loginizer / init.php

init.php in Loginizer 1.7.1, at init.php

5,280 lines 174.2 KB

Raw Download Zip

1	<?php
2
3	if(!function_exists('add_action')){
4	echo 'You are not allowed to access this page directly.';
5	exit;
6	}
7
8	define('LOGINIZER_VERSION', '1.7.1');
9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14
15	include_once(LOGINIZER_DIR.'/functions.php');
16
17	// Ok so we are now ready to go
18	register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
19
20	// Is called when the ADMIN enables the plugin
21	function loginizer_activation(){
22
23	global $wpdb;
24
25	$sql = array();
26
27	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28
29	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	`username` varchar(255) NOT NULL DEFAULT '',
31	`time` int(10) NOT NULL DEFAULT '0',
32	`count` int(10) NOT NULL DEFAULT '0',
33	`lockout` int(10) NOT NULL DEFAULT '0',
34	`ip` varchar(255) NOT NULL DEFAULT '',
35	`url` varchar(255) NOT NULL DEFAULT '',
36	UNIQUE KEY `ip` (`ip`)
37	) DEFAULT CHARSET=utf8;";
38
39	foreach($sql as $sk => $sv){
40	$wpdb->query($sv);
41	}
42
43	add_option('loginizer_version', LOGINIZER_VERSION);
44	add_option('loginizer_options', array());
45	add_option('loginizer_last_reset', 0);
46	add_option('loginizer_whitelist', array());
47	add_option('loginizer_blacklist', array());
48	add_option('loginizer_2fa_whitelist', array());
49
50	}
51
52	/**
53	* Updates the database structure for Loginizer
54	*
55	* If the plugin files are updated but database structure is not updated
56	* this function will update the database structure as per the plugin version
57	* NOTE: This does not update plugin files it just updates the database structure
58	*/
59	function loginizer_update_check(){
60
61	global $wpdb;
62
63	$sql = array();
64	$current_version = get_option('loginizer_version');
65
66	// It must be the 1.0 pre stuff
67	if(empty($current_version)){
68	$current_version = get_option('lz_version');
69	}
70
71	$version = (int) str_replace('.', '', $current_version);
72
73	// No update required
74	if($current_version == LOGINIZER_VERSION){
75	return true;
76	}
77
78	// Is it first run ?
79	if(empty($current_version)){
80
81	// Reinstall
82	loginizer_activation();
83
84	// Trick the following if conditions to not run
85	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
86
87	}
88
89	// Is it less than 1.0.1 ?
90	if($version < 101){
91
92	// TODO : GET the existing settings
93
94	// Get the existing settings
95	$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
96	$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
97	$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
98
99	// Delete the three tables
100	$sql = array();
101	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
102	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
103	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
104
105	foreach($sql as $sk => $sv){
106	$wpdb->query($sv);
107	}
108
109	// Delete option
110	delete_option('lz_version');
111
112	// Reinstall
113	loginizer_activation();
114
115	// TODO : Save the existing settings
116
117	// Update the existing failed logs to new table
118	if(is_array($lz_failed_logs)){
119	foreach($lz_failed_logs as $fk => $fv){
120	$insert_data = array('username' => $fv['username'],
121	'time' => $fv['time'],
122	'count' => $fv['count'],
123	'lockout' => $fv['lockout'],
124	'ip' => $fv['ip']);
125
126	$format = array('%s','%d','%d','%d','%s');
127
128	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
129	}
130	}
131
132	// Update the existing options to new structure
133	if(is_array($lz_options)){
134	foreach($lz_options as $ok => $ov){
135
136	if($ov['option_name'] == 'lz_last_reset'){
137	update_option('loginizer_last_reset', $ov['option_value']);
138	continue;
139	}
140
141	$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
142	}
143	// Save the options
144	update_option('loginizer_options', $old_option);
145	}
146
147	// Update the existing iprange to new structure
148	if(is_array($lz_iprange)){
149
150	$old_blacklist = array();
151	$old_whitelist = array();
152	$bid = 1;
153	$wid = 1;
154	foreach($lz_iprange as $ik => $iv){
155
156	if(!empty($iv['blacklist'])){
157	$old_blacklist[$bid] = array();
158	$old_blacklist[$bid]['start'] = long2ip($iv['start']);
159	$old_blacklist[$bid]['end'] = long2ip($iv['end']);
160	$old_blacklist[$bid]['time'] = strtotime($iv['date']);
161	$bid = $bid + 1;
162	}
163
164	if(!empty($iv['whitelist'])){
165	$old_whitelist[$wid] = array();
166	$old_whitelist[$wid]['start'] = long2ip($iv['start']);
167	$old_whitelist[$wid]['end'] = long2ip($iv['end']);
168	$old_whitelist[$wid]['time'] = strtotime($iv['date']);
169	$wid = $wid + 1;
170	}
171	}
172
173	if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
174	if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
175	}
176
177	}
178
179	// Is it less than 1.3.9 ?
180	if($version < 139){
181
182	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
183
184	}
185
186	// Save the new Version
187	update_option('loginizer_version', LOGINIZER_VERSION);
188
189	// In Sitepad Math Captcha is enabled by default
190	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
191	$option['captcha_no_google'] = 1;
192	add_option('loginizer_captcha', $option);
193	}
194
195	}
196
197	// Add the action to load the plugin
198	add_action('plugins_loaded', 'loginizer_load_plugin');
199
200	// The function that will be called when the plugin is loaded
201	function loginizer_load_plugin(){
202
203	global $loginizer;
204
205	// Check if the installed version is outdated
206	loginizer_update_check();
207
208	// Set the array
209	$loginizer = array();
210
211	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
212	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
213	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
214	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
215
216	// The IP Method to use
217	$loginizer['ip_method'] = get_option('loginizer_ip_method');
218	if($loginizer['ip_method'] == 3){
219	$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
220	}
221
222	// Load settings
223	$options = get_option('loginizer_options');
224	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
225	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
226	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
227	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
228	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
229	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
230	$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
231
232	if(!empty($options['notify_email_address'])){
233	$loginizer['notify_email_address'] = $options['notify_email_address'];
234	$loginizer['custom_notify_email'] = 1;
235	}
236
237	// Default messages
238	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
239	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
240	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
241	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
242	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
243	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
244
245	// Message Strings
246	$loginizer['msg'] = get_option('loginizer_msg');
247
248	foreach($loginizer['d_msg'] as $lk => $lv){
249	if(empty($loginizer['msg'][$lk])){
250	$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
251	}
252	}
253
254	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
255	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
256	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
257	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
258	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
259
260	// Message Strings
261	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg');
262
263	foreach($loginizer['2fa_d_msg'] as $lk => $lv){
264	if(empty($loginizer['2fa_msg'][$lk])){
265	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
266	}
267	}
268
269	// Load the blacklist and whitelist
270	$loginizer['blacklist'] = get_option('loginizer_blacklist');
271	$loginizer['whitelist'] = get_option('loginizer_whitelist');
272	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
273
274	// It should not be false
275	if(empty($loginizer['2fa_whitelist'])){
276	$loginizer['2fa_whitelist'] = array();
277	}
278
279	// When was the database cleared last time
280	$loginizer['last_reset'] = get_option('loginizer_last_reset');
281
282	//print_r($loginizer);
283
284	// Clear retries
285	if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
286	loginizer_reset_retries();
287	}
288
289	$ins_time = get_option('loginizer_ins_time');
290	if(empty($ins_time)){
291	$ins_time = time();
292	update_option('loginizer_ins_time', $ins_time);
293	}
294	$loginizer['ins_time'] = $ins_time;
295
296	// Set the current IP
297	$loginizer['current_ip'] = lz_getip();
298
299	// Is Brute Force Disabled ?
300	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');
301
302	// Filters and actions
303	if(empty($loginizer['disable_brute'])){
304
305	// Use this to verify before WP tries to login
306	// Is always called and is the first function to be called
307	//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
308	add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
309
310	// Is called when a login attempt fails
311	// Hence Update our records that the login failed
312	add_action('wp_login_failed', 'loginizer_login_failed');
313
314	// Is called before displaying the error message so that we dont show that the username is wrong or the password
315	// Update Error message
316	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
317	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
318
319	}
320
321	// ----------------
322	// PRO INIT
323	// ----------------
324
325	// Email to Login
326	$options = get_option('loginizer_epl');
327	$loginizer['pl_d_sub'] = 'Login at $site_name';
328	$loginizer['pl_d_msg'] = 'Hi,
329
330	A login request was submitted for your account $email at :
331	$site_name - $site_url
332
333	Login at $site_name by visiting this url :
334	$login_url
335
336	If you have not requested for the Login URL, please ignore this email.
337
338	Regards,
339	$site_name';
340	$loginizer['email_pass_less'] = empty($options['email_pass_less']) ? 0 : $options['email_pass_less'];
341	$loginizer['passwordless_sub'] = empty($options['passwordless_sub']) ? $loginizer['pl_d_sub'] : $options['passwordless_sub'];
342	$loginizer['passwordless_msg'] = empty($options['passwordless_msg']) ? $loginizer['pl_d_msg'] : $options['passwordless_msg'];
343	$loginizer['passwordless_msg_is_custom'] = empty($options['passwordless_msg']) ? 0 : 1;
344	$loginizer['passwordless_html'] = empty($options['passwordless_html']) ? 0 : $options['passwordless_html'];
345
346	// 2FA OTP Email to Login
347	$options = get_option('loginizer_2fa_email_template');
348	$loginizer['2fa_email_d_sub'] = 'OTP : Login at $site_name';
349	$loginizer['2fa_email_d_msg'] = 'Hi,
350
351	A login request was submitted for your account $email at :
352	$site_name - $site_url
353
354	Please use the following One Time password (OTP) to login :
355	$otp
356
357	Note : The OTP expires after 10 minutes.
358
359	If you haven\'t requested for the OTP, please ignore this email.
360
361	Regards,
362	$site_name';
363
364	$loginizer['2fa_email_sub'] = empty($options['2fa_email_sub']) ? $loginizer['2fa_email_d_sub'] : $options['2fa_email_sub'];
365	$loginizer['2fa_email_msg'] = empty($options['2fa_email_msg']) ? $loginizer['2fa_email_d_msg'] : $options['2fa_email_msg'];
366
367	// For SitePad its always on
368	if(defined('SITEPAD')){
369	$loginizer['email_pass_less'] = 1;
370	}
371
372	// Captcha
373	$options = get_option('loginizer_captcha');
374	$loginizer['captcha_type'] = empty($options['captcha_type']) ? '' : $options['captcha_type'];
375	$loginizer['captcha_key'] = empty($options['captcha_key']) ? '' : $options['captcha_key'];
376	$loginizer['captcha_secret'] = empty($options['captcha_secret']) ? '' : $options['captcha_secret'];
377	$loginizer['captcha_theme'] = empty($options['captcha_theme']) ? 'light' : $options['captcha_theme'];
378	$loginizer['captcha_size'] = empty($options['captcha_size']) ? 'normal' : $options['captcha_size'];
379	$loginizer['captcha_lang'] = empty($options['captcha_lang']) ? '' : $options['captcha_lang'];
380	$loginizer['captcha_user_hide'] = !isset($options['captcha_user_hide']) ? 0 : $options['captcha_user_hide'];
381	$loginizer['captcha_no_css_login'] = !isset($options['captcha_no_css_login']) ? 0 : $options['captcha_no_css_login'];
382	$loginizer['captcha_no_js'] = 1;
383	$loginizer['captcha_login'] = !isset($options['captcha_login']) ? 1 : $options['captcha_login'];
384	$loginizer['captcha_lostpass'] = !isset($options['captcha_lostpass']) ? 1 : $options['captcha_lostpass'];
385	$loginizer['captcha_resetpass'] = !isset($options['captcha_resetpass']) ? 1 : $options['captcha_resetpass'];
386	$loginizer['captcha_register'] = !isset($options['captcha_register']) ? 1 : $options['captcha_register'];
387	$loginizer['captcha_comment'] = !isset($options['captcha_comment']) ? 1 : $options['captcha_comment'];
388	$loginizer['captcha_wc_checkout'] = !isset($options['captcha_wc_checkout']) ? 1 : $options['captcha_wc_checkout'];
389
390	$loginizer['captcha_no_google'] = !isset($options['captcha_no_google']) ? 0 : $options['captcha_no_google'];
391	$loginizer['captcha_domain'] = empty($options['captcha_domain']) ? 'www.google.com' : $options['captcha_domain'];
392
393	$loginizer['captcha_text'] = empty($options['captcha_text']) ? __('Math Captcha', 'loginizer') : $options['captcha_text'];
394	$loginizer['captcha_time'] = empty($options['captcha_time']) ? 300 : $options['captcha_time'];
395	$loginizer['captcha_words'] = !isset($options['captcha_words']) ? 0 : $options['captcha_words'];
396	$loginizer['captcha_add'] = !isset($options['captcha_add']) ? 1 : $options['captcha_add'];
397	$loginizer['captcha_subtract'] = !isset($options['captcha_subtract']) ? 1 : $options['captcha_subtract'];
398	$loginizer['captcha_multiply'] = !isset($options['captcha_multiply']) ? 0 : $options['captcha_multiply'];
399	$loginizer['captcha_divide'] = !isset($options['captcha_divide']) ? 0 : $options['captcha_divide'];
400
401	// 2fa/question
402	$options = get_option('loginizer_2fa');
403	$loginizer['2fa_app'] = !isset($options['2fa_app']) ? 0 : $options['2fa_app'];
404	$loginizer['2fa_email'] = !isset($options['2fa_email']) ? 0 : $options['2fa_email'];
405	$loginizer['2fa_email_force'] = !isset($options['2fa_email_force']) ? 0 : $options['2fa_email_force'];
406	$loginizer['2fa_sms'] = !isset($options['2fa_sms']) ? 0 : $options['2fa_sms'];
407	$loginizer['question'] = !isset($options['question']) ? 0 : $options['question'];
408	$loginizer['2fa_default'] = empty($options['2fa_default']) ? 'question' : $options['2fa_default'];
409	$loginizer['2fa_roles'] = empty($options['2fa_roles']) ? array() : $options['2fa_roles'];
410
411	// Security Settings
412	$options = get_option('loginizer_security');
413	$loginizer['login_slug'] = empty($options['login_slug']) ? '' : $options['login_slug'];
414	$loginizer['rename_login_secret'] = empty($options['rename_login_secret']) ? '' : $options['rename_login_secret'];
415	$loginizer['xmlrpc_slug'] = empty($options['xmlrpc_slug']) ? '' : $options['xmlrpc_slug'];
416	$loginizer['xmlrpc_disable'] = empty($options['xmlrpc_disable']) ? '' : $options['xmlrpc_disable'];// Disable XML-RPC
417	$loginizer['pingbacks_disable'] = empty($options['pingbacks_disable']) ? '' : $options['pingbacks_disable'];// Disable Pingbacks
418
419	// Admin Slug Settings
420	$options = get_option('loginizer_wp_admin');
421	$loginizer['admin_slug'] = empty($options['admin_slug']) ? '' : $options['admin_slug'];
422	$loginizer['restrict_wp_admin'] = empty($options['restrict_wp_admin']) ? '' : $options['restrict_wp_admin'];
423	$loginizer['wp_admin_msg'] = empty($options['wp_admin_msg']) ? '' : $options['wp_admin_msg'];
424
425	// Checksum Settings
426	$options = get_option('loginizer_checksums');
427	$loginizer['disable_checksum'] = empty($options['disable_checksum']) ? '' : $options['disable_checksum'];
428	$loginizer['checksum_time'] = empty($options['checksum_time']) ? '' : $options['checksum_time'];
429	$loginizer['checksum_frequency'] = empty($options['checksum_frequency']) ? 7 : $options['checksum_frequency'];
430	$loginizer['no_checksum_email'] = empty($options['no_checksum_email']) ? '' : $options['no_checksum_email'];
431	$loginizer['checksums_last_run'] = get_option('loginizer_checksums_last_run');
432
433	// Auto Blacklist Usernames
434	$loginizer['username_blacklist'] = get_option('loginizer_username_blacklist');
435
436	$loginizer['domains_blacklist'] = get_option('loginizer_domains_blacklist');
437
438	$loginizer['wp_admin_d_msg'] = __('LZ : Not allowed via WP-ADMIN. Please access over the new Admin URL', 'loginizer');
439
440	// ----------------
441	// PRO INIT END
442	// ----------------
443
444	// Is the premium features there ?
445	if(file_exists(LOGINIZER_DIR.'/premium.php')){
446
447	// Include the file
448	include_once(LOGINIZER_DIR.'/premium.php');
449
450	loginizer_security_init();
451
452	// Its the free version
453	}else{
454
455	// The promo time
456	$loginizer['promo_time'] = get_option('loginizer_promo_time');
457	if(empty($loginizer['promo_time'])){
458	$loginizer['promo_time'] = time();
459	update_option('loginizer_promo_time', $loginizer['promo_time']);
460	}
461
462	// Are we to show the loginizer promo
463	if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30243600))){
464
465	add_action('admin_notices', 'loginizer_promo');
466
467	}
468
469	// Are we to disable the promo
470	if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
471	update_option('loginizer_promo_time', (0 - time()) );
472	die('DONE');
473	}
474
475	}
476
477	}
478
479	// Show the promo
480	function loginizer_promo(){
481
482	echo '
483	<style>
484	.lz_button {
485	background-color: #4CAF50; /* Green */
486	border: none;
487	color: white;
488	padding: 8px 16px;
489	text-align: center;
490	text-decoration: none;
491	display: inline-block;
492	font-size: 16px;
493	margin: 4px 2px;
494	-webkit-transition-duration: 0.4s; /* Safari */
495	transition-duration: 0.4s;
496	cursor: pointer;
497	}
498
499	.lz_button:focus{
500	border: none;
501	color: white;
502	}
503
504	.lz_button1 {
505	color: white;
506	background-color: #4CAF50;
507	border:3px solid #4CAF50;
508	}
509
510	.lz_button1:hover {
511	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
512	color: white;
513	border:3px solid #4CAF50;
514	}
515
516	.lz_button2 {
517	color: white;
518	background-color: #0085ba;
519	}
520
521	.lz_button2:hover {
522	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
523	color: white;
524	}
525
526	.lz_button3 {
527	color: white;
528	background-color: #365899;
529	}
530
531	.lz_button3:hover {
532	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
533	color: white;
534	}
535
536	.lz_button4 {
537	color: white;
538	background-color: rgb(66, 184, 221);
539	}
540
541	.lz_button4:hover {
542	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
543	color: white;
544	}
545
546	.loginizer_promo-close{
547	float:right;
548	text-decoration:none;
549	margin: 5px 10px 0px 0px;
550	}
551
552	.loginizer_promo-close:hover{
553	color: red;
554	}
555	</style>
556
557	<script>
558	jQuery(document).ready( function() {
559	(function($) {
560	$("#loginizer_promo .loginizer_promo-close").click(function(){
561	var data;
562
563	// Hide it
564	$("#loginizer_promo").hide();
565
566	// Save this preference
567	$.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
568	//alert(response);
569	});
570	});
571	})(jQuery);
572	});
573	</script>
574
575	<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
576	<a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
577	<span class="dashicons dashicons-dismiss"></span> Dismiss
578	</a>
579	<img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
580	<p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
581	<p>
582	<a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
583	<a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
584	\'s</a>
585	<a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
586	<a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
587	</p>
588	</div>';
589
590	}
591
592	// Should return NULL if everything is fine
593	function loginizer_wp_authenticate($user, $username, $password){
594
595	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
596
597	if(!empty($username) && !empty($password)){
598	$lz_user_pass = 1;
599	}
600
601	// Are you whitelisted ?
602	if(loginizer_is_whitelisted()){
603	$loginizer['ip_is_whitelisted'] = 1;
604	return $user;
605	}
606
607	// Are you blacklisted ?
608	if(loginizer_is_blacklisted()){
609	$lz_cannot_login = 1;
610
611	// This is used by WP Activity Log
612	apply_filters( 'wp_login_blocked', $username );
613
614	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
615	}
616
617	// Is the username blacklisted ?
618	if(function_exists('loginizer_user_blacklisted')){
619	if(loginizer_user_blacklisted($username)){
620	$lz_cannot_login = 1;
621
622	// This is used by WP Activity Log
623	apply_filters( 'wp_login_blocked', $username );
624
625	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
626	}
627	}
628
629	if(loginizer_can_login()){
630	return $user;
631	}
632
633	$lz_cannot_login = 1;
634
635	// This is used by WP Activity Log
636	apply_filters( 'wp_login_blocked', $username );
637
638	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
639
640	}
641
642	function loginizer_can_login(){
643
644	global $wpdb, $loginizer, $lz_error;
645
646	// Get the logs
647	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
648	$result = lz_selectquery($sel_query);
649
650	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
651
652	// Has he reached max lockouts ?
653	if($result['lockout'] >= $loginizer['max_lockouts']){
654	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
655	}
656
657	// Is he in the lockout time ?
658	if($result['time'] >= (time() - $loginizer['lockout_time'])){
659	$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
660
661	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
662	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
663	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
664
665	$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
666
667	if($banlift > 60){
668	$banlift = ceil($banlift / 60);
669	$_time = $banlift.' '.$loginizer['msg']['hours_err'];
670	}
671
672	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
673
674	return false;
675	}
676	}
677
678	return true;
679	}
680
681	function loginizer_is_blacklisted(){
682
683	global $wpdb, $loginizer, $lz_error;
684
685	$blacklist = $loginizer['blacklist'];
686
687	if(empty($blacklist)){
688	return false;
689	}
690
691	foreach($blacklist as $k => $v){
692
693	// Is the IP in the blacklist ?
694	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
695	$result = 1;
696	break;
697	}
698
699	// Is it in a wider range ?
700	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
701
702	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
703	// if the current IP is <= than the start of the range, it is within the range
704	// OR
705	// if the current IP is <= than the end of the range, it is within the range
706	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
707	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
708	$result = 1;
709	break;
710	}
711
712	}
713
714	}
715
716	// You are blacklisted
717	if(!empty($result)){
718	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
719	return true;
720	}
721
722	return false;
723
724	}
725
726	function loginizer_is_whitelisted(){
727
728	global $wpdb, $loginizer, $lz_error;
729
730	$whitelist = $loginizer['whitelist'];
731
732	if(empty($whitelist)){
733	return false;
734	}
735
736	foreach($whitelist as $k => $v){
737
738	// Is the IP in the blacklist ?
739	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
740	$result = 1;
741	break;
742	}
743
744	// Is it in a wider range ?
745	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
746
747	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
748	// if the current IP is <= than the start of the range, it is within the range
749	// OR
750	// if the current IP is <= than the end of the range, it is within the range
751	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
752	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
753	$result = 1;
754	break;
755	}
756
757	}
758
759	}
760
761	// You are whitelisted
762	if(!empty($result)){
763	return true;
764	}
765
766	return false;
767
768	}
769
770
771	// When the login fails, then this is called
772	// We need to update the database
773	function loginizer_login_failed($username, $is_2fa = ''){
774
775	global $wpdb, $loginizer, $lz_cannot_login;
776
777	// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
778	if(empty($username) \|\| is_null($username)){
779	$username = '';
780	}
781
782	$fail_type = 'Login';
783
784	if(!empty($is_2fa)){
785	$fail_type = '2FA';
786	}
787
788	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
789
790	$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
791	$url = esc_url($url);
792
793	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
794	$result = lz_selectquery($sel_query);
795
796	if(!empty($result)){
797	$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
798
799	$update_data = array('username' => $username,
800	'time' => time(),
801	'count' => $result['count']+1,
802	'lockout' => $lockout,
803	'url' => $url);
804
805	$where_data = array('ip' => $loginizer['current_ip']);
806
807	$format = array('%s','%d','%d','%d','%s');
808	$where_format = array('%s');
809
810	$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
811
812	// Do we need to email admin ?
813	if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
814
815	$lockout_time = $loginizer['lockout_time'];
816
817	if($lockout >= $loginizer['max_lockouts']){
818	// extended lockout is in hours so we have to convert to minute
819	$lockout_time = $loginizer['lockouts_extend'];
820	}
821
822	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
823	$mail = array();
824	$mail['to'] = $loginizer['notify_email_address'];
825	$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
826	$mail['message'] = 'Hi,
827
828	'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
829	'.home_url().'
830
831	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
832	Last User Attempt : '.$username.'
833	IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
834
835	Regards,
836	Loginizer';
837
838	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
839	}
840	}else{
841	$result = array();
842	$result['count'] = 0;
843
844	$insert_data = array('username' => $username,
845	'time' => time(),
846	'count' => 1,
847	'ip' => $loginizer['current_ip'],
848	'lockout' => 0,
849	'url' => $url);
850
851	$format = array('%s','%d','%d','%s','%d','%s');
852
853	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
854	}
855
856	// We need to add one as this is a failed attempt as well
857	$result['count'] = $result['count'] + 1;
858	$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
859	$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
860
861	}
862	}
863
864	// Handles the error of the password not being there
865	function loginizer_error_handler($errors, $redirect_to){
866
867	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
868
869	//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
870
871	// Remove the empty password error
872	if(is_wp_error($errors)){
873
874	$codes = $errors->get_error_codes();
875
876	foreach($codes as $k => $v){
877	if($v == 'invalid_username' \|\| $v == 'incorrect_password'){
878	$show_error = 1;
879	}
880	}
881
882	$errors->remove('invalid_username');
883	$errors->remove('incorrect_password');
884
885	}
886
887	// Add the error
888	if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
889	$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
890	}
891
892	// Add the number of retires left as well
893	if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
894	$errors->add('retries_left', loginizer_retries_left());
895	}
896
897	return $errors;
898
899	}
900
901
902
903	// Handles the error of the password not being there
904	function loginizer_woocommerce_error_handler(){
905
906	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
907
908	if(function_exists('wc_add_notice')){
909	wc_add_notice( loginizer_retries_left(), 'error' );
910	}
911
912	}
913
914	// Returns a string with the number of retries left
915	function loginizer_retries_left(){
916
917	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
918
919	// If we are to show the number of retries left
920	if(isset($loginizer['retries_left'])){
921	return '<b>'.$loginizer['retries_left'].'</b> '.$loginizer['msg']['attempts_left'];
922	}
923
924	}
925
926	function loginizer_reset_retries(){
927
928	global $wpdb, $loginizer;
929
930	$deltime = time() - $loginizer['reset_retries'];
931
932	$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
933	$result = $wpdb->query($del_query);
934
935	update_option('loginizer_last_reset', time());
936
937	}
938
939	add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
940
941	// Add settings link on plugin page
942	function loginizer_plugin_action_links($links) {
943
944	if(!defined('LOGINIZER_PREMIUM')){
945	$links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
946	}
947
948	$settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
949	array_unshift($links, $settings_link);
950
951	return $links;
952	}
953
954	add_action('admin_menu', 'loginizer_admin_menu');
955
956	// Shows the admin menu of Loginizer
957	function loginizer_admin_menu() {
958
959	global $wp_version, $loginizer;
960
961	if(!defined('SITEPAD')){
962
963	// Add the menu page
964	add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
965
966	// Dashboard
967	add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
968
969	}else{
970
971	// Add the menu page
972	add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
973
974	// Rename Login
975	add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
976
977	}
978
979	// Brute Force
980	add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
981
982	// PasswordLess
983	add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
984
985	// Security Settings
986	if(!defined('SITEPAD')){
987
988	// Two Factor Auth
989	add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
990
991	}
992
993	// reCaptcha
994	add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
995
996	// Security Settings
997	if(!defined('SITEPAD')){
998
999	// Security Settings
1000	add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
1001
1002	// File Checksums
1003	add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
1004
1005	}
1006
1007	if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30243600))){
1008
1009	// Go Pro link
1010	add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
1011
1012	}
1013
1014	}
1015
1016	// The Loginizer Admin Options Page
1017	function loginizer_page_header($title = 'Loginizer'){
1018
1019	global $loginizer;
1020
1021	?>
1022	<style>
1023	.lz-right-ul{
1024	padding-left: 10px !important;
1025	}
1026
1027	.lz-right-ul li{
1028	list-style: circle !important;
1029	}
1030	</style>
1031	<?php
1032
1033	echo '<div style="margin: 10px 20px 0 2px;">
1034	<div class="metabox-holder columns-2">
1035	<div class="postbox-container">
1036	<div id="top-sortables" class="meta-box-sortables ui-sortable">
1037
1038	<table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
1039	<tr>
1040	<td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
1041
1042	if(!defined('SITEPAD')){
1043
1044	echo '<td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">'.__('Review Loginizer', 'loginizer').'</a></td>
1045	<td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
1046	<td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
1047
1048	}
1049
1050	echo '
1051	</tr>
1052	</table>
1053	<hr />
1054
1055	<!--Main Table-->
1056	<table cellpadding="8" cellspacing="1" width="100%" class="fixed">
1057	<tr>
1058	<td valign="top">';
1059
1060	}
1061
1062	// The Loginizer Theme footer
1063	function loginizer_page_footer(){
1064
1065	if(!loginizer_is_premium()){
1066	echo '<script>
1067	jQuery("[loginizer-premium-only]").each(function(index) {
1068	jQuery(this).find( "input, textarea, select" ).attr("disabled", true);
1069	});
1070	</script>';
1071	}
1072
1073	echo '</td>
1074	<td width="200" valign="top" id="loginizer-right-bar">';
1075
1076	if(!defined('SITEPAD')){
1077
1078	if(!defined('LOGINIZER_PREMIUM')){
1079
1080	echo '
1081	<div class="postbox" style="min-width:0px !important;">
1082	<div class="postbox-header">
1083	<h2 class="hndle ui-sortable-handle">
1084	<span>Premium Version</span>
1085	</h2>
1086	</div>
1087
1088	<div class="inside">
1089	<i>Upgrade to the premium version and get the following features </i>:<br>
1090	<ul class="lz-right-ul">
1091	<li>PasswordLess Login</li>
1092	<li>Two Factor Auth - Email</li>
1093	<li>Two Factor Auth - App</li>
1094	<li>Login Challenge Question</li>
1095	<li>reCAPTCHA</li>
1096	<li>Rename Login Page</li>
1097	<li>Disable XML-RPC</li>
1098	<li>And many more ...</li>
1099	</ul>
1100	<center><a class="button button-primary" target="_blank" href="'.LOGINIZER_PRICING_URL.'">Upgrade</a></center>
1101	</div>
1102	</div>';
1103
1104	}else{
1105
1106	echo '
1107	<div class="postbox" style="min-width:0px !important;">
1108	<div class="postbox-header">
1109	<h2 class="hndle ui-sortable-handle">
1110	<span>Recommendations</span>
1111	</h2>
1112	</div>
1113	<div class="inside">
1114	<i>We recommed that you enable atleast one of the following security features</i>:<br>
1115	<ul class="lz-right-ul">
1116	<li>Rename Login Page</li>
1117	<li>Login Challenge Question</li>
1118	<li>reCAPTCHA</li>
1119	<li>Two Factor Auth - Email</li>
1120	<li>Two Factor Auth - App</li>
1121	<li>Change \'admin\' Username</li>
1122	</ul>
1123	</div>
1124	</div>';
1125	}
1126
1127	echo '
1128	<div class="postbox" style="min-width:0px !important;">
1129	<div class="postbox-header">
1130	<h2 class="hndle ui-sortable-handle">
1131	<span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
1132	</h2>
1133	</div>
1134	<div class="inside">
1135	<i>Easily manage and make professional pages and content with our Pagelayer builder </i>:<br>
1136	<ul class="lz-right-ul">
1137	<li>30+ Free Widgets</li>
1138	<li>60+ Premium Widgets</li>
1139	<li>400+ Premium Sections</li>
1140	<li>Theme Builder</li>
1141	<li>WooCommerce Builder</li>
1142	<li>Theme Creator and Exporter</li>
1143	<li>Form Builder</li>
1144	<li>Popup Builder</li>
1145	<li>And many more ...</li>
1146	</ul>
1147	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">Visit Pagelayer</a></center>
1148	</div>
1149	</div>';
1150
1151	echo '
1152	<div class="postbox" style="min-width:0px !important;">
1153	<div class="postbox-header">
1154	<h2 class="hndle ui-sortable-handle">
1155	<span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
1156	</h2>
1157	</div>
1158	<div class="inside">
1159	<i>Manage all your WordPress sites from <b>1 dashboard</b> </i>:<br>
1160	<ul class="lz-right-ul">
1161	<li>1-click Admin Access</li>
1162	<li>Update WordPress</li>
1163	<li>Update Themes</li>
1164	<li>Update Plugins</li>
1165	<li>Backup your WordPress Site</li>
1166	<li>Plugins & Theme Management</li>
1167	<li>Post Management</li>
1168	<li>And many more ...</li>
1169	</ul>
1170	<center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">Visit wpCentral</a></center>
1171	</div>
1172	</div>';
1173
1174	}
1175
1176	echo '</td>
1177	</tr>
1178	</table>';
1179
1180	if(!defined('SITEPAD')){
1181
1182	echo '<br />
1183	<div style="width:45%;background:#FFF;padding:15px; margin:auto">
1184	<b>Let your friends know that you have secured your website :</b>
1185	<form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
1186	<textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
1187	<input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
1188	</form>
1189
1190	</div>
1191	<br />
1192
1193	<script>
1194	function dotweet(ele){
1195	window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
1196	return false;
1197	}
1198	</script>
1199
1200	<hr />
1201	<a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.';
1202
1203	}
1204
1205	echo '
1206	</div>
1207	</div>
1208	</div>
1209	</div>';
1210
1211	}
1212
1213	// The Loginizer Admin Options Page
1214	function loginizer_page_dashboard(){
1215
1216	global $loginizer, $lz_error, $lz_env;
1217
1218	if(!current_user_can('manage_options')){
1219	wp_die('Sorry, but you do not have permissions to change settings.');
1220	}
1221
1222	// Dismiss the announcement
1223	if(isset($_GET['dismiss_announcement'])){
1224	update_option('loginizer_no_announcement', 1);
1225	}
1226
1227	/* Make sure post was from this page */
1228	if(count($_POST) > 0){
1229	check_admin_referer('loginizer-options');
1230	}
1231
1232	do_action('loginizer_pre_page_dashboard');
1233
1234	// Is there a IP Method ?
1235	if(isset($_POST['save_lz_ip_method'])){
1236
1237	$ip_method = (int) lz_optpost('lz_ip_method');
1238	$custom_ip_method = lz_optpost('lz_custom_ip_method');
1239
1240	if($ip_method >= 0 && $ip_method <= 3){
1241	update_option('loginizer_ip_method', $ip_method);
1242	}
1243
1244	// Custom Method name ?
1245	if($ip_method == 3){
1246	update_option('loginizer_custom_ip_method', $custom_ip_method);
1247	}
1248
1249	}
1250
1251	loginizer_page_dashboard_T();
1252
1253	}
1254
1255	// The Loginizer Admin Options Page - THEME
1256	function loginizer_page_dashboard_T(){
1257
1258	global $loginizer, $lz_error, $lz_env;
1259
1260	loginizer_page_header('Dashboard');
1261	?>
1262	<style>
1263	.lz-welcome-panel{
1264	border: 1px solid #c3c4c7;
1265	box-shadow: 0 1px 1px rgba(0,0,0,.04);
1266	background: #fff;
1267	padding:10px;
1268	}
1269
1270	.lz-welcome-panel-content{
1271	display:inline;
1272	vertical-align:middle;
1273	}
1274
1275	input[type="text"], textarea, select {
1276	width: 70%;
1277	}
1278
1279	.form-table label{
1280	font-weight:bold;
1281	}
1282
1283	.exp{
1284	font-size:12px;
1285	}
1286	</style>
1287
1288	<?php
1289	$lz_ip = lz_getip();
1290
1291	if($lz_ip != '127.0.0.1' && @$_SERVER['SERVER_ADDR'] == $lz_ip){
1292	echo '<div class="update-message notice error inline notice-error notice-alt"><p style="color:red">   Your Server IP Address seems to match the Client IP detected by Loginizer. You might want to change the IP detection method to HTTP_X_FORWARDED_FOR under System Information section.</p></div><br>';
1293	}
1294
1295	loginizer_newsletter_subscribe();
1296
1297	echo '
1298	<div class="lz-welcome-panel">
1299	<div class="lz-welcome-panel-content">Thank you for choosing Loginizer! Many more features coming soon...   Review Loginizer at WordPress     <a href="https://wordpress.org/support/view/plugin-reviews/loginizer" class="button button-primary" target="_blank">Add Review</a></div>
1300	</div><br />';
1301
1302	// Saved ?
1303	if(!empty($GLOBALS['lz_saved'])){
1304	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
1305	}
1306
1307	// Any errors ?
1308	if(!empty($lz_error)){
1309	lz_report_error($lz_error);echo '<br />';
1310	}
1311
1312	?>
1313
1314	<div class="postbox">
1315
1316	<div class="postbox-header">
1317	<h2 class="hndle ui-sortable-handle">
1318	<span><?php echo __('Getting Started', 'loginizer'); ?></span>
1319	</h2>
1320	</div>
1321
1322	<div class="inside">
1323
1324	<form action="" method="post" enctype="multipart/form-data">
1325	<?php wp_nonce_field('loginizer-options'); ?>
1326	<table class="form-table">
1327	<tr>
1328	<td scope="row" valign="top" colspan="2" style="line-height:150%">
1329	<i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
1330	<?php
1331	if(defined('LOGINIZER_PREMIUM')){
1332	echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
1333	}else{
1334	echo '<br><i><a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none;color:red;">Upgrade to Pro</a> for more features like <b>reCAPTCHA, Two Factor Auth, Rename wp-admin and wp-login.php pages, Email based PasswordLess</b> login and more. These features will improve your website\'s security.</i>';
1335	}
1336	?>
1337	</td>
1338	</tr>
1339	</table>
1340	</form>
1341
1342	</div>
1343	</div>
1344
1345	<div class="postbox">
1346
1347	<div class="postbox-header">
1348	<h2 class="hndle ui-sortable-handle">
1349	<span><?php echo __('System Information', 'loginizer'); ?></span>
1350	</h2>
1351	</div>
1352	<div class="inside">
1353
1354	<form action="" method="post" enctype="multipart/form-data">
1355	<?php wp_nonce_field('loginizer-options'); ?>
1356	<table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1357	<?php
1358	echo '
1359	<tr>
1360	<th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1361	<td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (<font color="green">Security PRO Version</font>)' : '').'</td>
1362	</tr>';
1363
1364	do_action('loginizer_system_information');
1365
1366	echo '<tr>
1367	<th align="left">'.__('URL', 'loginizer').'</th>
1368	<td>'.get_site_url().'</td>
1369	</tr>
1370	<tr>
1371	<th align="left">'.__('Path', 'loginizer').'</th>
1372	<td>'.ABSPATH.'</td>
1373	</tr>
1374	<tr>
1375	<th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1376	<td>'.@$_SERVER['SERVER_ADDR'].'</td>
1377	</tr>
1378	<tr>
1379	<th align="left">'.__('Your IP Address', 'loginizer').'</th>
1380	<td>'.lz_getip().'
1381	<div style="float:right">
1382	Method :
1383	<select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1384	<option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1385	<option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1386	<option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1387	<option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1388	</select>
1389	<input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method', @$loginizer['custom_ip_method']).'" style="font-size:11px; width:100px; display:none" />
1390	<input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1391	</div>
1392	</td>
1393	</tr>
1394	<tr>
1395	<th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1396	<td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1397	</tr>';
1398
1399	if(file_exists(ABSPATH.'/.htaccess')){
1400	echo '
1401	<tr>
1402	<th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1403	<td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1404	</tr>';
1405
1406	}
1407
1408	?>
1409	</table>
1410	</form>
1411
1412	</div>
1413	</div>
1414
1415	<script type="text/javascript">
1416
1417	function lz_ip_method_handle(){
1418	var ele = jQuery('#lz_ip_method');
1419	if(ele.val() == 3){
1420	jQuery('#lz_custom_ip_method').show();
1421	}else{
1422	jQuery('#lz_custom_ip_method').hide();
1423	}
1424	};
1425
1426	lz_ip_method_handle();
1427
1428	</script>
1429
1430	<div id="" class="postbox">
1431
1432	<div class="postbox-header">
1433	<h2 class="hndle ui-sortable-handle">
1434	<span><?php echo __('File Permissions', 'loginizer'); ?></span>
1435	</h2>
1436	</div>
1437
1438	<div class="inside">
1439
1440	<form action="" method="post" enctype="multipart/form-data">
1441	<?php wp_nonce_field('loginizer-options'); ?>
1442	<table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1443	<?php
1444
1445	echo '
1446	<tr>
1447	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1448	<th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1449	<th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1450	</tr>';
1451
1452	$wp_content = basename(dirname(dirname(dirname(__FILE__))));
1453
1454	$files_to_check = array('/' => array('0755', '0750'),
1455	'/wp-admin' => array('0755'),
1456	'/wp-includes' => array('0755'),
1457	'/wp-config.php' => array('0444'),
1458	'/'.$wp_content => array('0755'),
1459	'/'.$wp_content.'/themes' => array('0755'),
1460	'/'.$wp_content.'/plugins' => array('0755'));
1461
1462	if(file_exists(ABSPATH.'/.htaccess')){
1463	$files_to_check['.htaccess'] = array('0444');
1464	}
1465
1466	$root = ABSPATH;
1467
1468	foreach($files_to_check as $k => $v){
1469
1470	$path = $root.'/'.$k;
1471	$stat = @stat($path);
1472	$suggested = $v;
1473	$actual = substr(sprintf('%o', $stat['mode']), -4);
1474
1475	echo '
1476	<tr>
1477	<td>'.$k.'</td>
1478	<td>'.current($suggested).'</td>
1479	<td><span '.(!in_array($actual, $suggested) ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1480	</tr>';
1481
1482	}
1483
1484	?>
1485	</table>
1486	</form>
1487
1488	</div>
1489	</div>
1490
1491	<?php
1492
1493	loginizer_page_footer();
1494
1495	}
1496
1497	// The Loginizer Admin Options Page
1498	function loginizer_page_brute_force(){
1499
1500	global $wpdb, $wp_roles, $loginizer;
1501
1502	if(!current_user_can('manage_options')){
1503	wp_die('Sorry, but you do not have permissions to change settings.');
1504	}
1505
1506	/* Make sure post was from this page */
1507	if(count($_POST) > 0){
1508	check_admin_referer('loginizer-options');
1509	}
1510
1511	// BEGIN THEME
1512	loginizer_page_header('Brute Force Settings');
1513
1514	// Load the blacklist and whitelist
1515	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1516	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1517
1518	// Disable Brute Force
1519	if(isset($_POST['disable_brute_lz'])){
1520
1521	// Save the options
1522	update_option('loginizer_disable_brute', 1);
1523
1524	$loginizer['disable_brute'] = 1;
1525
1526	echo '<div id="message" class="updated"><p>'
1527	. __('The Brute Force Protection feature is now disabled', 'loginizer')
1528	. '</p></div><br />';
1529
1530	}
1531
1532	// Enable brute force
1533	if(isset($_POST['enable_brute_lz'])){
1534
1535	// Save the options
1536	update_option('loginizer_disable_brute', 0);
1537
1538	$loginizer['disable_brute'] = 0;
1539
1540	echo '<div id="message" class="updated"><p>'
1541	. __('The Brute Force Protection feature is now enabled', 'loginizer')
1542	. '</p></div><br />';
1543
1544	}
1545
1546	// The Brute Force Settings
1547	if(isset($_POST['save_lz'])){
1548
1549	$max_retries = (int) lz_optpost('max_retries');
1550	$lockout_time = (int) lz_optpost('lockout_time');
1551	$max_lockouts = (int) lz_optpost('max_lockouts');
1552	$lockouts_extend = (int) lz_optpost('lockouts_extend');
1553	$reset_retries = (int) lz_optpost('reset_retries');
1554	$notify_email = (int) lz_optpost('notify_email');
1555	$notify_email_address = lz_optpost('notify_email_address');
1556
1557	if(!empty($notify_email_address) && !lz_valid_email($notify_email_address)){
1558	$error[] = __('Email address is invalid', 'loginizer');
1559	}
1560
1561	$lockout_time = $lockout_time * 60;
1562	$lockouts_extend = $lockouts_extend * 60 * 60;
1563	$reset_retries = $reset_retries * 60 * 60;
1564
1565	if(empty($error)){
1566
1567	$option['max_retries'] = $max_retries;
1568	$option['lockout_time'] = $lockout_time;
1569	$option['max_lockouts'] = $max_lockouts;
1570	$option['lockouts_extend'] = $lockouts_extend;
1571	$option['reset_retries'] = $reset_retries;
1572	$option['notify_email'] = $notify_email;
1573	$option['notify_email_address'] = $notify_email_address;
1574
1575	// Save the options
1576	update_option('loginizer_options', $option);
1577
1578	$saved = true;
1579
1580	}else{
1581	lz_report_error($error);
1582	}
1583
1584	if(!empty($notice)){
1585	lz_report_notice($notice);
1586	}
1587
1588	if(!empty($saved)){
1589	echo '<div id="message" class="updated"><p>'
1590	. __('The settings were saved successfully', 'loginizer')
1591	. '</p></div><br />';
1592	}
1593
1594	}
1595
1596	// Delete a Blackist IP range
1597	if(isset($_POST['bdelid'])){
1598
1599	$delid = (int) lz_optreq('bdelid');
1600
1601	// Unset and save
1602	$blacklist = $loginizer['blacklist'];
1603	unset($blacklist[$delid]);
1604	update_option('loginizer_blacklist', $blacklist);
1605
1606	echo '<div id="message" class="updated fade"><p>'
1607	. __('The Blacklist IP range has been deleted successfully', 'loginizer')
1608	. '</p></div><br />';
1609
1610	}
1611
1612	// Delete all Blackist IP ranges
1613	if(isset($_POST['del_all_blacklist'])){
1614
1615	// Unset and save
1616	update_option('loginizer_blacklist', array());
1617
1618	echo '<div id="message" class="updated fade"><p>'
1619	. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1620	. '</p></div><br />';
1621
1622	}
1623
1624	// Delete a Whitelist IP range
1625	if(isset($_POST['delid'])){
1626
1627	$delid = (int) lz_optreq('delid');
1628
1629	// Unset and save
1630	$whitelist = $loginizer['whitelist'];
1631	unset($whitelist[$delid]);
1632	update_option('loginizer_whitelist', $whitelist);
1633
1634	echo '<div id="message" class="updated fade"><p>'
1635	. __('The Whitelist IP range has been deleted successfully', 'loginizer')
1636	. '</p></div><br />';
1637
1638	}
1639
1640	// Delete all Blackist IP ranges
1641	if(isset($_POST['del_all_whitelist'])){
1642
1643	// Unset and save
1644	update_option('loginizer_whitelist', array());
1645
1646	echo '<div id="message" class="updated fade"><p>'
1647	. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1648	. '</p></div><br />';
1649
1650	}
1651
1652	// Reset All Logs
1653	if(isset($_POST['lz_reset_all_ip'])){
1654
1655	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` > 0");
1656
1657	echo '<div id="message" class="updated fade"><p>'
1658	. __('All the IP Logs have been cleared', 'loginizer')
1659	. '</p></div><br />';
1660	}
1661
1662	// Reset Logs
1663	if(isset($_POST['lz_reset_ip']) && isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1664
1665	$ips = $_POST['lz_reset_ips'];
1666
1667	foreach($ips as $ip){
1668	if(!lz_valid_ip($ip)){
1669	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1670	}
1671	}
1672
1673	if(count($ips) < 1){
1674	$error[] = __('There are no IPs submitted', 'loginizer');
1675	}
1676
1677	// Should we start deleting logs
1678	if(empty($error)){
1679
1680	foreach($ips as $ip){
1681	$result = $wpdb->query($wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $ip));
1682	}
1683
1684	if(empty($error)){
1685
1686	echo '<div id="message" class="updated fade"><p>'
1687	. __('The selected IP Logs have been reset', 'loginizer')
1688	. '</p></div><br />';
1689
1690	}
1691
1692	}
1693
1694	if(!empty($error)){
1695	lz_report_error($error);echo '<br />';
1696	}
1697
1698	}
1699
1700	if(isset($_POST['blacklist_iprange'])){
1701
1702	$start_ip = lz_optpost('start_ip');
1703	$end_ip = lz_optpost('end_ip');
1704
1705	// If no end IP we consider only 1 IP
1706	if(empty($end_ip)){
1707	$end_ip = $start_ip;
1708	}
1709
1710	// Validate the IP against all checks
1711	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['blacklist'], $error);
1712
1713	if(empty($error)){
1714
1715	$blacklist = $loginizer['blacklist'];
1716
1717	$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1718
1719	$blacklist[$newid] = array();
1720	$blacklist[$newid]['start'] = $start_ip;
1721	$blacklist[$newid]['end'] = $end_ip;
1722	$blacklist[$newid]['time'] = time();
1723
1724	update_option('loginizer_blacklist', $blacklist);
1725
1726	echo '<div id="message" class="updated fade"><p>'
1727	. __('Blacklist IP range added successfully', 'loginizer')
1728	. '</p></div><br />';
1729
1730	}
1731
1732	if(!empty($error)){
1733	lz_report_error($error);echo '<br />';
1734	}
1735
1736	}
1737
1738	if(isset($_POST['whitelist_iprange'])){
1739
1740	$start_ip = lz_optpost('start_ip_w');
1741	$end_ip = lz_optpost('end_ip_w');
1742
1743	// If no end IP we consider only 1 IP
1744	if(empty($end_ip)){
1745	$end_ip = $start_ip;
1746	}
1747
1748	// Validate the IP against all checks
1749	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['whitelist'], $error);
1750
1751	if(empty($error)){
1752
1753	$whitelist = $loginizer['whitelist'];
1754
1755	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1756
1757	$whitelist[$newid] = array();
1758	$whitelist[$newid]['start'] = $start_ip;
1759	$whitelist[$newid]['end'] = $end_ip;
1760	$whitelist[$newid]['time'] = time();
1761
1762	update_option('loginizer_whitelist', $whitelist);
1763
1764	echo '<div id="message" class="updated fade"><p>'
1765	. __('Whitelist IP range added successfully', 'loginizer')
1766	. '</p></div><br />';
1767
1768	}
1769
1770	if(!empty($error)){
1771	lz_report_error($error);echo '<br />';
1772	}
1773	}
1774
1775	if(isset($_POST['lz_import_csv'])){
1776
1777	if(!empty($_FILES['lz_import_file_csv']['name'])){
1778
1779	$lz_csv_type = lz_optpost('lz_csv_type');
1780
1781	// Is the submitted type in the allowed list ?
1782	if(!in_array($lz_csv_type, array('blacklist', 'whitelist'))){
1783	$error[] = __('Invalid import type', 'loginizer');
1784	}
1785
1786	if(empty($error)){
1787
1788	//Get the extension of the file
1789	$csv_file_name = basename($_FILES['lz_import_file_csv']['name']);
1790	$csv_ext_name = strtolower(pathinfo($csv_file_name, PATHINFO_EXTENSION));
1791
1792	//Check if it's a csv file
1793	if($csv_ext_name == 'csv'){
1794
1795	$file = fopen($_FILES['lz_import_file_csv']['tmp_name'], "r");
1796
1797	$line_count = 0;
1798	$update_record = 0;
1799
1800	while($content = fgetcsv($file)){
1801
1802	//Increment the $line_count
1803	$line_count++;
1804
1805	//Skip the first line
1806	if($line_count <= 1){
1807	continue;
1808	}
1809
1810	if(loginizer_iprange_validate($content[0], $content[1], $loginizer[$lz_csv_type], $error, $line_count)){
1811
1812	$newid = ( empty($loginizer[$lz_csv_type]) ? 0 : max(array_keys($loginizer[$lz_csv_type])) ) + 1;
1813
1814	$loginizer[$lz_csv_type][$newid] = array();
1815	$loginizer[$lz_csv_type][$newid]['start'] = $content[0];
1816	$loginizer[$lz_csv_type][$newid]['end'] = $content[1];
1817	$loginizer[$lz_csv_type][$newid]['time'] = time();
1818
1819	$update_record = 1;
1820
1821	}
1822	}
1823
1824	fclose($file);
1825
1826	if(!empty($update_record)){
1827
1828	update_option('loginizer_'.$lz_csv_type, $loginizer[$lz_csv_type]);
1829
1830	echo '<div id="message" class="updated fade"><p>'
1831	. __('Imported '.ucfirst($lz_csv_type).' IP range(s) successfully', 'loginizer')
1832	. '</p></div><br />';
1833
1834	}
1835
1836	if(!empty($error)){
1837	lz_report_error($error);echo '<br />';
1838	}
1839	}
1840
1841	}
1842	}
1843	}
1844
1845	//Brute Force Bulk Blacklist/ Whitelist Ip
1846	if(isset($_POST['lz_blacklist_selected_ip'])){
1847	if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1848
1849	$ips = $_POST['lz_reset_ips'];
1850
1851	foreach($ips as $ip){
1852	if(!lz_valid_ip($ip)){
1853	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1854	}
1855	}
1856
1857	if(count($ips) < 1){
1858	$error[] = __('There are no IPs submitted', 'loginizer');
1859	}
1860
1861	// Should we start deleting logs
1862	if(empty($error)){
1863
1864	$update_record = 0;
1865
1866	foreach($ips as $ip){
1867
1868	if(loginizer_iprange_validate($ip, '', $loginizer['blacklist'], $error)){
1869
1870	$newid = ( empty($loginizer['blacklist']) ? 0 : max(array_keys($loginizer['blacklist'])) ) + 1;
1871
1872	$loginizer['blacklist'][$newid] = array();
1873	$loginizer['blacklist'][$newid]['start'] = $ip;
1874	$loginizer['blacklist'][$newid]['end'] = $ip;
1875	$loginizer['blacklist'][$newid]['time'] = time();
1876
1877	$update_record = 1;
1878	}
1879	}
1880
1881	if(!empty($update_record)){
1882
1883	update_option('loginizer_blacklist', $loginizer['blacklist']);
1884
1885	echo '<div id="message" class="updated fade"><p>'
1886	. __('The selected IP(s) have been blacklisted', 'loginizer')
1887	. '</p></div><br />';
1888
1889	}
1890
1891	}
1892	}else{
1893	$error[] = __('No IP(s) selected', 'loginizer');
1894	}
1895
1896	if(!empty($error)){
1897	lz_report_error($error);echo '<br />';
1898	}
1899	}
1900
1901	// Save the messages
1902	if(isset($_POST['save_err_msgs_lz'])){
1903
1904	$msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
1905	$msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
1906	$msgs['attempts_left'] = lz_optpost('msg_attempts_left');
1907	$msgs['lockout_err'] = lz_optpost('msg_lockout_err');
1908	$msgs['minutes_err'] = lz_optpost('msg_minutes_err');
1909	$msgs['hours_err'] = lz_optpost('msg_hours_err');
1910
1911	// Update them
1912	update_option('loginizer_msg', $msgs);
1913
1914	echo '<div id="message" class="updated fade"><p>'
1915	. __('Error messages were saved successfully', 'loginizer')
1916	. '</p></div><br />';
1917
1918	}
1919
1920	// Count the Results
1921	$tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1922	//print_r($tmp);
1923
1924	// Which Page is it
1925	$lz_env['res_len'] = 10;
1926	$lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1927	$lz_env['num_res'] = $tmp['num'];
1928	$lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1929
1930	// Get the logs
1931	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1932	ORDER BY `time` DESC
1933	LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1934	//print_r($result);
1935
1936	$lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1937	$lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1938	$lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1939	$lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1940
1941	// Reload the settings
1942	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1943	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1944
1945	$saved_msgs = get_option('loginizer_msg');
1946
1947	?>
1948
1949	<div id="" class="postbox">
1950
1951	<div class="postbox-header">
1952	<h2 class="hndle ui-sortable-handle">
1953	<?php echo __('<span>Failed Login Attempts Logs</span>   (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1954	</h2>
1955	</div>
1956
1957	<script>
1958	function yesdsd(){
1959	window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1960	return false;
1961	}
1962
1963	function lz_export_ajax(lz_csv_type){
1964
1965	var data = new Object();
1966	data["action"] = lz_csv_type != "failed_login" ? "loginizer_export" : "loginizer_failed_login_export";
1967	data["lz_csv_type"] = lz_csv_type;
1968	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax'); ?>";
1969
1970	var admin_url = "<?php admin_url(); ?>"+"admin-ajax.php";
1971
1972	jQuery.post(admin_url, data, function(response){
1973
1974	// Was the ajax call successful ?
1975	if(response.substring(0,2) == "-1"){
1976
1977	var err_message = response.substring(2);
1978
1979	if(err_message){
1980	alert(err_message);
1981	}else{
1982	alert("Failed to export data");
1983	}
1984
1985	return false;
1986	}
1987
1988	/*
1989	* Make CSV downloadable
1990	*/
1991	var downloadLink = document.createElement("a");
1992	var fileData = ['\ufeff'+response];
1993
1994	var blobObject = new Blob(fileData,{
1995	type: "text/csv;charset=utf-8;"
1996	});
1997
1998	var url = URL.createObjectURL(blobObject);
1999	downloadLink.href = url;
2000	downloadLink.download = "loginizer-"+lz_csv_type+".csv";
2001
2002	/*
2003	* Actually download CSV
2004	*/
2005	document.body.appendChild(downloadLink);
2006	downloadLink.click();
2007	document.body.removeChild(downloadLink);
2008
2009	});
2010
2011	}
2012
2013	</script>
2014
2015	<form method="get" onsubmit="return yesdsd();">
2016	<div class="tablenav">
2017	<p class="tablenav-pages" style="margin: 5px 10px" align="right">
2018	<span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
2019	<span class="pagination-links">
2020	<a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
2021	<a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
2022	<span class="paging-input">
2023	<label for="current-page-selector" class="screen-reader-text">Current Page</label>
2024	<input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
2025	</span>
2026	<a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
2027	<a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
2028	</span>
2029	</p>
2030	</div>
2031	</form>
2032
2033	<form action="" method="post" enctype="multipart/form-data">
2034	<?php wp_nonce_field('loginizer-options'); ?>
2035	<div class="inside">
2036	<table class="wp-list-table widefat fixed users" border="0">
2037	<tr>
2038	<th scope="row" valign="top" style="background:#EFEFEF;" width="20"><input type="checkbox" id="lz_check_all_logs" onchange="lz_multiple_check()" style="margin-left:-1px;"/></th>
2039	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
2040	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
2041	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
2042	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
2043	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
2044	<th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
2045	</tr>
2046	<?php
2047
2048	if(empty($result)){
2049	echo '
2050	<tr>
2051	<td colspan="4">
2052	'.__('No Logs. You will see logs about failed login attempts here.', 'loginizer').'
2053	</td>
2054	</tr>';
2055	}else{
2056	foreach($result as $ik => $iv){
2057	$status_button = (!empty($iv['status']) ? 'disable' : 'enable');
2058	echo '
2059	<tr>
2060	<td>
2061	<input type="checkbox" value="'.esc_attr($iv['ip']).'" name="lz_reset_ips[]" class="lz_shift_select_logs lz_check_all_logs" />
2062	</td>
2063	<td>
2064	<a href="https://ipinfo.io/'.esc_html($iv['ip']).'" target="_blank">'.esc_html($iv['ip']).' <span class="dashicons dashicons-external"></span></a>
2065	</td>
2066	<td>
2067	'.esc_html($iv['username']).'
2068	</td>
2069	<td>
2070	'.date('d/M/Y H:i:s P', $iv['time']).'
2071	</td>
2072	<td>
2073	'.esc_html($iv['count']).'
2074	</td>
2075	<td>
2076	'.esc_html($iv['lockout']).'
2077	</td>
2078	<td>
2079	'.esc_html($iv['url']).'
2080	</td>
2081	</tr>';
2082	}
2083	}
2084
2085	?>
2086	</table>
2087
2088	<br>
2089	<input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
2090
2091	<input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
2092
2093	<input name="lz_blacklist_selected_ip" class="button button-primary action" value="<?php echo __('Blacklist Selected IPs', 'loginizer'); ?>" type="submit" />
2094
2095	<input name="lz_export_csv" onclick="lz_export_ajax('failed_login'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2096	</div>
2097	</div>
2098	</form>
2099	<br />
2100
2101	<div id="" class="postbox">
2102
2103	<div class="postbox-header">
2104	<h2 class="hndle ui-sortable-handle">
2105	<span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
2106	</h2>
2107	</div>
2108
2109	<div class="inside">
2110
2111	<form action="" method="post" enctype="multipart/form-data">
2112	<?php wp_nonce_field('loginizer-options'); ?>
2113	<table class="form-table">
2114	<tr>
2115	<th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
2116	<td>
2117	<input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
2118	</td>
2119	</tr>
2120	<tr>
2121	<th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
2122	<td>
2123	<input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
2124	</td>
2125	</tr>
2126	<tr>
2127	<th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
2128	<td>
2129	<input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
2130	</td>
2131	</tr>
2132	<tr>
2133	<th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
2134	<td>
2135	<input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
2136	</td>
2137	</tr>
2138	<tr>
2139	<th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
2140	<td>
2141	<input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
2142	</td>
2143	</tr>
2144	<tr>
2145	<th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
2146	<td>
2147	<?php echo __('after ','loginizer'); ?>
2148	<input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
2149	</td>
2150	</tr>
2151	<tr>
2152	<th scope="row" valign="top"><label for="notify_email_address"><?php echo __('Email Address','loginizer'); ?></label></th>
2153	<td>
2154	<input type="text" value="<?php echo (!empty($notify_email_address) ? $notify_email_address : (!empty($loginizer['custom_notify_email']) ? $loginizer['notify_email_address'] : '')); ?>" name="notify_email_address" id="notify_email_address" size="30" /> <?php echo __('<br />failed login attempts notifications will be sent to this email','loginizer'); ?>
2155	</td>
2156	</tr>
2157	</table><br />
2158	<input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2159	<?php
2160
2161	if(empty($loginizer['disable_brute'])){
2162
2163	echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2164
2165	}else{
2166
2167	echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2168
2169	}
2170
2171	?>
2172	</form>
2173
2174	</div>
2175	</div>
2176	<br />
2177
2178	<?php
2179
2180	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
2181
2182	?>
2183
2184	<style>
2185	.page-navigation a {
2186	margin: 5px 2px;
2187	display: inline-block;
2188	padding: 5px 8px;
2189	color: #0073aa;
2190	background: #e5e5e5 none repeat scroll 0 0;
2191	border: 1px solid #ccc;
2192	text-decoration: none;
2193	transition-duration: 0.05s;
2194	transition-property: border, background, color;
2195	transition-timing-function: ease-in-out;
2196	}
2197
2198	.page-navigation a[data-selected] {
2199	background-color: #00a0d2;
2200	color: #fff;
2201	}
2202	</style>
2203
2204	<script>
2205
2206	jQuery(document).ready(function(){
2207	jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
2208	jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
2209	lz_multiple_check();
2210	lz_shift_check_all('lz_shift_select_logs');
2211	});
2212
2213	// Delete a Blacklist / Whitelist IP Range
2214	function del_confirm(field, todo_id, msg){
2215	var ret = confirm(msg);
2216
2217	if(ret){
2218	jQuery('#lz_bl_wl_todo').attr('name', field);
2219	jQuery('#lz_bl_wl_todo').val(todo_id);
2220	jQuery('#lz_bl_wl_form').submit();
2221	}
2222
2223	return false;
2224
2225	}
2226
2227	// Delete all Blacklist / Whitelist IP Ranges
2228	function del_confirm_all(msg){
2229	var ret = confirm(msg);
2230
2231	if(ret){
2232	return true;
2233	}
2234
2235	return false;
2236
2237	}
2238
2239	//Check all the failed log attempts
2240	function lz_multiple_check(){
2241	jQuery("#lz_check_all_logs").on("click", function(event){
2242	if(this.checked == true){
2243	jQuery(".lz_check_all_logs").prop("checked", true);
2244	}else{
2245	jQuery(".lz_check_all_logs").prop("checked", false);
2246	}
2247	});
2248	}
2249
2250	//To select the installations/backups using shift key
2251	function lz_shift_check_all(check_class){
2252
2253	var checkboxes = jQuery("."+check_class);
2254	var lastChecked = null;
2255
2256	checkboxes.click(function(event){
2257	if(!lastChecked){
2258	lastChecked = this;
2259	return;
2260	}
2261
2262	if(event.shiftKey){
2263	var start = checkboxes.index(this);
2264	var end = checkboxes.index(lastChecked);
2265
2266	checkboxes.slice(Math.min(start,end), Math.max(start,end)+ 1).prop("checked", this.checked);
2267	}
2268
2269	lastChecked = this;
2270	});
2271	};
2272
2273	</script>
2274
2275	<div id="" class="postbox">
2276
2277	<div class="postbox-header">
2278	<h2 class="hndle ui-sortable-handle">
2279	<span><?php echo __('Blacklist IP','loginizer'); ?></span>
2280	</h2>
2281	</div>
2282
2283	<div class="inside">
2284
2285	<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
2286
2287	<form action="" method="post">
2288	<?php wp_nonce_field('loginizer-options'); ?>
2289	<table class="form-table">
2290	<tr>
2291	<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
2292	<td>
2293	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2294	</td>
2295	</tr>
2296	<tr>
2297	<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2298	<td>
2299	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
2300	</td>
2301	</tr>
2302	</table><br />
2303	<input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
2304	<input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
2305	</form>
2306	</div>
2307
2308	<div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
2309
2310	<!--Brute Force Blacklist Import CSV Form-->
2311	<div class="inside" id="blacklist_csv" style="display:none;">
2312	<form action="" method="post" enctype="multipart/form-data">
2313	<?php wp_nonce_field('loginizer-options'); ?>
2314	<input type="hidden" value="blacklist" name="lz_csv_type" />
2315	<h3><?php echo __('Import Blacklist IPs (CSV)', 'loginizer'); ?>:</h3>
2316	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2317	<br><br>
2318	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2319	</form>
2320	</div>
2321	<!---->
2322
2323	<!--Brute Force Blacklist Export CSV Form-->
2324	<div class="inside" style="float:right;">
2325	<form action="" method="post">
2326	<?php wp_nonce_field('loginizer-options'); ?>
2327	<input type="hidden" value="blacklist" name="lz_csv_type" />
2328	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#blacklist_csv').toggle();"/>
2329	<input name="lz_export_csv" onclick="lz_export_ajax('blacklist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2330	</form>
2331
2332	</div>
2333	<!---->
2334
2335	<table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2336	<tr>
2337	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2338	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2339	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2340	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2341	</tr>
2342	<?php
2343	if(empty($loginizer['blacklist'])){
2344	echo '
2345	<tr>
2346	<td colspan="4">
2347	'.__('No Blacklist IPs. You will see blacklisted IP ranges here.', 'loginizer').'
2348	</td>
2349	</tr>';
2350	}else{
2351	foreach($loginizer['blacklist'] as $ik => $iv){
2352	echo '
2353	<tr>
2354	<td>
2355	'.$iv['start'].'
2356	</td>
2357	<td>
2358	'.$iv['end'].'
2359	</td>
2360	<td>
2361	'.date('d/m/Y', $iv['time']).'
2362	</td>
2363	<td>
2364	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2365	</td>
2366	</tr>';
2367	}
2368	}
2369	?>
2370	</table>
2371	<br />
2372	<form action="" method="post" id="lz_bl_wl_form">
2373	<?php wp_nonce_field('loginizer-options'); ?>
2374	<input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2375	</form>
2376	</div>
2377
2378	<br />
2379
2380	<div id="" class="postbox">
2381
2382	<div class="postbox-header">
2383	<h2 class="hndle ui-sortable-handle">
2384	<span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2385	</h2>
2386	</div>
2387
2388	<div class="inside">
2389
2390	<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2391	<form action="" method="post">
2392	<?php wp_nonce_field('loginizer-options'); ?>
2393	<table class="form-table">
2394	<tr>
2395	<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2396	<td>
2397	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2398	</td>
2399	</tr>
2400	<tr>
2401	<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2402	<td>
2403	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2404	</td>
2405	</tr>
2406	</table><br />
2407	<input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2408	<input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2409	</form>
2410	</div>
2411
2412	<div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2413
2414	<!--Brute Force Whitelist Import CSV Form-->
2415	<div class="inside" id="lz_whitelist_csv_div" style="display:none;">
2416	<form action="" method="post" enctype="multipart/form-data">
2417	<?php wp_nonce_field('loginizer-options'); ?>
2418	<input type="hidden" value="whitelist" name="lz_csv_type" />
2419	<h3><?php echo __('Import Whitelist IPs (CSV)', 'loginizer'); ?>:</h3>
2420	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2421	<br><br>
2422	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2423	</form>
2424	</div>
2425	<!---->
2426
2427	<!--Brute Force Whitelist Export CSV Form-->
2428	<div class="inside" style="float:right;">
2429	<form action="" method="post">
2430	<?php wp_nonce_field('loginizer-options'); ?>
2431	<input type="hidden" value="whitelist" name="lz_csv_type" />
2432	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#lz_whitelist_csv_div').toggle();"/>
2433	<input name="lz_export_csv" onclick="lz_export_ajax('whitelist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2434	</form>
2435	</div>
2436	<!---->
2437
2438	<table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2439	<tr>
2440	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2441	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2442	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2443	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2444	</tr>
2445	<?php
2446	if(empty($loginizer['whitelist'])){
2447	echo '
2448	<tr>
2449	<td colspan="4">
2450	'.__('No Whitelist IPs. You will see whitelisted IP ranges here.', 'loginizer').'
2451	</td>
2452	</tr>';
2453	}else{
2454	foreach($loginizer['whitelist'] as $ik => $iv){
2455	echo '
2456	<tr>
2457	<td>
2458	'.$iv['start'].'
2459	</td>
2460	<td>
2461	'.$iv['end'].'
2462	</td>
2463	<td>
2464	'.date('d/m/Y', $iv['time']).'
2465	</td>
2466	<td>
2467	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2468	</td>
2469	</tr>';
2470	}
2471	}
2472	?>
2473	</table>
2474	<br />
2475
2476	</div>
2477
2478	<div id="" class="postbox">
2479
2480	<div class="postbox-header">
2481	<h2 class="hndle ui-sortable-handle">
2482	<span><?php echo __('Error Messages', 'loginizer'); ?></span>
2483	</h2>
2484	</div>
2485
2486	<div class="inside">
2487
2488	<form action="" method="post" enctype="multipart/form-data">
2489	<?php wp_nonce_field('loginizer-options'); ?>
2490	<table class="form-table">
2491	<tr>
2492	<th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2493	<td>
2494	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['inv_userpass']); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2495	<?php echo __('Default: <em>"' . $loginizer['d_msg']['inv_userpass']. '"</em>', 'loginizer'); ?><br />
2496	</td>
2497	</tr>
2498	<tr>
2499	<th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2500	<td>
2501	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['ip_blacklisted']); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2502	<?php echo __('Default: <em>"' . $loginizer['d_msg']['ip_blacklisted']. '"</em>', 'loginizer'); ?><br />
2503	</td>
2504	</tr>
2505	<tr>
2506	<th scope="row" valign="top"><label for="msg_attempts_left"><?php echo __('Attempts Left','loginizer'); ?></label></th>
2507	<td>
2508	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['attempts_left']); ?>" name="msg_attempts_left" id="msg_attempts_left" />
2509	<?php echo __('Default: <em>"' . $loginizer['d_msg']['attempts_left']. '"</em>', 'loginizer'); ?><br />
2510	</td>
2511	</tr>
2512	<tr>
2513	<th scope="row" valign="top"><label for="msg_lockout_err"><?php echo __('Lockout Error','loginizer'); ?></label></th>
2514	<td>
2515	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['lockout_err']); ?>" name="msg_lockout_err" id="msg_lockout_err" />
2516	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['lockout_err']). '"</em>', 'loginizer'); ?><br />
2517	</td>
2518	</tr>
2519	<tr>
2520	<th scope="row" valign="top"><label for="msg_minutes_err"><?php echo __('Minutes','loginizer'); ?></label></th>
2521	<td>
2522	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['minutes_err']); ?>" name="msg_minutes_err" id="msg_minutes_err" />
2523	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['minutes_err']). '"</em>', 'loginizer'); ?><br />
2524	</td>
2525	</tr>
2526	<tr>
2527	<th scope="row" valign="top"><label for="msg_hours_err"><?php echo __('Hours','loginizer'); ?></label></th>
2528	<td>
2529	<input type="text" size="25" value="<?php echo esc_attr(@$saved_msgs['hours_err']); ?>" name="msg_hours_err" id="msg_hours_err" />
2530	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['hours_err']). '"</em>', 'loginizer'); ?><br />
2531	</td>
2532	</tr>
2533	</table><br />
2534	<input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2535	</form>
2536	</div>
2537	</div>
2538	<?php
2539
2540	loginizer_page_footer();
2541
2542	}
2543
2544	add_action('wp_ajax_loginizer_export', 'loginizer_export');
2545
2546	// Export CSV
2547	function loginizer_export(){
2548
2549	// Some AJAX security
2550	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2551
2552	if(!current_user_can('manage_options')){
2553	wp_die('Sorry, but you do not have permissions to change settings.');
2554	}
2555
2556	$lz_csv_type = lz_optpost('lz_csv_type');
2557
2558	switch($lz_csv_type){
2559
2560	case 'blacklist':
2561	$csv_array = get_option('loginizer_blacklist');
2562	$filename = 'loginizer-blacklist';
2563	break;
2564
2565	case 'whitelist':
2566	$csv_array = get_option('loginizer_whitelist');
2567	$filename = 'loginizer-whitelist';
2568	break;
2569	}
2570
2571	if(empty($csv_array)){
2572	echo -1;
2573	echo __('No data to export', 'loginizer');
2574	wp_die();
2575	}
2576
2577	header('Content-Type: text/csv; charset=utf-8');
2578	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2579
2580	$allowed_fields = array('start' => 'Start IP', 'end' => 'End IP', 'time' => 'Time');
2581
2582	$file = fopen("php://output","w");
2583
2584	fputcsv($file, array_values($allowed_fields));
2585
2586	foreach($csv_array as $ik => $iv){
2587
2588	$iv['start'] = $iv['start'];
2589	$iv['end'] = $iv['end'];
2590	$iv['time'] = date('d/m/Y', $iv['time']);
2591
2592	$row = array();
2593	foreach($allowed_fields as $ak => $av){
2594	$row[$ak] = $iv[$ak];
2595	}
2596
2597	fputcsv($file, $row);
2598	}
2599
2600	fclose($file);
2601
2602	wp_die();
2603
2604	}
2605
2606	add_action('wp_ajax_loginizer_failed_login_export', 'loginizer_failed_login_export');
2607
2608	//Export Failed Login Attempts
2609	function loginizer_failed_login_export(){
2610
2611	global $wpdb;
2612	// Some AJAX security
2613	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2614
2615	if(!current_user_can('manage_options')){
2616	wp_die('Sorry, but you do not have permissions to change settings.');
2617	}
2618
2619	$csv_array = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `time` DESC", 1);
2620	$filename = 'loginizer-failed-login-attempts';
2621
2622	if(empty($csv_array)){
2623	echo -1;
2624	echo __('No data to export', 'loginizer');
2625	wp_die();
2626	}
2627
2628	header('Content-Type: text/csv; charset=utf-8');
2629	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2630
2631	$allowed_fields = array('ip' => 'IP', 'attempted_username' => 'Attempted Username', 'last_f_attemp' => 'Last Failed Attempt', 'f_attempts_count' => 'Failed Attempts Count', 'lockouts_count' => 'Lockouts Count', 'url_attacked' => 'URL Attacked');
2632
2633	$file = fopen("php://output","w");
2634
2635	fputcsv($file, array_values($allowed_fields));
2636
2637	foreach($csv_array as $failed_attempts){
2638
2639	$row = array($failed_attempts['ip'], $failed_attempts['username'], date('d/M/Y H:i:s P', $failed_attempts['time']), $failed_attempts['count'], $failed_attempts['lockout'], $failed_attempts['url']);
2640	fputcsv($file, $row);
2641	}
2642
2643
2644	fclose($file);
2645
2646	wp_die();
2647
2648	}
2649
2650	// IP range validations
2651	function loginizer_iprange_validate($start_ip, $end_ip, $cur_list, &$error = array(), $line_count = ''){
2652
2653	$line_error = '';
2654	if(!empty($line_count)){
2655	$line_error = ' '.__('Line no.', 'loginizer').' '.$line_count;
2656	}
2657
2658	if(empty($start_ip)){
2659	$cur_error[] = __('Please enter the Start IP', 'loginizer').$line_error;
2660	}
2661
2662	// If no end IP we consider only 1 IP
2663	if(empty($end_ip)){
2664	$end_ip = $start_ip;
2665	}
2666
2667	if(!lz_valid_ip($start_ip)){
2668	$cur_error[] = __('Please provide a valid start IP', 'loginizer').$line_error;
2669	}
2670
2671	if(!lz_valid_ip($end_ip)){
2672	$cur_error[] = __('Please provide a valid end IP', 'loginizer').$line_error;
2673	}
2674
2675	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
2676
2677	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
2678	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
2679	// This is right
2680	}else{
2681	$cur_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer').$line_error;
2682	}
2683
2684	}
2685
2686	if(!empty($cur_error)){
2687
2688	foreach($cur_error as $rk => $rv){
2689	$error[] = $rv;
2690	}
2691
2692	return false;
2693	}
2694
2695	if(!empty($cur_list)){
2696
2697	foreach($cur_list as $k => $v){
2698
2699	// This is to check if there is any other range exists with the same Start or End IP
2700	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
2701	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
2702	){
2703	$cur_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer').$line_error;
2704	break;
2705	}
2706
2707	// This is to check if there is any other range exists with the same Start IP
2708	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
2709	$cur_error[] = __('The Start IP is present in an existing range !', 'loginizer').$line_error;
2710	break;
2711	}
2712
2713	// This is to check if there is any other range exists with the same End IP
2714	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
2715	$cur_error[] = __('The End IP is present in an existing range!', 'loginizer').$line_error;
2716	break;
2717	}
2718
2719	}
2720
2721	}
2722
2723	if(!empty($cur_error)){
2724
2725	foreach($cur_error as $rk => $rv){
2726	$error[] = $rv;
2727	}
2728
2729	return false;
2730	}
2731
2732	return true;
2733	}
2734
2735	//---------------------
2736	// Admin Menu Pro Pages
2737	//---------------------
2738
2739	// Loginizer - reCaptcha Page
2740	function loginizer_page_recaptcha(){
2741
2742	global $loginizer, $lz_error, $lz_env;
2743
2744	if(!current_user_can('manage_options')){
2745	wp_die('Sorry, but you do not have permissions to change settings.');
2746	}
2747
2748	if(!loginizer_is_premium() && count($_POST) > 0){
2749	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
2750	return loginizer_page_recaptcha_T();
2751	}
2752
2753	/* Make sure post was from this page */
2754	if(count($_POST) > 0){
2755	check_admin_referer('loginizer-options');
2756	}
2757
2758	// Themes
2759	$lz_env['theme']['light'] = 'Light';
2760	$lz_env['theme']['dark'] = 'Dark';
2761
2762	// Langs
2763	$lz_env['lang'][''] = 'Auto Detect';
2764	$lz_env['lang']['ar'] = 'Arabic';
2765	$lz_env['lang']['bg'] = 'Bulgarian';
2766	$lz_env['lang']['ca'] = 'Catalan';
2767	$lz_env['lang']['zh-CN'] = 'Chinese (Simplified)';
2768	$lz_env['lang']['zh-TW'] = 'Chinese (Traditional)';
2769	$lz_env['lang']['hr'] = 'Croatian';
2770	$lz_env['lang']['cs'] = 'Czech';
2771	$lz_env['lang']['da'] = 'Danish';
2772	$lz_env['lang']['nl'] = 'Dutch';
2773	$lz_env['lang']['en-GB'] = 'English (UK)';
2774	$lz_env['lang']['en'] = 'English (US)';
2775	$lz_env['lang']['fil'] = 'Filipino';
2776	$lz_env['lang']['fi'] = 'Finnish';
2777	$lz_env['lang']['fr'] = 'French';
2778	$lz_env['lang']['fr-CA'] = 'French (Canadian)';
2779	$lz_env['lang']['de'] = 'German';
2780	$lz_env['lang']['de-AT'] = 'German (Austria)';
2781	$lz_env['lang']['de-CH'] = 'German (Switzerland)';
2782	$lz_env['lang']['el'] = 'Greek';
2783	$lz_env['lang']['iw'] = 'Hebrew';
2784	$lz_env['lang']['hi'] = 'Hindi';
2785	$lz_env['lang']['hu'] = 'Hungarain';
2786	$lz_env['lang']['id'] = 'Indonesian';
2787	$lz_env['lang']['it'] = 'Italian';
2788	$lz_env['lang']['ja'] = 'Japanese';
2789	$lz_env['lang']['ko'] = 'Korean';
2790	$lz_env['lang']['lv'] = 'Latvian';
2791	$lz_env['lang']['lt'] = 'Lithuanian';
2792	$lz_env['lang']['no'] = 'Norwegian';
2793	$lz_env['lang']['fa'] = 'Persian';
2794	$lz_env['lang']['pl'] = 'Polish';
2795	$lz_env['lang']['pt'] = 'Portuguese';
2796	$lz_env['lang']['pt-BR'] = 'Portuguese (Brazil)';
2797	$lz_env['lang']['pt-PT'] = 'Portuguese (Portugal)';
2798	$lz_env['lang']['ro'] = 'Romanian';
2799	$lz_env['lang']['ru'] = 'Russian';
2800	$lz_env['lang']['sr'] = 'Serbian';
2801	$lz_env['lang']['sk'] = 'Slovak';
2802	$lz_env['lang']['sl'] = 'Slovenian';
2803	$lz_env['lang']['es'] = 'Spanish';
2804	$lz_env['lang']['es-419'] = 'Spanish (Latin America)';
2805	$lz_env['lang']['sv'] = 'Swedish';
2806	$lz_env['lang']['th'] = 'Thai';
2807	$lz_env['lang']['tr'] = 'Turkish';
2808	$lz_env['lang']['uk'] = 'Ukrainian';
2809	$lz_env['lang']['vi'] = 'Vietnamese';
2810
2811	// Sizes
2812	$lz_env['size']['normal'] = 'Normal';
2813	$lz_env['size']['compact'] = 'Compact';
2814
2815	// reCAPTCHA Domains
2816	$lz_env['captcha_domains']['www.google.com'] = 'google.com';
2817	$lz_env['captcha_domains']['www.recaptcha.net'] = 'recaptcha.net';
2818
2819	if(isset($_POST['save_lz'])){
2820
2821	// Clear captcha
2822	if(empty($_POST['captcha_status'])){
2823
2824	// Save the options
2825	update_option('loginizer_captcha', '');
2826
2827	// Mark as saved
2828	$GLOBALS['lz_cleared'] = true;
2829
2830	}else{
2831
2832	// Google Captcha
2833	$option['captcha_type'] = lz_optpost('captcha_type');
2834	$option['captcha_key'] = lz_optpost('captcha_key');
2835	$option['captcha_secret'] = lz_optpost('captcha_secret');
2836	$option['captcha_theme'] = lz_optpost('captcha_theme');
2837	$option['captcha_size'] = lz_optpost('captcha_size');
2838	$option['captcha_lang'] = lz_optpost('captcha_lang');
2839	$option['captcha_domain'] = lz_optpost('captcha_domain');
2840
2841	// No Google Captcha
2842	$option['captcha_text'] = lz_optpost('captcha_text');
2843	$option['captcha_time'] = (int) lz_optpost('captcha_time');
2844	$option['captcha_words'] = (int) lz_optpost('captcha_words');
2845	$option['captcha_add'] = (int) lz_optpost('captcha_add');
2846	$option['captcha_subtract'] = (int) lz_optpost('captcha_subtract');
2847	$option['captcha_multiply'] = (int) lz_optpost('captcha_multiply');
2848	$option['captcha_divide'] = (int) lz_optpost('captcha_divide');
2849
2850	// Checkboxes
2851	$option['captcha_user_hide'] = (int) lz_optpost('captcha_user_hide');
2852	$option['captcha_no_css_login'] = (int) lz_optpost('captcha_no_css_login');
2853	$option['captcha_login'] = (int) lz_optpost('captcha_login');
2854	$option['captcha_lostpass'] = (int) lz_optpost('captcha_lostpass');
2855	$option['captcha_resetpass'] = (int) lz_optpost('captcha_resetpass');
2856	$option['captcha_register'] = (int) lz_optpost('captcha_register');
2857	$option['captcha_comment'] = (int) lz_optpost('captcha_comment');
2858	$option['captcha_wc_checkout'] = (int) lz_optpost('captcha_wc_checkout');
2859
2860	// Are we to use Math Captcha ?
2861	if(!empty($_POST['captcha_status']) && $_POST['captcha_status'] == 2){
2862
2863	$option['captcha_no_google'] = 1;
2864
2865	// Make the checks
2866	if(strlen($option['captcha_text']) < 1){
2867	$lz_error['captcha_text'] = __('The Captcha key was not submitted', 'loginizer');
2868	}
2869
2870	}else{
2871
2872	// Make the checks
2873	if(strlen($option['captcha_key']) < 32 \|\| strlen($option['captcha_key']) > 50){
2874	$lz_error['captcha_key'] = __('The reCAPTCHA key is invalid', 'loginizer');
2875	}
2876
2877	// Is secret valid ?
2878	if(strlen($option['captcha_secret']) < 32 \|\| strlen($option['captcha_secret']) > 50){
2879	$lz_error['captcha_secret'] = __('The reCAPTCHA secret is invalid', 'loginizer');
2880	}
2881
2882	// Is theme valid ?
2883	if(empty($lz_env['theme'][$option['captcha_theme']])){
2884	$lz_error['captcha_theme'] = __('The reCAPTCHA theme is invalid', 'loginizer');
2885	}
2886
2887	// Is size valid ?
2888	if(empty($lz_env['size'][$option['captcha_size']])){
2889	$lz_error['captcha_size'] = __('The reCAPTCHA size is invalid', 'loginizer');
2890	}
2891
2892	// Is lang valid ?
2893	if(empty($lz_env['lang'][$option['captcha_lang']])){
2894	$lz_error['captcha_lang'] = __('The reCAPTCHA language is invalid', 'loginizer');
2895	}
2896
2897	if(empty($lz_env['captcha_domains'][$option['captcha_domain']])){
2898	$lz_error['captcha_domain'] = __('The reCAPTCHA domain is invalid', 'loginizer');
2899	}
2900
2901	}
2902
2903	// Is there an error ?
2904	if(!empty($lz_error)){
2905	return loginizer_page_recaptcha_T();
2906	}
2907
2908	// Save the options
2909	update_option('loginizer_captcha', $option);
2910
2911	// Mark as saved
2912	$GLOBALS['lz_saved'] = true;
2913	}
2914
2915	}
2916
2917	// Call the theme
2918	loginizer_page_recaptcha_T();
2919
2920	}
2921
2922	// Loginizer - reCaptcha Page Theme
2923	function loginizer_page_recaptcha_T(){
2924
2925	global $loginizer, $lz_error, $lz_env;
2926
2927	// Universal header
2928	loginizer_page_header('reCAPTCHA Settings');
2929
2930	loginizer_feature_available('reCAPTCHA');
2931
2932	// Saved ?
2933	if(!empty($GLOBALS['lz_saved'])){
2934	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
2935	}
2936
2937	// Cleared ?
2938	if(!empty($GLOBALS['lz_cleared'])){
2939	echo '<div id="message" class="updated"><p>'. __('reCAPTCHA has been disabled !', 'loginizer'). '</p></div><br />';
2940	}
2941
2942	// Any errors ?
2943	if(!empty($lz_error)){
2944	lz_report_error($lz_error);echo '<br />';
2945	}
2946
2947	?>
2948
2949	<style>
2950	input[type="text"], textarea, select {
2951	width: 70%;
2952	}
2953	</style>
2954
2955	<div id="" class="postbox">
2956
2957	<div class="postbox-header">
2958	<h2 class="hndle ui-sortable-handle">
2959	<span><?php echo __('reCAPTCHA Settings', 'loginizer'); ?></span>
2960	</h2>
2961	</div>
2962
2963	<div class="inside">
2964
2965	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
2966	<?php wp_nonce_field('loginizer-options'); ?>
2967	<table class="form-table">
2968	<tr>
2969	<td scope="row" valign="top" style="width:400px !important;"><label for="captcha_status"><b><?php echo __('Captcha Status', 'loginizer'); ?></b></label></td>
2970	<td>
2971	<select name="captcha_status" id="captcha_status" onchange="lz_captcha_status();">
2972	<?php
2973	echo '<option '.lz_POSTselect('captcha_status', 0, (empty($loginizer['captcha_key']) && empty($loginizer['captcha_no_google']) ? true : false)).' value="0">'.__('Disabled', 'loginizer').'</value>
2974	<option '.lz_POSTselect('captcha_status', 1, (!empty($loginizer['captcha_key']) ? true : false)).' value="1">'.__('Google reCAPTCHA', 'loginizer').'</value>
2975	<option '.lz_POSTselect('captcha_status', 2, (!empty($loginizer['captcha_no_google']) ? true : false)).' value="2">'.__('Math Captcha', 'loginizer').'</value>';
2976	?>
2977	</select>
2978	</td>
2979	</tr>
2980	<tr class="lz_google_cap">
2981	<td scope="row" valign="top"><label><b><?php echo __('reCAPTCHA type', 'loginizer'); ?></b></label><br>
2982	<?php echo __('Choose the type of reCAPTCHA', 'loginizer'); ?><br />
2983	<?php echo __('<a href="https://g.co/recaptcha/sitetypes/" target="_blank">See Site Types for more details</a>', 'loginizer'); ?>
2984	</td>
2985	<td>
2986	<input type="radio" value="v3" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v3', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v3" /> <label for="captcha_type_v3"><?php echo __('reCAPTCHA v3', 'loginizer'); ?></label><br /><br />
2987	<input type="radio" value="" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', '', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2" /> <label for="captcha_type_v2"><?php echo __('reCAPTCHA v2 - Checkbox', 'loginizer'); ?></label><br /><br />
2988	<input type="radio" value="v2_invisible" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v2_invisible', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2_invisible" /> <label for="captcha_type_v2_invisible"><?php echo __('reCAPTCHA v2 - Invisible', 'loginizer'); ?></label><br />
2989	</td>
2990	</tr>
2991	<tr class="lz_google_cap">
2992	<td scope="row" valign="top"><label for="captcha_key"><b><?php echo __('Site Key', 'loginizer'); ?></b></label><br>
2993	<?php echo __('Make sure you enter the correct keys as per the reCAPTCHA type selected above', 'loginizer'); ?>
2994	</td>
2995	<td>
2996	<input type="text" size="50" value="<?php echo lz_optpost('captcha_key', $loginizer['captcha_key']); ?>" name="captcha_key" id="captcha_key" /><br />
2997	<?php echo __('Get the Site Key and Secret Key from <a href="https://www.google.com/recaptcha/admin/" target="_blank">Google</a>', 'loginizer'); ?>
2998	</td>
2999	</tr>
3000	<tr class="lz_google_cap">
3001	<td scope="row" valign="top"><label for="captcha_secret"><b><?php echo __('Secret Key', 'loginizer'); ?></b></label></td>
3002	<td>
3003	<input type="text" size="50" value="<?php echo lz_optpost('captcha_secret', $loginizer['captcha_secret']); ?>" name="captcha_secret" id="captcha_secret" />
3004	</td>
3005	</tr>
3006	<tr class="lz_google_cap">
3007	<td scope="row" valign="top"><label for="captcha_theme"><b><?php echo __('Theme', 'loginizer'); ?></b></label></td>
3008	<td>
3009	<select name="captcha_theme" id="captcha_theme">
3010	<?php
3011	foreach($lz_env['theme'] as $k => $v){
3012	echo '<option '.lz_POSTselect('captcha_theme', $k, ($loginizer['captcha_theme'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3013	}
3014	?>
3015	</select>
3016	</td>
3017	</tr>
3018	<tr class="lz_google_cap">
3019	<td scope="row" valign="top"><label for="captcha_lang"><b><?php echo __('Language', 'loginizer'); ?></b></label></td>
3020	<td>
3021	<select name="captcha_lang" id="captcha_lang">
3022	<?php
3023	foreach($lz_env['lang'] as $k => $v){
3024	echo '<option '.lz_POSTselect('captcha_lang', $k, ($loginizer['captcha_lang'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3025	}
3026	?>
3027	</select>
3028	</td>
3029	</tr>
3030	<tr class="lz_google_cap lz_google_cap_size">
3031	<td scope="row" valign="top"><label for="captcha_size"><b><?php echo __('Size', 'loginizer'); ?></b></label></td>
3032	<td>
3033	<select name="captcha_size" id="captcha_size">
3034	<?php
3035	foreach($lz_env['size'] as $k => $v){
3036	echo '<option '.lz_POSTselect('captcha_size', $k, ($loginizer['captcha_size'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3037	}
3038	?>
3039	</select>
3040	</td>
3041	</tr>
3042	<tr class="lz_google_cap">
3043	<td scope="row" valign="top">
3044	<label for="captcha_domain"><b><?php echo __('reCAPTCHA Domain', 'loginizer'); ?></b></label><br>
3045	<?php echo __('If Google is not accessible or blocked in your country select other one', 'loginizer'); ?>
3046	</td>
3047	<td>
3048	<select name="captcha_domain" id="captcha_domain">
3049	<?php
3050	foreach($lz_env['captcha_domains'] as $k => $v){
3051	echo '<option '.lz_POSTselect('captcha_domain', $k, ($loginizer['captcha_domain'] == $k ? true : false)).' value="'.$k.'">'.$v.($k == 'www.google.com' ? ' '.__('(Default)', 'loginizer') : '').'</value>';
3052	}
3053	?>
3054	</select>
3055	</td>
3056	</tr>
3057	<tr class="lz_math_cap">
3058	<td scope="row" valign="top">
3059	<label for="captcha_text"><b><?php echo __('Captcha Text', 'loginizer'); ?></b></label><br>
3060	<?php echo __('The text to be shown for the Captcha Field', 'loginizer'); ?>
3061	</td>
3062	<td>
3063	<input type="text" size="30" value="<?php echo lz_optpost('captcha_text', @$loginizer['captcha_text']); ?>" name="captcha_text" id="captcha_text" />
3064	</td>
3065	</tr>
3066	<tr class="lz_math_cap">
3067	<td scope="row" valign="top">
3068	<label for="captcha_time"><b><?php echo __('Captcha Time', 'loginizer'); ?></b></label><br>
3069	<?php echo __('Enter the number of seconds, a user has to enter captcha value.', 'loginizer'); ?>
3070	</td>
3071	<td>
3072	<input type="text" size="30" value="<?php echo lz_optpost('captcha_time', @$loginizer['captcha_time']); ?>" name="captcha_time" id="captcha_time" />
3073	</td>
3074	</tr>
3075	<tr class="lz_math_cap">
3076	<td scope="row" valign="top">
3077	<label for="captcha_words"><b><?php echo __('Display Captcha in Words', 'loginizer'); ?></b></label><br>
3078	<?php echo __('If selected the Captcha will be displayed in words rather than numbers', 'loginizer'); ?>
3079	</td>
3080	<td>
3081	<input type="checkbox" value="1" name="captcha_words" id="captcha_words" <?php echo lz_POSTchecked('captcha_words', (empty($loginizer['captcha_words']) ? false : true));?> />
3082	</td>
3083	</tr>
3084	<tr class="lz_math_cap">
3085	<td scope="row" valign="top" style="vertical-align: top !important;">
3086	<label><b><?php echo __('Mathematical operations', 'loginizer'); ?></b></label><br>
3087	<?php echo __('The Mathematical operations to use for Captcha', 'loginizer'); ?>
3088	</td>
3089	<td valign="top">
3090	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3091	<?php echo '
3092	<tr>
3093	<td><label for="captcha_add">'.__('Addition (+)', 'loginizer').'</label></td>
3094	<td><input type="checkbox" value="1" name="captcha_add" id="captcha_add" '.lz_POSTchecked('captcha_add', (empty($loginizer['captcha_add']) ? false : true)).' /></td>
3095	</tr>
3096	<tr>
3097	<td><label for="captcha_subtract">'.__('Subtraction (-)', 'loginizer').'</label></td>
3098	<td><input type="checkbox" value="1" name="captcha_subtract" id="captcha_subtract" '.lz_POSTchecked('captcha_subtract', (empty($loginizer['captcha_subtract']) ? false : true)).' /></td>
3099	</tr>
3100	<tr>
3101	<td><label for="captcha_multiply">'.__('Multiplication (x)', 'loginizer').'</label></td>
3102	<td><input type="checkbox" value="1" name="captcha_multiply" id="captcha_multiply" '.lz_POSTchecked('captcha_multiply', (empty($loginizer['captcha_multiply']) ? false : true)).' /></td>
3103	</tr>
3104	<tr>
3105	<td><label for="captcha_divide">'.__('Division (÷)', 'loginizer').'</label></td>
3106	<td><input type="checkbox" value="1" name="captcha_divide" id="captcha_divide" '.lz_POSTchecked('captcha_divide', (empty($loginizer['captcha_divide']) ? false : true)).' /></td>
3107	</tr>';
3108	?>
3109	</table>
3110	</td>
3111	</tr>
3112	<tr class="lz_cap">
3113	<td scope="row" valign="top"><label><b><?php echo __('Show Captcha On', 'loginizer'); ?></b></label></td>
3114	<td valign="top">
3115	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3116	<?php echo '
3117	<tr>
3118	<td><label for="captcha_login">'.__('Login Form', 'loginizer').'</label></td>
3119	<td><input type="checkbox" value="1" name="captcha_login" id="captcha_login" '.lz_POSTchecked('captcha_login', (empty($loginizer['captcha_login']) ? false : true)).' /></td>
3120	</tr>
3121	<tr>
3122	<td><label for="captcha_lostpass">'.__('Lost Password Form', 'loginizer').'</label></td>
3123	<td><input type="checkbox" value="1" name="captcha_lostpass" id="captcha_lostpass" '.lz_POSTchecked('captcha_lostpass', (empty($loginizer['captcha_lostpass']) ? false : true)).' /></td>
3124	</tr>
3125	<tr>
3126	<td><label for="captcha_resetpass">'.__('Reset Password Form', 'loginizer').'</label></td>
3127	<td><input type="checkbox" value="1" name="captcha_resetpass" id="captcha_resetpass" '.lz_POSTchecked('captcha_resetpass', (empty($loginizer['captcha_resetpass']) ? false : true)).' /></td>
3128	</tr>
3129	<tr>
3130	<td><label for="captcha_register">'.__('Registration Form', 'loginizer').'</label></td>
3131	<td><input type="checkbox" value="1" name="captcha_register" id="captcha_register" '.lz_POSTchecked('captcha_register', (empty($loginizer['captcha_register']) ? false : true)).' /></td>
3132	</tr>
3133	<tr>
3134	<td><label for="captcha_comment">'.__('Comment Form', 'loginizer').'</label></td>
3135	<td><input type="checkbox" value="1" name="captcha_comment" id="captcha_comment" '.lz_POSTchecked('captcha_comment', (empty($loginizer['captcha_comment']) ? false : true)).' /></td>
3136	</tr>';
3137
3138	if(!defined('SITEPAD')){
3139
3140	echo '<tr>
3141	<td><label for="captcha_wc_checkout">'.__('WooCommerce Checkout', 'loginizer').'</label></td>
3142	<td><input type="checkbox" value="1" name="captcha_wc_checkout" id="captcha_wc_checkout" '.lz_POSTchecked('captcha_wc_checkout', (empty($loginizer['captcha_wc_checkout']) ? false : true)).' /></td>
3143	</tr>';
3144
3145	}
3146
3147	?>
3148	</table>
3149	</td>
3150	</tr>
3151	<tr class="lz_cap">
3152	<td scope="row" valign="top"><label for="captcha_user_hide"><b><?php echo __('Hide CAPTCHA for logged in Users', 'loginizer'); ?></b></label></td>
3153	<td>
3154	<input type="checkbox" value="1" name="captcha_user_hide" id="captcha_user_hide" <?php echo lz_POSTchecked('captcha_user_hide', (empty($loginizer['captcha_user_hide']) ? false : true)); ?> />
3155	</td>
3156	</tr>
3157	<tr class="lz_google_cap">
3158	<td scope="row" valign="top"><label for="captcha_no_css_login"><b><?php echo __('Disable CSS inserted on Login Page', 'loginizer'); ?></b></label></td>
3159	<td>
3160	<input type="checkbox" value="1" name="captcha_no_css_login" id="captcha_no_css_login" <?php echo lz_POSTchecked('captcha_no_css_login', (empty($loginizer['captcha_no_css_login']) ? false : true)); ?> />
3161	</td>
3162	</tr>
3163	</table><br />
3164	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" /></center>
3165	</form>
3166
3167	</div>
3168	</div>
3169	<br />
3170
3171	<script type="text/javascript">
3172
3173	function lz_captcha_status(){
3174
3175	var cur_captcha_status = jQuery("#captcha_status option:selected").val();
3176
3177	if(cur_captcha_status == 1){
3178	jQuery(".lz_google_cap").show();
3179	jQuery(".lz_math_cap").hide();
3180	jQuery(".lz_cap").show();
3181	google_recaptcha_type();
3182
3183	}else if(cur_captcha_status == 2){
3184	jQuery(".lz_google_cap").hide();
3185	jQuery(".lz_math_cap").show();
3186	jQuery(".lz_cap").show();
3187	}else{
3188	jQuery(".lz_google_cap").hide();
3189	jQuery(".lz_math_cap").hide();
3190	jQuery(".lz_cap").hide();
3191	}
3192
3193	}
3194
3195	function google_recaptcha_type(){
3196
3197	var cur_captcha_type = jQuery("input:radio[name='captcha_type']:checked").val();
3198
3199	if(cur_captcha_type == 'v3' \|\| cur_captcha_type == 'v2_invisible'){
3200	jQuery(".lz_google_cap_size").hide();
3201	}else{
3202	jQuery(".lz_google_cap_size").show();
3203	}
3204
3205	}
3206
3207	jQuery(document).ready(function(){
3208	lz_captcha_status();
3209	});
3210
3211	</script>
3212
3213	<?php
3214	loginizer_page_footer();
3215
3216	}
3217
3218
3219	// Loginizer - Two Factor Auth Page
3220	function loginizer_page_2fa(){
3221
3222	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3223
3224	if(!current_user_can('manage_options')){
3225	wp_die('Sorry, but you do not have permissions to change settings.');
3226	}
3227
3228	if(!loginizer_is_premium() && count($_POST) > 0){
3229	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3230	return loginizer_page_2fa_T();
3231	}
3232
3233	$lz_roles = get_editable_roles();
3234
3235	if(empty($lz_roles)){
3236	$lz_roles = array();
3237	}
3238
3239	/* Make sure post was from this page */
3240	if(count($_POST) > 0){
3241	check_admin_referer('loginizer-options');
3242	}
3243
3244	// Settings submitted
3245	if(isset($_POST['save_lz'])){
3246
3247	// In the future there can be more settings
3248	$option['2fa_app'] = (int) lz_optpost('2fa_app');
3249	$option['2fa_email'] = (int) lz_optpost('2fa_email');
3250	$option['question'] = (int) lz_optpost('question');
3251	$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
3252
3253	// Any roles to apply to ?
3254	foreach($lz_roles as $k => $v){
3255
3256	if(lz_optpost('2fa_roles_'.$k)){
3257	$option['2fa_roles'][$k] = 1;
3258	}
3259
3260	}
3261
3262	// If its all, then blank it
3263	if(lz_optpost('2fa_roles_all') \|\| empty($option['2fa_roles'])){
3264	$option['2fa_roles'] = '';
3265	}
3266
3267	// Is there an error ?
3268	if(!empty($lz_error)){
3269	return loginizer_page_2fa_T();
3270	}
3271
3272	// Save the options
3273	update_option('loginizer_2fa', $option);
3274
3275	// Mark as saved
3276	$GLOBALS['lz_saved'] = true;
3277
3278	}
3279
3280	// Reset a users 2FA
3281	if(isset($_POST['reset_user_lz'])){
3282
3283	$_username = lz_optpost('lz_user_2fa_disable');
3284
3285	// Try to get the user
3286	$user_search = get_user_by('login', $_username);
3287
3288	// If not found then search by email
3289	if(empty($user_search)){
3290	$user_search = get_user_by('email', $_username);
3291	}
3292
3293	// If not found then give error
3294	if(empty($user_search)){
3295	$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
3296	return loginizer_page_2fa_T();
3297	}
3298
3299	// Get the user prefences
3300	$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
3301
3302	// Blank it
3303	$user_pref['pref'] = 'none';
3304
3305	// Save it
3306	update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
3307
3308	// Mark as saved
3309	$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
3310
3311	}
3312
3313	if(isset($_POST['save_2fa_email_template_lz'])){
3314
3315	// In the future there can be more settings
3316	$option['2fa_email_sub'] = @stripslashes($_POST['lz_2fa_email_sub']);
3317	$option['2fa_email_msg'] = @stripslashes($_POST['lz_2fa_email_msg']);
3318
3319	// Is there an error ?
3320	if(!empty($lz_error)){
3321	return loginizer_page_2fa_T();
3322	}
3323
3324	// Save the options
3325	update_option('loginizer_2fa_email_template', $option);
3326
3327	// Mark as saved
3328	$GLOBALS['lz_saved'] = true;
3329
3330	}
3331
3332	// Save the messages
3333	if(isset($_POST['save_msgs_lz'])){
3334
3335	$msgs['otp_app'] = lz_optpost('msg_otp_app');
3336	$msgs['otp_email'] = lz_optpost('msg_otp_email');
3337	$msgs['otp_field'] = lz_optpost('msg_otp_field');
3338	$msgs['otp_question'] = lz_optpost('msg_otp_question');
3339	$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
3340
3341	// Update them
3342	update_option('loginizer_2fa_msg', $msgs);
3343
3344	// Mark as saved
3345	$GLOBALS['lz_saved'] = __('Messages were saved successfully', 'loginizer');
3346
3347	}
3348
3349	// Delete a Whitelist IP range
3350	if(isset($_POST['delid'])){
3351
3352	$delid = (int) lz_optreq('delid');
3353
3354	// Unset and save
3355	$whitelist = $loginizer['2fa_whitelist'];
3356	unset($whitelist[$delid]);
3357	update_option('loginizer_2fa_whitelist', $whitelist);
3358
3359	// Mark as saved
3360	$GLOBALS['lz_saved'] = __('The Whitelist IP range has been deleted successfully', 'loginizer');
3361
3362	}
3363
3364	// Delete all Blackist IP ranges
3365	if(isset($_POST['del_all_whitelist'])){
3366
3367	// Unset and save
3368	update_option('loginizer_2fa_whitelist', array());
3369
3370	// Mark as saved
3371	$GLOBALS['lz_saved'] = __('The Whitelist IP range(s) have been cleared successfully', 'loginizer');
3372
3373	}
3374
3375	// Add IP range to 2FA whitelist
3376	if(isset($_POST['2fa_whitelist_iprange'])){
3377
3378	$start_ip = lz_optpost('start_ip_w_2fa');
3379	$end_ip = lz_optpost('end_ip_w_2fa');
3380
3381	if(empty($start_ip)){
3382	$lz_error[] = __('Please enter the Start IP', 'loginizer');
3383	return loginizer_page_2fa_T();
3384	}
3385
3386	// If no end IP we consider only 1 IP
3387	if(empty($end_ip)){
3388	$end_ip = $start_ip;
3389	}
3390
3391	if(!lz_valid_ip($start_ip)){
3392	$lz_error[] = __('Please provide a valid start IP', 'loginizer');
3393	}
3394
3395	if(!lz_valid_ip($end_ip)){
3396	$lz_error[] = __('Please provide a valid end IP', 'loginizer');
3397	}
3398
3399	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
3400
3401	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
3402	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
3403	// This is right
3404	}else{
3405	$lz_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
3406	}
3407
3408	}
3409
3410	if(empty($lz_error)){
3411
3412	$whitelist = $loginizer['2fa_whitelist'];
3413
3414	foreach($whitelist as $k => $v){
3415
3416	// This is to check if there is any other range exists with the same Start or End IP
3417	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
3418	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
3419	){
3420	$lz_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
3421	break;
3422	}
3423
3424	// This is to check if there is any other range exists with the same Start IP
3425	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
3426	$lz_error[] = __('The Start IP is present in an existing range !', 'loginizer');
3427	break;
3428	}
3429
3430	// This is to check if there is any other range exists with the same End IP
3431	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
3432	$lz_error[] = __('The End IP is present in an existing range!', 'loginizer');
3433	break;
3434	}
3435
3436	}
3437
3438	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
3439
3440	if(empty($lz_error)){
3441
3442	$whitelist[$newid] = array();
3443	$whitelist[$newid]['start'] = $start_ip;
3444	$whitelist[$newid]['end'] = $end_ip;
3445	$whitelist[$newid]['time'] = time();
3446
3447	update_option('loginizer_2fa_whitelist', $whitelist);
3448
3449	// Mark as saved
3450	$GLOBALS['lz_saved'] = __('Whitelist IP range for Two Factor Authentication added successfully', 'loginizer');
3451
3452	}
3453
3454	}
3455	}
3456
3457
3458	$lz_options = get_option('loginizer_2fa_email_template');
3459	$saved_msgs = get_option('loginizer_2fa_msg');
3460	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
3461
3462	// Call theme
3463	loginizer_page_2fa_T();
3464
3465	}
3466
3467
3468	// Loginizer - Two Factor Auth Page
3469	function loginizer_page_2fa_T(){
3470
3471	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3472
3473	// Universal header
3474	loginizer_page_header('Two Factor Authentication');
3475
3476	loginizer_feature_available('Two-Factor Authentication');
3477
3478	// Saved ?
3479	if(!empty($GLOBALS['lz_saved'])){
3480	echo '<div id="message" class="updated"><p>'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '</p></div><br />';
3481	}
3482
3483	// Any errors ?
3484	if(!empty($lz_error)){
3485	lz_report_error($lz_error);echo '<br />';
3486	}
3487
3488	?>
3489
3490	<style>
3491	input[type="text"], textarea, select {
3492	width: 70%;
3493	}
3494
3495	.form-table label{
3496	font-weight:bold;
3497	}
3498
3499	.exp{
3500	font-size:12px;
3501	}
3502	</style>
3503
3504	<div id="" class="postbox">
3505
3506	<div class="postbox-header">
3507	<h2 class="hndle ui-sortable-handle">
3508	<span><?php echo __('Two Factor Authentication Settings', 'loginizer'); ?></span>
3509	</h2>
3510	</div>
3511
3512	<div class="inside">
3513
3514	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3515	<?php wp_nonce_field('loginizer-options'); ?>
3516	<table class="form-table">
3517	<tr>
3518	<td scope="row" valign="top" colspan="2">
3519	<i><?php echo __('Please choose from the following Two Factor Authentication methods. Each user can choose any one method from the ones enabled by you. You can enable all or anyone that you would like.', 'loginizer'); ?></i>
3520	</td>
3521	</tr>
3522	<tr>
3523	<td scope="row" valign="top" style="width:70% !important">
3524	<label><?php echo __('OTP via App', 'loginizer'); ?></label><br>
3525	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be obtained from the users mobile app e.g. <b>Google Authenticator, Authy, etc.</b>', 'loginizer'); ?></span>
3526	</td>
3527	<td>
3528	<input type="checkbox" value="1" name="2fa_app" <?php echo lz_POSTchecked('2fa_app', (empty($loginizer['2fa_app']) ? false : true), 'save_lz'); ?> />
3529	</td>
3530	</tr>
3531	<tr>
3532	<td scope="row" valign="top">
3533	<label><?php echo __('OTP via Email', 'loginizer'); ?></label><br>
3534	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be emailed to the user.', 'loginizer'); ?></span>
3535	</td>
3536	<td>
3537	<input type="checkbox" value="1" name="2fa_email" <?php echo lz_POSTchecked('2fa_email', (empty($loginizer['2fa_email']) ? false : true), 'save_lz'); ?> />
3538	</td>
3539	</tr>
3540	<tr>
3541	<td scope="row" valign="top">
3542	<label><?php echo __('User Defined Question & Answer', 'loginizer'); ?></label><br>
3543	<span class="exp"><?php echo __('In this method the user will be asked to set a secret personal question and answer. After entering the correct login credentials, the user will be asked to answer the question set by them, thus increasing the security', 'loginizer'); ?></span>
3544	</td>
3545	<td>
3546	<input type="checkbox" value="1" name="question" <?php echo lz_POSTchecked('question', (empty($loginizer['question']) ? false : true), 'save_lz'); ?> />
3547	</td>
3548	</tr>
3549	</table><br />
3550
3551	<table class="form-table">
3552	<tr>
3553	<td scope="row" valign="top" style="width:70% !important">
3554	<label><?php echo __('Force OTP via Email', 'loginizer'); ?></label><br>
3555	<span class="exp"><?php echo __('If the user does not have any 2FA method selected, this will enforce the OTP via Email for the users.', 'loginizer'); ?></span>
3556	</td>
3557	<td>
3558	<input type="checkbox" value="1" name="2fa_email_force" <?php echo lz_POSTchecked('2fa_email_force', (empty($loginizer['2fa_email_force']) ? false : true), 'save_lz'); ?> />
3559	</td>
3560	</tr>
3561	<tr>
3562	<td scope="row" valign="top" style="width:70% !important">
3563	<label><?php echo __('Apply 2FA to Roles', 'loginizer'); ?></label><br>
3564	<span class="exp"><?php echo __('Select the Roles to which 2FA should be applied.', 'loginizer'); ?></span>
3565	</td>
3566	<td>
3567	<input type="checkbox" value="1" onchange="lz_roles_handle()" name="2fa_roles_all" id="2fa_roles_all" <?php echo lz_POSTchecked('2fa_roles_all', (empty($loginizer['2fa_roles']) ? true : false), 'save_lz'); ?> /> All<br />
3568	<?php
3569
3570	foreach($lz_roles as $k => $v){
3571	echo '<span class="lz_roles"><input type="checkbox" value="1" name="2fa_roles_'.$k.'" '.lz_POSTchecked('2fa_roles_'.$k, (empty($loginizer['2fa_roles'][$k]) ? false : true), 'save_lz').' /> '.$v['name'].'<br /></span>';
3572	}
3573
3574	?>
3575	</td>
3576	</tr>
3577	</table><br />
3578	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3579	</form>
3580
3581	</div>
3582	</div>
3583
3584	<script type="text/javascript">
3585
3586	function lz_roles_handle(){
3587
3588	var obj = jQuery("#2fa_roles_all")[0];
3589
3590	if(obj.checked){
3591	jQuery(".lz_roles").hide();
3592	}else{
3593	jQuery(".lz_roles").show();
3594	}
3595
3596	}
3597
3598	lz_roles_handle();
3599
3600	</script>
3601
3602	<div id="" class="postbox">
3603
3604	<div class="postbox-header">
3605	<h2 class="hndle ui-sortable-handle">
3606	<span><?php echo __('OTP via Email Template', 'loginizer'); ?></span>
3607	</h2>
3608	</div>
3609
3610	<div class="inside">
3611
3612	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3613	<?php wp_nonce_field('loginizer-options'); ?>
3614	<table class="form-table">
3615	<tr>
3616	<td colspan="2" valign="top">
3617	<?php echo __('Customize the email template to be used when sending the OTP to login via Email for 2FA.', 'loginizer'); ?><br>
3618	<?php echo __('If you do not make changes below the default email template will be used !', 'loginizer'); ?>
3619	</td>
3620	</tr>
3621	<tr>
3622	<td scope="row" valign="top" style="width:350px !important">
3623	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3624	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3625	<br />Default : <?php echo @$loginizer['2fa_email_d_sub']; ?>
3626	</td>
3627	<td valign="top">
3628	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_sub']) ? stripslashes($_POST['lz_2fa_email_sub']) : @$lz_options['2fa_email_sub']); ?>" name="lz_2fa_email_sub" />
3629	</td>
3630	</tr>
3631	<tr>
3632	<td scope="row" valign="top">
3633	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3634	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3635	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['2fa_email_d_msg']; ?></pre>
3636	</td>
3637	<td valign="top">
3638	<textarea rows="10" name="lz_2fa_email_msg"><?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_msg']) ? stripslashes($_POST['lz_2fa_email_msg']) : @$lz_options['2fa_email_msg']); ?></textarea>
3639	<br />
3640	Variables :
3641	<br />$otp - The OTP for login
3642	<br />$site_name - The Site Name
3643	<br />$site_url - The Site URL
3644	<br />$email - Users Email
3645	<br />$display_name - Users Display Name
3646	<br />$user_login - Username
3647	<br />$first_name - Users First Name
3648	<br />$last_name - Users Last Name
3649	</td>
3650	</tr>
3651	</table><br />
3652	<center><input name="save_2fa_email_template_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3653	</form>
3654
3655	</div>
3656	</div>
3657
3658	<div id="" class="postbox">
3659
3660	<div class="postbox-header">
3661	<h2 class="hndle ui-sortable-handle">
3662	<span><?php echo __('Custom Messages for OTP', 'loginizer'); ?></span>
3663	</h2>
3664	</div>
3665
3666	<div class="inside">
3667
3668	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3669	<?php wp_nonce_field('loginizer-options'); ?>
3670	<table class="form-table">
3671	<tr>
3672	<td colspan="2" valign="top">
3673	<?php echo __('Customize the title for OTP field displayed to the user on the login form.', 'loginizer'); ?><br>
3674	<?php echo __('If you do not make changes below the default messages will be used !', 'loginizer'); ?>
3675	</td>
3676	</tr>
3677	<tr>
3678	<td scope="row" valign="top" style="width:350px !important">
3679	<label for="msg_otp_app"><?php echo __('OTP via APP','loginizer'); ?></label><br />
3680	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_app']. '"</em>', 'loginizer'); ?>
3681	</td>
3682	<td>
3683	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_app']); ?>" name="msg_otp_app" id="msg_otp_app" style="width:auto !important;" />
3684	<br />
3685	</td>
3686	</tr>
3687	<tr>
3688	<td scope="row" valign="top" style="width:350px !important">
3689	<label for="msg_otp_email"><?php echo __('OTP via Email','loginizer'); ?></label><br />
3690	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_email']. '"</em>', 'loginizer'); ?>
3691	</td>
3692	<td>
3693	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_email']); ?>" name="msg_otp_email" id="msg_otp_email" style="width:auto !important;" />
3694	<br />
3695	</td>
3696	</tr>
3697	<tr>
3698	<td scope="row" valign="top" style="width:350px !important">
3699	<label for="msg_otp_field"><?php echo __('Title for OTP field','loginizer'); ?></label><br />
3700	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_field']. '"</em>', 'loginizer'); ?>
3701	</td>
3702	<td>
3703	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_field']); ?>" name="msg_otp_field" id="msg_otp_field" style="width:auto !important;" />
3704	<br />
3705	</td>
3706	</tr>
3707	<tr>
3708	<td scope="row" valign="top" style="width:350px !important">
3709	<label for="msg_otp_question"><?php echo __('Title for Security Question','loginizer'); ?></label><br />
3710	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_question']. '"</em>', 'loginizer'); ?>
3711	</td>
3712	<td>
3713	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_question']); ?>" name="msg_otp_question" id="msg_otp_question" style="width:auto !important;" />
3714	<br />
3715	</td>
3716	</tr>
3717	<tr>
3718	<td scope="row" valign="top" style="width:350px !important">
3719	<label for="msg_otp_answer"><?php echo __('Title for Security Answer','loginizer'); ?></label><br />
3720	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_answer']. '"</em>', 'loginizer'); ?>
3721	</td>
3722	<td>
3723	<input type="text" size="50" value="<?php echo esc_attr(@$saved_msgs['otp_answer']); ?>" name="msg_otp_answer" id="msg_otp_answer" style="width:auto !important;" />
3724	<br />
3725	</td>
3726	</tr>
3727	</table><br />
3728	<center><input name="save_msgs_lz" class="button button-primary action" value="<?php echo __('Save Messages','loginizer'); ?>" type="submit" /></center>
3729	</form>
3730	</div>
3731	</div>
3732
3733	<!--Bypass a single user-->
3734	<div id="" class="postbox">
3735
3736	<div class="postbox-header">
3737	<h2 class="hndle ui-sortable-handle">
3738	<span><?php echo __('Disable Two Factor Authentication for a User', 'loginizer'); ?></span>
3739	</h2>
3740	</div>
3741
3742	<div class="inside">
3743
3744	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3745	<?php wp_nonce_field('loginizer-options'); ?>
3746	<table class="form-table">
3747	<tr>
3748	<td scope="row" valign="top" colspan="2">
3749	<i><?php echo __('Here you can disable the Two Factor Authentication settings of a user. In the event a user has forgotten his secret answer or lost his Device App, he will not be able to login. You can reset such a users settings from here.', 'loginizer'); ?></i>
3750	</td>
3751	</tr>
3752	<tr>
3753	<td scope="row" valign="top">
3754	<label><?php echo __('Username / Email', 'loginizer'); ?></label><br>
3755	<span class="exp"><?php echo __('The username or email of the user whose 2FA you would like to disable', 'loginizer'); ?></span>
3756	</td>
3757	<td>
3758	<input type="text" size="50" value="<?php echo lz_optpost('lz_user_2fa_disable', ''); ?>" name="lz_user_2fa_disable" />
3759	</td>
3760	</tr>
3761	</table><br />
3762
3763	<center><input name="reset_user_lz" class="button button-primary action" value="<?php echo __('Reset 2FA for User', 'loginizer'); ?>" type="submit" /></center>
3764	</form>
3765
3766	</div>
3767	</div>
3768
3769	<br />
3770
3771	<?php
3772
3773	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
3774
3775	?>
3776
3777	<style>
3778	.page-navigation a {
3779	margin: 5px 2px;
3780	display: inline-block;
3781	padding: 5px 8px;
3782	color: #0073aa;
3783	background: #e5e5e5 none repeat scroll 0 0;
3784	border: 1px solid #ccc;
3785	text-decoration: none;
3786	transition-duration: 0.05s;
3787	transition-property: border, background, color;
3788	transition-timing-function: ease-in-out;
3789	}
3790
3791	.page-navigation a[data-selected] {
3792	background-color: #00a0d2;
3793	color: #fff;
3794	}
3795	</style>
3796
3797	<script>
3798
3799	jQuery(document).ready(function(){
3800	jQuery('#lz_wl_2fa_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_2fa_nav')});
3801	});
3802
3803	// Delete a 2FA Whitelist IP Range
3804	function del_2fa_confirm(field, todo_id, msg){
3805	var ret = confirm(msg);
3806
3807	if(ret){
3808	jQuery('#lz_wl_2fa_todo').attr('name', field);
3809	jQuery('#lz_wl_2fa_todo').val(todo_id);
3810	jQuery('#lz_wl_2fa_form').submit();
3811	}
3812
3813	return false;
3814
3815	}
3816
3817	// Delete all 2FA Whitelist IP Ranges
3818	function del_2fa_confirm_all(msg){
3819	var ret = confirm(msg);
3820
3821	if(ret){
3822	return true;
3823	}
3824
3825	return false;
3826
3827	}
3828
3829	</script>
3830
3831	<div id="" class="postbox">
3832
3833	<div class="postbox-header">
3834	<h2 class="hndle ui-sortable-handle">
3835	<span><?php echo __('Disable Two Factor Authentication for IP', 'loginizer'); ?></span>
3836	</h2>
3837	</div>
3838
3839	<div class="inside">
3840
3841	<?php echo __('Enter the IP you want to whitelist for two factor authentication', 'loginizer'); ?>
3842	<form action="" method="post" loginizer-premium-only="1">
3843	<?php wp_nonce_field('loginizer-options'); ?>
3844	<table class="form-table">
3845	<tr>
3846	<th scope="row" valign="top"><label for="start_ip_w_2fa"><?php echo __('Start IP','loginizer'); ?></label></th>
3847	<td>
3848	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('start_ip_w_2fa')); ?>" name="start_ip_w_2fa" id="start_ip_w_2fa"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
3849	</td>
3850	</tr>
3851	<tr>
3852	<th scope="row" valign="top"><label for="end_ip_w_2fa"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
3853	<td>
3854	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('end_ip_w_2fa')); ?>" name="end_ip_w_2fa" id="end_ip_w_2fa"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
3855	</td>
3856	</tr>
3857	</table><br />
3858	<input name="2fa_whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
3859	<input style="float:right" name="del_all_whitelist" onclick="return del_2fa_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) for 2FA ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s) for 2FA','loginizer'); ?>" type="submit" />
3860	</form>
3861	</div>
3862
3863	<div id="lz_wl_2fa_nav" style="margin: 5px 10px; text-align:right"></div>
3864	<table id="lz_wl_2fa_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
3865	<tr>
3866	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
3867	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
3868	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
3869	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
3870	</tr>
3871	<?php
3872	if(empty($loginizer['2fa_whitelist'])){
3873	echo '
3874	<tr>
3875	<td colspan="4">
3876	'.__('No Whitelist IPs for Two Factor Authentication. You will see whitelisted IP ranges here.', 'loginizer').'
3877	</td>
3878	</tr>';
3879	}else{
3880	foreach($loginizer['2fa_whitelist'] as $ik => $iv){
3881	echo '
3882	<tr>
3883	<td>
3884	'.$iv['start'].'
3885	</td>
3886	<td>
3887	'.$iv['end'].'
3888	</td>
3889	<td>
3890	'.date('d/m/Y', $iv['time']).'
3891	</td>
3892	<td>
3893	<a class="submitdelete" href="javascript:void(0)" onclick="return del_2fa_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range for 2FA ?\')">Delete</a>
3894	</td>
3895	</tr>';
3896	}
3897	}
3898	?>
3899	</table>
3900	<br />
3901	<form action="" method="post" id="lz_wl_2fa_form">
3902	<?php wp_nonce_field('loginizer-options'); ?>
3903	<input type="hidden" value="" name="" id="lz_wl_2fa_todo"/>
3904	</form>
3905	<br />
3906
3907	</div>
3908
3909	<?php
3910	loginizer_page_footer();
3911
3912	}
3913
3914	// Loginizer - PasswordLess Page
3915	function loginizer_page_passwordless(){
3916
3917	global $loginizer, $lz_error, $lz_env;
3918
3919	if(!current_user_can('manage_options')){
3920	wp_die('Sorry, but you do not have permissions to change settings.');
3921	}
3922
3923	if(!loginizer_is_premium() && count($_POST) > 0){
3924	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3925	return loginizer_page_passwordless_T();
3926	}
3927
3928	/* Make sure post was from this page */
3929	if(count($_POST) > 0){
3930	check_admin_referer('loginizer-options');
3931	}
3932
3933	if(isset($_POST['save_lz'])){
3934
3935	// In the future there can be more settings
3936	$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
3937	$option['passwordless_sub'] = lz_optpost('lz_passwordless_sub');
3938	$option['passwordless_msg'] = lz_optpost('lz_passwordless_msg');
3939	$option['passwordless_html'] = (int) lz_optpost('lz_passwordless_html');
3940
3941	// Is there an error ?
3942	if(!empty($lz_error)){
3943	return loginizer_page_passwordless_T();
3944	}
3945
3946	// Save the options
3947	update_option('loginizer_epl', $option);
3948
3949	// Mark as saved
3950	$GLOBALS['lz_saved'] = true;
3951
3952	}
3953
3954	// Call theme
3955	loginizer_page_passwordless_T();
3956	}
3957
3958	// Loginizer - PasswordLess Page Theme
3959	function loginizer_page_passwordless_T(){
3960
3961	global $loginizer, $lz_error, $lz_env;
3962
3963	$lz_options = get_option('loginizer_epl');
3964
3965	// Universal header
3966	loginizer_page_header('PasswordLess Settings');
3967
3968	loginizer_feature_available('PasswordLess Login');
3969
3970	// Saved ?
3971	if(!empty($GLOBALS['lz_saved'])){
3972	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3973	}
3974
3975	// Any errors ?
3976	if(!empty($lz_error)){
3977	lz_report_error($lz_error);echo '<br />';
3978	}
3979
3980	?>
3981
3982	<style>
3983	input[type="text"], textarea, select {
3984	width: 90%;
3985	}
3986
3987	.form-table label{
3988	font-weight:bold;
3989	}
3990
3991	.form-table td{
3992	vertical-align:top;
3993	}
3994
3995	.exp{
3996	font-size:12px;
3997	}
3998	</style>
3999
4000	<div id="" class="postbox">
4001
4002	<div class="postbox-header">
4003	<h2 class="hndle ui-sortable-handle">
4004	<span><?php echo __('PasswordLess Settings', 'loginizer'); ?></span>
4005	</h2>
4006	</div>
4007
4008	<div class="inside">
4009
4010	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4011	<?php wp_nonce_field('loginizer-options'); ?>
4012	<table class="form-table">
4013	<tr>
4014	<th scope="row" valign="top" style="width:350px !important"><label for="email_pass_less"><?php echo __('Enable PasswordLess Login', 'loginizer'); ?></label></th>
4015	<td>
4016	<input type="checkbox" value="1" name="email_pass_less" id="email_pass_less" <?php echo lz_POSTchecked('email_pass_less', (empty($loginizer['email_pass_less']) ? false : true)); echo (defined('SITEPAD') ? 'disabled="disabled"' : '') ?> />
4017	</td>
4018	</tr>
4019	<tr>
4020	<td colspan="2" valign="top">
4021	<?php echo __('If enabled, the login screen will just ask for the username <b>OR</b> email address of the user. If such a user exists, an email with a <b>One Time Login </b> link will be sent to the email address of the user. The link will be valid for 10 minutes only.', 'loginizer'); ?><br><br>
4022	<?php echo __('If a wrong username/email is given, the brute force checker will prevent any brute force attempt !', 'loginizer'); ?>
4023	</td>
4024	</tr>
4025	<tr>
4026	<td scope="row" valign="top">
4027	<label for="lz_passwordless_sub"><?php echo __('Email Subject', 'loginizer'); ?></label><br>
4028	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
4029	<br />Default : <?php echo @$loginizer['pl_d_sub']; ?>
4030	</td>
4031	<td valign="top">
4032	<input type="text" size="40" value="<?php echo lz_optpost('lz_passwordless_sub', @$lz_options['passwordless_sub']); ?>" name="lz_passwordless_sub" id="lz_passwordless_sub" />
4033	</td>
4034	</tr>
4035	<tr>
4036	<td scope="row" valign="top">
4037	<label for="lz_passwordless_msg"><?php echo __('Email Body', 'loginizer'); ?></label><br>
4038	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
4039	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['pl_d_msg']; ?></pre>
4040	</td>
4041	<td valign="top">
4042	<textarea rows="10" name="lz_passwordless_msg" id="lz_passwordless_msg"><?php echo lz_optpost('lz_passwordless_msg', @$lz_options['passwordless_msg']); ?></textarea>
4043	<br />
4044	Variables :
4045	<br />$email - Users Email
4046	<br />$site_name - The Site Name
4047	<br />$site_url - The Site URL
4048	<br />$login_url - The Login URL
4049	</td>
4050	</tr>
4051	<tr>
4052	<th scope="row" valign="top" style="width:350px !important"><label for="lz_passwordless_html"><?php echo __('Send email as HTML', 'loginizer'); ?></label></th>
4053	<td>
4054	<input type="checkbox" value="1" name="lz_passwordless_html" id="lz_passwordless_html" <?php echo lz_POSTchecked('lz_passwordless_html', (empty($loginizer['passwordless_html']) ? false : true)); ?> />
4055	</td>
4056	</tr>
4057	</table><br />
4058	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4059	</form>
4060
4061	</div>
4062	</div>
4063	<br />
4064
4065	<?php
4066	loginizer_page_footer();
4067
4068	}
4069
4070	// Loginizer - Security Settings Page
4071	function loginizer_page_security(){
4072
4073	global $loginizer, $lz_error, $lz_env, $wpdb;
4074
4075	if(!current_user_can('manage_options')){
4076	wp_die('Sorry, but you do not have permissions to change settings.');
4077	}
4078
4079	if(!loginizer_is_premium() && count($_POST) > 0){
4080	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4081	return loginizer_page_security_T();
4082	}
4083
4084	/* Make sure post was from this page */
4085	if(count($_POST) > 0){
4086	check_admin_referer('loginizer-options');
4087	}
4088
4089	if(isset($_POST['save_lz'])){
4090
4091	$option['login_slug'] = lz_optpost('login_slug');
4092	$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
4093	$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
4094	$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
4095	$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
4096
4097	// Login Slug Valid ?
4098	if(!empty($option['login_slug'])){
4099	if(strlen($option['login_slug']) <= 4 \|\| strlen($option['login_slug']) > 50){
4100	$lz_error['login_slug'] = __('The Login slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4101	}
4102	}
4103
4104	// login slug and admin slug cannot be the same
4105	$_loginizer_wp_admin = get_option('loginizer_wp_admin');
4106	if(!empty($_loginizer_wp_admin['admin_slug']) && $_loginizer_wp_admin['admin_slug'] == $option['login_slug']){
4107	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4108	return loginizer_page_security_T();
4109	}
4110
4111	// XML-RPC Slug Valid ?
4112	if(!empty($option['xmlrpc_slug'])){
4113	if(strlen($option['xmlrpc_slug']) <= 4 \|\| strlen($option['xmlrpc_slug']) > 50){
4114	$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4115	}
4116	}
4117
4118	// Is there an error ?
4119	if(!empty($lz_error)){
4120	return loginizer_page_security_T();
4121	}
4122
4123	// Save the options
4124	update_option('loginizer_security', $option);
4125
4126	// Mark as saved
4127	$GLOBALS['lz_saved'] = true;
4128
4129	}
4130
4131	// Reset the username
4132	if(isset($_POST['save_lz_admin'])){
4133
4134	// Get the new username
4135	$current_username = lz_optpost('current_username');
4136	$new_username = lz_optpost('new_username');
4137
4138	if(empty($current_username)){
4139	$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
4140	return loginizer_page_security_T();
4141	}
4142
4143	if(empty($new_username)){
4144	$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
4145	return loginizer_page_security_T();
4146	}
4147
4148	// Is the starting of the username having 'admin' ?
4149	if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
4150	$lz_error['user_exists'] = __('The username begins with <b>admin</b>. Please change it !', 'loginizer');
4151	return loginizer_page_security_T();
4152	}
4153
4154	// Lets check if there is such a user
4155	$found = get_user_by('login', $new_username);
4156
4157	// Found one !
4158	if(!empty($found->ID)){
4159	$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
4160	return loginizer_page_security_T();
4161	}
4162
4163	$old_user = get_user_by('login', $current_username);
4164
4165	if(empty($old_user->ID)){
4166	$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
4167	return loginizer_page_security_T();
4168	}
4169
4170	if(empty($old_user->caps['administrator'])){
4171	$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
4172	return loginizer_page_security_T();
4173	}
4174
4175	$is_super_admin = 0;
4176	if(is_multisite() && is_super_admin($old_user->ID)){
4177	$is_super_admin = 1;
4178	}
4179
4180	// Update the username
4181	$update_data = array('user_login' => $new_username);
4182	$where_data = array('ID' => $old_user->ID);
4183
4184	$format = array('%s');
4185	$where_format = array('%d');
4186
4187	$wpdb->update($wpdb->prefix.'users', $update_data, $where_data, $format, $where_format);
4188
4189	// Update the super admins list for multisite
4190	if(!empty($is_super_admin)){
4191
4192	$super_admins = get_site_option('site_admins');
4193
4194	foreach($super_admins as $sk => $sv){
4195	// Remove the existing username from super admins list
4196	if($sv == $current_username){
4197	unset($super_admins[$sk]);
4198	}
4199	}
4200
4201	// Add the new username
4202	$super_admins[] = $new_username;
4203
4204	update_site_option( 'site_admins', $super_admins );
4205
4206	}
4207
4208	// Mark as saved
4209	$GLOBALS['lz_saved'] = true;
4210
4211	}
4212
4213	// Change the wp-admin slug
4214	if(isset($_POST['save_lz_wp_admin'])){
4215
4216	// Get the new username
4217	$option['admin_slug'] = lz_optpost('admin_slug');
4218	$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
4219	$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
4220	$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
4221
4222	// login slug and admin slug cannot be the same
4223	$_loginizer_security = get_option('loginizer_security');
4224	if(!empty($_loginizer_security['login_slug']) && $_loginizer_security['login_slug'] == $option['admin_slug']){
4225	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4226	return loginizer_page_security_T();
4227	}
4228
4229	// Did you agree to this ?
4230	if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
4231	$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
4232	return loginizer_page_security_T();
4233	}
4234
4235	// Length
4236	if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 \|\| strlen($option['admin_slug']) > 50)){
4237	$lz_error['admin_slug'] = __('The new Admin slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4238	return loginizer_page_security_T();
4239	}
4240
4241	// Only regular characters
4242	if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
4243	$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
4244	return loginizer_page_security_T();
4245	}
4246
4247	// Update the option
4248	update_option('loginizer_wp_admin', $option);
4249
4250	// Mark as saved
4251	$GLOBALS['lz_saved'] = true;
4252
4253	}
4254
4255
4256	// Save blacklisted usernames
4257	if(isset($_POST['save_lz_bl_users'])){
4258
4259	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
4260
4261	// Process the usernames i.e. remove blanks
4262	foreach($usernames as $k => $v){
4263	$v = trim($v);
4264
4265	// Unset blank values
4266	if(empty($v)){
4267	unset($usernames[$k]);
4268	}
4269
4270	// Disallow these special characters to avoid XSS or any other security vulnerability
4271	if(preg_match('/[\<\>\"\']/', $v)){
4272	unset($usernames[$k]);
4273	}
4274	}
4275
4276	// Update the blacklist
4277	update_option('loginizer_username_blacklist', array_values($usernames));
4278
4279	// Mark as saved
4280	$GLOBALS['lz_saved'] = true;
4281
4282	}
4283
4284
4285	// Save blacklisted domains
4286	if(isset($_POST['save_lz_bl_domains'])){
4287
4288	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
4289
4290	// Process the domains i.e. remove blanks
4291	foreach($domains as $k => $v){
4292	$v = trim($v);
4293
4294	// Unset blank values
4295	if(empty($v)){
4296	unset($domains[$k]);
4297	}
4298
4299	// Disallow these special characters to avoid XSS or any other security vulnerability
4300	if(preg_match('/[\<\>\"\']/', $v)){
4301	unset($domains[$k]);
4302	}
4303	}
4304
4305	// Update the blacklist
4306	update_option('loginizer_domains_blacklist', array_values($domains));
4307
4308	// Mark as saved
4309	$GLOBALS['lz_saved'] = true;
4310
4311	}
4312
4313	// Call theme
4314	loginizer_page_security_T();
4315
4316	}
4317
4318	// Loginizer - Security Settings Page Theme
4319	function loginizer_page_security_T(){
4320
4321	global $loginizer, $lz_error, $lz_env;
4322
4323	// Universal header
4324	loginizer_page_header('Security Settings');
4325
4326	loginizer_feature_available('Security Settings');
4327
4328	// Saved ?
4329	if(!empty($GLOBALS['lz_saved'])){
4330	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4331	}
4332
4333	// Any errors ?
4334	if(!empty($lz_error)){
4335	lz_report_error($lz_error);echo '<br />';
4336	}
4337
4338	$current_admin = get_user_by('id', 1);
4339
4340	?>
4341
4342	<style>
4343	input[type="text"], textarea, select {
4344	width: 70%;
4345	}
4346
4347	.form-table label{
4348	font-weight:bold;
4349	}
4350
4351	.exp{
4352	font-size:12px;
4353	}
4354	</style>
4355
4356	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4357
4358	<div id="" class="postbox">
4359
4360	<div class="postbox-header">
4361	<h2 class="hndle ui-sortable-handle">
4362	<span><?php echo __('Rename Login Page', 'loginizer'); ?></span>
4363	</h2>
4364	</div>
4365
4366	<div class="inside">
4367
4368	<?php wp_nonce_field('loginizer-options'); ?>
4369	<table class="form-table">
4370	<tr>
4371	<td scope="row" valign="top" colspan="2">
4372	<i>You can rename your Login page from <b><?php echo $loginizer['login_basename']; ?></b> to anything of your choice e.g. mylogin. This would make it very difficult for automated attack bots to know where to login !</i>
4373	</td>
4374	</tr>
4375	<tr>
4376	<td scope="row" valign="top" style="width:40% !important">
4377	<label><?php echo __('New Login Slug', 'loginizer'); ?></label><br>
4378	<span class="exp"><?php echo __('Set blank to reset to the original login URL', 'loginizer'); ?></span>
4379	</td>
4380	<td>
4381	<input type="text" size="50" value="<?php echo lz_POSTval('login_slug', $loginizer['login_slug']); ?>" name="login_slug" />
4382	</td>
4383	</tr>
4384
4385	<?php
4386
4387	if(!defined('SITEPAD')){
4388
4389	?>
4390	<tr>
4391	<td scope="row" valign="top" style="width:200px !important">
4392	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
4393	<span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
4394	</td>
4395	<td>
4396	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
4397	</td>
4398	</tr>
4399
4400	<?php
4401
4402	}
4403
4404	?>
4405	</table><br />
4406	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4407
4408	</div>
4409	</div>
4410	<br />
4411
4412	<?php
4413
4414	if(!defined('SITEPAD')){
4415
4416	?>
4417
4418	<div id="" class="postbox">
4419
4420	<div class="postbox-header">
4421	<h2 class="hndle ui-sortable-handle">
4422	<span><?php echo __('XML-RPC Settings', 'loginizer'); ?></span>
4423	</h2>
4424	</div>
4425
4426	<div class="inside">
4427
4428	<?php wp_nonce_field('loginizer-options'); ?>
4429	<table class="form-table">
4430	<tr>
4431	<td scope="row" valign="top" colspan="2">
4432	<i><?php echo __('WordPress\'s XML-RPC feature allows external services to access and modify content on the site. Services like the Jetpack plugin, the WordPress mobile app, pingbacks, etc make use of the XML-RPC feature. If this site does not use a service that requires XML-RPC, please <b>disable</b> the XML-RPC feature as it prevents attackers from using the feature to attack the site. If your service can use a custom XML-RPC URL, you can also <b>rename</b> the XML-RPC page to a <b>custom slug</b>.', 'loginizer'); ?></i>
4433	</td>
4434	</tr>
4435	<tr>
4436	<td scope="row" valign="top" style="width:40% !important">
4437	<label><?php echo __('Disable XML-RPC', 'loginizer'); ?></label>
4438	</td>
4439	<td>
4440	<input type="checkbox" value="1" name="xmlrpc_disable" <?php echo lz_POSTchecked('xmlrpc_disable', (empty($loginizer['xmlrpc_disable']) ? false : true)); ?> />
4441	</td>
4442	</tr>
4443	<tr>
4444	<td scope="row" valign="top" style="width:40% !important">
4445	<label><?php echo __('Disable Pingbacks', 'loginizer'); ?></label>
4446	</td>
4447	<td>
4448	<input type="checkbox" value="1" name="pingbacks_disable" <?php echo lz_POSTchecked('pingbacks_disable', (empty($loginizer['pingbacks_disable']) ? false : true)); ?> />
4449	</td>
4450	</tr>
4451	<tr>
4452	<td scope="row" valign="top">
4453	<label><?php echo __('New XML-RPC Slug', 'loginizer'); ?></label><br>
4454	<span class="exp"><?php echo __('Set blank to reset to the original XML-RPC URL', 'loginizer'); ?></span>
4455	</td>
4456	<td>
4457	<input type="text" size="50" value="<?php echo lz_optpost('xmlrpc_slug', $loginizer['xmlrpc_slug']); ?>" name="xmlrpc_slug" />
4458	</td>
4459	</tr>
4460	</table><br />
4461	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4462
4463	</div>
4464	</div>
4465	<br />
4466
4467	<?php
4468
4469	}
4470
4471	?>
4472
4473	</form>
4474
4475	<?php
4476
4477	if(!defined('SITEPAD')){
4478
4479	?>
4480
4481	<script type="text/javascript">
4482
4483
4484	function dirname(path) {
4485	return path.replace(/\\/g, '/').replace(/\/[^/]*\/?$/, '');
4486	}
4487
4488	function lz_test_wp_admin(){
4489
4490	var data = new Object();
4491	data["action"] = "loginizer_wp_admin";
4492	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax');?>";
4493
4494	var new_ajaxurl = dirname(dirname(ajaxurl))+'/'+jQuery('#lz_admin_slug').val()+'/admin-ajax.php';
4495
4496	// AJAX and on success function
4497	jQuery.post(new_ajaxurl, data, function(response){
4498
4499	if(response['result'] == 1){
4500	alert("<?php echo __('Everything seems to be good. You can proceed to save the settings !', 'loginizer'); ?>");
4501	}
4502
4503	// Throw an error for failures
4504	}).fail(function() {
4505	alert("<?php echo __('There was an error connecting to WordPress with the new Admin Slug. Did you configure everything properly ?', 'loginizer'); ?>");
4506	});
4507	//jQuery.ajax('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4508	return false;
4509	};
4510
4511	</script>
4512
4513	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4514	<div id="" class="postbox">
4515
4516	<div class="postbox-header">
4517	<h2 class="hndle ui-sortable-handle">
4518	<span><?php echo __('Rename wp-admin access', 'loginizer'); ?></span>
4519	</h2>
4520	</div>
4521
4522	<div class="inside">
4523
4524	<?php wp_nonce_field('loginizer-options'); ?>
4525	<table class="form-table">
4526	<?php
4527	if(preg_match('/(apache\|litespeed\|lsws)/is', $_SERVER["SERVER_SOFTWARE"])){
4528	// Supported. Do nothing
4529	}else{
4530	echo '<tr>
4531	<td scope="row" valign="top" colspan="2">
4532	<div style="color:#a94442; background-color:#f2dede; border-color:#ebccd1; padding:15px; border:1px solid transparent; border-radius:4px;">'.__('Rename wp-admin access feature is supported only on Apache and Litespeed', 'loginizer').'</div>
4533	</td>
4534	</tr>';
4535	}
4536	?>
4537	<tr>
4538	<td scope="row" valign="top" colspan="2">
4539	<i>You can rename your WordPress Admin access URL <b>wp-admin</b> to anything of your choice e.g. my-admin. This will require you to change .htaccess, so please follow <a href="<?php echo LOGINIZER_DOCS;?>Renaming_the_WP-Admin_Area" target="_blank">our guide</a> on how to do so !</i>
4540	</td>
4541	</tr>
4542	<tr>
4543	<td scope="row" valign="top" style="width:40% !important">
4544	<label><?php echo __('New wp-admin Slug', 'loginizer'); ?></label><br>
4545	<span class="exp"><?php echo __('Set blank to reset to the original wp-admin URL', 'loginizer'); ?></span>
4546	</td>
4547	<td>
4548	<input type="text" size="50" value="<?php echo lz_optpost('admin_slug', $loginizer['admin_slug']); ?>" name="admin_slug" id="lz_admin_slug" />
4549	</td>
4550	</tr>
4551	<tr>
4552	<td scope="row" valign="top" style="width:200px !important">
4553	<label><?php echo __('Disable wp-admin access', 'loginizer'); ?></label><br>
4554	<span class="exp"><?php echo __('If set, then only the new admin slug will work and access to the Old Admin Slug i.e. wp-admin will be disabled. If anyone accesses wp-admin, a warning will be shown.<br><label>NOTE: Please use this option cautiously !</label>', 'loginizer'); ?></span>
4555	</td>
4556	<td>
4557	<input type="checkbox" id="lz_restrict_wp_admin" onchange="lz_wp_admin_msg_toggle()" value="1" name="restrict_wp_admin" <?php echo lz_POSTchecked('restrict_wp_admin', (empty($loginizer['restrict_wp_admin']) ? false : true)); ?> />
4558	</td>
4559	</tr>
4560	<tr id="lz_wp_admin_msg_row" style="display:none">
4561	<td scope="row" valign="top">
4562	<label><?php echo __('WP-Admin Error Message', 'loginizer'); ?></label><br>
4563	<span class="exp"><?php echo __('Error message to show if someone accesses wp-admin', 'loginizer'); ?></span> Default : <?php echo $loginizer['wp_admin_d_msg']; ?>
4564	</td>
4565	<td>
4566	<input type="text" size="50" value="<?php echo lz_htmlizer(!empty($_POST['wp_admin_msg']) ? stripslashes($_POST['wp_admin_msg']) : @$loginizer['wp_admin_msg']); ?>" name="wp_admin_msg" id="lz_wp_admin_msg" />
4567	</td>
4568	</tr>
4569	<tr>
4570	<td scope="row" valign="top" style="width:200px !important">
4571	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
4572	<span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
4573	</td>
4574	<td>
4575	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
4576	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
4577	</td>
4578	</tr>
4579	</table><br />
4580	<center><input name="save_lz_wp_admin" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4581
4582	</div>
4583	</div>
4584	<br />
4585	</form>
4586
4587	<script type="text/javascript">
4588
4589	function lz_wp_admin_msg_toggle(){
4590	var ele = jQuery('#lz_restrict_wp_admin')[0];
4591	if(ele.checked){
4592	jQuery('#lz_wp_admin_msg_row').show();
4593	}else{
4594	jQuery('#lz_wp_admin_msg_row').hide();
4595	}
4596	};
4597
4598	lz_wp_admin_msg_toggle();
4599
4600	</script>
4601
4602
4603	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4604	<div id="" class="postbox">
4605
4606	<div class="postbox-header">
4607	<h2 class="hndle ui-sortable-handle">
4608	<span><?php echo __('Change Admin Username', 'loginizer'); ?></span>
4609	</h2>
4610	</div>
4611
4612	<div class="inside">
4613
4614	<?php wp_nonce_field('loginizer-options'); ?>
4615	<table class="form-table">
4616	<tr>
4617	<td scope="row" valign="top" colspan="2">
4618	<i><?php echo __('You can change the Admin Username from here to anything of your choice e.g. iamtheboss. This would make it very difficult for automated attack bots to know what is the admin username !', 'loginizer'); ?></i>
4619	</td>
4620	</tr>
4621	<tr>
4622	<td scope="row" valign="top" style="width:40% !important">
4623	<label for="current_username"><?php echo __('Current Username', 'loginizer'); ?></label><br>
4624	<span class="exp"><?php echo __('The current username you want to change', 'loginizer'); ?></span>
4625	</td>
4626	<td>
4627	<input type="text" size="50" value="<?php echo lz_optpost('current_username', (!empty($current_admin->user_login) ? $current_admin->user_login : '')); ?>" name="current_username" id="current_username" />
4628	</td>
4629	</tr>
4630	<tr>
4631	<td scope="row" valign="top" style="width:40% !important">
4632	<label for="new_username"><?php echo __('New Username', 'loginizer'); ?></label><br>
4633	<span class="exp"><?php echo __('The new username you want to set', 'loginizer'); ?></span>
4634	</td>
4635	<td>
4636	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
4637	</td>
4638	</tr>
4639	</table><br />
4640	<i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
4641	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
4642
4643	</div>
4644	</div>
4645	</form>
4646
4647	<script type="text/javascript">
4648	function add_lz_bl_users(){
4649	jQuery("#lz_bl_users").append('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4650	return false;
4651	};
4652	</script>
4653
4654	<style>
4655	.lz_bl_users, .lz_bl_domains{
4656	margin-bottom:20px;
4657	}
4658	</style>
4659
4660	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4661	<div id="" class="postbox">
4662
4663	<div class="postbox-header">
4664	<h2 class="hndle ui-sortable-handle">
4665	<span><?php echo __('Username Auto Blacklist', 'loginizer'); ?></span>
4666	</h2>
4667	</div>
4668
4669	<div class="inside">
4670
4671	<?php wp_nonce_field('loginizer-options'); ?>
4672	<table class="form-table">
4673	<tr>
4674	<td scope="row" valign="top" colspan="2">
4675	<i><?php echo __('Attackers generally use common usernames like <b>admin, administrator, or variations of your domain name / business name</b>. You can specify such username here and Loginizer will auto-blacklist the IP Address(s) of clients who try to use such username(s).', 'loginizer'); ?></i>
4676	</td>
4677	</tr>
4678	<tr>
4679	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
4680	<label><?php echo __('Username(s)', 'loginizer'); ?></label><br>
4681	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
4682	</td>
4683	<td>
4684	<div id="lz_bl_users">
4685	<?php
4686
4687	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : $loginizer['username_blacklist'];
4688
4689	if(empty($usernames)){
4690	$usernames[] = '';
4691	}
4692
4693	foreach($usernames as $_user){
4694
4695	// Disallow these special characters to avoid XSS or any other security vulnerability
4696	if(preg_match('/[\<\>\"\']/', $_user)){
4697	continue;
4698	}
4699
4700	echo '<input type="text" size="30" value="'.$_user.'" name="lz_bl_users[]" class="lz_bl_users" />';
4701	}
4702
4703	?>
4704	</div>
4705	<br />
4706	<input class="button" type="button" value="<?php echo __('Add New Username', 'loginizer'); ?>" onclick="return add_lz_bl_users();" style="float:right" />
4707	</td>
4708	</tr>
4709	</table><br />
4710	<center><input name="save_lz_bl_users" class="button button-primary action" value="<?php echo __('Save Username(s)', 'loginizer'); ?>" type="submit" /></center>
4711
4712	</div>
4713	</div>
4714	</form>
4715
4716	<script type="text/javascript">
4717	function add_lz_bl_domains(){
4718	jQuery("#lz_bl_domains").append('<input type="text" size="30" value="" name="lz_bl_domains[]" class="lz_bl_domains" />');
4719	return false;
4720	};
4721	</script>
4722
4723
4724	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4725	<div id="" class="postbox">
4726
4727	<div class="postbox-header">
4728	<h2 class="hndle ui-sortable-handle">
4729	<span><?php echo __('New Registration Domain Blacklist', 'loginizer'); ?></span>
4730	</h2>
4731	</div>
4732
4733	<div class="inside">
4734
4735	<?php wp_nonce_field('loginizer-options'); ?>
4736	<table class="form-table">
4737	<tr>
4738	<td scope="row" valign="top" colspan="2">
4739	<i>If you would like to ban new registrations from a particular domain, you can use this utility to do so.</i>
4740	</td>
4741	</tr>
4742	<tr>
4743	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
4744	<label><?php echo __('Domain(s)', 'loginizer'); ?></label><br>
4745	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
4746	</td>
4747	<td>
4748	<div id="lz_bl_domains">
4749	<?php
4750
4751	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : $loginizer['domains_blacklist'];
4752
4753	if(empty($domains)){
4754	$domains[] = '';
4755	}
4756
4757	foreach($domains as $_domain){
4758
4759	// Disallow these special characters to avoid XSS or any other security vulnerability
4760	if(preg_match('/[\<\>\"\']/', $_domain)){
4761	continue;
4762	}
4763
4764	echo '<input type="text" size="30" value="'.$_domain.'" name="lz_bl_domains[]" class="lz_bl_domains" />';
4765	}
4766
4767	?>
4768	</div>
4769	<br />
4770	<input class="button" type="button" value="<?php echo __('Add New Domain', 'loginizer'); ?>" onclick="return add_lz_bl_domains();" style="float:right" />
4771	</td>
4772	</tr>
4773	</table><br />
4774	<center><input name="save_lz_bl_domains" class="button button-primary action" value="<?php echo __('Save Domains(s)', 'loginizer'); ?>" type="submit" /></center>
4775
4776	</div>
4777	</div>
4778	</form>
4779
4780	<?php
4781
4782	}
4783
4784	loginizer_page_footer();
4785
4786	}
4787
4788	// Loginizer - Checksum load data
4789	function loginizer_page_checksums_L(&$files, &$_ignores){
4790
4791	global $loginizer, $lz_error, $lz_env;
4792
4793	// Load any mismatched files and ignores
4794	$files = get_option('loginizer_checksums_diff');
4795	$_ignores = get_option('loginizer_checksums_ignore');
4796	$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
4797	$ignores = array();
4798
4799	foreach($_ignores as $ik => $iv){
4800	$ignores[$iv] = array();
4801	if(!empty($files[$iv])){
4802	$ignores[$iv] = $files[$iv];
4803	}
4804	}
4805
4806	$lz_env['files'] = $files;
4807	$lz_env['ignores'] = $ignores;
4808
4809	}
4810
4811	// Loginizer - PasswordLess Page
4812	function loginizer_page_checksums(){
4813
4814	global $loginizer, $lz_error, $lz_env;
4815
4816	if(!current_user_can('manage_options')){
4817	wp_die('Sorry, but you do not have permissions to change settings.');
4818	}
4819
4820	if(!loginizer_is_premium() && count($_POST) > 0){
4821	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4822	return loginizer_page_checksums_T();
4823	}
4824
4825	/* Make sure post was from this page */
4826	if(count($_POST) > 0){
4827	check_admin_referer('loginizer-options');
4828	}
4829
4830	// Are we to run it ?
4831	if(isset($_REQUEST['lz_run_checksum'])){
4832	loginizer_checksums();
4833	}
4834
4835	loginizer_page_checksums_L($files, $_ignores);
4836
4837	$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
4838	$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
4839	$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
4840
4841	if(isset($_POST['save_lz'])){
4842
4843	// In the future there can be more settings
4844	$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
4845	$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
4846	$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
4847	$option['checksum_time'] = lz_optpost('checksum_time');
4848
4849	// Is there an error ?
4850	if(!empty($lz_error)){
4851	return loginizer_page_checksums_T();
4852	}
4853
4854	// Save the options
4855	update_option('loginizer_checksums', $option);
4856
4857	// Mark as saved
4858	$GLOBALS['lz_saved'] = true;
4859
4860	}
4861
4862	// Add or remove from ignore list
4863	if(isset($_POST['save_lz_csum_ig'])){
4864
4865	if(@is_array($_POST['checksum_del_ignore'])){
4866
4867	foreach($_POST['checksum_del_ignore'] as $k => $v){
4868	$key = array_search($v, $_ignores);
4869	if($key !== false){
4870	unset($_ignores[$key]);
4871	}
4872	}
4873
4874	// Save it
4875	update_option('loginizer_checksums_ignore', $_ignores);
4876
4877	}
4878
4879	if(@is_array($_POST['checksum_add_ignore'])){
4880
4881	foreach($_POST['checksum_add_ignore'] as $k => $v){
4882	if(!empty($files[$v])){
4883	$_ignores[] = $v;
4884	}
4885	}
4886
4887	// Save it
4888	update_option('loginizer_checksums_ignore', $_ignores);
4889
4890	}
4891
4892	// Reload
4893	loginizer_page_checksums_L($files, $_ignores);
4894
4895	// Mark as saved
4896	$GLOBALS['lz_saved'] = true;
4897
4898	}
4899
4900	// Call theme
4901	loginizer_page_checksums_T();
4902	}
4903
4904	// Loginizer - PasswordLess Page Theme
4905	function loginizer_page_checksums_T(){
4906
4907	global $loginizer, $lz_error, $lz_env;
4908
4909	// Universal header
4910	loginizer_page_header('File Checksum Settings');
4911
4912	loginizer_feature_available('File Checksum');
4913
4914	wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
4915	wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
4916
4917	// Saved ?
4918	if(!empty($GLOBALS['lz_saved'])){
4919	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4920	}
4921
4922	// Did we just run the checksums
4923	if(isset($_REQUEST['lz_run_checksum'])){
4924	echo '<div id="message" class="updated"><p>'. __('The Checksum process was executed successfully', 'loginizer'). '</p></div><br />';
4925	}
4926
4927	// Any errors ?
4928	if(!empty($lz_error)){
4929	lz_report_error($lz_error);echo '<br />';
4930	}
4931
4932	?>
4933
4934	<style>
4935	input[type="text"], textarea, select {
4936	width: 70%;
4937	}
4938
4939	.form-table label{
4940	font-weight:bold;
4941	}
4942
4943	.exp{
4944	font-size:12px;
4945	}
4946	</style>
4947
4948	<script>
4949	function lz_apply_status(ele, the_class){
4950
4951	var status = ele.checked;
4952	jQuery(the_class).each(function(){
4953	this.checked = status;
4954	});
4955
4956	}
4957	</script>
4958
4959	<div id="" class="postbox">
4960	<div class="postbox-header">
4961	<h2 class="hndle ui-sortable-handle">
4962	<span><?php echo __('Checksum Settings', 'loginizer'); ?></span>
4963	</h2>
4964	</div>
4965	<div class="inside">
4966
4967	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4968	<?php wp_nonce_field('loginizer-options'); ?>
4969	<table class="form-table">
4970	<tr>
4971	<td scope="row" valign="top" style="width:400px !important">
4972	<label><?php echo __('Disable Checksum of WP Core', 'loginizer'); ?></label><br>
4973	<span class="exp"><?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?></span>
4974	</td>
4975	<td valign="top">
4976	<input type="checkbox" value="1" name="disable_checksum" <?php echo lz_POSTchecked('disable_checksum', (empty($loginizer['disable_checksum']) ? false : true)); ?> />
4977	</td>
4978	</tr>
4979	<tr>
4980	<td scope="row" valign="top" style="width:400px !important">
4981	<label><?php echo __('Disable Email of Checksum Results', 'loginizer'); ?></label><br>
4982	<span class="exp"><?php echo __('If checked, Loginizer will not email you the checksum results.', 'loginizer'); ?></span>
4983	</td>
4984	<td valign="top">
4985	<input type="checkbox" value="1" name="no_checksum_email" <?php echo lz_POSTchecked('no_checksum_email', (empty($loginizer['no_checksum_email']) ? false : true)); ?> />
4986	</td>
4987	</tr>
4988	<tr>
4989	<td scope="row" valign="top" style="width:400px !important">
4990	<label><?php echo __('Checksum Frequency', 'loginizer'); ?></label><br>
4991	<span class="exp"><?php echo __('If Checksum is enabled, at what frequency should the checksums be performed.', 'loginizer'); ?></span>
4992	</td>
4993	<td valign="top">
4994	<select name="checksum_frequency">
4995	<?php
4996	foreach($lz_env['csum_freq'] as $k => $v){
4997	echo '<option '.lz_POSTselect('checksum_frequency', $k, ($loginizer['checksum_frequency'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
4998	}
4999	?>
5000	</select>
5001	</td>
5002	</tr>
5003	<tr id="lz_checksum_time">
5004	<td scope="row" valign="top" style="width:400px !important">
5005	<label><?php echo __('Time of Day', 'loginizer'); ?></label><br>
5006	<span class="exp"><?php echo __('If Checksum is enabled, what time of day should Loginizer do the check. Note : The check will be done on or after this time has elapsed as per the accesses being made.', 'loginizer'); ?></span>
5007	</td>
5008	<td valign="top">
5009	<div class="input-group clockpicker" data-autoclose="true">
5010	<input type="text" name="checksum_time" class="form-control" value="<?php echo (empty($loginizer['checksum_time']) ? '00:00' : $loginizer['checksum_time']);?>">
5011	<span class="input-group-addon">
5012	<span class="glyphicon glyphicon-time"></span>
5013	</span>
5014	</div>
5015	<script type="text/javascript">
5016	jQuery(document).ready(function(){
5017	(function($) {
5018	$('.clockpicker').clockpicker({donetext: 'Done'});
5019	})(jQuery);
5020	});
5021	</script>
5022	</td>
5023	</tr>
5024	<tr>
5025	<td colspan="2">
5026	<?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?>
5027	</td>
5028	</tr>
5029	</table><br />
5030	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /><input name="lz_run_checksum" style="float:right; background: #5cb85c; color:white; border:#5cb85c" class="button button-secondary" value="<?php echo __('Do a Checksum Now', 'loginizer'); ?>" type="submit" /></center>
5031	</form>
5032
5033	</div>
5034	</div>
5035
5036	<div id="" class="postbox">
5037
5038	<div class="postbox-header">
5039	<h2 class="hndle ui-sortable-handle">
5040	<span><?php echo __('Mismatching Files', 'loginizer'); ?></span>
5041	</h2>
5042	</div>
5043
5044	<div class="inside">
5045
5046	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5047	<?php wp_nonce_field('loginizer-options'); ?>
5048	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5049	<?php
5050
5051	$files = $lz_env['files'];
5052
5053	// Avoid undefined notice for $files
5054	if(!empty($files)){
5055	foreach($files as $k => $v){
5056	if(!empty($lz_env['ignores'][$k])){
5057	unset($files[$k]);
5058	}
5059	}
5060	}
5061
5062	echo '
5063	<tr>
5064	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5065	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5066	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5067	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_add_ig\');" /></th>
5068	</tr>';
5069
5070	if(is_array($files) && count($files) > 0){
5071
5072	foreach($files as $k => $v){
5073
5074	echo '
5075	<tr>
5076	<td>'.$k.'</td>
5077	<td>'.$v['cur_md5'].'</td>
5078	<td>'.$v['md5'].'</td>
5079	<td><input type="checkbox" name="checksum_add_ignore[]" class="csum_add_ig" value="'.$k.'" /></td>
5080	</tr>';
5081
5082	}
5083
5084	}else{
5085
5086	echo '
5087	<tr>
5088	<td colspan="4" align="center">'.__('This is great ! No file with any wrong checksum has been found.').'</td>
5089	</tr>';
5090
5091	}
5092
5093	?>
5094	</table><br />
5095	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Add Selected to Ignore List', 'loginizer'); ?>" type="submit" /></center>
5096	</form>
5097	</div>
5098
5099	</div>
5100	<br />
5101
5102	<div id="" class="postbox">
5103
5104	<div class="postbox-header">
5105	<h2 class="hndle ui-sortable-handle">
5106	<span><?php echo __('Ignore List', 'loginizer'); ?></span>
5107	</h2>
5108	</div>
5109
5110	<div class="inside">
5111
5112	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5113	<?php wp_nonce_field('loginizer-options'); ?>
5114	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5115	<?php
5116
5117	$ignores = $lz_env['ignores'];
5118
5119	echo '
5120	<tr>
5121	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5122	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5123	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5124	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_del_ig\');" /></th>
5125	</tr>';
5126
5127	// Load any mismatched files
5128	$files = $ignores;
5129
5130	if(is_array($files) && count($files) > 0){
5131
5132	foreach($files as $k => $v){
5133
5134	echo '
5135	<tr>
5136	<td>'.$k.'</td>
5137	<td>'.$v['cur_md5'].'</td>
5138	<td>'.$v['md5'].'</td>
5139	<td><input type="checkbox" name="checksum_del_ignore[]" class="csum_del_ig" value="'.$k.'" /></td>
5140	</tr>';
5141
5142	}
5143
5144	}else{
5145
5146	echo '
5147	<tr>
5148	<td colspan="4" align="center">'.__('No files have been added to the ignore list').'</td>
5149	</tr>';
5150
5151	}
5152
5153	?>
5154	</table><br />
5155	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Remove Selected from Ignore List', 'loginizer'); ?>" type="submit" /></center>
5156	</form>
5157	</div>
5158
5159	</div>
5160	<br />
5161
5162	<?php
5163	loginizer_page_footer();
5164
5165	}
5166
5167	function loginizer_dismiss_newsletter(){
5168
5169	// Some AJAX security
5170	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5171
5172	if(!current_user_can('manage_options')){
5173	wp_die('Sorry, but you do not have permissions to change settings.');
5174	}
5175
5176	update_option('loginizer_dismiss_newsletter', time());
5177	echo 1;
5178	wp_die();
5179	}
5180
5181	add_action('wp_ajax_loginizer_dismiss_newsletter', 'loginizer_dismiss_newsletter');
5182
5183	function loginizer_newsletter_subscribe(){
5184
5185	$newsletter_dismiss = get_option('loginizer_dismiss_newsletter');
5186
5187	if(!empty($newsletter_dismiss)){
5188	return;
5189	}
5190
5191	$env['url'] = 'https://loginizer.com/';
5192
5193	echo '
5194	<style>
5195	.newsletter_container{
5196	color: #000000;
5197	background: #FFFFFF;
5198	text-align:center;
5199	}
5200	.subscribe_form_row{
5201	color: #000000;
5202	padding-bottom:0px !important;
5203	}
5204	.subscribe_heading{
5205	font-size:22px;
5206	}
5207	</style>
5208
5209	<div class="notice my-loginizer-dismiss-notice is-dismissible" style="background:#FFF;padding:15px; border: 1px solid #ccd0d4; width:80%;margin-left:0px;margin:auto;">
5210	<div class="container">
5211	<div class="col-md-6 col-md-offset-3 text-center newsletter_container">
5212	<h2 style="font-weight:100; margin-bottom:20px; margin-top:5px;" class="subscribe_heading">Subscribe to our Newsletter</h2>
5213	<form class="form-inline" action="" method="POST">
5214	<div class="row subscribe_form_row">
5215	<div class="col-md-12">
5216	<input type="email" name="email" size="40" id="subscribe_email" class="" placeholder="email@example.com" value="">
5217	<input type="button" name="subscribe" id="subscribe_button" class="button button-primary" value="Subscribe" onclick="loginizer_email_subscribe();" style="margin-top:0px;">
5218	</div>
5219	<div class="col-md-3">
5220	</div>
5221	</div>
5222	</form>
5223	<p><b>Note :</b> If a Loginizer account does not exist it will be created.</p>
5224	</div>
5225	</div>
5226	</div><br />
5227
5228	<script type="text/javascript">
5229	function loginizer_dismiss_newsletter(){
5230
5231	var data = new Object();
5232	data["action"] = "loginizer_dismiss_newsletter";
5233	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5234
5235	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5236	jQuery.post(admin_url, data, function(response){
5237
5238	});
5239
5240	}
5241
5242	function loginizer_email_subscribe(){
5243	var subs_location = "'.$env['url'].'?email="+encodeURIComponent(jQuery("#subscribe_email").val());
5244	window.open(subs_location, "_blank");
5245	}
5246	jQuery(document).on("click", ".my-loginizer-dismiss-notice .notice-dismiss", loginizer_dismiss_newsletter);
5247	</script>';
5248
5249	return true;
5250	}
5251
5252
5253	// Sorry to see you going
5254	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
5255
5256	function loginizer_deactivation(){
5257
5258	global $wpdb;
5259
5260	$sql = array();
5261	$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
5262
5263	foreach($sql as $sk => $sv){
5264	$wpdb->query($sv);
5265	}
5266
5267	delete_option('loginizer_version');
5268	delete_option('loginizer_options');
5269	delete_option('loginizer_last_reset');
5270	delete_option('loginizer_whitelist');
5271	delete_option('loginizer_blacklist');
5272	delete_option('loginizer_msg');
5273	delete_option('loginizer_2fa_msg');
5274	delete_option('loginizer_2fa_email_template');
5275	delete_option('loginizer_security');
5276	delete_option('loginizer_wp_admin');
5277
5278	}
5279
5280