loginizer / init.php

init.php in Loginizer 1.7.7, at init.php

5,841 lines 197.0 KB

Raw Download Zip

1	<?php
2
3	if(!function_exists('add_action')){
4	echo 'You are not allowed to access this page directly.';
5	exit;
6	}
7
8	define('LOGINIZER_VERSION', '1.7.7');
9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14
15	include_once(LOGINIZER_DIR.'/functions.php');
16
17	// Ok so we are now ready to go
18	register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
19
20	// Is called when the ADMIN enables the plugin
21	function loginizer_activation(){
22
23	global $wpdb;
24
25	$sql = array();
26
27	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28
29	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	`username` varchar(255) NOT NULL DEFAULT '',
31	`time` int(10) NOT NULL DEFAULT '0',
32	`count` int(10) NOT NULL DEFAULT '0',
33	`lockout` int(10) NOT NULL DEFAULT '0',
34	`ip` varchar(255) NOT NULL DEFAULT '',
35	`url` varchar(255) NOT NULL DEFAULT '',
36	UNIQUE KEY `ip` (`ip`)
37	) DEFAULT CHARSET=utf8;";
38
39	foreach($sql as $sk => $sv){
40	$wpdb->query($sv);
41	}
42
43	add_option('loginizer_version', LOGINIZER_VERSION);
44	add_option('loginizer_options', array());
45	add_option('loginizer_last_reset', 0);
46	add_option('loginizer_whitelist', array());
47	add_option('loginizer_blacklist', array());
48	add_option('loginizer_2fa_whitelist', array());
49
50	}
51
52	/**
53	* Updates the database structure for Loginizer
54	*
55	* If the plugin files are updated but database structure is not updated
56	* this function will update the database structure as per the plugin version
57	* NOTE: This does not update plugin files it just updates the database structure
58	*/
59	function loginizer_update_check(){
60
61	global $wpdb;
62
63	$sql = array();
64	$current_version = get_option('loginizer_version');
65
66	// It must be the 1.0 pre stuff
67	if(empty($current_version)){
68	$current_version = get_option('lz_version');
69	}
70
71	$version = (int) str_replace('.', '', $current_version);
72
73	// No update required
74	if($current_version == LOGINIZER_VERSION){
75	return true;
76	}
77
78	// Is it first run ?
79	if(empty($current_version)){
80
81	// Reinstall
82	loginizer_activation();
83
84	// Trick the following if conditions to not run
85	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
86
87	}
88
89	// Is it less than 1.0.1 ?
90	if($version < 101){
91
92	// TODO : GET the existing settings
93
94	// Get the existing settings
95	$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
96	$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
97	$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
98
99	// Delete the three tables
100	$sql = array();
101	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
102	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
103	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
104
105	foreach($sql as $sk => $sv){
106	$wpdb->query($sv);
107	}
108
109	// Delete option
110	delete_option('lz_version');
111
112	// Reinstall
113	loginizer_activation();
114
115	// TODO : Save the existing settings
116
117	// Update the existing failed logs to new table
118	if(is_array($lz_failed_logs)){
119	foreach($lz_failed_logs as $fk => $fv){
120	$insert_data = array('username' => $fv['username'],
121	'time' => $fv['time'],
122	'count' => $fv['count'],
123	'lockout' => $fv['lockout'],
124	'ip' => $fv['ip']);
125
126	$format = array('%s','%d','%d','%d','%s');
127
128	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
129	}
130	}
131
132	// Update the existing options to new structure
133	if(is_array($lz_options)){
134	foreach($lz_options as $ok => $ov){
135
136	if($ov['option_name'] == 'lz_last_reset'){
137	update_option('loginizer_last_reset', $ov['option_value']);
138	continue;
139	}
140
141	$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
142	}
143	// Save the options
144	update_option('loginizer_options', $old_option);
145	}
146
147	// Update the existing iprange to new structure
148	if(is_array($lz_iprange)){
149
150	$old_blacklist = array();
151	$old_whitelist = array();
152	$bid = 1;
153	$wid = 1;
154	foreach($lz_iprange as $ik => $iv){
155
156	if(!empty($iv['blacklist'])){
157	$old_blacklist[$bid] = array();
158	$old_blacklist[$bid]['start'] = long2ip($iv['start']);
159	$old_blacklist[$bid]['end'] = long2ip($iv['end']);
160	$old_blacklist[$bid]['time'] = strtotime($iv['date']);
161	$bid = $bid + 1;
162	}
163
164	if(!empty($iv['whitelist'])){
165	$old_whitelist[$wid] = array();
166	$old_whitelist[$wid]['start'] = long2ip($iv['start']);
167	$old_whitelist[$wid]['end'] = long2ip($iv['end']);
168	$old_whitelist[$wid]['time'] = strtotime($iv['date']);
169	$wid = $wid + 1;
170	}
171	}
172
173	if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
174	if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
175	}
176
177	}
178
179	// Is it less than 1.3.9 ?
180	if($version < 139){
181
182	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
183
184	}
185
186	// Save the new Version
187	update_option('loginizer_version', LOGINIZER_VERSION);
188
189	// In Sitepad Math Captcha is enabled by default
190	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
191	$option['captcha_no_google'] = 1;
192	add_option('loginizer_captcha', $option);
193	}
194
195	}
196
197	// Add the action to load the plugin
198	add_action('plugins_loaded', 'loginizer_load_plugin');
199
200	// The function that will be called when the plugin is loaded
201	function loginizer_load_plugin(){
202
203	global $loginizer;
204
205	// Check if the installed version is outdated
206	loginizer_update_check();
207
208	// Set the array
209	$loginizer = array();
210
211	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
212	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
213	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
214	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
215
216	// The IP Method to use
217	$loginizer['ip_method'] = get_option('loginizer_ip_method');
218	if($loginizer['ip_method'] == 3){
219	$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
220	}
221
222	// Load settings
223	$options = get_option('loginizer_options');
224	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
225	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
226	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
227	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
228	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
229	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
230	$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
231	$loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
232
233	if(!empty($options['notify_email_address'])){
234	$loginizer['notify_email_address'] = $options['notify_email_address'];
235	$loginizer['custom_notify_email'] = 1;
236	}
237
238	// Default messages
239	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
240	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
241	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
242	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
243	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
244	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
245
246	// Message Strings
247	$loginizer['msg'] = get_option('loginizer_msg', []);
248
249	foreach($loginizer['d_msg'] as $lk => $lv){
250	if(empty($loginizer['msg'][$lk])){
251	$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
252	}
253	}
254
255	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
256	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
257	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
258	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
259	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
260
261	// Message Strings
262	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
263
264	foreach($loginizer['2fa_d_msg'] as $lk => $lv){
265	if(empty($loginizer['2fa_msg'][$lk])){
266	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
267	}
268	}
269
270	// Load the blacklist and whitelist
271	$loginizer['blacklist'] = get_option('loginizer_blacklist');
272	$loginizer['whitelist'] = get_option('loginizer_whitelist');
273	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
274
275	// It should not be false
276	if(empty($loginizer['2fa_whitelist'])){
277	$loginizer['2fa_whitelist'] = array();
278	}
279
280	// When was the database cleared last time
281	$loginizer['last_reset'] = get_option('loginizer_last_reset');
282
283	//print_r($loginizer);
284
285	// Clear retries
286	if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
287	loginizer_reset_retries();
288	}
289
290	$ins_time = get_option('loginizer_ins_time');
291	if(empty($ins_time)){
292	$ins_time = time();
293	update_option('loginizer_ins_time', $ins_time);
294	}
295	$loginizer['ins_time'] = $ins_time;
296
297	// Set the current IP
298	$loginizer['current_ip'] = lz_getip();
299
300	// Is Brute Force Disabled ?
301	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');
302
303	// Filters and actions
304	if(empty($loginizer['disable_brute'])){
305
306	// Use this to verify before WP tries to login
307	// Is always called and is the first function to be called
308	//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
309	add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
310
311	// Is called when a login attempt fails
312	// Hence Update our records that the login failed
313	add_action('wp_login_failed', 'loginizer_login_failed');
314
315	// Is called before displaying the error message so that we dont show that the username is wrong or the password
316	// Update Error message
317	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
318	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
319
320	}
321
322	// ----------------
323	// PRO INIT
324	// ----------------
325
326	// Email to Login
327	$options = get_option('loginizer_epl');
328	$loginizer['pl_d_sub'] = __('Login at $site_name','loginizer');
329	$loginizer['pl_d_msg'] = __('Hi,
330
331	A login request was submitted for your account $email at :
332	$site_name - $site_url
333
334	Login at $site_name by visiting this url :
335	$login_url
336
337	If you have not requested for the Login URL, please ignore this email.
338
339	Regards,
340	$site_name','loginizer');
341	$loginizer['email_pass_less'] = empty($options['email_pass_less']) ? 0 : $options['email_pass_less'];
342	$loginizer['passwordless_sub'] = empty($options['passwordless_sub']) ? $loginizer['pl_d_sub'] : $options['passwordless_sub'];
343	$loginizer['passwordless_msg'] = empty($options['passwordless_msg']) ? $loginizer['pl_d_msg'] : $options['passwordless_msg'];
344	$loginizer['passwordless_msg_is_custom'] = empty($options['passwordless_msg']) ? 0 : 1;
345	$loginizer['passwordless_html'] = empty($options['passwordless_html']) ? 0 : $options['passwordless_html'];
346	$loginizer['passwordless_redirect'] = empty($options['passwordless_redirect']) ? 0 : $options['passwordless_redirect'];
347	$loginizer['passwordless_redirect_for'] = empty($options['passwordless_redirect_for']) ? 0 : $options['passwordless_redirect_for'];
348
349	// 2FA OTP Email to Login
350	$options = get_option('loginizer_2fa_email_template');
351	$loginizer['2fa_email_d_sub'] = 'OTP : Login at $site_name';
352	$loginizer['2fa_email_d_msg'] = 'Hi,
353
354	A login request was submitted for your account $email at :
355	$site_name - $site_url
356
357	Please use the following One Time password (OTP) to login :
358	$otp
359
360	Note : The OTP expires after 10 minutes.
361
362	If you haven\'t requested for the OTP, please ignore this email.
363
364	Regards,
365	$site_name';
366
367	$loginizer['2fa_email_sub'] = empty($options['2fa_email_sub']) ? $loginizer['2fa_email_d_sub'] : $options['2fa_email_sub'];
368	$loginizer['2fa_email_msg'] = empty($options['2fa_email_msg']) ? $loginizer['2fa_email_d_msg'] : $options['2fa_email_msg'];
369
370	// For SitePad its always on
371	if(defined('SITEPAD')){
372	$loginizer['email_pass_less'] = 1;
373	}
374
375	// Captcha
376	$options = get_option('loginizer_captcha');
377	$loginizer['captcha_type'] = empty($options['captcha_type']) ? '' : $options['captcha_type'];
378	$loginizer['captcha_key'] = empty($options['captcha_key']) ? '' : $options['captcha_key'];
379	$loginizer['captcha_secret'] = empty($options['captcha_secret']) ? '' : $options['captcha_secret'];
380	$loginizer['captcha_theme'] = empty($options['captcha_theme']) ? 'light' : $options['captcha_theme'];
381	$loginizer['captcha_size'] = empty($options['captcha_size']) ? 'normal' : $options['captcha_size'];
382	$loginizer['captcha_lang'] = empty($options['captcha_lang']) ? '' : $options['captcha_lang'];
383	$loginizer['captcha_user_hide'] = !isset($options['captcha_user_hide']) ? 0 : $options['captcha_user_hide'];
384	$loginizer['captcha_no_css_login'] = !isset($options['captcha_no_css_login']) ? 0 : $options['captcha_no_css_login'];
385	$loginizer['captcha_no_js'] = 1;
386	$loginizer['captcha_login'] = !isset($options['captcha_login']) ? 1 : $options['captcha_login'];
387	$loginizer['captcha_lostpass'] = !isset($options['captcha_lostpass']) ? 1 : $options['captcha_lostpass'];
388	$loginizer['captcha_resetpass'] = !isset($options['captcha_resetpass']) ? 1 : $options['captcha_resetpass'];
389	$loginizer['captcha_register'] = !isset($options['captcha_register']) ? 1 : $options['captcha_register'];
390	$loginizer['captcha_comment'] = !isset($options['captcha_comment']) ? 1 : $options['captcha_comment'];
391	$loginizer['captcha_wc_checkout'] = !isset($options['captcha_wc_checkout']) ? 1 : $options['captcha_wc_checkout'];
392
393	$loginizer['captcha_no_google'] = !isset($options['captcha_no_google']) ? 0 : $options['captcha_no_google'];
394	$loginizer['captcha_domain'] = empty($options['captcha_domain']) ? 'www.google.com' : $options['captcha_domain'];
395
396	$loginizer['captcha_text'] = empty($options['captcha_text']) ? __('Math Captcha', 'loginizer') : $options['captcha_text'];
397	$loginizer['captcha_time'] = empty($options['captcha_time']) ? 300 : $options['captcha_time'];
398	$loginizer['captcha_words'] = !isset($options['captcha_words']) ? 0 : $options['captcha_words'];
399	$loginizer['captcha_add'] = !isset($options['captcha_add']) ? 1 : $options['captcha_add'];
400	$loginizer['captcha_subtract'] = !isset($options['captcha_subtract']) ? 1 : $options['captcha_subtract'];
401	$loginizer['captcha_multiply'] = !isset($options['captcha_multiply']) ? 0 : $options['captcha_multiply'];
402	$loginizer['captcha_divide'] = !isset($options['captcha_divide']) ? 0 : $options['captcha_divide'];
403
404	// 2fa/question
405	$options = get_option('loginizer_2fa');
406	$loginizer['2fa_app'] = !isset($options['2fa_app']) ? 0 : $options['2fa_app'];
407	$loginizer['2fa_email'] = !isset($options['2fa_email']) ? 0 : $options['2fa_email'];
408	$loginizer['2fa_email_force'] = !isset($options['2fa_email_force']) ? 0 : $options['2fa_email_force'];
409	$loginizer['2fa_sms'] = !isset($options['2fa_sms']) ? 0 : $options['2fa_sms'];
410	$loginizer['question'] = !isset($options['question']) ? 0 : $options['question'];
411	$loginizer['2fa_default'] = empty($options['2fa_default']) ? 'question' : $options['2fa_default'];
412	$loginizer['2fa_roles'] = empty($options['2fa_roles']) ? array() : $options['2fa_roles'];
413
414	// Security Settings
415	$options = get_option('loginizer_security');
416	$loginizer['login_slug'] = empty($options['login_slug']) ? '' : $options['login_slug'];
417	$loginizer['rename_login_secret'] = empty($options['rename_login_secret']) ? '' : $options['rename_login_secret'];
418	$loginizer['xmlrpc_slug'] = empty($options['xmlrpc_slug']) ? '' : $options['xmlrpc_slug'];
419	$loginizer['xmlrpc_disable'] = empty($options['xmlrpc_disable']) ? '' : $options['xmlrpc_disable'];// Disable XML-RPC
420	$loginizer['pingbacks_disable'] = empty($options['pingbacks_disable']) ? '' : $options['pingbacks_disable'];// Disable Pingbacks
421
422	// Admin Slug Settings
423	$options = get_option('loginizer_wp_admin');
424	$loginizer['admin_slug'] = empty($options['admin_slug']) ? '' : $options['admin_slug'];
425	$loginizer['restrict_wp_admin'] = empty($options['restrict_wp_admin']) ? '' : $options['restrict_wp_admin'];
426	$loginizer['wp_admin_msg'] = empty($options['wp_admin_msg']) ? '' : $options['wp_admin_msg'];
427
428	// Checksum Settings
429	$options = get_option('loginizer_checksums');
430	$loginizer['disable_checksum'] = empty($options['disable_checksum']) ? '' : $options['disable_checksum'];
431	$loginizer['checksum_time'] = empty($options['checksum_time']) ? '' : $options['checksum_time'];
432	$loginizer['checksum_frequency'] = empty($options['checksum_frequency']) ? 7 : $options['checksum_frequency'];
433	$loginizer['no_checksum_email'] = empty($options['no_checksum_email']) ? '' : $options['no_checksum_email'];
434	$loginizer['checksums_last_run'] = get_option('loginizer_checksums_last_run');
435
436	// Auto Blacklist Usernames
437	$loginizer['username_blacklist'] = get_option('loginizer_username_blacklist');
438
439	$loginizer['domains_blacklist'] = get_option('loginizer_domains_blacklist');
440
441	$loginizer['wp_admin_d_msg'] = __('LZ : Not allowed via WP-ADMIN. Please access over the new Admin URL', 'loginizer');
442
443	// CSRF Protection
444	$loginizer['enable_csrf_protection'] = get_option('loginizer_csrf_protection');
445	$loginizer['2fa_custom_login_redirect'] = get_option('loginizer_2fa_custom_redirect');
446
447	// ----------------
448	// PRO INIT END
449	// ----------------
450
451	// Is the premium features there ?
452	if(file_exists(LOGINIZER_DIR.'/premium.php')){
453
454	// Include the file
455	include_once(LOGINIZER_DIR.'/premium.php');
456
457	loginizer_security_init();
458
459	// Its the free version
460	}else{
461
462	// The promo time
463	$loginizer['promo_time'] = get_option('loginizer_promo_time');
464	if(empty($loginizer['promo_time'])){
465	$loginizer['promo_time'] = time();
466	update_option('loginizer_promo_time', $loginizer['promo_time']);
467	}
468
469	// Are we to show the loginizer promo
470	if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30243600))){
471
472	add_action('admin_notices', 'loginizer_promo');
473
474	}
475
476	if(!file_exists(LOGINIZER_DIR.'/premium.php') && current_user_can('activate_plugins') && !empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
477
478	add_action('admin_notices', 'loginizer_csrf_promo');
479
480	}
481
482	// Are we to disable the promo
483	if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
484	update_option('loginizer_promo_time', (0 - time()) );
485	die('DONE');
486	}
487
488	$loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
489
490	if(empty($loginizer['backuply_promo'])){
491	$loginizer['backuply_promo'] = abs($loginizer['promo_time']);
492	update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
493	}
494
495	// Setting CSRF Promo time
496	$loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
497
498	if(empty($loginizer['csrf_promo'])){
499	$loginizer['csrf_promo'] = abs($loginizer['promo_time']);
500	update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
501	}
502	}
503
504	}
505
506	// Show the promo
507	function loginizer_promo(){
508
509	echo '
510	<style>
511	.lz_button {
512	background-color: #4CAF50; /* Green */
513	border: none;
514	color: white;
515	padding: 8px 16px;
516	text-align: center;
517	text-decoration: none;
518	display: inline-block;
519	font-size: 16px;
520	margin: 4px 2px;
521	-webkit-transition-duration: 0.4s; /* Safari */
522	transition-duration: 0.4s;
523	cursor: pointer;
524	}
525
526	.lz_button:focus{
527	border: none;
528	color: white;
529	}
530
531	.lz_button1 {
532	color: white;
533	background-color: #4CAF50;
534	border:3px solid #4CAF50;
535	}
536
537	.lz_button1:hover {
538	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
539	color: white;
540	border:3px solid #4CAF50;
541	}
542
543	.lz_button2 {
544	color: white;
545	background-color: #0085ba;
546	}
547
548	.lz_button2:hover {
549	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
550	color: white;
551	}
552
553	.lz_button3 {
554	color: white;
555	background-color: #365899;
556	}
557
558	.lz_button3:hover {
559	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
560	color: white;
561	}
562
563	.lz_button4 {
564	color: white;
565	background-color: rgb(66, 184, 221);
566	}
567
568	.lz_button4:hover {
569	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
570	color: white;
571	}
572
573	.loginizer_promo-close{
574	float:right;
575	text-decoration:none;
576	margin: 5px 10px 0px 0px;
577	}
578
579	.loginizer_promo-close:hover{
580	color: red;
581	}
582	</style>
583
584	<script>
585	jQuery(document).ready( function() {
586	(function($) {
587	$("#loginizer_promo .loginizer_promo-close").click(function(){
588	var data;
589
590	// Hide it
591	$("#loginizer_promo").hide();
592
593	// Save this preference
594	$.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
595	//alert(response);
596	});
597	});
598	})(jQuery);
599	});
600	</script>
601
602	<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
603	<a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
604	<span class="dashicons dashicons-dismiss"></span> Dismiss
605	</a>
606	<img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
607	<p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
608	<p>
609	<a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
610	<a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
611	\'s</a>
612	<a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
613	<a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
614	</p>
615	</div>';
616
617	}
618
619	// Should return NULL if everything is fine
620	function loginizer_wp_authenticate($user, $username, $password){
621
622	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
623
624	if(!empty($username) && !empty($password)){
625	$lz_user_pass = 1;
626	}
627
628	// Are you whitelisted ?
629	if(loginizer_is_whitelisted()){
630	$loginizer['ip_is_whitelisted'] = 1;
631	return $user;
632
633	} else if (!empty($loginizer['trusted_ips'])){
634	$lz_cannot_login = 1;
635
636	// This is used by WP Activity Log
637	apply_filters( 'wp_login_blocked', $username );
638
639	return new WP_Error('ip_blacklisted', __('Your IP is not whitelisted, so you can not log in', 'loginizer'));
640	}
641
642	// Are you blacklisted ?
643	if(loginizer_is_blacklisted()){
644	$lz_cannot_login = 1;
645
646	// This is used by WP Activity Log
647	apply_filters( 'wp_login_blocked', $username );
648
649	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
650	}
651
652	// Is the username blacklisted ?
653	if(function_exists('loginizer_user_blacklisted')){
654	if(loginizer_user_blacklisted($username)){
655	$lz_cannot_login = 1;
656
657	// This is used by WP Activity Log
658	apply_filters( 'wp_login_blocked', $username );
659
660	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
661	}
662	}
663
664	if(loginizer_can_login()){
665	return $user;
666	}
667
668	$lz_cannot_login = 1;
669
670	// This is used by WP Activity Log
671	apply_filters( 'wp_login_blocked', $username );
672
673	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
674
675	}
676
677	function loginizer_can_login(){
678
679	global $wpdb, $loginizer, $lz_error;
680
681	// Get the logs
682	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
683	$result = lz_selectquery($sel_query);
684
685	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
686
687	// Has he reached max lockouts ?
688	if($result['lockout'] >= $loginizer['max_lockouts']){
689	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
690	}
691
692	// Is he in the lockout time ?
693	if($result['time'] >= (time() - $loginizer['lockout_time'])){
694	$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
695
696	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
697	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
698	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
699
700	$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
701
702	if($banlift > 60){
703	$banlift = ceil($banlift / 60);
704	$_time = $banlift.' '.$loginizer['msg']['hours_err'];
705	}
706
707	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
708
709	return false;
710	}
711	}
712
713	return true;
714	}
715
716	function loginizer_is_blacklisted(){
717
718	global $wpdb, $loginizer, $lz_error;
719
720	$blacklist = $loginizer['blacklist'];
721
722	if(empty($blacklist)){
723	return false;
724	}
725
726	foreach($blacklist as $k => $v){
727
728	// Is the IP in the blacklist ?
729	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
730	$result = 1;
731	break;
732	}
733
734	// Is it in a wider range ?
735	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
736
737	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
738	// if the current IP is <= than the start of the range, it is within the range
739	// OR
740	// if the current IP is <= than the end of the range, it is within the range
741	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
742	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
743	$result = 1;
744	break;
745	}
746
747	}
748
749	}
750
751	// You are blacklisted
752	if(!empty($result)){
753	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
754	return true;
755	}
756
757	return false;
758
759	}
760
761	function loginizer_is_whitelisted(){
762
763	global $wpdb, $loginizer, $lz_error;
764
765	$whitelist = $loginizer['whitelist'];
766
767	if(empty($whitelist)){
768	return false;
769	}
770
771	foreach($whitelist as $k => $v){
772
773	// Is the IP in the blacklist ?
774	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
775	$result = 1;
776	break;
777	}
778
779	// Is it in a wider range ?
780	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
781
782	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
783	// if the current IP is <= than the start of the range, it is within the range
784	// OR
785	// if the current IP is <= than the end of the range, it is within the range
786	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
787	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
788	$result = 1;
789	break;
790	}
791
792	}
793
794	}
795
796	// You are whitelisted
797	if(!empty($result)){
798	return true;
799	}
800
801	return false;
802
803	}
804
805
806	// When the login fails, then this is called
807	// We need to update the database
808	function loginizer_login_failed($username, $is_2fa = ''){
809
810	global $wpdb, $loginizer, $lz_cannot_login;
811
812	// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
813	if(empty($username) \|\| is_null($username)){
814	$username = '';
815	}
816
817	$fail_type = 'Login';
818
819	if(!empty($is_2fa)){
820	$fail_type = '2FA';
821	}
822
823	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
824
825	$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
826	$url = esc_url($url);
827
828	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
829	$result = lz_selectquery($sel_query);
830
831	if(!empty($result)){
832	$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
833
834	$update_data = array('username' => $username,
835	'time' => time(),
836	'count' => $result['count']+1,
837	'lockout' => $lockout,
838	'url' => $url);
839
840	$where_data = array('ip' => $loginizer['current_ip']);
841
842	$format = array('%s','%d','%d','%d','%s');
843	$where_format = array('%s');
844
845	$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
846
847	// Do we need to email admin ?
848	if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
849
850	$lockout_time = $loginizer['lockout_time'];
851
852	if($lockout >= $loginizer['max_lockouts']){
853	// extended lockout is in hours so we have to convert to minute
854	$lockout_time = $loginizer['lockouts_extend'];
855	}
856
857	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
858	$mail = array();
859	$mail['to'] = $loginizer['notify_email_address'];
860	$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
861	$mail['message'] = 'Hi,
862
863	'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
864	'.home_url().'
865
866	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
867	Last User Attempt : '.$username.'
868	IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
869
870	Regards,
871	Loginizer';
872
873	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
874	}
875	}else{
876	$result = array();
877	$result['count'] = 0;
878
879	$insert_data = array('username' => $username,
880	'time' => time(),
881	'count' => 1,
882	'ip' => $loginizer['current_ip'],
883	'lockout' => 0,
884	'url' => $url);
885
886	$format = array('%s','%d','%d','%s','%d','%s');
887
888	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
889	}
890
891	// We need to add one as this is a failed attempt as well
892	$result['count'] = $result['count'] + 1;
893	$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
894	$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
895
896	}
897	}
898
899	// Handles the error of the password not being there
900	function loginizer_error_handler($errors, $redirect_to){
901
902	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
903
904	//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
905	if(is_null($errors) \|\| empty($errors)){
906	return true;
907	}
908
909	// Remove the empty password error
910	if(is_wp_error($errors)){
911
912	$codes = $errors->get_error_codes();
913
914	foreach($codes as $k => $v){
915	if($v == 'invalid_username' \|\| $v == 'incorrect_password'){
916	$show_error = 1;
917	}
918	}
919
920	$errors->remove('invalid_username');
921	$errors->remove('incorrect_password');
922
923	// Add the error
924	if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
925	$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
926	}
927
928	// Add the number of retires left as well
929	if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
930	$errors->add('retries_left', loginizer_retries_left());
931	}
932
933	}
934
935	return $errors;
936
937	}
938
939
940
941	// Handles the error of the password not being there
942	function loginizer_woocommerce_error_handler(){
943
944	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
945
946	if(function_exists('wc_add_notice')){
947	wc_add_notice( loginizer_retries_left(), 'error' );
948	}
949
950	}
951
952	// Returns a string with the number of retries left
953	function loginizer_retries_left(){
954
955	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
956
957	// If we are to show the number of retries left
958	if(isset($loginizer['retries_left'])){
959	$retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
960
961	return '<b>'.sanitize_text_field($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
962	}
963
964	}
965
966	function loginizer_reset_retries(){
967
968	global $wpdb, $loginizer;
969
970	$deltime = time() - $loginizer['reset_retries'];
971
972	$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
973	$result = $wpdb->query($del_query);
974
975	update_option('loginizer_last_reset', time());
976
977	}
978
979	add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
980
981	// Add settings link on plugin page
982	function loginizer_plugin_action_links($links) {
983
984	if(!defined('LOGINIZER_PREMIUM')){
985	$links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
986	}
987
988	$settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
989	array_unshift($links, $settings_link);
990
991	return $links;
992	}
993
994	add_action('admin_menu', 'loginizer_admin_menu');
995
996	// Shows the admin menu of Loginizer
997	function loginizer_admin_menu() {
998
999	global $wp_version, $loginizer;
1000
1001	if(!defined('SITEPAD')){
1002
1003	// Add the menu page
1004	add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
1005
1006	// Dashboard
1007	add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
1008
1009	}else{
1010
1011	// Add the menu page
1012	add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
1013
1014	// Rename Login
1015	add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
1016
1017	}
1018
1019	// Brute Force
1020	add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
1021
1022	// PasswordLess
1023	add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
1024
1025	// Security Settings
1026	if(!defined('SITEPAD')){
1027
1028	// Two Factor Auth
1029	add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
1030
1031	}
1032
1033	// reCaptcha
1034	add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
1035
1036	// Security Settings
1037	if(!defined('SITEPAD')){
1038
1039	// Security Settings
1040	add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
1041
1042	// File Checksums
1043	add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
1044
1045	}
1046
1047	if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30243600))){
1048
1049	// Go Pro link
1050	add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
1051
1052	}
1053
1054	}
1055
1056	// The Loginizer Admin Options Page
1057	function loginizer_page_header($title = 'Loginizer'){
1058
1059	global $loginizer;
1060
1061	?>
1062	<style>
1063	.lz-right-ul{
1064	padding-left: 10px !important;
1065	}
1066
1067	.lz-right-ul li{
1068	list-style: circle !important;
1069	}
1070	</style>
1071	<?php
1072
1073	echo '<div style="margin: 10px 20px 0 2px;">
1074	<div class="metabox-holder columns-2">
1075	<div class="postbox-container">
1076	<div id="top-sortables" class="meta-box-sortables ui-sortable">
1077
1078	<table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
1079	<tr>
1080	<td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
1081
1082	if(!defined('SITEPAD')){
1083
1084	echo '<td align="right"><a href="https://www.softaculous.com/clients?ca=affiliate" class="button button-primary" target="_blank">'. __('Refer and Earn', 'loginizer'). '</a> <a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">'.__('Review Loginizer', 'loginizer').'</a></td>
1085	<td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
1086	<td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
1087
1088	}
1089
1090	echo '
1091	</tr>
1092	</table>
1093	<hr />
1094
1095	<!--Main Table-->
1096	<table cellpadding="8" cellspacing="1" width="100%" class="fixed">
1097	<tr>
1098	<td valign="top">';
1099
1100	if(file_exists(LOGINIZER_DIR.'/premium.php') && !empty($loginizer['enable_csrf_protection']) && !loginizer_is_csrf_prot_mod_set()){
1101
1102	$lz_error['csrf_mod'] = esc_html__('You have enabled CSRF protection but the .htaccess file has not been updated', 'loginizer');
1103
1104	if(!empty($lz_error)){
1105	lz_report_error($lz_error);echo '<br />';
1106	}
1107	}
1108
1109	}
1110
1111	// The Loginizer Theme footer
1112	function loginizer_page_footer(){
1113
1114	if(!loginizer_is_premium()){
1115	echo '<script>
1116	jQuery("[loginizer-premium-only]").each(function(index) {
1117	jQuery(this).find( "input, textarea, select" ).attr("disabled", true);
1118	});
1119	</script>';
1120	}
1121
1122	echo '</td>
1123	<td width="200" valign="top" id="loginizer-right-bar">';
1124
1125	if(!defined('SITEPAD')){
1126
1127	if(!defined('LOGINIZER_PREMIUM')){
1128
1129	echo '
1130	<div class="postbox" style="min-width:0px !important;">
1131	<div class="postbox-header">
1132	<h2 class="hndle ui-sortable-handle">
1133	<span>'.__('Premium Version','loginizer').'</span>
1134	</h2>
1135	</div>
1136
1137	<div class="inside">
1138	<i>'.__('Upgrade to the premium version and get the following features','loginizer').' </i>:<br>
1139	<ul class="lz-right-ul">
1140	<li>'.__('PasswordLess Login','loginizer').'</li>
1141	<li>'.__('Two Factor Auth - Email','loginizer').'</li>
1142	<li>'.__('Two Factor Auth - App','loginizer').'</li>
1143	<li>'.__('Login Challenge Question','loginizer').'</li>
1144	<li>'.__('reCAPTCHA','loginizer').'</li>
1145	<li>'.__('Rename Login Page','loginizer').'</li>
1146	<li>'.__('Disable XML-RPC','loginizer').'</li>
1147	<li>'.__('And many more ...','loginizer').'</li>
1148	</ul>
1149	<center><a class="button button-primary" target="_blank" href="'.LOGINIZER_PRICING_URL.'">Upgrade</a></center>
1150	</div>
1151	</div>';
1152
1153	}else{
1154
1155	echo '
1156	<div class="postbox" style="min-width:0px !important;">
1157	<div class="postbox-header">
1158	<h2 class="hndle ui-sortable-handle">
1159	<span>'.__('Recommendations','loginizer').'</span>
1160	</h2>
1161	</div>
1162	<div class="inside">
1163	<i>'.__('We recommed that you enable atleast one of the following security features','loginizer').'</i>:<br>
1164	<ul class="lz-right-ul">
1165	<li>'.__('Rename Login Page','loginizer').'</li>
1166	<li>'.__('Login Challenge Question','loginizer').'</li>
1167	<li>'.__('reCAPTCHA','loginizer').'</li>
1168	<li>'.__('Two Factor Auth - Email','loginizer').'</li>
1169	<li>'.__('Two Factor Auth - App','loginizer').'</li>
1170	<li>'.__('Change \'admin\' Username','loginizer').'</li>
1171	</ul>
1172	</div>
1173	</div>';
1174	}
1175
1176	echo '
1177	<div class="postbox" style="min-width:0px !important;">
1178	<div class="postbox-header">
1179	<h2 class="hndle ui-sortable-handle">
1180	<span><a target="_blank" href="https://backuply.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/backuply-black.png" width="100%" /></a></span>
1181	</h2>
1182	</div>
1183	<div class="inside">
1184	<i>'.__('Secure your WordPress site by creating backups with Backuply', 'loginizer').'</i>:<br>
1185	<ul class="lz-right-ul">
1186	<li>'.__('Remote Backup to 8 location','loginizer').'</li>
1187	<li>'.__('Auto Backups', 'loginizer').'</li>
1188	<li>'.__('Backup Rotation', 'loginizer').'</li>
1189	<li>'.__('One-Click Restore', 'loginizer').'</li>
1190	<li>'.__('Stress-free Migration', 'loginizer').'</li>
1191	<li>'.__('Backup to Google Drive', 'loginizer').'</li>
1192	<li>'.__('Backup to Amazon S3', 'loginizer').'</li>
1193	<li>'.__('Backup to Dropbox', 'loginizer').'</li>
1194	<li>'.__('Backup to FTP,FTPS and many more ...','loginizer').'</li>
1195	</ul>
1196	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/backuply/">'.__('Visit Backuply','loginizer').'</a></center>
1197	</div>
1198	</div>';
1199
1200	echo '
1201	<div class="postbox" style="min-width:0px !important;">
1202	<div class="postbox-header">
1203	<h2 class="hndle ui-sortable-handle">
1204	<span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
1205	</h2>
1206	</div>
1207	<div class="inside">
1208	<i>'.__('Easily manage and make professional pages and content with our Pagelayer builder','loginizer').'</i>:<br>
1209	<ul class="lz-right-ul">
1210	<li>'.__('30+ Free Widgets','loginizer').'</li>
1211	<li>'.__('60+ Premium Widgets','loginizer').'</li>
1212	<li>'.__('400+ Premium Sections','loginizer').'</li>
1213	<li>'.__('Theme Builder','loginizer').'</li>
1214	<li>'.__('WooCommerce Builder','loginizer').'</li>
1215	<li>'.__('Theme Creator and Exporter','loginizer').'</li>
1216	<li>'.__('Form Builder','loginizer').'</li>
1217	<li>'.__('Popup Builder','loginizer').'</li>
1218	<li>'.__('And many more ...','loginizer').'</li>
1219	</ul>
1220	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">'.__('Visit Pagelayer','loginizer').'</a></center>
1221	</div>
1222	</div>';
1223
1224	echo '
1225	<div class="postbox" style="min-width:0px !important;">
1226	<div class="postbox-header">
1227	<h2 class="hndle ui-sortable-handle">
1228	<span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
1229	</h2>
1230	</div>
1231	<div class="inside">
1232	<i>'.__('Manage all your WordPress sites from <b>1 dashboard</b> ','loginizer').'</i>:<br>
1233	<ul class="lz-right-ul">
1234	<li>'.__('1-click Admin Access','loginizer').'</li>
1235	<li>'.__('Update WordPress','loginizer').'</li>
1236	<li>'.__('Update Themes','loginizer').'</li>
1237	<li>'.__('Update Plugins','loginizer').'</li>
1238	<li>'.__('Backup your WordPress Site','loginizer').'</li>
1239	<li>'.__('Plugins & Theme Management','loginizer').'</li>
1240	<li>'.__('Post Management','loginizer').'</li>
1241	<li>'.__('And many more ...','loginizer').'</li>
1242	</ul>
1243	<center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">'.__('Visit wpCentral','loginizer').'</a></center>
1244	</div>
1245	</div>';
1246
1247	}
1248
1249	echo '</td>
1250	</tr>
1251	</table>';
1252
1253	if(!defined('SITEPAD')){
1254
1255	echo '<br />
1256	<div style="width:45%;background:#FFF;padding:15px; margin:auto">
1257	<b>'.__('Let your friends know that you have secured your website :','loginizer').'</b>
1258	<form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
1259	<textarea name="text" cols="45" row="3" style="resize:none;">'.__('I just secured my @WordPress site against #bruteforce using @loginizer','loginizer').'</textarea>
1260	<input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
1261	</form>
1262
1263	</div>
1264	<br />
1265
1266	<script>
1267	function dotweet(ele){
1268	window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
1269	return false;
1270	}
1271	</script>
1272
1273	<hr />
1274	<a href="http://loginizer.com" target="_blank">Loginizer</a> '.__('v'.LOGINIZER_VERSION.'. You can report any bugs ','loginizer').'<a href="http://wordpress.org/support/plugin/loginizer" target="_blank">'.__('here','loginizer').'</a>.';
1275
1276	}
1277
1278	echo '
1279	</div>
1280	</div>
1281	</div>
1282	</div>';
1283
1284	}
1285
1286	// The Loginizer Admin Options Page
1287	function loginizer_page_dashboard(){
1288
1289	global $loginizer, $lz_error, $lz_env;
1290
1291	if(!current_user_can('manage_options')){
1292	wp_die('Sorry, but you do not have permissions to change settings.');
1293	}
1294
1295	// Dismiss the announcement
1296	if(isset($_GET['dismiss_announcement'])){
1297	update_option('loginizer_no_announcement', 1);
1298	}
1299
1300	/* Make sure post was from this page */
1301	if(count($_POST) > 0){
1302	check_admin_referer('loginizer-options');
1303	}
1304
1305	do_action('loginizer_pre_page_dashboard');
1306
1307	// Is there a IP Method ?
1308	if(isset($_POST['save_lz_ip_method'])){
1309
1310	$ip_method = (int) lz_optpost('lz_ip_method');
1311	$custom_ip_method = lz_optpost('lz_custom_ip_method');
1312
1313	if($ip_method >= 0 && $ip_method <= 3){
1314	update_option('loginizer_ip_method', $ip_method);
1315	}
1316
1317	// Custom Method name ?
1318	if($ip_method == 3){
1319	update_option('loginizer_custom_ip_method', $custom_ip_method);
1320	}
1321
1322	}
1323
1324	loginizer_page_dashboard_T();
1325
1326	}
1327
1328	// The Loginizer Admin Options Page - THEME
1329	function loginizer_page_dashboard_T(){
1330
1331	global $loginizer, $lz_error, $lz_env;
1332
1333	loginizer_page_header('Dashboard');
1334	?>
1335	<style>
1336	.lz-welcome-panel{
1337	border: 1px solid #c3c4c7;
1338	box-shadow: 0 1px 1px rgba(0,0,0,.04);
1339	background: #fff;
1340	padding:10px;
1341	}
1342
1343	.lz-welcome-panel-content{
1344	display:inline;
1345	vertical-align:middle;
1346	}
1347
1348	input[type="text"], textarea, select {
1349	width: 70%;
1350	}
1351
1352	.form-table label{
1353	font-weight:bold;
1354	}
1355
1356	.exp{
1357	font-size:12px;
1358	}
1359	</style>
1360
1361	<?php
1362	$lz_ip = lz_getip();
1363
1364	if($lz_ip != '127.0.0.1' && @$_SERVER['SERVER_ADDR'] == $lz_ip){
1365	echo '<div class="update-message notice error inline notice-error notice-alt"><p style="color:red">   Your Server IP Address seems to match the Client IP detected by Loginizer. You might want to change the IP detection method to HTTP_X_FORWARDED_FOR under System Information section.</p></div><br>';
1366	}
1367
1368	loginizer_newsletter_subscribe();
1369
1370	if(!empty($loginizer['backuply_promo']) && $loginizer['backuply_promo'] > 0 && $loginizer['backuply_promo'] < (time() - (7243600))){
1371
1372	loginizer_backuply_promo();
1373
1374	}
1375
1376
1377	echo '
1378	<div class="lz-welcome-panel">
1379	<div class="lz-welcome-panel-content">'. __('Thank you for choosing Loginizer! Many more features coming soon...   Review Loginizer at WordPress    ', 'loginizer').'<a href="https://wordpress.org/support/view/plugin-reviews/loginizer" class="button button-primary" target="_blank">'. __('Add Review', 'loginizer'). '</a></div>
1380	</div><br />';
1381
1382	// Saved ?
1383	if(!empty($GLOBALS['lz_saved'])){
1384	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
1385	}
1386
1387	// Any errors ?
1388	if(!empty($lz_error)){
1389	lz_report_error($lz_error);echo '<br />';
1390	}
1391
1392	?>
1393
1394	<div class="postbox">
1395
1396	<div class="postbox-header">
1397	<h2 class="hndle ui-sortable-handle">
1398	<span><?php echo __('Getting Started', 'loginizer'); ?></span>
1399	</h2>
1400	</div>
1401
1402	<div class="inside">
1403
1404	<form action="" method="post" enctype="multipart/form-data">
1405	<?php wp_nonce_field('loginizer-options'); ?>
1406	<table class="form-table">
1407	<tr>
1408	<td scope="row" valign="top" colspan="2" style="line-height:150%">
1409	<i><?php echo __('Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.', 'loginizer'); ?></i>
1410	<?php
1411	if(defined('LOGINIZER_PREMIUM')){
1412	echo '<br><i>'.__('In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security','loginizer').'</i>';
1413	}else{
1414	echo '<br><i><a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none;color:red;">'.__('Upgrade to Pro</a> for more features like <b>reCAPTCHA, Two Factor Auth, Rename wp-admin and wp-login.php pages, Email based PasswordLess</b> login and more. These features will improve your website\'s security.','loginizer').'</i>';
1415	}
1416	?>
1417	</td>
1418	</tr>
1419	</table>
1420	</form>
1421
1422	</div>
1423	</div>
1424
1425	<div class="postbox">
1426
1427	<div class="postbox-header">
1428	<h2 class="hndle ui-sortable-handle">
1429	<span><?php echo __('System Information', 'loginizer'); ?></span>
1430	</h2>
1431	</div>
1432	<div class="inside">
1433
1434	<form action="" method="post" enctype="multipart/form-data">
1435	<?php wp_nonce_field('loginizer-options'); ?>
1436	<table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1437	<?php
1438	echo '
1439	<tr>
1440	<th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1441	<td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (<font color="green">'.__('Security PRO Version','loginizer').'</font>)' : '').'</td>
1442	</tr>';
1443
1444	do_action('loginizer_system_information');
1445
1446	echo '<tr>
1447	<th align="left">'.__('URL', 'loginizer').'</th>
1448	<td>'.get_site_url().'</td>
1449	</tr>
1450	<tr>
1451	<th align="left">'.__('Path', 'loginizer').'</th>
1452	<td>'.ABSPATH.'</td>
1453	</tr>
1454	<tr>
1455	<th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1456	<td>'.@$_SERVER['SERVER_ADDR'].'</td>
1457	</tr>
1458	<tr>
1459	<th align="left">'.__('Your IP Address', 'loginizer').'</th>
1460	<td>'.lz_getip().'
1461	<div style="float:right">
1462	Method :
1463	<select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1464	<option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1465	<option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1466	<option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1467	<option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1468	</select>
1469	<input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method',(empty($loginizer['custom_ip_method']) ? '' : $loginizer['custom_ip_method'])).'" style="font-size:11px; width:100px; display:none" />
1470	<input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1471	</div>
1472	</td>
1473	</tr>
1474	<tr>
1475	<th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1476	<td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1477	</tr>';
1478
1479	if(file_exists(ABSPATH.'/.htaccess')){
1480	echo '
1481	<tr>
1482	<th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1483	<td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1484	</tr>';
1485
1486	}
1487
1488	?>
1489	</table>
1490	</form>
1491
1492	</div>
1493	</div>
1494
1495	<script type="text/javascript">
1496
1497	function lz_ip_method_handle(){
1498	var ele = jQuery('#lz_ip_method');
1499	if(ele.val() == 3){
1500	jQuery('#lz_custom_ip_method').show();
1501	}else{
1502	jQuery('#lz_custom_ip_method').hide();
1503	}
1504	};
1505
1506	lz_ip_method_handle();
1507
1508	</script>
1509
1510	<div id="" class="postbox">
1511
1512	<div class="postbox-header">
1513	<h2 class="hndle ui-sortable-handle">
1514	<span><?php echo __('File Permissions', 'loginizer'); ?></span>
1515	</h2>
1516	</div>
1517
1518	<div class="inside">
1519
1520	<form action="" method="post" enctype="multipart/form-data">
1521	<?php wp_nonce_field('loginizer-options'); ?>
1522	<table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1523	<?php
1524
1525	echo '
1526	<tr>
1527	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1528	<th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1529	<th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1530	</tr>';
1531
1532	$wp_content = basename(dirname(dirname(dirname(__FILE__))));
1533
1534	$files_to_check = array('/' => array('0755', '0750'),
1535	'/wp-admin' => array('0755'),
1536	'/wp-includes' => array('0755'),
1537	'/wp-config.php' => array('0444'),
1538	'/'.$wp_content => array('0755'),
1539	'/'.$wp_content.'/themes' => array('0755'),
1540	'/'.$wp_content.'/plugins' => array('0755'));
1541
1542	if(file_exists(ABSPATH.'/.htaccess')){
1543	$files_to_check['.htaccess'] = array('0444');
1544	}
1545
1546	$root = ABSPATH;
1547
1548	foreach($files_to_check as $k => $v){
1549
1550	$path = $root.'/'.$k;
1551	$stat = @stat($path);
1552	$suggested = $v;
1553	$actual = substr(sprintf('%o', $stat['mode']), -4);
1554
1555	echo '
1556	<tr>
1557	<td>'.$k.'</td>
1558	<td>'.current($suggested).'</td>
1559	<td><span '.(!in_array($actual, $suggested) ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1560	</tr>';
1561
1562	}
1563
1564	?>
1565	</table>
1566	</form>
1567
1568	</div>
1569	</div>
1570
1571	<?php
1572
1573	loginizer_page_footer();
1574
1575	}
1576
1577	// The Loginizer Admin Options Page
1578	function loginizer_page_brute_force(){
1579
1580	global $wpdb, $wp_roles, $loginizer;
1581
1582	if(!current_user_can('manage_options')){
1583	wp_die('Sorry, but you do not have permissions to change settings.');
1584	}
1585
1586	/* Make sure post was from this page */
1587	if(count($_POST) > 0){
1588	check_admin_referer('loginizer-options');
1589	}
1590
1591	// BEGIN THEME
1592	loginizer_page_header('Brute Force Settings');
1593
1594	// Load the blacklist and whitelist
1595	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1596	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1597
1598	// Disable Brute Force
1599	if(isset($_POST['disable_brute_lz'])){
1600
1601	// Save the options
1602	update_option('loginizer_disable_brute', 1);
1603
1604	$loginizer['disable_brute'] = 1;
1605
1606	echo '<div id="message" class="updated"><p>'
1607	. __('The Brute Force Protection feature is now disabled', 'loginizer')
1608	. '</p></div><br />';
1609
1610	}
1611
1612	// Enable brute force
1613	if(isset($_POST['enable_brute_lz'])){
1614
1615	// Save the options
1616	update_option('loginizer_disable_brute', 0);
1617
1618	$loginizer['disable_brute'] = 0;
1619
1620	echo '<div id="message" class="updated"><p>'
1621	. __('The Brute Force Protection feature is now enabled', 'loginizer')
1622	. '</p></div><br />';
1623
1624	}
1625
1626	// The Brute Force Settings
1627	if(isset($_POST['save_lz'])){
1628
1629	$max_retries = (int) lz_optpost('max_retries');
1630	$lockout_time = (int) lz_optpost('lockout_time');
1631	$max_lockouts = (int) lz_optpost('max_lockouts');
1632	$lockouts_extend = (int) lz_optpost('lockouts_extend');
1633	$reset_retries = (int) lz_optpost('reset_retries');
1634	$notify_email = (int) lz_optpost('notify_email');
1635	$notify_email_address = lz_optpost('notify_email_address');
1636	$trusted_ips = lz_optpost('trusted_ips');
1637
1638	if(!empty($notify_email_address) && !lz_valid_email($notify_email_address)){
1639	$error[] = __('Email address is invalid', 'loginizer');
1640	}
1641
1642	if(empty(loginizer_is_whitelisted()) && isset($_POST['trusted_ips'])){
1643	$error[] = __('Add your IP to whitelist to enable Trusted IP\'s', 'loginizer');
1644	}
1645
1646	if(!empty($max_retries) && $max_retries < 0){
1647	$error[] = __('Max Retries value is invalid', 'loginizer');
1648	}
1649
1650	if(!empty($lockout_time) && $lockout_time < 0){
1651	$error[] = __('Lockout Time value is invalid', 'loginizer');
1652	}
1653
1654	if(!empty($max_lockouts) && $max_lockouts < 0){
1655	$error[] = __('Max Lockouts value is invalid', 'loginizer');
1656	}
1657
1658	if(!empty($lockouts_extend) && $lockouts_extend < 0){
1659	$error[] = __('Extended Lockout value is invalid', 'loginizer');
1660	}
1661
1662	if(!empty($reset_retries) && $reset_retries < 0){
1663	$error[] = __('Reset Retries value is invalid', 'loginizer');
1664	}
1665
1666	if(!empty($notify_email) && $notify_email < 0){
1667	$error[] = __('Email Notification value is invalid', 'loginizer');
1668	}
1669
1670	$lockout_time = $lockout_time * 60;
1671	$lockouts_extend = $lockouts_extend * 60 * 60;
1672	$reset_retries = $reset_retries * 60 * 60;
1673
1674	if(empty($error)){
1675
1676	$option['max_retries'] = $max_retries;
1677	$option['lockout_time'] = $lockout_time;
1678	$option['max_lockouts'] = $max_lockouts;
1679	$option['lockouts_extend'] = $lockouts_extend;
1680	$option['reset_retries'] = $reset_retries;
1681	$option['notify_email'] = $notify_email;
1682	$option['notify_email_address'] = $notify_email_address;
1683	$option['trusted_ips'] = $trusted_ips;
1684
1685	// Save the options
1686	update_option('loginizer_options', $option);
1687
1688	$saved = true;
1689
1690	}else{
1691	lz_report_error($error);
1692	}
1693
1694	if(!empty($notice)){
1695	lz_report_notice($notice);
1696	}
1697
1698	if(!empty($saved)){
1699	echo '<div id="message" class="updated"><p>'
1700	. __('The settings were saved successfully', 'loginizer')
1701	. '</p></div><br />';
1702	}
1703
1704	}
1705
1706	// Delete a Blackist IP range
1707	if(isset($_POST['bdelid'])){
1708
1709	$delid = (int) lz_optreq('bdelid');
1710
1711	// Unset and save
1712	$blacklist = $loginizer['blacklist'];
1713	unset($blacklist[$delid]);
1714	update_option('loginizer_blacklist', $blacklist);
1715
1716	echo '<div id="message" class="updated fade"><p>'
1717	. __('The Blacklist IP range has been deleted successfully', 'loginizer')
1718	. '</p></div><br />';
1719
1720	}
1721
1722	// Delete all Blackist IP ranges
1723	if(isset($_POST['del_all_blacklist'])){
1724
1725	// Unset and save
1726	update_option('loginizer_blacklist', array());
1727
1728	echo '<div id="message" class="updated fade"><p>'
1729	. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1730	. '</p></div><br />';
1731
1732	}
1733
1734	// Delete a Whitelist IP range
1735	if(isset($_POST['delid'])){
1736
1737	$delid = (int) lz_optreq('delid');
1738
1739	// Unset and save
1740	$whitelist = $loginizer['whitelist'];
1741	unset($whitelist[$delid]);
1742	update_option('loginizer_whitelist', $whitelist);
1743
1744	echo '<div id="message" class="updated fade"><p>'
1745	. __('The Whitelist IP range has been deleted successfully', 'loginizer')
1746	. '</p></div><br />';
1747
1748	}
1749
1750	// Delete all Blackist IP ranges
1751	if(isset($_POST['del_all_whitelist'])){
1752
1753	// Unset and save
1754	update_option('loginizer_whitelist', array());
1755
1756	echo '<div id="message" class="updated fade"><p>'
1757	. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1758	. '</p></div><br />';
1759
1760	}
1761
1762	// Reset All Logs
1763	if(isset($_POST['lz_reset_all_ip'])){
1764
1765	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` > 0");
1766
1767	echo '<div id="message" class="updated fade"><p>'
1768	. __('All the IP Logs have been cleared', 'loginizer')
1769	. '</p></div><br />';
1770	}
1771
1772	// Reset Logs
1773	if(isset($_POST['lz_reset_ip']) && isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1774
1775	$ips = $_POST['lz_reset_ips'];
1776
1777	foreach($ips as $ip){
1778	if(!lz_valid_ip($ip)){
1779	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1780	}
1781	}
1782
1783	if(count($ips) < 1){
1784	$error[] = __('There are no IPs submitted', 'loginizer');
1785	}
1786
1787	// Should we start deleting logs
1788	if(empty($error)){
1789
1790	foreach($ips as $ip){
1791	$result = $wpdb->query($wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $ip));
1792	}
1793
1794	if(empty($error)){
1795
1796	echo '<div id="message" class="updated fade"><p>'
1797	. __('The selected IP Logs have been reset', 'loginizer')
1798	. '</p></div><br />';
1799
1800	}
1801
1802	}
1803
1804	if(!empty($error)){
1805	lz_report_error($error);echo '<br />';
1806	}
1807
1808	}
1809
1810	if(isset($_POST['blacklist_iprange'])){
1811
1812	$start_ip = lz_optpost('start_ip');
1813	$end_ip = lz_optpost('end_ip');
1814
1815	// If no end IP we consider only 1 IP
1816	if(empty($end_ip)){
1817	$end_ip = $start_ip;
1818	}
1819
1820	// Validate the IP against all checks
1821	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['blacklist'], $error);
1822
1823	if(empty($error)){
1824
1825	$blacklist = $loginizer['blacklist'];
1826
1827	$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1828
1829	$blacklist[$newid] = array();
1830	$blacklist[$newid]['start'] = $start_ip;
1831	$blacklist[$newid]['end'] = $end_ip;
1832	$blacklist[$newid]['time'] = time();
1833
1834	update_option('loginizer_blacklist', $blacklist);
1835
1836	echo '<div id="message" class="updated fade"><p>'
1837	. __('Blacklist IP range added successfully', 'loginizer')
1838	. '</p></div><br />';
1839
1840	}
1841
1842	if(!empty($error)){
1843	lz_report_error($error);echo '<br />';
1844	}
1845
1846	}
1847
1848	if(isset($_POST['whitelist_iprange'])){
1849
1850	$start_ip = lz_optpost('start_ip_w');
1851	$end_ip = lz_optpost('end_ip_w');
1852
1853	// If no end IP we consider only 1 IP
1854	if(empty($end_ip)){
1855	$end_ip = $start_ip;
1856	}
1857
1858	// Validate the IP against all checks
1859	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['whitelist'], $error);
1860
1861	if(empty($error)){
1862
1863	$whitelist = $loginizer['whitelist'];
1864
1865	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1866
1867	$whitelist[$newid] = array();
1868	$whitelist[$newid]['start'] = $start_ip;
1869	$whitelist[$newid]['end'] = $end_ip;
1870	$whitelist[$newid]['time'] = time();
1871
1872	update_option('loginizer_whitelist', $whitelist);
1873
1874	echo '<div id="message" class="updated fade"><p>'
1875	. __('Whitelist IP range added successfully', 'loginizer')
1876	. '</p></div><br />';
1877
1878	}
1879
1880	if(!empty($error)){
1881	lz_report_error($error);echo '<br />';
1882	}
1883	}
1884
1885	if(isset($_POST['lz_import_csv'])){
1886
1887	if(!empty($_FILES['lz_import_file_csv']['name'])){
1888
1889	$lz_csv_type = lz_optpost('lz_csv_type');
1890
1891	// Is the submitted type in the allowed list ?
1892	if(!in_array($lz_csv_type, array('blacklist', 'whitelist'))){
1893	$error[] = __('Invalid import type', 'loginizer');
1894	}
1895
1896	if(empty($error)){
1897
1898	//Get the extension of the file
1899	$csv_file_name = basename($_FILES['lz_import_file_csv']['name']);
1900	$csv_ext_name = strtolower(pathinfo($csv_file_name, PATHINFO_EXTENSION));
1901
1902	//Check if it's a csv file
1903	if($csv_ext_name == 'csv'){
1904
1905	$file = fopen($_FILES['lz_import_file_csv']['tmp_name'], "r");
1906
1907	$line_count = 0;
1908	$update_record = 0;
1909
1910	while($content = fgetcsv($file)){
1911
1912	//Increment the $line_count
1913	$line_count++;
1914
1915	//Skip the first line
1916	if($line_count <= 1){
1917	continue;
1918	}
1919
1920	if(loginizer_iprange_validate($content[0], $content[1], $loginizer[$lz_csv_type], $error, $line_count)){
1921
1922	$newid = ( empty($loginizer[$lz_csv_type]) ? 0 : max(array_keys($loginizer[$lz_csv_type])) ) + 1;
1923
1924	$loginizer[$lz_csv_type][$newid] = array();
1925	$loginizer[$lz_csv_type][$newid]['start'] = $content[0];
1926	$loginizer[$lz_csv_type][$newid]['end'] = $content[1];
1927	$loginizer[$lz_csv_type][$newid]['time'] = time();
1928
1929	$update_record = 1;
1930
1931	}
1932	}
1933
1934	fclose($file);
1935
1936	if(!empty($update_record)){
1937
1938	update_option('loginizer_'.$lz_csv_type, $loginizer[$lz_csv_type]);
1939
1940	echo '<div id="message" class="updated fade"><p>'
1941	. __('Imported '.ucfirst($lz_csv_type).' IP range(s) successfully', 'loginizer')
1942	. '</p></div><br />';
1943
1944	}
1945
1946	if(!empty($error)){
1947	lz_report_error($error);echo '<br />';
1948	}
1949	}
1950
1951	}
1952	}
1953	}
1954
1955	//Brute Force Bulk Blacklist/ Whitelist Ip
1956	if(isset($_POST['lz_blacklist_selected_ip'])){
1957	if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1958
1959	$ips = $_POST['lz_reset_ips'];
1960
1961	foreach($ips as $ip){
1962	if(!lz_valid_ip($ip)){
1963	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1964	}
1965	}
1966
1967	if(count($ips) < 1){
1968	$error[] = __('There are no IPs submitted', 'loginizer');
1969	}
1970
1971	// Should we start deleting logs
1972	if(empty($error)){
1973
1974	$update_record = 0;
1975
1976	foreach($ips as $ip){
1977
1978	if(loginizer_iprange_validate($ip, '', $loginizer['blacklist'], $error)){
1979
1980	$newid = ( empty($loginizer['blacklist']) ? 0 : max(array_keys($loginizer['blacklist'])) ) + 1;
1981
1982	$loginizer['blacklist'][$newid] = array();
1983	$loginizer['blacklist'][$newid]['start'] = $ip;
1984	$loginizer['blacklist'][$newid]['end'] = $ip;
1985	$loginizer['blacklist'][$newid]['time'] = time();
1986
1987	$update_record = 1;
1988	}
1989	}
1990
1991	if(!empty($update_record)){
1992
1993	update_option('loginizer_blacklist', $loginizer['blacklist']);
1994
1995	echo '<div id="message" class="updated fade"><p>'
1996	. __('The selected IP(s) have been blacklisted', 'loginizer')
1997	. '</p></div><br />';
1998
1999	}
2000
2001	}
2002	}else{
2003	$error[] = __('No IP(s) selected', 'loginizer');
2004	}
2005
2006	if(!empty($error)){
2007	lz_report_error($error);echo '<br />';
2008	}
2009	}
2010
2011	// Save the messages
2012	if(isset($_POST['save_err_msgs_lz'])){
2013
2014	$msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
2015	$msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
2016	$msgs['attempts_left'] = lz_optpost('msg_attempts_left');
2017	$msgs['lockout_err'] = lz_optpost('msg_lockout_err');
2018	$msgs['minutes_err'] = lz_optpost('msg_minutes_err');
2019	$msgs['hours_err'] = lz_optpost('msg_hours_err');
2020
2021	// Update them
2022	update_option('loginizer_msg', $msgs);
2023
2024	echo '<div id="message" class="updated fade"><p>'
2025	. __('Error messages were saved successfully', 'loginizer')
2026	. '</p></div><br />';
2027
2028	}
2029
2030	// Count the Results
2031	$tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
2032	//print_r($tmp);
2033
2034	// Which Page is it
2035	$lz_env['res_len'] = 10;
2036	$lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
2037	$lz_env['num_res'] = $tmp['num'];
2038	$lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
2039
2040	// Get the logs
2041	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
2042	ORDER BY `time` DESC
2043	LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
2044	//print_r($result);
2045
2046	$lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
2047	$lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
2048	$lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
2049	$lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
2050
2051	// Reload the settings
2052	$loginizer['blacklist'] = get_option('loginizer_blacklist');
2053	$loginizer['whitelist'] = get_option('loginizer_whitelist');
2054
2055	$saved_msgs = get_option('loginizer_msg');
2056
2057	?>
2058
2059	<div id="" class="postbox">
2060
2061	<div class="postbox-header">
2062	<h2 class="hndle ui-sortable-handle">
2063	<?php echo '<span>'.__('Failed Login Attempts Logs', 'loginizer').'</span>   ('.__('Past', 'loginizer').' '.($loginizer['reset_retries']/60/60).' '.__('hours', 'loginizer').')'; ?>
2064	</h2>
2065	</div>
2066
2067	<script>
2068	function yesdsd(){
2069	window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
2070	return false;
2071	}
2072
2073	function lz_export_ajax(lz_csv_type){
2074
2075	var data = new Object();
2076	data["action"] = lz_csv_type != "failed_login" ? "loginizer_export" : "loginizer_failed_login_export";
2077	data["lz_csv_type"] = lz_csv_type;
2078	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax'); ?>";
2079
2080	var admin_url = "<?php admin_url(); ?>"+"admin-ajax.php";
2081
2082	jQuery.post(admin_url, data, function(response){
2083
2084	// Was the ajax call successful ?
2085	if(response.substring(0,2) == "-1"){
2086
2087	var err_message = response.substring(2);
2088
2089	if(err_message){
2090	alert(err_message);
2091	}else{
2092	alert("Failed to export data");
2093	}
2094
2095	return false;
2096	}
2097
2098	/*
2099	* Make CSV downloadable
2100	*/
2101	var downloadLink = document.createElement("a");
2102	var fileData = ['\ufeff'+response];
2103
2104	var blobObject = new Blob(fileData,{
2105	type: "text/csv;charset=utf-8;"
2106	});
2107
2108	var url = URL.createObjectURL(blobObject);
2109	downloadLink.href = url;
2110	downloadLink.download = "loginizer-"+lz_csv_type+".csv";
2111
2112	/*
2113	* Actually download CSV
2114	*/
2115	document.body.appendChild(downloadLink);
2116	downloadLink.click();
2117	document.body.removeChild(downloadLink);
2118
2119	});
2120
2121	}
2122
2123	</script>
2124
2125	<form method="get" onsubmit="return yesdsd();">
2126	<div class="tablenav">
2127	<p class="tablenav-pages" style="margin: 5px 10px" align="right">
2128	<span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
2129	<span class="pagination-links">
2130	<a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
2131	<a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
2132	<span class="paging-input">
2133	<label for="current-page-selector" class="screen-reader-text">Current Page</label>
2134	<input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
2135	</span>
2136	<a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
2137	<a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
2138	</span>
2139	</p>
2140	</div>
2141	</form>
2142
2143	<form action="" method="post" enctype="multipart/form-data">
2144	<?php wp_nonce_field('loginizer-options'); ?>
2145	<div class="inside">
2146	<table class="wp-list-table widefat fixed users" border="0">
2147	<tr>
2148	<th scope="row" valign="top" style="background:#EFEFEF;" width="20"><input type="checkbox" id="lz_check_all_logs" onchange="lz_multiple_check()" style="margin-left:-1px;"/></th>
2149	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
2150	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
2151	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
2152	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
2153	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
2154	<th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
2155	</tr>
2156	<?php
2157
2158	if(empty($result)){
2159	echo '
2160	<tr>
2161	<td colspan="4">
2162	'.__('No Logs. You will see logs about failed login attempts here.', 'loginizer').'
2163	</td>
2164	</tr>';
2165	}else{
2166	foreach($result as $ik => $iv){
2167	$status_button = (!empty($iv['status']) ? 'disable' : 'enable');
2168	echo '
2169	<tr>
2170	<td>
2171	<input type="checkbox" value="'.esc_attr($iv['ip']).'" name="lz_reset_ips[]" class="lz_shift_select_logs lz_check_all_logs" />
2172	</td>
2173	<td>
2174	<a href="https://ipinfo.io/'.esc_html($iv['ip']).'" target="_blank">'.esc_html($iv['ip']).' <span class="dashicons dashicons-external"></span></a>
2175	</td>
2176	<td>
2177	'.esc_html($iv['username']).'
2178	</td>
2179	<td>
2180	'.date('d/M/Y H:i:s P', $iv['time']).'
2181	</td>
2182	<td>
2183	'.esc_html($iv['count']).'
2184	</td>
2185	<td>
2186	'.esc_html($iv['lockout']).'
2187	</td>
2188	<td>
2189	'.esc_html($iv['url']).'
2190	</td>
2191	</tr>';
2192	}
2193	}
2194
2195	?>
2196	</table>
2197
2198	<br>
2199	<input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
2200
2201	<input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
2202
2203	<input name="lz_blacklist_selected_ip" class="button button-primary action" value="<?php echo __('Blacklist Selected IPs', 'loginizer'); ?>" type="submit" />
2204
2205	<input name="lz_export_csv" onclick="lz_export_ajax('failed_login'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2206	</div>
2207	</div>
2208	</form>
2209	<br />
2210
2211	<div id="" class="postbox">
2212
2213	<div class="postbox-header">
2214	<h2 class="hndle ui-sortable-handle">
2215	<span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
2216	</h2>
2217	</div>
2218
2219	<div class="inside">
2220
2221	<form action="" method="post" enctype="multipart/form-data">
2222	<?php wp_nonce_field('loginizer-options'); ?>
2223	<table class="form-table">
2224	<tr>
2225	<th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
2226	<td>
2227	<input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
2228	</td>
2229	</tr>
2230	<tr>
2231	<th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
2232	<td>
2233	<input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
2234	</td>
2235	</tr>
2236	<tr>
2237	<th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
2238	<td>
2239	<input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
2240	</td>
2241	</tr>
2242	<tr>
2243	<th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
2244	<td>
2245	<input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
2246	</td>
2247	</tr>
2248	<tr>
2249	<th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
2250	<td>
2251	<input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
2252	</td>
2253	</tr>
2254	<tr>
2255	<th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
2256	<td>
2257	<?php echo __('after ','loginizer'); ?>
2258	<input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
2259	</td>
2260	</tr>
2261	<tr>
2262	<th scope="row" valign="top"><label for="notify_email_address"><?php echo __('Email Address','loginizer'); ?></label></th>
2263	<td>
2264	<input type="text" value="<?php echo (!empty($notify_email_address) ? $notify_email_address : (!empty($loginizer['custom_notify_email']) ? $loginizer['notify_email_address'] : '')); ?>" name="notify_email_address" id="notify_email_address" size="30" /> <br /><?php echo __('failed login attempts notifications will be sent to this email','loginizer'); ?>
2265	</td>
2266	</tr>
2267	<tr>
2268	<th scope="row" valign="top"><label for="trusted_ips"><?php echo __('Trusted IP\'s','loginizer'); ?><span style="color:red; margin-left:5px;">New</span></label></th>
2269	<td>
2270	<input type="checkbox" <?php echo lz_POSTchecked('trusted_ips', (empty($loginizer['trusted_ips']) ? false : true)); ?> name="trusted_ips" id="trusted_ips"/>
2271	<?php _e('If enabled Loginizer will only allow whitlisted IP\'s to Login.', 'loginizer'); ?>
2272	</td>
2273	</tr>
2274	</table><br />
2275	<input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2276	<?php
2277
2278	if(empty($loginizer['disable_brute'])){
2279
2280	echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2281
2282	}else{
2283
2284	echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2285
2286	}
2287
2288	?>
2289	</form>
2290
2291	</div>
2292	</div>
2293	<br />
2294
2295	<?php
2296
2297	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
2298
2299	?>
2300
2301	<style>
2302	.page-navigation a {
2303	margin: 5px 2px;
2304	display: inline-block;
2305	padding: 5px 8px;
2306	color: #0073aa;
2307	background: #e5e5e5 none repeat scroll 0 0;
2308	border: 1px solid #ccc;
2309	text-decoration: none;
2310	transition-duration: 0.05s;
2311	transition-property: border, background, color;
2312	transition-timing-function: ease-in-out;
2313	}
2314
2315	.page-navigation a[data-selected] {
2316	background-color: #00a0d2;
2317	color: #fff;
2318	}
2319	</style>
2320
2321	<script>
2322
2323	jQuery(document).ready(function(){
2324	jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
2325	jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
2326	lz_multiple_check();
2327	lz_shift_check_all('lz_shift_select_logs');
2328	});
2329
2330	// Delete a Blacklist / Whitelist IP Range
2331	function del_confirm(field, todo_id, msg){
2332	var ret = confirm(msg);
2333
2334	if(ret){
2335	jQuery('#lz_bl_wl_todo').attr('name', field);
2336	jQuery('#lz_bl_wl_todo').val(todo_id);
2337	jQuery('#lz_bl_wl_form').submit();
2338	}
2339
2340	return false;
2341
2342	}
2343
2344	// Delete all Blacklist / Whitelist IP Ranges
2345	function del_confirm_all(msg){
2346	var ret = confirm(msg);
2347
2348	if(ret){
2349	return true;
2350	}
2351
2352	return false;
2353
2354	}
2355
2356	//Check all the failed log attempts
2357	function lz_multiple_check(){
2358	jQuery("#lz_check_all_logs").on("click", function(event){
2359	if(this.checked == true){
2360	jQuery(".lz_check_all_logs").prop("checked", true);
2361	}else{
2362	jQuery(".lz_check_all_logs").prop("checked", false);
2363	}
2364	});
2365	}
2366
2367	//To select the installations/backups using shift key
2368	function lz_shift_check_all(check_class){
2369
2370	var checkboxes = jQuery("."+check_class);
2371	var lastChecked = null;
2372
2373	checkboxes.click(function(event){
2374	if(!lastChecked){
2375	lastChecked = this;
2376	return;
2377	}
2378
2379	if(event.shiftKey){
2380	var start = checkboxes.index(this);
2381	var end = checkboxes.index(lastChecked);
2382
2383	checkboxes.slice(Math.min(start,end), Math.max(start,end)+ 1).prop("checked", this.checked);
2384	}
2385
2386	lastChecked = this;
2387	});
2388	};
2389
2390	</script>
2391
2392	<div id="" class="postbox">
2393
2394	<div class="postbox-header">
2395	<h2 class="hndle ui-sortable-handle">
2396	<span><?php echo __('Blacklist IP','loginizer'); ?></span>
2397	</h2>
2398	</div>
2399
2400	<div class="inside">
2401
2402	<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
2403
2404	<form action="" method="post">
2405	<?php wp_nonce_field('loginizer-options'); ?>
2406	<table class="form-table">
2407	<tr>
2408	<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
2409	<td>
2410	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2411	</td>
2412	</tr>
2413	<tr>
2414	<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2415	<td>
2416	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
2417	</td>
2418	</tr>
2419	</table><br />
2420	<input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
2421	<input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
2422	</form>
2423	</div>
2424
2425	<div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
2426
2427	<!--Brute Force Blacklist Import CSV Form-->
2428	<div class="inside" id="blacklist_csv" style="display:none;">
2429	<form action="" method="post" enctype="multipart/form-data">
2430	<?php wp_nonce_field('loginizer-options'); ?>
2431	<input type="hidden" value="blacklist" name="lz_csv_type" />
2432	<h3><?php echo __('Import Blacklist IPs (CSV)', 'loginizer'); ?>:</h3>
2433	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2434	<br><br>
2435	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2436	</form>
2437	</div>
2438	<!---->
2439
2440	<!--Brute Force Blacklist Export CSV Form-->
2441	<div class="inside" style="float:right;">
2442	<form action="" method="post">
2443	<?php wp_nonce_field('loginizer-options'); ?>
2444	<input type="hidden" value="blacklist" name="lz_csv_type" />
2445	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#blacklist_csv').toggle();"/>
2446	<input name="lz_export_csv" onclick="lz_export_ajax('blacklist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2447	</form>
2448
2449	</div>
2450	<!---->
2451
2452	<table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2453	<tr>
2454	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2455	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2456	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2457	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2458	</tr>
2459	<?php
2460	if(empty($loginizer['blacklist'])){
2461	echo '
2462	<tr>
2463	<td colspan="4">
2464	'.__('No Blacklist IPs. You will see blacklisted IP ranges here.', 'loginizer').'
2465	</td>
2466	</tr>';
2467	}else{
2468	foreach($loginizer['blacklist'] as $ik => $iv){
2469	echo '
2470	<tr>
2471	<td>
2472	'.$iv['start'].'
2473	</td>
2474	<td>
2475	'.$iv['end'].'
2476	</td>
2477	<td>
2478	'.date('d/m/Y', $iv['time']).'
2479	</td>
2480	<td>
2481	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2482	</td>
2483	</tr>';
2484	}
2485	}
2486	?>
2487	</table>
2488	<br />
2489	<form action="" method="post" id="lz_bl_wl_form">
2490	<?php wp_nonce_field('loginizer-options'); ?>
2491	<input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2492	</form>
2493	</div>
2494
2495	<br />
2496
2497	<div id="" class="postbox">
2498
2499	<div class="postbox-header">
2500	<h2 class="hndle ui-sortable-handle">
2501	<span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2502	</h2>
2503	</div>
2504
2505	<div class="inside">
2506
2507	<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2508	<form action="" method="post">
2509	<?php wp_nonce_field('loginizer-options'); ?>
2510	<table class="form-table">
2511	<tr>
2512	<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2513	<td>
2514	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2515	</td>
2516	</tr>
2517	<tr>
2518	<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2519	<td>
2520	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2521	</td>
2522	</tr>
2523	</table><br />
2524	<input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2525	<input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2526	</form>
2527	</div>
2528
2529	<div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2530
2531	<!--Brute Force Whitelist Import CSV Form-->
2532	<div class="inside" id="lz_whitelist_csv_div" style="display:none;">
2533	<form action="" method="post" enctype="multipart/form-data">
2534	<?php wp_nonce_field('loginizer-options'); ?>
2535	<input type="hidden" value="whitelist" name="lz_csv_type" />
2536	<h3><?php echo __('Import Whitelist IPs (CSV)', 'loginizer'); ?>:</h3>
2537	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2538	<br><br>
2539	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2540	</form>
2541	</div>
2542	<!---->
2543
2544	<!--Brute Force Whitelist Export CSV Form-->
2545	<div class="inside" style="float:right;">
2546	<form action="" method="post">
2547	<?php wp_nonce_field('loginizer-options'); ?>
2548	<input type="hidden" value="whitelist" name="lz_csv_type" />
2549	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#lz_whitelist_csv_div').toggle();"/>
2550	<input name="lz_export_csv" onclick="lz_export_ajax('whitelist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2551	</form>
2552	</div>
2553	<!---->
2554
2555	<table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2556	<tr>
2557	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2558	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2559	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2560	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2561	</tr>
2562	<?php
2563	if(empty($loginizer['whitelist'])){
2564	echo '
2565	<tr>
2566	<td colspan="4">
2567	'.__('No Whitelist IPs. You will see whitelisted IP ranges here.', 'loginizer').'
2568	</td>
2569	</tr>';
2570	}else{
2571	foreach($loginizer['whitelist'] as $ik => $iv){
2572	echo '
2573	<tr>
2574	<td>
2575	'.$iv['start'].'
2576	</td>
2577	<td>
2578	'.$iv['end'].'
2579	</td>
2580	<td>
2581	'.date('d/m/Y', $iv['time']).'
2582	</td>
2583	<td>
2584	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2585	</td>
2586	</tr>';
2587	}
2588	}
2589	?>
2590	</table>
2591	<br />
2592
2593	</div>
2594
2595	<div id="" class="postbox">
2596
2597	<div class="postbox-header">
2598	<h2 class="hndle ui-sortable-handle">
2599	<span><?php echo __('Error Messages', 'loginizer'); ?></span>
2600	</h2>
2601	</div>
2602
2603	<div class="inside">
2604
2605	<form action="" method="post" enctype="multipart/form-data">
2606	<?php wp_nonce_field('loginizer-options'); ?>
2607	<table class="form-table">
2608	<tr>
2609	<th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2610	<td>
2611	<input type="text" size="25" value="<?php echo (empty($saved_msgs['inv_userpass']) ? '' : esc_attr($saved_msgs['inv_userpass'])); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2612	<?php echo __('Default: <em>"' . $loginizer['d_msg']['inv_userpass']. '"</em>', 'loginizer'); ?><br />
2613	</td>
2614	</tr>
2615	<tr>
2616	<th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2617	<td>
2618	<input type="text" size="25" value="<?php echo (empty($saved_msgs['ip_blacklisted']) ? '' : esc_attr($saved_msgs['ip_blacklisted'])); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2619	<?php echo __('Default: <em>"' . $loginizer['d_msg']['ip_blacklisted']. '"</em>', 'loginizer'); ?><br />
2620	</td>
2621	</tr>
2622	<tr>
2623	<th scope="row" valign="top"><label for="msg_attempts_left"><?php echo __('Attempts Left','loginizer'); ?></label></th>
2624	<td>
2625	<input type="text" size="25" value="<?php echo (empty($saved_msgs['attempts_left']) ? '' : esc_attr($saved_msgs['attempts_left'])); ?>" name="msg_attempts_left" id="msg_attempts_left" />
2626	<?php echo __('Default: <em>"' . $loginizer['d_msg']['attempts_left']. '"</em>', 'loginizer'); ?><br />
2627	</td>
2628	</tr>
2629	<tr>
2630	<th scope="row" valign="top"><label for="msg_lockout_err"><?php echo __('Lockout Error','loginizer'); ?></label></th>
2631	<td>
2632	<input type="text" size="25" value="<?php echo (empty($saved_msgs['lockout_err']) ? '' : esc_attr($saved_msgs['lockout_err'])); ?>" name="msg_lockout_err" id="msg_lockout_err" />
2633	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['lockout_err']). '"</em>', 'loginizer'); ?><br />
2634	</td>
2635	</tr>
2636	<tr>
2637	<th scope="row" valign="top"><label for="msg_minutes_err"><?php echo __('Minutes','loginizer'); ?></label></th>
2638	<td>
2639	<input type="text" size="25" value="<?php echo (empty($saved_msgs['minutes_err']) ? '' : esc_attr($saved_msgs['minutes_err'])); ?>" name="msg_minutes_err" id="msg_minutes_err" />
2640	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['minutes_err']). '"</em>', 'loginizer'); ?><br />
2641	</td>
2642	</tr>
2643	<tr>
2644	<th scope="row" valign="top"><label for="msg_hours_err"><?php echo __('Hours','loginizer'); ?></label></th>
2645	<td>
2646	<input type="text" size="25" value="<?php echo (empty($saved_msgs['hours_err']) ? '' : esc_attr($saved_msgs['hours_err'])); ?>" name="msg_hours_err" id="msg_hours_err" />
2647	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['hours_err']). '"</em>', 'loginizer'); ?><br />
2648	</td>
2649	</tr>
2650	</table><br />
2651	<input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2652	</form>
2653	</div>
2654	</div>
2655	<?php
2656
2657	loginizer_page_footer();
2658
2659	}
2660
2661	add_action('wp_ajax_loginizer_export', 'loginizer_export');
2662
2663	// Export CSV
2664	function loginizer_export(){
2665
2666	// Some AJAX security
2667	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2668
2669	if(!current_user_can('manage_options')){
2670	wp_die('Sorry, but you do not have permissions to change settings.');
2671	}
2672
2673	$lz_csv_type = lz_optpost('lz_csv_type');
2674
2675	switch($lz_csv_type){
2676
2677	case 'blacklist':
2678	$csv_array = get_option('loginizer_blacklist');
2679	$filename = 'loginizer-blacklist';
2680	break;
2681
2682	case 'whitelist':
2683	$csv_array = get_option('loginizer_whitelist');
2684	$filename = 'loginizer-whitelist';
2685	break;
2686	}
2687
2688	if(empty($csv_array)){
2689	echo -1;
2690	echo __('No data to export', 'loginizer');
2691	wp_die();
2692	}
2693
2694	header('Content-Type: text/csv; charset=utf-8');
2695	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2696
2697	$allowed_fields = array('start' => 'Start IP', 'end' => 'End IP', 'time' => 'Time');
2698
2699	$file = fopen("php://output","w");
2700
2701	fputcsv($file, array_values($allowed_fields));
2702
2703	foreach($csv_array as $ik => $iv){
2704
2705	$iv['start'] = $iv['start'];
2706	$iv['end'] = $iv['end'];
2707	$iv['time'] = date('d/m/Y', $iv['time']);
2708
2709	$row = array();
2710	foreach($allowed_fields as $ak => $av){
2711	$row[$ak] = $iv[$ak];
2712	}
2713
2714	fputcsv($file, $row);
2715	}
2716
2717	fclose($file);
2718
2719	wp_die();
2720
2721	}
2722
2723	add_action('wp_ajax_loginizer_failed_login_export', 'loginizer_failed_login_export');
2724
2725	//Export Failed Login Attempts
2726	function loginizer_failed_login_export(){
2727
2728	global $wpdb;
2729	// Some AJAX security
2730	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2731
2732	if(!current_user_can('manage_options')){
2733	wp_die('Sorry, but you do not have permissions to change settings.');
2734	}
2735
2736	$csv_array = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `time` DESC", 1);
2737	$filename = 'loginizer-failed-login-attempts';
2738
2739	if(empty($csv_array)){
2740	echo -1;
2741	echo __('No data to export', 'loginizer');
2742	wp_die();
2743	}
2744
2745	header('Content-Type: text/csv; charset=utf-8');
2746	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2747
2748	$allowed_fields = array('ip' => 'IP', 'attempted_username' => 'Attempted Username', 'last_f_attemp' => 'Last Failed Attempt', 'f_attempts_count' => 'Failed Attempts Count', 'lockouts_count' => 'Lockouts Count', 'url_attacked' => 'URL Attacked');
2749
2750	$file = fopen("php://output","w");
2751
2752	fputcsv($file, array_values($allowed_fields));
2753
2754	foreach($csv_array as $failed_attempts){
2755
2756	$row = array($failed_attempts['ip'], $failed_attempts['username'], date('d/M/Y H:i:s P', $failed_attempts['time']), $failed_attempts['count'], $failed_attempts['lockout'], $failed_attempts['url']);
2757	fputcsv($file, $row);
2758	}
2759
2760
2761	fclose($file);
2762
2763	wp_die();
2764
2765	}
2766
2767	// IP range validations
2768	function loginizer_iprange_validate($start_ip, $end_ip, $cur_list, &$error = array(), $line_count = ''){
2769
2770	$line_error = '';
2771	if(!empty($line_count)){
2772	$line_error = ' '.__('Line no.', 'loginizer').' '.$line_count;
2773	}
2774
2775	if(empty($start_ip)){
2776	$cur_error[] = __('Please enter the Start IP', 'loginizer').$line_error;
2777	}
2778
2779	// If no end IP we consider only 1 IP
2780	if(empty($end_ip)){
2781	$end_ip = $start_ip;
2782	}
2783
2784	if(!lz_valid_ip($start_ip)){
2785	$cur_error[] = __('Please provide a valid start IP', 'loginizer').$line_error;
2786	}
2787
2788	if(!lz_valid_ip($end_ip)){
2789	$cur_error[] = __('Please provide a valid end IP', 'loginizer').$line_error;
2790	}
2791
2792	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
2793
2794	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
2795	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
2796	// This is right
2797	}else{
2798	$cur_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer').$line_error;
2799	}
2800
2801	}
2802
2803	if(!empty($cur_error)){
2804
2805	foreach($cur_error as $rk => $rv){
2806	$error[] = $rv;
2807	}
2808
2809	return false;
2810	}
2811
2812	if(!empty($cur_list)){
2813
2814	foreach($cur_list as $k => $v){
2815
2816	// This is to check if there is any other range exists with the same Start or End IP
2817	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
2818	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
2819	){
2820	$cur_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer').$line_error;
2821	break;
2822	}
2823
2824	// This is to check if there is any other range exists with the same Start IP
2825	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
2826	$cur_error[] = __('The Start IP is present in an existing range !', 'loginizer').$line_error;
2827	break;
2828	}
2829
2830	// This is to check if there is any other range exists with the same End IP
2831	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
2832	$cur_error[] = __('The End IP is present in an existing range!', 'loginizer').$line_error;
2833	break;
2834	}
2835
2836	}
2837
2838	}
2839
2840	if(!empty($cur_error)){
2841
2842	foreach($cur_error as $rk => $rv){
2843	$error[] = $rv;
2844	}
2845
2846	return false;
2847	}
2848
2849	return true;
2850	}
2851
2852	//---------------------
2853	// Admin Menu Pro Pages
2854	//---------------------
2855
2856	// Loginizer - reCaptcha Page
2857	function loginizer_page_recaptcha(){
2858
2859	global $loginizer, $lz_error, $lz_env;
2860
2861	if(!current_user_can('manage_options')){
2862	wp_die('Sorry, but you do not have permissions to change settings.');
2863	}
2864
2865	if(!loginizer_is_premium() && count($_POST) > 0){
2866	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
2867	return loginizer_page_recaptcha_T();
2868	}
2869
2870	/* Make sure post was from this page */
2871	if(count($_POST) > 0){
2872	check_admin_referer('loginizer-options');
2873	}
2874
2875	// Themes
2876	$lz_env['theme']['light'] = 'Light';
2877	$lz_env['theme']['dark'] = 'Dark';
2878
2879	// Langs
2880	$lz_env['lang'][''] = 'Auto Detect';
2881	$lz_env['lang']['ar'] = 'Arabic';
2882	$lz_env['lang']['bg'] = 'Bulgarian';
2883	$lz_env['lang']['ca'] = 'Catalan';
2884	$lz_env['lang']['zh-CN'] = 'Chinese (Simplified)';
2885	$lz_env['lang']['zh-TW'] = 'Chinese (Traditional)';
2886	$lz_env['lang']['hr'] = 'Croatian';
2887	$lz_env['lang']['cs'] = 'Czech';
2888	$lz_env['lang']['da'] = 'Danish';
2889	$lz_env['lang']['nl'] = 'Dutch';
2890	$lz_env['lang']['en-GB'] = 'English (UK)';
2891	$lz_env['lang']['en'] = 'English (US)';
2892	$lz_env['lang']['fil'] = 'Filipino';
2893	$lz_env['lang']['fi'] = 'Finnish';
2894	$lz_env['lang']['fr'] = 'French';
2895	$lz_env['lang']['fr-CA'] = 'French (Canadian)';
2896	$lz_env['lang']['de'] = 'German';
2897	$lz_env['lang']['de-AT'] = 'German (Austria)';
2898	$lz_env['lang']['de-CH'] = 'German (Switzerland)';
2899	$lz_env['lang']['el'] = 'Greek';
2900	$lz_env['lang']['iw'] = 'Hebrew';
2901	$lz_env['lang']['hi'] = 'Hindi';
2902	$lz_env['lang']['hu'] = 'Hungarain';
2903	$lz_env['lang']['id'] = 'Indonesian';
2904	$lz_env['lang']['it'] = 'Italian';
2905	$lz_env['lang']['ja'] = 'Japanese';
2906	$lz_env['lang']['ko'] = 'Korean';
2907	$lz_env['lang']['lv'] = 'Latvian';
2908	$lz_env['lang']['lt'] = 'Lithuanian';
2909	$lz_env['lang']['no'] = 'Norwegian';
2910	$lz_env['lang']['fa'] = 'Persian';
2911	$lz_env['lang']['pl'] = 'Polish';
2912	$lz_env['lang']['pt'] = 'Portuguese';
2913	$lz_env['lang']['pt-BR'] = 'Portuguese (Brazil)';
2914	$lz_env['lang']['pt-PT'] = 'Portuguese (Portugal)';
2915	$lz_env['lang']['ro'] = 'Romanian';
2916	$lz_env['lang']['ru'] = 'Russian';
2917	$lz_env['lang']['sr'] = 'Serbian';
2918	$lz_env['lang']['sk'] = 'Slovak';
2919	$lz_env['lang']['sl'] = 'Slovenian';
2920	$lz_env['lang']['es'] = 'Spanish';
2921	$lz_env['lang']['es-419'] = 'Spanish (Latin America)';
2922	$lz_env['lang']['sv'] = 'Swedish';
2923	$lz_env['lang']['th'] = 'Thai';
2924	$lz_env['lang']['tr'] = 'Turkish';
2925	$lz_env['lang']['uk'] = 'Ukrainian';
2926	$lz_env['lang']['vi'] = 'Vietnamese';
2927
2928	// Sizes
2929	$lz_env['size']['normal'] = 'Normal';
2930	$lz_env['size']['compact'] = 'Compact';
2931
2932	// reCAPTCHA Domains
2933	$lz_env['captcha_domains']['www.google.com'] = 'google.com';
2934	$lz_env['captcha_domains']['www.recaptcha.net'] = 'recaptcha.net';
2935
2936	if(isset($_POST['save_lz'])){
2937
2938	// Clear captcha
2939	if(empty($_POST['captcha_status'])){
2940
2941	// Save the options
2942	update_option('loginizer_captcha', '');
2943
2944	// Mark as saved
2945	$GLOBALS['lz_cleared'] = true;
2946
2947	}else{
2948
2949	// Google Captcha
2950	$option['captcha_type'] = lz_optpost('captcha_type');
2951	$option['captcha_key'] = lz_optpost('captcha_key');
2952	$option['captcha_secret'] = lz_optpost('captcha_secret');
2953	$option['captcha_theme'] = lz_optpost('captcha_theme');
2954	$option['captcha_size'] = lz_optpost('captcha_size');
2955	$option['captcha_lang'] = lz_optpost('captcha_lang');
2956	$option['captcha_domain'] = lz_optpost('captcha_domain');
2957
2958	// No Google Captcha
2959	$option['captcha_text'] = lz_optpost('captcha_text');
2960	$option['captcha_time'] = (int) lz_optpost('captcha_time');
2961	$option['captcha_words'] = (int) lz_optpost('captcha_words');
2962	$option['captcha_add'] = (int) lz_optpost('captcha_add');
2963	$option['captcha_subtract'] = (int) lz_optpost('captcha_subtract');
2964	$option['captcha_multiply'] = (int) lz_optpost('captcha_multiply');
2965	$option['captcha_divide'] = (int) lz_optpost('captcha_divide');
2966
2967	// Checkboxes
2968	$option['captcha_user_hide'] = (int) lz_optpost('captcha_user_hide');
2969	$option['captcha_no_css_login'] = (int) lz_optpost('captcha_no_css_login');
2970	$option['captcha_login'] = (int) lz_optpost('captcha_login');
2971	$option['captcha_lostpass'] = (int) lz_optpost('captcha_lostpass');
2972	$option['captcha_resetpass'] = (int) lz_optpost('captcha_resetpass');
2973	$option['captcha_register'] = (int) lz_optpost('captcha_register');
2974	$option['captcha_comment'] = (int) lz_optpost('captcha_comment');
2975	$option['captcha_wc_checkout'] = (int) lz_optpost('captcha_wc_checkout');
2976
2977	// Are we to use Math Captcha ?
2978	if(!empty($_POST['captcha_status']) && $_POST['captcha_status'] == 2){
2979
2980	$option['captcha_no_google'] = 1;
2981
2982	// Make the checks
2983	if(strlen($option['captcha_text']) < 1){
2984	$lz_error['captcha_text'] = __('The Captcha key was not submitted', 'loginizer');
2985	}
2986
2987	}else{
2988
2989	// Make the checks
2990	if(strlen($option['captcha_key']) < 32 \|\| strlen($option['captcha_key']) > 50){
2991	$lz_error['captcha_key'] = __('The reCAPTCHA key is invalid', 'loginizer');
2992	}
2993
2994	// Is secret valid ?
2995	if(strlen($option['captcha_secret']) < 32 \|\| strlen($option['captcha_secret']) > 50){
2996	$lz_error['captcha_secret'] = __('The reCAPTCHA secret is invalid', 'loginizer');
2997	}
2998
2999	// Is theme valid ?
3000	if(empty($lz_env['theme'][$option['captcha_theme']])){
3001	$lz_error['captcha_theme'] = __('The reCAPTCHA theme is invalid', 'loginizer');
3002	}
3003
3004	// Is size valid ?
3005	if(empty($lz_env['size'][$option['captcha_size']])){
3006	$lz_error['captcha_size'] = __('The reCAPTCHA size is invalid', 'loginizer');
3007	}
3008
3009	// Is lang valid ?
3010	if(empty($lz_env['lang'][$option['captcha_lang']])){
3011	$lz_error['captcha_lang'] = __('The reCAPTCHA language is invalid', 'loginizer');
3012	}
3013
3014	if(empty($lz_env['captcha_domains'][$option['captcha_domain']])){
3015	$lz_error['captcha_domain'] = __('The reCAPTCHA domain is invalid', 'loginizer');
3016	}
3017
3018	}
3019
3020	// Is there an error ?
3021	if(!empty($lz_error)){
3022	return loginizer_page_recaptcha_T();
3023	}
3024
3025	// Save the options
3026	update_option('loginizer_captcha', $option);
3027
3028	// Mark as saved
3029	$GLOBALS['lz_saved'] = true;
3030	}
3031
3032	}
3033
3034	// Call the theme
3035	loginizer_page_recaptcha_T();
3036
3037	}
3038
3039	// Loginizer - reCaptcha Page Theme
3040	function loginizer_page_recaptcha_T(){
3041
3042	global $loginizer, $lz_error, $lz_env;
3043
3044	// Universal header
3045	loginizer_page_header('reCAPTCHA Settings');
3046
3047	loginizer_feature_available('reCAPTCHA');
3048
3049	// Saved ?
3050	if(!empty($GLOBALS['lz_saved'])){
3051	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3052	}
3053
3054	// Cleared ?
3055	if(!empty($GLOBALS['lz_cleared'])){
3056	echo '<div id="message" class="updated"><p>'. __('reCAPTCHA has been disabled !', 'loginizer'). '</p></div><br />';
3057	}
3058
3059	// Any errors ?
3060	if(!empty($lz_error)){
3061	lz_report_error($lz_error);echo '<br />';
3062	}
3063
3064	?>
3065
3066	<style>
3067	input[type="text"], textarea, select {
3068	width: 70%;
3069	}
3070	</style>
3071
3072	<div id="" class="postbox">
3073
3074	<div class="postbox-header">
3075	<h2 class="hndle ui-sortable-handle">
3076	<span><?php echo __('reCAPTCHA Settings', 'loginizer'); ?></span>
3077	</h2>
3078	</div>
3079
3080	<div class="inside">
3081
3082	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3083	<?php wp_nonce_field('loginizer-options'); ?>
3084	<table class="form-table">
3085	<tr>
3086	<td scope="row" valign="top" style="width:400px !important;"><label for="captcha_status"><b><?php echo __('Captcha Status', 'loginizer'); ?></b></label></td>
3087	<td>
3088	<select name="captcha_status" id="captcha_status" onchange="lz_captcha_status();">
3089	<?php
3090	echo '<option '.lz_POSTselect('captcha_status', 0, (empty($loginizer['captcha_key']) && empty($loginizer['captcha_no_google']) ? true : false)).' value="0">'.__('Disabled', 'loginizer').'</value>
3091	<option '.lz_POSTselect('captcha_status', 1, (!empty($loginizer['captcha_key']) ? true : false)).' value="1">'.__('Google reCAPTCHA', 'loginizer').'</value>
3092	<option '.lz_POSTselect('captcha_status', 2, (!empty($loginizer['captcha_no_google']) ? true : false)).' value="2">'.__('Math Captcha', 'loginizer').'</value>';
3093	?>
3094	</select>
3095	</td>
3096	</tr>
3097	<tr class="lz_google_cap">
3098	<td scope="row" valign="top"><label><b><?php echo __('reCAPTCHA type', 'loginizer'); ?></b></label><br>
3099	<?php echo __('Choose the type of reCAPTCHA', 'loginizer'); ?><br />
3100	<?php echo __('<a href="https://g.co/recaptcha/sitetypes/" target="_blank">See Site Types for more details</a>', 'loginizer'); ?>
3101	</td>
3102	<td>
3103	<input type="radio" value="v3" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v3', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v3" /> <label for="captcha_type_v3"><?php echo __('reCAPTCHA v3', 'loginizer'); ?></label><br /><br />
3104	<input type="radio" value="" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', '', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2" /> <label for="captcha_type_v2"><?php echo __('reCAPTCHA v2 - Checkbox', 'loginizer'); ?></label><br /><br />
3105	<input type="radio" value="v2_invisible" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v2_invisible', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2_invisible" /> <label for="captcha_type_v2_invisible"><?php echo __('reCAPTCHA v2 - Invisible', 'loginizer'); ?></label><br />
3106	</td>
3107	</tr>
3108	<tr class="lz_google_cap">
3109	<td scope="row" valign="top"><label for="captcha_key"><b><?php echo __('Site Key', 'loginizer'); ?></b></label><br>
3110	<?php echo __('Make sure you enter the correct keys as per the reCAPTCHA type selected above', 'loginizer'); ?>
3111	</td>
3112	<td>
3113	<input type="text" size="50" value="<?php echo lz_optpost('captcha_key', $loginizer['captcha_key']); ?>" name="captcha_key" id="captcha_key" /><br />
3114	<?php echo __('Get the Site Key and Secret Key from <a href="https://www.google.com/recaptcha/admin/" target="_blank">Google</a>', 'loginizer'); ?>
3115	</td>
3116	</tr>
3117	<tr class="lz_google_cap">
3118	<td scope="row" valign="top"><label for="captcha_secret"><b><?php echo __('Secret Key', 'loginizer'); ?></b></label></td>
3119	<td>
3120	<input type="text" size="50" value="<?php echo lz_optpost('captcha_secret', $loginizer['captcha_secret']); ?>" name="captcha_secret" id="captcha_secret" />
3121	</td>
3122	</tr>
3123	<tr class="lz_google_cap">
3124	<td scope="row" valign="top"><label for="captcha_theme"><b><?php echo __('Theme', 'loginizer'); ?></b></label></td>
3125	<td>
3126	<select name="captcha_theme" id="captcha_theme">
3127	<?php
3128	foreach($lz_env['theme'] as $k => $v){
3129	echo '<option '.lz_POSTselect('captcha_theme', $k, ($loginizer['captcha_theme'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3130	}
3131	?>
3132	</select>
3133	</td>
3134	</tr>
3135	<tr class="lz_google_cap">
3136	<td scope="row" valign="top"><label for="captcha_lang"><b><?php echo __('Language', 'loginizer'); ?></b></label></td>
3137	<td>
3138	<select name="captcha_lang" id="captcha_lang">
3139	<?php
3140	foreach($lz_env['lang'] as $k => $v){
3141	echo '<option '.lz_POSTselect('captcha_lang', $k, ($loginizer['captcha_lang'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3142	}
3143	?>
3144	</select>
3145	</td>
3146	</tr>
3147	<tr class="lz_google_cap lz_google_cap_size">
3148	<td scope="row" valign="top"><label for="captcha_size"><b><?php echo __('Size', 'loginizer'); ?></b></label></td>
3149	<td>
3150	<select name="captcha_size" id="captcha_size">
3151	<?php
3152	foreach($lz_env['size'] as $k => $v){
3153	echo '<option '.lz_POSTselect('captcha_size', $k, ($loginizer['captcha_size'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3154	}
3155	?>
3156	</select>
3157	</td>
3158	</tr>
3159	<tr class="lz_google_cap">
3160	<td scope="row" valign="top">
3161	<label for="captcha_domain"><b><?php echo __('reCAPTCHA Domain', 'loginizer'); ?></b></label><br>
3162	<?php echo __('If Google is not accessible or blocked in your country select other one', 'loginizer'); ?>
3163	</td>
3164	<td>
3165	<select name="captcha_domain" id="captcha_domain">
3166	<?php
3167	foreach($lz_env['captcha_domains'] as $k => $v){
3168	echo '<option '.lz_POSTselect('captcha_domain', $k, ($loginizer['captcha_domain'] == $k ? true : false)).' value="'.$k.'">'.$v.($k == 'www.google.com' ? ' '.__('(Default)', 'loginizer') : '').'</value>';
3169	}
3170	?>
3171	</select>
3172	</td>
3173	</tr>
3174	<tr class="lz_math_cap">
3175	<td scope="row" valign="top">
3176	<label for="captcha_text"><b><?php echo __('Captcha Text', 'loginizer'); ?></b></label><br>
3177	<?php echo __('The text to be shown for the Captcha Field', 'loginizer'); ?>
3178	</td>
3179	<td>
3180	<input type="text" size="30" value="<?php echo lz_optpost('captcha_text', @$loginizer['captcha_text']); ?>" name="captcha_text" id="captcha_text" />
3181	</td>
3182	</tr>
3183	<tr class="lz_math_cap">
3184	<td scope="row" valign="top">
3185	<label for="captcha_time"><b><?php echo __('Captcha Time', 'loginizer'); ?></b></label><br>
3186	<?php echo __('Enter the number of seconds, a user has to enter captcha value.', 'loginizer'); ?>
3187	</td>
3188	<td>
3189	<input type="text" size="30" value="<?php echo lz_optpost('captcha_time', @$loginizer['captcha_time']); ?>" name="captcha_time" id="captcha_time" />
3190	</td>
3191	</tr>
3192	<tr class="lz_math_cap">
3193	<td scope="row" valign="top">
3194	<label for="captcha_words"><b><?php echo __('Display Captcha in Words', 'loginizer'); ?></b></label><br>
3195	<?php echo __('If selected the Captcha will be displayed in words rather than numbers', 'loginizer'); ?>
3196	</td>
3197	<td>
3198	<input type="checkbox" value="1" name="captcha_words" id="captcha_words" <?php echo lz_POSTchecked('captcha_words', (empty($loginizer['captcha_words']) ? false : true));?> />
3199	</td>
3200	</tr>
3201	<tr class="lz_math_cap">
3202	<td scope="row" valign="top" style="vertical-align: top !important;">
3203	<label><b><?php echo __('Mathematical operations', 'loginizer'); ?></b></label><br>
3204	<?php echo __('The Mathematical operations to use for Captcha', 'loginizer'); ?>
3205	</td>
3206	<td valign="top">
3207	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3208	<?php echo '
3209	<tr>
3210	<td><label for="captcha_add">'.__('Addition (+)', 'loginizer').'</label></td>
3211	<td><input type="checkbox" value="1" name="captcha_add" id="captcha_add" '.lz_POSTchecked('captcha_add', (empty($loginizer['captcha_add']) ? false : true)).' /></td>
3212	</tr>
3213	<tr>
3214	<td><label for="captcha_subtract">'.__('Subtraction (-)', 'loginizer').'</label></td>
3215	<td><input type="checkbox" value="1" name="captcha_subtract" id="captcha_subtract" '.lz_POSTchecked('captcha_subtract', (empty($loginizer['captcha_subtract']) ? false : true)).' /></td>
3216	</tr>
3217	<tr>
3218	<td><label for="captcha_multiply">'.__('Multiplication (x)', 'loginizer').'</label></td>
3219	<td><input type="checkbox" value="1" name="captcha_multiply" id="captcha_multiply" '.lz_POSTchecked('captcha_multiply', (empty($loginizer['captcha_multiply']) ? false : true)).' /></td>
3220	</tr>
3221	<tr>
3222	<td><label for="captcha_divide">'.__('Division (÷)', 'loginizer').'</label></td>
3223	<td><input type="checkbox" value="1" name="captcha_divide" id="captcha_divide" '.lz_POSTchecked('captcha_divide', (empty($loginizer['captcha_divide']) ? false : true)).' /></td>
3224	</tr>';
3225	?>
3226	</table>
3227	</td>
3228	</tr>
3229	<tr class="lz_cap">
3230	<td scope="row" valign="top"><label><b><?php echo __('Show Captcha On', 'loginizer'); ?></b></label></td>
3231	<td valign="top">
3232	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3233	<?php echo '
3234	<tr>
3235	<td><label for="captcha_login">'.__('Login Form', 'loginizer').'</label></td>
3236	<td><input type="checkbox" value="1" name="captcha_login" id="captcha_login" '.lz_POSTchecked('captcha_login', (empty($loginizer['captcha_login']) ? false : true)).' /></td>
3237	</tr>
3238	<tr>
3239	<td><label for="captcha_lostpass">'.__('Lost Password Form', 'loginizer').'</label></td>
3240	<td><input type="checkbox" value="1" name="captcha_lostpass" id="captcha_lostpass" '.lz_POSTchecked('captcha_lostpass', (empty($loginizer['captcha_lostpass']) ? false : true)).' /></td>
3241	</tr>
3242	<tr>
3243	<td><label for="captcha_resetpass">'.__('Reset Password Form', 'loginizer').'</label></td>
3244	<td><input type="checkbox" value="1" name="captcha_resetpass" id="captcha_resetpass" '.lz_POSTchecked('captcha_resetpass', (empty($loginizer['captcha_resetpass']) ? false : true)).' /></td>
3245	</tr>
3246	<tr>
3247	<td><label for="captcha_register">'.__('Registration Form', 'loginizer').'</label></td>
3248	<td><input type="checkbox" value="1" name="captcha_register" id="captcha_register" '.lz_POSTchecked('captcha_register', (empty($loginizer['captcha_register']) ? false : true)).' /></td>
3249	</tr>
3250	<tr>
3251	<td><label for="captcha_comment">'.__('Comment Form', 'loginizer').'</label></td>
3252	<td><input type="checkbox" value="1" name="captcha_comment" id="captcha_comment" '.lz_POSTchecked('captcha_comment', (empty($loginizer['captcha_comment']) ? false : true)).' /></td>
3253	</tr>';
3254
3255	if(!defined('SITEPAD')){
3256
3257	echo '<tr>
3258	<td><label for="captcha_wc_checkout">'.__('WooCommerce Checkout', 'loginizer').'</label></td>
3259	<td><input type="checkbox" value="1" name="captcha_wc_checkout" id="captcha_wc_checkout" '.lz_POSTchecked('captcha_wc_checkout', (empty($loginizer['captcha_wc_checkout']) ? false : true)).' /></td>
3260	</tr>';
3261
3262	}
3263
3264	?>
3265	</table>
3266	</td>
3267	</tr>
3268	<tr class="lz_cap">
3269	<td scope="row" valign="top"><label for="captcha_user_hide"><b><?php echo __('Hide CAPTCHA for logged in Users', 'loginizer'); ?></b></label></td>
3270	<td>
3271	<input type="checkbox" value="1" name="captcha_user_hide" id="captcha_user_hide" <?php echo lz_POSTchecked('captcha_user_hide', (empty($loginizer['captcha_user_hide']) ? false : true)); ?> />
3272	</td>
3273	</tr>
3274	<tr class="lz_google_cap">
3275	<td scope="row" valign="top"><label for="captcha_no_css_login"><b><?php echo __('Disable CSS inserted on Login Page', 'loginizer'); ?></b></label></td>
3276	<td>
3277	<input type="checkbox" value="1" name="captcha_no_css_login" id="captcha_no_css_login" <?php echo lz_POSTchecked('captcha_no_css_login', (empty($loginizer['captcha_no_css_login']) ? false : true)); ?> />
3278	</td>
3279	</tr>
3280	</table><br />
3281	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" /></center>
3282	</form>
3283
3284	</div>
3285	</div>
3286	<br />
3287
3288	<script type="text/javascript">
3289
3290	function lz_captcha_status(){
3291
3292	var cur_captcha_status = jQuery("#captcha_status option:selected").val();
3293
3294	if(cur_captcha_status == 1){
3295	jQuery(".lz_google_cap").show();
3296	jQuery(".lz_math_cap").hide();
3297	jQuery(".lz_cap").show();
3298	google_recaptcha_type();
3299
3300	}else if(cur_captcha_status == 2){
3301	jQuery(".lz_google_cap").hide();
3302	jQuery(".lz_math_cap").show();
3303	jQuery(".lz_cap").show();
3304	}else{
3305	jQuery(".lz_google_cap").hide();
3306	jQuery(".lz_math_cap").hide();
3307	jQuery(".lz_cap").hide();
3308	}
3309
3310	}
3311
3312	function google_recaptcha_type(){
3313
3314	var cur_captcha_type = jQuery("input:radio[name='captcha_type']:checked").val();
3315
3316	if(cur_captcha_type == 'v3' \|\| cur_captcha_type == 'v2_invisible'){
3317	jQuery(".lz_google_cap_size").hide();
3318	}else{
3319	jQuery(".lz_google_cap_size").show();
3320	}
3321
3322	}
3323
3324	jQuery(document).ready(function(){
3325	lz_captcha_status();
3326	});
3327
3328	</script>
3329
3330	<?php
3331	loginizer_page_footer();
3332
3333	}
3334
3335
3336	// Loginizer - Two Factor Auth Page
3337	function loginizer_page_2fa(){
3338
3339	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3340
3341	if(!current_user_can('manage_options')){
3342	wp_die('Sorry, but you do not have permissions to change settings.');
3343	}
3344
3345	if(!loginizer_is_premium() && count($_POST) > 0){
3346	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3347	return loginizer_page_2fa_T();
3348	}
3349
3350	$lz_roles = get_editable_roles();
3351
3352	if(empty($lz_roles)){
3353	$lz_roles = array();
3354	}
3355
3356	/* Make sure post was from this page */
3357	if(count($_POST) > 0){
3358	check_admin_referer('loginizer-options');
3359	}
3360
3361	// Settings submitted
3362	if(isset($_POST['save_lz'])){
3363
3364	// In the future there can be more settings
3365	$option['2fa_app'] = (int) lz_optpost('2fa_app');
3366	$option['2fa_email'] = (int) lz_optpost('2fa_email');
3367	$option['question'] = (int) lz_optpost('question');
3368	$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
3369
3370	// Any roles to apply to ?
3371	foreach($lz_roles as $k => $v){
3372
3373	if(lz_optpost('2fa_roles_'.$k)){
3374	$option['2fa_roles'][$k] = 1;
3375	}
3376
3377	}
3378
3379	// If its all, then blank it
3380	if(lz_optpost('2fa_roles_all') \|\| empty($option['2fa_roles'])){
3381	$option['2fa_roles'] = '';
3382	}
3383
3384	// Is there an error ?
3385	if(!empty($lz_error)){
3386	return loginizer_page_2fa_T();
3387	}
3388
3389	// Save the options
3390	update_option('loginizer_2fa', $option);
3391
3392	// Mark as saved
3393	$GLOBALS['lz_saved'] = true;
3394
3395	// update the rewrite rules for WooCommerce to make security settings page accessible from woo commerce client area
3396	if((!empty($option['2fa_app']) \|\| !empty($option['2fa_email']) \|\| !empty($option['question']) \|\| !empty($option['2fa_email_force'])) && class_exists('WooCommerce')){
3397	loginizer_woocommerce_rewrite_rule();
3398	}
3399
3400	}
3401
3402	// Reset a users 2FA
3403	if(isset($_POST['reset_user_lz'])){
3404
3405	$_username = lz_optpost('lz_user_2fa_disable');
3406
3407	// Try to get the user
3408	$user_search = get_user_by('login', $_username);
3409
3410	// If not found then search by email
3411	if(empty($user_search)){
3412	$user_search = get_user_by('email', $_username);
3413	}
3414
3415	// If not found then give error
3416	if(empty($user_search)){
3417	$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
3418	return loginizer_page_2fa_T();
3419	}
3420
3421	// Get the user prefences
3422	$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
3423
3424	// Blank it
3425	$user_pref['pref'] = 'none';
3426
3427	// Save it
3428	update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
3429
3430	// Mark as saved
3431	$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
3432
3433	}
3434
3435	if(isset($_POST['save_2fa_custom_redirect'])){
3436
3437	if(!empty($_POST['lz_2fa_custom_login_redirect'])){
3438	$loginizer['2fa_custom_login_redirect'] = map_deep($_POST['lz_2fa_custom_login_redirect'], 'sanitize_text_field');
3439
3440	update_option('loginizer_2fa_custom_redirect', $loginizer['2fa_custom_login_redirect']);
3441
3442	$GLOBALS['lz_saved'] = true;
3443	}
3444	}
3445
3446	if(isset($_POST['save_2fa_email_template_lz'])){
3447
3448	// In the future there can be more settings
3449	$option['2fa_email_sub'] = @stripslashes($_POST['lz_2fa_email_sub']);
3450	$option['2fa_email_msg'] = @stripslashes($_POST['lz_2fa_email_msg']);
3451
3452	// Is there an error ?
3453	if(!empty($lz_error)){
3454	return loginizer_page_2fa_T();
3455	}
3456
3457	// Save the options
3458	update_option('loginizer_2fa_email_template', $option);
3459
3460	// Mark as saved
3461	$GLOBALS['lz_saved'] = true;
3462
3463	}
3464
3465	// Save the messages
3466	if(isset($_POST['save_msgs_lz'])){
3467
3468	$msgs['otp_app'] = lz_optpost('msg_otp_app');
3469	$msgs['otp_email'] = lz_optpost('msg_otp_email');
3470	$msgs['otp_field'] = lz_optpost('msg_otp_field');
3471	$msgs['otp_question'] = lz_optpost('msg_otp_question');
3472	$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
3473
3474	// Update them
3475	update_option('loginizer_2fa_msg', $msgs);
3476
3477	// Mark as saved
3478	$GLOBALS['lz_saved'] = __('Messages were saved successfully', 'loginizer');
3479
3480	}
3481
3482	// Delete a Whitelist IP range
3483	if(isset($_POST['delid'])){
3484
3485	$delid = (int) lz_optreq('delid');
3486
3487	// Unset and save
3488	$whitelist = $loginizer['2fa_whitelist'];
3489	unset($whitelist[$delid]);
3490	update_option('loginizer_2fa_whitelist', $whitelist);
3491
3492	// Mark as saved
3493	$GLOBALS['lz_saved'] = __('The Whitelist IP range has been deleted successfully', 'loginizer');
3494
3495	}
3496
3497	// Delete all Blackist IP ranges
3498	if(isset($_POST['del_all_whitelist'])){
3499
3500	// Unset and save
3501	update_option('loginizer_2fa_whitelist', array());
3502
3503	// Mark as saved
3504	$GLOBALS['lz_saved'] = __('The Whitelist IP range(s) have been cleared successfully', 'loginizer');
3505
3506	}
3507
3508	// Add IP range to 2FA whitelist
3509	if(isset($_POST['2fa_whitelist_iprange'])){
3510
3511	$start_ip = lz_optpost('start_ip_w_2fa');
3512	$end_ip = lz_optpost('end_ip_w_2fa');
3513
3514	if(empty($start_ip)){
3515	$lz_error[] = __('Please enter the Start IP', 'loginizer');
3516	return loginizer_page_2fa_T();
3517	}
3518
3519	// If no end IP we consider only 1 IP
3520	if(empty($end_ip)){
3521	$end_ip = $start_ip;
3522	}
3523
3524	if(!lz_valid_ip($start_ip)){
3525	$lz_error[] = __('Please provide a valid start IP', 'loginizer');
3526	}
3527
3528	if(!lz_valid_ip($end_ip)){
3529	$lz_error[] = __('Please provide a valid end IP', 'loginizer');
3530	}
3531
3532	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
3533
3534	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
3535	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
3536	// This is right
3537	}else{
3538	$lz_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
3539	}
3540
3541	}
3542
3543	if(empty($lz_error)){
3544
3545	$whitelist = $loginizer['2fa_whitelist'];
3546
3547	foreach($whitelist as $k => $v){
3548
3549	// This is to check if there is any other range exists with the same Start or End IP
3550	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
3551	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
3552	){
3553	$lz_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
3554	break;
3555	}
3556
3557	// This is to check if there is any other range exists with the same Start IP
3558	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
3559	$lz_error[] = __('The Start IP is present in an existing range !', 'loginizer');
3560	break;
3561	}
3562
3563	// This is to check if there is any other range exists with the same End IP
3564	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
3565	$lz_error[] = __('The End IP is present in an existing range!', 'loginizer');
3566	break;
3567	}
3568
3569	}
3570
3571	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
3572
3573	if(empty($lz_error)){
3574
3575	$whitelist[$newid] = array();
3576	$whitelist[$newid]['start'] = $start_ip;
3577	$whitelist[$newid]['end'] = $end_ip;
3578	$whitelist[$newid]['time'] = time();
3579
3580	update_option('loginizer_2fa_whitelist', $whitelist);
3581
3582	// Mark as saved
3583	$GLOBALS['lz_saved'] = __('Whitelist IP range for Two Factor Authentication added successfully', 'loginizer');
3584
3585	}
3586
3587	}
3588	}
3589
3590
3591	$lz_options = get_option('loginizer_2fa_email_template');
3592	$saved_msgs = get_option('loginizer_2fa_msg');
3593	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
3594
3595	// Call theme
3596	loginizer_page_2fa_T();
3597
3598	}
3599
3600
3601	// Loginizer - Two Factor Auth Page
3602	function loginizer_page_2fa_T(){
3603
3604	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3605
3606	// Universal header
3607	loginizer_page_header('Two Factor Authentication');
3608
3609	loginizer_feature_available('Two-Factor Authentication');
3610
3611	// Saved ?
3612	if(!empty($GLOBALS['lz_saved'])){
3613	echo '<div id="message" class="updated"><p>'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '</p></div><br />';
3614	}
3615
3616	// Any errors ?
3617	if(!empty($lz_error)){
3618	lz_report_error($lz_error);echo '<br />';
3619	}
3620
3621	?>
3622
3623	<style>
3624	input[type="text"], textarea, select {
3625	width: 70%;
3626	}
3627
3628	.form-table label{
3629	font-weight:bold;
3630	}
3631
3632	.exp{
3633	font-size:12px;
3634	}
3635	</style>
3636
3637	<div id="" class="postbox">
3638
3639	<div class="postbox-header">
3640	<h2 class="hndle ui-sortable-handle">
3641	<span><?php echo __('Two Factor Authentication Settings', 'loginizer'); ?></span>
3642	</h2>
3643	</div>
3644
3645	<div class="inside">
3646
3647	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3648	<?php wp_nonce_field('loginizer-options'); ?>
3649	<table class="form-table">
3650	<tr>
3651	<td scope="row" valign="top" colspan="2">
3652	<i><?php echo __('Please choose from the following Two Factor Authentication methods. Each user can choose any one method from the ones enabled by you. You can enable all or anyone that you would like.', 'loginizer'); ?></i>
3653	</td>
3654	</tr>
3655	<tr>
3656	<td scope="row" valign="top" style="width:70% !important">
3657	<label><?php echo __('OTP via App', 'loginizer'); ?></label><br>
3658	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be obtained from the users mobile app e.g. <b>Google Authenticator, Authy, etc.</b>', 'loginizer'); ?></span>
3659	</td>
3660	<td>
3661	<input type="checkbox" value="1" name="2fa_app" <?php echo lz_POSTchecked('2fa_app', (empty($loginizer['2fa_app']) ? false : true), 'save_lz'); ?> />
3662	</td>
3663	</tr>
3664	<tr>
3665	<td scope="row" valign="top">
3666	<label><?php echo __('OTP via Email', 'loginizer'); ?></label><br>
3667	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be emailed to the user.', 'loginizer'); ?></span>
3668	</td>
3669	<td>
3670	<input type="checkbox" value="1" name="2fa_email" <?php echo lz_POSTchecked('2fa_email', (empty($loginizer['2fa_email']) ? false : true), 'save_lz'); ?> />
3671	</td>
3672	</tr>
3673	<tr>
3674	<td scope="row" valign="top">
3675	<label><?php echo __('User Defined Question & Answer', 'loginizer'); ?></label><br>
3676	<span class="exp"><?php echo __('In this method the user will be asked to set a secret personal question and answer. After entering the correct login credentials, the user will be asked to answer the question set by them, thus increasing the security', 'loginizer'); ?></span>
3677	</td>
3678	<td>
3679	<input type="checkbox" value="1" name="question" <?php echo lz_POSTchecked('question', (empty($loginizer['question']) ? false : true), 'save_lz'); ?> />
3680	</td>
3681	</tr>
3682	</table><br />
3683
3684	<table class="form-table">
3685	<tr>
3686	<td scope="row" valign="top" style="width:70% !important">
3687	<label><?php echo __('Force OTP via Email', 'loginizer'); ?></label><br>
3688	<span class="exp"><?php echo __('If the user does not have any 2FA method selected, this will enforce the OTP via Email for the users.', 'loginizer'); ?></span>
3689	</td>
3690	<td>
3691	<input type="checkbox" value="1" name="2fa_email_force" <?php echo lz_POSTchecked('2fa_email_force', (empty($loginizer['2fa_email_force']) ? false : true), 'save_lz'); ?> />
3692	</td>
3693	</tr>
3694	<tr>
3695	<td scope="row" valign="top" style="width:70% !important">
3696	<label><?php echo __('Apply 2FA to Roles', 'loginizer'); ?></label><br>
3697	<span class="exp"><?php echo __('Select the Roles to which 2FA should be applied.', 'loginizer'); ?></span>
3698	</td>
3699	<td>
3700	<input type="checkbox" value="1" onchange="lz_roles_handle()" name="2fa_roles_all" id="2fa_roles_all" <?php echo lz_POSTchecked('2fa_roles_all', (empty($loginizer['2fa_roles']) ? true : false), 'save_lz'); ?> /> All<br />
3701	<?php
3702
3703	foreach($lz_roles as $k => $v){
3704	echo '<span class="lz_roles"><input type="checkbox" value="1" name="2fa_roles_'.$k.'" '.lz_POSTchecked('2fa_roles_'.$k, (empty($loginizer['2fa_roles'][$k]) ? false : true), 'save_lz').' /> '.$v['name'].'<br /></span>';
3705	}
3706
3707	?>
3708	</td>
3709	</tr>
3710	</table><br />
3711	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3712	</form>
3713
3714	</div>
3715	</div>
3716
3717	<script type="text/javascript">
3718
3719	function lz_roles_handle(){
3720
3721	var obj = jQuery("#2fa_roles_all")[0];
3722
3723	if(obj.checked){
3724	jQuery(".lz_roles").hide();
3725	}else{
3726	jQuery(".lz_roles").show();
3727	}
3728
3729	}
3730
3731	lz_roles_handle();
3732
3733	</script>
3734
3735	<div id="" class="postbox">
3736
3737	<div class="postbox-header">
3738	<h2 class="hndle ui-sortable-handle">
3739	<span><?php echo __('OTP via Email Template', 'loginizer'); ?></span>
3740	</h2>
3741	</div>
3742
3743	<div class="inside">
3744
3745	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3746	<?php wp_nonce_field('loginizer-options'); ?>
3747	<table class="form-table">
3748	<tr>
3749	<td colspan="2" valign="top">
3750	<?php echo __('Customize the email template to be used when sending the OTP to login via Email for 2FA.', 'loginizer'); ?><br>
3751	<?php echo __('If you do not make changes below the default email template will be used !', 'loginizer'); ?>
3752	</td>
3753	</tr>
3754	<tr>
3755	<td scope="row" valign="top" style="width:350px !important">
3756	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3757	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3758	<br />Default : <?php echo @$loginizer['2fa_email_d_sub']; ?>
3759	</td>
3760	<td valign="top">
3761	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_sub']) ? stripslashes($_POST['lz_2fa_email_sub']) : (empty($lz_options['2fa_email_sub']) ? '' : $lz_options['2fa_email_sub'])); ?>" name="lz_2fa_email_sub" />
3762	</td>
3763	</tr>
3764	<tr>
3765	<td scope="row" valign="top">
3766	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3767	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3768	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['2fa_email_d_msg']; ?></pre>
3769	</td>
3770	<td valign="top">
3771	<textarea rows="10" name="lz_2fa_email_msg"><?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_msg']) ? stripslashes($_POST['lz_2fa_email_msg']) : (empty($lz_options['2fa_email_msg']) ? '' : $lz_options['2fa_email_msg'])); ?></textarea>
3772	<br />
3773	Variables :
3774	<br />$otp - The OTP for login
3775	<br />$site_name - The Site Name
3776	<br />$site_url - The Site URL
3777	<br />$email - Users Email
3778	<br />$display_name - Users Display Name
3779	<br />$user_login - Username
3780	<br />$first_name - Users First Name
3781	<br />$last_name - Users Last Name
3782	</td>
3783	</tr>
3784	</table><br />
3785	<center><input name="save_2fa_email_template_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3786	</form>
3787
3788	</div>
3789	</div>
3790
3791	<div id="" class="postbox">
3792
3793	<div class="postbox-header">
3794	<h2 class="hndle ui-sortable-handle">
3795	<span><?php echo __('Custom Messages for OTP', 'loginizer'); ?></span>
3796	</h2>
3797	</div>
3798
3799	<div class="inside">
3800
3801	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3802	<?php wp_nonce_field('loginizer-options'); ?>
3803	<table class="form-table">
3804	<tr>
3805	<td colspan="2" valign="top">
3806	<?php echo __('Customize the title for OTP field displayed to the user on the login form.', 'loginizer'); ?><br>
3807	<?php echo __('If you do not make changes below the default messages will be used !', 'loginizer'); ?>
3808	</td>
3809	</tr>
3810	<tr>
3811	<td scope="row" valign="top" style="width:350px !important">
3812	<label for="msg_otp_app"><?php echo __('OTP via APP','loginizer'); ?></label><br />
3813	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_app']. '"</em>', 'loginizer'); ?>
3814	</td>
3815	<td>
3816	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_app']) ? '' : $saved_msgs['otp_app']); ?>" name="msg_otp_app" id="msg_otp_app" style="width:auto !important;" />
3817	<br />
3818	</td>
3819	</tr>
3820	<tr>
3821	<td scope="row" valign="top" style="width:350px !important">
3822	<label for="msg_otp_email"><?php echo __('OTP via Email','loginizer'); ?></label><br />
3823	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_email']. '"</em>', 'loginizer'); ?>
3824	</td>
3825	<td>
3826	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_email']) ? '' : $saved_msgs['otp_email']); ?>" name="msg_otp_email" id="msg_otp_email" style="width:auto !important;" />
3827	<br />
3828	</td>
3829	</tr>
3830	<tr>
3831	<td scope="row" valign="top" style="width:350px !important">
3832	<label for="msg_otp_field"><?php echo __('Title for OTP field','loginizer'); ?></label><br />
3833	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_field']. '"</em>', 'loginizer'); ?>
3834	</td>
3835	<td>
3836	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_field']) ? '' : $saved_msgs['otp_field']); ?>" name="msg_otp_field" id="msg_otp_field" style="width:auto !important;" />
3837	<br />
3838	</td>
3839	</tr>
3840	<tr>
3841	<td scope="row" valign="top" style="width:350px !important">
3842	<label for="msg_otp_question"><?php echo __('Title for Security Question','loginizer'); ?></label><br />
3843	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_question']. '"</em>', 'loginizer'); ?>
3844	</td>
3845	<td>
3846	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_question']) ? '' : $saved_msgs['otp_question']); ?>" name="msg_otp_question" id="msg_otp_question" style="width:auto !important;" />
3847	<br />
3848	</td>
3849	</tr>
3850	<tr>
3851	<td scope="row" valign="top" style="width:350px !important">
3852	<label for="msg_otp_answer"><?php echo __('Title for Security Answer','loginizer'); ?></label><br />
3853	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_answer']. '"</em>', 'loginizer'); ?>
3854	</td>
3855	<td>
3856	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_answer']) ? '' : $saved_msgs['otp_answer']); ?>" name="msg_otp_answer" id="msg_otp_answer" style="width:auto !important;" />
3857	<br />
3858	</td>
3859	</tr>
3860	</table><br />
3861	<center><input name="save_msgs_lz" class="button button-primary action" value="<?php echo __('Save Messages','loginizer'); ?>" type="submit" /></center>
3862	</form>
3863	</div>
3864	</div>
3865
3866	<!--Bypass a single user-->
3867	<div id="" class="postbox">
3868
3869	<div class="postbox-header">
3870	<h2 class="hndle ui-sortable-handle">
3871	<span><?php echo __('Disable Two Factor Authentication for a User', 'loginizer'); ?></span>
3872	</h2>
3873	</div>
3874
3875	<div class="inside">
3876
3877	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3878	<?php wp_nonce_field('loginizer-options'); ?>
3879	<table class="form-table">
3880	<tr>
3881	<td scope="row" valign="top" colspan="2">
3882	<i><?php echo __('Here you can disable the Two Factor Authentication settings of a user. In the event a user has forgotten his secret answer or lost his Device App, he will not be able to login. You can reset such a users settings from here.', 'loginizer'); ?></i>
3883	</td>
3884	</tr>
3885	<tr>
3886	<td scope="row" valign="top">
3887	<label><?php echo __('Username / Email', 'loginizer'); ?></label><br>
3888	<span class="exp"><?php echo __('The username or email of the user whose 2FA you would like to disable', 'loginizer'); ?></span>
3889	</td>
3890	<td>
3891	<input type="text" size="50" value="<?php echo lz_optpost('lz_user_2fa_disable', ''); ?>" name="lz_user_2fa_disable" />
3892	</td>
3893	</tr>
3894	</table><br />
3895
3896	<center><input name="reset_user_lz" class="button button-primary action" value="<?php echo __('Reset 2FA for User', 'loginizer'); ?>" type="submit" /></center>
3897	</form>
3898
3899	</div>
3900	</div>
3901
3902	<br />
3903
3904	<?php
3905
3906	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
3907
3908	?>
3909
3910	<style>
3911	.page-navigation a {
3912	margin: 5px 2px;
3913	display: inline-block;
3914	padding: 5px 8px;
3915	color: #0073aa;
3916	background: #e5e5e5 none repeat scroll 0 0;
3917	border: 1px solid #ccc;
3918	text-decoration: none;
3919	transition-duration: 0.05s;
3920	transition-property: border, background, color;
3921	transition-timing-function: ease-in-out;
3922	}
3923
3924	.page-navigation a[data-selected] {
3925	background-color: #00a0d2;
3926	color: #fff;
3927	}
3928	</style>
3929
3930	<script>
3931
3932	jQuery(document).ready(function(){
3933	jQuery('#lz_wl_2fa_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_2fa_nav')});
3934	});
3935
3936	// Delete a 2FA Whitelist IP Range
3937	function del_2fa_confirm(field, todo_id, msg){
3938	var ret = confirm(msg);
3939
3940	if(ret){
3941	jQuery('#lz_wl_2fa_todo').attr('name', field);
3942	jQuery('#lz_wl_2fa_todo').val(todo_id);
3943	jQuery('#lz_wl_2fa_form').submit();
3944	}
3945
3946	return false;
3947
3948	}
3949
3950	// Delete all 2FA Whitelist IP Ranges
3951	function del_2fa_confirm_all(msg){
3952	var ret = confirm(msg);
3953
3954	if(ret){
3955	return true;
3956	}
3957
3958	return false;
3959
3960	}
3961
3962	</script>
3963
3964	<div id="" class="postbox">
3965
3966	<div class="postbox-header">
3967	<h2 class="hndle ui-sortable-handle">
3968	<span><?php echo __('Disable Two Factor Authentication for IP', 'loginizer'); ?></span>
3969	</h2>
3970	</div>
3971
3972	<div class="inside">
3973
3974	<?php echo __('Enter the IP you want to whitelist for two factor authentication', 'loginizer'); ?>
3975	<form action="" method="post" loginizer-premium-only="1">
3976	<?php wp_nonce_field('loginizer-options'); ?>
3977	<table class="form-table">
3978	<tr>
3979	<th scope="row" valign="top"><label for="start_ip_w_2fa"><?php echo __('Start IP','loginizer'); ?></label></th>
3980	<td>
3981	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('start_ip_w_2fa')); ?>" name="start_ip_w_2fa" id="start_ip_w_2fa"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
3982	</td>
3983	</tr>
3984	<tr>
3985	<th scope="row" valign="top"><label for="end_ip_w_2fa"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
3986	<td>
3987	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('end_ip_w_2fa')); ?>" name="end_ip_w_2fa" id="end_ip_w_2fa"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
3988	</td>
3989	</tr>
3990	</table><br />
3991	<input name="2fa_whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
3992	<input style="float:right" name="del_all_whitelist" onclick="return del_2fa_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) for 2FA ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s) for 2FA','loginizer'); ?>" type="submit" />
3993	</form>
3994	</div>
3995
3996	<div id="lz_wl_2fa_nav" style="margin: 5px 10px; text-align:right"></div>
3997	<table id="lz_wl_2fa_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
3998	<tr>
3999	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
4000	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
4001	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
4002	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
4003	</tr>
4004	<?php
4005	if(empty($loginizer['2fa_whitelist'])){
4006	echo '
4007	<tr>
4008	<td colspan="4">
4009	'.__('No Whitelist IPs for Two Factor Authentication. You will see whitelisted IP ranges here.', 'loginizer').'
4010	</td>
4011	</tr>';
4012	}else{
4013	foreach($loginizer['2fa_whitelist'] as $ik => $iv){
4014	echo '
4015	<tr>
4016	<td>
4017	'.$iv['start'].'
4018	</td>
4019	<td>
4020	'.$iv['end'].'
4021	</td>
4022	<td>
4023	'.date('d/m/Y', $iv['time']).'
4024	</td>
4025	<td>
4026	<a class="submitdelete" href="javascript:void(0)" onclick="return del_2fa_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range for 2FA ?\')">Delete</a>
4027	</td>
4028	</tr>';
4029	}
4030	}
4031	?>
4032	</table>
4033	<br />
4034	<form action="" method="post" id="lz_wl_2fa_form">
4035	<?php wp_nonce_field('loginizer-options'); ?>
4036	<input type="hidden" value="" name="" id="lz_wl_2fa_todo"/>
4037	</form>
4038	<br />
4039
4040	</div>
4041
4042	<!--Custom Redirects based on role-->
4043	<div id="" class="postbox">
4044
4045	<div class="postbox-header">
4046	<h2 class="hndle ui-sortable-handle">
4047	<span><?php echo __('Custom Redirects based on roles', 'loginizer'); ?><span style="color:red; margin-left:5px;">New</span></span>
4048	</h2>
4049	</div>
4050
4051	<div class="inside">
4052
4053	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4054	<?php wp_nonce_field('loginizer-options'); ?>
4055	<table class="form-table">
4056	<tr>
4057	<td scope="row" valign="top" colspan="2">
4058	<i><?php echo __('Here you can set the URL, which you wish your user to get redirected to after login via 2FA.', 'loginizer'); ?></i>
4059	</td>
4060	</tr>
4061	<?php
4062	global $wp_roles;
4063
4064	foreach($wp_roles->roles as $key => $role){
4065	echo'<tr>
4066	<td scope="row" valign="top">
4067	<label>'. esc_html($role['name']).'</label><br>
4068	</td>
4069	<td>
4070	<input type="text" size="50" value="'.(!empty($loginizer['2fa_custom_login_redirect']) && !empty($loginizer['2fa_custom_login_redirect'][$key]) ? esc_attr($loginizer['2fa_custom_login_redirect'][$key]) : '').'" placeholder="'.site_url().'" name="lz_2fa_custom_login_redirect['.esc_html($key).']" />
4071	</td>
4072	</tr>';
4073	}
4074	?>
4075
4076	</table><br />
4077
4078	<center><input name="save_2fa_custom_redirect" class="button button-primary action" value="<?php echo __('Save Custom URLs', 'loginizer'); ?>" type="submit" /></center>
4079	</form>
4080
4081	</div>
4082	</div>
4083
4084	<?php
4085	loginizer_page_footer();
4086
4087	}
4088
4089	// Loginizer - PasswordLess Page
4090	function loginizer_page_passwordless(){
4091
4092	global $loginizer, $lz_error, $lz_env;
4093
4094	if(!current_user_can('manage_options')){
4095	wp_die('Sorry, but you do not have permissions to change settings.');
4096	}
4097
4098	if(!loginizer_is_premium() && count($_POST) > 0){
4099	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4100	return loginizer_page_passwordless_T();
4101	}
4102
4103	/* Make sure post was from this page */
4104	if(count($_POST) > 0){
4105	check_admin_referer('loginizer-options');
4106	}
4107
4108	if(isset($_POST['save_lz'])){
4109
4110	// In the future there can be more settings
4111	$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
4112	$option['passwordless_sub'] = @stripslashes($_POST['lz_passwordless_sub']);
4113	$option['passwordless_msg'] = @stripslashes($_POST['lz_passwordless_msg']);
4114	$option['passwordless_html'] = (int) lz_optpost('lz_passwordless_html');
4115	$option['passwordless_redirect'] = esc_url_raw($_POST['lz_passwordless_redirect']);
4116	$option['passwordless_redirect_for'] = map_deep($_POST['lz_passwordless_redirect_for'], 'sanitize_text_field');
4117
4118	// Is there an error ?
4119	if(!empty($lz_error)){
4120	return loginizer_page_passwordless_T();
4121	}
4122
4123	// Save the options
4124	update_option('loginizer_epl', $option);
4125
4126	// Mark as saved
4127	$GLOBALS['lz_saved'] = true;
4128
4129	}
4130
4131	// Call theme
4132	loginizer_page_passwordless_T();
4133	}
4134
4135	// Loginizer - PasswordLess Page Theme
4136	function loginizer_page_passwordless_T(){
4137
4138	global $loginizer, $lz_error, $lz_env;
4139
4140	$lz_options = get_option('loginizer_epl');
4141
4142	// Universal header
4143	loginizer_page_header('PasswordLess Settings');
4144
4145	loginizer_feature_available('PasswordLess Login');
4146
4147	// Saved ?
4148	if(!empty($GLOBALS['lz_saved'])){
4149	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4150	}
4151
4152	// Any errors ?
4153	if(!empty($lz_error)){
4154	lz_report_error($lz_error);echo '<br />';
4155	}
4156
4157	?>
4158
4159	<style>
4160	input[type="text"], textarea, select {
4161	width: 90%;
4162	}
4163
4164	.form-table label{
4165	font-weight:bold;
4166	}
4167
4168	.form-table td{
4169	vertical-align:top;
4170	}
4171
4172	.exp{
4173	font-size:12px;
4174	}
4175	</style>
4176
4177	<div id="" class="postbox">
4178
4179	<div class="postbox-header">
4180	<h2 class="hndle ui-sortable-handle">
4181	<span><?php echo __('PasswordLess Settings', 'loginizer'); ?></span>
4182	</h2>
4183	</div>
4184
4185	<div class="inside">
4186
4187	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4188	<?php wp_nonce_field('loginizer-options'); ?>
4189	<table class="form-table">
4190	<tr>
4191	<td scope="row" valign="top" style="width:350px !important"><label for="email_pass_less"><?php echo __('Enable PasswordLess Login', 'loginizer'); ?></label></td>
4192	<td>
4193	<input type="checkbox" value="1" name="email_pass_less" id="email_pass_less" <?php echo lz_POSTchecked('email_pass_less', (empty($loginizer['email_pass_less']) ? false : true)); echo (defined('SITEPAD') ? 'disabled="disabled"' : '') ?> />
4194	</td>
4195	</tr>
4196	<tr>
4197	<td colspan="2" valign="top">
4198	<?php echo __('If enabled, the login screen will just ask for the username <b>OR</b> email address of the user. If such a user exists, an email with a <b>One Time Login </b> link will be sent to the email address of the user. The link will be valid for 10 minutes only.', 'loginizer'); ?><br><br>
4199	<?php echo __('If a wrong username/email is given, the brute force checker will prevent any brute force attempt !', 'loginizer'); ?>
4200	</td>
4201	</tr>
4202	<tr>
4203	<td scope="row" valign="top">
4204	<label for="lz_passwordless_sub"><?php echo __('Email Subject', 'loginizer'); ?></label><br>
4205	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
4206	<br />Default : <?php echo @$loginizer['pl_d_sub']; ?>
4207	</td>
4208	<td valign="top">
4209	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_passwordless_sub']) ? stripslashes($_POST['lz_passwordless_sub']) : (empty($lz_options['passwordless_sub']) ? '' : $lz_options['passwordless_sub'])); ?>" name="lz_passwordless_sub" id="lz_passwordless_sub" />
4210	</td>
4211	</tr>
4212	<tr>
4213	<td scope="row" valign="top">
4214	<label for="lz_passwordless_msg"><?php echo __('Email Body', 'loginizer'); ?></label><br>
4215	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
4216	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['pl_d_msg']; ?></pre>
4217	</td>
4218	<td valign="top">
4219	<textarea rows="10" name="lz_passwordless_msg" id="lz_passwordless_msg"><?php echo lz_htmlizer(!empty($_POST['lz_passwordless_msg']) ? stripslashes($_POST['lz_passwordless_msg']) : (empty($lz_options['passwordless_msg']) ? '' : $lz_options['passwordless_msg'])); ?></textarea>
4220	<br />
4221	Variables :
4222	<br />$email - Users Email
4223	<br />$site_name - The Site Name
4224	<br />$site_url - The Site URL
4225	<br />$login_url - The Login URL
4226	</td>
4227	</tr>
4228	<tr>
4229	<td scope="row" valign="top"><label for="lz_passwordless_html"><?php echo __('Send email as HTML', 'loginizer'); ?></label></td>
4230	<td>
4231	<input type="checkbox" value="1" name="lz_passwordless_html" id="lz_passwordless_html" <?php echo lz_POSTchecked('lz_passwordless_html', (empty($loginizer['passwordless_html']) ? false : true)); ?> />
4232	</td>
4233	</tr>
4234	<tr>
4235	<td scope="row" valign="top" style="width:350px !important">
4236	<label for="lz_passwordless_redirect"><?php echo __('Custom redirect to', 'loginizer'); ?></label><br/>
4237	<span class="exp"><?php echo __('Redirects user to a page of your website other than the admin panel', 'loginizer'); ?></span>
4238	</td>
4239	<td align="top">
4240	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_passwordless_redirect']) ? stripslashes($_POST['lz_passwordless_redirect']) : (empty($lz_options['passwordless_redirect']) ? '' : $lz_options['passwordless_redirect'])); ?>" name="lz_passwordless_redirect" id="lz_passwordless_redirect" />
4241	</td>
4242	</tr>
4243
4244	<tr>
4245	<td scope="row" valign="top" style="width:350px !important">
4246	<label for="lz_passwordless_redirect_for"><?php echo __('Custom redirect for', 'loginizer'); ?></label><br/>
4247	<span class="exp"><?php echo __('Select the user roles for whom this custom redirect will be used', 'loginizer'); ?></span>
4248	</td>
4249	<td align="top">
4250	<?php
4251	$editable_roles = get_editable_roles();
4252	echo '<div style="max-height:120px; overflow:auto;">';
4253	$r = '';
4254	foreach($editable_roles as $role => $details) {
4255	$name = translate_user_role( $details['name'] );
4256	// Preselect specified role.
4257	if(!empty($lz_options['passwordless_redirect_for']) && in_array($role, $lz_options['passwordless_redirect_for'])) {
4258	$r .= "\n\t<input type=\"checkbox\" checked name=\"lz_passwordless_redirect_for[]\" value='" . esc_attr($role) . "' style=\"margin-top:5px\">$name</option>";
4259	} else {
4260	$r .= "\n\t<input type=\"checkbox\" value='" . esc_attr($role) . "' name=\"lz_passwordless_redirect_for[]\">$name</option>";
4261	}
4262
4263	$r .= '<br/>';
4264	}
4265	echo $r . '</div>';
4266	?>
4267	</td>
4268	</tr>
4269
4270	</table><br />
4271	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4272	</form>
4273
4274	</div>
4275	</div>
4276	<br />
4277
4278	<?php
4279	loginizer_page_footer();
4280
4281	}
4282
4283	// Loginizer - Security Settings Page
4284	function loginizer_page_security(){
4285
4286	global $loginizer, $lz_error, $lz_env, $wpdb;
4287
4288	if(!current_user_can('manage_options')){
4289	wp_die('Sorry, but you do not have permissions to change settings.');
4290	}
4291
4292	if(!loginizer_is_premium() && count($_POST) > 0){
4293	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4294	return loginizer_page_security_T();
4295	}
4296
4297	/* Make sure post was from this page */
4298	if(count($_POST) > 0){
4299	check_admin_referer('loginizer-options');
4300	}
4301
4302	if(isset($_POST['save_lz'])){
4303
4304	$option['login_slug'] = lz_optpost('login_slug');
4305	$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
4306	$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
4307	$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
4308	$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
4309
4310	// Login Slug Valid ?
4311	if(!empty($option['login_slug'])){
4312	if(strlen($option['login_slug']) <= 4 \|\| strlen($option['login_slug']) > 50){
4313	$lz_error['login_slug'] = __('The Login slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4314	}
4315	}
4316
4317	// login slug and admin slug cannot be the same
4318	$_loginizer_wp_admin = get_option('loginizer_wp_admin');
4319	if(!empty($_loginizer_wp_admin['admin_slug']) && $_loginizer_wp_admin['admin_slug'] == $option['login_slug']){
4320	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4321	return loginizer_page_security_T();
4322	}
4323
4324	// XML-RPC Slug Valid ?
4325	if(!empty($option['xmlrpc_slug'])){
4326	if(strlen($option['xmlrpc_slug']) <= 4 \|\| strlen($option['xmlrpc_slug']) > 50){
4327	$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4328	}
4329	}
4330
4331	// Is there an error ?
4332	if(!empty($lz_error)){
4333	return loginizer_page_security_T();
4334	}
4335
4336	// Save the options
4337	update_option('loginizer_security', $option);
4338
4339	// Mark as saved
4340	$GLOBALS['lz_saved'] = true;
4341
4342	}
4343
4344	// Reset the username
4345	if(isset($_POST['save_lz_admin'])){
4346
4347	// Get the new username
4348	$current_username = lz_optpost('current_username');
4349	$new_username = lz_optpost('new_username');
4350
4351	if(empty($current_username)){
4352	$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
4353	return loginizer_page_security_T();
4354	}
4355
4356	if(empty($new_username)){
4357	$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
4358	return loginizer_page_security_T();
4359	}
4360
4361	// Is the starting of the username having 'admin' ?
4362	if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
4363	$lz_error['user_exists'] = __('The username begins with <b>admin</b>. Please change it !', 'loginizer');
4364	return loginizer_page_security_T();
4365	}
4366
4367	// Lets check if there is such a user
4368	$found = get_user_by('login', $new_username);
4369
4370	// Found one !
4371	if(!empty($found->ID)){
4372	$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
4373	return loginizer_page_security_T();
4374	}
4375
4376	$old_user = get_user_by('login', $current_username);
4377
4378	if(empty($old_user->ID)){
4379	$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
4380	return loginizer_page_security_T();
4381	}
4382
4383	if(empty($old_user->caps['administrator'])){
4384	$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
4385	return loginizer_page_security_T();
4386	}
4387
4388	$is_super_admin = 0;
4389	if(is_multisite() && is_super_admin($old_user->ID)){
4390	$is_super_admin = 1;
4391	}
4392
4393	// Update the username
4394	$update_data = array('user_login' => $new_username);
4395	$where_data = array('ID' => $old_user->ID);
4396
4397	$format = array('%s');
4398	$where_format = array('%d');
4399
4400	$wpdb->update($wpdb->prefix.'users', $update_data, $where_data, $format, $where_format);
4401
4402	// Update the super admins list for multisite
4403	if(!empty($is_super_admin)){
4404
4405	$super_admins = get_site_option('site_admins');
4406
4407	foreach($super_admins as $sk => $sv){
4408	// Remove the existing username from super admins list
4409	if($sv == $current_username){
4410	unset($super_admins[$sk]);
4411	}
4412	}
4413
4414	// Add the new username
4415	$super_admins[] = $new_username;
4416
4417	update_site_option( 'site_admins', $super_admins );
4418
4419	}
4420
4421	// Mark as saved
4422	$GLOBALS['lz_saved'] = true;
4423
4424	}
4425
4426	// Change the wp-admin slug
4427	if(isset($_POST['save_lz_wp_admin'])){
4428
4429	// Get the new username
4430	$option['admin_slug'] = lz_optpost('admin_slug');
4431	$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
4432	$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
4433	$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
4434
4435	// login slug and admin slug cannot be the same
4436	$_loginizer_security = get_option('loginizer_security');
4437	if(!empty($_loginizer_security['login_slug']) && $_loginizer_security['login_slug'] == $option['admin_slug']){
4438	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4439	return loginizer_page_security_T();
4440	}
4441
4442	// Did you agree to this ?
4443	if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
4444	$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
4445	return loginizer_page_security_T();
4446	}
4447
4448	// Length
4449	if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 \|\| strlen($option['admin_slug']) > 50)){
4450	$lz_error['admin_slug'] = __('The new Admin slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4451	return loginizer_page_security_T();
4452	}
4453
4454	// Only regular characters
4455	if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
4456	$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
4457	return loginizer_page_security_T();
4458	}
4459
4460	// Update the option
4461	update_option('loginizer_wp_admin', $option);
4462
4463	// Mark as saved
4464	$GLOBALS['lz_saved'] = true;
4465
4466	}
4467
4468
4469	// Save blacklisted usernames
4470	if(isset($_POST['save_lz_bl_users'])){
4471
4472	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
4473
4474	// Process the usernames i.e. remove blanks
4475	foreach($usernames as $k => $v){
4476	$v = trim($v);
4477
4478	// Unset blank values
4479	if(empty($v)){
4480	unset($usernames[$k]);
4481	}
4482
4483	// Disallow these special characters to avoid XSS or any other security vulnerability
4484	if(preg_match('/[\<\>\"\']/', $v)){
4485	unset($usernames[$k]);
4486	}
4487	}
4488
4489	// Update the blacklist
4490	update_option('loginizer_username_blacklist', array_values($usernames));
4491
4492	// Mark as saved
4493	$GLOBALS['lz_saved'] = true;
4494
4495	}
4496
4497
4498	// Save blacklisted domains
4499	if(isset($_POST['save_lz_bl_domains'])){
4500
4501	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
4502
4503	// Process the domains i.e. remove blanks
4504	foreach($domains as $k => $v){
4505	$v = trim($v);
4506
4507	// Unset blank values
4508	if(empty($v)){
4509	unset($domains[$k]);
4510	}
4511
4512	// Disallow these special characters to avoid XSS or any other security vulnerability
4513	if(preg_match('/[\<\>\"\']/', $v)){
4514	unset($domains[$k]);
4515	}
4516	}
4517
4518	// Update the blacklist
4519	update_option('loginizer_domains_blacklist', array_values($domains));
4520
4521	// Mark as saved
4522	$GLOBALS['lz_saved'] = true;
4523
4524	}
4525
4526
4527	if(isset($_POST['save_lz_csrf_protection'])){
4528	update_option('loginizer_csrf_protection', empty(lz_optpost('enable_csrf_protection')) ? false : true);
4529
4530	delete_transient('loginizer_csrf_mod_rewrite');
4531	$GLOBALS['lz_saved'] = true;
4532	}
4533
4534	// Call theme
4535	loginizer_page_security_T();
4536
4537	}
4538
4539	// Loginizer - Security Settings Page Theme
4540	function loginizer_page_security_T(){
4541
4542	global $loginizer, $lz_error, $lz_env;
4543
4544	// Universal header
4545	loginizer_page_header('Security Settings');
4546
4547	loginizer_feature_available('Security Settings');
4548
4549	// Saved ?
4550	if(!empty($GLOBALS['lz_saved'])){
4551	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4552	}
4553
4554	// Any errors ?
4555	if(!empty($lz_error)){
4556	lz_report_error($lz_error);echo '<br />';
4557	}
4558
4559	$current_admin = get_user_by('id', 1);
4560
4561	?>
4562
4563	<style>
4564	input[type="text"], textarea, select {
4565	width: 70%;
4566	}
4567
4568	.form-table label{
4569	font-weight:bold;
4570	}
4571
4572	.exp{
4573	font-size:12px;
4574	}
4575	</style>
4576
4577	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4578
4579	<div id="" class="postbox">
4580
4581	<div class="postbox-header">
4582	<h2 class="hndle ui-sortable-handle">
4583	<span><?php echo __('Rename Login Page', 'loginizer'); ?></span>
4584	</h2>
4585	</div>
4586
4587	<div class="inside">
4588
4589	<?php wp_nonce_field('loginizer-options'); ?>
4590	<table class="form-table">
4591	<tr>
4592	<td scope="row" valign="top" colspan="2">
4593	<i><?php echo __('You can rename your Login page from','loginizer'). ' <b> '. $loginizer['login_basename'].' </b> '.__(' to anything of your choice e.g. mylogin. This would make it very difficult for automated attack bots to know where to login !','loginizer'); ?></i>
4594	</td>
4595	</tr>
4596	<tr>
4597	<td scope="row" valign="top" style="width:40% !important">
4598	<label><?php echo __('New Login Slug', 'loginizer'); ?></label><br>
4599	<span class="exp"><?php echo __('Set blank to reset to the original login URL', 'loginizer'); ?></span>
4600	</td>
4601	<td>
4602	<input type="text" size="50" value="<?php echo lz_POSTval('login_slug', $loginizer['login_slug']); ?>" name="login_slug" />
4603	</td>
4604	</tr>
4605
4606	<?php
4607
4608	if(!defined('SITEPAD')){
4609
4610	?>
4611	<tr>
4612	<td scope="row" valign="top" style="width:200px !important">
4613	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
4614	<span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
4615	</td>
4616	<td>
4617	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
4618	</td>
4619	</tr>
4620
4621	<?php
4622
4623	}
4624
4625	?>
4626	</table><br />
4627	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4628
4629	</div>
4630	</div>
4631
4632	<?php
4633
4634	if(!defined('SITEPAD')){
4635
4636	?>
4637
4638	<div id="" class="postbox">
4639
4640	<div class="postbox-header">
4641	<h2 class="hndle ui-sortable-handle">
4642	<span><?php echo __('XML-RPC Settings', 'loginizer'); ?></span>
4643	</h2>
4644	</div>
4645
4646	<div class="inside">
4647
4648	<?php wp_nonce_field('loginizer-options'); ?>
4649	<table class="form-table">
4650	<tr>
4651	<td scope="row" valign="top" colspan="2">
4652	<i><?php echo __('WordPress\'s XML-RPC feature allows external services to access and modify content on the site. Services like the Jetpack plugin, the WordPress mobile app, pingbacks, etc make use of the XML-RPC feature. If this site does not use a service that requires XML-RPC, please <b>disable</b> the XML-RPC feature as it prevents attackers from using the feature to attack the site. If your service can use a custom XML-RPC URL, you can also <b>rename</b> the XML-RPC page to a <b>custom slug</b>.', 'loginizer'); ?></i>
4653	</td>
4654	</tr>
4655	<tr>
4656	<td scope="row" valign="top" style="width:40% !important">
4657	<label><?php echo __('Disable XML-RPC', 'loginizer'); ?></label>
4658	</td>
4659	<td>
4660	<input type="checkbox" value="1" name="xmlrpc_disable" <?php echo lz_POSTchecked('xmlrpc_disable', (empty($loginizer['xmlrpc_disable']) ? false : true)); ?> />
4661	</td>
4662	</tr>
4663	<tr>
4664	<td scope="row" valign="top" style="width:40% !important">
4665	<label><?php echo __('Disable Pingbacks', 'loginizer'); ?></label>
4666	</td>
4667	<td>
4668	<input type="checkbox" value="1" name="pingbacks_disable" <?php echo lz_POSTchecked('pingbacks_disable', (empty($loginizer['pingbacks_disable']) ? false : true)); ?> />
4669	</td>
4670	</tr>
4671	<tr>
4672	<td scope="row" valign="top">
4673	<label><?php echo __('New XML-RPC Slug', 'loginizer'); ?></label><br>
4674	<span class="exp"><?php echo __('Set blank to reset to the original XML-RPC URL', 'loginizer'); ?></span>
4675	</td>
4676	<td>
4677	<input type="text" size="50" value="<?php echo lz_optpost('xmlrpc_slug', $loginizer['xmlrpc_slug']); ?>" name="xmlrpc_slug" />
4678	</td>
4679	</tr>
4680	</table><br />
4681	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4682
4683	</div>
4684	</div>
4685
4686	<?php
4687
4688	}
4689
4690	?>
4691
4692	</form>
4693
4694	<?php
4695
4696	if(!defined('SITEPAD')){
4697
4698	?>
4699
4700	<script type="text/javascript">
4701
4702	function lz_update_htaccess_admin(e){
4703
4704	var admin_name = jQuery(e).val();
4705
4706	if(admin_name.length == 0){
4707	admin_name = 'wp-admin';
4708	}
4709
4710	var textarea = jQuery('.lz-htaccess-textarea');
4711
4712	if(textarea.length == 0) {
4713	return;
4714	}
4715
4716	var htaccess = textarea.val();
4717	htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
4718	textarea.val(htaccess);
4719
4720	}
4721
4722
4723	function dirname(path) {
4724	return path.replace(/\\/g, '/').replace(/\/[^/]*\/?$/, '');
4725	}
4726
4727	function lz_test_wp_admin(){
4728
4729	var data = new Object();
4730	data["action"] = "loginizer_wp_admin";
4731	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax');?>";
4732
4733	var new_ajaxurl = dirname(dirname(ajaxurl))+'/'+jQuery('#lz_admin_slug').val()+'/admin-ajax.php';
4734
4735	// AJAX and on success function
4736	jQuery.post(new_ajaxurl, data, function(response){
4737
4738	if(response['result'] == 1){
4739	alert("<?php echo __('Everything seems to be good. You can proceed to save the settings !', 'loginizer'); ?>");
4740	}
4741
4742	// Throw an error for failures
4743	}).fail(function() {
4744	alert("<?php echo __('There was an error connecting to WordPress with the new Admin Slug. Did you configure everything properly ?', 'loginizer'); ?>");
4745	});
4746	//jQuery.ajax('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4747	return false;
4748	};
4749
4750	</script>
4751
4752	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4753	<div id="" class="postbox">
4754
4755	<div class="postbox-header">
4756	<h2 class="hndle ui-sortable-handle">
4757	<span><?php echo __('Rename wp-admin access', 'loginizer'); ?></span>
4758	</h2>
4759	</div>
4760
4761	<div class="inside">
4762
4763	<?php wp_nonce_field('loginizer-options'); ?>
4764	<table class="form-table">
4765	<?php
4766	if(preg_match('/(apache\|litespeed\|lsws)/is', $_SERVER["SERVER_SOFTWARE"])){
4767	// Supported. Do nothing
4768	}else{
4769	echo '<tr>
4770	<td scope="row" valign="top" colspan="2">
4771	<div style="color:#a94442; background-color:#f2dede; border-color:#ebccd1; padding:15px; border:1px solid transparent; border-radius:4px;">'.__('Rename wp-admin access feature is supported only on Apache and Litespeed', 'loginizer').'</div>
4772	</td>
4773	</tr>';
4774	}
4775
4776	if(file_exists(LOGINIZER_DIR.'/premium.php') && !empty($loginizer['enable_csrf_protection']) && empty($loginizer['admin_slug'])){
4777
4778	echo '<div style="color: #856404; background-color: #fff3cd; border-color: #ffeeba; padding: 15px; font-size:1rem; font-weight:400;">'.esc_html__('Note: Be careful while changing the Admin name as your CSRF Protection is on', 'loginizer').'</div>';
4779
4780	}
4781	?>
4782	<tr>
4783	<td scope="row" valign="top" colspan="2">
4784	<i><?php echo __('You can rename your WordPress Admin access URL <b>wp-admin</b> to anything of your choice e.g. my-admin. This will require you to change .htaccess, so please follow','loginizer'); ?> <a href="<?php echo LOGINIZER_DOCS;?>Renaming_the_WP-Admin_Area" target="_blank"><?php echo __('our guide','loginizer').'</a> '.__('on how to do so !','loginizer'); ?></i>
4785	</td>
4786	</tr>
4787	<tr>
4788	<td scope="row" valign="top" style="width:40% !important">
4789	<label><?php echo __('New wp-admin Slug', 'loginizer'); ?></label><br>
4790	<span class="exp"><?php echo __('Set blank to reset to the original wp-admin URL', 'loginizer'); ?></span>
4791	</td>
4792	<td>
4793	<input type="text" size="50" value="<?php echo lz_optpost('admin_slug', $loginizer['admin_slug']); ?>" name="admin_slug" id="lz_admin_slug" onchange="lz_update_htaccess_admin(this)"/>
4794	</td>
4795	</tr>
4796	<tr>
4797	<td scope="row" valign="top" style="width:200px !important">
4798	<label><?php echo __('Disable wp-admin access', 'loginizer'); ?></label><br>
4799	<span class="exp"><?php echo __('If set, then only the new admin slug will work and access to the Old Admin Slug i.e. wp-admin will be disabled. If anyone accesses wp-admin, a warning will be shown.<br><label>NOTE: Please use this option cautiously !</label>', 'loginizer'); ?></span>
4800	</td>
4801	<td>
4802	<input type="checkbox" id="lz_restrict_wp_admin" onchange="lz_wp_admin_msg_toggle()" value="1" name="restrict_wp_admin" <?php echo lz_POSTchecked('restrict_wp_admin', (empty($loginizer['restrict_wp_admin']) ? false : true)); ?> />
4803	</td>
4804	</tr>
4805	<tr id="lz_wp_admin_msg_row" style="display:none">
4806	<td scope="row" valign="top">
4807	<label><?php echo __('WP-Admin Error Message', 'loginizer'); ?></label><br>
4808	<span class="exp"><?php echo __('Error message to show if someone accesses wp-admin', 'loginizer'); ?></span> Default : <?php echo $loginizer['wp_admin_d_msg']; ?>
4809	</td>
4810	<td>
4811	<input type="text" size="50" value="<?php echo lz_htmlizer(!empty($_POST['wp_admin_msg']) ? stripslashes($_POST['wp_admin_msg']) : @$loginizer['wp_admin_msg']); ?>" name="wp_admin_msg" id="lz_wp_admin_msg" />
4812	</td>
4813	</tr>
4814
4815	<?php
4816	loginizer_htaccess_rules();
4817	?>
4818	<tr>
4819	<td scope="row" valign="top" style="width:200px !important">
4820	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
4821	<span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
4822	</td>
4823	<td>
4824	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
4825	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
4826	</td>
4827	</tr>
4828	</table><br />
4829	<center><input name="save_lz_wp_admin" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4830
4831	</div>
4832	</div>
4833	</form>
4834
4835	<script type="text/javascript">
4836	function lz_csrf_htaccess_update(e){
4837	event.preventDefault();
4838
4839	var tb = jQuery(e).closest('table'),
4840	csrf_enabled = tb.find('[name="enable_csrf_protection"]'),
4841	admin_name = tb.find('#lz_admin_slug');
4842
4843	var data = new Object();
4844
4845	// Setting admin name if anything is set
4846	if(admin_name && admin_name.val()){
4847	data['admin_name'] = admin_name.val();
4848	}
4849
4850	if(csrf_enabled){
4851	data['csrf'] = true;
4852	} else {
4853	data['csrf'] = false;
4854	}
4855
4856	data['action'] = 'loginizer_update_csrf_mod';
4857	data['nonce'] = '<?php echo wp_create_nonce('loginizer_admin_ajax');?>';
4858
4859	var new_ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>'
4860
4861	// AJAX and on success function
4862	jQuery.post(new_ajaxurl, data, function(response){
4863
4864	if(response['success'] == true){
4865	alert("<?php esc_html_e('.htaccess has been updated !', 'loginizer'); ?>");
4866	}
4867
4868	// Throw an error for failures
4869	}).fail(function() {
4870	alert("<?php esc_html_e('Was unable to update the .htaccess file so please update it manually', 'loginizer'); ?>");
4871	});
4872
4873	return false;
4874
4875	}
4876
4877	function lz_show_rewrite_rule(e){
4878	event.preventDefault();
4879	jQuery(e).closest('td').find('textarea').toggle();
4880	}
4881
4882
4883	</script>
4884
4885	<!-- Begin CSRF Protection -->
4886	<form action="" method="post" loginizer-premium-only="1">
4887	<div id="" class="postbox">
4888
4889	<div class="postbox-header">
4890	<h2 class="hndle ui-sortable-handle">
4891	<span><?php esc_html_e('CSRF Protection', 'loginizer'); ?></span>
4892	</h2>
4893	</div>
4894
4895	<div class="inside">
4896
4897	<?php wp_nonce_field('loginizer-options'); ?>
4898	<table class="form-table">
4899	<tr>
4900	<td scope="row" valign="top" colspan="2">
4901	<i><?php esc_html_e('This helps in preventing CSRF attacks as it updates the admin URLS with a session string which make it difficult and nearly impossible for the attacker to predict the URL', 'loginizer'); ?></i>
4902	</td>
4903	</tr>
4904	<tr>
4905	<td scope="row" valign="top" style="width:400px !important">
4906	<label><?php esc_html_e('Enable CSRF Protection', 'loginizer'); ?></label><br>
4907	<span class="exp"><?php esc_html_e('If enabled, it will update the URL of wp-admin with a random session string in the URL making it hard to predict the URL.', 'loginizer'); ?></span>
4908	</td>
4909	<td valign="top">
4910	<input type="checkbox" value="1" name="enable_csrf_protection" <?php echo lz_POSTchecked('enable_csrf_protection', (empty($loginizer['enable_csrf_protection']) ? false : true)); ?> />
4911	</td>
4912	</tr>
4913	<?php
4914	loginizer_htaccess_rules(true);
4915	?>
4916	</table><br />
4917	<div style="text-align: center;"><input name="save_lz_csrf_protection" class="button button-primary action" value="<?php esc_html_e('Save Settings', 'loginizer'); ?>" type="submit" />
4918	</div>
4919	</div>
4920	</div>
4921	</form>
4922	<!-- End CSRF Protection -->
4923
4924
4925	<script type="text/javascript">
4926
4927	function lz_wp_admin_msg_toggle(){
4928	var ele = jQuery('#lz_restrict_wp_admin')[0];
4929	if(ele.checked){
4930	jQuery('#lz_wp_admin_msg_row').show();
4931	}else{
4932	jQuery('#lz_wp_admin_msg_row').hide();
4933	}
4934	};
4935
4936	lz_wp_admin_msg_toggle();
4937
4938	</script>
4939
4940
4941	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4942	<div id="" class="postbox">
4943
4944	<div class="postbox-header">
4945	<h2 class="hndle ui-sortable-handle">
4946	<span><?php echo __('Change Admin Username', 'loginizer'); ?></span>
4947	</h2>
4948	</div>
4949
4950	<div class="inside">
4951
4952	<?php wp_nonce_field('loginizer-options'); ?>
4953	<table class="form-table">
4954	<tr>
4955	<td scope="row" valign="top" colspan="2">
4956	<i><?php echo __('You can change the Admin Username from here to anything of your choice e.g. iamtheboss. This would make it very difficult for automated attack bots to know what is the admin username !', 'loginizer'); ?></i>
4957	</td>
4958	</tr>
4959	<tr>
4960	<td scope="row" valign="top" style="width:40% !important">
4961	<label for="current_username"><?php echo __('Current Username', 'loginizer'); ?></label><br>
4962	<span class="exp"><?php echo __('The current username you want to change', 'loginizer'); ?></span>
4963	</td>
4964	<td>
4965	<input type="text" size="50" value="<?php echo lz_optpost('current_username', (!empty($current_admin->user_login) ? $current_admin->user_login : '')); ?>" name="current_username" id="current_username" />
4966	</td>
4967	</tr>
4968	<tr>
4969	<td scope="row" valign="top" style="width:40% !important">
4970	<label for="new_username"><?php echo __('New Username', 'loginizer'); ?></label><br>
4971	<span class="exp"><?php echo __('The new username you want to set', 'loginizer'); ?></span>
4972	</td>
4973	<td>
4974	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
4975	</td>
4976	</tr>
4977	</table><br />
4978	<i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
4979	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
4980
4981	</div>
4982	</div>
4983	</form>
4984
4985	<script type="text/javascript">
4986	function add_lz_bl_users(){
4987	jQuery("#lz_bl_users").append('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4988	return false;
4989	};
4990	</script>
4991
4992	<style>
4993	.lz_bl_users, .lz_bl_domains{
4994	margin-bottom:20px;
4995	}
4996	</style>
4997
4998	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4999	<div id="" class="postbox">
5000
5001	<div class="postbox-header">
5002	<h2 class="hndle ui-sortable-handle">
5003	<span><?php echo __('Username Auto Blacklist', 'loginizer'); ?></span>
5004	</h2>
5005	</div>
5006
5007	<div class="inside">
5008
5009	<?php wp_nonce_field('loginizer-options'); ?>
5010	<table class="form-table">
5011	<tr>
5012	<td scope="row" valign="top" colspan="2">
5013	<i><?php echo __('Attackers generally use common usernames like <b>admin, administrator, or variations of your domain name / business name</b>. You can specify such username here and Loginizer will auto-blacklist the IP Address(s) of clients who try to use such username(s).', 'loginizer'); ?></i>
5014	</td>
5015	</tr>
5016	<tr>
5017	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
5018	<label><?php echo __('Username(s)', 'loginizer'); ?></label><br>
5019	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
5020	</td>
5021	<td>
5022	<div id="lz_bl_users">
5023	<?php
5024
5025	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : $loginizer['username_blacklist'];
5026
5027	if(empty($usernames)){
5028	$usernames[] = '';
5029	}
5030
5031	foreach($usernames as $_user){
5032
5033	// Disallow these special characters to avoid XSS or any other security vulnerability
5034	if(preg_match('/[\<\>\"\']/', $_user)){
5035	continue;
5036	}
5037
5038	echo '<input type="text" size="30" value="'.$_user.'" name="lz_bl_users[]" class="lz_bl_users" />';
5039	}
5040
5041	?>
5042	</div>
5043	<br />
5044	<input class="button" type="button" value="<?php echo __('Add New Username', 'loginizer'); ?>" onclick="return add_lz_bl_users();" style="float:right" />
5045	</td>
5046	</tr>
5047	</table><br />
5048	<center><input name="save_lz_bl_users" class="button button-primary action" value="<?php echo __('Save Username(s)', 'loginizer'); ?>" type="submit" /></center>
5049
5050	</div>
5051	</div>
5052	</form>
5053
5054	<script type="text/javascript">
5055	function add_lz_bl_domains(){
5056	jQuery("#lz_bl_domains").append('<input type="text" size="30" value="" name="lz_bl_domains[]" class="lz_bl_domains" />');
5057	return false;
5058	};
5059	</script>
5060
5061
5062	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5063	<div id="" class="postbox">
5064
5065	<div class="postbox-header">
5066	<h2 class="hndle ui-sortable-handle">
5067	<span><?php echo __('New Registration Domain Blacklist', 'loginizer'); ?></span>
5068	</h2>
5069	</div>
5070
5071	<div class="inside">
5072
5073	<?php wp_nonce_field('loginizer-options'); ?>
5074	<table class="form-table">
5075	<tr>
5076	<td scope="row" valign="top" colspan="2">
5077	<i>If you would like to ban new registrations from a particular domain, you can use this utility to do so.</i>
5078	</td>
5079	</tr>
5080	<tr>
5081	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
5082	<label><?php echo __('Domain(s)', 'loginizer'); ?></label><br>
5083	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
5084	</td>
5085	<td>
5086	<div id="lz_bl_domains">
5087	<?php
5088
5089	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : $loginizer['domains_blacklist'];
5090
5091	if(empty($domains)){
5092	$domains[] = '';
5093	}
5094
5095	foreach($domains as $_domain){
5096
5097	// Disallow these special characters to avoid XSS or any other security vulnerability
5098	if(preg_match('/[\<\>\"\']/', $_domain)){
5099	continue;
5100	}
5101
5102	echo '<input type="text" size="30" value="'.$_domain.'" name="lz_bl_domains[]" class="lz_bl_domains" />';
5103	}
5104
5105	?>
5106	</div>
5107	<br />
5108	<input class="button" type="button" value="<?php echo __('Add New Domain', 'loginizer'); ?>" onclick="return add_lz_bl_domains();" style="float:right" />
5109	</td>
5110	</tr>
5111	</table><br />
5112	<center><input name="save_lz_bl_domains" class="button button-primary action" value="<?php echo __('Save Domains(s)', 'loginizer'); ?>" type="submit" /></center>
5113
5114	</div>
5115	</div>
5116	</form>
5117
5118	<?php
5119
5120	}
5121
5122	loginizer_page_footer();
5123
5124	}
5125
5126	// .htaccess UI options for wp-admin and CSRF
5127	function loginizer_htaccess_rules($is_csrf = false){
5128	global $loginizer;
5129
5130	$admin_slug = 'wp-admin';
5131
5132	if(!empty($loginizer['admin_slug'])){
5133	$admin_slug = $loginizer['admin_slug'];
5134	}
5135
5136	// getting sub directory if any
5137	$home_root = parse_url(home_url());
5138
5139	if(isset($home_root['path'])){
5140	$home_root = trailingslashit($home_root['path']);
5141	} else {
5142	$home_root = '/';
5143	}
5144
5145	// Selecting admin slug
5146	$admin_slug = 'wp-admin';
5147
5148	if(!empty($loginizer['admin_slug'])){
5149	$admin_slug = $loginizer['admin_slug'];
5150	}
5151
5152	// Setting the rule
5153	$rule = '# BEGIN Loginizer' . "\n";
5154	$rule .= '<IfModule mod_rewrite.c>' . "\n";
5155	$rule .= 'RewriteEngine On' . "\n";
5156	$rule .= 'RewriteBase ' . $home_root . "\n\n";
5157	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
5158	$rule .= '</IfModule>' . "\n";
5159	$rule .= '# END Loginizer' . "\n";
5160
5161	if(is_writable(ABSPATH . '/.htaccess')){
5162	echo '<tr>
5163	<td scope="row" valign="top" style="width:400px !important">
5164	<label>'. esc_html__('Update .htaccess', 'loginizer').'</label><br>
5165	<span class="exp">'. (!empty($is_csrf) ? esc_html__('Rewrites rule for CSRF session URL', 'loginizer') : esc_html__('Rewrites rule to change wp-admin and if you have a Multisite then check', 'loginizer') . ' <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a>') . '</span>
5166	</td>
5167	<td valign="top">
5168	<button class="button" style="background: #5cb85c; color:white; border:#5cb85c;" onclick="lz_csrf_htaccess_update(this)">Update .htaccess</button><a onClick="lz_show_rewrite_rule(this)" href="#" style="margin-left:5px; line-height: 2; font-weight:500;">Show Rewrite Rule</a><br/><br/>
5169
5170	<textarea rows="8" readonly style="display:none;" class="lz-htaccess-textarea">' . trim($rule) . '</textarea>
5171	</td>
5172	</tr>';
5173
5174	} else {
5175	echo '<tr>
5176	<td scope="row" valign="top" style="width:400px !important">
5177	<label>'. esc_html__('Manually Update .htaccess', 'loginizer') . '</label><br>
5178	<span class="exp">' . esc_html__('You can manually update your .htaccess by adding the given code at the top of your .htaccess file', 'loginizer'). '</span>
5179	</td>
5180	<td valign="top">
5181	<textarea rows="8" readonly class="lz-htaccess-textarea">' . trim($rule) . '</textarea>
5182	</td>
5183	</tr>';
5184	}
5185
5186	}
5187
5188	// Loginizer - Checksum load data
5189	function loginizer_page_checksums_L(&$files, &$_ignores){
5190
5191	global $loginizer, $lz_error, $lz_env;
5192
5193	// Load any mismatched files and ignores
5194	$files = get_option('loginizer_checksums_diff');
5195	$_ignores = get_option('loginizer_checksums_ignore');
5196	$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
5197	$ignores = array();
5198
5199	foreach($_ignores as $ik => $iv){
5200	$ignores[$iv] = array();
5201	if(!empty($files[$iv])){
5202	$ignores[$iv] = $files[$iv];
5203	}
5204	}
5205
5206	$lz_env['files'] = $files;
5207	$lz_env['ignores'] = $ignores;
5208
5209	}
5210
5211	// Loginizer - PasswordLess Page
5212	function loginizer_page_checksums(){
5213
5214	global $loginizer, $lz_error, $lz_env;
5215
5216	if(!current_user_can('manage_options')){
5217	wp_die('Sorry, but you do not have permissions to change settings.');
5218	}
5219
5220	if(!loginizer_is_premium() && count($_POST) > 0){
5221	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
5222	return loginizer_page_checksums_T();
5223	}
5224
5225	/* Make sure post was from this page */
5226	if(count($_POST) > 0){
5227	check_admin_referer('loginizer-options');
5228	}
5229
5230	// Are we to run it ?
5231	if(isset($_REQUEST['lz_run_checksum'])){
5232	loginizer_checksums();
5233	}
5234
5235	loginizer_page_checksums_L($files, $_ignores);
5236
5237	$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
5238	$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
5239	$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
5240
5241	if(isset($_POST['save_lz'])){
5242
5243	// In the future there can be more settings
5244	$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
5245	$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
5246	$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
5247	$option['checksum_time'] = lz_optpost('checksum_time');
5248
5249	// Is there an error ?
5250	if(!empty($lz_error)){
5251	return loginizer_page_checksums_T();
5252	}
5253
5254	// Save the options
5255	update_option('loginizer_checksums', $option);
5256
5257	// Mark as saved
5258	$GLOBALS['lz_saved'] = true;
5259
5260	}
5261
5262	// Add or remove from ignore list
5263	if(isset($_POST['save_lz_csum_ig'])){
5264
5265	if(@is_array($_POST['checksum_del_ignore'])){
5266
5267	foreach($_POST['checksum_del_ignore'] as $k => $v){
5268	$key = array_search($v, $_ignores);
5269	if($key !== false){
5270	unset($_ignores[$key]);
5271	}
5272	}
5273
5274	// Save it
5275	update_option('loginizer_checksums_ignore', $_ignores);
5276
5277	}
5278
5279	if(@is_array($_POST['checksum_add_ignore'])){
5280
5281	foreach($_POST['checksum_add_ignore'] as $k => $v){
5282	if(!empty($files[$v])){
5283	$_ignores[] = $v;
5284	}
5285	}
5286
5287	// Save it
5288	update_option('loginizer_checksums_ignore', $_ignores);
5289
5290	}
5291
5292	// Reload
5293	loginizer_page_checksums_L($files, $_ignores);
5294
5295	// Mark as saved
5296	$GLOBALS['lz_saved'] = true;
5297
5298	}
5299
5300	// Call theme
5301	loginizer_page_checksums_T();
5302	}
5303
5304	// Loginizer - PasswordLess Page Theme
5305	function loginizer_page_checksums_T(){
5306
5307	global $loginizer, $lz_error, $lz_env;
5308
5309	// Universal header
5310	loginizer_page_header('File Checksum Settings');
5311
5312	loginizer_feature_available('File Checksum');
5313
5314	wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
5315	wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
5316
5317	// Saved ?
5318	if(!empty($GLOBALS['lz_saved'])){
5319	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
5320	}
5321
5322	// Did we just run the checksums
5323	if(isset($_REQUEST['lz_run_checksum'])){
5324	echo '<div id="message" class="updated"><p>'. __('The Checksum process was executed successfully', 'loginizer'). '</p></div><br />';
5325	}
5326
5327	// Any errors ?
5328	if(!empty($lz_error)){
5329	lz_report_error($lz_error);echo '<br />';
5330	}
5331
5332	?>
5333
5334	<style>
5335	input[type="text"], textarea, select {
5336	width: 70%;
5337	}
5338
5339	.form-table label{
5340	font-weight:bold;
5341	}
5342
5343	.exp{
5344	font-size:12px;
5345	}
5346	</style>
5347
5348	<script>
5349	function lz_apply_status(ele, the_class){
5350
5351	var status = ele.checked;
5352	jQuery(the_class).each(function(){
5353	this.checked = status;
5354	});
5355
5356	}
5357	</script>
5358
5359	<div id="" class="postbox">
5360	<div class="postbox-header">
5361	<h2 class="hndle ui-sortable-handle">
5362	<span><?php echo __('Checksum Settings', 'loginizer'); ?></span>
5363	</h2>
5364	</div>
5365	<div class="inside">
5366
5367	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5368	<?php wp_nonce_field('loginizer-options'); ?>
5369	<table class="form-table">
5370	<tr>
5371	<td scope="row" valign="top" style="width:400px !important">
5372	<label><?php echo __('Disable Checksum of WP Core', 'loginizer'); ?></label><br>
5373	<span class="exp"><?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?></span>
5374	</td>
5375	<td valign="top">
5376	<input type="checkbox" value="1" name="disable_checksum" <?php echo lz_POSTchecked('disable_checksum', (empty($loginizer['disable_checksum']) ? false : true)); ?> />
5377	</td>
5378	</tr>
5379	<tr>
5380	<td scope="row" valign="top" style="width:400px !important">
5381	<label><?php echo __('Disable Email of Checksum Results', 'loginizer'); ?></label><br>
5382	<span class="exp"><?php echo __('If checked, Loginizer will not email you the checksum results.', 'loginizer'); ?></span>
5383	</td>
5384	<td valign="top">
5385	<input type="checkbox" value="1" name="no_checksum_email" <?php echo lz_POSTchecked('no_checksum_email', (empty($loginizer['no_checksum_email']) ? false : true)); ?> />
5386	</td>
5387	</tr>
5388	<tr>
5389	<td scope="row" valign="top" style="width:400px !important">
5390	<label><?php echo __('Checksum Frequency', 'loginizer'); ?></label><br>
5391	<span class="exp"><?php echo __('If Checksum is enabled, at what frequency should the checksums be performed.', 'loginizer'); ?></span>
5392	</td>
5393	<td valign="top">
5394	<select name="checksum_frequency">
5395	<?php
5396	foreach($lz_env['csum_freq'] as $k => $v){
5397	echo '<option '.lz_POSTselect('checksum_frequency', $k, ($loginizer['checksum_frequency'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
5398	}
5399	?>
5400	</select>
5401	</td>
5402	</tr>
5403	<tr id="lz_checksum_time">
5404	<td scope="row" valign="top" style="width:400px !important">
5405	<label><?php echo __('Time of Day', 'loginizer'); ?></label><br>
5406	<span class="exp"><?php echo __('If Checksum is enabled, what time of day should Loginizer do the check. Note : The check will be done on or after this time has elapsed as per the accesses being made.', 'loginizer'); ?></span>
5407	</td>
5408	<td valign="top">
5409	<div class="input-group clockpicker" data-autoclose="true">
5410	<input type="text" name="checksum_time" class="form-control" value="<?php echo (empty($loginizer['checksum_time']) ? '00:00' : $loginizer['checksum_time']);?>">
5411	<span class="input-group-addon">
5412	<span class="glyphicon glyphicon-time"></span>
5413	</span>
5414	</div>
5415	<script type="text/javascript">
5416	jQuery(document).ready(function(){
5417	(function($) {
5418	$('.clockpicker').clockpicker({donetext: 'Done'});
5419	})(jQuery);
5420	});
5421	</script>
5422	</td>
5423	</tr>
5424	<tr>
5425	<td colspan="2">
5426	<?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?>
5427	</td>
5428	</tr>
5429	</table><br />
5430	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /><input name="lz_run_checksum" style="float:right; background: #5cb85c; color:white; border:#5cb85c" class="button button-secondary" value="<?php echo __('Do a Checksum Now', 'loginizer'); ?>" type="submit" /></center>
5431	</form>
5432
5433	</div>
5434	</div>
5435
5436	<div id="" class="postbox">
5437
5438	<div class="postbox-header">
5439	<h2 class="hndle ui-sortable-handle">
5440	<span><?php echo __('Mismatching Files', 'loginizer'); ?></span>
5441	</h2>
5442	</div>
5443
5444	<div class="inside">
5445
5446	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5447	<?php wp_nonce_field('loginizer-options'); ?>
5448	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5449	<?php
5450
5451	$files = $lz_env['files'];
5452
5453	// Avoid undefined notice for $files
5454	if(!empty($files)){
5455	foreach($files as $k => $v){
5456	if(!empty($lz_env['ignores'][$k])){
5457	unset($files[$k]);
5458	}
5459	}
5460	}
5461
5462	echo '
5463	<tr>
5464	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5465	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5466	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5467	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_add_ig\');" /></th>
5468	</tr>';
5469
5470	if(is_array($files) && count($files) > 0){
5471
5472	foreach($files as $k => $v){
5473
5474	echo '
5475	<tr>
5476	<td>'.$k.'</td>
5477	<td>'.$v['cur_md5'].'</td>
5478	<td>'.$v['md5'].'</td>
5479	<td><input type="checkbox" name="checksum_add_ignore[]" class="csum_add_ig" value="'.$k.'" /></td>
5480	</tr>';
5481
5482	}
5483
5484	}else{
5485
5486	echo '
5487	<tr>
5488	<td colspan="4" align="center">'.__('This is great ! No file with any wrong checksum has been found.','loginizer').'</td>
5489	</tr>';
5490
5491	}
5492
5493	?>
5494	</table><br />
5495	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Add Selected to Ignore List', 'loginizer'); ?>" type="submit" /></center>
5496	</form>
5497	</div>
5498
5499	</div>
5500	<br />
5501
5502	<div id="" class="postbox">
5503
5504	<div class="postbox-header">
5505	<h2 class="hndle ui-sortable-handle">
5506	<span><?php echo __('Ignore List', 'loginizer'); ?></span>
5507	</h2>
5508	</div>
5509
5510	<div class="inside">
5511
5512	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5513	<?php wp_nonce_field('loginizer-options'); ?>
5514	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5515	<?php
5516
5517	$ignores = $lz_env['ignores'];
5518
5519	echo '
5520	<tr>
5521	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5522	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5523	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5524	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_del_ig\');" /></th>
5525	</tr>';
5526
5527	// Load any mismatched files
5528	$files = $ignores;
5529
5530	if(is_array($files) && count($files) > 0){
5531
5532	foreach($files as $k => $v){
5533
5534	echo '
5535	<tr>
5536	<td>'.$k.'</td>
5537	<td>'.$v['cur_md5'].'</td>
5538	<td>'.$v['md5'].'</td>
5539	<td><input type="checkbox" name="checksum_del_ignore[]" class="csum_del_ig" value="'.$k.'" /></td>
5540	</tr>';
5541
5542	}
5543
5544	}else{
5545
5546	echo '
5547	<tr>
5548	<td colspan="4" align="center">'.__('No files have been added to the ignore list','loginizer').'</td>
5549	</tr>';
5550
5551	}
5552
5553	?>
5554	</table><br />
5555	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Remove Selected from Ignore List', 'loginizer'); ?>" type="submit" /></center>
5556	</form>
5557	</div>
5558
5559	</div>
5560	<br />
5561
5562	<?php
5563	loginizer_page_footer();
5564
5565	}
5566
5567	function loginizer_dismiss_newsletter(){
5568
5569	// Some AJAX security
5570	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5571
5572	if(!current_user_can('manage_options')){
5573	wp_die('Sorry, but you do not have permissions to change settings.');
5574	}
5575
5576	update_option('loginizer_dismiss_newsletter', time());
5577	echo 1;
5578	wp_die();
5579	}
5580
5581	add_action('wp_ajax_loginizer_dismiss_newsletter', 'loginizer_dismiss_newsletter');
5582
5583	function loginizer_dismiss_backuply(){
5584
5585	// Some AJAX security
5586	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5587
5588	if(!current_user_can('manage_options')){
5589	wp_die('Sorry, but you do not have permissions to change settings.');
5590	}
5591
5592	update_option('loginizer_backuply_promo_time', (0 - time()));
5593	echo 1;
5594	wp_die();
5595	}
5596
5597	add_action('wp_ajax_loginizer_dismiss_backuply', 'loginizer_dismiss_backuply');
5598
5599	function loginizer_dismiss_csrf(){
5600
5601	// Some AJAX security
5602	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5603
5604	if(!current_user_can('manage_options')){
5605	wp_die('Sorry, but you do not have permissions to change settings.');
5606	}
5607
5608	update_option('loginizer_csrf_promo_time', (0 - time()));
5609	echo 1;
5610	wp_die();
5611	}
5612
5613	add_action('wp_ajax_loginizer_dismiss_csrf', 'loginizer_dismiss_csrf');
5614
5615	function loginizer_newsletter_subscribe(){
5616
5617	$newsletter_dismiss = get_option('loginizer_dismiss_newsletter');
5618
5619	if(!empty($newsletter_dismiss)){
5620	return;
5621	}
5622
5623	$env['url'] = 'https://loginizer.com/';
5624
5625	echo '
5626	<style>
5627	.newsletter_container{
5628	color: #000000;
5629	background: #FFFFFF;
5630	text-align:center;
5631	}
5632	.subscribe_form_row{
5633	color: #000000;
5634	padding-bottom:0px !important;
5635	}
5636	.subscribe_heading{
5637	font-size:22px;
5638	}
5639	</style>
5640
5641	<div class="notice my-loginizer-dismiss-notice is-dismissible" style="background:#FFF;padding:15px; border: 1px solid #ccd0d4; width:80%;margin-left:0px;margin:auto;">
5642	<div class="container">
5643	<div class="col-md-6 col-md-offset-3 text-center newsletter_container">
5644	<h2 style="font-weight:100; margin-bottom:20px; margin-top:5px;" class="subscribe_heading">Subscribe to our Newsletter</h2>
5645	<form class="form-inline" action="" method="POST">
5646	<div class="row subscribe_form_row">
5647	<div class="col-md-12">
5648	<input type="email" name="email" size="40" id="subscribe_email" class="" placeholder="email@example.com" value="">
5649	<input type="button" name="subscribe" id="subscribe_button" class="button button-primary" value="Subscribe" onclick="loginizer_email_subscribe();" style="margin-top:0px;">
5650	</div>
5651	<div class="col-md-3">
5652	</div>
5653	</div>
5654	</form>
5655	<p><b>Note :</b> If a Loginizer account does not exist it will be created.</p>
5656	</div>
5657	</div>
5658	</div><br />
5659
5660	<script type="text/javascript">
5661	function loginizer_dismiss_newsletter(){
5662
5663	var data = new Object();
5664	data["action"] = "loginizer_dismiss_newsletter";
5665	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5666
5667	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5668	jQuery.post(admin_url, data, function(response){
5669
5670	});
5671
5672	}
5673
5674	function loginizer_email_subscribe(){
5675	var subs_location = "'.$env['url'].'?email="+encodeURIComponent(jQuery("#subscribe_email").val());
5676	window.open(subs_location, "_blank");
5677	}
5678	jQuery(document).on("click", ".my-loginizer-dismiss-notice .notice-dismiss", loginizer_dismiss_newsletter);
5679	</script>';
5680
5681	return true;
5682	}
5683
5684	function loginizer_backuply_promo(){
5685
5686	$plugins = get_plugins();
5687
5688	// Dont show Backuply Promo if its already installed
5689	if(array_key_exists('backuply-pro/backuply-pro.php', $plugins) \|\| array_key_exists('backuply/backuply.php', $plugins)){
5690	return;
5691	}
5692
5693	if(isset($_REQUEST['install_backuply'])){
5694	if(!wp_verify_nonce($_REQUEST['security'], 'loginizer_install_backuply') \|\| !current_user_can('activate_plugins')){
5695	die('Only Admin can access it');
5696	}
5697
5698	loginizer_backuply_install();
5699	return;
5700	}
5701
5702	echo '<div class="notice is-dismissible lz-welcome-panel lz-backuply-dismissible" style="padding:20px; margin:0;">
5703	<table>
5704	<tr>
5705	<th width="25%">
5706	<img src="'.LOGINIZER_URL.'\images\backuply-square.png" height="150px" width="150px"/>
5707	</th>
5708	<td width="75%">
5709	<div class="inside" style="margin-left: 20px;">
5710	<strong><i>'.__('Backups are the best form of security. Secure your WordPress site by creating backups with Backuply','loginizer').'</i>:</strong><br>
5711	<ul class="lz-right-ul">
5712	<li>'.__('Backup to remote locations like FTP, FTPS, SFTP, WebDAV, Google Drive, OneDrive, Dropbox, Amazon S3','loginizer').'</li>
5713	<li>'.__('Auto Backups','loginizer').'</li>
5714	<li>'.__('Easy One-Click restores','loginizer').'</li>
5715	<li>'.__('Stress Free Migrations','loginizer').'</li>
5716	</ul>
5717	<a class="button button-primary" href="'.esc_url(admin_url('admin.php?page=loginizer&install_backuply=1&security='.wp_create_nonce('loginizer_install_backuply'))).'">'.__('Install Backuply', 'loginizer').'</a>  <a class="button button-secondary" target="_blank" href="https://wordpress.org/plugins/backuply/">'.__('Visit Backuply','loginizer').'</a>
5718	</div>
5719	</td>
5720	</tr>
5721	</table>
5722	</div><br />
5723	<script type="text/javascript">
5724	function loginizer_dismiss_backuply(){
5725
5726	var data = new Object();
5727	data["action"] = "loginizer_dismiss_backuply";
5728	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5729
5730	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5731	jQuery.post(admin_url, data, function(response){
5732
5733	});
5734
5735	}
5736
5737	jQuery(document).on("click", ".lz-backuply-dismissible .notice-dismiss", loginizer_dismiss_backuply);
5738	</script>';
5739
5740	return true;
5741	}
5742
5743	function loginizer_csrf_promo(){
5744
5745	echo '<div class="notice notice-success is-dismissible lz-csrf-dismissible"><p>Secure your WordPress site from CSRF attacks with our new feature <strong>CSRF Protection</strong> <a href="https://loginizer.com/docs/configuration-and-settings/how-to-enable-csrf-protection/" target="_blank" class="button button-primary">Read More</a></p></div>';
5746
5747	echo'<script type="text/javascript">
5748	function loginizer_dismiss_csrf(){
5749
5750	var data = new Object();
5751	data["action"] = "loginizer_dismiss_csrf";
5752	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5753
5754	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5755	jQuery.post(admin_url, data, function(response){
5756
5757	});
5758
5759	}
5760
5761	jQuery(document).on("click", ".lz-csrf-dismissible", loginizer_dismiss_csrf);
5762	</script>';
5763	}
5764
5765	// Install Backuply
5766	function loginizer_backuply_install(){
5767
5768	// Include the necessary stuff
5769	include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
5770
5771	// Includes necessary for Plugin_Upgrader and Plugin_Installer_Skin
5772	include_once( ABSPATH . 'wp-admin/includes/file.php' );
5773	include_once( ABSPATH . 'wp-admin/includes/misc.php' );
5774	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
5775
5776	// Filter to prevent the activate text
5777	add_filter('install_plugin_complete_actions', 'loginizer_backuply_install_complete_actions', 10, 3);
5778
5779	$upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin() );
5780	$installed = $upgrader->install('https://downloads.wordpress.org/plugin/backuply.zip');
5781
5782	if ( !is_wp_error( $installed ) && $installed ) {
5783	echo 'Activating Backuply !';
5784	$activate = activate_plugin('backuply/backuply.php');
5785
5786	if ( is_null($activate) ) {
5787	echo '<div id="message" class="updated"><p>'. esc_html__('Done! Backuply is now installed and activated.', 'loginizer'). '</p></div><br /><br><br><b>'. esc_html__('Done! Backuply is now installed and activated.', 'loginizer').'</b>';
5788	}
5789	}
5790
5791	return $installed;
5792	}
5793
5794	// Prevent pro activate text for installer
5795	function loginizer_backuply_install_complete_actions($install_actions, $api, $plugin_file){
5796
5797	if($plugin_file == 'backuply/backuply.php'){
5798	return array();
5799	}
5800
5801	return $install_actions;
5802	}
5803
5804
5805	// Sorry to see you going
5806	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
5807
5808	function loginizer_deactivation(){
5809
5810	global $wpdb;
5811
5812	$sql = array();
5813	$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
5814
5815	foreach($sql as $sk => $sv){
5816	$wpdb->query($sv);
5817	}
5818
5819	delete_option('loginizer_version');
5820	delete_option('loginizer_options');
5821	delete_option('loginizer_last_reset');
5822	delete_option('loginizer_whitelist');
5823	delete_option('loginizer_blacklist');
5824	delete_option('loginizer_msg');
5825	delete_option('loginizer_2fa_msg');
5826	delete_option('loginizer_2fa_email_template');
5827	delete_option('loginizer_security');
5828	delete_option('loginizer_wp_admin');
5829	delete_option('loginizer_csrf_promo_time');
5830	delete_option('loginizer_backuply_promo_time');
5831	delete_option('loginizer_promo_time');
5832	delete_option('loginizer_ins_time');
5833	delete_option('loginizer_2fa_whitelist');
5834	delete_option('loginizer_checksums_last_run');
5835	delete_option('loginizer_checksums_diff');
5836	delete_option('loginizer_ip_method');
5837	delete_option('loginizer_2fa_custom_redirect');
5838
5839	}
5840
5841