loginizer / init.php

init.php in Loginizer 1.7.8, at init.php

6,118 lines 206.2 KB

Raw Download Zip

1	<?php
2
3	if(!function_exists('add_action')){
4	echo 'You are not allowed to access this page directly.';
5	exit;
6	}
7
8	define('LOGINIZER_VERSION', '1.7.8');
9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13	define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
14
15	include_once(LOGINIZER_DIR.'/functions.php');
16
17	// Ok so we are now ready to go
18	register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');
19
20	// Is called when the ADMIN enables the plugin
21	function loginizer_activation(){
22
23	global $wpdb;
24
25	$sql = array();
26
27	$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
28
29	$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
30	`username` varchar(255) NOT NULL DEFAULT '',
31	`time` int(10) NOT NULL DEFAULT '0',
32	`count` int(10) NOT NULL DEFAULT '0',
33	`lockout` int(10) NOT NULL DEFAULT '0',
34	`ip` varchar(255) NOT NULL DEFAULT '',
35	`url` varchar(255) NOT NULL DEFAULT '',
36	UNIQUE KEY `ip` (`ip`)
37	) DEFAULT CHARSET=utf8;";
38
39	foreach($sql as $sk => $sv){
40	$wpdb->query($sv);
41	}
42
43	add_option('loginizer_version', LOGINIZER_VERSION);
44	add_option('loginizer_options', array());
45	add_option('loginizer_last_reset', 0);
46	add_option('loginizer_whitelist', array());
47	add_option('loginizer_blacklist', array());
48	add_option('loginizer_2fa_whitelist', array());
49
50	}
51
52	/**
53	* Updates the database structure for Loginizer
54	*
55	* If the plugin files are updated but database structure is not updated
56	* this function will update the database structure as per the plugin version
57	* NOTE: This does not update plugin files it just updates the database structure
58	*/
59	function loginizer_update_check(){
60
61	global $wpdb;
62
63	$sql = array();
64	$current_version = get_option('loginizer_version');
65
66	// It must be the 1.0 pre stuff
67	if(empty($current_version)){
68	$current_version = get_option('lz_version');
69	}
70
71	$version = (int) str_replace('.', '', $current_version);
72
73	// No update required
74	if($current_version == LOGINIZER_VERSION){
75	return true;
76	}
77
78	// Is it first run ?
79	if(empty($current_version)){
80
81	// Reinstall
82	loginizer_activation();
83
84	// Trick the following if conditions to not run
85	$version = (int) str_replace('.', '', LOGINIZER_VERSION);
86
87	}
88
89	// Is it less than 1.0.1 ?
90	if($version < 101){
91
92	// TODO : GET the existing settings
93
94	// Get the existing settings
95	$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1);
96	$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1);
97	$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1);
98
99	// Delete the three tables
100	$sql = array();
101	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;";
102	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;";
103	$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;";
104
105	foreach($sql as $sk => $sv){
106	$wpdb->query($sv);
107	}
108
109	// Delete option
110	delete_option('lz_version');
111
112	// Reinstall
113	loginizer_activation();
114
115	// TODO : Save the existing settings
116
117	// Update the existing failed logs to new table
118	if(is_array($lz_failed_logs)){
119	foreach($lz_failed_logs as $fk => $fv){
120	$insert_data = array('username' => $fv['username'],
121	'time' => $fv['time'],
122	'count' => $fv['count'],
123	'lockout' => $fv['lockout'],
124	'ip' => $fv['ip']);
125
126	$format = array('%s','%d','%d','%d','%s');
127
128	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
129	}
130	}
131
132	// Update the existing options to new structure
133	if(is_array($lz_options)){
134	foreach($lz_options as $ok => $ov){
135
136	if($ov['option_name'] == 'lz_last_reset'){
137	update_option('loginizer_last_reset', $ov['option_value']);
138	continue;
139	}
140
141	$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
142	}
143	// Save the options
144	update_option('loginizer_options', $old_option);
145	}
146
147	// Update the existing iprange to new structure
148	if(is_array($lz_iprange)){
149
150	$old_blacklist = array();
151	$old_whitelist = array();
152	$bid = 1;
153	$wid = 1;
154	foreach($lz_iprange as $ik => $iv){
155
156	if(!empty($iv['blacklist'])){
157	$old_blacklist[$bid] = array();
158	$old_blacklist[$bid]['start'] = long2ip($iv['start']);
159	$old_blacklist[$bid]['end'] = long2ip($iv['end']);
160	$old_blacklist[$bid]['time'] = strtotime($iv['date']);
161	$bid = $bid + 1;
162	}
163
164	if(!empty($iv['whitelist'])){
165	$old_whitelist[$wid] = array();
166	$old_whitelist[$wid]['start'] = long2ip($iv['start']);
167	$old_whitelist[$wid]['end'] = long2ip($iv['end']);
168	$old_whitelist[$wid]['time'] = strtotime($iv['date']);
169	$wid = $wid + 1;
170	}
171	}
172
173	if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
174	if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
175	}
176
177	}
178
179	// Is it less than 1.3.9 ?
180	if($version < 139){
181
182	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
183
184	}
185
186	// Save the new Version
187	update_option('loginizer_version', LOGINIZER_VERSION);
188
189	// In Sitepad Math Captcha is enabled by default
190	if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
191	$option['captcha_no_google'] = 1;
192	add_option('loginizer_captcha', $option);
193	}
194
195	}
196
197	// Add the action to load the plugin
198	add_action('plugins_loaded', 'loginizer_load_plugin');
199
200	// The function that will be called when the plugin is loaded
201	function loginizer_load_plugin(){
202
203	global $loginizer;
204
205	// Check if the installed version is outdated
206	loginizer_update_check();
207
208	// Set the array
209	$loginizer = array();
210
211	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
212	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
213	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
214	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
215
216	// The IP Method to use
217	$loginizer['ip_method'] = get_option('loginizer_ip_method');
218	if($loginizer['ip_method'] == 3){
219	$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
220	}
221
222	// Load settings
223	$options = get_option('loginizer_options');
224	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
225	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
226	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
227	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
228	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
229	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
230	$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
231	$loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
232
233	if(!empty($options['notify_email_address'])){
234	$loginizer['notify_email_address'] = $options['notify_email_address'];
235	$loginizer['custom_notify_email'] = 1;
236	}
237
238	// Default messages
239	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
240	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
241	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
242	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
243	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
244	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
245
246	// Message Strings
247	$loginizer['msg'] = get_option('loginizer_msg', []);
248
249	foreach($loginizer['d_msg'] as $lk => $lv){
250	if(empty($loginizer['msg'][$lk])){
251	$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
252	}
253	}
254
255	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
256	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
257	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
258	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
259	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
260
261	// Message Strings
262	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
263
264	foreach($loginizer['2fa_d_msg'] as $lk => $lv){
265	if(empty($loginizer['2fa_msg'][$lk])){
266	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
267	}
268	}
269
270	// Load the blacklist and whitelist
271	$loginizer['blacklist'] = get_option('loginizer_blacklist');
272	$loginizer['whitelist'] = get_option('loginizer_whitelist');
273	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
274
275	// It should not be false
276	if(empty($loginizer['2fa_whitelist'])){
277	$loginizer['2fa_whitelist'] = array();
278	}
279
280	// When was the database cleared last time
281	$loginizer['last_reset'] = get_option('loginizer_last_reset');
282
283	//print_r($loginizer);
284
285	// Clear retries
286	if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){
287	loginizer_reset_retries();
288	}
289
290	$ins_time = get_option('loginizer_ins_time');
291	if(empty($ins_time)){
292	$ins_time = time();
293	update_option('loginizer_ins_time', $ins_time);
294	}
295	$loginizer['ins_time'] = $ins_time;
296
297	// Set the current IP
298	$loginizer['current_ip'] = lz_getip();
299
300	// Is Brute Force Disabled ?
301	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');
302
303	// Filters and actions
304	if(empty($loginizer['disable_brute'])){
305
306	// Use this to verify before WP tries to login
307	// Is always called and is the first function to be called
308	//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
309	add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
310
311	// Is called when a login attempt fails
312	// Hence Update our records that the login failed
313	add_action('wp_login_failed', 'loginizer_login_failed');
314
315	// Is called before displaying the error message so that we dont show that the username is wrong or the password
316	// Update Error message
317	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
318	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
319	add_action('wp_login', 'loginizer_login_success', 10, 2);
320
321	}
322
323	// ----------------
324	// PRO INIT
325	// ----------------
326
327	// Email to Login
328	$options = get_option('loginizer_epl');
329	$loginizer['pl_d_sub'] = __('Login at $site_name','loginizer');
330	$loginizer['pl_d_msg'] = __('Hi,
331
332	A login request was submitted for your account $email at :
333	$site_name - $site_url
334
335	Login at $site_name by visiting this url :
336	$login_url
337
338	If you have not requested for the Login URL, please ignore this email.
339
340	Regards,
341	$site_name','loginizer');
342	$loginizer['email_pass_less'] = empty($options['email_pass_less']) ? 0 : $options['email_pass_less'];
343	$loginizer['passwordless_sub'] = empty($options['passwordless_sub']) ? $loginizer['pl_d_sub'] : $options['passwordless_sub'];
344	$loginizer['passwordless_msg'] = empty($options['passwordless_msg']) ? $loginizer['pl_d_msg'] : $options['passwordless_msg'];
345	$loginizer['passwordless_msg_is_custom'] = empty($options['passwordless_msg']) ? 0 : 1;
346	$loginizer['passwordless_html'] = empty($options['passwordless_html']) ? 0 : $options['passwordless_html'];
347	$loginizer['passwordless_redirect'] = empty($options['passwordless_redirect']) ? 0 : $options['passwordless_redirect'];
348	$loginizer['passwordless_redirect_for'] = empty($options['passwordless_redirect_for']) ? 0 : $options['passwordless_redirect_for'];
349
350	// 2FA OTP Email to Login
351	$options = get_option('loginizer_2fa_email_template');
352	$loginizer['2fa_email_d_sub'] = 'OTP : Login at $site_name';
353	$loginizer['2fa_email_d_msg'] = 'Hi,
354
355	A login request was submitted for your account $email at :
356	$site_name - $site_url
357
358	Please use the following One Time password (OTP) to login :
359	$otp
360
361	Note : The OTP expires after 10 minutes.
362
363	If you haven\'t requested for the OTP, please ignore this email.
364
365	Regards,
366	$site_name';
367
368	$loginizer['2fa_email_sub'] = empty($options['2fa_email_sub']) ? $loginizer['2fa_email_d_sub'] : $options['2fa_email_sub'];
369	$loginizer['2fa_email_msg'] = empty($options['2fa_email_msg']) ? $loginizer['2fa_email_d_msg'] : $options['2fa_email_msg'];
370
371	// For SitePad its always on
372	if(defined('SITEPAD')){
373	$loginizer['email_pass_less'] = 1;
374	}
375
376	// Captcha
377	$options = get_option('loginizer_captcha');
378	$loginizer['captcha_type'] = empty($options['captcha_type']) ? '' : $options['captcha_type'];
379	$loginizer['captcha_key'] = empty($options['captcha_key']) ? '' : $options['captcha_key'];
380	$loginizer['captcha_secret'] = empty($options['captcha_secret']) ? '' : $options['captcha_secret'];
381	$loginizer['captcha_theme'] = empty($options['captcha_theme']) ? 'light' : $options['captcha_theme'];
382	$loginizer['captcha_size'] = empty($options['captcha_size']) ? 'normal' : $options['captcha_size'];
383	$loginizer['captcha_lang'] = empty($options['captcha_lang']) ? '' : $options['captcha_lang'];
384	$loginizer['captcha_user_hide'] = !isset($options['captcha_user_hide']) ? 0 : $options['captcha_user_hide'];
385	$loginizer['captcha_no_css_login'] = !isset($options['captcha_no_css_login']) ? 0 : $options['captcha_no_css_login'];
386	$loginizer['captcha_no_js'] = 1;
387	$loginizer['captcha_login'] = !isset($options['captcha_login']) ? 1 : $options['captcha_login'];
388	$loginizer['captcha_lostpass'] = !isset($options['captcha_lostpass']) ? 1 : $options['captcha_lostpass'];
389	$loginizer['captcha_resetpass'] = !isset($options['captcha_resetpass']) ? 1 : $options['captcha_resetpass'];
390	$loginizer['captcha_register'] = !isset($options['captcha_register']) ? 1 : $options['captcha_register'];
391	$loginizer['captcha_comment'] = !isset($options['captcha_comment']) ? 1 : $options['captcha_comment'];
392	$loginizer['captcha_wc_checkout'] = !isset($options['captcha_wc_checkout']) ? 1 : $options['captcha_wc_checkout'];
393
394	$loginizer['captcha_no_google'] = !isset($options['captcha_no_google']) ? 0 : $options['captcha_no_google'];
395	$loginizer['captcha_domain'] = empty($options['captcha_domain']) ? 'www.google.com' : $options['captcha_domain'];
396
397	$loginizer['captcha_text'] = empty($options['captcha_text']) ? __('Math Captcha', 'loginizer') : $options['captcha_text'];
398	$loginizer['captcha_time'] = empty($options['captcha_time']) ? 300 : $options['captcha_time'];
399	$loginizer['captcha_words'] = !isset($options['captcha_words']) ? 0 : $options['captcha_words'];
400	$loginizer['captcha_add'] = !isset($options['captcha_add']) ? 1 : $options['captcha_add'];
401	$loginizer['captcha_subtract'] = !isset($options['captcha_subtract']) ? 1 : $options['captcha_subtract'];
402	$loginizer['captcha_multiply'] = !isset($options['captcha_multiply']) ? 0 : $options['captcha_multiply'];
403	$loginizer['captcha_divide'] = !isset($options['captcha_divide']) ? 0 : $options['captcha_divide'];
404
405	// 2fa/question
406	$options = get_option('loginizer_2fa');
407	$loginizer['2fa_app'] = !isset($options['2fa_app']) ? 0 : $options['2fa_app'];
408	$loginizer['2fa_email'] = !isset($options['2fa_email']) ? 0 : $options['2fa_email'];
409	$loginizer['2fa_email_force'] = !isset($options['2fa_email_force']) ? 0 : $options['2fa_email_force'];
410	$loginizer['2fa_sms'] = !isset($options['2fa_sms']) ? 0 : $options['2fa_sms'];
411	$loginizer['question'] = !isset($options['question']) ? 0 : $options['question'];
412	$loginizer['2fa_default'] = empty($options['2fa_default']) ? 'question' : $options['2fa_default'];
413	$loginizer['2fa_roles'] = empty($options['2fa_roles']) ? array() : $options['2fa_roles'];
414
415	// Security Settings
416	$options = get_option('loginizer_security');
417	$loginizer['login_slug'] = empty($options['login_slug']) ? '' : $options['login_slug'];
418	$loginizer['rename_login_secret'] = empty($options['rename_login_secret']) ? '' : $options['rename_login_secret'];
419	$loginizer['xmlrpc_slug'] = empty($options['xmlrpc_slug']) ? '' : $options['xmlrpc_slug'];
420	$loginizer['xmlrpc_disable'] = empty($options['xmlrpc_disable']) ? '' : $options['xmlrpc_disable'];// Disable XML-RPC
421	$loginizer['pingbacks_disable'] = empty($options['pingbacks_disable']) ? '' : $options['pingbacks_disable'];// Disable Pingbacks
422
423	// Admin Slug Settings
424	$options = get_option('loginizer_wp_admin');
425	$loginizer['admin_slug'] = empty($options['admin_slug']) ? '' : $options['admin_slug'];
426	$loginizer['restrict_wp_admin'] = empty($options['restrict_wp_admin']) ? '' : $options['restrict_wp_admin'];
427	$loginizer['wp_admin_msg'] = empty($options['wp_admin_msg']) ? '' : $options['wp_admin_msg'];
428
429	// Checksum Settings
430	$options = get_option('loginizer_checksums');
431	$loginizer['disable_checksum'] = empty($options['disable_checksum']) ? '' : $options['disable_checksum'];
432	$loginizer['checksum_time'] = empty($options['checksum_time']) ? '' : $options['checksum_time'];
433	$loginizer['checksum_frequency'] = empty($options['checksum_frequency']) ? 7 : $options['checksum_frequency'];
434	$loginizer['no_checksum_email'] = empty($options['no_checksum_email']) ? '' : $options['no_checksum_email'];
435	$loginizer['checksums_last_run'] = get_option('loginizer_checksums_last_run');
436
437	// Auto Blacklist Usernames
438	$loginizer['username_blacklist'] = get_option('loginizer_username_blacklist');
439
440	$loginizer['domains_blacklist'] = get_option('loginizer_domains_blacklist');
441
442	$loginizer['wp_admin_d_msg'] = __('LZ : Not allowed via WP-ADMIN. Please access over the new Admin URL', 'loginizer');
443
444	// CSRF Protection
445	$loginizer['enable_csrf_protection'] = get_option('loginizer_csrf_protection');
446	$loginizer['2fa_custom_login_redirect'] = get_option('loginizer_2fa_custom_redirect');
447	$loginizer['limit_session'] = get_option('loginizer_limit_session');
448
449	// ----------------
450	// PRO INIT END
451	// ----------------
452
453	// Is the premium features there ?
454	if(file_exists(LOGINIZER_DIR.'/premium.php')){
455
456	// Include the file
457	include_once(LOGINIZER_DIR.'/premium.php');
458
459	loginizer_security_init();
460
461	// Its the free version
462	}else{
463
464	// The promo time
465	$loginizer['promo_time'] = get_option('loginizer_promo_time');
466	if(empty($loginizer['promo_time'])){
467	$loginizer['promo_time'] = time();
468	update_option('loginizer_promo_time', $loginizer['promo_time']);
469	}
470
471	// Are we to show the loginizer promo
472	if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30243600))){
473
474	add_action('admin_notices', 'loginizer_promo');
475
476	}
477
478	if(!file_exists(LOGINIZER_DIR.'/premium.php') && current_user_can('activate_plugins') && !empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
479
480	add_action('admin_notices', 'loginizer_csrf_promo');
481
482	}
483
484	// Are we to disable the promo
485	if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
486	update_option('loginizer_promo_time', (0 - time()) );
487	die('DONE');
488	}
489
490	$loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
491
492	if(empty($loginizer['backuply_promo'])){
493	$loginizer['backuply_promo'] = abs($loginizer['promo_time']);
494	update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
495	}
496
497	// Setting CSRF Promo time
498	$loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
499
500	if(empty($loginizer['csrf_promo'])){
501	$loginizer['csrf_promo'] = abs($loginizer['promo_time']);
502	update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
503	}
504	}
505
506	}
507
508	// Show the promo
509	function loginizer_promo(){
510
511	echo '
512	<style>
513	.lz_button {
514	background-color: #4CAF50; /* Green */
515	border: none;
516	color: white;
517	padding: 8px 16px;
518	text-align: center;
519	text-decoration: none;
520	display: inline-block;
521	font-size: 16px;
522	margin: 4px 2px;
523	-webkit-transition-duration: 0.4s; /* Safari */
524	transition-duration: 0.4s;
525	cursor: pointer;
526	}
527
528	.lz_button:focus{
529	border: none;
530	color: white;
531	}
532
533	.lz_button1 {
534	color: white;
535	background-color: #4CAF50;
536	border:3px solid #4CAF50;
537	}
538
539	.lz_button1:hover {
540	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
541	color: white;
542	border:3px solid #4CAF50;
543	}
544
545	.lz_button2 {
546	color: white;
547	background-color: #0085ba;
548	}
549
550	.lz_button2:hover {
551	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
552	color: white;
553	}
554
555	.lz_button3 {
556	color: white;
557	background-color: #365899;
558	}
559
560	.lz_button3:hover {
561	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
562	color: white;
563	}
564
565	.lz_button4 {
566	color: white;
567	background-color: rgb(66, 184, 221);
568	}
569
570	.lz_button4:hover {
571	box-shadow: 0 6px 8px 0 rgba(0,0,0,0.24), 0 9px 25px 0 rgba(0,0,0,0.19);
572	color: white;
573	}
574
575	.loginizer_promo-close{
576	float:right;
577	text-decoration:none;
578	margin: 5px 10px 0px 0px;
579	}
580
581	.loginizer_promo-close:hover{
582	color: red;
583	}
584	</style>
585
586	<script>
587	jQuery(document).ready( function() {
588	(function($) {
589	$("#loginizer_promo .loginizer_promo-close").click(function(){
590	var data;
591
592	// Hide it
593	$("#loginizer_promo").hide();
594
595	// Save this preference
596	$.post("'.admin_url('?loginizer_promo=0').'", data, function(response) {
597	//alert(response);
598	});
599	});
600	})(jQuery);
601	});
602	</script>
603
604	<div class="notice notice-success" id="loginizer_promo" style="min-height:120px">
605	<a class="loginizer_promo-close" href="javascript:" aria-label="Dismiss this Notice">
606	<span class="dashicons dashicons-dismiss"></span> Dismiss
607	</a>
608	<img src="'.LOGINIZER_URL.'/loginizer-200.png" style="float:left; margin:10px 20px 10px 10px" width="100" />
609	<p style="font-size:16px">We are glad you like Loginizer and have been using it since the past few days. It is time to take the next step </p>
610	<p>
611	<a class="lz_button lz_button1" target="_blank" href="https://loginizer.com/features">Upgrade to Pro</a>
612	<a class="lz_button lz_button2" target="_blank" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Rate it 5�
613	\'s</a>
614	<a class="lz_button lz_button3" target="_blank" href="https://www.facebook.com/Loginizer-815504798591884/">Like Us on Facebook</a>
615	<a class="lz_button lz_button4" target="_blank" href="https://twitter.com/home?status='.rawurlencode('I use @loginizer to secure my #WordPress site - https://loginizer.com').'">Tweet about Loginizer</a>
616	</p>
617	</div>';
618
619	}
620
621	// Should return NULL if everything is fine
622	function loginizer_wp_authenticate($user, $username, $password){
623
624	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
625
626	if(!empty($username) && !empty($password)){
627	$lz_user_pass = 1;
628	}
629
630	// Are you whitelisted ?
631	if(loginizer_is_whitelisted()){
632	$loginizer['ip_is_whitelisted'] = 1;
633	return $user;
634
635	} else if (!empty($loginizer['trusted_ips'])){
636	$lz_cannot_login = 1;
637
638	// This is used by WP Activity Log
639	apply_filters( 'wp_login_blocked', $username );
640
641	return new WP_Error('ip_blacklisted', __('Your IP is not whitelisted, so you can not log in', 'loginizer'));
642	}
643
644	// Are you blacklisted ?
645	if(loginizer_is_blacklisted()){
646	$lz_cannot_login = 1;
647
648	// This is used by WP Activity Log
649	apply_filters( 'wp_login_blocked', $username );
650
651	return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
652	}
653
654	// Is the username blacklisted ?
655	if(function_exists('loginizer_user_blacklisted')){
656	if(loginizer_user_blacklisted($username)){
657	$lz_cannot_login = 1;
658
659	// This is used by WP Activity Log
660	apply_filters( 'wp_login_blocked', $username );
661
662	return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
663	}
664	}
665
666	if(loginizer_can_login()){
667	return $user;
668	}
669
670	$lz_cannot_login = 1;
671
672	// This is used by WP Activity Log
673	apply_filters( 'wp_login_blocked', $username );
674
675	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
676
677	}
678
679	function loginizer_can_login(){
680
681	global $wpdb, $loginizer, $lz_error;
682
683	// Get the logs
684	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
685	$result = lz_selectquery($sel_query);
686
687	if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
688
689	// Has he reached max lockouts ?
690	if($result['lockout'] >= $loginizer['max_lockouts']){
691	$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
692	}
693
694	// Is he in the lockout time ?
695	if($result['time'] >= (time() - $loginizer['lockout_time'])){
696	$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
697
698	//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
699	//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
700	//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
701
702	$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
703
704	if($banlift > 60){
705	$banlift = ceil($banlift / 60);
706	$_time = $banlift.' '.$loginizer['msg']['hours_err'];
707	}
708
709	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
710
711	return false;
712	}
713	}
714
715	return true;
716	}
717
718	function loginizer_is_blacklisted(){
719
720	global $wpdb, $loginizer, $lz_error;
721
722	$blacklist = $loginizer['blacklist'];
723
724	if(empty($blacklist)){
725	return false;
726	}
727
728	foreach($blacklist as $k => $v){
729
730	// Is the IP in the blacklist ?
731	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
732	$result = 1;
733	break;
734	}
735
736	// Is it in a wider range ?
737	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
738
739	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
740	// if the current IP is <= than the start of the range, it is within the range
741	// OR
742	// if the current IP is <= than the end of the range, it is within the range
743	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
744	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
745	$result = 1;
746	break;
747	}
748
749	}
750
751	}
752
753	// You are blacklisted
754	if(!empty($result)){
755	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
756	return true;
757	}
758
759	return false;
760
761	}
762
763	function loginizer_is_whitelisted(){
764
765	global $wpdb, $loginizer, $lz_error;
766
767	$whitelist = $loginizer['whitelist'];
768
769	if(empty($whitelist)){
770	return false;
771	}
772
773	foreach($whitelist as $k => $v){
774
775	// Is the IP in the blacklist ?
776	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
777	$result = 1;
778	break;
779	}
780
781	// Is it in a wider range ?
782	if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
783
784	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
785	// if the current IP is <= than the start of the range, it is within the range
786	// OR
787	// if the current IP is <= than the end of the range, it is within the range
788	if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
789	\|\| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
790	$result = 1;
791	break;
792	}
793
794	}
795
796	}
797
798	// You are whitelisted
799	if(!empty($result)){
800	return true;
801	}
802
803	return false;
804
805	}
806
807
808	// When the login fails, then this is called
809	// We need to update the database
810	function loginizer_login_failed($username, $is_2fa = ''){
811
812	global $wpdb, $loginizer, $lz_cannot_login;
813
814	// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
815	if(empty($username) \|\| is_null($username)){
816	$username = '';
817	}
818
819	$fail_type = 'Login';
820
821	if(!empty($is_2fa)){
822	$fail_type = '2FA';
823	}
824
825	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
826
827	$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
828	$url = esc_url($url);
829
830	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
831	$result = lz_selectquery($sel_query);
832
833	if(!empty($result)){
834	$lockout = floor((($result['count']+1) / $loginizer['max_retries']));
835
836	$update_data = array('username' => $username,
837	'time' => time(),
838	'count' => $result['count']+1,
839	'lockout' => $lockout,
840	'url' => $url);
841
842	$where_data = array('ip' => $loginizer['current_ip']);
843
844	$format = array('%s','%d','%d','%d','%s');
845	$where_format = array('%s');
846
847	$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
848
849	// Do we need to email admin ?
850	if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
851
852	$lockout_time = $loginizer['lockout_time'];
853
854	if($lockout >= $loginizer['max_lockouts']){
855	// extended lockout is in hours so we have to convert to minute
856	$lockout_time = $loginizer['lockouts_extend'];
857	}
858
859	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
860	$mail = array();
861	$mail['to'] = $loginizer['notify_email_address'];
862	$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
863	$mail['message'] = 'Hi,
864
865	'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
866	'.home_url().'
867
868	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
869	Last User Attempt : '.$username.'
870	IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
871
872	Regards,
873	Loginizer';
874
875	@wp_mail($mail['to'], $mail['subject'], $mail['message']);
876	}
877	}else{
878	$result = array();
879	$result['count'] = 0;
880
881	$insert_data = array('username' => $username,
882	'time' => time(),
883	'count' => 1,
884	'ip' => $loginizer['current_ip'],
885	'lockout' => 0,
886	'url' => $url);
887
888	$format = array('%s','%d','%d','%s','%d','%s');
889
890	$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
891	}
892
893	// We need to add one as this is a failed attempt as well
894	$result['count'] = $result['count'] + 1;
895	loginizer_update_attempt_stats(0);
896	$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
897	$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
898
899	}
900	}
901
902	function loginizer_login_success($user_login, $user){
903	loginizer_update_attempt_stats(1);
904	}
905
906	function loginizer_update_attempt_stats($type){
907
908	$stats = get_option('loginizer_login_attempt_stats', []);
909	$time = strtotime(date('Y-m-d H:00:00'));
910
911	if(empty($stats[$time][$type])){
912	$stats[$time][$type] = 0;
913	}
914
915	$stats[$time][$type] += 1;
916
917	update_option('loginizer_login_attempt_stats', $stats, false);
918	}
919
920	// Handles the error of the password not being there
921	function loginizer_error_handler($errors, $redirect_to){
922
923	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
924
925	//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
926	if(is_null($errors) \|\| empty($errors)){
927	return true;
928	}
929
930	// Remove the empty password error
931	if(is_wp_error($errors)){
932
933	$codes = $errors->get_error_codes();
934
935	foreach($codes as $k => $v){
936	if($v == 'invalid_username' \|\| $v == 'incorrect_password'){
937	$show_error = 1;
938	}
939	}
940
941	$errors->remove('invalid_username');
942	$errors->remove('incorrect_password');
943
944	// Add the error
945	if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
946	$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
947	}
948
949	// Add the number of retires left as well
950	if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
951	$errors->add('retries_left', loginizer_retries_left());
952	}
953
954	}
955
956	return $errors;
957
958	}
959
960
961
962	// Handles the error of the password not being there
963	function loginizer_woocommerce_error_handler(){
964
965	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
966
967	if(function_exists('wc_add_notice')){
968	wc_add_notice( loginizer_retries_left(), 'error' );
969	}
970
971	}
972
973	// Returns a string with the number of retries left
974	function loginizer_retries_left(){
975
976	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
977
978	// If we are to show the number of retries left
979	if(isset($loginizer['retries_left'])){
980	$retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
981
982	return '<b>'.sanitize_text_field($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
983	}
984
985	}
986
987	function loginizer_reset_retries(){
988
989	global $wpdb, $loginizer;
990
991	$deltime = time() - $loginizer['reset_retries'];
992
993	$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
994	$result = $wpdb->query($del_query);
995
996	update_option('loginizer_last_reset', time());
997
998	}
999
1000	add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
1001
1002	// Add settings link on plugin page
1003	function loginizer_plugin_action_links($links) {
1004
1005	if(!defined('LOGINIZER_PREMIUM')){
1006	$links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
1007	}
1008
1009	$settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
1010	array_unshift($links, $settings_link);
1011
1012	return $links;
1013	}
1014
1015	add_action('admin_menu', 'loginizer_admin_menu');
1016
1017	// Shows the admin menu of Loginizer
1018	function loginizer_admin_menu() {
1019
1020	global $wp_version, $loginizer;
1021
1022	if(!defined('SITEPAD')){
1023
1024	// Add the menu page
1025	add_menu_page(__('Loginizer Dashboard', 'loginizer'), __('Loginizer Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
1026
1027	// Dashboard
1028	add_submenu_page('loginizer', __('Loginizer Dashboard', 'loginizer'), __('Dashboard', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
1029
1030	}else{
1031
1032	// Add the menu page
1033	add_menu_page(__('Security', 'loginizer'), __('Security', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security', 'dashicons-shield', 85);
1034
1035	// Rename Login
1036	add_submenu_page('loginizer', __('Security Settings', 'loginizer'), __('Rename Login', 'loginizer'), 'activate_plugins', 'loginizer', 'loginizer_page_security');
1037
1038	}
1039
1040	// Brute Force
1041	add_submenu_page('loginizer', __('Brute Force Settings', 'loginizer'), __('Brute Force', 'loginizer'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
1042
1043	// PasswordLess
1044	add_submenu_page('loginizer', __($loginizer['prefix'].'PasswordLess Settings', 'loginizer'), __('PasswordLess', 'loginizer'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
1045
1046	// Security Settings
1047	if(!defined('SITEPAD')){
1048
1049	// Two Factor Auth
1050	add_submenu_page('loginizer', __($loginizer['prefix'].' Two Factor Authentication', 'loginizer'), __('Two Factor Auth', 'loginizer'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
1051
1052	}
1053
1054	// reCaptcha
1055	add_submenu_page('loginizer', __($loginizer['prefix'].'reCAPTCHA Settings', 'loginizer'), __('reCAPTCHA', 'loginizer'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
1056
1057	// Security Settings
1058	if(!defined('SITEPAD')){
1059
1060	// Security Settings
1061	add_submenu_page('loginizer', __($loginizer['prefix'].'Security Settings', 'loginizer'), __('Security Settings', 'loginizer'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
1062
1063	// File Checksums
1064	add_submenu_page('loginizer', __('Loginizer File Checksums', 'loginizer'), __('File Checksums', 'loginizer'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
1065
1066	}
1067
1068	if(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30243600))){
1069
1070	// Go Pro link
1071	add_submenu_page('loginizer', __('Loginizer Go Pro', 'loginizer'), __('Go Pro', 'loginizer'), 'activate_plugins', LOGINIZER_PRO_URL);
1072
1073	}
1074
1075	}
1076
1077	// The Loginizer Admin Options Page
1078	function loginizer_page_header($title = 'Loginizer'){
1079
1080	global $loginizer;
1081
1082	?>
1083	<style>
1084	.lz-right-ul{
1085	padding-left: 10px !important;
1086	}
1087
1088	.lz-right-ul li{
1089	list-style: circle !important;
1090	}
1091	</style>
1092	<?php
1093
1094	echo '<div style="margin: 10px 20px 0 2px;">
1095	<div class="metabox-holder columns-2">
1096	<div class="postbox-container">
1097	<div id="top-sortables" class="meta-box-sortables ui-sortable">
1098
1099	<table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
1100	<tr>
1101	<td valign="top"><h3>'.$loginizer['prefix'].$title.'</h3></td>';
1102
1103	if(!defined('SITEPAD')){
1104
1105	echo '<td align="right"><a href="https://www.softaculous.com/clients?ca=affiliate" class="button button-primary" target="_blank">'. __('Refer and Earn', 'loginizer'). '</a> <a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">'.__('Review Loginizer', 'loginizer').'</a></td>
1106	<td align="right" width="40"><a target="_blank" href="https://twitter.com/loginizer"><img src="'.LOGINIZER_URL.'/twitter.png" /></a></td>
1107	<td align="right" width="40"><a target="_blank" href="https://www.facebook.com/Loginizer-815504798591884"><img src="'.LOGINIZER_URL.'/facebook.png" /></a></td>';
1108
1109	}
1110
1111	echo '
1112	</tr>
1113	</table>
1114	<hr />
1115
1116	<!--Main Table-->
1117	<table cellpadding="8" cellspacing="1" width="100%" class="fixed">
1118	<tr>
1119	<td valign="top">';
1120
1121	if(file_exists(LOGINIZER_DIR.'/premium.php') && !empty($loginizer['enable_csrf_protection']) && !loginizer_is_csrf_prot_mod_set()){
1122
1123	$lz_error['csrf_mod'] = esc_html__('You have enabled CSRF protection but the .htaccess file has not been updated', 'loginizer');
1124
1125	if(!empty($lz_error)){
1126	lz_report_error($lz_error);echo '<br />';
1127	}
1128	}
1129
1130	}
1131
1132	// The Loginizer Theme footer
1133	function loginizer_page_footer(){
1134
1135	if(!loginizer_is_premium()){
1136	echo '<script>
1137	jQuery("[loginizer-premium-only]").each(function(index) {
1138	jQuery(this).find( "input, textarea, select" ).attr("disabled", true);
1139	});
1140	</script>';
1141	}
1142
1143	echo '</td>
1144	<td width="200" valign="top" id="loginizer-right-bar">';
1145
1146	if(!defined('SITEPAD')){
1147
1148	if(!defined('LOGINIZER_PREMIUM')){
1149
1150	echo '
1151	<div class="postbox" style="min-width:0px !important;">
1152	<div class="postbox-header">
1153	<h2 class="hndle ui-sortable-handle">
1154	<span>'.__('Premium Version','loginizer').'</span>
1155	</h2>
1156	</div>
1157
1158	<div class="inside">
1159	<i>'.__('Upgrade to the premium version and get the following features','loginizer').' </i>:<br>
1160	<ul class="lz-right-ul">
1161	<li>'.__('PasswordLess Login','loginizer').'</li>
1162	<li>'.__('Two Factor Auth - Email','loginizer').'</li>
1163	<li>'.__('Two Factor Auth - App','loginizer').'</li>
1164	<li>'.__('Login Challenge Question','loginizer').'</li>
1165	<li>'.__('reCAPTCHA','loginizer').'</li>
1166	<li>'.__('Rename Login Page','loginizer').'</li>
1167	<li>'.__('Disable XML-RPC','loginizer').'</li>
1168	<li>'.__('And many more ...','loginizer').'</li>
1169	</ul>
1170	<center><a class="button button-primary" target="_blank" href="'.LOGINIZER_PRICING_URL.'">Upgrade</a></center>
1171	</div>
1172	</div>';
1173
1174	}else{
1175
1176	echo '
1177	<div class="postbox" style="min-width:0px !important;">
1178	<div class="postbox-header">
1179	<h2 class="hndle ui-sortable-handle">
1180	<span>'.__('Recommendations','loginizer').'</span>
1181	</h2>
1182	</div>
1183	<div class="inside">
1184	<i>'.__('We recommed that you enable atleast one of the following security features','loginizer').'</i>:<br>
1185	<ul class="lz-right-ul">
1186	<li>'.__('Rename Login Page','loginizer').'</li>
1187	<li>'.__('Login Challenge Question','loginizer').'</li>
1188	<li>'.__('reCAPTCHA','loginizer').'</li>
1189	<li>'.__('Two Factor Auth - Email','loginizer').'</li>
1190	<li>'.__('Two Factor Auth - App','loginizer').'</li>
1191	<li>'.__('Change \'admin\' Username','loginizer').'</li>
1192	</ul>
1193	</div>
1194	</div>';
1195	}
1196
1197	echo '
1198	<div class="postbox" style="min-width:0px !important;">
1199	<div class="postbox-header">
1200	<h2 class="hndle ui-sortable-handle">
1201	<span><a target="_blank" href="https://backuply.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/backuply-black.png" width="100%" /></a></span>
1202	</h2>
1203	</div>
1204	<div class="inside">
1205	<i>'.__('Secure your WordPress site by creating backups with Backuply', 'loginizer').'</i>:<br>
1206	<ul class="lz-right-ul">
1207	<li>'.__('Remote Backup to 8 location','loginizer').'</li>
1208	<li>'.__('Auto Backups', 'loginizer').'</li>
1209	<li>'.__('Backup Rotation', 'loginizer').'</li>
1210	<li>'.__('One-Click Restore', 'loginizer').'</li>
1211	<li>'.__('Stress-free Migration', 'loginizer').'</li>
1212	<li>'.__('Backup to Google Drive', 'loginizer').'</li>
1213	<li>'.__('Backup to Amazon S3', 'loginizer').'</li>
1214	<li>'.__('Backup to Dropbox', 'loginizer').'</li>
1215	<li>'.__('Backup to FTP,FTPS and many more ...','loginizer').'</li>
1216	</ul>
1217	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/backuply/">'.__('Visit Backuply','loginizer').'</a></center>
1218	</div>
1219	</div>';
1220
1221	echo '
1222	<div class="postbox" style="min-width:0px !important;">
1223	<div class="postbox-header">
1224	<h2 class="hndle ui-sortable-handle">
1225	<span><a target="_blank" href="https://pagelayer.com/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/pagelayer_product.png" width="100%" /></a></span>
1226	</h2>
1227	</div>
1228	<div class="inside">
1229	<i>'.__('Easily manage and make professional pages and content with our Pagelayer builder','loginizer').'</i>:<br>
1230	<ul class="lz-right-ul">
1231	<li>'.__('30+ Free Widgets','loginizer').'</li>
1232	<li>'.__('60+ Premium Widgets','loginizer').'</li>
1233	<li>'.__('400+ Premium Sections','loginizer').'</li>
1234	<li>'.__('Theme Builder','loginizer').'</li>
1235	<li>'.__('WooCommerce Builder','loginizer').'</li>
1236	<li>'.__('Theme Creator and Exporter','loginizer').'</li>
1237	<li>'.__('Form Builder','loginizer').'</li>
1238	<li>'.__('Popup Builder','loginizer').'</li>
1239	<li>'.__('And many more ...','loginizer').'</li>
1240	</ul>
1241	<center><a class="button button-primary" target="_blank" href="https://wordpress.org/plugins/pagelayer/">'.__('Visit Pagelayer','loginizer').'</a></center>
1242	</div>
1243	</div>';
1244
1245	echo '
1246	<div class="postbox" style="min-width:0px !important;">
1247	<div class="postbox-header">
1248	<h2 class="hndle ui-sortable-handle">
1249	<span><a target="_blank" href="https://wpcentral.co/?from=loginizer-plugin"><img src="'.LOGINIZER_URL.'/images/wpcentral_product.png" width="100%" /></a></span>
1250	</h2>
1251	</div>
1252	<div class="inside">
1253	<i>'.__('Manage all your WordPress sites from <b>1 dashboard</b> ','loginizer').'</i>:<br>
1254	<ul class="lz-right-ul">
1255	<li>'.__('1-click Admin Access','loginizer').'</li>
1256	<li>'.__('Update WordPress','loginizer').'</li>
1257	<li>'.__('Update Themes','loginizer').'</li>
1258	<li>'.__('Update Plugins','loginizer').'</li>
1259	<li>'.__('Backup your WordPress Site','loginizer').'</li>
1260	<li>'.__('Plugins & Theme Management','loginizer').'</li>
1261	<li>'.__('Post Management','loginizer').'</li>
1262	<li>'.__('And many more ...','loginizer').'</li>
1263	</ul>
1264	<center><a class="button button-primary" target="_blank" href="https://wpcentral.co/?from=loginizer-plugin">'.__('Visit wpCentral','loginizer').'</a></center>
1265	</div>
1266	</div>';
1267
1268	}
1269
1270	echo '</td>
1271	</tr>
1272	</table>';
1273
1274	if(!defined('SITEPAD')){
1275
1276	echo '<br />
1277	<div style="width:45%;background:#FFF;padding:15px; margin:auto">
1278	<b>'.__('Let your friends know that you have secured your website :','loginizer').'</b>
1279	<form method="get" action="https://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
1280	<textarea name="text" cols="45" row="3" style="resize:none;">'.__('I just secured my @WordPress site against #bruteforce using @loginizer','loginizer').'</textarea>
1281	<input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
1282	</form>
1283
1284	</div>
1285	<br />
1286
1287	<script>
1288	function dotweet(ele){
1289	window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
1290	return false;
1291	}
1292	</script>
1293
1294	<hr />
1295	<a href="http://loginizer.com" target="_blank">Loginizer</a> '.__('v'.LOGINIZER_VERSION.'. You can report any bugs ','loginizer').'<a href="http://wordpress.org/support/plugin/loginizer" target="_blank">'.__('here','loginizer').'</a>.';
1296
1297	}
1298
1299	echo '
1300	</div>
1301	</div>
1302	</div>
1303	</div>';
1304
1305	}
1306
1307	// The Loginizer Admin Options Page
1308	function loginizer_page_dashboard(){
1309
1310	global $loginizer, $lz_error, $lz_env;
1311
1312	if(!current_user_can('manage_options')){
1313	wp_die('Sorry, but you do not have permissions to change settings.');
1314	}
1315
1316	// Dismiss the announcement
1317	if(isset($_GET['dismiss_announcement'])){
1318	update_option('loginizer_no_announcement', 1);
1319	}
1320
1321	/* Make sure post was from this page */
1322	if(count($_POST) > 0){
1323	check_admin_referer('loginizer-options');
1324	}
1325
1326	do_action('loginizer_pre_page_dashboard');
1327
1328	// Is there a IP Method ?
1329	if(isset($_POST['save_lz_ip_method'])){
1330
1331	$ip_method = (int) lz_optpost('lz_ip_method');
1332	$custom_ip_method = lz_optpost('lz_custom_ip_method');
1333
1334	if($ip_method >= 0 && $ip_method <= 3){
1335	update_option('loginizer_ip_method', $ip_method);
1336	}
1337
1338	// Custom Method name ?
1339	if($ip_method == 3){
1340	update_option('loginizer_custom_ip_method', $custom_ip_method);
1341	}
1342
1343	}
1344
1345	loginizer_page_dashboard_T();
1346
1347	}
1348
1349	// The Loginizer Admin Options Page - THEME
1350	function loginizer_page_dashboard_T(){
1351
1352	global $loginizer, $lz_error, $lz_env;
1353
1354	loginizer_page_header('Dashboard');
1355	?>
1356	<style>
1357	.lz-welcome-panel{
1358	border: 1px solid #c3c4c7;
1359	box-shadow: 0 1px 1px rgba(0,0,0,.04);
1360	background: #fff;
1361	padding:10px;
1362	}
1363
1364	.lz-welcome-panel-content{
1365	display:inline;
1366	vertical-align:middle;
1367	}
1368
1369	input[type="text"], textarea, select {
1370	width: 70%;
1371	}
1372
1373	.form-table label{
1374	font-weight:bold;
1375	}
1376
1377	.exp{
1378	font-size:12px;
1379	}
1380	</style>
1381
1382	<?php
1383	$lz_ip = lz_getip();
1384
1385	if($lz_ip != '127.0.0.1' && @$_SERVER['SERVER_ADDR'] == $lz_ip){
1386	echo '<div class="update-message notice error inline notice-error notice-alt"><p style="color:red">   Your Server IP Address seems to match the Client IP detected by Loginizer. You might want to change the IP detection method to HTTP_X_FORWARDED_FOR under System Information section.</p></div><br>';
1387	}
1388
1389	loginizer_newsletter_subscribe();
1390
1391	if(!empty($loginizer['backuply_promo']) && $loginizer['backuply_promo'] > 0 && $loginizer['backuply_promo'] < (time() - (7243600))){
1392
1393	loginizer_backuply_promo();
1394
1395	}
1396
1397
1398	echo '
1399	<div class="lz-welcome-panel">
1400	<div class="lz-welcome-panel-content">'. __('Thank you for choosing Loginizer! Many more features coming soon...   Review Loginizer at WordPress    ', 'loginizer').'<a href="https://wordpress.org/support/view/plugin-reviews/loginizer" class="button button-primary" target="_blank">'. __('Add Review', 'loginizer'). '</a></div>
1401	</div><br />';
1402
1403	// Saved ?
1404	if(!empty($GLOBALS['lz_saved'])){
1405	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
1406	}
1407
1408	// Any errors ?
1409	if(!empty($lz_error)){
1410	lz_report_error($lz_error);echo '<br />';
1411	}
1412
1413	?>
1414	<div style="display:flex; justify-content:space-between;" >
1415	<div class="postbox" style="width:34%">
1416
1417	<div class="postbox-header">
1418	<h2 class="hndle ui-sortable-handle">
1419	<span><?php echo __('Getting Started', 'loginizer'); ?></span>
1420	</h2>
1421	</div>
1422
1423	<div class="inside">
1424
1425	<form action="" method="post" enctype="multipart/form-data">
1426	<?php wp_nonce_field('loginizer-options'); ?>
1427	<table class="form-table">
1428	<tr>
1429	<td scope="row" valign="top" colspan="2" style="line-height:1.9">
1430	<i><?php echo __('Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.', 'loginizer'); ?></i>
1431	<?php
1432	if(defined('LOGINIZER_PREMIUM')){
1433	echo '<br><i>'.__('In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security','loginizer').'</i>';
1434	}else{
1435	echo '<br><i><a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none;color:red;">'.__('Upgrade to Pro</a> for more features like <b>reCAPTCHA, Two Factor Auth, Rename wp-admin and wp-login.php pages, Email based PasswordLess</b> login and more. These features will improve your website\'s security.','loginizer').'</i>';
1436	}
1437	?>
1438	</td>
1439	</tr>
1440	</table>
1441	</form>
1442
1443	</div>
1444	</div>
1445
1446	<?php
1447
1448	$login_attempt_stats = get_option('loginizer_login_attempt_stats', []);
1449	$success_logins = 1;
1450	$failed_logins = 0;
1451	$stats_dataset = [];
1452
1453	foreach($login_attempt_stats as $attempt_time => $count){
1454
1455	if($attempt_time < strtotime('-30 days')){
1456	unset($login_attempt_stats[$attempt_time]);
1457	update_option('loginizer_login_attempt_stats', $login_attempt_stats, false);
1458	continue;
1459	}
1460
1461	$day_month = date('M j', $attempt_time);
1462	if(empty($stats_dataset[$day_month])){
1463	$stats_dataset[$day_month] = 0;
1464	}
1465
1466	$stats_dataset[$day_month] += $login_attempt_stats[$attempt_time][0];
1467
1468	if($attempt_time > strtotime('-24 hours')){
1469
1470	if(!empty($login_attempt_stats[$attempt_time][0])){
1471	$failed_logins += $login_attempt_stats[$attempt_time][0];
1472	}
1473
1474	if(!empty($login_attempt_stats[$attempt_time][1])){
1475	$success_logins += $login_attempt_stats[$attempt_time][1];
1476	}
1477
1478	continue;
1479	}
1480	}
1481
1482	$failed_login_color = '#f9fa8e';
1483
1484	if($failed_logins < 40){
1485	$failed_login_color = '#f9fa8e';
1486	$failed_notice = __('Your Website is safe', 'loginizer');
1487
1488	} else if($failed_logins < 70){
1489	$failed_login_color = '#ffcd56';
1490	$failed_notice = __('Risk from Brute-force attacks is low, attacks are under control', 'loginizer');
1491	} else if($failed_logins < 150){
1492	$failed_login_color = '#f67019';
1493	$failed_notice = __('Brute-force attacks on your websites are on rise', 'loginizer');
1494	} else {
1495	$failed_login_color = '#fc1e4d';
1496	$failed_notice = __('Your website is under heavy brute-force attacks.<br/> <a href="https://loginizer.com/pricing?utm_source=stats_block" target="_blank">Upgrade to a premium version</a> for added protection if this trend persists. Act fast to secure your site.', 'loginizer');
1497	}
1498
1499	if(file_exists(LOGINIZER_DIR.'/premium.php')){
1500	$failed_login_color = '#f53794';
1501	$failed_notice = __('Your website is being protected by Loginizer Security.', 'loginizer');
1502	}
1503
1504	?>
1505
1506	<div class="postbox" style="width:65%;">
1507
1508	<div class="postbox-header">
1509	<h2 class="hndle">
1510	<span><?php echo __('Login Attempts', 'loginizer'); ?></span>
1511	</h2>
1512	</div>
1513	<div class="inside" style="display:flex;">
1514	<div style="margin-right:50px;">
1515	<div style="position:relative; width: 250px; height:auto; margin: 0 auto;">
1516	<canvas id="lz-attempts-chart"></canvas>
1517	<h3 style="position:absolute; bottom:0%; width:100%; text-align:center;"><?php _e('Total Attempts:', 'loginizer'); ?> <?php echo esc_html($failed_logins + $success_logins); ?></h3>
1518	</div>
1519	<div><p style="text-align:center;"><?php echo wp_kses_post($failed_notice); ?></p></div>
1520	<div style="color:#898989; text-align:right;"><?php _e('Data For Last 24 hours', 'loginizer'); ?></div>
1521	</div>
1522	<div style="margin:auto; height:100%; min-height:300px; width:80%;">
1523	<canvas id="lz-attemt-chart-thirty"></canvas>
1524	</div>
1525	</div>
1526	</div>
1527	</div>
1528
1529	<div class="postbox">
1530
1531	<div class="postbox-header">
1532	<h2 class="hndle ui-sortable-handle">
1533	<span><?php echo __('System Information', 'loginizer'); ?></span>
1534	</h2>
1535	</div>
1536	<div class="inside">
1537
1538	<form action="" method="post" enctype="multipart/form-data">
1539	<?php wp_nonce_field('loginizer-options'); ?>
1540	<table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
1541	<?php
1542	echo '
1543	<tr>
1544	<th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
1545	<td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (<font color="green">'.__('Security PRO Version','loginizer').'</font>)' : '').'</td>
1546	</tr>';
1547
1548	do_action('loginizer_system_information');
1549
1550	echo '<tr>
1551	<th align="left">'.__('URL', 'loginizer').'</th>
1552	<td>'.get_site_url().'</td>
1553	</tr>
1554	<tr>
1555	<th align="left">'.__('Path', 'loginizer').'</th>
1556	<td>'.ABSPATH.'</td>
1557	</tr>
1558	<tr>
1559	<th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
1560	<td>'.@$_SERVER['SERVER_ADDR'].'</td>
1561	</tr>
1562	<tr>
1563	<th align="left">'.__('Your IP Address', 'loginizer').'</th>
1564	<td>'.lz_getip().'
1565	<div style="float:right">
1566	Method :
1567	<select name="lz_ip_method" id="lz_ip_method" style="font-size:11px; width:150px" onchange="lz_ip_method_handle()">
1568	<option value="0" '.lz_POSTselect('lz_ip_method', 0, (@$loginizer['ip_method'] == 0)).'>REMOTE_ADDR</option>
1569	<option value="1" '.lz_POSTselect('lz_ip_method', 1, (@$loginizer['ip_method'] == 1)).'>HTTP_X_FORWARDED_FOR</option>
1570	<option value="2" '.lz_POSTselect('lz_ip_method', 2, (@$loginizer['ip_method'] == 2)).'>HTTP_CLIENT_IP</option>
1571	<option value="3" '.lz_POSTselect('lz_ip_method', 3, (@$loginizer['ip_method'] == 3)).'>CUSTOM</option>
1572	</select>
1573	<input name="lz_custom_ip_method" id="lz_custom_ip_method" type="text" value="'.lz_optpost('lz_custom_ip_method',(empty($loginizer['custom_ip_method']) ? '' : $loginizer['custom_ip_method'])).'" style="font-size:11px; width:100px; display:none" />
1574	<input name="save_lz_ip_method" class="button button-primary" value="Save" type="submit" />
1575	</div>
1576	</td>
1577	</tr>
1578	<tr>
1579	<th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
1580	<td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1581	</tr>';
1582
1583	if(file_exists(ABSPATH.'/.htaccess')){
1584	echo '
1585	<tr>
1586	<th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
1587	<td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
1588	</tr>';
1589
1590	}
1591
1592	// Setting up the dataset for the 30 day chart
1593	$line_dataset[] = array(
1594	'label' => __( 'Failed', 'loginizer'),
1595	'data' => array_reverse($stats_dataset),
1596	'backgroundColor' => 'rgb(54, 162, 235)',
1597	'borderColor' => 'rgb(54, 162, 235)',
1598	);
1599
1600	// Enqueues CharJS script and inline the char js
1601	wp_enqueue_script('chartjs', LOGINIZER_URL.'/chart.js', array('jquery'), '3.0.0');
1602	wp_add_inline_script('chartjs', 'function lz_attempts_chart(){
1603	const ctx = document.getElementById("lz-attempts-chart");
1604
1605	new Chart(ctx, {
1606	type: "doughnut",
1607	data: {
1608	labels: ["Failed", "Success"],
1609	datasets: [{
1610	label: "Count",
1611	data: ['.esc_html($failed_logins).', '.esc_html($success_logins).'],
1612	backgroundColor: [
1613	"'.esc_html($failed_login_color).'",
1614	"rgb(54, 162, 235)",
1615	],
1616	hoverOffset: 4,
1617	borderWidth: [0]
1618	}],
1619	},
1620	options : {
1621	circumference : 180,
1622	rotation:-90,
1623	responsive: true,
1624	}
1625	});
1626
1627	const thirty_days = document.getElementById("lz-attemt-chart-thirty");
1628
1629	new Chart(thirty_days, {
1630	type: "line",
1631	data: {
1632	datasets: '.json_encode($line_dataset).'
1633	},
1634	options: {
1635	responsive: true,
1636	maintainAspectRatio: false,
1637	hover: {
1638	mode: "nearest",
1639	intersect: true
1640	},
1641	scales: {
1642	x: {
1643	display: true,
1644	scaleLabel: {
1645	display: false
1646	}
1647
1648	},
1649	y: {
1650	display: true,
1651	scaleLabel: {
1652	display: false
1653	},
1654	beginAtZero: true,
1655	ticks: {
1656	callback: function(label, index, labels) {
1657	if (Math.floor(label) === label) {
1658	return label;
1659	}
1660	},
1661	}
1662	}
1663	}
1664	}
1665	});
1666	}
1667
1668	lz_attempts_chart();');
1669
1670	?>
1671	</table>
1672	</form>
1673
1674	</div>
1675	</div>
1676
1677	<script type="text/javascript">
1678
1679	function lz_ip_method_handle(){
1680	var ele = jQuery('#lz_ip_method');
1681	if(ele.val() == 3){
1682	jQuery('#lz_custom_ip_method').show();
1683	}else{
1684	jQuery('#lz_custom_ip_method').hide();
1685	}
1686	};
1687
1688	lz_ip_method_handle();
1689
1690	</script>
1691
1692	<div id="" class="postbox">
1693
1694	<div class="postbox-header">
1695	<h2 class="hndle ui-sortable-handle">
1696	<span><?php echo __('File Permissions', 'loginizer'); ?></span>
1697	</h2>
1698	</div>
1699
1700	<div class="inside">
1701
1702	<form action="" method="post" enctype="multipart/form-data">
1703	<?php wp_nonce_field('loginizer-options'); ?>
1704	<table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1705	<?php
1706
1707	echo '
1708	<tr>
1709	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
1710	<th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
1711	<th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
1712	</tr>';
1713
1714	$wp_content = basename(dirname(dirname(dirname(__FILE__))));
1715
1716	$files_to_check = array('/' => array('0755', '0750'),
1717	'/wp-admin' => array('0755'),
1718	'/wp-includes' => array('0755'),
1719	'/wp-config.php' => array('0444'),
1720	'/'.$wp_content => array('0755'),
1721	'/'.$wp_content.'/themes' => array('0755'),
1722	'/'.$wp_content.'/plugins' => array('0755'));
1723
1724	if(file_exists(ABSPATH.'/.htaccess')){
1725	$files_to_check['.htaccess'] = array('0444');
1726	}
1727
1728	$root = ABSPATH;
1729
1730	foreach($files_to_check as $k => $v){
1731
1732	$path = $root.'/'.$k;
1733	$stat = @stat($path);
1734	$suggested = $v;
1735	$actual = substr(sprintf('%o', $stat['mode']), -4);
1736
1737	echo '
1738	<tr>
1739	<td>'.$k.'</td>
1740	<td>'.current($suggested).'</td>
1741	<td><span '.(!in_array($actual, $suggested) ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
1742	</tr>';
1743
1744	}
1745
1746	?>
1747	</table>
1748	</form>
1749
1750	</div>
1751	</div>
1752
1753	<?php
1754
1755	loginizer_page_footer();
1756
1757	}
1758
1759	// The Loginizer Admin Options Page
1760	function loginizer_page_brute_force(){
1761
1762	global $wpdb, $wp_roles, $loginizer;
1763
1764	if(!current_user_can('manage_options')){
1765	wp_die('Sorry, but you do not have permissions to change settings.');
1766	}
1767
1768	/* Make sure post was from this page */
1769	if(count($_POST) > 0){
1770	check_admin_referer('loginizer-options');
1771	}
1772
1773	// BEGIN THEME
1774	loginizer_page_header('Brute Force Settings');
1775
1776	// Load the blacklist and whitelist
1777	$loginizer['blacklist'] = get_option('loginizer_blacklist');
1778	$loginizer['whitelist'] = get_option('loginizer_whitelist');
1779
1780	// Disable Brute Force
1781	if(isset($_POST['disable_brute_lz'])){
1782
1783	// Save the options
1784	update_option('loginizer_disable_brute', 1);
1785
1786	$loginizer['disable_brute'] = 1;
1787
1788	echo '<div id="message" class="updated"><p>'
1789	. __('The Brute Force Protection feature is now disabled', 'loginizer')
1790	. '</p></div><br />';
1791
1792	}
1793
1794	// Enable brute force
1795	if(isset($_POST['enable_brute_lz'])){
1796
1797	// Save the options
1798	update_option('loginizer_disable_brute', 0);
1799
1800	$loginizer['disable_brute'] = 0;
1801
1802	echo '<div id="message" class="updated"><p>'
1803	. __('The Brute Force Protection feature is now enabled', 'loginizer')
1804	. '</p></div><br />';
1805
1806	}
1807
1808	// The Brute Force Settings
1809	if(isset($_POST['save_lz'])){
1810
1811	$max_retries = (int) lz_optpost('max_retries');
1812	$lockout_time = (int) lz_optpost('lockout_time');
1813	$max_lockouts = (int) lz_optpost('max_lockouts');
1814	$lockouts_extend = (int) lz_optpost('lockouts_extend');
1815	$reset_retries = (int) lz_optpost('reset_retries');
1816	$notify_email = (int) lz_optpost('notify_email');
1817	$notify_email_address = lz_optpost('notify_email_address');
1818	$trusted_ips = lz_optpost('trusted_ips');
1819
1820	if(!empty($notify_email_address) && !lz_valid_email($notify_email_address)){
1821	$error[] = __('Email address is invalid', 'loginizer');
1822	}
1823
1824	if(empty(loginizer_is_whitelisted()) && isset($_POST['trusted_ips'])){
1825	$error[] = __('Add your IP to whitelist to enable Trusted IP\'s', 'loginizer');
1826	}
1827
1828	if(!empty($max_retries) && $max_retries < 0){
1829	$error[] = __('Max Retries value is invalid', 'loginizer');
1830	}
1831
1832	if(!empty($lockout_time) && $lockout_time < 0){
1833	$error[] = __('Lockout Time value is invalid', 'loginizer');
1834	}
1835
1836	if(!empty($max_lockouts) && $max_lockouts < 0){
1837	$error[] = __('Max Lockouts value is invalid', 'loginizer');
1838	}
1839
1840	if(!empty($lockouts_extend) && $lockouts_extend < 0){
1841	$error[] = __('Extended Lockout value is invalid', 'loginizer');
1842	}
1843
1844	if(!empty($reset_retries) && $reset_retries < 0){
1845	$error[] = __('Reset Retries value is invalid', 'loginizer');
1846	}
1847
1848	if(!empty($notify_email) && $notify_email < 0){
1849	$error[] = __('Email Notification value is invalid', 'loginizer');
1850	}
1851
1852	$lockout_time = $lockout_time * 60;
1853	$lockouts_extend = $lockouts_extend * 60 * 60;
1854	$reset_retries = $reset_retries * 60 * 60;
1855
1856	if(empty($error)){
1857
1858	$option['max_retries'] = $max_retries;
1859	$option['lockout_time'] = $lockout_time;
1860	$option['max_lockouts'] = $max_lockouts;
1861	$option['lockouts_extend'] = $lockouts_extend;
1862	$option['reset_retries'] = $reset_retries;
1863	$option['notify_email'] = $notify_email;
1864	$option['notify_email_address'] = $notify_email_address;
1865	$option['trusted_ips'] = $trusted_ips;
1866
1867	// Save the options
1868	update_option('loginizer_options', $option);
1869
1870	$saved = true;
1871
1872	}else{
1873	lz_report_error($error);
1874	}
1875
1876	if(!empty($notice)){
1877	lz_report_notice($notice);
1878	}
1879
1880	if(!empty($saved)){
1881	echo '<div id="message" class="updated"><p>'
1882	. __('The settings were saved successfully', 'loginizer')
1883	. '</p></div><br />';
1884	}
1885
1886	}
1887
1888	// Delete a Blackist IP range
1889	if(isset($_POST['bdelid'])){
1890
1891	$delid = (int) lz_optreq('bdelid');
1892
1893	// Unset and save
1894	$blacklist = $loginizer['blacklist'];
1895	unset($blacklist[$delid]);
1896	update_option('loginizer_blacklist', $blacklist);
1897
1898	echo '<div id="message" class="updated fade"><p>'
1899	. __('The Blacklist IP range has been deleted successfully', 'loginizer')
1900	. '</p></div><br />';
1901
1902	}
1903
1904	// Delete all Blackist IP ranges
1905	if(isset($_POST['del_all_blacklist'])){
1906
1907	// Unset and save
1908	update_option('loginizer_blacklist', array());
1909
1910	echo '<div id="message" class="updated fade"><p>'
1911	. __('The Blacklist IP range(s) have been cleared successfully', 'loginizer')
1912	. '</p></div><br />';
1913
1914	}
1915
1916	// Delete a Whitelist IP range
1917	if(isset($_POST['delid'])){
1918
1919	$delid = (int) lz_optreq('delid');
1920
1921	// Unset and save
1922	$whitelist = $loginizer['whitelist'];
1923	unset($whitelist[$delid]);
1924	update_option('loginizer_whitelist', $whitelist);
1925
1926	echo '<div id="message" class="updated fade"><p>'
1927	. __('The Whitelist IP range has been deleted successfully', 'loginizer')
1928	. '</p></div><br />';
1929
1930	}
1931
1932	// Delete all Blackist IP ranges
1933	if(isset($_POST['del_all_whitelist'])){
1934
1935	// Unset and save
1936	update_option('loginizer_whitelist', array());
1937
1938	echo '<div id="message" class="updated fade"><p>'
1939	. __('The Whitelist IP range(s) have been cleared successfully', 'loginizer')
1940	. '</p></div><br />';
1941
1942	}
1943
1944	// Reset All Logs
1945	if(isset($_POST['lz_reset_all_ip'])){
1946
1947	$result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` > 0");
1948
1949	echo '<div id="message" class="updated fade"><p>'
1950	. __('All the IP Logs have been cleared', 'loginizer')
1951	. '</p></div><br />';
1952	}
1953
1954	// Reset Logs
1955	if(isset($_POST['lz_reset_ip']) && isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
1956
1957	$ips = $_POST['lz_reset_ips'];
1958
1959	foreach($ips as $ip){
1960	if(!lz_valid_ip($ip)){
1961	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
1962	}
1963	}
1964
1965	if(count($ips) < 1){
1966	$error[] = __('There are no IPs submitted', 'loginizer');
1967	}
1968
1969	// Should we start deleting logs
1970	if(empty($error)){
1971
1972	foreach($ips as $ip){
1973	$result = $wpdb->query($wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $ip));
1974	}
1975
1976	if(empty($error)){
1977
1978	echo '<div id="message" class="updated fade"><p>'
1979	. __('The selected IP Logs have been reset', 'loginizer')
1980	. '</p></div><br />';
1981
1982	}
1983
1984	}
1985
1986	if(!empty($error)){
1987	lz_report_error($error);echo '<br />';
1988	}
1989
1990	}
1991
1992	if(isset($_POST['blacklist_iprange'])){
1993
1994	$start_ip = lz_optpost('start_ip');
1995	$end_ip = lz_optpost('end_ip');
1996
1997	// If no end IP we consider only 1 IP
1998	if(empty($end_ip)){
1999	$end_ip = $start_ip;
2000	}
2001
2002	// Validate the IP against all checks
2003	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['blacklist'], $error);
2004
2005	if(empty($error)){
2006
2007	$blacklist = $loginizer['blacklist'];
2008
2009	$newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
2010
2011	$blacklist[$newid] = array();
2012	$blacklist[$newid]['start'] = $start_ip;
2013	$blacklist[$newid]['end'] = $end_ip;
2014	$blacklist[$newid]['time'] = time();
2015
2016	update_option('loginizer_blacklist', $blacklist);
2017
2018	echo '<div id="message" class="updated fade"><p>'
2019	. __('Blacklist IP range added successfully', 'loginizer')
2020	. '</p></div><br />';
2021
2022	}
2023
2024	if(!empty($error)){
2025	lz_report_error($error);echo '<br />';
2026	}
2027
2028	}
2029
2030	if(isset($_POST['whitelist_iprange'])){
2031
2032	$start_ip = lz_optpost('start_ip_w');
2033	$end_ip = lz_optpost('end_ip_w');
2034
2035	// If no end IP we consider only 1 IP
2036	if(empty($end_ip)){
2037	$end_ip = $start_ip;
2038	}
2039
2040	// Validate the IP against all checks
2041	loginizer_iprange_validate($start_ip, $end_ip, $loginizer['whitelist'], $error);
2042
2043	if(empty($error)){
2044
2045	$whitelist = $loginizer['whitelist'];
2046
2047	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
2048
2049	$whitelist[$newid] = array();
2050	$whitelist[$newid]['start'] = $start_ip;
2051	$whitelist[$newid]['end'] = $end_ip;
2052	$whitelist[$newid]['time'] = time();
2053
2054	update_option('loginizer_whitelist', $whitelist);
2055
2056	echo '<div id="message" class="updated fade"><p>'
2057	. __('Whitelist IP range added successfully', 'loginizer')
2058	. '</p></div><br />';
2059
2060	}
2061
2062	if(!empty($error)){
2063	lz_report_error($error);echo '<br />';
2064	}
2065	}
2066
2067	if(isset($_POST['lz_import_csv'])){
2068
2069	if(!empty($_FILES['lz_import_file_csv']['name'])){
2070
2071	$lz_csv_type = lz_optpost('lz_csv_type');
2072
2073	// Is the submitted type in the allowed list ?
2074	if(!in_array($lz_csv_type, array('blacklist', 'whitelist'))){
2075	$error[] = __('Invalid import type', 'loginizer');
2076	}
2077
2078	if(empty($error)){
2079
2080	//Get the extension of the file
2081	$csv_file_name = basename($_FILES['lz_import_file_csv']['name']);
2082	$csv_ext_name = strtolower(pathinfo($csv_file_name, PATHINFO_EXTENSION));
2083
2084	//Check if it's a csv file
2085	if($csv_ext_name == 'csv'){
2086
2087	$file = fopen($_FILES['lz_import_file_csv']['tmp_name'], "r");
2088
2089	$line_count = 0;
2090	$update_record = 0;
2091
2092	while($content = fgetcsv($file)){
2093
2094	//Increment the $line_count
2095	$line_count++;
2096
2097	//Skip the first line
2098	if($line_count <= 1){
2099	continue;
2100	}
2101
2102	if(loginizer_iprange_validate($content[0], $content[1], $loginizer[$lz_csv_type], $error, $line_count)){
2103
2104	$newid = ( empty($loginizer[$lz_csv_type]) ? 0 : max(array_keys($loginizer[$lz_csv_type])) ) + 1;
2105
2106	$loginizer[$lz_csv_type][$newid] = array();
2107	$loginizer[$lz_csv_type][$newid]['start'] = $content[0];
2108	$loginizer[$lz_csv_type][$newid]['end'] = $content[1];
2109	$loginizer[$lz_csv_type][$newid]['time'] = time();
2110
2111	$update_record = 1;
2112
2113	}
2114	}
2115
2116	fclose($file);
2117
2118	if(!empty($update_record)){
2119
2120	update_option('loginizer_'.$lz_csv_type, $loginizer[$lz_csv_type]);
2121
2122	echo '<div id="message" class="updated fade"><p>'
2123	. __('Imported '.ucfirst($lz_csv_type).' IP range(s) successfully', 'loginizer')
2124	. '</p></div><br />';
2125
2126	}
2127
2128	if(!empty($error)){
2129	lz_report_error($error);echo '<br />';
2130	}
2131	}
2132
2133	}
2134	}
2135	}
2136
2137	//Brute Force Bulk Blacklist/ Whitelist Ip
2138	if(isset($_POST['lz_blacklist_selected_ip'])){
2139	if(isset($_POST['lz_reset_ips']) && is_array($_POST['lz_reset_ips'])){
2140
2141	$ips = $_POST['lz_reset_ips'];
2142
2143	foreach($ips as $ip){
2144	if(!lz_valid_ip($ip)){
2145	$error[] = 'The IP - '.esc_html($ip).' is invalid !';
2146	}
2147	}
2148
2149	if(count($ips) < 1){
2150	$error[] = __('There are no IPs submitted', 'loginizer');
2151	}
2152
2153	// Should we start deleting logs
2154	if(empty($error)){
2155
2156	$update_record = 0;
2157
2158	foreach($ips as $ip){
2159
2160	if(loginizer_iprange_validate($ip, '', $loginizer['blacklist'], $error)){
2161
2162	$newid = ( empty($loginizer['blacklist']) ? 0 : max(array_keys($loginizer['blacklist'])) ) + 1;
2163
2164	$loginizer['blacklist'][$newid] = array();
2165	$loginizer['blacklist'][$newid]['start'] = $ip;
2166	$loginizer['blacklist'][$newid]['end'] = $ip;
2167	$loginizer['blacklist'][$newid]['time'] = time();
2168
2169	$update_record = 1;
2170	}
2171	}
2172
2173	if(!empty($update_record)){
2174
2175	update_option('loginizer_blacklist', $loginizer['blacklist']);
2176
2177	echo '<div id="message" class="updated fade"><p>'
2178	. __('The selected IP(s) have been blacklisted', 'loginizer')
2179	. '</p></div><br />';
2180
2181	}
2182
2183	}
2184	}else{
2185	$error[] = __('No IP(s) selected', 'loginizer');
2186	}
2187
2188	if(!empty($error)){
2189	lz_report_error($error);echo '<br />';
2190	}
2191	}
2192
2193	// Save the messages
2194	if(isset($_POST['save_err_msgs_lz'])){
2195
2196	$msgs['inv_userpass'] = lz_optpost('msg_inv_userpass');
2197	$msgs['ip_blacklisted'] = lz_optpost('msg_ip_blacklisted');
2198	$msgs['attempts_left'] = lz_optpost('msg_attempts_left');
2199	$msgs['lockout_err'] = lz_optpost('msg_lockout_err');
2200	$msgs['minutes_err'] = lz_optpost('msg_minutes_err');
2201	$msgs['hours_err'] = lz_optpost('msg_hours_err');
2202
2203	// Update them
2204	update_option('loginizer_msg', $msgs);
2205
2206	echo '<div id="message" class="updated fade"><p>'
2207	. __('Error messages were saved successfully', 'loginizer')
2208	. '</p></div><br />';
2209
2210	}
2211
2212	// Count the Results
2213	$tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
2214	//print_r($tmp);
2215
2216	// Which Page is it
2217	$lz_env['res_len'] = 10;
2218	$lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
2219	$lz_env['num_res'] = $tmp['num'];
2220	$lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
2221
2222	// Get the logs
2223	$result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
2224	ORDER BY `time` DESC
2225	LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
2226	//print_r($result);
2227
2228	$lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
2229	$lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
2230	$lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
2231	$lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
2232
2233	// Reload the settings
2234	$loginizer['blacklist'] = get_option('loginizer_blacklist');
2235	$loginizer['whitelist'] = get_option('loginizer_whitelist');
2236
2237	$saved_msgs = get_option('loginizer_msg');
2238
2239	?>
2240
2241	<div id="" class="postbox">
2242
2243	<div class="postbox-header">
2244	<h2 class="hndle ui-sortable-handle">
2245	<?php echo '<span>'.__('Failed Login Attempts Logs', 'loginizer').'</span>   ('.__('Past', 'loginizer').' '.($loginizer['reset_retries']/60/60).' '.__('hours', 'loginizer').')'; ?>
2246	</h2>
2247	</div>
2248
2249	<script>
2250	function yesdsd(){
2251	window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
2252	return false;
2253	}
2254
2255	function lz_export_ajax(lz_csv_type){
2256
2257	var data = new Object();
2258	data["action"] = lz_csv_type != "failed_login" ? "loginizer_export" : "loginizer_failed_login_export";
2259	data["lz_csv_type"] = lz_csv_type;
2260	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax'); ?>";
2261
2262	var admin_url = "<?php admin_url(); ?>"+"admin-ajax.php";
2263
2264	jQuery.post(admin_url, data, function(response){
2265
2266	// Was the ajax call successful ?
2267	if(response.substring(0,2) == "-1"){
2268
2269	var err_message = response.substring(2);
2270
2271	if(err_message){
2272	alert(err_message);
2273	}else{
2274	alert("Failed to export data");
2275	}
2276
2277	return false;
2278	}
2279
2280	/*
2281	* Make CSV downloadable
2282	*/
2283	var downloadLink = document.createElement("a");
2284	var fileData = ['\ufeff'+response];
2285
2286	var blobObject = new Blob(fileData,{
2287	type: "text/csv;charset=utf-8;"
2288	});
2289
2290	var url = URL.createObjectURL(blobObject);
2291	downloadLink.href = url;
2292	downloadLink.download = "loginizer-"+lz_csv_type+".csv";
2293
2294	/*
2295	* Actually download CSV
2296	*/
2297	document.body.appendChild(downloadLink);
2298	downloadLink.click();
2299	document.body.removeChild(downloadLink);
2300
2301	});
2302
2303	}
2304
2305	</script>
2306
2307	<form method="get" onsubmit="return yesdsd();">
2308	<div class="tablenav">
2309	<p class="tablenav-pages" style="margin: 5px 10px" align="right">
2310	<span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
2311	<span class="pagination-links">
2312	<a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
2313	<a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
2314	<span class="paging-input">
2315	<label for="current-page-selector" class="screen-reader-text">Current Page</label>
2316	<input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
2317	</span>
2318	<a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
2319	<a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
2320	</span>
2321	</p>
2322	</div>
2323	</form>
2324
2325	<form action="" method="post" enctype="multipart/form-data">
2326	<?php wp_nonce_field('loginizer-options'); ?>
2327	<div class="inside">
2328	<table class="wp-list-table widefat fixed users" border="0">
2329	<tr>
2330	<th scope="row" valign="top" style="background:#EFEFEF;" width="20"><input type="checkbox" id="lz_check_all_logs" onchange="lz_multiple_check()" style="margin-left:-1px;"/></th>
2331	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
2332	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Attempted Username','loginizer'); ?></th>
2333	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
2334	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
2335	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Lockouts Count','loginizer'); ?></th>
2336	<th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('URL Attacked','loginizer'); ?></th>
2337	</tr>
2338	<?php
2339
2340	if(empty($result)){
2341	echo '
2342	<tr>
2343	<td colspan="4">
2344	'.__('No Logs. You will see logs about failed login attempts here.', 'loginizer').'
2345	</td>
2346	</tr>';
2347	}else{
2348	foreach($result as $ik => $iv){
2349	$status_button = (!empty($iv['status']) ? 'disable' : 'enable');
2350	echo '
2351	<tr>
2352	<td>
2353	<input type="checkbox" value="'.esc_attr($iv['ip']).'" name="lz_reset_ips[]" class="lz_shift_select_logs lz_check_all_logs" />
2354	</td>
2355	<td>
2356	<a href="https://ipinfo.io/'.esc_html($iv['ip']).'" target="_blank">'.esc_html($iv['ip']).' <span class="dashicons dashicons-external"></span></a>
2357	</td>
2358	<td>
2359	'.esc_html($iv['username']).'
2360	</td>
2361	<td>
2362	'.date('d/M/Y H:i:s P', $iv['time']).'
2363	</td>
2364	<td>
2365	'.esc_html($iv['count']).'
2366	</td>
2367	<td>
2368	'.esc_html($iv['lockout']).'
2369	</td>
2370	<td>
2371	'.esc_html($iv['url']).'
2372	</td>
2373	</tr>';
2374	}
2375	}
2376
2377	?>
2378	</table>
2379
2380	<br>
2381	<input name="lz_reset_ip" class="button button-primary action" value="<?php echo __('Remove From Logs', 'loginizer'); ?>" type="submit" />
2382
2383	<input name="lz_reset_all_ip" class="button button-primary action" value="<?php echo __('Clear All Logs', 'loginizer'); ?>" type="submit" />
2384
2385	<input name="lz_blacklist_selected_ip" class="button button-primary action" value="<?php echo __('Blacklist Selected IPs', 'loginizer'); ?>" type="submit" />
2386
2387	<input name="lz_export_csv" onclick="lz_export_ajax('failed_login'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2388	</div>
2389	</div>
2390	</form>
2391	<br />
2392
2393	<div id="" class="postbox">
2394
2395	<div class="postbox-header">
2396	<h2 class="hndle ui-sortable-handle">
2397	<span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
2398	</h2>
2399	</div>
2400
2401	<div class="inside">
2402
2403	<form action="" method="post" enctype="multipart/form-data">
2404	<?php wp_nonce_field('loginizer-options'); ?>
2405	<table class="form-table">
2406	<tr>
2407	<th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
2408	<td>
2409	<input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
2410	</td>
2411	</tr>
2412	<tr>
2413	<th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
2414	<td>
2415	<input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
2416	</td>
2417	</tr>
2418	<tr>
2419	<th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
2420	<td>
2421	<input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
2422	</td>
2423	</tr>
2424	<tr>
2425	<th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
2426	<td>
2427	<input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
2428	</td>
2429	</tr>
2430	<tr>
2431	<th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
2432	<td>
2433	<input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
2434	</td>
2435	</tr>
2436	<tr>
2437	<th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
2438	<td>
2439	<?php echo __('after ','loginizer'); ?>
2440	<input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
2441	</td>
2442	</tr>
2443	<tr>
2444	<th scope="row" valign="top"><label for="notify_email_address"><?php echo __('Email Address','loginizer'); ?></label></th>
2445	<td>
2446	<input type="text" value="<?php echo (!empty($notify_email_address) ? $notify_email_address : (!empty($loginizer['custom_notify_email']) ? $loginizer['notify_email_address'] : '')); ?>" name="notify_email_address" id="notify_email_address" size="30" /> <br /><?php echo __('failed login attempts notifications will be sent to this email','loginizer'); ?>
2447	</td>
2448	</tr>
2449	<tr>
2450	<th scope="row" valign="top"><label for="trusted_ips"><?php echo __('Trusted IP\'s','loginizer'); ?><span style="color:red; margin-left:5px;">New</span></label></th>
2451	<td>
2452	<input type="checkbox" <?php echo lz_POSTchecked('trusted_ips', (empty($loginizer['trusted_ips']) ? false : true)); ?> name="trusted_ips" id="trusted_ips"/>
2453	<?php _e('If enabled Loginizer will only allow whitlisted IP\'s to Login.', 'loginizer'); ?>
2454	</td>
2455	</tr>
2456	</table><br />
2457	<input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
2458	<?php
2459
2460	if(empty($loginizer['disable_brute'])){
2461
2462	echo '<input name="disable_brute_lz" class="button action" value="'.__('Disable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2463
2464	}else{
2465
2466	echo '<input name="enable_brute_lz" class="button button-primary action" value="'.__('Enable Brute Force Protection','loginizer').'" type="submit" style="float:right" />';
2467
2468	}
2469
2470	?>
2471	</form>
2472
2473	</div>
2474	</div>
2475	<br />
2476
2477	<?php
2478
2479	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
2480
2481	?>
2482
2483	<style>
2484	.page-navigation a {
2485	margin: 5px 2px;
2486	display: inline-block;
2487	padding: 5px 8px;
2488	color: #0073aa;
2489	background: #e5e5e5 none repeat scroll 0 0;
2490	border: 1px solid #ccc;
2491	text-decoration: none;
2492	transition-duration: 0.05s;
2493	transition-property: border, background, color;
2494	transition-timing-function: ease-in-out;
2495	}
2496
2497	.page-navigation a[data-selected] {
2498	background-color: #00a0d2;
2499	color: #fff;
2500	}
2501	</style>
2502
2503	<script>
2504
2505	jQuery(document).ready(function(){
2506	jQuery('#lz_bl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_bl_nav')});
2507	jQuery('#lz_wl_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_nav')});
2508	lz_multiple_check();
2509	lz_shift_check_all('lz_shift_select_logs');
2510	});
2511
2512	// Delete a Blacklist / Whitelist IP Range
2513	function del_confirm(field, todo_id, msg){
2514	var ret = confirm(msg);
2515
2516	if(ret){
2517	jQuery('#lz_bl_wl_todo').attr('name', field);
2518	jQuery('#lz_bl_wl_todo').val(todo_id);
2519	jQuery('#lz_bl_wl_form').submit();
2520	}
2521
2522	return false;
2523
2524	}
2525
2526	// Delete all Blacklist / Whitelist IP Ranges
2527	function del_confirm_all(msg){
2528	var ret = confirm(msg);
2529
2530	if(ret){
2531	return true;
2532	}
2533
2534	return false;
2535
2536	}
2537
2538	//Check all the failed log attempts
2539	function lz_multiple_check(){
2540	jQuery("#lz_check_all_logs").on("click", function(event){
2541	if(this.checked == true){
2542	jQuery(".lz_check_all_logs").prop("checked", true);
2543	}else{
2544	jQuery(".lz_check_all_logs").prop("checked", false);
2545	}
2546	});
2547	}
2548
2549	//To select the installations/backups using shift key
2550	function lz_shift_check_all(check_class){
2551
2552	var checkboxes = jQuery("."+check_class);
2553	var lastChecked = null;
2554
2555	checkboxes.click(function(event){
2556	if(!lastChecked){
2557	lastChecked = this;
2558	return;
2559	}
2560
2561	if(event.shiftKey){
2562	var start = checkboxes.index(this);
2563	var end = checkboxes.index(lastChecked);
2564
2565	checkboxes.slice(Math.min(start,end), Math.max(start,end)+ 1).prop("checked", this.checked);
2566	}
2567
2568	lastChecked = this;
2569	});
2570	};
2571
2572	</script>
2573
2574	<div id="" class="postbox">
2575
2576	<div class="postbox-header">
2577	<h2 class="hndle ui-sortable-handle">
2578	<span><?php echo __('Blacklist IP','loginizer'); ?></span>
2579	</h2>
2580	</div>
2581
2582	<div class="inside">
2583
2584	<?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
2585
2586	<form action="" method="post">
2587	<?php wp_nonce_field('loginizer-options'); ?>
2588	<table class="form-table">
2589	<tr>
2590	<th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
2591	<td>
2592	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2593	</td>
2594	</tr>
2595	<tr>
2596	<th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2597	<td>
2598	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
2599	</td>
2600	</tr>
2601	</table><br />
2602	<input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
2603	<input style="float:right" name="del_all_blacklist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Blacklist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Blacklist IP Range(s)','loginizer'); ?>" type="submit" />
2604	</form>
2605	</div>
2606
2607	<div id="lz_bl_nav" style="margin: 5px 10px; text-align:right"></div>
2608
2609	<!--Brute Force Blacklist Import CSV Form-->
2610	<div class="inside" id="blacklist_csv" style="display:none;">
2611	<form action="" method="post" enctype="multipart/form-data">
2612	<?php wp_nonce_field('loginizer-options'); ?>
2613	<input type="hidden" value="blacklist" name="lz_csv_type" />
2614	<h3><?php echo __('Import Blacklist IPs (CSV)', 'loginizer'); ?>:</h3>
2615	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2616	<br><br>
2617	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2618	</form>
2619	</div>
2620	<!---->
2621
2622	<!--Brute Force Blacklist Export CSV Form-->
2623	<div class="inside" style="float:right;">
2624	<form action="" method="post">
2625	<?php wp_nonce_field('loginizer-options'); ?>
2626	<input type="hidden" value="blacklist" name="lz_csv_type" />
2627	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#blacklist_csv').toggle();"/>
2628	<input name="lz_export_csv" onclick="lz_export_ajax('blacklist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2629	</form>
2630
2631	</div>
2632	<!---->
2633
2634	<table id="lz_bl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2635	<tr>
2636	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2637	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2638	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2639	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2640	</tr>
2641	<?php
2642	if(empty($loginizer['blacklist'])){
2643	echo '
2644	<tr>
2645	<td colspan="4">
2646	'.__('No Blacklist IPs. You will see blacklisted IP ranges here.', 'loginizer').'
2647	</td>
2648	</tr>';
2649	}else{
2650	foreach($loginizer['blacklist'] as $ik => $iv){
2651	echo '
2652	<tr>
2653	<td>
2654	'.$iv['start'].'
2655	</td>
2656	<td>
2657	'.$iv['end'].'
2658	</td>
2659	<td>
2660	'.date('d/m/Y', $iv['time']).'
2661	</td>
2662	<td>
2663	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'bdelid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2664	</td>
2665	</tr>';
2666	}
2667	}
2668	?>
2669	</table>
2670	<br />
2671	<form action="" method="post" id="lz_bl_wl_form">
2672	<?php wp_nonce_field('loginizer-options'); ?>
2673	<input type="hidden" value="" name="" id="lz_bl_wl_todo"/>
2674	</form>
2675	</div>
2676
2677	<br />
2678
2679	<div id="" class="postbox">
2680
2681	<div class="postbox-header">
2682	<h2 class="hndle ui-sortable-handle">
2683	<span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
2684	</h2>
2685	</div>
2686
2687	<div class="inside">
2688
2689	<?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
2690	<form action="" method="post">
2691	<?php wp_nonce_field('loginizer-options'); ?>
2692	<table class="form-table">
2693	<tr>
2694	<th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
2695	<td>
2696	<input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
2697	</td>
2698	</tr>
2699	<tr>
2700	<th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
2701	<td>
2702	<input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
2703	</td>
2704	</tr>
2705	</table><br />
2706	<input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
2707	<input style="float:right" name="del_all_whitelist" onclick="return del_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s)','loginizer'); ?>" type="submit" />
2708	</form>
2709	</div>
2710
2711	<div id="lz_wl_nav" style="margin: 5px 10px; text-align:right"></div>
2712
2713	<!--Brute Force Whitelist Import CSV Form-->
2714	<div class="inside" id="lz_whitelist_csv_div" style="display:none;">
2715	<form action="" method="post" enctype="multipart/form-data">
2716	<?php wp_nonce_field('loginizer-options'); ?>
2717	<input type="hidden" value="whitelist" name="lz_csv_type" />
2718	<h3><?php echo __('Import Whitelist IPs (CSV)', 'loginizer'); ?>:</h3>
2719	<input type="file" name="lz_import_file_csv" value="Import CSV" />
2720	<br><br>
2721	<input name="lz_import_csv" class="button button-primary action" value="<?php echo __('Submit', 'loginizer'); ?>" type="submit" />
2722	</form>
2723	</div>
2724	<!---->
2725
2726	<!--Brute Force Whitelist Export CSV Form-->
2727	<div class="inside" style="float:right;">
2728	<form action="" method="post">
2729	<?php wp_nonce_field('loginizer-options'); ?>
2730	<input type="hidden" value="whitelist" name="lz_csv_type" />
2731	<input class="button button-primary action" value="<?php echo __('Import CSV', 'loginizer'); ?>" type="button" onclick="jQuery('#lz_whitelist_csv_div').toggle();"/>
2732	<input name="lz_export_csv" onclick="lz_export_ajax('whitelist'); return false;" class="button button-primary action" value="<?php echo __('Export CSV', 'loginizer'); ?>" type="submit" />
2733	</form>
2734	</div>
2735	<!---->
2736
2737	<table id="lz_wl_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
2738	<tr>
2739	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
2740	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
2741	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
2742	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
2743	</tr>
2744	<?php
2745	if(empty($loginizer['whitelist'])){
2746	echo '
2747	<tr>
2748	<td colspan="4">
2749	'.__('No Whitelist IPs. You will see whitelisted IP ranges here.', 'loginizer').'
2750	</td>
2751	</tr>';
2752	}else{
2753	foreach($loginizer['whitelist'] as $ik => $iv){
2754	echo '
2755	<tr>
2756	<td>
2757	'.$iv['start'].'
2758	</td>
2759	<td>
2760	'.$iv['end'].'
2761	</td>
2762	<td>
2763	'.date('d/m/Y', $iv['time']).'
2764	</td>
2765	<td>
2766	<a class="submitdelete" href="javascript:void(0)" onclick="return del_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range ?\')">Delete</a>
2767	</td>
2768	</tr>';
2769	}
2770	}
2771	?>
2772	</table>
2773	<br />
2774
2775	</div>
2776
2777	<div id="" class="postbox">
2778
2779	<div class="postbox-header">
2780	<h2 class="hndle ui-sortable-handle">
2781	<span><?php echo __('Error Messages', 'loginizer'); ?></span>
2782	</h2>
2783	</div>
2784
2785	<div class="inside">
2786
2787	<form action="" method="post" enctype="multipart/form-data">
2788	<?php wp_nonce_field('loginizer-options'); ?>
2789	<table class="form-table">
2790	<tr>
2791	<th scope="row" valign="top"><label for="msg_inv_userpass"><?php echo __('Failed Login Attempt','loginizer'); ?></label></th>
2792	<td>
2793	<input type="text" size="25" value="<?php echo (empty($saved_msgs['inv_userpass']) ? '' : esc_attr($saved_msgs['inv_userpass'])); ?>" name="msg_inv_userpass" id="msg_inv_userpass" />
2794	<?php echo __('Default: <em>"' . $loginizer['d_msg']['inv_userpass']. '"</em>', 'loginizer'); ?><br />
2795	</td>
2796	</tr>
2797	<tr>
2798	<th scope="row" valign="top"><label for="msg_ip_blacklisted"><?php echo __('Blacklisted IP','loginizer'); ?></label></th>
2799	<td>
2800	<input type="text" size="25" value="<?php echo (empty($saved_msgs['ip_blacklisted']) ? '' : esc_attr($saved_msgs['ip_blacklisted'])); ?>" name="msg_ip_blacklisted" id="msg_ip_blacklisted" />
2801	<?php echo __('Default: <em>"' . $loginizer['d_msg']['ip_blacklisted']. '"</em>', 'loginizer'); ?><br />
2802	</td>
2803	</tr>
2804	<tr>
2805	<th scope="row" valign="top"><label for="msg_attempts_left"><?php echo __('Attempts Left','loginizer'); ?></label></th>
2806	<td>
2807	<input type="text" size="25" value="<?php echo (empty($saved_msgs['attempts_left']) ? '' : esc_attr($saved_msgs['attempts_left'])); ?>" name="msg_attempts_left" id="msg_attempts_left" />
2808	<?php echo __('Default: <em>"' . $loginizer['d_msg']['attempts_left']. '"</em>', 'loginizer'); ?><br />
2809	</td>
2810	</tr>
2811	<tr>
2812	<th scope="row" valign="top"><label for="msg_lockout_err"><?php echo __('Lockout Error','loginizer'); ?></label></th>
2813	<td>
2814	<input type="text" size="25" value="<?php echo (empty($saved_msgs['lockout_err']) ? '' : esc_attr($saved_msgs['lockout_err'])); ?>" name="msg_lockout_err" id="msg_lockout_err" />
2815	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['lockout_err']). '"</em>', 'loginizer'); ?><br />
2816	</td>
2817	</tr>
2818	<tr>
2819	<th scope="row" valign="top"><label for="msg_minutes_err"><?php echo __('Minutes','loginizer'); ?></label></th>
2820	<td>
2821	<input type="text" size="25" value="<?php echo (empty($saved_msgs['minutes_err']) ? '' : esc_attr($saved_msgs['minutes_err'])); ?>" name="msg_minutes_err" id="msg_minutes_err" />
2822	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['minutes_err']). '"</em>', 'loginizer'); ?><br />
2823	</td>
2824	</tr>
2825	<tr>
2826	<th scope="row" valign="top"><label for="msg_hours_err"><?php echo __('Hours','loginizer'); ?></label></th>
2827	<td>
2828	<input type="text" size="25" value="<?php echo (empty($saved_msgs['hours_err']) ? '' : esc_attr($saved_msgs['hours_err'])); ?>" name="msg_hours_err" id="msg_hours_err" />
2829	<?php echo __('Default: <em>"' . strip_tags($loginizer['d_msg']['hours_err']). '"</em>', 'loginizer'); ?><br />
2830	</td>
2831	</tr>
2832	</table><br />
2833	<input name="save_err_msgs_lz" class="button button-primary action" value="<?php echo __('Save Error Messages','loginizer'); ?>" type="submit" />
2834	</form>
2835	</div>
2836	</div>
2837	<?php
2838
2839	loginizer_page_footer();
2840
2841	}
2842
2843	add_action('wp_ajax_loginizer_export', 'loginizer_export');
2844
2845	// Export CSV
2846	function loginizer_export(){
2847
2848	// Some AJAX security
2849	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2850
2851	if(!current_user_can('manage_options')){
2852	wp_die('Sorry, but you do not have permissions to change settings.');
2853	}
2854
2855	$lz_csv_type = lz_optpost('lz_csv_type');
2856
2857	switch($lz_csv_type){
2858
2859	case 'blacklist':
2860	$csv_array = get_option('loginizer_blacklist');
2861	$filename = 'loginizer-blacklist';
2862	break;
2863
2864	case 'whitelist':
2865	$csv_array = get_option('loginizer_whitelist');
2866	$filename = 'loginizer-whitelist';
2867	break;
2868	}
2869
2870	if(empty($csv_array)){
2871	echo -1;
2872	echo __('No data to export', 'loginizer');
2873	wp_die();
2874	}
2875
2876	header('Content-Type: text/csv; charset=utf-8');
2877	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2878
2879	$allowed_fields = array('start' => 'Start IP', 'end' => 'End IP', 'time' => 'Time');
2880
2881	$file = fopen("php://output","w");
2882
2883	fputcsv($file, array_values($allowed_fields));
2884
2885	foreach($csv_array as $ik => $iv){
2886
2887	$iv['start'] = $iv['start'];
2888	$iv['end'] = $iv['end'];
2889	$iv['time'] = date('d/m/Y', $iv['time']);
2890
2891	$row = array();
2892	foreach($allowed_fields as $ak => $av){
2893	$row[$ak] = $iv[$ak];
2894	}
2895
2896	fputcsv($file, $row);
2897	}
2898
2899	fclose($file);
2900
2901	wp_die();
2902
2903	}
2904
2905	add_action('wp_ajax_loginizer_failed_login_export', 'loginizer_failed_login_export');
2906
2907	//Export Failed Login Attempts
2908	function loginizer_failed_login_export(){
2909
2910	global $wpdb;
2911	// Some AJAX security
2912	check_ajax_referer('loginizer_admin_ajax', 'nonce');
2913
2914	if(!current_user_can('manage_options')){
2915	wp_die('Sorry, but you do not have permissions to change settings.');
2916	}
2917
2918	$csv_array = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` ORDER BY `time` DESC", 1);
2919	$filename = 'loginizer-failed-login-attempts';
2920
2921	if(empty($csv_array)){
2922	echo -1;
2923	echo __('No data to export', 'loginizer');
2924	wp_die();
2925	}
2926
2927	header('Content-Type: text/csv; charset=utf-8');
2928	header('Content-Disposition: attachment; filename='.$filename.'.csv');
2929
2930	$allowed_fields = array('ip' => 'IP', 'attempted_username' => 'Attempted Username', 'last_f_attemp' => 'Last Failed Attempt', 'f_attempts_count' => 'Failed Attempts Count', 'lockouts_count' => 'Lockouts Count', 'url_attacked' => 'URL Attacked');
2931
2932	$file = fopen("php://output","w");
2933
2934	fputcsv($file, array_values($allowed_fields));
2935
2936	foreach($csv_array as $failed_attempts){
2937
2938	$row = array($failed_attempts['ip'], $failed_attempts['username'], date('d/M/Y H:i:s P', $failed_attempts['time']), $failed_attempts['count'], $failed_attempts['lockout'], $failed_attempts['url']);
2939	fputcsv($file, $row);
2940	}
2941
2942
2943	fclose($file);
2944
2945	wp_die();
2946
2947	}
2948
2949	// IP range validations
2950	function loginizer_iprange_validate($start_ip, $end_ip, $cur_list, &$error = array(), $line_count = ''){
2951
2952	$line_error = '';
2953	if(!empty($line_count)){
2954	$line_error = ' '.__('Line no.', 'loginizer').' '.$line_count;
2955	}
2956
2957	if(empty($start_ip)){
2958	$cur_error[] = __('Please enter the Start IP', 'loginizer').$line_error;
2959	}
2960
2961	// If no end IP we consider only 1 IP
2962	if(empty($end_ip)){
2963	$end_ip = $start_ip;
2964	}
2965
2966	if(!lz_valid_ip($start_ip)){
2967	$cur_error[] = __('Please provide a valid start IP', 'loginizer').$line_error;
2968	}
2969
2970	if(!lz_valid_ip($end_ip)){
2971	$cur_error[] = __('Please provide a valid end IP', 'loginizer').$line_error;
2972	}
2973
2974	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
2975
2976	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
2977	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
2978	// This is right
2979	}else{
2980	$cur_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer').$line_error;
2981	}
2982
2983	}
2984
2985	if(!empty($cur_error)){
2986
2987	foreach($cur_error as $rk => $rv){
2988	$error[] = $rv;
2989	}
2990
2991	return false;
2992	}
2993
2994	if(!empty($cur_list)){
2995
2996	foreach($cur_list as $k => $v){
2997
2998	// This is to check if there is any other range exists with the same Start or End IP
2999	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
3000	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
3001	){
3002	$cur_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer').$line_error;
3003	break;
3004	}
3005
3006	// This is to check if there is any other range exists with the same Start IP
3007	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
3008	$cur_error[] = __('The Start IP is present in an existing range !', 'loginizer').$line_error;
3009	break;
3010	}
3011
3012	// This is to check if there is any other range exists with the same End IP
3013	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
3014	$cur_error[] = __('The End IP is present in an existing range!', 'loginizer').$line_error;
3015	break;
3016	}
3017
3018	}
3019
3020	}
3021
3022	if(!empty($cur_error)){
3023
3024	foreach($cur_error as $rk => $rv){
3025	$error[] = $rv;
3026	}
3027
3028	return false;
3029	}
3030
3031	return true;
3032	}
3033
3034	//---------------------
3035	// Admin Menu Pro Pages
3036	//---------------------
3037
3038	// Loginizer - reCaptcha Page
3039	function loginizer_page_recaptcha(){
3040
3041	global $loginizer, $lz_error, $lz_env;
3042
3043	if(!current_user_can('manage_options')){
3044	wp_die('Sorry, but you do not have permissions to change settings.');
3045	}
3046
3047	if(!loginizer_is_premium() && count($_POST) > 0){
3048	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3049	return loginizer_page_recaptcha_T();
3050	}
3051
3052	/* Make sure post was from this page */
3053	if(count($_POST) > 0){
3054	check_admin_referer('loginizer-options');
3055	}
3056
3057	// Themes
3058	$lz_env['theme']['light'] = 'Light';
3059	$lz_env['theme']['dark'] = 'Dark';
3060
3061	// Langs
3062	$lz_env['lang'][''] = 'Auto Detect';
3063	$lz_env['lang']['ar'] = 'Arabic';
3064	$lz_env['lang']['bg'] = 'Bulgarian';
3065	$lz_env['lang']['ca'] = 'Catalan';
3066	$lz_env['lang']['zh-CN'] = 'Chinese (Simplified)';
3067	$lz_env['lang']['zh-TW'] = 'Chinese (Traditional)';
3068	$lz_env['lang']['hr'] = 'Croatian';
3069	$lz_env['lang']['cs'] = 'Czech';
3070	$lz_env['lang']['da'] = 'Danish';
3071	$lz_env['lang']['nl'] = 'Dutch';
3072	$lz_env['lang']['en-GB'] = 'English (UK)';
3073	$lz_env['lang']['en'] = 'English (US)';
3074	$lz_env['lang']['fil'] = 'Filipino';
3075	$lz_env['lang']['fi'] = 'Finnish';
3076	$lz_env['lang']['fr'] = 'French';
3077	$lz_env['lang']['fr-CA'] = 'French (Canadian)';
3078	$lz_env['lang']['de'] = 'German';
3079	$lz_env['lang']['de-AT'] = 'German (Austria)';
3080	$lz_env['lang']['de-CH'] = 'German (Switzerland)';
3081	$lz_env['lang']['el'] = 'Greek';
3082	$lz_env['lang']['iw'] = 'Hebrew';
3083	$lz_env['lang']['hi'] = 'Hindi';
3084	$lz_env['lang']['hu'] = 'Hungarain';
3085	$lz_env['lang']['id'] = 'Indonesian';
3086	$lz_env['lang']['it'] = 'Italian';
3087	$lz_env['lang']['ja'] = 'Japanese';
3088	$lz_env['lang']['ko'] = 'Korean';
3089	$lz_env['lang']['lv'] = 'Latvian';
3090	$lz_env['lang']['lt'] = 'Lithuanian';
3091	$lz_env['lang']['no'] = 'Norwegian';
3092	$lz_env['lang']['fa'] = 'Persian';
3093	$lz_env['lang']['pl'] = 'Polish';
3094	$lz_env['lang']['pt'] = 'Portuguese';
3095	$lz_env['lang']['pt-BR'] = 'Portuguese (Brazil)';
3096	$lz_env['lang']['pt-PT'] = 'Portuguese (Portugal)';
3097	$lz_env['lang']['ro'] = 'Romanian';
3098	$lz_env['lang']['ru'] = 'Russian';
3099	$lz_env['lang']['sr'] = 'Serbian';
3100	$lz_env['lang']['sk'] = 'Slovak';
3101	$lz_env['lang']['sl'] = 'Slovenian';
3102	$lz_env['lang']['es'] = 'Spanish';
3103	$lz_env['lang']['es-419'] = 'Spanish (Latin America)';
3104	$lz_env['lang']['sv'] = 'Swedish';
3105	$lz_env['lang']['th'] = 'Thai';
3106	$lz_env['lang']['tr'] = 'Turkish';
3107	$lz_env['lang']['uk'] = 'Ukrainian';
3108	$lz_env['lang']['vi'] = 'Vietnamese';
3109
3110	// Sizes
3111	$lz_env['size']['normal'] = 'Normal';
3112	$lz_env['size']['compact'] = 'Compact';
3113
3114	// reCAPTCHA Domains
3115	$lz_env['captcha_domains']['www.google.com'] = 'google.com';
3116	$lz_env['captcha_domains']['www.recaptcha.net'] = 'recaptcha.net';
3117
3118	if(isset($_POST['save_lz'])){
3119
3120	// Clear captcha
3121	if(empty($_POST['captcha_status'])){
3122
3123	// Save the options
3124	update_option('loginizer_captcha', '');
3125
3126	// Mark as saved
3127	$GLOBALS['lz_cleared'] = true;
3128
3129	}else{
3130
3131	// Google Captcha
3132	$option['captcha_type'] = lz_optpost('captcha_type');
3133	$option['captcha_key'] = lz_optpost('captcha_key');
3134	$option['captcha_secret'] = lz_optpost('captcha_secret');
3135	$option['captcha_theme'] = lz_optpost('captcha_theme');
3136	$option['captcha_size'] = lz_optpost('captcha_size');
3137	$option['captcha_lang'] = lz_optpost('captcha_lang');
3138	$option['captcha_domain'] = lz_optpost('captcha_domain');
3139
3140	// No Google Captcha
3141	$option['captcha_text'] = lz_optpost('captcha_text');
3142	$option['captcha_time'] = (int) lz_optpost('captcha_time');
3143	$option['captcha_words'] = (int) lz_optpost('captcha_words');
3144	$option['captcha_add'] = (int) lz_optpost('captcha_add');
3145	$option['captcha_subtract'] = (int) lz_optpost('captcha_subtract');
3146	$option['captcha_multiply'] = (int) lz_optpost('captcha_multiply');
3147	$option['captcha_divide'] = (int) lz_optpost('captcha_divide');
3148
3149	// Checkboxes
3150	$option['captcha_user_hide'] = (int) lz_optpost('captcha_user_hide');
3151	$option['captcha_no_css_login'] = (int) lz_optpost('captcha_no_css_login');
3152	$option['captcha_login'] = (int) lz_optpost('captcha_login');
3153	$option['captcha_lostpass'] = (int) lz_optpost('captcha_lostpass');
3154	$option['captcha_resetpass'] = (int) lz_optpost('captcha_resetpass');
3155	$option['captcha_register'] = (int) lz_optpost('captcha_register');
3156	$option['captcha_comment'] = (int) lz_optpost('captcha_comment');
3157	$option['captcha_wc_checkout'] = (int) lz_optpost('captcha_wc_checkout');
3158
3159	// Are we to use Math Captcha ?
3160	if(!empty($_POST['captcha_status']) && $_POST['captcha_status'] == 2){
3161
3162	$option['captcha_no_google'] = 1;
3163
3164	// Make the checks
3165	if(strlen($option['captcha_text']) < 1){
3166	$lz_error['captcha_text'] = __('The Captcha key was not submitted', 'loginizer');
3167	}
3168
3169	}else{
3170
3171	// Make the checks
3172	if(strlen($option['captcha_key']) < 32 \|\| strlen($option['captcha_key']) > 50){
3173	$lz_error['captcha_key'] = __('The reCAPTCHA key is invalid', 'loginizer');
3174	}
3175
3176	// Is secret valid ?
3177	if(strlen($option['captcha_secret']) < 32 \|\| strlen($option['captcha_secret']) > 50){
3178	$lz_error['captcha_secret'] = __('The reCAPTCHA secret is invalid', 'loginizer');
3179	}
3180
3181	// Is theme valid ?
3182	if(empty($lz_env['theme'][$option['captcha_theme']])){
3183	$lz_error['captcha_theme'] = __('The reCAPTCHA theme is invalid', 'loginizer');
3184	}
3185
3186	// Is size valid ?
3187	if(empty($lz_env['size'][$option['captcha_size']])){
3188	$lz_error['captcha_size'] = __('The reCAPTCHA size is invalid', 'loginizer');
3189	}
3190
3191	// Is lang valid ?
3192	if(empty($lz_env['lang'][$option['captcha_lang']])){
3193	$lz_error['captcha_lang'] = __('The reCAPTCHA language is invalid', 'loginizer');
3194	}
3195
3196	if(empty($lz_env['captcha_domains'][$option['captcha_domain']])){
3197	$lz_error['captcha_domain'] = __('The reCAPTCHA domain is invalid', 'loginizer');
3198	}
3199
3200	}
3201
3202	// Is there an error ?
3203	if(!empty($lz_error)){
3204	return loginizer_page_recaptcha_T();
3205	}
3206
3207	// Save the options
3208	update_option('loginizer_captcha', $option);
3209
3210	// Mark as saved
3211	$GLOBALS['lz_saved'] = true;
3212	}
3213
3214	}
3215
3216	// Call the theme
3217	loginizer_page_recaptcha_T();
3218
3219	}
3220
3221	// Loginizer - reCaptcha Page Theme
3222	function loginizer_page_recaptcha_T(){
3223
3224	global $loginizer, $lz_error, $lz_env;
3225
3226	// Universal header
3227	loginizer_page_header('reCAPTCHA Settings');
3228
3229	loginizer_feature_available('reCAPTCHA');
3230
3231	// Saved ?
3232	if(!empty($GLOBALS['lz_saved'])){
3233	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
3234	}
3235
3236	// Cleared ?
3237	if(!empty($GLOBALS['lz_cleared'])){
3238	echo '<div id="message" class="updated"><p>'. __('reCAPTCHA has been disabled !', 'loginizer'). '</p></div><br />';
3239	}
3240
3241	// Any errors ?
3242	if(!empty($lz_error)){
3243	lz_report_error($lz_error);echo '<br />';
3244	}
3245
3246	?>
3247
3248	<style>
3249	input[type="text"], textarea, select {
3250	width: 70%;
3251	}
3252	</style>
3253
3254	<div id="" class="postbox">
3255
3256	<div class="postbox-header">
3257	<h2 class="hndle ui-sortable-handle">
3258	<span><?php echo __('reCAPTCHA Settings', 'loginizer'); ?></span>
3259	</h2>
3260	</div>
3261
3262	<div class="inside">
3263
3264	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3265	<?php wp_nonce_field('loginizer-options'); ?>
3266	<table class="form-table">
3267	<tr>
3268	<td scope="row" valign="top" style="width:400px !important;"><label for="captcha_status"><b><?php echo __('Captcha Status', 'loginizer'); ?></b></label></td>
3269	<td>
3270	<select name="captcha_status" id="captcha_status" onchange="lz_captcha_status();">
3271	<?php
3272	echo '<option '.lz_POSTselect('captcha_status', 0, (empty($loginizer['captcha_key']) && empty($loginizer['captcha_no_google']) ? true : false)).' value="0">'.__('Disabled', 'loginizer').'</value>
3273	<option '.lz_POSTselect('captcha_status', 1, (!empty($loginizer['captcha_key']) ? true : false)).' value="1">'.__('Google reCAPTCHA', 'loginizer').'</value>
3274	<option '.lz_POSTselect('captcha_status', 2, (!empty($loginizer['captcha_no_google']) ? true : false)).' value="2">'.__('Math Captcha', 'loginizer').'</value>';
3275	?>
3276	</select>
3277	</td>
3278	</tr>
3279	<tr class="lz_google_cap">
3280	<td scope="row" valign="top"><label><b><?php echo __('reCAPTCHA type', 'loginizer'); ?></b></label><br>
3281	<?php echo __('Choose the type of reCAPTCHA', 'loginizer'); ?><br />
3282	<?php echo __('<a href="https://g.co/recaptcha/sitetypes/" target="_blank">See Site Types for more details</a>', 'loginizer'); ?>
3283	</td>
3284	<td>
3285	<input type="radio" value="v3" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v3', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v3" /> <label for="captcha_type_v3"><?php echo __('reCAPTCHA v3', 'loginizer'); ?></label><br /><br />
3286	<input type="radio" value="" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', '', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2" /> <label for="captcha_type_v2"><?php echo __('reCAPTCHA v2 - Checkbox', 'loginizer'); ?></label><br /><br />
3287	<input type="radio" value="v2_invisible" onchange="google_recaptcha_type()" <?php echo lz_POSTradio('captcha_type', 'v2_invisible', $loginizer['captcha_type']); ?> name="captcha_type" id="captcha_type_v2_invisible" /> <label for="captcha_type_v2_invisible"><?php echo __('reCAPTCHA v2 - Invisible', 'loginizer'); ?></label><br />
3288	</td>
3289	</tr>
3290	<tr class="lz_google_cap">
3291	<td scope="row" valign="top"><label for="captcha_key"><b><?php echo __('Site Key', 'loginizer'); ?></b></label><br>
3292	<?php echo __('Make sure you enter the correct keys as per the reCAPTCHA type selected above', 'loginizer'); ?>
3293	</td>
3294	<td>
3295	<input type="text" size="50" value="<?php echo lz_optpost('captcha_key', $loginizer['captcha_key']); ?>" name="captcha_key" id="captcha_key" /><br />
3296	<?php echo __('Get the Site Key and Secret Key from <a href="https://www.google.com/recaptcha/admin/" target="_blank">Google</a>', 'loginizer'); ?>
3297	</td>
3298	</tr>
3299	<tr class="lz_google_cap">
3300	<td scope="row" valign="top"><label for="captcha_secret"><b><?php echo __('Secret Key', 'loginizer'); ?></b></label></td>
3301	<td>
3302	<input type="text" size="50" value="<?php echo lz_optpost('captcha_secret', $loginizer['captcha_secret']); ?>" name="captcha_secret" id="captcha_secret" />
3303	</td>
3304	</tr>
3305	<tr class="lz_google_cap">
3306	<td scope="row" valign="top"><label for="captcha_theme"><b><?php echo __('Theme', 'loginizer'); ?></b></label></td>
3307	<td>
3308	<select name="captcha_theme" id="captcha_theme">
3309	<?php
3310	foreach($lz_env['theme'] as $k => $v){
3311	echo '<option '.lz_POSTselect('captcha_theme', $k, ($loginizer['captcha_theme'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3312	}
3313	?>
3314	</select>
3315	</td>
3316	</tr>
3317	<tr class="lz_google_cap">
3318	<td scope="row" valign="top"><label for="captcha_lang"><b><?php echo __('Language', 'loginizer'); ?></b></label></td>
3319	<td>
3320	<select name="captcha_lang" id="captcha_lang">
3321	<?php
3322	foreach($lz_env['lang'] as $k => $v){
3323	echo '<option '.lz_POSTselect('captcha_lang', $k, ($loginizer['captcha_lang'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3324	}
3325	?>
3326	</select>
3327	</td>
3328	</tr>
3329	<tr class="lz_google_cap lz_google_cap_size">
3330	<td scope="row" valign="top"><label for="captcha_size"><b><?php echo __('Size', 'loginizer'); ?></b></label></td>
3331	<td>
3332	<select name="captcha_size" id="captcha_size">
3333	<?php
3334	foreach($lz_env['size'] as $k => $v){
3335	echo '<option '.lz_POSTselect('captcha_size', $k, ($loginizer['captcha_size'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
3336	}
3337	?>
3338	</select>
3339	</td>
3340	</tr>
3341	<tr class="lz_google_cap">
3342	<td scope="row" valign="top">
3343	<label for="captcha_domain"><b><?php echo __('reCAPTCHA Domain', 'loginizer'); ?></b></label><br>
3344	<?php echo __('If Google is not accessible or blocked in your country select other one', 'loginizer'); ?>
3345	</td>
3346	<td>
3347	<select name="captcha_domain" id="captcha_domain">
3348	<?php
3349	foreach($lz_env['captcha_domains'] as $k => $v){
3350	echo '<option '.lz_POSTselect('captcha_domain', $k, ($loginizer['captcha_domain'] == $k ? true : false)).' value="'.$k.'">'.$v.($k == 'www.google.com' ? ' '.__('(Default)', 'loginizer') : '').'</value>';
3351	}
3352	?>
3353	</select>
3354	</td>
3355	</tr>
3356	<tr class="lz_math_cap">
3357	<td scope="row" valign="top">
3358	<label for="captcha_text"><b><?php echo __('Captcha Text', 'loginizer'); ?></b></label><br>
3359	<?php echo __('The text to be shown for the Captcha Field', 'loginizer'); ?>
3360	</td>
3361	<td>
3362	<input type="text" size="30" value="<?php echo lz_optpost('captcha_text', @$loginizer['captcha_text']); ?>" name="captcha_text" id="captcha_text" />
3363	</td>
3364	</tr>
3365	<tr class="lz_math_cap">
3366	<td scope="row" valign="top">
3367	<label for="captcha_time"><b><?php echo __('Captcha Time', 'loginizer'); ?></b></label><br>
3368	<?php echo __('Enter the number of seconds, a user has to enter captcha value.', 'loginizer'); ?>
3369	</td>
3370	<td>
3371	<input type="text" size="30" value="<?php echo lz_optpost('captcha_time', @$loginizer['captcha_time']); ?>" name="captcha_time" id="captcha_time" />
3372	</td>
3373	</tr>
3374	<tr class="lz_math_cap">
3375	<td scope="row" valign="top">
3376	<label for="captcha_words"><b><?php echo __('Display Captcha in Words', 'loginizer'); ?></b></label><br>
3377	<?php echo __('If selected the Captcha will be displayed in words rather than numbers', 'loginizer'); ?>
3378	</td>
3379	<td>
3380	<input type="checkbox" value="1" name="captcha_words" id="captcha_words" <?php echo lz_POSTchecked('captcha_words', (empty($loginizer['captcha_words']) ? false : true));?> />
3381	</td>
3382	</tr>
3383	<tr class="lz_math_cap">
3384	<td scope="row" valign="top" style="vertical-align: top !important;">
3385	<label><b><?php echo __('Mathematical operations', 'loginizer'); ?></b></label><br>
3386	<?php echo __('The Mathematical operations to use for Captcha', 'loginizer'); ?>
3387	</td>
3388	<td valign="top">
3389	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3390	<?php echo '
3391	<tr>
3392	<td><label for="captcha_add">'.__('Addition (+)', 'loginizer').'</label></td>
3393	<td><input type="checkbox" value="1" name="captcha_add" id="captcha_add" '.lz_POSTchecked('captcha_add', (empty($loginizer['captcha_add']) ? false : true)).' /></td>
3394	</tr>
3395	<tr>
3396	<td><label for="captcha_subtract">'.__('Subtraction (-)', 'loginizer').'</label></td>
3397	<td><input type="checkbox" value="1" name="captcha_subtract" id="captcha_subtract" '.lz_POSTchecked('captcha_subtract', (empty($loginizer['captcha_subtract']) ? false : true)).' /></td>
3398	</tr>
3399	<tr>
3400	<td><label for="captcha_multiply">'.__('Multiplication (x)', 'loginizer').'</label></td>
3401	<td><input type="checkbox" value="1" name="captcha_multiply" id="captcha_multiply" '.lz_POSTchecked('captcha_multiply', (empty($loginizer['captcha_multiply']) ? false : true)).' /></td>
3402	</tr>
3403	<tr>
3404	<td><label for="captcha_divide">'.__('Division (÷)', 'loginizer').'</label></td>
3405	<td><input type="checkbox" value="1" name="captcha_divide" id="captcha_divide" '.lz_POSTchecked('captcha_divide', (empty($loginizer['captcha_divide']) ? false : true)).' /></td>
3406	</tr>';
3407	?>
3408	</table>
3409	</td>
3410	</tr>
3411	<tr class="lz_cap">
3412	<td scope="row" valign="top"><label><b><?php echo __('Show Captcha On', 'loginizer'); ?></b></label></td>
3413	<td valign="top">
3414	<table class="wp-list-table fixed users" cellpadding="8" cellspacing="1">
3415	<?php echo '
3416	<tr>
3417	<td><label for="captcha_login">'.__('Login Form', 'loginizer').'</label></td>
3418	<td><input type="checkbox" value="1" name="captcha_login" id="captcha_login" '.lz_POSTchecked('captcha_login', (empty($loginizer['captcha_login']) ? false : true)).' /></td>
3419	</tr>
3420	<tr>
3421	<td><label for="captcha_lostpass">'.__('Lost Password Form', 'loginizer').'</label></td>
3422	<td><input type="checkbox" value="1" name="captcha_lostpass" id="captcha_lostpass" '.lz_POSTchecked('captcha_lostpass', (empty($loginizer['captcha_lostpass']) ? false : true)).' /></td>
3423	</tr>
3424	<tr>
3425	<td><label for="captcha_resetpass">'.__('Reset Password Form', 'loginizer').'</label></td>
3426	<td><input type="checkbox" value="1" name="captcha_resetpass" id="captcha_resetpass" '.lz_POSTchecked('captcha_resetpass', (empty($loginizer['captcha_resetpass']) ? false : true)).' /></td>
3427	</tr>
3428	<tr>
3429	<td><label for="captcha_register">'.__('Registration Form', 'loginizer').'</label></td>
3430	<td><input type="checkbox" value="1" name="captcha_register" id="captcha_register" '.lz_POSTchecked('captcha_register', (empty($loginizer['captcha_register']) ? false : true)).' /></td>
3431	</tr>
3432	<tr>
3433	<td><label for="captcha_comment">'.__('Comment Form', 'loginizer').'</label></td>
3434	<td><input type="checkbox" value="1" name="captcha_comment" id="captcha_comment" '.lz_POSTchecked('captcha_comment', (empty($loginizer['captcha_comment']) ? false : true)).' /></td>
3435	</tr>';
3436
3437	if(!defined('SITEPAD')){
3438
3439	echo '<tr>
3440	<td><label for="captcha_wc_checkout">'.__('WooCommerce Checkout', 'loginizer').'</label></td>
3441	<td><input type="checkbox" value="1" name="captcha_wc_checkout" id="captcha_wc_checkout" '.lz_POSTchecked('captcha_wc_checkout', (empty($loginizer['captcha_wc_checkout']) ? false : true)).' /></td>
3442	</tr>';
3443
3444	}
3445
3446	?>
3447	</table>
3448	</td>
3449	</tr>
3450	<tr class="lz_cap">
3451	<td scope="row" valign="top"><label for="captcha_user_hide"><b><?php echo __('Hide CAPTCHA for logged in Users', 'loginizer'); ?></b></label></td>
3452	<td>
3453	<input type="checkbox" value="1" name="captcha_user_hide" id="captcha_user_hide" <?php echo lz_POSTchecked('captcha_user_hide', (empty($loginizer['captcha_user_hide']) ? false : true)); ?> />
3454	</td>
3455	</tr>
3456	<tr class="lz_google_cap">
3457	<td scope="row" valign="top"><label for="captcha_no_css_login"><b><?php echo __('Disable CSS inserted on Login Page', 'loginizer'); ?></b></label></td>
3458	<td>
3459	<input type="checkbox" value="1" name="captcha_no_css_login" id="captcha_no_css_login" <?php echo lz_POSTchecked('captcha_no_css_login', (empty($loginizer['captcha_no_css_login']) ? false : true)); ?> />
3460	</td>
3461	</tr>
3462	</table><br />
3463	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" /></center>
3464	</form>
3465
3466	</div>
3467	</div>
3468	<br />
3469
3470	<script type="text/javascript">
3471
3472	function lz_captcha_status(){
3473
3474	var cur_captcha_status = jQuery("#captcha_status option:selected").val();
3475
3476	if(cur_captcha_status == 1){
3477	jQuery(".lz_google_cap").show();
3478	jQuery(".lz_math_cap").hide();
3479	jQuery(".lz_cap").show();
3480	google_recaptcha_type();
3481
3482	}else if(cur_captcha_status == 2){
3483	jQuery(".lz_google_cap").hide();
3484	jQuery(".lz_math_cap").show();
3485	jQuery(".lz_cap").show();
3486	}else{
3487	jQuery(".lz_google_cap").hide();
3488	jQuery(".lz_math_cap").hide();
3489	jQuery(".lz_cap").hide();
3490	}
3491
3492	}
3493
3494	function google_recaptcha_type(){
3495
3496	var cur_captcha_type = jQuery("input:radio[name='captcha_type']:checked").val();
3497
3498	if(cur_captcha_type == 'v3' \|\| cur_captcha_type == 'v2_invisible'){
3499	jQuery(".lz_google_cap_size").hide();
3500	}else{
3501	jQuery(".lz_google_cap_size").show();
3502	}
3503
3504	}
3505
3506	jQuery(document).ready(function(){
3507	lz_captcha_status();
3508	});
3509
3510	</script>
3511
3512	<?php
3513	loginizer_page_footer();
3514
3515	}
3516
3517
3518	// Loginizer - Two Factor Auth Page
3519	function loginizer_page_2fa(){
3520
3521	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3522
3523	if(!current_user_can('manage_options')){
3524	wp_die('Sorry, but you do not have permissions to change settings.');
3525	}
3526
3527	if(!loginizer_is_premium() && count($_POST) > 0){
3528	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
3529	return loginizer_page_2fa_T();
3530	}
3531
3532	$lz_roles = get_editable_roles();
3533
3534	if(empty($lz_roles)){
3535	$lz_roles = array();
3536	}
3537
3538	/* Make sure post was from this page */
3539	if(count($_POST) > 0){
3540	check_admin_referer('loginizer-options');
3541	}
3542
3543	// Settings submitted
3544	if(isset($_POST['save_lz'])){
3545
3546	// In the future there can be more settings
3547	$option['2fa_app'] = (int) lz_optpost('2fa_app');
3548	$option['2fa_email'] = (int) lz_optpost('2fa_email');
3549	$option['question'] = (int) lz_optpost('question');
3550	$option['2fa_email_force'] = (int) lz_optpost('2fa_email_force');
3551
3552	// Any roles to apply to ?
3553	foreach($lz_roles as $k => $v){
3554
3555	if(lz_optpost('2fa_roles_'.$k)){
3556	$option['2fa_roles'][$k] = 1;
3557	}
3558
3559	}
3560
3561	// If its all, then blank it
3562	if(lz_optpost('2fa_roles_all') \|\| empty($option['2fa_roles'])){
3563	$option['2fa_roles'] = '';
3564	}
3565
3566	// Is there an error ?
3567	if(!empty($lz_error)){
3568	return loginizer_page_2fa_T();
3569	}
3570
3571	// Save the options
3572	update_option('loginizer_2fa', $option);
3573
3574	// Mark as saved
3575	$GLOBALS['lz_saved'] = true;
3576
3577	// update the rewrite rules for WooCommerce to make security settings page accessible from woo commerce client area
3578	if((!empty($option['2fa_app']) \|\| !empty($option['2fa_email']) \|\| !empty($option['question']) \|\| !empty($option['2fa_email_force'])) && class_exists('WooCommerce')){
3579	loginizer_woocommerce_rewrite_rule();
3580	}
3581
3582	}
3583
3584	// Reset a users 2FA
3585	if(isset($_POST['reset_user_lz'])){
3586
3587	$_username = lz_optpost('lz_user_2fa_disable');
3588
3589	// Try to get the user
3590	$user_search = get_user_by('login', $_username);
3591
3592	// If not found then search by email
3593	if(empty($user_search)){
3594	$user_search = get_user_by('email', $_username);
3595	}
3596
3597	// If not found then give error
3598	if(empty($user_search)){
3599	$lz_error['2fa_user_not'] = __('There is no such user with the email or username you submitted', 'loginizer');
3600	return loginizer_page_2fa_T();
3601	}
3602
3603	// Get the user prefences
3604	$user_pref = get_user_meta($user_search->ID, 'loginizer_user_settings');
3605
3606	// Blank it
3607	$user_pref['pref'] = 'none';
3608
3609	// Save it
3610	update_user_meta($user_search->ID, 'loginizer_user_settings', $user_pref);
3611
3612	// Mark as saved
3613	$GLOBALS['lz_saved'] = __('The user\'s 2FA settings have been reset', 'loginizer');
3614
3615	}
3616
3617	if(isset($_POST['save_2fa_custom_redirect'])){
3618
3619	if(!empty($_POST['lz_2fa_custom_login_redirect'])){
3620	$loginizer['2fa_custom_login_redirect'] = map_deep($_POST['lz_2fa_custom_login_redirect'], 'sanitize_text_field');
3621
3622	update_option('loginizer_2fa_custom_redirect', $loginizer['2fa_custom_login_redirect']);
3623
3624	$GLOBALS['lz_saved'] = true;
3625	}
3626	}
3627
3628	if(isset($_POST['save_2fa_email_template_lz'])){
3629
3630	// In the future there can be more settings
3631	$option['2fa_email_sub'] = @stripslashes($_POST['lz_2fa_email_sub']);
3632	$option['2fa_email_msg'] = @stripslashes($_POST['lz_2fa_email_msg']);
3633
3634	// Is there an error ?
3635	if(!empty($lz_error)){
3636	return loginizer_page_2fa_T();
3637	}
3638
3639	// Save the options
3640	update_option('loginizer_2fa_email_template', $option);
3641
3642	// Mark as saved
3643	$GLOBALS['lz_saved'] = true;
3644
3645	}
3646
3647	// Save the messages
3648	if(isset($_POST['save_msgs_lz'])){
3649
3650	$msgs['otp_app'] = lz_optpost('msg_otp_app');
3651	$msgs['otp_email'] = lz_optpost('msg_otp_email');
3652	$msgs['otp_field'] = lz_optpost('msg_otp_field');
3653	$msgs['otp_question'] = lz_optpost('msg_otp_question');
3654	$msgs['otp_answer'] = lz_optpost('msg_otp_answer');
3655
3656	// Update them
3657	update_option('loginizer_2fa_msg', $msgs);
3658
3659	// Mark as saved
3660	$GLOBALS['lz_saved'] = __('Messages were saved successfully', 'loginizer');
3661
3662	}
3663
3664	// Delete a Whitelist IP range
3665	if(isset($_POST['delid'])){
3666
3667	$delid = (int) lz_optreq('delid');
3668
3669	// Unset and save
3670	$whitelist = $loginizer['2fa_whitelist'];
3671	unset($whitelist[$delid]);
3672	update_option('loginizer_2fa_whitelist', $whitelist);
3673
3674	// Mark as saved
3675	$GLOBALS['lz_saved'] = __('The Whitelist IP range has been deleted successfully', 'loginizer');
3676
3677	}
3678
3679	// Delete all Blackist IP ranges
3680	if(isset($_POST['del_all_whitelist'])){
3681
3682	// Unset and save
3683	update_option('loginizer_2fa_whitelist', array());
3684
3685	// Mark as saved
3686	$GLOBALS['lz_saved'] = __('The Whitelist IP range(s) have been cleared successfully', 'loginizer');
3687
3688	}
3689
3690	// Add IP range to 2FA whitelist
3691	if(isset($_POST['2fa_whitelist_iprange'])){
3692
3693	$start_ip = lz_optpost('start_ip_w_2fa');
3694	$end_ip = lz_optpost('end_ip_w_2fa');
3695
3696	if(empty($start_ip)){
3697	$lz_error[] = __('Please enter the Start IP', 'loginizer');
3698	return loginizer_page_2fa_T();
3699	}
3700
3701	// If no end IP we consider only 1 IP
3702	if(empty($end_ip)){
3703	$end_ip = $start_ip;
3704	}
3705
3706	if(!lz_valid_ip($start_ip)){
3707	$lz_error[] = __('Please provide a valid start IP', 'loginizer');
3708	}
3709
3710	if(!lz_valid_ip($end_ip)){
3711	$lz_error[] = __('Please provide a valid end IP', 'loginizer');
3712	}
3713
3714	if(inet_ptoi($start_ip) > inet_ptoi($end_ip)){
3715
3716	// BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
3717	if(inet_ptoi($start_ip) >= 0 && inet_ptoi($end_ip) < 0){
3718	// This is right
3719	}else{
3720	$lz_error[] = __('The End IP cannot be smaller than the Start IP', 'loginizer');
3721	}
3722
3723	}
3724
3725	if(empty($lz_error)){
3726
3727	$whitelist = $loginizer['2fa_whitelist'];
3728
3729	foreach($whitelist as $k => $v){
3730
3731	// This is to check if there is any other range exists with the same Start or End IP
3732	if(( inet_ptoi($start_ip) <= inet_ptoi($v['start']) && inet_ptoi($v['start']) <= inet_ptoi($end_ip) )
3733	\|\| ( inet_ptoi($start_ip) <= inet_ptoi($v['end']) && inet_ptoi($v['end']) <= inet_ptoi($end_ip) )
3734	){
3735	$lz_error[] = __('The Start IP or End IP submitted conflicts with an existing IP range !', 'loginizer');
3736	break;
3737	}
3738
3739	// This is to check if there is any other range exists with the same Start IP
3740	if(inet_ptoi($v['start']) <= inet_ptoi($start_ip) && inet_ptoi($start_ip) <= inet_ptoi($v['end'])){
3741	$lz_error[] = __('The Start IP is present in an existing range !', 'loginizer');
3742	break;
3743	}
3744
3745	// This is to check if there is any other range exists with the same End IP
3746	if(inet_ptoi($v['start']) <= inet_ptoi($end_ip) && inet_ptoi($end_ip) <= inet_ptoi($v['end'])){
3747	$lz_error[] = __('The End IP is present in an existing range!', 'loginizer');
3748	break;
3749	}
3750
3751	}
3752
3753	$newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
3754
3755	if(empty($lz_error)){
3756
3757	$whitelist[$newid] = array();
3758	$whitelist[$newid]['start'] = $start_ip;
3759	$whitelist[$newid]['end'] = $end_ip;
3760	$whitelist[$newid]['time'] = time();
3761
3762	update_option('loginizer_2fa_whitelist', $whitelist);
3763
3764	// Mark as saved
3765	$GLOBALS['lz_saved'] = __('Whitelist IP range for Two Factor Authentication added successfully', 'loginizer');
3766
3767	}
3768
3769	}
3770	}
3771
3772
3773	$lz_options = get_option('loginizer_2fa_email_template');
3774	$saved_msgs = get_option('loginizer_2fa_msg');
3775	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
3776
3777	// Call theme
3778	loginizer_page_2fa_T();
3779
3780	}
3781
3782
3783	// Loginizer - Two Factor Auth Page
3784	function loginizer_page_2fa_T(){
3785
3786	global $loginizer, $lz_error, $lz_env, $lz_roles, $lz_options, $saved_msgs;
3787
3788	// Universal header
3789	loginizer_page_header('Two Factor Authentication');
3790
3791	loginizer_feature_available('Two-Factor Authentication');
3792
3793	// Saved ?
3794	if(!empty($GLOBALS['lz_saved'])){
3795	echo '<div id="message" class="updated"><p>'. __(is_string($GLOBALS['lz_saved']) ? $GLOBALS['lz_saved'] : 'The settings were saved successfully', 'loginizer'). '</p></div><br />';
3796	}
3797
3798	// Any errors ?
3799	if(!empty($lz_error)){
3800	lz_report_error($lz_error);echo '<br />';
3801	}
3802
3803	?>
3804
3805	<style>
3806	input[type="text"], textarea, select {
3807	width: 70%;
3808	}
3809
3810	.form-table label{
3811	font-weight:bold;
3812	}
3813
3814	.exp{
3815	font-size:12px;
3816	}
3817	</style>
3818
3819	<div id="" class="postbox">
3820
3821	<div class="postbox-header">
3822	<h2 class="hndle ui-sortable-handle">
3823	<span><?php echo __('Two Factor Authentication Settings', 'loginizer'); ?></span>
3824	</h2>
3825	</div>
3826
3827	<div class="inside">
3828
3829	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3830	<?php wp_nonce_field('loginizer-options'); ?>
3831	<table class="form-table">
3832	<tr>
3833	<td scope="row" valign="top" colspan="2">
3834	<i><?php echo __('Please choose from the following Two Factor Authentication methods. Each user can choose any one method from the ones enabled by you. You can enable all or anyone that you would like.', 'loginizer'); ?></i>
3835	</td>
3836	</tr>
3837	<tr>
3838	<td scope="row" valign="top" style="width:70% !important">
3839	<label><?php echo __('OTP via App', 'loginizer'); ?></label><br>
3840	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be obtained from the users mobile app e.g. <b>Google Authenticator, Authy, etc.</b>', 'loginizer'); ?></span>
3841	</td>
3842	<td>
3843	<input type="checkbox" value="1" name="2fa_app" <?php echo lz_POSTchecked('2fa_app', (empty($loginizer['2fa_app']) ? false : true), 'save_lz'); ?> />
3844	</td>
3845	</tr>
3846	<tr>
3847	<td scope="row" valign="top">
3848	<label><?php echo __('OTP via Email', 'loginizer'); ?></label><br>
3849	<span class="exp"><?php echo __('After entering the correct login credentials, the user will be asked for the OTP. The OTP will be emailed to the user.', 'loginizer'); ?></span>
3850	</td>
3851	<td>
3852	<input type="checkbox" value="1" name="2fa_email" <?php echo lz_POSTchecked('2fa_email', (empty($loginizer['2fa_email']) ? false : true), 'save_lz'); ?> />
3853	</td>
3854	</tr>
3855	<tr>
3856	<td scope="row" valign="top">
3857	<label><?php echo __('User Defined Question & Answer', 'loginizer'); ?></label><br>
3858	<span class="exp"><?php echo __('In this method the user will be asked to set a secret personal question and answer. After entering the correct login credentials, the user will be asked to answer the question set by them, thus increasing the security', 'loginizer'); ?></span>
3859	</td>
3860	<td>
3861	<input type="checkbox" value="1" name="question" <?php echo lz_POSTchecked('question', (empty($loginizer['question']) ? false : true), 'save_lz'); ?> />
3862	</td>
3863	</tr>
3864	</table><br />
3865
3866	<table class="form-table">
3867	<tr>
3868	<td scope="row" valign="top" style="width:70% !important">
3869	<label><?php echo __('Force OTP via Email', 'loginizer'); ?></label><br>
3870	<span class="exp"><?php echo __('If the user does not have any 2FA method selected, this will enforce the OTP via Email for the users.', 'loginizer'); ?></span>
3871	</td>
3872	<td>
3873	<input type="checkbox" value="1" name="2fa_email_force" <?php echo lz_POSTchecked('2fa_email_force', (empty($loginizer['2fa_email_force']) ? false : true), 'save_lz'); ?> />
3874	</td>
3875	</tr>
3876	<tr>
3877	<td scope="row" valign="top" style="width:70% !important">
3878	<label><?php echo __('Apply 2FA to Roles', 'loginizer'); ?></label><br>
3879	<span class="exp"><?php echo __('Select the Roles to which 2FA should be applied.', 'loginizer'); ?></span>
3880	</td>
3881	<td>
3882	<input type="checkbox" value="1" onchange="lz_roles_handle()" name="2fa_roles_all" id="2fa_roles_all" <?php echo lz_POSTchecked('2fa_roles_all', (empty($loginizer['2fa_roles']) ? true : false), 'save_lz'); ?> /> All<br />
3883	<?php
3884
3885	foreach($lz_roles as $k => $v){
3886	echo '<span class="lz_roles"><input type="checkbox" value="1" name="2fa_roles_'.$k.'" '.lz_POSTchecked('2fa_roles_'.$k, (empty($loginizer['2fa_roles'][$k]) ? false : true), 'save_lz').' /> '.$v['name'].'<br /></span>';
3887	}
3888
3889	?>
3890	</td>
3891	</tr>
3892	</table><br />
3893	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3894	</form>
3895
3896	</div>
3897	</div>
3898
3899	<script type="text/javascript">
3900
3901	function lz_roles_handle(){
3902
3903	var obj = jQuery("#2fa_roles_all")[0];
3904
3905	if(obj.checked){
3906	jQuery(".lz_roles").hide();
3907	}else{
3908	jQuery(".lz_roles").show();
3909	}
3910
3911	}
3912
3913	lz_roles_handle();
3914
3915	</script>
3916
3917	<div id="" class="postbox">
3918
3919	<div class="postbox-header">
3920	<h2 class="hndle ui-sortable-handle">
3921	<span><?php echo __('OTP via Email Template', 'loginizer'); ?></span>
3922	</h2>
3923	</div>
3924
3925	<div class="inside">
3926
3927	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3928	<?php wp_nonce_field('loginizer-options'); ?>
3929	<table class="form-table">
3930	<tr>
3931	<td colspan="2" valign="top">
3932	<?php echo __('Customize the email template to be used when sending the OTP to login via Email for 2FA.', 'loginizer'); ?><br>
3933	<?php echo __('If you do not make changes below the default email template will be used !', 'loginizer'); ?>
3934	</td>
3935	</tr>
3936	<tr>
3937	<td scope="row" valign="top" style="width:350px !important">
3938	<label><?php echo __('Email Subject', 'loginizer'); ?></label><br>
3939	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
3940	<br />Default : <?php echo @$loginizer['2fa_email_d_sub']; ?>
3941	</td>
3942	<td valign="top">
3943	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_sub']) ? stripslashes($_POST['lz_2fa_email_sub']) : (empty($lz_options['2fa_email_sub']) ? '' : $lz_options['2fa_email_sub'])); ?>" name="lz_2fa_email_sub" />
3944	</td>
3945	</tr>
3946	<tr>
3947	<td scope="row" valign="top">
3948	<label><?php echo __('Email Body', 'loginizer'); ?></label><br>
3949	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
3950	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['2fa_email_d_msg']; ?></pre>
3951	</td>
3952	<td valign="top">
3953	<textarea rows="10" name="lz_2fa_email_msg"><?php echo lz_htmlizer(!empty($_POST['lz_2fa_email_msg']) ? stripslashes($_POST['lz_2fa_email_msg']) : (empty($lz_options['2fa_email_msg']) ? '' : $lz_options['2fa_email_msg'])); ?></textarea>
3954	<br />
3955	Variables :
3956	<br />$otp - The OTP for login
3957	<br />$site_name - The Site Name
3958	<br />$site_url - The Site URL
3959	<br />$email - Users Email
3960	<br />$display_name - Users Display Name
3961	<br />$user_login - Username
3962	<br />$first_name - Users First Name
3963	<br />$last_name - Users Last Name
3964	</td>
3965	</tr>
3966	</table><br />
3967	<center><input name="save_2fa_email_template_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
3968	</form>
3969
3970	</div>
3971	</div>
3972
3973	<div id="" class="postbox">
3974
3975	<div class="postbox-header">
3976	<h2 class="hndle ui-sortable-handle">
3977	<span><?php echo __('Custom Messages for OTP', 'loginizer'); ?></span>
3978	</h2>
3979	</div>
3980
3981	<div class="inside">
3982
3983	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
3984	<?php wp_nonce_field('loginizer-options'); ?>
3985	<table class="form-table">
3986	<tr>
3987	<td colspan="2" valign="top">
3988	<?php echo __('Customize the title for OTP field displayed to the user on the login form.', 'loginizer'); ?><br>
3989	<?php echo __('If you do not make changes below the default messages will be used !', 'loginizer'); ?>
3990	</td>
3991	</tr>
3992	<tr>
3993	<td scope="row" valign="top" style="width:350px !important">
3994	<label for="msg_otp_app"><?php echo __('OTP via APP','loginizer'); ?></label><br />
3995	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_app']. '"</em>', 'loginizer'); ?>
3996	</td>
3997	<td>
3998	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_app']) ? '' : $saved_msgs['otp_app']); ?>" name="msg_otp_app" id="msg_otp_app" style="width:auto !important;" />
3999	<br />
4000	</td>
4001	</tr>
4002	<tr>
4003	<td scope="row" valign="top" style="width:350px !important">
4004	<label for="msg_otp_email"><?php echo __('OTP via Email','loginizer'); ?></label><br />
4005	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_email']. '"</em>', 'loginizer'); ?>
4006	</td>
4007	<td>
4008	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_email']) ? '' : $saved_msgs['otp_email']); ?>" name="msg_otp_email" id="msg_otp_email" style="width:auto !important;" />
4009	<br />
4010	</td>
4011	</tr>
4012	<tr>
4013	<td scope="row" valign="top" style="width:350px !important">
4014	<label for="msg_otp_field"><?php echo __('Title for OTP field','loginizer'); ?></label><br />
4015	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_field']. '"</em>', 'loginizer'); ?>
4016	</td>
4017	<td>
4018	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_field']) ? '' : $saved_msgs['otp_field']); ?>" name="msg_otp_field" id="msg_otp_field" style="width:auto !important;" />
4019	<br />
4020	</td>
4021	</tr>
4022	<tr>
4023	<td scope="row" valign="top" style="width:350px !important">
4024	<label for="msg_otp_question"><?php echo __('Title for Security Question','loginizer'); ?></label><br />
4025	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_question']. '"</em>', 'loginizer'); ?>
4026	</td>
4027	<td>
4028	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_question']) ? '' : $saved_msgs['otp_question']); ?>" name="msg_otp_question" id="msg_otp_question" style="width:auto !important;" />
4029	<br />
4030	</td>
4031	</tr>
4032	<tr>
4033	<td scope="row" valign="top" style="width:350px !important">
4034	<label for="msg_otp_answer"><?php echo __('Title for Security Answer','loginizer'); ?></label><br />
4035	<?php echo __('Default: <em>"' . $loginizer['2fa_d_msg']['otp_answer']. '"</em>', 'loginizer'); ?>
4036	</td>
4037	<td>
4038	<input type="text" size="50" value="<?php echo esc_attr(empty($saved_msgs['otp_answer']) ? '' : $saved_msgs['otp_answer']); ?>" name="msg_otp_answer" id="msg_otp_answer" style="width:auto !important;" />
4039	<br />
4040	</td>
4041	</tr>
4042	</table><br />
4043	<center><input name="save_msgs_lz" class="button button-primary action" value="<?php echo __('Save Messages','loginizer'); ?>" type="submit" /></center>
4044	</form>
4045	</div>
4046	</div>
4047
4048	<!--Bypass a single user-->
4049	<div id="" class="postbox">
4050
4051	<div class="postbox-header">
4052	<h2 class="hndle ui-sortable-handle">
4053	<span><?php echo __('Disable Two Factor Authentication for a User', 'loginizer'); ?></span>
4054	</h2>
4055	</div>
4056
4057	<div class="inside">
4058
4059	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4060	<?php wp_nonce_field('loginizer-options'); ?>
4061	<table class="form-table">
4062	<tr>
4063	<td scope="row" valign="top" colspan="2">
4064	<i><?php echo __('Here you can disable the Two Factor Authentication settings of a user. In the event a user has forgotten his secret answer or lost his Device App, he will not be able to login. You can reset such a users settings from here.', 'loginizer'); ?></i>
4065	</td>
4066	</tr>
4067	<tr>
4068	<td scope="row" valign="top">
4069	<label><?php echo __('Username / Email', 'loginizer'); ?></label><br>
4070	<span class="exp"><?php echo __('The username or email of the user whose 2FA you would like to disable', 'loginizer'); ?></span>
4071	</td>
4072	<td>
4073	<input type="text" size="50" value="<?php echo lz_optpost('lz_user_2fa_disable', ''); ?>" name="lz_user_2fa_disable" />
4074	</td>
4075	</tr>
4076	</table><br />
4077
4078	<center><input name="reset_user_lz" class="button button-primary action" value="<?php echo __('Reset 2FA for User', 'loginizer'); ?>" type="submit" /></center>
4079	</form>
4080
4081	</div>
4082	</div>
4083
4084	<br />
4085
4086	<?php
4087
4088	wp_enqueue_script('jquery-paginate', LOGINIZER_URL.'/jquery-paginate.js', array('jquery'), '1.10.15');
4089
4090	?>
4091
4092	<style>
4093	.page-navigation a {
4094	margin: 5px 2px;
4095	display: inline-block;
4096	padding: 5px 8px;
4097	color: #0073aa;
4098	background: #e5e5e5 none repeat scroll 0 0;
4099	border: 1px solid #ccc;
4100	text-decoration: none;
4101	transition-duration: 0.05s;
4102	transition-property: border, background, color;
4103	transition-timing-function: ease-in-out;
4104	}
4105
4106	.page-navigation a[data-selected] {
4107	background-color: #00a0d2;
4108	color: #fff;
4109	}
4110	</style>
4111
4112	<script>
4113
4114	jQuery(document).ready(function(){
4115	jQuery('#lz_wl_2fa_table').paginate({ limit: 11, navigationWrapper: jQuery('#lz_wl_2fa_nav')});
4116	});
4117
4118	// Delete a 2FA Whitelist IP Range
4119	function del_2fa_confirm(field, todo_id, msg){
4120	var ret = confirm(msg);
4121
4122	if(ret){
4123	jQuery('#lz_wl_2fa_todo').attr('name', field);
4124	jQuery('#lz_wl_2fa_todo').val(todo_id);
4125	jQuery('#lz_wl_2fa_form').submit();
4126	}
4127
4128	return false;
4129
4130	}
4131
4132	// Delete all 2FA Whitelist IP Ranges
4133	function del_2fa_confirm_all(msg){
4134	var ret = confirm(msg);
4135
4136	if(ret){
4137	return true;
4138	}
4139
4140	return false;
4141
4142	}
4143
4144	</script>
4145
4146	<div id="" class="postbox">
4147
4148	<div class="postbox-header">
4149	<h2 class="hndle ui-sortable-handle">
4150	<span><?php echo __('Disable Two Factor Authentication for IP', 'loginizer'); ?></span>
4151	</h2>
4152	</div>
4153
4154	<div class="inside">
4155
4156	<?php echo __('Enter the IP you want to whitelist for two factor authentication', 'loginizer'); ?>
4157	<form action="" method="post" loginizer-premium-only="1">
4158	<?php wp_nonce_field('loginizer-options'); ?>
4159	<table class="form-table">
4160	<tr>
4161	<th scope="row" valign="top"><label for="start_ip_w_2fa"><?php echo __('Start IP','loginizer'); ?></label></th>
4162	<td>
4163	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('start_ip_w_2fa')); ?>" name="start_ip_w_2fa" id="start_ip_w_2fa"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
4164	</td>
4165	</tr>
4166	<tr>
4167	<th scope="row" valign="top"><label for="end_ip_w_2fa"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
4168	<td>
4169	<input type="text" size="25" style="width:auto;" value="<?php echo(lz_optpost('end_ip_w_2fa')); ?>" name="end_ip_w_2fa" id="end_ip_w_2fa"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
4170	</td>
4171	</tr>
4172	</table><br />
4173	<input name="2fa_whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
4174	<input style="float:right" name="del_all_whitelist" onclick="return del_2fa_confirm_all('<?php echo __('Are you sure you want to delete all Whitelist IP Range(s) for 2FA ?','loginizer'); ?>')" class="button action" value="<?php echo __('Delete All Whitelist IP Range(s) for 2FA','loginizer'); ?>" type="submit" />
4175	</form>
4176	</div>
4177
4178	<div id="lz_wl_2fa_nav" style="margin: 5px 10px; text-align:right"></div>
4179	<table id="lz_wl_2fa_table" class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
4180	<tr>
4181	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
4182	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
4183	<th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
4184	<th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
4185	</tr>
4186	<?php
4187	if(empty($loginizer['2fa_whitelist'])){
4188	echo '
4189	<tr>
4190	<td colspan="4">
4191	'.__('No Whitelist IPs for Two Factor Authentication. You will see whitelisted IP ranges here.', 'loginizer').'
4192	</td>
4193	</tr>';
4194	}else{
4195	foreach($loginizer['2fa_whitelist'] as $ik => $iv){
4196	echo '
4197	<tr>
4198	<td>
4199	'.$iv['start'].'
4200	</td>
4201	<td>
4202	'.$iv['end'].'
4203	</td>
4204	<td>
4205	'.date('d/m/Y', $iv['time']).'
4206	</td>
4207	<td>
4208	<a class="submitdelete" href="javascript:void(0)" onclick="return del_2fa_confirm(\'delid\', '.$ik.', \'Are you sure you want to delete this IP range for 2FA ?\')">Delete</a>
4209	</td>
4210	</tr>';
4211	}
4212	}
4213	?>
4214	</table>
4215	<br />
4216	<form action="" method="post" id="lz_wl_2fa_form">
4217	<?php wp_nonce_field('loginizer-options'); ?>
4218	<input type="hidden" value="" name="" id="lz_wl_2fa_todo"/>
4219	</form>
4220	<br />
4221
4222	</div>
4223
4224	<!--Custom Redirects based on role-->
4225	<div id="" class="postbox">
4226
4227	<div class="postbox-header">
4228	<h2 class="hndle ui-sortable-handle">
4229	<span><?php echo __('Custom Redirects based on roles', 'loginizer'); ?><span style="color:red; margin-left:5px;">New</span></span>
4230	</h2>
4231	</div>
4232
4233	<div class="inside">
4234
4235	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4236	<?php wp_nonce_field('loginizer-options'); ?>
4237	<table class="form-table">
4238	<tr>
4239	<td scope="row" valign="top" colspan="2">
4240	<i><?php echo __('Here you can set the URL, which you wish your user to get redirected to after login via 2FA.', 'loginizer'); ?></i>
4241	</td>
4242	</tr>
4243	<?php
4244	global $wp_roles;
4245
4246	foreach($wp_roles->roles as $key => $role){
4247	echo'<tr>
4248	<td scope="row" valign="top">
4249	<label>'. esc_html($role['name']).'</label><br>
4250	</td>
4251	<td>
4252	<input type="text" size="50" value="'.(!empty($loginizer['2fa_custom_login_redirect']) && !empty($loginizer['2fa_custom_login_redirect'][$key]) ? esc_attr($loginizer['2fa_custom_login_redirect'][$key]) : '').'" placeholder="'.site_url().'" name="lz_2fa_custom_login_redirect['.esc_html($key).']" />
4253	</td>
4254	</tr>';
4255	}
4256	?>
4257
4258	</table><br />
4259
4260	<center><input name="save_2fa_custom_redirect" class="button button-primary action" value="<?php echo __('Save Custom URLs', 'loginizer'); ?>" type="submit" /></center>
4261	</form>
4262
4263	</div>
4264	</div>
4265
4266	<?php
4267	loginizer_page_footer();
4268
4269	}
4270
4271	// Loginizer - PasswordLess Page
4272	function loginizer_page_passwordless(){
4273
4274	global $loginizer, $lz_error, $lz_env;
4275
4276	if(!current_user_can('manage_options')){
4277	wp_die('Sorry, but you do not have permissions to change settings.');
4278	}
4279
4280	if(!loginizer_is_premium() && count($_POST) > 0){
4281	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4282	return loginizer_page_passwordless_T();
4283	}
4284
4285	/* Make sure post was from this page */
4286	if(count($_POST) > 0){
4287	check_admin_referer('loginizer-options');
4288	}
4289
4290	if(isset($_POST['save_lz'])){
4291
4292	// In the future there can be more settings
4293	$option['email_pass_less'] = (int) lz_optpost('email_pass_less');
4294	$option['passwordless_sub'] = @stripslashes($_POST['lz_passwordless_sub']);
4295	$option['passwordless_msg'] = @stripslashes($_POST['lz_passwordless_msg']);
4296	$option['passwordless_html'] = (int) lz_optpost('lz_passwordless_html');
4297	$option['passwordless_redirect'] = esc_url_raw($_POST['lz_passwordless_redirect']);
4298	$option['passwordless_redirect_for'] = map_deep($_POST['lz_passwordless_redirect_for'], 'sanitize_text_field');
4299
4300	// Is there an error ?
4301	if(!empty($lz_error)){
4302	return loginizer_page_passwordless_T();
4303	}
4304
4305	// Save the options
4306	update_option('loginizer_epl', $option);
4307
4308	// Mark as saved
4309	$GLOBALS['lz_saved'] = true;
4310
4311	}
4312
4313	// Call theme
4314	loginizer_page_passwordless_T();
4315	}
4316
4317	// Loginizer - PasswordLess Page Theme
4318	function loginizer_page_passwordless_T(){
4319
4320	global $loginizer, $lz_error, $lz_env;
4321
4322	$lz_options = get_option('loginizer_epl');
4323
4324	// Universal header
4325	loginizer_page_header('PasswordLess Settings');
4326
4327	loginizer_feature_available('PasswordLess Login');
4328
4329	// Saved ?
4330	if(!empty($GLOBALS['lz_saved'])){
4331	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4332	}
4333
4334	// Any errors ?
4335	if(!empty($lz_error)){
4336	lz_report_error($lz_error);echo '<br />';
4337	}
4338
4339	?>
4340
4341	<style>
4342	input[type="text"], textarea, select {
4343	width: 90%;
4344	}
4345
4346	.form-table label{
4347	font-weight:bold;
4348	}
4349
4350	.form-table td{
4351	vertical-align:top;
4352	}
4353
4354	.exp{
4355	font-size:12px;
4356	}
4357	</style>
4358
4359	<div id="" class="postbox">
4360
4361	<div class="postbox-header">
4362	<h2 class="hndle ui-sortable-handle">
4363	<span><?php echo __('PasswordLess Settings', 'loginizer'); ?></span>
4364	</h2>
4365	</div>
4366
4367	<div class="inside">
4368
4369	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4370	<?php wp_nonce_field('loginizer-options'); ?>
4371	<table class="form-table">
4372	<tr>
4373	<td scope="row" valign="top" style="width:350px !important"><label for="email_pass_less"><?php echo __('Enable PasswordLess Login', 'loginizer'); ?></label></td>
4374	<td>
4375	<input type="checkbox" value="1" name="email_pass_less" id="email_pass_less" <?php echo lz_POSTchecked('email_pass_less', (empty($loginizer['email_pass_less']) ? false : true)); echo (defined('SITEPAD') ? 'disabled="disabled"' : '') ?> />
4376	</td>
4377	</tr>
4378	<tr>
4379	<td colspan="2" valign="top">
4380	<?php echo __('If enabled, the login screen will just ask for the username <b>OR</b> email address of the user. If such a user exists, an email with a <b>One Time Login </b> link will be sent to the email address of the user. The link will be valid for 10 minutes only.', 'loginizer'); ?><br><br>
4381	<?php echo __('If a wrong username/email is given, the brute force checker will prevent any brute force attempt !', 'loginizer'); ?>
4382	</td>
4383	</tr>
4384	<tr>
4385	<td scope="row" valign="top">
4386	<label for="lz_passwordless_sub"><?php echo __('Email Subject', 'loginizer'); ?></label><br>
4387	<span class="exp"><?php echo __('Set blank to reset to the default subject', 'loginizer'); ?></span>
4388	<br />Default : <?php echo @$loginizer['pl_d_sub']; ?>
4389	</td>
4390	<td valign="top">
4391	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_passwordless_sub']) ? stripslashes($_POST['lz_passwordless_sub']) : (empty($lz_options['passwordless_sub']) ? '' : $lz_options['passwordless_sub'])); ?>" name="lz_passwordless_sub" id="lz_passwordless_sub" />
4392	</td>
4393	</tr>
4394	<tr>
4395	<td scope="row" valign="top">
4396	<label for="lz_passwordless_msg"><?php echo __('Email Body', 'loginizer'); ?></label><br>
4397	<span class="exp"><?php echo __('Set blank to reset to the default message', 'loginizer'); ?></span>
4398	<br />Default : <pre style="font-size:10px"><?php echo @$loginizer['pl_d_msg']; ?></pre>
4399	</td>
4400	<td valign="top">
4401	<textarea rows="10" name="lz_passwordless_msg" id="lz_passwordless_msg"><?php echo lz_htmlizer(!empty($_POST['lz_passwordless_msg']) ? stripslashes($_POST['lz_passwordless_msg']) : (empty($lz_options['passwordless_msg']) ? '' : $lz_options['passwordless_msg'])); ?></textarea>
4402	<br />
4403	Variables :
4404	<br />$email - Users Email
4405	<br />$site_name - The Site Name
4406	<br />$site_url - The Site URL
4407	<br />$login_url - The Login URL
4408	</td>
4409	</tr>
4410	<tr>
4411	<td scope="row" valign="top"><label for="lz_passwordless_html"><?php echo __('Send email as HTML', 'loginizer'); ?></label></td>
4412	<td>
4413	<input type="checkbox" value="1" name="lz_passwordless_html" id="lz_passwordless_html" <?php echo lz_POSTchecked('lz_passwordless_html', (empty($loginizer['passwordless_html']) ? false : true)); ?> />
4414	</td>
4415	</tr>
4416	<tr>
4417	<td scope="row" valign="top" style="width:350px !important">
4418	<label for="lz_passwordless_redirect"><?php echo __('Custom redirect to', 'loginizer'); ?></label><br/>
4419	<span class="exp"><?php echo __('Redirects user to a page of your website other than the admin panel', 'loginizer'); ?></span>
4420	</td>
4421	<td align="top">
4422	<input type="text" size="40" value="<?php echo lz_htmlizer(!empty($_POST['lz_passwordless_redirect']) ? stripslashes($_POST['lz_passwordless_redirect']) : (empty($lz_options['passwordless_redirect']) ? '' : $lz_options['passwordless_redirect'])); ?>" name="lz_passwordless_redirect" id="lz_passwordless_redirect" />
4423	</td>
4424	</tr>
4425
4426	<tr>
4427	<td scope="row" valign="top" style="width:350px !important">
4428	<label for="lz_passwordless_redirect_for"><?php echo __('Custom redirect for', 'loginizer'); ?></label><br/>
4429	<span class="exp"><?php echo __('Select the user roles for whom this custom redirect will be used', 'loginizer'); ?></span>
4430	</td>
4431	<td align="top">
4432	<?php
4433	$editable_roles = get_editable_roles();
4434	echo '<div style="max-height:120px; overflow:auto;">';
4435	$r = '';
4436	foreach($editable_roles as $role => $details) {
4437	$name = translate_user_role( $details['name'] );
4438	// Preselect specified role.
4439	if(!empty($lz_options['passwordless_redirect_for']) && in_array($role, $lz_options['passwordless_redirect_for'])) {
4440	$r .= "\n\t<input type=\"checkbox\" checked name=\"lz_passwordless_redirect_for[]\" value='" . esc_attr($role) . "' style=\"margin-top:5px\">$name</option>";
4441	} else {
4442	$r .= "\n\t<input type=\"checkbox\" value='" . esc_attr($role) . "' name=\"lz_passwordless_redirect_for[]\">$name</option>";
4443	}
4444
4445	$r .= '<br/>';
4446	}
4447	echo $r . '</div>';
4448	?>
4449	</td>
4450	</tr>
4451
4452	</table><br />
4453	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4454	</form>
4455
4456	</div>
4457	</div>
4458	<br />
4459
4460	<?php
4461	loginizer_page_footer();
4462
4463	}
4464
4465	// Loginizer - Security Settings Page
4466	function loginizer_page_security(){
4467
4468	global $loginizer, $lz_error, $lz_env, $wpdb;
4469
4470	if(!current_user_can('manage_options')){
4471	wp_die('Sorry, but you do not have permissions to change settings.');
4472	}
4473
4474	if(!loginizer_is_premium() && count($_POST) > 0){
4475	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
4476	return loginizer_page_security_T();
4477	}
4478
4479	/* Make sure post was from this page */
4480	if(count($_POST) > 0){
4481	check_admin_referer('loginizer-options');
4482	}
4483
4484	if(isset($_POST['save_lz'])){
4485
4486	$option['login_slug'] = lz_optpost('login_slug');
4487	$option['rename_login_secret'] = (int) lz_optpost('rename_login_secret');
4488	$option['xmlrpc_slug'] = lz_optpost('xmlrpc_slug');
4489	$option['xmlrpc_disable'] = (int) lz_optpost('xmlrpc_disable');
4490	$option['pingbacks_disable'] = (int) lz_optpost('pingbacks_disable');
4491
4492	// Login Slug Valid ?
4493	if(!empty($option['login_slug'])){
4494	if(strlen($option['login_slug']) <= 4 \|\| strlen($option['login_slug']) > 50){
4495	$lz_error['login_slug'] = __('The Login slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4496	}
4497	}
4498
4499	// login slug and admin slug cannot be the same
4500	$_loginizer_wp_admin = get_option('loginizer_wp_admin');
4501	if(!empty($_loginizer_wp_admin['admin_slug']) && $_loginizer_wp_admin['admin_slug'] == $option['login_slug']){
4502	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4503	return loginizer_page_security_T();
4504	}
4505
4506	// XML-RPC Slug Valid ?
4507	if(!empty($option['xmlrpc_slug'])){
4508	if(strlen($option['xmlrpc_slug']) <= 4 \|\| strlen($option['xmlrpc_slug']) > 50){
4509	$lz_error['xmlrpc_slug'] = __('The XML-RPC slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4510	}
4511	}
4512
4513	// Is there an error ?
4514	if(!empty($lz_error)){
4515	return loginizer_page_security_T();
4516	}
4517
4518	// Save the options
4519	update_option('loginizer_security', $option);
4520
4521	// Mark as saved
4522	$GLOBALS['lz_saved'] = true;
4523
4524	}
4525
4526	// Reset the username
4527	if(isset($_POST['save_lz_admin'])){
4528
4529	// Get the new username
4530	$current_username = lz_optpost('current_username');
4531	$new_username = lz_optpost('new_username');
4532
4533	if(empty($current_username)){
4534	$lz_error['current_username_empty'] = __('Current username is required', 'loginizer');
4535	return loginizer_page_security_T();
4536	}
4537
4538	if(empty($new_username)){
4539	$lz_error['new_username_empty'] = __('New username is required', 'loginizer');
4540	return loginizer_page_security_T();
4541	}
4542
4543	// Is the starting of the username having 'admin' ?
4544	if(@strtolower(substr($new_username, 0, 5)) == 'admin'){
4545	$lz_error['user_exists'] = __('The username begins with <b>admin</b>. Please change it !', 'loginizer');
4546	return loginizer_page_security_T();
4547	}
4548
4549	// Lets check if there is such a user
4550	$found = get_user_by('login', $new_username);
4551
4552	// Found one !
4553	if(!empty($found->ID)){
4554	$lz_error['user_exists'] = __('The new username is already assigned to another user', 'loginizer');
4555	return loginizer_page_security_T();
4556	}
4557
4558	$old_user = get_user_by('login', $current_username);
4559
4560	if(empty($old_user->ID)){
4561	$lz_error['current_username_invalid'] = __('No user found with the current username provided', 'loginizer');
4562	return loginizer_page_security_T();
4563	}
4564
4565	if(empty($old_user->caps['administrator'])){
4566	$lz_error['user_not_admin'] = __('The user is not an administrator. Only administrator user\'s username can be changed.', 'loginizer');
4567	return loginizer_page_security_T();
4568	}
4569
4570	$is_super_admin = 0;
4571	if(is_multisite() && is_super_admin($old_user->ID)){
4572	$is_super_admin = 1;
4573	}
4574
4575	// Update the username
4576	$update_data = array('user_login' => $new_username);
4577	$where_data = array('ID' => $old_user->ID);
4578
4579	$format = array('%s');
4580	$where_format = array('%d');
4581
4582	$wpdb->update($wpdb->prefix.'users', $update_data, $where_data, $format, $where_format);
4583
4584	// Update the super admins list for multisite
4585	if(!empty($is_super_admin)){
4586
4587	$super_admins = get_site_option('site_admins');
4588
4589	foreach($super_admins as $sk => $sv){
4590	// Remove the existing username from super admins list
4591	if($sv == $current_username){
4592	unset($super_admins[$sk]);
4593	}
4594	}
4595
4596	// Add the new username
4597	$super_admins[] = $new_username;
4598
4599	update_site_option( 'site_admins', $super_admins );
4600
4601	}
4602
4603	// Mark as saved
4604	$GLOBALS['lz_saved'] = true;
4605
4606	}
4607
4608	// Change the wp-admin slug
4609	if(isset($_POST['save_lz_wp_admin'])){
4610
4611	// Get the new username
4612	$option['admin_slug'] = lz_optpost('admin_slug');
4613	$option['restrict_wp_admin'] = (int) lz_optpost('restrict_wp_admin');
4614	$option['wp_admin_msg'] = @stripslashes($_POST['wp_admin_msg']);
4615	$lz_wp_admin_docs = (int) lz_optpost('lz_wp_admin_docs');
4616
4617	// login slug and admin slug cannot be the same
4618	$_loginizer_security = get_option('loginizer_security');
4619	if(!empty($_loginizer_security['login_slug']) && $_loginizer_security['login_slug'] == $option['admin_slug']){
4620	$lz_error['lz_same_slug'] = __('The wp-login.php and wp-admin slugs cannot be the same. Choose unique names for login and admin slugs', 'loginizer');
4621	return loginizer_page_security_T();
4622	}
4623
4624	// Did you agree to this ?
4625	if(!empty($option['admin_slug']) && empty($lz_wp_admin_docs)){
4626	$lz_error['lz_wp_admin_docs'] = __('You have not confirmed that you have read the guide and configured .htaccess. Please read the guide, configure .htaccess and then save these settings and check this checkbox', 'loginizer');
4627	return loginizer_page_security_T();
4628	}
4629
4630	// Length
4631	if(!empty($option['admin_slug']) && (strlen($option['admin_slug']) <= 4 \|\| strlen($option['admin_slug']) > 50)){
4632	$lz_error['admin_slug'] = __('The new Admin slug length must be greater than <b>4</b> chars and upto <b>50</b> chars long', 'loginizer');
4633	return loginizer_page_security_T();
4634	}
4635
4636	// Only regular characters
4637	if(preg_match('/[^\w\d\-_]/is', $option['admin_slug'])){
4638	$lz_error['admin_slug_chars'] = __('Special characters are not allowed', 'loginizer');
4639	return loginizer_page_security_T();
4640	}
4641
4642	// Update the option
4643	update_option('loginizer_wp_admin', $option);
4644
4645	// Mark as saved
4646	$GLOBALS['lz_saved'] = true;
4647
4648	}
4649
4650
4651	// Save blacklisted usernames
4652	if(isset($_POST['save_lz_bl_users'])){
4653
4654	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : array();
4655
4656	// Process the usernames i.e. remove blanks
4657	foreach($usernames as $k => $v){
4658	$v = trim($v);
4659
4660	// Unset blank values
4661	if(empty($v)){
4662	unset($usernames[$k]);
4663	}
4664
4665	// Disallow these special characters to avoid XSS or any other security vulnerability
4666	if(preg_match('/[\<\>\"\']/', $v)){
4667	unset($usernames[$k]);
4668	}
4669	}
4670
4671	// Update the blacklist
4672	update_option('loginizer_username_blacklist', array_values($usernames));
4673
4674	// Mark as saved
4675	$GLOBALS['lz_saved'] = true;
4676
4677	}
4678
4679
4680	// Save blacklisted domains
4681	if(isset($_POST['save_lz_bl_domains'])){
4682
4683	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : array();
4684
4685	// Process the domains i.e. remove blanks
4686	foreach($domains as $k => $v){
4687	$v = trim($v);
4688
4689	// Unset blank values
4690	if(empty($v)){
4691	unset($domains[$k]);
4692	}
4693
4694	// Disallow these special characters to avoid XSS or any other security vulnerability
4695	if(preg_match('/[\<\>\"\']/', $v)){
4696	unset($domains[$k]);
4697	}
4698	}
4699
4700	// Update the blacklist
4701	update_option('loginizer_domains_blacklist', array_values($domains));
4702
4703	// Mark as saved
4704	$GLOBALS['lz_saved'] = true;
4705
4706	}
4707
4708
4709	if(isset($_POST['save_lz_csrf_protection'])){
4710	update_option('loginizer_csrf_protection', empty(lz_optpost('enable_csrf_protection')) ? false : true);
4711
4712	delete_transient('loginizer_csrf_mod_rewrite');
4713	$GLOBALS['lz_saved'] = true;
4714	}
4715
4716	if(isset($_POST['save_lz_limit_session'])){
4717	$limit_session = map_deep($_POST['limit_session'], 'sanitize_text_field');
4718
4719	if(empty($limit_session)){
4720	delete_option('loginizer_limit_session');
4721	} else {
4722	update_option('loginizer_limit_session', $limit_session);
4723	}
4724
4725	$GLOBALS['lz_saved'] = true;
4726	}
4727
4728	// Call theme
4729	loginizer_page_security_T();
4730
4731	}
4732
4733	// Loginizer - Security Settings Page Theme
4734	function loginizer_page_security_T(){
4735
4736	global $loginizer, $lz_error, $lz_env;
4737
4738	// Universal header
4739	loginizer_page_header('Security Settings');
4740
4741	loginizer_feature_available('Security Settings');
4742
4743	// Saved ?
4744	if(!empty($GLOBALS['lz_saved'])){
4745	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
4746	}
4747
4748	// Any errors ?
4749	if(!empty($lz_error)){
4750	lz_report_error($lz_error);echo '<br />';
4751	}
4752
4753	$current_admin = get_user_by('id', 1);
4754
4755	?>
4756
4757	<style>
4758	input[type="text"], textarea, select {
4759	width: 70%;
4760	}
4761
4762	.form-table label{
4763	font-weight:bold;
4764	}
4765
4766	.exp{
4767	font-size:12px;
4768	}
4769	</style>
4770
4771	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4772
4773	<div id="" class="postbox">
4774
4775	<div class="postbox-header">
4776	<h2 class="hndle ui-sortable-handle">
4777	<span><?php echo __('Rename Login Page', 'loginizer'); ?></span>
4778	</h2>
4779	</div>
4780
4781	<div class="inside">
4782
4783	<?php wp_nonce_field('loginizer-options'); ?>
4784	<table class="form-table">
4785	<tr>
4786	<td scope="row" valign="top" colspan="2">
4787	<i><?php echo __('You can rename your Login page from','loginizer'). ' <b> '. $loginizer['login_basename'].' </b> '.__(' to anything of your choice e.g. mylogin. This would make it very difficult for automated attack bots to know where to login !','loginizer'); ?></i>
4788	</td>
4789	</tr>
4790	<tr>
4791	<td scope="row" valign="top" style="width:40% !important">
4792	<label><?php echo __('New Login Slug', 'loginizer'); ?></label><br>
4793	<span class="exp"><?php echo __('Set blank to reset to the original login URL', 'loginizer'); ?></span>
4794	</td>
4795	<td>
4796	<input type="text" size="50" value="<?php echo lz_POSTval('login_slug', $loginizer['login_slug']); ?>" name="login_slug" />
4797	</td>
4798	</tr>
4799
4800	<?php
4801
4802	if(!defined('SITEPAD')){
4803
4804	?>
4805	<tr>
4806	<td scope="row" valign="top" style="width:200px !important">
4807	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
4808	<span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
4809	</td>
4810	<td>
4811	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
4812	</td>
4813	</tr>
4814
4815	<?php
4816
4817	}
4818
4819	?>
4820	</table><br />
4821	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4822
4823	</div>
4824	</div>
4825
4826	<?php
4827
4828	if(!defined('SITEPAD')){
4829
4830	?>
4831
4832	<div id="" class="postbox">
4833
4834	<div class="postbox-header">
4835	<h2 class="hndle ui-sortable-handle">
4836	<span><?php echo __('XML-RPC Settings', 'loginizer'); ?></span>
4837	</h2>
4838	</div>
4839
4840	<div class="inside">
4841
4842	<?php wp_nonce_field('loginizer-options'); ?>
4843	<table class="form-table">
4844	<tr>
4845	<td scope="row" valign="top" colspan="2">
4846	<i><?php echo __('WordPress\'s XML-RPC feature allows external services to access and modify content on the site. Services like the Jetpack plugin, the WordPress mobile app, pingbacks, etc make use of the XML-RPC feature. If this site does not use a service that requires XML-RPC, please <b>disable</b> the XML-RPC feature as it prevents attackers from using the feature to attack the site. If your service can use a custom XML-RPC URL, you can also <b>rename</b> the XML-RPC page to a <b>custom slug</b>.', 'loginizer'); ?></i>
4847	</td>
4848	</tr>
4849	<tr>
4850	<td scope="row" valign="top" style="width:40% !important">
4851	<label><?php echo __('Disable XML-RPC', 'loginizer'); ?></label>
4852	</td>
4853	<td>
4854	<input type="checkbox" value="1" name="xmlrpc_disable" <?php echo lz_POSTchecked('xmlrpc_disable', (empty($loginizer['xmlrpc_disable']) ? false : true)); ?> />
4855	</td>
4856	</tr>
4857	<tr>
4858	<td scope="row" valign="top" style="width:40% !important">
4859	<label><?php echo __('Disable Pingbacks', 'loginizer'); ?></label>
4860	</td>
4861	<td>
4862	<input type="checkbox" value="1" name="pingbacks_disable" <?php echo lz_POSTchecked('pingbacks_disable', (empty($loginizer['pingbacks_disable']) ? false : true)); ?> />
4863	</td>
4864	</tr>
4865	<tr>
4866	<td scope="row" valign="top">
4867	<label><?php echo __('New XML-RPC Slug', 'loginizer'); ?></label><br>
4868	<span class="exp"><?php echo __('Set blank to reset to the original XML-RPC URL', 'loginizer'); ?></span>
4869	</td>
4870	<td>
4871	<input type="text" size="50" value="<?php echo lz_optpost('xmlrpc_slug', $loginizer['xmlrpc_slug']); ?>" name="xmlrpc_slug" />
4872	</td>
4873	</tr>
4874	</table><br />
4875	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
4876
4877	</div>
4878	</div>
4879
4880	<?php
4881
4882	}
4883
4884	?>
4885
4886	</form>
4887
4888	<?php
4889
4890	if(!defined('SITEPAD')){
4891
4892	?>
4893
4894	<script type="text/javascript">
4895
4896	function lz_update_htaccess_admin(e){
4897
4898	var admin_name = jQuery(e).val();
4899
4900	if(admin_name.length == 0){
4901	admin_name = 'wp-admin';
4902	}
4903
4904	var textarea = jQuery('.lz-htaccess-textarea');
4905
4906	if(textarea.length == 0) {
4907	return;
4908	}
4909
4910	var htaccess = textarea.val();
4911	htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
4912	textarea.val(htaccess);
4913
4914	}
4915
4916
4917	function dirname(path) {
4918	return path.replace(/\\/g, '/').replace(/\/[^/]*\/?$/, '');
4919	}
4920
4921	function lz_test_wp_admin(){
4922
4923	var data = new Object();
4924	data["action"] = "loginizer_wp_admin";
4925	data["nonce"] = "<?php echo wp_create_nonce('loginizer_admin_ajax');?>";
4926
4927	var new_ajaxurl = dirname(dirname(ajaxurl))+'/'+jQuery('#lz_admin_slug').val()+'/admin-ajax.php';
4928
4929	// AJAX and on success function
4930	jQuery.post(new_ajaxurl, data, function(response){
4931
4932	if(response['result'] == 1){
4933	alert("<?php echo __('Everything seems to be good. You can proceed to save the settings !', 'loginizer'); ?>");
4934	}
4935
4936	// Throw an error for failures
4937	}).fail(function() {
4938	alert("<?php echo __('There was an error connecting to WordPress with the new Admin Slug. Did you configure everything properly ?', 'loginizer'); ?>");
4939	});
4940	//jQuery.ajax('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
4941	return false;
4942	};
4943
4944	</script>
4945
4946	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
4947	<div id="" class="postbox">
4948
4949	<div class="postbox-header">
4950	<h2 class="hndle ui-sortable-handle">
4951	<span><?php echo __('Rename wp-admin access', 'loginizer'); ?></span>
4952	</h2>
4953	</div>
4954
4955	<div class="inside">
4956
4957	<?php wp_nonce_field('loginizer-options'); ?>
4958	<table class="form-table">
4959	<?php
4960	if(preg_match('/(apache\|litespeed\|lsws)/is', $_SERVER["SERVER_SOFTWARE"])){
4961	// Supported. Do nothing
4962	}else{
4963	echo '<tr>
4964	<td scope="row" valign="top" colspan="2">
4965	<div style="color:#a94442; background-color:#f2dede; border-color:#ebccd1; padding:15px; border:1px solid transparent; border-radius:4px;">'.__('Rename wp-admin access feature is supported only on Apache and Litespeed', 'loginizer').'</div>
4966	</td>
4967	</tr>';
4968	}
4969
4970	if(file_exists(LOGINIZER_DIR.'/premium.php') && !empty($loginizer['enable_csrf_protection']) && empty($loginizer['admin_slug'])){
4971
4972	echo '<div style="color: #856404; background-color: #fff3cd; border-color: #ffeeba; padding: 15px; font-size:1rem; font-weight:400;">'.esc_html__('Note: Be careful while changing the Admin name as your CSRF Protection is on', 'loginizer').'</div>';
4973
4974	}
4975	?>
4976	<tr>
4977	<td scope="row" valign="top" colspan="2">
4978	<i><?php echo __('You can rename your WordPress Admin access URL <b>wp-admin</b> to anything of your choice e.g. my-admin. This will require you to change .htaccess, so please follow','loginizer'); ?> <a href="<?php echo LOGINIZER_DOCS;?>Renaming_the_WP-Admin_Area" target="_blank"><?php echo __('our guide','loginizer').'</a> '.__('on how to do so !','loginizer'); ?></i>
4979	</td>
4980	</tr>
4981	<tr>
4982	<td scope="row" valign="top" style="width:40% !important">
4983	<label><?php echo __('New wp-admin Slug', 'loginizer'); ?></label><br>
4984	<span class="exp"><?php echo __('Set blank to reset to the original wp-admin URL', 'loginizer'); ?></span>
4985	</td>
4986	<td>
4987	<input type="text" size="50" value="<?php echo lz_optpost('admin_slug', $loginizer['admin_slug']); ?>" name="admin_slug" id="lz_admin_slug" onchange="lz_update_htaccess_admin(this)"/>
4988	</td>
4989	</tr>
4990	<tr>
4991	<td scope="row" valign="top" style="width:200px !important">
4992	<label><?php echo __('Disable wp-admin access', 'loginizer'); ?></label><br>
4993	<span class="exp"><?php echo __('If set, then only the new admin slug will work and access to the Old Admin Slug i.e. wp-admin will be disabled. If anyone accesses wp-admin, a warning will be shown.<br><label>NOTE: Please use this option cautiously !</label>', 'loginizer'); ?></span>
4994	</td>
4995	<td>
4996	<input type="checkbox" id="lz_restrict_wp_admin" onchange="lz_wp_admin_msg_toggle()" value="1" name="restrict_wp_admin" <?php echo lz_POSTchecked('restrict_wp_admin', (empty($loginizer['restrict_wp_admin']) ? false : true)); ?> />
4997	</td>
4998	</tr>
4999	<tr id="lz_wp_admin_msg_row" style="display:none">
5000	<td scope="row" valign="top">
5001	<label><?php echo __('WP-Admin Error Message', 'loginizer'); ?></label><br>
5002	<span class="exp"><?php echo __('Error message to show if someone accesses wp-admin', 'loginizer'); ?></span> Default : <?php echo $loginizer['wp_admin_d_msg']; ?>
5003	</td>
5004	<td>
5005	<input type="text" size="50" value="<?php echo lz_htmlizer(!empty($_POST['wp_admin_msg']) ? stripslashes($_POST['wp_admin_msg']) : @$loginizer['wp_admin_msg']); ?>" name="wp_admin_msg" id="lz_wp_admin_msg" />
5006	</td>
5007	</tr>
5008
5009	<?php
5010	loginizer_htaccess_rules();
5011	?>
5012	<tr>
5013	<td scope="row" valign="top" style="width:200px !important">
5014	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
5015	<span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
5016	</td>
5017	<td>
5018	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
5019	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
5020	</td>
5021	</tr>
5022	</table><br />
5023	<center><input name="save_lz_wp_admin" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
5024
5025	</div>
5026	</div>
5027	</form>
5028
5029	<script type="text/javascript">
5030	function lz_csrf_htaccess_update(e){
5031	event.preventDefault();
5032
5033	var tb = jQuery(e).closest('table'),
5034	csrf_enabled = tb.find('[name="enable_csrf_protection"]'),
5035	admin_name = tb.find('#lz_admin_slug');
5036
5037	var data = new Object();
5038
5039	// Setting admin name if anything is set
5040	if(admin_name && admin_name.val()){
5041	data['admin_name'] = admin_name.val();
5042	}
5043
5044	if(csrf_enabled){
5045	data['csrf'] = true;
5046	} else {
5047	data['csrf'] = false;
5048	}
5049
5050	data['action'] = 'loginizer_update_csrf_mod';
5051	data['nonce'] = '<?php echo wp_create_nonce('loginizer_admin_ajax');?>';
5052
5053	var new_ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>'
5054
5055	// AJAX and on success function
5056	jQuery.post(new_ajaxurl, data, function(response){
5057
5058	if(response['success'] == true){
5059	alert("<?php esc_html_e('.htaccess has been updated !', 'loginizer'); ?>");
5060	}
5061
5062	// Throw an error for failures
5063	}).fail(function() {
5064	alert("<?php esc_html_e('Was unable to update the .htaccess file so please update it manually', 'loginizer'); ?>");
5065	});
5066
5067	return false;
5068
5069	}
5070
5071	function lz_show_rewrite_rule(e){
5072	event.preventDefault();
5073	jQuery(e).closest('td').find('textarea').toggle();
5074	}
5075
5076
5077	</script>
5078
5079	<!-- Begin CSRF Protection -->
5080	<form action="" method="post" loginizer-premium-only="1">
5081	<div id="" class="postbox">
5082
5083	<div class="postbox-header">
5084	<h2 class="hndle ui-sortable-handle">
5085	<span><?php esc_html_e('CSRF Protection', 'loginizer'); ?></span>
5086	</h2>
5087	</div>
5088
5089	<div class="inside">
5090
5091	<?php wp_nonce_field('loginizer-options'); ?>
5092	<table class="form-table">
5093	<tr>
5094	<td scope="row" valign="top" colspan="2">
5095	<i><?php esc_html_e('This helps in preventing CSRF attacks as it updates the admin URLS with a session string which make it difficult and nearly impossible for the attacker to predict the URL', 'loginizer'); ?></i>
5096	</td>
5097	</tr>
5098	<tr>
5099	<td scope="row" valign="top" style="width:400px !important">
5100	<label><?php esc_html_e('Enable CSRF Protection', 'loginizer'); ?></label><br>
5101	<span class="exp"><?php esc_html_e('If enabled, it will update the URL of wp-admin with a random session string in the URL making it hard to predict the URL.', 'loginizer'); ?></span>
5102	</td>
5103	<td valign="top">
5104	<input type="checkbox" value="1" name="enable_csrf_protection" <?php echo lz_POSTchecked('enable_csrf_protection', (empty($loginizer['enable_csrf_protection']) ? false : true)); ?> />
5105	</td>
5106	</tr>
5107	<?php
5108	loginizer_htaccess_rules(true);
5109	?>
5110	</table><br />
5111	<div style="text-align: center;"><input name="save_lz_csrf_protection" class="button button-primary action" value="<?php esc_html_e('Save Settings', 'loginizer'); ?>" type="submit" />
5112	</div>
5113	</div>
5114	</div>
5115	</form>
5116	<!-- End CSRF Protection -->
5117
5118
5119	<script type="text/javascript">
5120
5121	function lz_wp_admin_msg_toggle(){
5122	var ele = jQuery('#lz_restrict_wp_admin')[0];
5123	if(ele.checked){
5124	jQuery('#lz_wp_admin_msg_row').show();
5125	}else{
5126	jQuery('#lz_wp_admin_msg_row').hide();
5127	}
5128	};
5129
5130	lz_wp_admin_msg_toggle();
5131
5132	</script>
5133
5134
5135	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5136	<div id="" class="postbox">
5137
5138	<div class="postbox-header">
5139	<h2 class="hndle ui-sortable-handle">
5140	<span><?php echo __('Change Admin Username', 'loginizer'); ?></span>
5141	</h2>
5142	</div>
5143
5144	<div class="inside">
5145
5146	<?php wp_nonce_field('loginizer-options'); ?>
5147	<table class="form-table">
5148	<tr>
5149	<td scope="row" valign="top" colspan="2">
5150	<i><?php echo __('You can change the Admin Username from here to anything of your choice e.g. iamtheboss. This would make it very difficult for automated attack bots to know what is the admin username !', 'loginizer'); ?></i>
5151	</td>
5152	</tr>
5153	<tr>
5154	<td scope="row" valign="top" style="width:40% !important">
5155	<label for="current_username"><?php echo __('Current Username', 'loginizer'); ?></label><br>
5156	<span class="exp"><?php echo __('The current username you want to change', 'loginizer'); ?></span>
5157	</td>
5158	<td>
5159	<input type="text" size="50" value="<?php echo lz_optpost('current_username', (!empty($current_admin->user_login) ? $current_admin->user_login : '')); ?>" name="current_username" id="current_username" />
5160	</td>
5161	</tr>
5162	<tr>
5163	<td scope="row" valign="top" style="width:40% !important">
5164	<label for="new_username"><?php echo __('New Username', 'loginizer'); ?></label><br>
5165	<span class="exp"><?php echo __('The new username you want to set', 'loginizer'); ?></span>
5166	</td>
5167	<td>
5168	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
5169	</td>
5170	</tr>
5171	</table><br />
5172	<i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
5173	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
5174
5175	</div>
5176	</div>
5177	</form>
5178
5179	<script type="text/javascript">
5180	function add_lz_bl_users(){
5181	jQuery("#lz_bl_users").append('<input type="text" size="30" value="" name="lz_bl_users[]" class="lz_bl_users" />');
5182	return false;
5183	};
5184	</script>
5185
5186	<style>
5187	.lz_bl_users, .lz_bl_domains{
5188	margin-bottom:20px;
5189	}
5190	</style>
5191
5192	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5193	<div id="" class="postbox">
5194
5195	<div class="postbox-header">
5196	<h2 class="hndle ui-sortable-handle">
5197	<span><?php echo __('Username Auto Blacklist', 'loginizer'); ?></span>
5198	</h2>
5199	</div>
5200
5201	<div class="inside">
5202
5203	<?php wp_nonce_field('loginizer-options'); ?>
5204	<table class="form-table">
5205	<tr>
5206	<td scope="row" valign="top" colspan="2">
5207	<i><?php echo __('Attackers generally use common usernames like <b>admin, administrator, or variations of your domain name / business name</b>. You can specify such username here and Loginizer will auto-blacklist the IP Address(s) of clients who try to use such username(s).', 'loginizer'); ?></i>
5208	</td>
5209	</tr>
5210	<tr>
5211	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
5212	<label><?php echo __('Username(s)', 'loginizer'); ?></label><br>
5213	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
5214	</td>
5215	<td>
5216	<div id="lz_bl_users">
5217	<?php
5218
5219	$usernames = isset($_POST['lz_bl_users']) && is_array($_POST['lz_bl_users']) ? $_POST['lz_bl_users'] : $loginizer['username_blacklist'];
5220
5221	if(empty($usernames)){
5222	$usernames[] = '';
5223	}
5224
5225	foreach($usernames as $_user){
5226
5227	// Disallow these special characters to avoid XSS or any other security vulnerability
5228	if(preg_match('/[\<\>\"\']/', $_user)){
5229	continue;
5230	}
5231
5232	echo '<input type="text" size="30" value="'.$_user.'" name="lz_bl_users[]" class="lz_bl_users" />';
5233	}
5234
5235	?>
5236	</div>
5237	<br />
5238	<input class="button" type="button" value="<?php echo __('Add New Username', 'loginizer'); ?>" onclick="return add_lz_bl_users();" style="float:right" />
5239	</td>
5240	</tr>
5241	</table><br />
5242	<center><input name="save_lz_bl_users" class="button button-primary action" value="<?php echo __('Save Username(s)', 'loginizer'); ?>" type="submit" /></center>
5243
5244	</div>
5245	</div>
5246	</form>
5247
5248	<script type="text/javascript">
5249	function add_lz_bl_domains(){
5250	jQuery("#lz_bl_domains").append('<input type="text" size="30" value="" name="lz_bl_domains[]" class="lz_bl_domains" />');
5251	return false;
5252	};
5253	</script>
5254
5255
5256	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5257	<div id="" class="postbox">
5258
5259	<div class="postbox-header">
5260	<h2 class="hndle ui-sortable-handle">
5261	<span><?php echo __('New Registration Domain Blacklist', 'loginizer'); ?></span>
5262	</h2>
5263	</div>
5264
5265	<div class="inside">
5266
5267	<?php wp_nonce_field('loginizer-options'); ?>
5268	<table class="form-table">
5269	<tr>
5270	<td scope="row" valign="top" colspan="2">
5271	<i>If you would like to ban new registrations from a particular domain, you can use this utility to do so.</i>
5272	</td>
5273	</tr>
5274	<tr>
5275	<td scope="row" valign="top" style="width:40% !important; vertical-align:top !important;">
5276	<label><?php echo __('Domain(s)', 'loginizer'); ?></label><br>
5277	<span class="exp"><?php echo __('You can use - <b>*</b> (Star)- as a wild card as well. Blank fields will be ignored', 'loginizer'); ?></span>
5278	</td>
5279	<td>
5280	<div id="lz_bl_domains">
5281	<?php
5282
5283	$domains = isset($_POST['lz_bl_domains']) && is_array($_POST['lz_bl_domains']) ? $_POST['lz_bl_domains'] : $loginizer['domains_blacklist'];
5284
5285	if(empty($domains)){
5286	$domains[] = '';
5287	}
5288
5289	foreach($domains as $_domain){
5290
5291	// Disallow these special characters to avoid XSS or any other security vulnerability
5292	if(preg_match('/[\<\>\"\']/', $_domain)){
5293	continue;
5294	}
5295
5296	echo '<input type="text" size="30" value="'.$_domain.'" name="lz_bl_domains[]" class="lz_bl_domains" />';
5297	}
5298
5299	?>
5300	</div>
5301	<br />
5302	<input class="button" type="button" value="<?php echo __('Add New Domain', 'loginizer'); ?>" onclick="return add_lz_bl_domains();" style="float:right" />
5303	</td>
5304	</tr>
5305	</table><br />
5306	<center><input name="save_lz_bl_domains" class="button button-primary action" value="<?php echo __('Save Domains(s)', 'loginizer'); ?>" type="submit" /></center>
5307
5308	</div>
5309	</div>
5310	</form>
5311
5312	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5313	<div id="" class="postbox">
5314
5315	<div class="postbox-header">
5316	<h2 class="hndle ui-sortable-handle">
5317	<span><?php echo __('Limit Concurrent Sessions', 'loginizer');
5318	if(time() < strtotime('30 July 2023')){
5319	echo ' <span style="color:red;">New</span></span>';
5320	} ?>
5321	</h2>
5322	</div>
5323
5324	<div class="inside">
5325
5326	<?php wp_nonce_field('loginizer-options'); ?>
5327	<table class="form-table">
5328	<tr>
5329	<td scope="row" valign="top" colspan="2">
5330	<i><?php echo __('This feature will help limit the number of devices your user can login to concurrently', 'loginizer'); ?></i>
5331	</td>
5332	</tr>
5333	<tr>
5334	<td scope="row" valign="top" style="width:300px !important">
5335	<label><?php echo __('Enable', 'loginizer'); ?></label><br>
5336	<span class="exp"><?php echo __('Enabling it will start limiting number of devices the user can login on concurrently', 'loginizer'); ?></span>
5337	</td>
5338	<td>
5339	<input type="checkbox" value="1" name="limit_session[enable]" <?php echo (!empty($_POST['limit_session']['enable']) \|\| (!empty($loginizer['limit_session']['enable']))) ? 'checked' : false; ?> />
5340	</td>
5341	</tr>
5342	<tr>
5343	<td scope="row" valign="top" style="width:300px !important">
5344	<label><?php echo __('Limit Type', 'loginizer'); ?></label><br>
5345	</td>
5346	<td>
5347	<input type="radio" value="block" name="limit_session[type]" <?php echo ((!empty($_POST['limit_session']['type']) && $_POST['limit_session']['type'] == 'block') \|\| (!empty($loginizer['limit_session']['type']) && $loginizer['limit_session']['type'] == 'block' ) ? 'checked' : false); ?> />
5348	<span class="exp"><?php echo '<strong>'.__('Block', 'loginizer') . ' : </strong>' . __('Blocks all the login attempts if limit is reached', 'loginizer'); ?></span><br/>
5349	<input type="radio" value="destroy" name="limit_session[type]" <?php echo ((!empty($_POST['limit_session']['type']) && $_POST['limit_session']['type'] == 'destroy') \|\| (!empty($loginizer['limit_session']['type']) && $loginizer['limit_session']['type'] == 'destroy' ) ? 'checked' : false); ?> />
5350	<span class="exp"><?php echo '<strong>'.__('Destroy', 'loginizer') . ' : </strong>' . __('Revokes all the sessions on successful login', 'loginizer'); ?></span>
5351	</td>
5352	</tr>
5353	<tr>
5354	<td scope="row" valign="top" style="width:40% !important">
5355	<label><?php echo __('Max Session Count', 'loginizer'); ?></label><br>
5356	<span class="exp"><?php echo __('Set Maximum number of sessions can be created', 'loginizer'); ?></span>
5357	</td>
5358	<td>
5359	<input type="number" min="1" max="10" size="20" value="<?php echo (!empty($_POST['limit_session']['count']) ? sanitize_text_field($_POST['limit_session']['count']) : (!empty($loginizer['limit_session']['count']) ? sanitize_text_field($loginizer['limit_session']['count']) : 1)); ?>" name="limit_session[count]" />
5360	</td>
5361	</tr>
5362	<tr>
5363	<tr>
5364	<td scope="row" valign="top">
5365	<label><?php echo __('Exclude Roles', 'loginizer'); ?></label><br>
5366	<span class="exp"><?php echo __('Excluded roles won\'t face session limit checks', 'loginizer'); ?></span>
5367	</td>
5368	<td>
5369	<div style="max-height:120px;; overflow-y:auto;">
5370	<?php
5371	global $wp_roles;
5372
5373	foreach($wp_roles->roles as $key => $role){
5374	$checked = '';
5375
5376	if(!empty($_POST['limit_session']['roles']) && in_array($key, $_POST['limit_session']['roles'])
5377	\|\| !empty($loginizer['limit_session']['roles']) && in_array($key, $loginizer['limit_session']['roles'])){
5378	$checked = 'checked';
5379	}
5380
5381
5382	echo '<input type="checkbox" value="'.esc_attr($key).'" name="limit_session[roles][]" '.esc_attr($checked).'/>'. esc_html($role['name']) . '<br/>';
5383	}
5384	?>
5385	</div>
5386	</td>
5387	</tr>
5388	</table><br/>
5389	<center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
5390
5391	</div>
5392	</div>
5393	</form>
5394
5395	<?php
5396
5397	}
5398
5399	loginizer_page_footer();
5400
5401	}
5402
5403	// .htaccess UI options for wp-admin and CSRF
5404	function loginizer_htaccess_rules($is_csrf = false){
5405	global $loginizer;
5406
5407	$admin_slug = 'wp-admin';
5408
5409	if(!empty($loginizer['admin_slug'])){
5410	$admin_slug = $loginizer['admin_slug'];
5411	}
5412
5413	// getting sub directory if any
5414	$home_root = parse_url(home_url());
5415
5416	if(isset($home_root['path'])){
5417	$home_root = trailingslashit($home_root['path']);
5418	} else {
5419	$home_root = '/';
5420	}
5421
5422	// Selecting admin slug
5423	$admin_slug = 'wp-admin';
5424
5425	if(!empty($loginizer['admin_slug'])){
5426	$admin_slug = $loginizer['admin_slug'];
5427	}
5428
5429	// Setting the rule
5430	$rule = '# BEGIN Loginizer' . "\n";
5431	$rule .= '<IfModule mod_rewrite.c>' . "\n";
5432	$rule .= 'RewriteEngine On' . "\n";
5433	$rule .= 'RewriteBase ' . $home_root . "\n\n";
5434	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
5435	$rule .= '</IfModule>' . "\n";
5436	$rule .= '# END Loginizer' . "\n";
5437
5438	if(is_writable(ABSPATH . '/.htaccess')){
5439	echo '<tr>
5440	<td scope="row" valign="top" style="width:400px !important">
5441	<label>'. esc_html__('Update .htaccess', 'loginizer').'</label><br>
5442	<span class="exp">'. (!empty($is_csrf) ? esc_html__('Rewrites rule for CSRF session URL', 'loginizer') : esc_html__('Rewrites rule to change wp-admin and if you have a Multisite then check', 'loginizer') . ' <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a>') . '</span>
5443	</td>
5444	<td valign="top">
5445	<button class="button" style="background: #5cb85c; color:white; border:#5cb85c;" onclick="lz_csrf_htaccess_update(this)">Update .htaccess</button><a onClick="lz_show_rewrite_rule(this)" href="#" style="margin-left:5px; line-height: 2; font-weight:500;">Show Rewrite Rule</a><br/><br/>
5446
5447	<textarea rows="8" readonly style="display:none;" class="lz-htaccess-textarea">' . trim($rule) . '</textarea>
5448	</td>
5449	</tr>';
5450
5451	} else {
5452	echo '<tr>
5453	<td scope="row" valign="top" style="width:400px !important">
5454	<label>'. esc_html__('Manually Update .htaccess', 'loginizer') . '</label><br>
5455	<span class="exp">' . esc_html__('You can manually update your .htaccess by adding the given code at the top of your .htaccess file', 'loginizer'). '</span>
5456	</td>
5457	<td valign="top">
5458	<textarea rows="8" readonly class="lz-htaccess-textarea">' . trim($rule) . '</textarea>
5459	</td>
5460	</tr>';
5461	}
5462
5463	}
5464
5465	// Loginizer - Checksum load data
5466	function loginizer_page_checksums_L(&$files, &$_ignores){
5467
5468	global $loginizer, $lz_error, $lz_env;
5469
5470	// Load any mismatched files and ignores
5471	$files = get_option('loginizer_checksums_diff');
5472	$_ignores = get_option('loginizer_checksums_ignore');
5473	$_ignores = is_array($_ignores) ? $_ignores : array(); // SHOULD ALWAYS BE PURE
5474	$ignores = array();
5475
5476	foreach($_ignores as $ik => $iv){
5477	$ignores[$iv] = array();
5478	if(!empty($files[$iv])){
5479	$ignores[$iv] = $files[$iv];
5480	}
5481	}
5482
5483	$lz_env['files'] = $files;
5484	$lz_env['ignores'] = $ignores;
5485
5486	}
5487
5488	// Loginizer - PasswordLess Page
5489	function loginizer_page_checksums(){
5490
5491	global $loginizer, $lz_error, $lz_env;
5492
5493	if(!current_user_can('manage_options')){
5494	wp_die('Sorry, but you do not have permissions to change settings.');
5495	}
5496
5497	if(!loginizer_is_premium() && count($_POST) > 0){
5498	$lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
5499	return loginizer_page_checksums_T();
5500	}
5501
5502	/* Make sure post was from this page */
5503	if(count($_POST) > 0){
5504	check_admin_referer('loginizer-options');
5505	}
5506
5507	// Are we to run it ?
5508	if(isset($_REQUEST['lz_run_checksum'])){
5509	loginizer_checksums();
5510	}
5511
5512	loginizer_page_checksums_L($files, $_ignores);
5513
5514	$lz_env['csum_freq'][1] = __('Once a Day', 'loginizer');
5515	$lz_env['csum_freq'][7] = __('Once a Week', 'loginizer');
5516	$lz_env['csum_freq'][30] = __('Once a Month', 'loginizer');
5517
5518	if(isset($_POST['save_lz'])){
5519
5520	// In the future there can be more settings
5521	$option['disable_checksum'] = (int) lz_optpost('disable_checksum');
5522	$option['no_checksum_email'] = (int) lz_optpost('no_checksum_email');
5523	$option['checksum_frequency'] = (int) lz_optpost('checksum_frequency');
5524	$option['checksum_time'] = lz_optpost('checksum_time');
5525
5526	// Is there an error ?
5527	if(!empty($lz_error)){
5528	return loginizer_page_checksums_T();
5529	}
5530
5531	// Save the options
5532	update_option('loginizer_checksums', $option);
5533
5534	// Mark as saved
5535	$GLOBALS['lz_saved'] = true;
5536
5537	}
5538
5539	// Add or remove from ignore list
5540	if(isset($_POST['save_lz_csum_ig'])){
5541
5542	if(@is_array($_POST['checksum_del_ignore'])){
5543
5544	foreach($_POST['checksum_del_ignore'] as $k => $v){
5545	$key = array_search($v, $_ignores);
5546	if($key !== false){
5547	unset($_ignores[$key]);
5548	}
5549	}
5550
5551	// Save it
5552	update_option('loginizer_checksums_ignore', $_ignores);
5553
5554	}
5555
5556	if(@is_array($_POST['checksum_add_ignore'])){
5557
5558	foreach($_POST['checksum_add_ignore'] as $k => $v){
5559	if(!empty($files[$v])){
5560	$_ignores[] = $v;
5561	}
5562	}
5563
5564	// Save it
5565	update_option('loginizer_checksums_ignore', $_ignores);
5566
5567	}
5568
5569	// Reload
5570	loginizer_page_checksums_L($files, $_ignores);
5571
5572	// Mark as saved
5573	$GLOBALS['lz_saved'] = true;
5574
5575	}
5576
5577	// Call theme
5578	loginizer_page_checksums_T();
5579	}
5580
5581	// Loginizer - PasswordLess Page Theme
5582	function loginizer_page_checksums_T(){
5583
5584	global $loginizer, $lz_error, $lz_env;
5585
5586	// Universal header
5587	loginizer_page_header('File Checksum Settings');
5588
5589	loginizer_feature_available('File Checksum');
5590
5591	wp_enqueue_script('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.js', array('jquery'), '0.0.7');
5592	wp_enqueue_style('jquery-clockpicker', LOGINIZER_URL.'/jquery-clockpicker.min.css', array(), '0.0.7');
5593
5594	// Saved ?
5595	if(!empty($GLOBALS['lz_saved'])){
5596	echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
5597	}
5598
5599	// Did we just run the checksums
5600	if(isset($_REQUEST['lz_run_checksum'])){
5601	echo '<div id="message" class="updated"><p>'. __('The Checksum process was executed successfully', 'loginizer'). '</p></div><br />';
5602	}
5603
5604	// Any errors ?
5605	if(!empty($lz_error)){
5606	lz_report_error($lz_error);echo '<br />';
5607	}
5608
5609	?>
5610
5611	<style>
5612	input[type="text"], textarea, select {
5613	width: 70%;
5614	}
5615
5616	.form-table label{
5617	font-weight:bold;
5618	}
5619
5620	.exp{
5621	font-size:12px;
5622	}
5623	</style>
5624
5625	<script>
5626	function lz_apply_status(ele, the_class){
5627
5628	var status = ele.checked;
5629	jQuery(the_class).each(function(){
5630	this.checked = status;
5631	});
5632
5633	}
5634	</script>
5635
5636	<div id="" class="postbox">
5637	<div class="postbox-header">
5638	<h2 class="hndle ui-sortable-handle">
5639	<span><?php echo __('Checksum Settings', 'loginizer'); ?></span>
5640	</h2>
5641	</div>
5642	<div class="inside">
5643
5644	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5645	<?php wp_nonce_field('loginizer-options'); ?>
5646	<table class="form-table">
5647	<tr>
5648	<td scope="row" valign="top" style="width:400px !important">
5649	<label><?php echo __('Disable Checksum of WP Core', 'loginizer'); ?></label><br>
5650	<span class="exp"><?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?></span>
5651	</td>
5652	<td valign="top">
5653	<input type="checkbox" value="1" name="disable_checksum" <?php echo lz_POSTchecked('disable_checksum', (empty($loginizer['disable_checksum']) ? false : true)); ?> />
5654	</td>
5655	</tr>
5656	<tr>
5657	<td scope="row" valign="top" style="width:400px !important">
5658	<label><?php echo __('Disable Email of Checksum Results', 'loginizer'); ?></label><br>
5659	<span class="exp"><?php echo __('If checked, Loginizer will not email you the checksum results.', 'loginizer'); ?></span>
5660	</td>
5661	<td valign="top">
5662	<input type="checkbox" value="1" name="no_checksum_email" <?php echo lz_POSTchecked('no_checksum_email', (empty($loginizer['no_checksum_email']) ? false : true)); ?> />
5663	</td>
5664	</tr>
5665	<tr>
5666	<td scope="row" valign="top" style="width:400px !important">
5667	<label><?php echo __('Checksum Frequency', 'loginizer'); ?></label><br>
5668	<span class="exp"><?php echo __('If Checksum is enabled, at what frequency should the checksums be performed.', 'loginizer'); ?></span>
5669	</td>
5670	<td valign="top">
5671	<select name="checksum_frequency">
5672	<?php
5673	foreach($lz_env['csum_freq'] as $k => $v){
5674	echo '<option '.lz_POSTselect('checksum_frequency', $k, ($loginizer['checksum_frequency'] == $k ? true : false)).' value="'.$k.'">'.$v.'</value>';
5675	}
5676	?>
5677	</select>
5678	</td>
5679	</tr>
5680	<tr id="lz_checksum_time">
5681	<td scope="row" valign="top" style="width:400px !important">
5682	<label><?php echo __('Time of Day', 'loginizer'); ?></label><br>
5683	<span class="exp"><?php echo __('If Checksum is enabled, what time of day should Loginizer do the check. Note : The check will be done on or after this time has elapsed as per the accesses being made.', 'loginizer'); ?></span>
5684	</td>
5685	<td valign="top">
5686	<div class="input-group clockpicker" data-autoclose="true">
5687	<input type="text" name="checksum_time" class="form-control" value="<?php echo (empty($loginizer['checksum_time']) ? '00:00' : $loginizer['checksum_time']);?>">
5688	<span class="input-group-addon">
5689	<span class="glyphicon glyphicon-time"></span>
5690	</span>
5691	</div>
5692	<script type="text/javascript">
5693	jQuery(document).ready(function(){
5694	(function($) {
5695	$('.clockpicker').clockpicker({donetext: 'Done'});
5696	})(jQuery);
5697	});
5698	</script>
5699	</td>
5700	</tr>
5701	<tr>
5702	<td colspan="2">
5703	<?php echo __('If disabled, Loginizer will not check your sites core files against the WordPress checksum list.', 'loginizer'); ?>
5704	</td>
5705	</tr>
5706	</table><br />
5707	<center><input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /><input name="lz_run_checksum" style="float:right; background: #5cb85c; color:white; border:#5cb85c" class="button button-secondary" value="<?php echo __('Do a Checksum Now', 'loginizer'); ?>" type="submit" /></center>
5708	</form>
5709
5710	</div>
5711	</div>
5712
5713	<div id="" class="postbox">
5714
5715	<div class="postbox-header">
5716	<h2 class="hndle ui-sortable-handle">
5717	<span><?php echo __('Mismatching Files', 'loginizer'); ?></span>
5718	</h2>
5719	</div>
5720
5721	<div class="inside">
5722
5723	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5724	<?php wp_nonce_field('loginizer-options'); ?>
5725	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5726	<?php
5727
5728	$files = $lz_env['files'];
5729
5730	// Avoid undefined notice for $files
5731	if(!empty($files)){
5732	foreach($files as $k => $v){
5733	if(!empty($lz_env['ignores'][$k])){
5734	unset($files[$k]);
5735	}
5736	}
5737	}
5738
5739	echo '
5740	<tr>
5741	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5742	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5743	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5744	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_add_ig\');" /></th>
5745	</tr>';
5746
5747	if(is_array($files) && count($files) > 0){
5748
5749	foreach($files as $k => $v){
5750
5751	echo '
5752	<tr>
5753	<td>'.$k.'</td>
5754	<td>'.$v['cur_md5'].'</td>
5755	<td>'.$v['md5'].'</td>
5756	<td><input type="checkbox" name="checksum_add_ignore[]" class="csum_add_ig" value="'.$k.'" /></td>
5757	</tr>';
5758
5759	}
5760
5761	}else{
5762
5763	echo '
5764	<tr>
5765	<td colspan="4" align="center">'.__('This is great ! No file with any wrong checksum has been found.','loginizer').'</td>
5766	</tr>';
5767
5768	}
5769
5770	?>
5771	</table><br />
5772	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Add Selected to Ignore List', 'loginizer'); ?>" type="submit" /></center>
5773	</form>
5774	</div>
5775
5776	</div>
5777	<br />
5778
5779	<div id="" class="postbox">
5780
5781	<div class="postbox-header">
5782	<h2 class="hndle ui-sortable-handle">
5783	<span><?php echo __('Ignore List', 'loginizer'); ?></span>
5784	</h2>
5785	</div>
5786
5787	<div class="inside">
5788
5789	<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
5790	<?php wp_nonce_field('loginizer-options'); ?>
5791	<table class="wp-list-table fixed striped users" border="0" width="100%" cellpadding="10" align="center">
5792	<?php
5793
5794	$ignores = $lz_env['ignores'];
5795
5796	echo '
5797	<tr>
5798	<th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
5799	<th style="width:240px; background:#EFEFEF;">'.__('Found', 'loginizer').'</th>
5800	<th style="width:240px; background:#EFEFEF;">'.__('Should be', 'loginizer').'</th>
5801	<th style="width:10px; background:#EFEFEF;"><input type="checkbox" onchange="lz_apply_status(this, \'.csum_del_ig\');" /></th>
5802	</tr>';
5803
5804	// Load any mismatched files
5805	$files = $ignores;
5806
5807	if(is_array($files) && count($files) > 0){
5808
5809	foreach($files as $k => $v){
5810
5811	echo '
5812	<tr>
5813	<td>'.$k.'</td>
5814	<td>'.$v['cur_md5'].'</td>
5815	<td>'.$v['md5'].'</td>
5816	<td><input type="checkbox" name="checksum_del_ignore[]" class="csum_del_ig" value="'.$k.'" /></td>
5817	</tr>';
5818
5819	}
5820
5821	}else{
5822
5823	echo '
5824	<tr>
5825	<td colspan="4" align="center">'.__('No files have been added to the ignore list','loginizer').'</td>
5826	</tr>';
5827
5828	}
5829
5830	?>
5831	</table><br />
5832	<center><input name="save_lz_csum_ig" class="button button-primary action" value="<?php echo __('Remove Selected from Ignore List', 'loginizer'); ?>" type="submit" /></center>
5833	</form>
5834	</div>
5835
5836	</div>
5837	<br />
5838
5839	<?php
5840	loginizer_page_footer();
5841
5842	}
5843
5844	function loginizer_dismiss_newsletter(){
5845
5846	// Some AJAX security
5847	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5848
5849	if(!current_user_can('manage_options')){
5850	wp_die('Sorry, but you do not have permissions to change settings.');
5851	}
5852
5853	update_option('loginizer_dismiss_newsletter', time());
5854	echo 1;
5855	wp_die();
5856	}
5857
5858	add_action('wp_ajax_loginizer_dismiss_newsletter', 'loginizer_dismiss_newsletter');
5859
5860	function loginizer_dismiss_backuply(){
5861
5862	// Some AJAX security
5863	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5864
5865	if(!current_user_can('manage_options')){
5866	wp_die('Sorry, but you do not have permissions to change settings.');
5867	}
5868
5869	update_option('loginizer_backuply_promo_time', (0 - time()));
5870	echo 1;
5871	wp_die();
5872	}
5873
5874	add_action('wp_ajax_loginizer_dismiss_backuply', 'loginizer_dismiss_backuply');
5875
5876	function loginizer_dismiss_csrf(){
5877
5878	// Some AJAX security
5879	check_ajax_referer('loginizer_admin_ajax', 'nonce');
5880
5881	if(!current_user_can('manage_options')){
5882	wp_die('Sorry, but you do not have permissions to change settings.');
5883	}
5884
5885	update_option('loginizer_csrf_promo_time', (0 - time()));
5886	echo 1;
5887	wp_die();
5888	}
5889
5890	add_action('wp_ajax_loginizer_dismiss_csrf', 'loginizer_dismiss_csrf');
5891
5892	function loginizer_newsletter_subscribe(){
5893
5894	$newsletter_dismiss = get_option('loginizer_dismiss_newsletter');
5895
5896	if(!empty($newsletter_dismiss)){
5897	return;
5898	}
5899
5900	$env['url'] = 'https://loginizer.com/';
5901
5902	echo '
5903	<style>
5904	.newsletter_container{
5905	color: #000000;
5906	background: #FFFFFF;
5907	text-align:center;
5908	}
5909	.subscribe_form_row{
5910	color: #000000;
5911	padding-bottom:0px !important;
5912	}
5913	.subscribe_heading{
5914	font-size:22px;
5915	}
5916	</style>
5917
5918	<div class="notice my-loginizer-dismiss-notice is-dismissible" style="background:#FFF;padding:15px; border: 1px solid #ccd0d4; width:80%;margin-left:0px;margin:auto;">
5919	<div class="container">
5920	<div class="col-md-6 col-md-offset-3 text-center newsletter_container">
5921	<h2 style="font-weight:100; margin-bottom:20px; margin-top:5px;" class="subscribe_heading">Subscribe to our Newsletter</h2>
5922	<form class="form-inline" action="" method="POST">
5923	<div class="row subscribe_form_row">
5924	<div class="col-md-12">
5925	<input type="email" name="email" size="40" id="subscribe_email" class="" placeholder="email@example.com" value="">
5926	<input type="button" name="subscribe" id="subscribe_button" class="button button-primary" value="Subscribe" onclick="loginizer_email_subscribe();" style="margin-top:0px;">
5927	</div>
5928	<div class="col-md-3">
5929	</div>
5930	</div>
5931	</form>
5932	<p><b>Note :</b> If a Loginizer account does not exist it will be created.</p>
5933	</div>
5934	</div>
5935	</div><br />
5936
5937	<script type="text/javascript">
5938	function loginizer_dismiss_newsletter(){
5939
5940	var data = new Object();
5941	data["action"] = "loginizer_dismiss_newsletter";
5942	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
5943
5944	var admin_url = "'.admin_url().'"+"admin-ajax.php";
5945	jQuery.post(admin_url, data, function(response){
5946
5947	});
5948
5949	}
5950
5951	function loginizer_email_subscribe(){
5952	var subs_location = "'.$env['url'].'?email="+encodeURIComponent(jQuery("#subscribe_email").val());
5953	window.open(subs_location, "_blank");
5954	}
5955	jQuery(document).on("click", ".my-loginizer-dismiss-notice .notice-dismiss", loginizer_dismiss_newsletter);
5956	</script>';
5957
5958	return true;
5959	}
5960
5961	function loginizer_backuply_promo(){
5962
5963	$plugins = get_plugins();
5964
5965	// Dont show Backuply Promo if its already installed
5966	if(array_key_exists('backuply-pro/backuply-pro.php', $plugins) \|\| array_key_exists('backuply/backuply.php', $plugins)){
5967	return;
5968	}
5969
5970	if(isset($_REQUEST['install_backuply'])){
5971	if(!wp_verify_nonce($_REQUEST['security'], 'loginizer_install_backuply') \|\| !current_user_can('activate_plugins')){
5972	die('Only Admin can access it');
5973	}
5974
5975	loginizer_backuply_install();
5976	return;
5977	}
5978
5979	echo '<div class="notice is-dismissible lz-welcome-panel lz-backuply-dismissible" style="padding:20px; margin:0;">
5980	<table>
5981	<tr>
5982	<th width="25%">
5983	<img src="'.LOGINIZER_URL.'\images\backuply-square.png" height="150px" width="150px"/>
5984	</th>
5985	<td width="75%">
5986	<div class="inside" style="margin-left: 20px;">
5987	<strong><i>'.__('Backups are the best form of security. Secure your WordPress site by creating backups with Backuply','loginizer').'</i>:</strong><br>
5988	<ul class="lz-right-ul">
5989	<li>'.__('Backup to remote locations like FTP, FTPS, SFTP, WebDAV, Google Drive, OneDrive, Dropbox, Amazon S3','loginizer').'</li>
5990	<li>'.__('Auto Backups','loginizer').'</li>
5991	<li>'.__('Easy One-Click restores','loginizer').'</li>
5992	<li>'.__('Stress Free Migrations','loginizer').'</li>
5993	</ul>
5994	<a class="button button-primary" href="'.esc_url(admin_url('admin.php?page=loginizer&install_backuply=1&security='.wp_create_nonce('loginizer_install_backuply'))).'">'.__('Install Backuply', 'loginizer').'</a>  <a class="button button-secondary" target="_blank" href="https://wordpress.org/plugins/backuply/">'.__('Visit Backuply','loginizer').'</a>
5995	</div>
5996	</td>
5997	</tr>
5998	</table>
5999	</div><br />
6000	<script type="text/javascript">
6001	function loginizer_dismiss_backuply(){
6002
6003	var data = new Object();
6004	data["action"] = "loginizer_dismiss_backuply";
6005	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
6006
6007	var admin_url = "'.admin_url().'"+"admin-ajax.php";
6008	jQuery.post(admin_url, data, function(response){
6009
6010	});
6011
6012	}
6013
6014	jQuery(document).on("click", ".lz-backuply-dismissible .notice-dismiss", loginizer_dismiss_backuply);
6015	</script>';
6016
6017	return true;
6018	}
6019
6020	function loginizer_csrf_promo(){
6021
6022	echo '<div class="notice notice-success is-dismissible lz-csrf-dismissible"><p>Secure your WordPress site from CSRF attacks with our new feature <strong>CSRF Protection</strong> <a href="https://loginizer.com/docs/configuration-and-settings/how-to-enable-csrf-protection/" target="_blank" class="button button-primary">Read More</a></p></div>';
6023
6024	echo'<script type="text/javascript">
6025	function loginizer_dismiss_csrf(){
6026
6027	var data = new Object();
6028	data["action"] = "loginizer_dismiss_csrf";
6029	data["nonce"] = "'.wp_create_nonce('loginizer_admin_ajax').'";
6030
6031	var admin_url = "'.admin_url().'"+"admin-ajax.php";
6032	jQuery.post(admin_url, data, function(response){
6033
6034	});
6035
6036	}
6037
6038	jQuery(document).on("click", ".lz-csrf-dismissible", loginizer_dismiss_csrf);
6039	</script>';
6040	}
6041
6042	// Install Backuply
6043	function loginizer_backuply_install(){
6044
6045	// Include the necessary stuff
6046	include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
6047
6048	// Includes necessary for Plugin_Upgrader and Plugin_Installer_Skin
6049	include_once( ABSPATH . 'wp-admin/includes/file.php' );
6050	include_once( ABSPATH . 'wp-admin/includes/misc.php' );
6051	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
6052
6053	// Filter to prevent the activate text
6054	add_filter('install_plugin_complete_actions', 'loginizer_backuply_install_complete_actions', 10, 3);
6055
6056	$upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin() );
6057	$installed = $upgrader->install('https://downloads.wordpress.org/plugin/backuply.zip');
6058
6059	if ( !is_wp_error( $installed ) && $installed ) {
6060	echo 'Activating Backuply !';
6061	$activate = activate_plugin('backuply/backuply.php');
6062
6063	if ( is_null($activate) ) {
6064	echo '<div id="message" class="updated"><p>'. esc_html__('Done! Backuply is now installed and activated.', 'loginizer'). '</p></div><br /><br><br><b>'. esc_html__('Done! Backuply is now installed and activated.', 'loginizer').'</b>';
6065	}
6066	}
6067
6068	return $installed;
6069	}
6070
6071	// Prevent pro activate text for installer
6072	function loginizer_backuply_install_complete_actions($install_actions, $api, $plugin_file){
6073
6074	if($plugin_file == 'backuply/backuply.php'){
6075	return array();
6076	}
6077
6078	return $install_actions;
6079	}
6080
6081
6082	// Sorry to see you going
6083	register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
6084
6085	function loginizer_deactivation(){
6086
6087	global $wpdb;
6088
6089	$sql = array();
6090	$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;";
6091
6092	foreach($sql as $sk => $sv){
6093	$wpdb->query($sv);
6094	}
6095
6096	delete_option('loginizer_version');
6097	delete_option('loginizer_options');
6098	delete_option('loginizer_last_reset');
6099	delete_option('loginizer_whitelist');
6100	delete_option('loginizer_blacklist');
6101	delete_option('loginizer_msg');
6102	delete_option('loginizer_2fa_msg');
6103	delete_option('loginizer_2fa_email_template');
6104	delete_option('loginizer_security');
6105	delete_option('loginizer_wp_admin');
6106	delete_option('loginizer_csrf_promo_time');
6107	delete_option('loginizer_backuply_promo_time');
6108	delete_option('loginizer_promo_time');
6109	delete_option('loginizer_ins_time');
6110	delete_option('loginizer_2fa_whitelist');
6111	delete_option('loginizer_checksums_last_run');
6112	delete_option('loginizer_checksums_diff');
6113	delete_option('loginizer_ip_method');
6114	delete_option('loginizer_2fa_custom_redirect');
6115
6116	}
6117
6118