(lz_optpost('2fa_roles_all') \|\| empty($option['2fa_roles'])){
3209	$option['2fa_roles'] = '';
3210	}
3211
3212	// Is there an error ?
3213	if(!empty($lz_error)){
3214	return loginizer_page_2fa_T();
3215	}
3216
3217	// Save the options
3218	update_option('loginizer_2fa', $option);
3219
3220	// Mark as saved
3221	$GLOBALS['lz_saved'] = true;
3222
3223	}
3224
3225	// Reset a users 2FA
3226	if(isset($_POST['reset_user_lz'])){
3227
3228	$_username = lz_optpost('lz_user_2fa_disable');
3229
3230	// Try to get the user
3231	$user_search = get_user_by('login', $_username);
3232
3233	// If not found then search by email
3234	if(empty($user_search)){
3235	$user_search = get_user_by('email', $_username);
3236	}
3237
3238	// If not found then give error
3239	if(empty($user_search)){
3240	$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
3241	return loginizer_page_2fa_T();
3242	}
3243
3244	// Get the user prefences
3245	$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
3246
3247	// Blank it
3248	$user_pref['pref'] = 'none';
3249
3250	// Save it
3251	update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
3252
3253	// Mark as saved
3254	$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
3255
3256	}
3257
3258	if(isset($_POST['save_2fa_email_template_lz'])){
3259
3260	// In the future there can be more settings
3261	$option['2fa_email_sub'] = lz_optpost('lz_2fa_email_sub');
3262	$option['2fa_email_msg'] = lz_optpost('lz_2fa_email_msg');
3263
3264	// Is there an error ?
3265	if(!empty($lz_error)){
3266	return loginizer_page_2fa_T();
3267	}
3268
3269	// Save the options
3270	update_option('loginizer_2fa_email_template', $option);
3271
3272	// Mark as saved
3273	$GLOBALS['lz_saved'] = true;
3274
3275	}
3276
3277	// Save the messages
3278	if(isset($_POST['save_msgs_lz'])){
3279
3280	$msgs['otp_app'] = lz_optpost('msg_otp_app');
3281	$msgs['otp_email'] = lz_optpost('msg_otp_email');
3282	$msgs['otp_field'] = lz_optpost('msg_otp_field');
3283	$msgs['otp_question'] = lz_optpost('msg_otp_question');
3284	$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
3285
3286	// Update them
3287	update_option('loginizer_2fa_msg', $msgs);
3288
3289	// Mark as saved
3290	$GLOBALS['lz_saved'] = __('Messages were saved successfully', 'loginizer');
3291
3292	}
3293
3294	// Delete a Whitelist IP range
3295	if(isset($_POST['delid'])){
3296
3297	$delid = (int) lz_optreq('delid');
3298
3299	// Unset and save
3300	$whitelist = $loginizer['2fa_whitelist'];
3301	unset($whitelist[$delid]);
3302	update_option('loginizer_2fa_whitelist', $whitelist);
3303
3304	// Mark as saved
3305	$GLOBALS['lz_saved'] = __('The Whitelist IP range has been deleted successfully', 'loginizer');
3306
3307	}
3308
3309	// Delete all Blackist IP ranges
3310	if(isset($_POST['del_all_whitelist'])){
3311
3312	// Unset and save
3313	update_option('loginizer_2fa_whitelist', array());
3314
3315	// Mark as saved
3316	$GLOBALS['lz_saved'] = __('The Whitelist IP range(s) have been cleared successfully', 'loginizer');
3317
3318	}
3319
3320	// Add IP range to 2FA whitelist
3321	if(isset($_POST['2fa_whitelist_iprange'])){
3322
3323	$start_ip = lz_optpost('start_ip_w_2fa');
3324	$end_ip = lz_optpost('end_ip_w_2fa');
3325
3326	if(empty($start_ip)){
3327	$lz_error[] = __('Please enter the Start IP', 'loginizer');
3328	return loginizer_page_2fa_T();
3329	}
3330
3331	// If no end IP we consider only 1 IP
3332	if(empty($end_ip)){
3333	$end_ip = $start_ip;
3334	}
3335
3336	if(!lz_valid_ip($start_ip)){
3337	$lz_error[] = __('Please provide a valid start IP', 'loginizer');
3338	}
3339
3340	if(!lz_valid_ip($end_ip)){
3341	$lz_error[] = __('Please provide a valid end IP', 'loginizer');
3342	}
3343
3344	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
3345
3346	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
3347	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
3348	// This is right
3349	}else{
3350	$lz_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
3351	}
3352
3353	}
3354
3355	if(empty($lz_error)){
3356
3357	$whitelist = $loginizer['2fa_whitelist'];
3358
3359	foreach($whitelist as $k => $v){
3360
3361	// This is to check if there is any other range exists with the same Start or End IP
3362	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
3363	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
3364	){
3365	$lz_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
3366	break;
3367	}
3368
3369	// This is to check if there is any other range exists with the same Start IP
3370	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
3371	$lz_error[] = __('The Start IP is present in an existing range !', 'loginizer');
3372	break;
3373	}
3374
3375	// This is to check if there is any other range exists with the same End IP
3376	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
3377	$lz_error[] = __('The End IP is present in an existing range!', 'loginizer');
3378	break;
3379	}
3380
3381	}
3382
3383	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
3384
3385	if(empty($lz_error)){
3386
3387	$whitelist[$newid] = array();
3388	$whitelist[$newid]['start'] = $start_ip;
3389	$whitelist[$newid]['end'] = $end_ip;
3390	$whitelist[$newid]['time'] = time();
3391
3392	update_option('loginizer_2fa_whitelist', $whitelist);
3393
3394	// Mark as saved
3395	$GLOBALS['lz_saved'] = __('Whitelist IP range for Two Factor Authentication added successfully', 'loginizer');
3396
3397	}
3398
3399	}
3400	}
3401
3402
3403	$lz_options = get_option('loginizer_2fa_email_template');
3404	$saved_msgs = get_option('loginizer_2fa_msg');
3405	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
3406
3407	// Call theme
3408	loginizer_page_2fa_T();
3409
3410	}
3411
3412
3413	// Loginizer - Two Factor Auth Page
3414	function loginizer_page_2fa_T(){
3415
3416	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3417
3418	// Universal header
3419	loginizer_page_header('Two Factor Authentication');
3420
3421	loginizer_feature_available('Two-Factor Authentication');
3422
3423	// Saved ?
3424	if(!empty($GLOBALS['lz_saved'])){
3425	echo '<div id="message" class="updated"><p>'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '</p></div><br />';
3426	}
3427
3428	// Any errors ?
3429	if(!empty($lz_error)){
3430	lz_report_error($lz_error);echo '<br />';
3431	}
3432
3433	?>
3434
3435	<style>
3436	input[type="text"], textarea, select {
3437	width: 70%;
3438	}
3439
3440	.form-table label{
3441	font-weight:bold;
3442	}
3443
3444	.exp{
3445	font-size:12px;
3446	}
3447	</style>
3448
3449	<div id="" class="postbox">
3450
3451	<div class="postbox-header">
3452	<h2 class="hndle ui-sortable-handle">
3453	<span><?php echo __('Two Factor Authentication Settings', 'loginizer'); ?></span>
3454	</h2>
3455	</div>
3456
3457	<div class="inside">
3458
3459	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3460	<?php wp_nonce_field('loginizer-options'); ?>
3461	<table class="form-table">
3462	<tr>
3463	<td scope="row" valign="top" colspan="2">
3464	<i><?php echo __('Please choose from the following Two Factor Authentication methods. Each user can choose any one method from the ones enabled by you. You can enable all or anyone that you would like.', 'loginizer'); ?></i>
3465	</td>
3466	</tr>
3467	<tr>
3468	<td scope="row" valign="top" style="width:70% !important">
3469	<label><?php echo __('OTP via App', 'loginizer'); ?></label><br>
3470	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be obtained from the users mobile app e.g. <b>Google Authenticator, Authy, etc.</b>', 'loginizer'); ?></span>
3471	</td>
3472	<td>
3473	<input type="checkbox" value="1" name="2fa_app" <?php echo lz_POSTchecked('2fa_app', (empty($loginizer['2fa_app']) ? false : true), 'save_lz'); ?> />
3474	</td>
3475	</tr>
3476	<tr>
3477	<td scope="row" valign="top">
3478	<label><?php echo __('OTP via Email', 'loginizer'); ?></label><br>
3479	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be emailed to the user.', 'loginizer'); ?></span>
3480	</td>
3481	<td>
3482	<input type="checkbox" value="1" name="2fa_email" <?php echo lz_POSTchecked('2fa_email', (empty($loginizer['2fa_email']) ? false : true), 'save_lz'); ?> />
3483	</td>
3484	</tr>
3485	<tr>
3486	<td scope="row" valign="top">
3487	<label><?php echo __('User Defined Question & Answer', 'loginizer'); ?></label><br>
3488	<span class="exp"><?php echo __('In this method the user will be asked to set a secret personal question and answer. After entering the correct login credentials, the user will be asked to answer the question set by them, thus increasing the security', 'loginizer'); ?></span>
3489	</td>
3490	<td>
3491	<input type="checkbox" value="1" name="question" <?php echo lz_POSTchecked('question', (empty($loginizer['question']) ? false : true), 'save_lz'); ?> />
3492	</td>
3493	</tr>
3494	</table><br />
3495
3496	<table class="form-table">
3497	<tr>
3498	<td scope="row" valign="top" style="width:70% !important">
3499	<label><?php echo __('Force OTP via Email', 'loginizer'); ?></label><br>
3500	<span class="exp"><?php echo __('If the user does not have any 2FA method selected, this will enforce the OTP via Email for the users.', 'loginizer'); ?></span>
3501	</td>
3502	<td>
3503	<input type="checkbox" value="1" name="2fa_email_force" <?php echo lz_POSTchecked('2fa_email_force', (empty($loginizer['2fa_email_force']) ? false : true), 'save_lz'); ?> />
3504	</td>
3505	</tr>
3506	<tr>
3507	<td scope="row" valign="top" style="width:70% !important">
3508	<label><?php echo __('Apply 2FA to Roles', 'loginizer'); ?></label><br>
3509	<span class="exp"><?php echo __('Select the Roles to which 2FA should be applied.', 'loginizer'); ?></span>
3510	</td>
3511	<td>
3512	<input type="checkbox" value="1" onchange="lz_roles_handle()" name="2fa_roles_all" id="2fa_roles_all" <?php echo lz_POSTchecked('2fa_roles_all', (empty($loginizer['2fa_roles']) ? true : false), 'save_lz'); ?> /> All<br />
3513	<?php
3514
3515	foreach($lz_roles as $k => $v){
3516	echo '<span class="lz_roles"><input type="checkbox" value="1" name="2fa_roles_'.$k.'" '.lz_POSTchecked('2fa_roles_'.$k, (empty($loginizer['2fa_roles'][$k]) ? false : true), 'save_lz').' /> '.$v['name'].'<br /></span>';
3517	}
3518
3519	?>
3520	</td>
3521	</tr>
3522	</table><br />
3523	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3524	</form>
3525
3526	</div>
3527	</div>
3528
3529	<script type="text/javascript">
3530
3531	function lz_roles_handle(){
3532
3533	var obj = jQuery("#2fa_roles_all")[0];
3534
3535	if(obj.checked){
3536	jQuery(".lz_roles").hide();
3537	}else{
3538	jQuery(".lz_roles").show();
3539	}
3540
3541	}
3542
3543	lz_roles_handle();
3544
3545	</script>
3546
3547	<div id="" class="postbox">
3548
3549	<div class="postbox-header">
3550	<h2 class="hndle ui-sortable-handle">
3551	<span><?php echo __('OTP via Email Template', 'loginizer'); ?></span>
3552	</h2>
3553	</div>
3554
3555	<div class="inside">
3556
3557	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3558	<?php wp_nonce_field('loginizer-options'); ?>
3559	<table class="form-table">
3560	<tr>
3561	<td colspan="2" valign="top">
3562	<?php echo __('Customize the email template to be used when sending the OTP to login via Email for 2FA.', 'loginizer'); ?><br>
3563	<?php echo __('If you do not make changes below the default email template will be used !', 'loginizer'); ?>
3564	</td>
3565	</tr>
3566	<tr>
3567	<td scope="row" valign="top" style="width:350px !important">
3568	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3569	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3570	<br />Default : <?php echo @$loginizer['2fa_email_d_sub']; ?>
3571	</td>
3572	<td valign="top">
3573	<input type="text" size="40" value="<?php echo lz_optpost('lz_2fa_email_sub', @$lz_options['2fa_email_sub']); ?>" name="lz_2fa_email_sub" />
3574	</td>
3575	</tr>
3576	<tr>
3577	<td scope="row" valign="top">
3578	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3579	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3580	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['2fa_email_d_msg']; ?></pre>
3581	</td>
3582	<td valign="top">
3583	<textarea rows="10" name="lz_2fa_email_msg"><?php echo lz_optpost('lz_2fa_email_msg', @$lz_options['2fa_email_msg']); ?></textarea>
3584	<br />
3585	Variables :
3586	<br />$otp - The OTP for login
3587	<br />$site_name - The Site Name
3588	<br />$site_url - The Site URL
3589	<br />$email - Users Email
3590	<br />$display_name - Users Display Name
3591	<br />$user_login - Username
3592	<br />$first_name - Users First Name
3593	<br />$last_name - Users Last Name
3594	</td>
3595	</tr>
3596	</table><br />
3597	<center><input name="save_2fa_email_template_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3598	</form>
3599
3600	</div>
3601	</div>
3602
3603	<div id="" class="postbox">
3604
3605	<div class="postbox-header">
3606	<h2 class="hndle ui-sortable-handle">
3607	<span><?php echo __('Custom Messages for OTP', 'loginizer'); ?></span>
3608	</h2>
3609	</div>
3610
3611	<div class="inside">
3612
3613	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3614	<?php wp_nonce_field('loginizer-options'); ?>
3615	<table class="form-table">
3616	<tr>
3617	<td colspan="2" valign="top">
3618	<?php echo __('Customize the title for OTP field displayed to the user on the login form.', 'loginizer'); ?><br>
3619	<?php echo __('If you do not make changes below the default messages will be used !', 'loginizer'); ?>
3620	</td>
3621	</tr>
3622	<tr>
3623	<td scope="row" valign="top" style="width:350px !important">
3624	<label for="msg_otp_app"><?php echo __('OTP via APP','loginizer'); ?></label><br />
3625	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_app']. '"</em>', 'loginizer'); ?>
3626	</td>
3627	<td>
3628	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_app']); ?>" name="msg_otp_app" id="msg_otp_app" style="width:auto !important;" />
3629	<br />
3630	</td>
3631	</tr>
3632	<tr>
3633	<td scope="row" valign="top" style="width:350px !important">
3634	<label for="msg_otp_email"><?php echo __('OTP via Email','loginizer'); ?></label><br />
3635	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_email']. '"</em>', 'loginizer'); ?>
3636	</td>
3637	<td>
3638	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_email']); ?>" name="msg_otp_email" id="msg_otp_email" style="width:auto !important;" />
3639	<br />
3640	</td>
3641	</tr>
3642	<tr>
3643	<td scope="row" valign="top" style="width:350px !important">
3644	<label for="msg_otp_field"><?php echo __('Title for OTP field','loginizer'); ?></label><br />
3645	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_field']. '"</em>', 'loginizer'); ?>
3646	</td>
3647	<td>
3648	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_field']); ?>" name="msg_otp_field" id="msg_otp_field" style="width:auto !important;" />
3649	<br />
3650	</td>
3651	</tr>
3652	<tr>
3653	<td scope="row" valign="top" style="width:350px !important">
3654	<label for="msg_otp_question"><?php echo __('Title for Security Question','loginizer'); ?></label><br />
3655	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_question']. '"</em>', 'loginizer'); ?>
3656	</td>
3657	<td>
3658	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_question']); ?>" name="msg_otp_question" id="msg_otp_question" style="width:auto !important;" />
3659	<br />
3660	</td>
3661	</tr>
3662	<tr>
3663	<td scope="row" valign="top" style="width:350px !important">
3664	<label for="msg_otp_answer"><?php echo __('Title for Security Answer','loginizer'); ?></label><br />
3665	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_answer']. '"</em>', 'loginizer'); ?>
3666	</td>
3667	<td>
3668	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_answer']); ?>" name="msg_otp_answer" id="msg_otp_answer" style="width:auto !important;" />
3669	<br />
3670	</td>
3671	</tr>
3672	</table><br />
3673	<center><input name="save_msgs_lz" class="button button-primary action" value="<?php echo __('Save Messages','loginizer'); ?>" type="submit" /></center>
3674	</form>
3675	</div>
3676	</div>
3677
3678	<!--Bypass a single user-->
3679	<div id="" class="postbox">
3680
3681	<div class="postbox-header">
3682	<h2 class="hndle ui-sortable-handle">
3683	<span><?php echo __('Disable Two Factor Authentication for a User', 'loginizer'); ?></span>
3684	</h2>
3685	</div>
3686
3687	<div class="inside">
3688
3689	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3690	<?php wp_nonce_field('loginizer-options'); ?>
3691	<table class="form-table">
3692	<tr>
3693	<td scope="row" valign="top" colspan="2">
3694	<i><?php echo __('Here you can disable the Two Factor Authentication settings of a user. In the event a user has forgotten his secret answer or lost his Device App, he will not be able to login. You can reset such a users settings from here.', 'loginizer'); ?></i>
3695	</td>
3696	</tr>
3697	<tr>
3698	<td scope="row" valign="top">
3699	<label><?php echo __('Username / Email', 'loginizer'); ?></label><br>
3700	<span class="exp"><?php echo __('The username or email of the user whose 2FA you would like to disable', 'loginizer'); ?></span>
3701	</td>
3702	<td>
3703	<input type="text" size="50" value="<?php echo lz_optpost('lz_user_2fa_disable', ''); ?>" name="lz_user_2fa_disable" />
3704	</td>
3705	</tr>
3706	</table><br />
3707
3708	<center><input name="reset_user_lz" class="button button-primary action" value="<?php echo __('Reset 2FA for User', 'loginizer'); ?>" type="submit" /></center>
3709	</form>
3710
3711	</div>
3712	</div>
3713
3714	<br />
3715
3716	<?php
3717
3718	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
3719
3720	?>
3721
3722	<style>
3723	.page-navigation a {
3724	margin: 5px 2px;
3725	display: inline-block;
3726	padding: 5px 8px;
3727	color: #0073aa;
3728	background: #e5e5e5 none repeat scroll 0 0;
3729	border: 1px solid #ccc;
3730	text-decoration: none;
3731	transition-duration: 0.05s;
3732	transition-property: border, background, color;
3733	transition-timing-function: ease-in-out;
3734	}
3735
3736	.page-navigation a[data-selected] {
3737	background-color: #00a0d2;
3738	color: #fff;
3739	}
3740	</style>
3741
3742	<script>
3743
3744	jQuery(document).ready(function(){
3745	jQuery('#lz_wl_2fa_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_2fa_nav')});
3746	});
3747
3748	// Delete a 2FA Whitelist IP Range
3749	function del_2fa_confirm(field, todo_id, msg){
3750	var ret = confirm(msg);
3751
3752	if(ret){
3753	jQuery('#lz_wl_2fa_todo').attr('name', field);
3754	jQuery('#lz_wl_2fa_todo').val(todo_id);
3755	jQuery('#lz_wl_2fa_form').submit();
3756	}
3757
3758	return false;
3759
3760	}
3761
3762	// Delete all 2FA Whitelist IP Ranges
3763	function del_2fa_confirm_all(msg){
3764	var ret = confirm(msg);
3765
3766	if(ret){
3767	return true;
3768	}
3769
3770	return false;
3771
3772	}
3773
3774	</script>
3775
3776	<div id="" class="postbox">
3777
3778	<div class="postbox-header">
3779	<h2 class="hndle ui-sortable-handle">
3780	<span><?php echo __('Disable Two Factor Authentication for IP', 'loginizer'); ?></span>
3781	</h2>
3782	</div>
3783
3784	<div class="inside">
3785
3786	<?php echo __('Enter the IP you want to whitelist for two factor authentication', 'loginizer'); ?>
3787	<form action="" method="post" loginizer-premium-only="1">
3788	<?php wp_nonce_field('loginizer-options'); ?>
3789	<table class="form-table">
3790	<tr>
3791	<th scope="row" valign="top"><label for="start_ip_w_2fa"><?php echo __('Start IP','loginizer'); ?></label></th>
3792	<td>
3793	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('start_ip_w_2fa')); ?>" name="start_ip_w_2fa" id="start_ip_w_2fa"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
3794	</td>
3795	</tr>
3796	<tr>
3797	<th scope="row" valign="top"><label for="end_ip_w_2fa"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
3798	<td>
3799	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('end_ip_w_2fa')); ?>" name="end_ip_w_2fa" id="end_ip_w_2fa"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
3800	</td>
3801	</tr>
3802	</table><br />
3803	<input name="2fa_whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
3804	<input style="float:right" name="del_all_whitelist" onclick="return del_2fa_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) for 2FA ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s) for 2FA','loginizer'); ?>" type="submit" />
3805	</form>
3806	</div>
3807
3808	<div id="lz_wl_2fa_nav" style="margin: 5px 10px; text-align:right"></div>
3809	<table id="lz_wl_2fa_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
3810	<tr>
3811	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
3812	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
3813	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
3814	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
3815	</tr>
3816	<?php
3817	if(empty($loginizer['2fa_whitelist'])){
3818	echo '
3819	<tr>
3820	<td colspan="4">
3821	'.__('No Whitelist IPs for Two Factor Authentication. You will see whitelisted IP ranges here.', 'loginizer').'
3822	</td>
3823	</tr>';
3824	}else{
3825	foreach($loginizer['2fa_whitelist'] as $ik => $iv){
3826	echo '
3827	<tr>
3828	<td>
3829	'.$iv['start'].'
3830	</td>
3831	<td>
3832	'.$iv['end'].'
3833	</td>
3834	<td>
3835	'.date('d/m/Y', $iv['time']).'
3836	</td>
3837	<td>
3838	<a class="submitdelete" href="javascript:void(0)" onclick="return del_2fa_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range for 2FA ?\')">Delete</a>
3839	</td>
3840	</tr>';
3841	}
3842	}
3843	?>
3844	</table>
3845	<br />
3846	<form action="" method="post" id="lz_wl_2fa_form">
3847	<?php wp_nonce_field('loginizer-options'); ?>
3848	<input type="hidden" value="" name="" id="lz_wl_2fa_todo"/>
3849	</form>
3850	<br />
3851
3852	</div>
3853
3854	<?php
3855	loginizer_page_footer();
3856
3857	}
3858
3859	// Loginizer - PasswordLess Page
3860	function loginizer_page_passwordless(){
3861
3862	global $loginizer, $lz_error, $lz_env;
3863
3864	if(!current_user_can('manage_options')){
3865	wp_die('Sorry, but you do not have permissions to change settings.');
3866	}
3867
3868	if(!loginizer_is_premium() && count($_POST) > 0){
3869	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3870	return loginizer_page_passwordless_T();
3871	}
3872
3873	/* Make sure post was from this page */
3874	if(count($_POST) > 0){
3875	check_admin_referer('loginizer-options');
3876	}
3877
3878	if(isset($_POST['save_lz'])){
3879
3880	// In the future there can be more settings
3881	$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
3882	$option['passwordless_sub'] = lz_optpost('lz_passwordless_sub');
3883	$option['passwordless_msg'] = lz_optpost('lz_passwordless_msg');
3884	$option['passwordless_html'] = (int) lz_optpost('lz_passwordless_html');
3885
3886	// Is there an error ?
3887	if(!empty($lz_error)){
3888	return loginizer_page_passwordless_T();
3889	}
3890
3891	// Save the options
3892	update_option('loginizer_epl', $option);
3893
3894	// Mark as saved
3895	$GLOBALS['lz_saved'] = true;
3896
3897	}
3898
3899	// Call theme
3900	loginizer_page_passwordless_T();
3901	}
3902
3903	// Loginizer - PasswordLess Page Theme
3904	function loginizer_page_passwordless_T(){
3905
3906	global $loginizer, $lz_error, $lz_env;
3907
3908	$lz_options = get_option('loginizer_epl');
3909
3910	// Universal header
3911	loginizer_page_header('PasswordLess Settings');
3912
3913	loginizer_feature_available('PasswordLess Login');
3914
3915	// Saved ?
3916	if(!empty($GLOBALS['lz_saved'])){
3917	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3918	}
3919
3920	// Any errors ?
3921	if(!empty($lz_error)){
3922	lz_report_error($lz_error);echo '<br />';
3923	}
3924
3925	?>
3926
3927	<style>
3928	input[type="text"], textarea, select {
3929	width: 90%;
3930	}
3931
3932	.form-table label{
3933	font-weight:bold;
3934	}
3935
3936	.form-table td{
3937	vertical-align:top;
3938	}
3939
3940	.exp{
3941	font-size:12px;
3942	}
3943	</style>
3944
3945	<div id="" class="postbox">
3946
3947	<div class="postbox-header">
3948	<h2 class="hndle ui-sortable-handle">
3949	<span><?php echo __('PasswordLess Settings', 'loginizer'); ?></span>
3950	</h2>
3951	</div>
3952
3953	<div class="inside">
3954
3955	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3956	<?php wp_nonce_field('loginizer-options'); ?>
3957	<table class="form-table">
3958	<tr>
3959	<th scope="row" valign="top" style="width:350px !important"><label for="email_pass_less"><?php echo __('Enable PasswordLess Login', 'loginizer'); ?></label></th>
3960	<td>
3961	<input type="checkbox" value="1" name="email_pass_less" id="email_pass_less" <?php echo lz_POSTchecked('email_pass_less', (empty($loginizer['email_pass_less']) ? false : true)); echo (defined('SITEPAD') ? 'disabled="disabled"' : '') ?> />
3962	</td>
3963	</tr>
3964	<tr>
3965	<td colspan="2" valign="top">
3966	<?php echo __('If enabled, the login screen will just ask for the username <b>OR</b> email address of the user. If such a user exists, an email with a <b>One Time Login </b> link will be sent to the email address of the user. The link will be valid for 10 minutes only.', 'loginizer'); ?><br><br>
3967	<?php echo __('If a wrong username/email is given, the brute force checker will prevent any brute force attempt !', 'loginizer'); ?>
3968	</td>
3969	</tr>
3970	<tr>
3971	<td scope="row" valign="top">
3972	<label for="lz_passwordless_sub"><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3973	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3974	<br />Default : <?php echo @$loginizer['pl_d_sub']; ?>
3975	</td>
3976	<td valign="top">
3977	<input type="text" size="40" value="<?php echo lz_optpost('lz_passwordless_sub', @$lz_options['passwordless_sub']); ?>" name="lz_passwordless_sub" id="lz_passwordless_sub" />
3978	</td>
3979	</tr>
3980	<tr>
3981	<td scope="row" valign="top">
3982	<label for="lz_passwordless_msg"><?php echo __('Email Body', 'loginizer'); ?></label><br>
3983	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3984	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['pl_d_msg']; ?></pre>
3985	</td>
3986	<td valign="top">
3987	<textarea rows="10" name="lz_passwordless_msg" id="lz_passwordless_msg"><?php echo lz_optpost('lz_passwordless_msg', @$lz_options['passwordless_msg']); ?></textarea>
3988	<br />
3989	Variables :
3990	<br />$email - Users Email
3991	<br />$site_name - The Site Name
3992	<br />$site_url - The Site URL
3993	<br />$login_url - The Login URL
3994	</td>
3995	</tr>
3996	<tr>
3997	<th scope="row" valign="top" style="width:350px !important"><label for="lz_passwordless_html"><?php echo __('Send email as HTML', 'loginizer'); ?></label></th>
3998	<td>
3999	<input type="checkbox" value="1" name="lz_passwordless_html" id="lz_passwordless_html" <?php echo lz_POSTchecked('lz_passwordless_html', (empty($loginizer['passwordless_html']) ? false : true)); ?> />
4000	</td>
4001	</tr>
4002	</table><br />
4003	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4004	</form>
4005
4006	</div>
4007	</div>
4008	<br />
4009
4010	<?php
4011	loginizer_page_footer();
4012
4013	}
4014
4015	// Loginizer - Security Settings Page
4016	function loginizer_page_security(){
4017
4018	global $loginizer, $lz_error, $lz_env, $wpdb;
4019
4020	if(!current_user_can('manage_options')){
4021	wp_die('Sorry, but you do not have permissions to change settings.');
4022	}
4023
4024	if(!loginizer_is_premium() && count($_POST) > 0){
4025	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4026	return loginizer_page_security_T();
4027	}
4028
4029	/* Make sure post was from this page */
4030	if(count($_POST) > 0){
4031	check_admin_referer('loginizer-options');
4032	}
4033
4034	if(isset($_POST['save_lz'])){
4035
4036	$option['login_slug'] = lz_optpost('login_slug');
4037	$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
4038	$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
4039	$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
4040	$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
4041
4042	// Login Slug Valid ?
4043	if(!empty($option['login_slug'])){
4044	if(strlen($option['login_slug']) <= 4 \|\| strlen($option['login_slug']) > 50){
4045	$lz_error['login_slug'] = __('The Login slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4046	}
4047	}
4048
4049	// XML-RPC Slug Valid ?
4050	if(!empty($option['xmlrpc_slug'])){
4051	if(strlen($option['xmlrpc_slug']) <= 4 \|\| strlen($option['xmlrpc_slug']) > 50){
4052	$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4053	}
4054	}
4055
4056	// Is there an error ?
4057	if(!empty($lz_error)){
4058	return loginizer_page_security_T();
4059	}
4060
4061	// Save the options
4062	update_option('loginizer_security', $option);
4063
4064	// Mark as saved
4065	$GLOBALS['lz_saved'] = true;
4066
4067	}
4068
4069	// Reset the username
4070	if(isset($_POST['save_lz_admin'])){
4071
4072	// Get the new username
4073	$current_username = lz_optpost('current_username');
4074	$new_username = lz_optpost('new_username');
4075
4076	if(empty($current_username)){
4077	$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
4078	return loginizer_page_security_T();
4079	}
4080
4081	if(empty($new_username)){
4082	$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
4083	return loginizer_page_security_T();
4084	}
4085
4086	// Is the starting of the username having 'admin' ?
4087	if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
4088	$lz_error['user_exists'] = __('The username begins with <b>admin</b>. Please change it !', 'loginizer');
4089	return loginizer_page_security_T();
4090	}
4091
4092	// Lets check if there is such a user
4093	$found = get_user_by('login', $new_username);
4094
4095	// Found one !
4096	if(!empty($found->ID)){
4097	$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
4098	return loginizer_page_security_T();
4099	}
4100
4101	$old_user = get_user_by('login', $current_username);
4102
4103	if(empty($old_user->ID)){
4104	$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
4105	return loginizer_page_security_T();
4106	}
4107
4108	if(empty($old_user->caps['administrator'])){
4109	$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
4110	return loginizer_page_security_T();
4111	}
4112
4113	// Update the username
4114	$update_data = array('user_login' => $new_username);
4115	$where_data = array('ID' => $old_user->ID);
4116
4117	$format = array('%s');
4118	$where_format = array('%d');
4119
4120	$wpdb->update($wpdb->prefix.'users', $update_data, $where_data, $format, $where_format);
4121
4122	// Mark as saved
4123	$GLOBALS['lz_saved'] = true;
4124
4125	}
4126
4127	// Change the wp-admin slug
4128	if(isset($_POST['save_lz_wp_admin'])){
4129
4130	// Get the new username
4131	$option['admin_slug'] = lz_optpost('admin_slug');
4132	$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
4133	$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
4134	$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
4135
4136	// Did you agree to this ?
4137	if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
4138	$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
4139	return loginizer_page_security_T();
4140	}
4141
4142	// Length
4143	if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 \|\| strlen($option['admin_slug']) > 50)){
4144	$lz_error['admin_slug'] = __('The new Admin slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4145	return loginizer_page_security_T();
4146	}
4147
4148	// Only regular characters
4149	if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
4150	$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
4151	return loginizer_page_security_T();
4152	}
4153
4154	// Update the option
4155	update_option('loginizer_wp_admin', $option);
4156
4157	// Mark as saved
4158	$GLOBALS['lz_saved'] = true;
4159
4160	}
4161
4162
4163	// Save blacklisted usernames
4164	if(isset($_POST['save_lz_bl_users'])){
4165
4166	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
4167
4168	// Process the usernames i.e. remove blanks
4169	foreach($usernames as $k => $v){
4170	$v = trim($v);
4171
4172	// Unset blank values
4173	if(empty($v)){
4174	unset($usernames[$k]);
4175	}
4176
4177	// Disallow these special characters to avoid XSS or any other security vulnerability
4178	if(preg_match('/[\<\>\"\']/', $v)){
4179	unset($usernames[$k]);
4180	}
4181	}
4182
4183	// Update the blacklist
4184	update_option('loginizer_username_blacklist', array_values($usernames));
4185
4186	// Mark as saved
4187	$GLOBALS['lz_saved'] = true;
4188
4189	}
4190
4191
4192	// Save blacklisted domains
4193	if(isset($_POST['save_lz_bl_domains'])){
4194
4195	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
4196
4197	// Process the domains i.e. remove blanks
4198	foreach($domains as $k => $v){
4199	$v = trim($v);
4200
4201	// Unset blank values
4202	if(empty($v)){
4203	unset($domains[$k]);
4204	}
4205
4206	// Disallow these special characters to avoid XSS or any other security vulnerability
4207	if(preg_match('/[\<\>\"\']/', $v)){
4208	unset($domains[$k]);
4209	}
4210	}
4211
4212	// Update the blacklist
4213	update_option('loginizer_domains_blacklist', array_values($domains));
4214
4215	// Mark as saved
4216	$GLOBALS['lz_saved'] = true;
4217
4218	}
4219
4220	// Call theme
4221	loginizer_page_security_T();
4222
4223	}
4224
4225	// Loginizer - Security Settings Page Theme
4226	function loginizer_page_security_T(){
4227
4228	global $loginizer, $lz_error, $lz_env;
4229
4230	// Universal header
4231	loginizer_page_header('Security Settings');
4232
4233	loginizer_feature_available('Security Settings');
4234
4235	// Saved ?
4236	if(!empty($GLOBALS['lz_saved'])){
4237	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4238	}
4239
4240	// Any errors ?
4241	if(!empty($lz_error)){
4242	lz_report_error($lz_error);echo '<br />';
4243	}
4244
4245	$current_admin = get_user_by('id', 1);
4246
4247	?>
4248
4249	<style>
4250	input[type="text"], textarea, select {
4251	width: 70%;
4252	}
4253
4254	.form-table label{
4255	font-weight:bold;
4256	}
4257
4258	.exp{
4259	font-size:12px;
4260	}
4261	</style>
4262
4263	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4264
4265	<div id="" class="postbox">
4266
4267	<div class="postbox-header">
4268	<h2 class="hndle ui-sortable-handle">
4269	<span><?php echo __('Rename Login Page', 'loginizer'); ?></span>
4270	</h2>
4271	</div>
4272
4273	<div class="inside">
4274
4275	<?php wp_nonce_field('loginizer-options'); ?>
4276	<table class="form-table">
4277	<tr>
4278	<td scope="row" valign="top" colspan="2">
4279	<i>You can rename your Login page from <b><?php echo $loginizer['login_basename']; ?></b> to anything of your choice e.g. mylogin. This would make it very difficult for automated attack bots to know where to login !</i>
4280	</td>
4281	</tr>
4282	<tr>
4283	<td scope="row" valign="top" style="width:40% !important">
4284	<label><?php echo __('New Login Slug', 'loginizer'); ?></label><br>
4285	<span class="exp"><?php echo __('Set blank to reset to the original login URL', 'loginizer'); ?></span>
4286	</td>
4287	<td>
4288	<input type="text" size="50" value="<?php echo lz_POSTval('login_slug', $loginizer['login_slug']); ?>" name="login_slug" />
4289	</td>
4290	</tr>
4291
4292	<?php
4293
4294	if(!defined('SITEPAD')){
4295
4296	?>
4297	<tr>
4298	<td scope="row" valign="top" style="width:200px !important">
4299	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
4300	<span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
4301	</td>
4302	<td>
4303	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
4304	</td>
4305	</tr>
4306
4307	<?php
4308
4309	}
4310
4311	?>
4312	</table><br />
4313	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4314
4315	</div>
4316	</div>
4317	<br />
4318
4319	<?php
4320
4321	if(!defined('SITEPAD')){
4322
4323	?>
4324
4325	<div id="" class="postbox">
4326
4327	<div class="postbox-header">
4328	<h2 class="hndle ui-sortable-handle">
4329	<span><?php echo __('XML-RPC Settings', 'loginizer'); ?></span>
4330	</h2>
4331	</div>
4332
4333	<div class="inside">
4334
4335	<?php wp_nonce_field('loginizer-options'); ?>
4336	<table class="form-table">
4337	<tr>
4338	<td scope="row" valign="top" colspan="2">
4339	<i><?php echo __('WordPress\'s XML-RPC feature allows external services to access and modify content on the site. Services like the Jetpack plugin, the WordPress mobile app, pingbacks, etc make use of the XML-RPC feature. If this site does not use a service that requires XML-RPC, please <b>disable</b> the XML-RPC feature as it prevents attackers from using the feature to attack the site. If your service can use a custom XML-RPC URL, you can also <b>rename</b> the XML-RPC page to a <b>custom slug</b>.', 'loginizer'); ?></i>
4340	</td>
4341	</tr>
4342	<tr>
4343	<td scope="row" valign="top" style="width:40% !important">
4344	<label><?php echo __('Disable XML-RPC', 'loginizer'); ?></label>
4345	</td>
4346	<td>
4347	<input type="checkbox" value="1" name="xmlrpc_disable" <?php echo lz_POSTchecked('xmlrpc_disable', (empty($loginizer['xmlrpc_disable']) ? false : true)); ?> />
4348	</td>
4349	</tr>
4350	<tr>
4351	<td scope="row" valign="top" style="width:40% !important">
4352	<label><?php echo __('Disable Pingbacks', 'loginizer'); ?></label>
4353	</td>
4354	<td>
4355	<input type="checkbox" value="1" name="pingbacks_disable" <?php echo lz_POSTchecked('pingbacks_disable', (empty($loginizer['pingbacks_disable']) ? false : true)); ?> />
4356	</td>
4357	</tr>
4358	<tr>
4359	<td scope="row" valign="top">
4360	<label><?php echo __('New XML-RPC Slug', 'loginizer'); ?></label><br>
4361	<span class="exp"><?php echo __('Set blank to reset to the original XML-RPC URL', 'loginizer'); ?></span>
4362	</td>
4363	<td>
4364	<input type="text" size="50" value="<?php echo lz_optpost('xmlrpc_slug', $loginizer['xmlrpc_slug']); ?>" name="xmlrpc_slug" />
4365	</td>
4366	</tr>
4367	</table><br />
4368	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4369
4370	</div>
4371	</div>
4372	<br />
4373
4374	<?php
4375
4376	}
4377
4378	?>
4379
4380	</form>
4381
4382	<?php
4383
4384	if(!defined('SITEPAD')){
4385
4386	?>
4387
4388	<script type="text/javascript">
4389
4390
4391	function dirname(path) {
4392	return path.replace(/\\/g, '/').replace(/\/[^/]*\/?$/, '');
4393	}
4394
4395	function lz_test_wp_admin(){
4396
4397	var data = new Object();
4398	data["action"] = "loginizer_wp_admin";
4399	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax');?>";
4400
4401	var new_ajaxurl = dirname(dirname(ajaxurl))+'/'+jQuery('#lz_admin_slug').val()+'/admin-ajax.php';
4402
4403	// AJAX and on success function
4404	jQuery.post(new_ajaxurl, data, function(response){
4405
4406	if(response['result'] == 1){
4407	alert("<?php echo __('Everything seems to be good. You can proceed to save the settings !', 'loginizer'); ?>");
4408	}
4409
4410	// Throw an error for failures
4411	}).fail(function() {
4412	alert("<?php echo __('There was an error connecting to WordPress with the new Admin Slug. Did you configure everything properly ?', 'loginizer'); ?>");
4413	});
4414	//jQuery.ajax('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4415	return false;
4416	};
4417
4418	</script>
4419
4420	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4421	<div id="" class="postbox">
4422
4423	<div class="postbox-header">
4424	<h2 class="hndle ui-sortable-handle">
4425	<span><?php echo __('Rename wp-admin access', 'loginizer'); ?></span>
4426	</h2>
4427	</div>
4428
4429	<div class="inside">
4430
4431	<?php wp_nonce_field('loginizer-options'); ?>
4432	<table class="form-table">
4433	<?php
4434	if(preg_match('/(apache\|litespeed\|lsws)/is', $_SERVER["SERVER_SOFTWARE"])){
4435	// Supported. Do nothing
4436	}else{
4437	echo '<tr>
4438	<td scope="row" valign="top" colspan="2">
4439	<div style="color:#a94442; background-color:#f2dede; border-color:#ebccd1; padding:15px; border:1px solid transparent; border-radius:4px;">'.__('Rename wp-admin access feature is supported only on Apache and Litespeed', 'loginizer').'</div>
4440	</td>
4441	</tr>';
4442	}
4443	?>
4444	<tr>
4445	<td scope="row" valign="top" colspan="2">
4446	<i>You can rename your WordPress Admin access URL <b>wp-admin</b> to anything of your choice e.g. my-admin. This will require you to change .htaccess, so please follow <a href="<?php echo LOGINIZER_DOCS;?>Renaming_the_WP-Admin_Area" target="_blank">our guide</a> on how to do so !</i>
4447	</td>
4448	</tr>
4449	<tr>
4450	<td scope="row" valign="top" style="width:40% !important">
4451	<label><?php echo __('New wp-admin Slug', 'loginizer'); ?></label><br>
4452	<span class="exp"><?php echo __('Set blank to reset to the original wp-admin URL', 'loginizer'); ?></span>
4453	</td>
4454	<td>
4455	<input type="text" size="50" value="<?php echo lz_optpost('admin_slug', $loginizer['admin_slug']); ?>" name="admin_slug" id="lz_admin_slug" />
4456	</td>
4457	</tr>
4458	<tr>
4459	<td scope="row" valign="top" style="width:200px !important">
4460	<label><?php echo __('Disable wp-admin access', 'loginizer'); ?></label><br>
4461	<span class="exp"><?php echo __('If set, then only the new admin slug will work and access to the Old Admin Slug i.e. wp-admin will be disabled. If anyone accesses wp-admin, a warning will be shown.<br><label>NOTE: Please use this option cautiously !</label>', 'loginizer'); ?></span>
4462	</td>
4463	<td>
4464	<input type="checkbox" id="lz_restrict_wp_admin" onchange="lz_wp_admin_msg_toggle()" value="1" name="restrict_wp_admin" <?php echo lz_POSTchecked('restrict_wp_admin', (empty($loginizer['restrict_wp_admin']) ? false : true)); ?> />
4465	</td>
4466	</tr>
4467	<tr id="lz_wp_admin_msg_row" style="display:none">
4468	<td scope="row" valign="top">
4469	<label><?php echo __('WP-Admin Error Message', 'loginizer'); ?></label><br>
4470	<span class="exp"><?php echo __('Error message to show if someone accesses wp-admin', 'loginizer'); ?></span> Default : <?php echo $loginizer['wp_admin_d_msg']; ?>
4471	</td>
4472	<td>
4473	<input type="text" size="50" value="<?php echo lz_htmlizer(!empty($_POST['wp_admin_msg']) ? stripslashes($_POST['wp_admin_msg']) : @$loginizer['wp_admin_msg']); ?>" name="wp_admin_msg" id="lz_wp_admin_msg" />
4474	</td>
4475	</tr>
4476	<tr>
4477	<td scope="row" valign="top" style="width:200px !important">
4478	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
4479	<span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
4480	</td>
4481	<td>
4482	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
4483	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
4484	</td>
4485	</tr>
4486	</table><br />
4487	<center><input name="save_lz_wp_admin" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4488
4489	</div>
4490	</div>
4491	<br />
4492	</form>
4493
4494	<script type="text/javascript">
4495
4496	function lz_wp_admin_msg_toggle(){
4497	var ele = jQuery('#lz_restrict_wp_admin')[0];
4498	if(ele.checked){
4499	jQuery('#lz_wp_admin_msg_row').show();
4500	}else{
4501	jQuery('#lz_wp_admin_msg_row').hide();
4502	}
4503	};
4504
4505	lz_wp_admin_msg_toggle();
4506
4507	</script>
4508
4509
4510	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4511	<div id="" class="postbox">
4512
4513	<div class="postbox-header">
4514	<h2 class="hndle ui-sortable-handle">
4515	<span><?php echo __('Change Admin Username', 'loginizer'); ?></span>
4516	</h2>
4517	</div>
4518
4519	<div class="inside">
4520
4521	<?php wp_nonce_field('loginizer-options'); ?>
4522	<table class="form-table">
4523	<tr>
4524	<td scope="row" valign="top" colspan="2">
4525	<i><?php echo __('You can change the Admin Username from here to anything of your choice e.g. iamtheboss. This would make it very difficult for automated attack bots to know what is the admin username !', 'loginizer'); ?></i>
4526	</td>
4527	</tr>
4528	<tr>
4529	<td scope="row" valign="top" style="width:40% !important">
4530	<label for="current_username"><?php echo __('Current Username', 'loginizer'); ?></label><br>
4531	<span class="exp"><?php echo __('The current username you want to change', 'loginizer'); ?></span>
4532	</td>
4533	<td>
4534	<input type="text" size="50" value="<?php echo lz_optpost('current_username', (!empty($current_admin->user_login) ? $current_admin->user_login : '')); ?>" name="current_username" id="current_username" />
4535	</td>
4536	</tr>
4537	<tr>
4538	<td scope="row" valign="top" style="width:40% !important">
4539	<label for="new_username"><?php echo __('New Username', 'loginizer'); ?></label><br>
4540	<span class="exp"><?php echo __('The new username you want to set', 'loginizer'); ?></span>
4541	</td>
4542	<td>
4543	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
4544	</td>
4545	</tr>
4546	</table><br />
4547	<i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
4548	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
4549
4550	</div>
4551	</div>
4552	</form>
4553
4554	<script type="text/javascript">
4555	function add_lz_bl_users(){
4556	jQuery("#lz_bl_users").append('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4557	return false;
4558	};
4559	</script>
4560
4561	<style>
4562	.lz_bl_users, .lz_bl_domains{
4563	margin-bottom:20px;
4564	}
4565	</style>
4566
4567	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4568	<div id="" class="postbox">
4569
4570	<div class="postbox-header">
4571	<h2 class="hndle ui-sortable-handle">
4572	<span><?php echo __('Username Auto Blacklist', 'loginizer'); ?></span>
4573	</h2>
4574	</div>
4575
4576	<div class="inside">
4577
4578	<?php wp_nonce_field('loginizer-options'); ?>
4579	<table class="form-table">
4580	<tr>
4581	<td scope="row" valign="top" colspan="2">
4582	<i><?php echo __('Attackers generally use common usernames like <b>admin, administrator, or variations of your domain name / business name</b>. You can specify such username here and Loginizer will auto-blacklist the IP Address(s) of clients who try to use such username(s).', 'loginizer'); ?></i>
4583	</td>
4584	</tr>
4585	<tr>
4586	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
4587	<label><?php echo __('Username(s)', 'loginizer'); ?></label><br>
4588	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
4589	</td>
4590	<td>
4591	<div id="lz_bl_users">
4592	<?php
4593
4594	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : $loginizer['username_blacklist'];
4595
4596	if(empty($usernames)){
4597	$usernames[] = '';
4598	}
4599
4600	foreach($usernames as $_user){
4601
4602	// Disallow these special characters to avoid XSS or any other security vulnerability
4603	if(preg_match('/[\<\>\"\']/', $_user)){
4604	continue;
4605	}
4606
4607	echo '<input type="text" size="30" value="'.$_user.'" name="lz_bl_users[]" class="lz_bl_users" />';
4608	}
4609
4610	?>
4611	</div>
4612	<br />
4613	<input class="button" type="button" value="<?php echo __('Add New Username', 'loginizer'); ?>" onclick="return add_lz_bl_users();" style="float:right" />
4614	</td>
4615	</tr>
4616	</table><br />
4617	<center><input name="save_lz_bl_users" class="button button-primary action" value="<?php echo __('Save Username(s)', 'loginizer'); ?>" type="submit" /></center>
4618
4619	</div>
4620	</div>
4621	</form>
4622
4623	<script type="text/javascript">
4624	function add_lz_bl_domains(){
4625	jQuery("#lz_bl_domains").append('<input type="text" size="30" value="" name="lz_bl_domains[]" class="lz_bl_domains" />');
4626	return false;
4627	};
4628	</script>
4629
4630
4631	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4632	<div id="" class="postbox">
4633
4634	<div class="postbox-header">
4635	<h2 class="hndle ui-sortable-handle">
4636	<span><?php echo __('New Registration Domain Blacklist', 'loginizer'); ?></span>
4637	</h2>
4638	</div>
4639
4640	<div class="inside">
4641
4642	<?php wp_nonce_field('loginizer-options'); ?>
4643	<table class="form-table">
4644	<tr>
4645	<td scope="row" valign="top" colspan="2">
4646	<i>If you would like to ban new registrations from a particular domain, you can use this utility to do so.</i>
4647	</td>
4648	</tr>
4649	<tr>
4650	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
4651	<label><?php echo __('Domain(s)', 'loginizer'); ?></label><br>
4652	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
4653	</td>
4654	<td>
4655	<div id="lz_bl_domains">
4656	<?php
4657
4658	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : $loginizer['domains_blacklist'];
4659
4660	if(empty($domains)){
4661	$domains[] = '';
4662	}
4663
4664	foreach($domains as $_domain){
4665
4666	// Disallow these special characters to avoid XSS or any other security vulnerability
4667	if(preg_match('/[\<\>\"\']/', $_domain)){
4668	continue;
4669	}
4670
4671	echo '<input type="text" size="30" value="'.$_domain.'" name="lz_bl_domains[]" class="lz_bl_domains" />';
4672	}
4673
4674	?>
4675	</div>
4676	<br />
4677	<input class="button" type="button" value="<?php echo __('Add New Domain', 'loginizer'); ?>" onclick="return add_lz_bl_domains();" style="float:right" />
4678	</td>
4679	</tr>
4680	</table><br />
4681	<center><input name="save_lz_bl_domains" class="button button-primary action" value="<?php echo __('Save Domains(s)', 'loginizer'); ?>" type="submit" /></center>
4682
4683	</div>
4684	</div>
4685	</form>
4686
4687	<?php
4688
4689	}
4690
4691	loginizer_page_footer();
4692
4693	}
4694
4695	// Loginizer - Checksum load data
4696	function loginizer_page_checksums_L(&$files, &$_ignores){
4697
4698	global $loginizer, $lz_error, $lz_env;
4699
4700	// Load any mismatched files and ignores
4701	$files = get_option('loginizer_checksums_diff');
4702	$_ignores = get_option('loginizer_checksums_ignore');
4703	$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
4704	$ignores = array();
4705
4706	foreach($_ignores as $ik => $iv){
4707	$ignores[$iv] = array();
4708	if(!empty($files[$iv])){
4709	$ignores[$iv] = $files[$iv];
4710	}
4711	}
4712
4713	$lz_env['files'] = $files;
4714	$lz_env['ignores'] = $ignores;
4715
4716	}
4717
4718	// Loginizer - PasswordLess Page
4719	function loginizer_page_checksums(){
4720
4721	global $loginizer, $lz_error, $lz_env;
4722
4723	if(!current_user_can('manage_options')){
4724	wp_die('Sorry, but you do not have permissions to change settings.');
4725	}
4726
4727	if(!loginizer_is_premium() && count($_POST) > 0){
4728	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4729	return loginizer_page_checksums_T();
4730	}
4731
4732	/* Make sure post was from this page */
4733	if(count($_POST) > 0){
4734	check_admin_referer('loginizer-options');
4735	}
4736
4737	// Are we to run it ?
4738	if(isset($_REQUEST['lz_run_checksum'])){
4739	loginizer_checksums();
4740	}
4741
4742	loginizer_page_checksums_L($files, $_ignores);
4743
4744	$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
4745	$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
4746	$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
4747
4748	if(isset($_POST['save_lz'])){
4749
4750	// In the future there can be more settings
4751	$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
4752	$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
4753	$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
4754	$option['checksum_time'] = lz_optpost('checksum_time');
4755
4756	// Is there an error ?
4757	if(!empty($lz_error)){
4758	return loginizer_page_checksums_T();
4759	}
4760
4761	// Save the options
4762	update_option('loginizer_checksums', $option);
4763
4764	// Mark as saved
4765	$GLOBALS['lz_saved'] = true;
4766
4767	}
4768
4769	// Add or remove from ignore list
4770	if(isset($_POST['save_lz_csum_ig'])){
4771
4772	if(@is_array($_POST['checksum_del_ignore'])){
4773
4774	foreach($_POST['checksum_del_ignore'] as $k => $v){
4775	$key = array_search($v, $_ignores);
4776	if($key !== false){
4777	unset($_ignores[$key]);
4778	}
4779	}
4780
4781	// Save it
4782	update_option('loginizer_checksums_ignore', $_ignores);
4783
4784	}
4785
4786	if(@is_array($_POST['checksum_add_ignore'])){
4787
4788	foreach($_POST['checksum_add_ignore'] as $k => $v){
4789	if(!empty($files[$v])){
4790	$_ignores[] = $v;
4791	}
4792	}
4793
4794	// Save it
4795	update_option('loginizer_checksums_ignore', $_ignores);
4796
4797	}
4798
4799	// Reload
4800	loginizer_page_checksums_L($files, $_ignores);
4801
4802	// Mark as saved
4803	$GLOBALS['lz_saved'] = true;
4804
4805	}
4806
4807	// Call theme
4808	loginizer_page_checksums_T();
4809	}
4810
4811	// Loginizer - PasswordLess Page Theme
4812	function loginizer_page_checksums_T(){
4813
4814	global $loginizer, $lz_error, $lz_env;
4815
4816	// Universal header
4817	loginizer_page_header('File Checksum Settings');
4818
4819	loginizer_feature_available('File Checksum');
4820
4821	wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
4822	wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
4823
4824	// Saved ?
4825	if(!empty($GLOBALS['lz_saved'])){
4826	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4827	}
4828
4829	// Did we just run the checksums
4830	if(isset($_REQUEST['lz_run_checksum'])){
4831	echo '<div id="message" class="updated"><p>'. __('The Checksum process was executed successfully', 'loginizer'). '</p></div><br />';
4832	}
4833
4834	// Any errors ?
4835	if(!empty($lz_error)){
4836	lz_report_error($lz_error);echo '<br />';
4837	}
4838
4839	?>
4840
4841	<style>
4842	input[type="text"], textarea, select {
4843	width: 70%;
4844	}
4845
4846	.form-table label{
4847	font-weight:bold;
4848	}
4849
4850	.exp{
4851	font-size:12px;
4852	}
4853	</style>
4854
4855	<script>
4856	function lz_apply_status(ele, the_class){
4857
4858	var status = ele.checked;
4859	jQuery(the_class).each(function(){
4860	this.checked = status;
4861	});
4862
4863	}
4864	</script>
4865
4866	<div id="" class="postbox">
4867	<div class="postbox-header">
4868	<h2 class="hndle ui-sortable-handle">
4869	<span><?php echo __('Checksum Settings', 'loginizer'); ?></span>
4870	</h2>
4871	</div>
4872	<div class="inside">
4873
4874	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4875	<?php wp_nonce_field('loginizer-options'); ?>
4876	<table class="form-table">
4877	<tr>
4878	<td scope="row" valign="top" style="width:400px !important">
4879	<label><?php echo __('Disable Checksum of WP Core', 'loginizer'); ?></label><br>
4880	<span class="exp"><?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?></span>
4881	</td>
4882	<td valign="top">
4883	<input type="checkbox" value="1" name="disable_checksum" <?php echo lz_POSTchecked('disable_checksum', (empty($loginizer['disable_checksum']) ? false : true)); ?> />
4884	</td>
4885	</tr>
4886	<tr>
4887	<td scope="row" valign="top" style="width:400px !important">
4888	<label><?php echo __('Disable Email of Checksum Results', 'loginizer'); ?></label><br>
4889	<span class="exp"><?php echo __('If checked, Loginizer will not email you the checksum results.', 'loginizer'); ?></span>
4890	</td>
4891	<td valign="top">
4892	<input type="checkbox" value="1" name="no_checksum_email" <?php echo lz_POSTchecked('no_checksum_email', (empty($loginizer['no_checksum_email']) ? false : true)); ?> />
4893	</td>
4894	</tr>
4895	<tr>
4896	<td scope="row" valign="top" style="width:400px !important">
4897	<label><?php echo __('Checksum Frequency', 'loginizer'); ?></label><br>
4898	<span class="exp"><?php echo __('If Checksum is enabled, at what frequency should the checksums be performed.', 'loginizer'); ?></span>
4899	</td>
4900	<td valign="top">
4901	<select name="checksum_frequency">
4902	<?php
4903	foreach($lz_env['csum_freq'] as $k => $v){
4904	echo '<option '.lz_POSTselect('checksum_frequency', $k, ($loginizer['checksum_frequency'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
4905	}
4906	?>
4907	</select>
4908	</td>
4909	</tr>
4910	<tr id="lz_checksum_time">
4911	<td scope="row" valign="top" style="width:400px !important">
4912	<label><?php echo __('Time of Day', 'loginizer'); ?></label><br>
4913	<span class="exp"><?php echo __('If Checksum is enabled, what time of day should Loginizer do the check. Note : The check will be done on or after this time has elapsed as per the accesses being made.', 'loginizer'); ?></span>
4914	</td>
4915	<td valign="top">
4916	<div class="input-group clockpicker" data-autoclose="true">
4917	<input type="text" name="checksum_time" class="form-control" value="<?php echo (empty($loginizer['checksum_time']) ? '00:00' : $loginizer['checksum_time']);?>">
4918	<span class="input-group-addon">
4919	<span class="glyphicon glyphicon-time"></span>
4920	</span>
4921	</div>
4922	<script type="text/javascript">
4923	jQuery(document).ready(function(){
4924	(function($) {
4925	$('.clockpicker').clockpicker({donetext: 'Done'});
4926	})(jQuery);
4927	});
4928	</script>
4929	</td>
4930	</tr>
4931	<tr>
4932	<td colspan="2">
4933	<?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?>
4934	</td>
4935	</tr>
4936	</table><br />
4937	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /><input name="lz_run_checksum" style="float:right; background: #5cb85c; color:white; border:#5cb85c" class="button button-secondary" value="<?php echo __('Do a Checksum Now', 'loginizer'); ?>" type="submit" /></center>
4938	</form>
4939
4940	</div>
4941	</div>
4942
4943	<div id="" class="postbox">
4944
4945	<div class="postbox-header">
4946	<h2 class="hndle ui-sortable-handle">
4947	<span><?php echo __('Mismatching Files', 'loginizer'); ?></span>
4948	</h2>
4949	</div>
4950
4951	<div class="inside">
4952
4953	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4954	<?php wp_nonce_field('loginizer-options'); ?>
4955	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
4956	<?php
4957
4958	$files = $lz_env['files'];
4959
4960	// Avoid undefined notice for $files
4961	if(!empty($files)){
4962	foreach($files as $k => $v){
4963	if(!empty($lz_env['ignores'][$k])){
4964	unset($files[$k]);
4965	}
4966	}
4967	}
4968
4969	echo '
4970	<tr>
4971	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
4972	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
4973	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
4974	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_add_ig\');" /></th>
4975	</tr>';
4976
4977	if(is_array($files) && count($files) > 0){
4978
4979	foreach($files as $k => $v){
4980
4981	echo '
4982	<tr>
4983	<td>'.$k.'</td>
4984	<td>'.$v['cur_md5'].'</td>
4985	<td>'.$v['md5'].'</td>
4986	<td><input type="checkbox" name="checksum_add_ignore[]" class="csum_add_ig" value="'.$k.'" /></td>
4987	</tr>';
4988
4989	}
4990
4991	}else{
4992
4993	echo '
4994	<tr>
4995	<td colspan="4" align="center">'.__('This is great ! No file with any wrong checksum has been found.').'</td>
4996	</tr>';
4997
4998	}
4999
5000	?>
5001	</table><br />
5002	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Add Selected to Ignore List', 'loginizer'); ?>" type="submit" /></center>
5003	</form>
5004	</div>
5005
5006	</div>
5007	<br />
5008
5009	<div id="" class="postbox">
5010
5011	<div class="postbox-header">
5012	<h2 class="hndle ui-sortable-handle">
5013	<span><?php echo __('Ignore List', 'loginizer'); ?></span>
5014	</h2>
5015	</div>
5016
5017	<div class="inside">
5018
5019	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5020	<?php wp_nonce_field('loginizer-options'); ?>
5021	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5022	<?php
5023
5024	$ignores = $lz_env['ignores'];
5025
5026	echo '
5027	<tr>
5028	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5029	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5030	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5031	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_del_ig\');" /></th>
5032	</tr>';
5033
5034	// Load any mismatched files
5035	$files = $ignores;
5036
5037	if(is_array($files) && count($files) > 0){
5038
5039	foreach($files as $k => $v){
5040
5041	echo '
5042	<tr>
5043	<td>'.$k.'</td>
5044	<td>'.$v['cur_md5'].'</td>
5045	<td>'.$v['md5'].'</td>
5046	<td><input type="checkbox" name="checksum_del_ignore[]" class="csum_del_ig" value="'.$k.'" /></td>
5047	</tr>';
5048
5049	}
5050
5051	}else{
5052
5053	echo '
5054	<tr>
5055	<td colspan="4" align="center">'.__('No files have been added to the ignore list').'</td>
5056	</tr>';
5057
5058	}
5059
5060	?>
5061	</table><br />
5062	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Remove Selected from Ignore List', 'loginizer'); ?>" type="submit" /></center>
5063	</form>
5064	</div>
5065
5066	</div>
5067	<br />
5068
5069	<?php
5070	loginizer_page_footer();
5071
5072	}
5073
5074	function loginizer_dismiss_newsletter(){
5075
5076	// Some AJAX security
5077	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5078
5079	if(!current_user_can('manage_options')){
5080	wp_die('Sorry, but you do not have permissions to change settings.');
5081	}
5082
5083	update_option('loginizer_dismiss_newsletter', time());
5084	echo 1;
5085	wp_die();
5086	}
5087
5088	add_action('wp_ajax_loginizer_dismiss_newsletter', 'loginizer_dismiss_newsletter');
5089
5090	function loginizer_newsletter_subscribe(){
5091
5092	$newsletter_dismiss = get_option('loginizer_dismiss_newsletter');
5093
5094	if(!empty($newsletter_dismiss)){
5095	return;
5096	}
5097
5098	$env['url'] = 'https://loginizer.com/';
5099
5100	echo '
5101	<style>
5102	.newsletter_container{
5103	color: #000000;
5104	background: #FFFFFF;
5105	text-align:center;
5106	}
5107	.subscribe_form_row{
5108	color: #000000;
5109	padding-bottom:0px !important;
5110	}
5111	.subscribe_heading{
5112	font-size:22px;
5113	}
5114	</style>
5115
5116	<div class="notice my-loginizer-dismiss-notice is-dismissible" style="background:#FFF;padding:15px; border: 1px solid #ccd0d4; width:80%;margin-left:0px;margin:auto;">
5117	<div class="container">
5118	<div class="col-md-6 col-md-offset-3 text-center newsletter_container">
5119	<h2 style="font-weight:100; margin-bottom:20px; margin-top:5px;" class="subscribe_heading">Subscribe to our Newsletter</h2>
5120	<form class="form-inline" action="" method="POST">
5121	<div class="row subscribe_form_row">
5122	<div class="col-md-12">
5123	<input type="email" name="email" size="40" id="subscribe_email" class="" placeholder="email@example.com" value="">
5124	<input type="button" name="subscribe" id="subscribe_button" class="button button-primary" value="Subscribe" onclick="loginizer_email_subscribe();" style="margin-top:0px;">
5125	</div>
5126	<div class="col-md-3">
5127	</div>
5128	</div>
5129	</form>
5130	<p><b>Note :</b> If a Loginizer account does not exist it will be created.</p>
5131	</div>
5132	</div>
5133	</div><br />
5134
5135	<script type="text/javascript">
5136	function loginizer_dismiss_newsletter(){
5137
5138	var data = new Object();
5139	data["action"] = "loginizer_dismiss_newsletter";
5140	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5141
5142	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5143	jQuery.post(admin_url, data, function(response){
5144
5145	});
5146
5147	}
5148
5149	function loginizer_email_subscribe(){
5150	var subs_location = "'.$env['url'].'?email="+encodeURIComponent(jQuery("#subscribe_email").val());
5151	window.open(subs_location, "_blank");
5152	}
5153	jQuery(document).on("click", ".my-loginizer-dismiss-notice .notice-dismiss", loginizer_dismiss_newsletter);
5154	</script>';
5155
5156	return true;
5157	}
5158
5159
5160	// Sorry to see you going
5161	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
5162
5163	function loginizer_deactivation(){
5164
5165	global $wpdb;
5166
5167	$sql = array();
5168	$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
5169
5170	foreach($sql as $sk => $sv){
5171	$wpdb->query($sv);
5172	}
5173
5174	delete_option('loginizer_version');
5175	delete_option('loginizer_options');
5176	delete_option('loginizer_last_reset');
5177	delete_option('loginizer_whitelist');
5178	delete_option('loginizer_blacklist');
5179	delete_option('loginizer_msg');
5180	delete_option('loginizer_2fa_msg');
5181	delete_option('loginizer_2fa_email_template');
5182	delete_option('loginizer_security');
5183	delete_option('loginizer_wp_admin');
5184
5185	}
5186
5187