';
}
// Should return NULL if everything is fine
function loginizer_wp_authenticate($user, $username, $password){
global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
if(!empty($username) && !empty($password)){
$lz_user_pass = 1;
}
// Are you whitelisted ?
if(loginizer_is_whitelisted()){
$loginizer['ip_is_whitelisted'] = 1;
return $user;
} else if (!empty($loginizer['trusted_ips'])){
$lz_cannot_login = 1;
// This is used by WP Activity Log
apply_filters( 'wp_login_blocked', $username );
return new WP_Error('ip_blacklisted', __('Your IP is not whitelisted, so you can not log in', 'loginizer'));
}
// Are you blacklisted ?
if(loginizer_is_blacklisted()){
$lz_cannot_login = 1;
// This is used by WP Activity Log
apply_filters( 'wp_login_blocked', $username );
return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
}
// Is the username blacklisted ?
if(function_exists('loginizer_user_blacklisted')){
if(loginizer_user_blacklisted($username)){
$lz_cannot_login = 1;
// This is used by WP Activity Log
apply_filters( 'wp_login_blocked', $username );
return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
}
}
if(loginizer_can_login()){
return $user;
}
$lz_cannot_login = 1;
// This is used by WP Activity Log
apply_filters( 'wp_login_blocked', $username );
return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
}
function loginizer_can_login(){
global $wpdb, $loginizer, $lz_error;
// Get the logs
$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
$result = lz_selectquery($sel_query);
if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
// Has he reached max lockouts ?
if($result['lockout'] >= $loginizer['max_lockouts']){
$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
}
// Is he in the lockout time ?
if($result['time'] >= (time() - $loginizer['lockout_time'])){
$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
//echo 'Current Time '.date('d/M/Y H:i:s P', time()).' ';
//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).' ';
//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).' ';
$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
if($banlift > 60){
$banlift = ceil($banlift / 60);
$_time = $banlift.' '.$loginizer['msg']['hours_err'];
}
$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
return false;
}
}
return true;
}
function loginizer_is_blacklisted(){
global $wpdb, $loginizer, $lz_error;
$blacklist = $loginizer['blacklist'];
if(empty($blacklist)){
return false;
}
foreach($blacklist as $k => $v){
// Is the IP in the blacklist ?
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
$result = 1;
break;
}
// Is it in a wider range ?
if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
// if the current IP is <= than the start of the range, it is within the range
// OR
// if the current IP is <= than the end of the range, it is within the range
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
|| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
$result = 1;
break;
}
}
}
// You are blacklisted
if(!empty($result)){
$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
return true;
}
return false;
}
function loginizer_is_whitelisted(){
global $wpdb, $loginizer, $lz_error;
$whitelist = $loginizer['whitelist'];
if(empty($whitelist)){
return false;
}
foreach($whitelist as $k => $v){
// Is the IP in the blacklist ?
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
$result = 1;
break;
}
// Is it in a wider range ?
if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
// if the current IP is <= than the start of the range, it is within the range
// OR
// if the current IP is <= than the end of the range, it is within the range
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
|| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
$result = 1;
break;
}
}
}
// You are whitelisted
if(!empty($result)){
return true;
}
return false;
}
// When the login fails, then this is called
// We need to update the database
function loginizer_login_failed($username, $is_2fa = ''){
global $wpdb, $loginizer, $lz_cannot_login;
// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
if(empty($username) || is_null($username)){
$username = '';
}
$fail_type = 'Login';
if(!empty($is_2fa)){
$fail_type = '2FA';
}
if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
$url = esc_url($url);
$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
$result = lz_selectquery($sel_query);
if(!empty($result)){
$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
$update_data = array('username' => $username,
'time' => time(),
'count' => $result['count']+1,
'lockout' => $lockout,
'url' => $url);
$where_data = array('ip' => $loginizer['current_ip']);
$format = array('%s','%d','%d','%d','%s');
$where_format = array('%s');
$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
// Do we need to email admin ?
if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
$lockout_time = $loginizer['lockout_time'];
if($lockout >= $loginizer['max_lockouts']){
// extended lockout is in hours so we have to convert to minute
$lockout_time = $loginizer['lockouts_extend'];
}
$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
$mail = array();
$mail['to'] = $loginizer['notify_email_address'];
$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
$mail['message'] = 'Hi,
'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
'.home_url().'
Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
Last User Attempt : '.$username.'
IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
Regards,
Loginizer';
@wp_mail($mail['to'], $mail['subject'], $mail['message']);
}
}else{
$result = array();
$result['count'] = 0;
$insert_data = array('username' => $username,
'time' => time(),
'count' => 1,
'ip' => $loginizer['current_ip'],
'lockout' => 0,
'url' => $url);
$format = array('%s','%d','%d','%s','%d','%s');
$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
}
// We need to add one as this is a failed attempt as well
$result['count'] = $result['count'] + 1;
$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
}
}
// Handles the error of the password not being there
function loginizer_error_handler($errors, $redirect_to){
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
//echo 'loginizer_error_handler :';print_r($errors->errors);echo ' ';
if(is_null($errors) || empty($errors)){
return true;
}
// Remove the empty password error
if(is_wp_error($errors)){
$codes = $errors->get_error_codes();
foreach($codes as $k => $v){
if($v == 'invalid_username' || $v == 'incorrect_password'){
$show_error = 1;
}
}
$errors->remove('invalid_username');
$errors->remove('incorrect_password');
// Add the error
if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
$errors->add('invalid_userpass', 'ERROR: ' . $loginizer['msg']['inv_userpass']);
}
// Add the number of retires left as well
if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
$errors->add('retries_left', loginizer_retries_left());
}
}
return $errors;
}
// Handles the error of the password not being there
function loginizer_woocommerce_error_handler(){
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
if(function_exists('wc_add_notice')){
wc_add_notice( loginizer_retries_left(), 'error' );
}
}
// Returns a string with the number of retries left
function loginizer_retries_left(){
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
// If we are to show the number of retries left
if(isset($loginizer['retries_left'])){
$retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
return ''.sanitize_text_field($retries_left).' '.$loginizer['msg']['attempts_left'];
}
}
function loginizer_reset_retries(){
global $wpdb, $loginizer;
$deltime = time() - $loginizer['reset_retries'];
$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
$result = $wpdb->query($del_query);
update_option('loginizer_last_reset', time());
}
add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
// Add settings link on plugin page
function loginizer_plugin_action_links($links) {
if(!defined('LOGINIZER_PREMIUM')){
$links[] = ''._x('Upgrade', 'Plugin action link label.', 'loginizer').'';
}
$settings_link = 'Settings';
array_unshift($links, $settings_link);
return $links;
}
add_action('admin_menu', 'loginizer_admin_menu');
// Shows the admin menu of Loginizer
function loginizer_admin_menu() {
global $wp_version, $loginizer;
if(!defined('SITEPAD')){
// Add the menu page
add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
// Dashboard
add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
}else{
// Add the menu page
add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
// Rename Login
add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
}
// Brute Force
add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
// PasswordLess
add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
// Security Settings
if(!defined('SITEPAD')){
// Two Factor Auth
add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
}
// reCaptcha
add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
// Security Settings
if(!defined('SITEPAD')){
// Security Settings
add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
// File Checksums
add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
}
if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
// Go Pro link
add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
}
}
// The Loginizer Admin Options Page
function loginizer_page_header($title = 'Loginizer'){
global $loginizer;
?>
';
}
// The Loginizer Admin Options Page
function loginizer_page_dashboard(){
global $loginizer, $lz_error, $lz_env;
if(!current_user_can('manage_options')){
wp_die('Sorry, but you do not have permissions to change settings.');
}
// Dismiss the announcement
if(isset($_GET['dismiss_announcement'])){
update_option('loginizer_no_announcement', 1);
}
/* Make sure post was from this page */
if(count($_POST) > 0){
check_admin_referer('loginizer-options');
}
do_action('loginizer_pre_page_dashboard');
// Is there a IP Method ?
if(isset($_POST['save_lz_ip_method'])){
$ip_method = (int) lz_optpost('lz_ip_method');
$custom_ip_method = lz_optpost('lz_custom_ip_method');
if($ip_method >= 0 && $ip_method <= 3){
update_option('loginizer_ip_method', $ip_method);
}
// Custom Method name ?
if($ip_method == 3){
update_option('loginizer_custom_ip_method', $custom_ip_method);
}
}
loginizer_page_dashboard_T();
}
// The Loginizer Admin Options Page - THEME
function loginizer_page_dashboard_T(){
global $loginizer, $lz_error, $lz_env;
loginizer_page_header('Dashboard');
?>
Your Server IP Address seems to match the Client IP detected by Loginizer. You might want to change the IP detection method to HTTP_X_FORWARDED_FOR under System Information section.
'. __('Thank you for choosing Loginizer! Many more features coming soon... Review Loginizer at WordPress ', 'loginizer').''. __('Add Review', 'loginizer'). '
0){
check_admin_referer('loginizer-options');
}
// BEGIN THEME
loginizer_page_header('Brute Force Settings');
// Load the blacklist and whitelist
$loginizer['blacklist'] = get_option('loginizer_blacklist');
$loginizer['whitelist'] = get_option('loginizer_whitelist');
// Disable Brute Force
if(isset($_POST['disable_brute_lz'])){
// Save the options
update_option('loginizer_disable_brute', 1);
$loginizer['disable_brute'] = 1;
echo '
'
. __('The Brute Force Protection feature is now disabled', 'loginizer')
. '
';
}
// Enable brute force
if(isset($_POST['enable_brute_lz'])){
// Save the options
update_option('loginizer_disable_brute', 0);
$loginizer['disable_brute'] = 0;
echo '
'
. __('The Brute Force Protection feature is now enabled', 'loginizer')
. '
';
}
// The Brute Force Settings
if(isset($_POST['save_lz'])){
$max_retries = (int) lz_optpost('max_retries');
$lockout_time = (int) lz_optpost('lockout_time');
$max_lockouts = (int) lz_optpost('max_lockouts');
$lockouts_extend = (int) lz_optpost('lockouts_extend');
$reset_retries = (int) lz_optpost('reset_retries');
$notify_email = (int) lz_optpost('notify_email');
$notify_email_address = lz_optpost('notify_email_address');
$trusted_ips = lz_optpost('trusted_ips');
if(!empty($notify_email_address) && !lz_valid_email($notify_email_address)){
$error[] = __('Email address is invalid', 'loginizer');
}
if(empty(loginizer_is_whitelisted()) && isset($_POST['trusted_ips'])){
$error[] = __('Add your IP to whitelist to enable Trusted IP\'s', 'loginizer');
}
if(!empty($max_retries) && $max_retries < 0){
$error[] = __('Max Retries value is invalid', 'loginizer');
}
if(!empty($lockout_time) && $lockout_time < 0){
$error[] = __('Lockout Time value is invalid', 'loginizer');
}
if(!empty($max_lockouts) && $max_lockouts < 0){
$error[] = __('Max Lockouts value is invalid', 'loginizer');
}
if(!empty($lockouts_extend) && $lockouts_extend < 0){
$error[] = __('Extended Lockout value is invalid', 'loginizer');
}
if(!empty($reset_retries) && $reset_retries < 0){
$error[] = __('Reset Retries value is invalid', 'loginizer');
}
if(!empty($notify_email) && $notify_email < 0){
$error[] = __('Email Notification value is invalid', 'loginizer');
}
$lockout_time = $lockout_time * 60;
$lockouts_extend = $lockouts_extend * 60 * 60;
$reset_retries = $reset_retries * 60 * 60;
if(empty($error)){
$option['max_retries'] = $max_retries;
$option['lockout_time'] = $lockout_time;
$option['max_lockouts'] = $max_lockouts;
$option['lockouts_extend'] = $lockouts_extend;
$option['reset_retries'] = $reset_retries;
$option['notify_email'] = $notify_email;
$option['notify_email_address'] = $notify_email_address;
$option['trusted_ips'] = $trusted_ips;
// Save the options
update_option('loginizer_options', $option);
$saved = true;
}else{
lz_report_error($error);
}
if(!empty($notice)){
lz_report_notice($notice);
}
if(!empty($saved)){
echo '
'
. __('The settings were saved successfully', 'loginizer')
. '
';
}
}
// Delete a Blackist IP range
if(isset($_POST['bdelid'])){
$delid = (int) lz_optreq('bdelid');
// Unset and save
$blacklist = $loginizer['blacklist'];
unset($blacklist[$delid]);
update_option('loginizer_blacklist', $blacklist);
echo '
'
. __('The Blacklist IP range has been deleted successfully', 'loginizer')
. '
';
}
// Delete all Blackist IP ranges
if(isset($_POST['del_all_blacklist'])){
// Unset and save
update_option('loginizer_blacklist', array());
echo '
'
. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
. '
';
}
// Delete a Whitelist IP range
if(isset($_POST['delid'])){
$delid = (int) lz_optreq('delid');
// Unset and save
$whitelist = $loginizer['whitelist'];
unset($whitelist[$delid]);
update_option('loginizer_whitelist', $whitelist);
echo '
'
. __('The Whitelist IP range has been deleted successfully', 'loginizer')
. '
';
}
// Delete all Blackist IP ranges
if(isset($_POST['del_all_whitelist'])){
// Unset and save
update_option('loginizer_whitelist', array());
echo '
'
. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
. '
';
}
// Reset All Logs
if(isset($_POST['lz_reset_all_ip'])){
$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` > 0");
echo '
'
. __('All the IP Logs have been cleared', 'loginizer')
. '
';
}
// Reset Logs
if(isset($_POST['lz_reset_ip']) && isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
$ips = $_POST['lz_reset_ips'];
foreach($ips as $ip){
if(!lz_valid_ip($ip)){
$error[] = 'The IP - '.esc_html($ip).' is invalid !';
}
}
if(count($ips) < 1){
$error[] = __('There are no IPs submitted', 'loginizer');
}
// Should we start deleting logs
if(empty($error)){
foreach($ips as $ip){
$result = $wpdb->query($wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $ip));
}
if(empty($error)){
echo '
'
. __('The selected IP Logs have been reset', 'loginizer')
. '
';
}
}
if(!empty($error)){
lz_report_error($error);echo ' ';
}
}
if(isset($_POST['blacklist_iprange'])){
$start_ip = lz_optpost('start_ip');
$end_ip = lz_optpost('end_ip');
// If no end IP we consider only 1 IP
if(empty($end_ip)){
$end_ip = $start_ip;
}
// Validate the IP against all checks
loginizer_iprange_validate($start_ip, $end_ip, $loginizer['blacklist'], $error);
if(empty($error)){
$blacklist = $loginizer['blacklist'];
$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
$blacklist[$newid] = array();
$blacklist[$newid]['start'] = $start_ip;
$blacklist[$newid]['end'] = $end_ip;
$blacklist[$newid]['time'] = time();
update_option('loginizer_blacklist', $blacklist);
echo '
'
. __('Blacklist IP range added successfully', 'loginizer')
. '
';
}
if(!empty($error)){
lz_report_error($error);echo ' ';
}
}
if(isset($_POST['whitelist_iprange'])){
$start_ip = lz_optpost('start_ip_w');
$end_ip = lz_optpost('end_ip_w');
// If no end IP we consider only 1 IP
if(empty($end_ip)){
$end_ip = $start_ip;
}
// Validate the IP against all checks
loginizer_iprange_validate($start_ip, $end_ip, $loginizer['whitelist'], $error);
if(empty($error)){
$whitelist = $loginizer['whitelist'];
$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
$whitelist[$newid] = array();
$whitelist[$newid]['start'] = $start_ip;
$whitelist[$newid]['end'] = $end_ip;
$whitelist[$newid]['time'] = time();
update_option('loginizer_whitelist', $whitelist);
echo '
'
. __('Whitelist IP range added successfully', 'loginizer')
. '
';
}
if(!empty($error)){
lz_report_error($error);echo ' ';
}
}
if(isset($_POST['lz_import_csv'])){
if(!empty($_FILES['lz_import_file_csv']['name'])){
$lz_csv_type = lz_optpost('lz_csv_type');
// Is the submitted type in the allowed list ?
if(!in_array($lz_csv_type, array('blacklist', 'whitelist'))){
$error[] = __('Invalid import type', 'loginizer');
}
if(empty($error)){
//Get the extension of the file
$csv_file_name = basename($_FILES['lz_import_file_csv']['name']);
$csv_ext_name = strtolower(pathinfo($csv_file_name, PATHINFO_EXTENSION));
//Check if it's a csv file
if($csv_ext_name == 'csv'){
$file = fopen($_FILES['lz_import_file_csv']['tmp_name'], "r");
$line_count = 0;
$update_record = 0;
while($content = fgetcsv($file)){
//Increment the $line_count
$line_count++;
//Skip the first line
if($line_count <= 1){
continue;
}
if(loginizer_iprange_validate($content[0], $content[1], $loginizer[$lz_csv_type], $error, $line_count)){
$newid = ( empty($loginizer[$lz_csv_type]) ? 0 : max(array_keys($loginizer[$lz_csv_type])) ) + 1;
$loginizer[$lz_csv_type][$newid] = array();
$loginizer[$lz_csv_type][$newid]['start'] = $content[0];
$loginizer[$lz_csv_type][$newid]['end'] = $content[1];
$loginizer[$lz_csv_type][$newid]['time'] = time();
$update_record = 1;
}
}
fclose($file);
if(!empty($update_record)){
update_option('loginizer_'.$lz_csv_type, $loginizer[$lz_csv_type]);
echo '
'
. __('Imported '.ucfirst($lz_csv_type).' IP range(s) successfully', 'loginizer')
. '
';
}
if(!empty($error)){
lz_report_error($error);echo ' ';
}
}
}
}
}
//Brute Force Bulk Blacklist/ Whitelist Ip
if(isset($_POST['lz_blacklist_selected_ip'])){
if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
$ips = $_POST['lz_reset_ips'];
foreach($ips as $ip){
if(!lz_valid_ip($ip)){
$error[] = 'The IP - '.esc_html($ip).' is invalid !';
}
}
if(count($ips) < 1){
$error[] = __('There are no IPs submitted', 'loginizer');
}
// Should we start deleting logs
if(empty($error)){
$update_record = 0;
foreach($ips as $ip){
if(loginizer_iprange_validate($ip, '', $loginizer['blacklist'], $error)){
$newid = ( empty($loginizer['blacklist']) ? 0 : max(array_keys($loginizer['blacklist'])) ) + 1;
$loginizer['blacklist'][$newid] = array();
$loginizer['blacklist'][$newid]['start'] = $ip;
$loginizer['blacklist'][$newid]['end'] = $ip;
$loginizer['blacklist'][$newid]['time'] = time();
$update_record = 1;
}
}
if(!empty($update_record)){
update_option('loginizer_blacklist', $loginizer['blacklist']);
echo '
'
. __('The selected IP(s) have been blacklisted', 'loginizer')
. '
0){
$lz_error['not_in_free'] = __('This feature is not available in the Free version. Upgrade to Pro', 'loginizer');
return loginizer_page_2fa_T();
}
$lz_roles = get_editable_roles();
if(empty($lz_roles)){
$lz_roles = array();
}
/* Make sure post was from this page */
if(count($_POST) > 0){
check_admin_referer('loginizer-options');
}
// Settings submitted
if(isset($_POST['save_lz'])){
// In the future there can be more settings
$option['2fa_app'] = (int) lz_optpost('2fa_app');
$option['2fa_email'] = (int) lz_optpost('2fa_email');
$option['question'] = (int) lz_optpost('question');
$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
// Any roles to apply to ?
foreach($lz_roles as $k => $v){
if(lz_optpost('2fa_roles_'.$k)){
$option['2fa_roles'][$k] = 1;
}
}
// If its all, then blank it
if(lz_optpost('2fa_roles_all') || empty($option['2fa_roles'])){
$option['2fa_roles'] = '';
}
// Is there an error ?
if(!empty($lz_error)){
return loginizer_page_2fa_T();
}
// Save the options
update_option('loginizer_2fa', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
// update the rewrite rules for WooCommerce to make security settings page accessible from woo commerce client area
if((!empty($option['2fa_app']) || !empty($option['2fa_email']) || !empty($option['question']) || !empty($option['2fa_email_force'])) && class_exists('WooCommerce')){
loginizer_woocommerce_rewrite_rule();
}
}
// Reset a users 2FA
if(isset($_POST['reset_user_lz'])){
$_username = lz_optpost('lz_user_2fa_disable');
// Try to get the user
$user_search = get_user_by('login', $_username);
// If not found then search by email
if(empty($user_search)){
$user_search = get_user_by('email', $_username);
}
// If not found then give error
if(empty($user_search)){
$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
return loginizer_page_2fa_T();
}
// Get the user prefences
$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
// Blank it
$user_pref['pref'] = 'none';
// Save it
update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
// Mark as saved
$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
}
if(isset($_POST['save_2fa_custom_redirect'])){
if(!empty($_POST['lz_2fa_custom_login_redirect'])){
$loginizer['2fa_custom_login_redirect'] = map_deep($_POST['lz_2fa_custom_login_redirect'], 'sanitize_text_field');
update_option('loginizer_2fa_custom_redirect', $loginizer['2fa_custom_login_redirect']);
$GLOBALS['lz_saved'] = true;
}
}
if(isset($_POST['save_2fa_email_template_lz'])){
// In the future there can be more settings
$option['2fa_email_sub'] = @stripslashes($_POST['lz_2fa_email_sub']);
$option['2fa_email_msg'] = @stripslashes($_POST['lz_2fa_email_msg']);
// Is there an error ?
if(!empty($lz_error)){
return loginizer_page_2fa_T();
}
// Save the options
update_option('loginizer_2fa_email_template', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Save the messages
if(isset($_POST['save_msgs_lz'])){
$msgs['otp_app'] = lz_optpost('msg_otp_app');
$msgs['otp_email'] = lz_optpost('msg_otp_email');
$msgs['otp_field'] = lz_optpost('msg_otp_field');
$msgs['otp_question'] = lz_optpost('msg_otp_question');
$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
// Update them
update_option('loginizer_2fa_msg', $msgs);
// Mark as saved
$GLOBALS['lz_saved'] = __('Messages were saved successfully', 'loginizer');
}
// Delete a Whitelist IP range
if(isset($_POST['delid'])){
$delid = (int) lz_optreq('delid');
// Unset and save
$whitelist = $loginizer['2fa_whitelist'];
unset($whitelist[$delid]);
update_option('loginizer_2fa_whitelist', $whitelist);
// Mark as saved
$GLOBALS['lz_saved'] = __('The Whitelist IP range has been deleted successfully', 'loginizer');
}
// Delete all Blackist IP ranges
if(isset($_POST['del_all_whitelist'])){
// Unset and save
update_option('loginizer_2fa_whitelist', array());
// Mark as saved
$GLOBALS['lz_saved'] = __('The Whitelist IP range(s) have been cleared successfully', 'loginizer');
}
// Add IP range to 2FA whitelist
if(isset($_POST['2fa_whitelist_iprange'])){
$start_ip = lz_optpost('start_ip_w_2fa');
$end_ip = lz_optpost('end_ip_w_2fa');
if(empty($start_ip)){
$lz_error[] = __('Please enter the Start IP', 'loginizer');
return loginizer_page_2fa_T();
}
// If no end IP we consider only 1 IP
if(empty($end_ip)){
$end_ip = $start_ip;
}
if(!lz_valid_ip($start_ip)){
$lz_error[] = __('Please provide a valid start IP', 'loginizer');
}
if(!lz_valid_ip($end_ip)){
$lz_error[] = __('Please provide a valid end IP', 'loginizer');
}
if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
// This is right
}else{
$lz_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
}
}
if(empty($lz_error)){
$whitelist = $loginizer['2fa_whitelist'];
foreach($whitelist as $k => $v){
// This is to check if there is any other range exists with the same Start or End IP
if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
|| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
){
$lz_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
break;
}
// This is to check if there is any other range exists with the same Start IP
if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
$lz_error[] = __('The Start IP is present in an existing range !', 'loginizer');
break;
}
// This is to check if there is any other range exists with the same End IP
if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
$lz_error[] = __('The End IP is present in an existing range!', 'loginizer');
break;
}
}
$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
if(empty($lz_error)){
$whitelist[$newid] = array();
$whitelist[$newid]['start'] = $start_ip;
$whitelist[$newid]['end'] = $end_ip;
$whitelist[$newid]['time'] = time();
update_option('loginizer_2fa_whitelist', $whitelist);
// Mark as saved
$GLOBALS['lz_saved'] = __('Whitelist IP range for Two Factor Authentication added successfully', 'loginizer');
}
}
}
$lz_options = get_option('loginizer_2fa_email_template');
$saved_msgs = get_option('loginizer_2fa_msg');
$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
// Call theme
loginizer_page_2fa_T();
}
// Loginizer - Two Factor Auth Page
function loginizer_page_2fa_T(){
global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
// Universal header
loginizer_page_header('Two Factor Authentication');
loginizer_feature_available('Two-Factor Authentication');
// Saved ?
if(!empty($GLOBALS['lz_saved'])){
echo '
'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '
0){
$lz_error['not_in_free'] = __('This feature is not available in the Free version. Upgrade to Pro', 'loginizer');
return loginizer_page_passwordless_T();
}
/* Make sure post was from this page */
if(count($_POST) > 0){
check_admin_referer('loginizer-options');
}
if(isset($_POST['save_lz'])){
// In the future there can be more settings
$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
$option['passwordless_sub'] = @stripslashes($_POST['lz_passwordless_sub']);
$option['passwordless_msg'] = @stripslashes($_POST['lz_passwordless_msg']);
$option['passwordless_html'] = (int) lz_optpost('lz_passwordless_html');
$option['passwordless_redirect'] = esc_url_raw($_POST['lz_passwordless_redirect']);
$option['passwordless_redirect_for'] = map_deep($_POST['lz_passwordless_redirect_for'], 'sanitize_text_field');
// Is there an error ?
if(!empty($lz_error)){
return loginizer_page_passwordless_T();
}
// Save the options
update_option('loginizer_epl', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Call theme
loginizer_page_passwordless_T();
}
// Loginizer - PasswordLess Page Theme
function loginizer_page_passwordless_T(){
global $loginizer, $lz_error, $lz_env;
$lz_options = get_option('loginizer_epl');
// Universal header
loginizer_page_header('PasswordLess Settings');
loginizer_feature_available('PasswordLess Login');
// Saved ?
if(!empty($GLOBALS['lz_saved'])){
echo '
'. __('The settings were saved successfully', 'loginizer'). '
0){
$lz_error['not_in_free'] = __('This feature is not available in the Free version. Upgrade to Pro', 'loginizer');
return loginizer_page_security_T();
}
/* Make sure post was from this page */
if(count($_POST) > 0){
check_admin_referer('loginizer-options');
}
if(isset($_POST['save_lz'])){
$option['login_slug'] = lz_optpost('login_slug');
$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
// Login Slug Valid ?
if(!empty($option['login_slug'])){
if(strlen($option['login_slug']) <= 4 || strlen($option['login_slug']) > 50){
$lz_error['login_slug'] = __('The Login slug length must be greater than 4 chars and upto 50 chars long', 'loginizer');
}
}
// login slug and admin slug cannot be the same
$_loginizer_wp_admin = get_option('loginizer_wp_admin');
if(!empty($_loginizer_wp_admin['admin_slug']) && $_loginizer_wp_admin['admin_slug'] == $option['login_slug']){
$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
return loginizer_page_security_T();
}
// XML-RPC Slug Valid ?
if(!empty($option['xmlrpc_slug'])){
if(strlen($option['xmlrpc_slug']) <= 4 || strlen($option['xmlrpc_slug']) > 50){
$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than 4 chars and upto 50 chars long', 'loginizer');
}
}
// Is there an error ?
if(!empty($lz_error)){
return loginizer_page_security_T();
}
// Save the options
update_option('loginizer_security', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Reset the username
if(isset($_POST['save_lz_admin'])){
// Get the new username
$current_username = lz_optpost('current_username');
$new_username = lz_optpost('new_username');
if(empty($current_username)){
$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
return loginizer_page_security_T();
}
if(empty($new_username)){
$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
return loginizer_page_security_T();
}
// Is the starting of the username having 'admin' ?
if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
$lz_error['user_exists'] = __('The username begins with admin. Please change it !', 'loginizer');
return loginizer_page_security_T();
}
// Lets check if there is such a user
$found = get_user_by('login', $new_username);
// Found one !
if(!empty($found->ID)){
$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
return loginizer_page_security_T();
}
$old_user = get_user_by('login', $current_username);
if(empty($old_user->ID)){
$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
return loginizer_page_security_T();
}
if(empty($old_user->caps['administrator'])){
$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
return loginizer_page_security_T();
}
$is_super_admin = 0;
if(is_multisite() && is_super_admin($old_user->ID)){
$is_super_admin = 1;
}
// Update the username
$update_data = array('user_login' => $new_username);
$where_data = array('ID' => $old_user->ID);
$format = array('%s');
$where_format = array('%d');
$wpdb->update($wpdb->prefix.'users', $update_data, $where_data, $format, $where_format);
// Update the super admins list for multisite
if(!empty($is_super_admin)){
$super_admins = get_site_option('site_admins');
foreach($super_admins as $sk => $sv){
// Remove the existing username from super admins list
if($sv == $current_username){
unset($super_admins[$sk]);
}
}
// Add the new username
$super_admins[] = $new_username;
update_site_option( 'site_admins', $super_admins );
}
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Change the wp-admin slug
if(isset($_POST['save_lz_wp_admin'])){
// Get the new username
$option['admin_slug'] = lz_optpost('admin_slug');
$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
// login slug and admin slug cannot be the same
$_loginizer_security = get_option('loginizer_security');
if(!empty($_loginizer_security['login_slug']) && $_loginizer_security['login_slug'] == $option['admin_slug']){
$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
return loginizer_page_security_T();
}
// Did you agree to this ?
if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
return loginizer_page_security_T();
}
// Length
if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 || strlen($option['admin_slug']) > 50)){
$lz_error['admin_slug'] = __('The new Admin slug length must be greater than 4 chars and upto 50 chars long', 'loginizer');
return loginizer_page_security_T();
}
// Only regular characters
if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
return loginizer_page_security_T();
}
// Update the option
update_option('loginizer_wp_admin', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Save blacklisted usernames
if(isset($_POST['save_lz_bl_users'])){
$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
// Process the usernames i.e. remove blanks
foreach($usernames as $k => $v){
$v = trim($v);
// Unset blank values
if(empty($v)){
unset($usernames[$k]);
}
// Disallow these special characters to avoid XSS or any other security vulnerability
if(preg_match('/[\<\>\"\']/', $v)){
unset($usernames[$k]);
}
}
// Update the blacklist
update_option('loginizer_username_blacklist', array_values($usernames));
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Save blacklisted domains
if(isset($_POST['save_lz_bl_domains'])){
$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
// Process the domains i.e. remove blanks
foreach($domains as $k => $v){
$v = trim($v);
// Unset blank values
if(empty($v)){
unset($domains[$k]);
}
// Disallow these special characters to avoid XSS or any other security vulnerability
if(preg_match('/[\<\>\"\']/', $v)){
unset($domains[$k]);
}
}
// Update the blacklist
update_option('loginizer_domains_blacklist', array_values($domains));
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
if(isset($_POST['save_lz_csrf_protection'])){
update_option('loginizer_csrf_protection', empty(lz_optpost('enable_csrf_protection')) ? false : true);
delete_transient('loginizer_csrf_mod_rewrite');
$GLOBALS['lz_saved'] = true;
}
// Call theme
loginizer_page_security_T();
}
// Loginizer - Security Settings Page Theme
function loginizer_page_security_T(){
global $loginizer, $lz_error, $lz_env;
// Universal header
loginizer_page_header('Security Settings');
loginizer_feature_available('Security Settings');
// Saved ?
if(!empty($GLOBALS['lz_saved'])){
echo '
'. __('The settings were saved successfully', 'loginizer'). '
'. (!empty($is_csrf) ? esc_html__('Rewrites rule for CSRF session URL', 'loginizer') : esc_html__('Rewrites rule to change wp-admin and if you have a Multisite then check', 'loginizer') . ' our guide') . '
' . esc_html__('You can manually update your .htaccess by adding the given code at the top of your .htaccess file', 'loginizer'). '
';
}
}
// Loginizer - Checksum load data
function loginizer_page_checksums_L(&$files, &$_ignores){
global $loginizer, $lz_error, $lz_env;
// Load any mismatched files and ignores
$files = get_option('loginizer_checksums_diff');
$_ignores = get_option('loginizer_checksums_ignore');
$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
$ignores = array();
foreach($_ignores as $ik => $iv){
$ignores[$iv] = array();
if(!empty($files[$iv])){
$ignores[$iv] = $files[$iv];
}
}
$lz_env['files'] = $files;
$lz_env['ignores'] = $ignores;
}
// Loginizer - PasswordLess Page
function loginizer_page_checksums(){
global $loginizer, $lz_error, $lz_env;
if(!current_user_can('manage_options')){
wp_die('Sorry, but you do not have permissions to change settings.');
}
if(!loginizer_is_premium() && count($_POST) > 0){
$lz_error['not_in_free'] = __('This feature is not available in the Free version. Upgrade to Pro', 'loginizer');
return loginizer_page_checksums_T();
}
/* Make sure post was from this page */
if(count($_POST) > 0){
check_admin_referer('loginizer-options');
}
// Are we to run it ?
if(isset($_REQUEST['lz_run_checksum'])){
loginizer_checksums();
}
loginizer_page_checksums_L($files, $_ignores);
$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
if(isset($_POST['save_lz'])){
// In the future there can be more settings
$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
$option['checksum_time'] = lz_optpost('checksum_time');
// Is there an error ?
if(!empty($lz_error)){
return loginizer_page_checksums_T();
}
// Save the options
update_option('loginizer_checksums', $option);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Add or remove from ignore list
if(isset($_POST['save_lz_csum_ig'])){
if(@is_array($_POST['checksum_del_ignore'])){
foreach($_POST['checksum_del_ignore'] as $k => $v){
$key = array_search($v, $_ignores);
if($key !== false){
unset($_ignores[$key]);
}
}
// Save it
update_option('loginizer_checksums_ignore', $_ignores);
}
if(@is_array($_POST['checksum_add_ignore'])){
foreach($_POST['checksum_add_ignore'] as $k => $v){
if(!empty($files[$v])){
$_ignores[] = $v;
}
}
// Save it
update_option('loginizer_checksums_ignore', $_ignores);
}
// Reload
loginizer_page_checksums_L($files, $_ignores);
// Mark as saved
$GLOBALS['lz_saved'] = true;
}
// Call theme
loginizer_page_checksums_T();
}
// Loginizer - PasswordLess Page Theme
function loginizer_page_checksums_T(){
global $loginizer, $lz_error, $lz_env;
// Universal header
loginizer_page_header('File Checksum Settings');
loginizer_feature_available('File Checksum');
wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
// Saved ?
if(!empty($GLOBALS['lz_saved'])){
echo '
'. __('The settings were saved successfully', 'loginizer'). '
';
}
// Did we just run the checksums
if(isset($_REQUEST['lz_run_checksum'])){
echo '
'. __('The Checksum process was executed successfully', 'loginizer'). '
