| 1 |
<?php |
| 2 |
|
| 3 |
if(!function_exists('add_action')){ |
| 4 |
echo 'You are not allowed to access this page directly.'; |
| 5 |
exit; |
| 6 |
} |
| 7 |
|
| 8 |
define('LOGINIZER_VERSION', '1.9.1'); |
| 9 |
define('LOGINIZER_DIR', dirname(LOGINIZER_FILE)); |
| 10 |
define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE)); |
| 11 |
define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare'); |
| 12 |
define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing'); |
| 13 |
define('LOGINIZER_DOCS', 'https://loginizer.com/docs/'); |
| 14 |
|
| 15 |
include_once(LOGINIZER_DIR.'/functions.php'); |
| 16 |
|
| 17 |
// Ok so we are now ready to go |
| 18 |
register_activation_hook(LOGINIZER_FILE, 'loginizer_activation'); |
| 19 |
|
| 20 |
// Is called when the ADMIN enables the plugin |
| 21 |
function loginizer_activation(){ |
| 22 |
|
| 23 |
global $wpdb; |
| 24 |
|
| 25 |
$sql = array(); |
| 26 |
|
| 27 |
$sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`"; |
| 28 |
|
| 29 |
$sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` ( |
| 30 |
`username` varchar(255) NOT NULL DEFAULT '', |
| 31 |
`time` int(10) NOT NULL DEFAULT '0', |
| 32 |
`count` int(10) NOT NULL DEFAULT '0', |
| 33 |
`lockout` int(10) NOT NULL DEFAULT '0', |
| 34 |
`ip` varchar(255) NOT NULL DEFAULT '', |
| 35 |
`url` varchar(255) NOT NULL DEFAULT '', |
| 36 |
UNIQUE KEY `ip` (`ip`) |
| 37 |
) DEFAULT CHARSET=utf8;"; |
| 38 |
|
| 39 |
foreach($sql as $sk => $sv){ |
| 40 |
$wpdb->query($sv); |
| 41 |
} |
| 42 |
|
| 43 |
add_option('loginizer_version', LOGINIZER_VERSION); |
| 44 |
add_option('loginizer_options', array()); |
| 45 |
add_option('loginizer_last_reset', 0); |
| 46 |
add_option('loginizer_whitelist', array()); |
| 47 |
add_option('loginizer_blacklist', array()); |
| 48 |
add_option('loginizer_2fa_whitelist', array()); |
| 49 |
|
| 50 |
} |
| 51 |
|
| 52 |
/** |
| 53 |
* Updates the database structure for Loginizer |
| 54 |
* |
| 55 |
* If the plugin files are updated but database structure is not updated |
| 56 |
* this function will update the database structure as per the plugin version |
| 57 |
* NOTE: This does not update plugin files it just updates the database structure |
| 58 |
*/ |
| 59 |
function loginizer_update_check(){ |
| 60 |
|
| 61 |
global $wpdb; |
| 62 |
|
| 63 |
$sql = array(); |
| 64 |
$current_version = get_option('loginizer_version'); |
| 65 |
|
| 66 |
// It must be the 1.0 pre stuff |
| 67 |
if(empty($current_version)){ |
| 68 |
$current_version = get_option('lz_version'); |
| 69 |
} |
| 70 |
|
| 71 |
$version = (int) str_replace('.', '', $current_version); |
| 72 |
|
| 73 |
// No update required |
| 74 |
if($current_version == LOGINIZER_VERSION){ |
| 75 |
return true; |
| 76 |
} |
| 77 |
|
| 78 |
// Is it first run ? |
| 79 |
if(empty($current_version)){ |
| 80 |
|
| 81 |
// Reinstall |
| 82 |
loginizer_activation(); |
| 83 |
|
| 84 |
// Trick the following if conditions to not run |
| 85 |
$version = (int) str_replace('.', '', LOGINIZER_VERSION); |
| 86 |
|
| 87 |
} |
| 88 |
|
| 89 |
// Is it less than 1.0.1 ? |
| 90 |
if($version < 101){ |
| 91 |
|
| 92 |
// TODO : GET the existing settings |
| 93 |
|
| 94 |
// Get the existing settings |
| 95 |
$lz_failed_logs = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_failed_logs`;", 1); |
| 96 |
$lz_options = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_options`;", 1); |
| 97 |
$lz_iprange = lz_selectquery("SELECT * FROM `".$wpdb->prefix."lz_iprange`;", 1); |
| 98 |
|
| 99 |
// Delete the three tables |
| 100 |
$sql = array(); |
| 101 |
$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_failed_logs;"; |
| 102 |
$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_options;"; |
| 103 |
$sql[] = "DROP TABLE IF EXISTS ".$wpdb->prefix."lz_iprange;"; |
| 104 |
|
| 105 |
foreach($sql as $sk => $sv){ |
| 106 |
$wpdb->query($sv); |
| 107 |
} |
| 108 |
|
| 109 |
// Delete option |
| 110 |
delete_option('lz_version'); |
| 111 |
|
| 112 |
// Reinstall |
| 113 |
loginizer_activation(); |
| 114 |
|
| 115 |
// TODO : Save the existing settings |
| 116 |
|
| 117 |
// Update the existing failed logs to new table |
| 118 |
if(is_array($lz_failed_logs)){ |
| 119 |
foreach($lz_failed_logs as $fk => $fv){ |
| 120 |
$insert_data = array('username' => $fv['username'], |
| 121 |
'time' => $fv['time'], |
| 122 |
'count' => $fv['count'], |
| 123 |
'lockout' => $fv['lockout'], |
| 124 |
'ip' => $fv['ip']); |
| 125 |
|
| 126 |
$format = array('%s','%d','%d','%d','%s'); |
| 127 |
|
| 128 |
$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format); |
| 129 |
} |
| 130 |
} |
| 131 |
|
| 132 |
// Update the existing options to new structure |
| 133 |
if(is_array($lz_options)){ |
| 134 |
foreach($lz_options as $ok => $ov){ |
| 135 |
|
| 136 |
if($ov['option_name'] == 'lz_last_reset'){ |
| 137 |
update_option('loginizer_last_reset', $ov['option_value']); |
| 138 |
continue; |
| 139 |
} |
| 140 |
|
| 141 |
$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value']; |
| 142 |
} |
| 143 |
// Save the options |
| 144 |
update_option('loginizer_options', $old_option); |
| 145 |
} |
| 146 |
|
| 147 |
// Update the existing iprange to new structure |
| 148 |
if(is_array($lz_iprange)){ |
| 149 |
|
| 150 |
$old_blacklist = array(); |
| 151 |
$old_whitelist = array(); |
| 152 |
$bid = 1; |
| 153 |
$wid = 1; |
| 154 |
foreach($lz_iprange as $ik => $iv){ |
| 155 |
|
| 156 |
if(!empty($iv['blacklist'])){ |
| 157 |
$old_blacklist[$bid] = array(); |
| 158 |
$old_blacklist[$bid]['start'] = long2ip($iv['start']); |
| 159 |
$old_blacklist[$bid]['end'] = long2ip($iv['end']); |
| 160 |
$old_blacklist[$bid]['time'] = strtotime($iv['date']); |
| 161 |
$bid = $bid + 1; |
| 162 |
} |
| 163 |
|
| 164 |
if(!empty($iv['whitelist'])){ |
| 165 |
$old_whitelist[$wid] = array(); |
| 166 |
$old_whitelist[$wid]['start'] = long2ip($iv['start']); |
| 167 |
$old_whitelist[$wid]['end'] = long2ip($iv['end']); |
| 168 |
$old_whitelist[$wid]['time'] = strtotime($iv['date']); |
| 169 |
$wid = $wid + 1; |
| 170 |
} |
| 171 |
} |
| 172 |
|
| 173 |
if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist); |
| 174 |
if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist); |
| 175 |
} |
| 176 |
|
| 177 |
} |
| 178 |
|
| 179 |
// Is it less than 1.3.9 ? |
| 180 |
if($version < 139){ |
| 181 |
|
| 182 |
$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;"); |
| 183 |
|
| 184 |
} |
| 185 |
|
| 186 |
// Save the new Version |
| 187 |
update_option('loginizer_version', LOGINIZER_VERSION); |
| 188 |
|
| 189 |
// In Sitepad Math Captcha is enabled by default |
| 190 |
if(defined('SITEPAD') && get_option('loginizer_captcha') === false){ |
| 191 |
$option['captcha_no_google'] = 1; |
| 192 |
add_option('loginizer_captcha', $option); |
| 193 |
} |
| 194 |
|
| 195 |
} |
| 196 |
|
| 197 |
// Add the action to load the plugin |
| 198 |
add_action('plugins_loaded', 'loginizer_load_plugin'); |
| 199 |
|
| 200 |
// The function that will be called when the plugin is loaded |
| 201 |
function loginizer_load_plugin(){ |
| 202 |
|
| 203 |
global $loginizer; |
| 204 |
|
| 205 |
// Check if the installed version is outdated |
| 206 |
loginizer_update_check(); |
| 207 |
|
| 208 |
// Set the array |
| 209 |
if(empty($loginizer)){ |
| 210 |
$loginizer = array(); |
| 211 |
} |
| 212 |
|
| 213 |
$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad '; |
| 214 |
$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad'; |
| 215 |
$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php'; |
| 216 |
$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc'; |
| 217 |
|
| 218 |
// The IP Method to use |
| 219 |
$loginizer['ip_method'] = get_option('loginizer_ip_method'); |
| 220 |
if($loginizer['ip_method'] == 3){ |
| 221 |
$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method'); |
| 222 |
} |
| 223 |
|
| 224 |
// Load settings |
| 225 |
$options = get_option('loginizer_options'); |
| 226 |
$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries']; |
| 227 |
$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes |
| 228 |
$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts']; |
| 229 |
$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours |
| 230 |
$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours |
| 231 |
$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email']; |
| 232 |
$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email'); |
| 233 |
$loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true; |
| 234 |
$loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true; |
| 235 |
$loginizer['social_settings'] = get_option('loginizer_social_settings', []); |
| 236 |
|
| 237 |
if(!empty($options['notify_email_address'])){ |
| 238 |
$loginizer['notify_email_address'] = $options['notify_email_address']; |
| 239 |
$loginizer['custom_notify_email'] = 1; |
| 240 |
} |
| 241 |
|
| 242 |
// Login Success Email Notification. |
| 243 |
$loginizer['login_mail'] = get_option('loginizer_login_mail', []); |
| 244 |
$loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer'); |
| 245 |
$loginizer['login_mail_default_msg'] = __('Hello $user_login, |
| 246 |
|
| 247 |
Your account was recently logged in from the IP : $ip |
| 248 |
Time : $date |
| 249 |
If it was not you who logged in then please report this to us immediately. |
| 250 |
|
| 251 |
Regards, |
| 252 |
$sitename','loginizer'); |
| 253 |
|
| 254 |
$loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? $loginizer['login_mail_default_sub']: $loginizer['login_mail']['subject']; |
| 255 |
$loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? $loginizer['login_mail_default_msg'] : $loginizer['login_mail']['body']; |
| 256 |
|
| 257 |
// Default messages |
| 258 |
$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer'); |
| 259 |
$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer'); |
| 260 |
$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer'); |
| 261 |
$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer'); |
| 262 |
$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer'); |
| 263 |
$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer'); |
| 264 |
|
| 265 |
// Message Strings |
| 266 |
$loginizer['msg'] = get_option('loginizer_msg', []); |
| 267 |
|
| 268 |
foreach($loginizer['d_msg'] as $lk => $lv){ |
| 269 |
if(empty($loginizer['msg'][$lk])){ |
| 270 |
$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk]; |
| 271 |
} |
| 272 |
} |
| 273 |
|
| 274 |
$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer'); |
| 275 |
$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer'); |
| 276 |
$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer'); |
| 277 |
$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer'); |
| 278 |
$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer'); |
| 279 |
|
| 280 |
// Message Strings |
| 281 |
$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []); |
| 282 |
|
| 283 |
foreach($loginizer['2fa_d_msg'] as $lk => $lv){ |
| 284 |
if(empty($loginizer['2fa_msg'][$lk])){ |
| 285 |
$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk]; |
| 286 |
} |
| 287 |
} |
| 288 |
|
| 289 |
// Load the blacklist and whitelist |
| 290 |
$loginizer['blacklist'] = get_option('loginizer_blacklist', []); |
| 291 |
$loginizer['whitelist'] = get_option('loginizer_whitelist', []); |
| 292 |
$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist'); |
| 293 |
|
| 294 |
// It should not be false |
| 295 |
if(empty($loginizer['2fa_whitelist'])){ |
| 296 |
$loginizer['2fa_whitelist'] = array(); |
| 297 |
} |
| 298 |
|
| 299 |
// When was the database cleared last time |
| 300 |
$loginizer['last_reset'] = get_option('loginizer_last_reset'); |
| 301 |
|
| 302 |
//print_r($loginizer); |
| 303 |
|
| 304 |
// Clear retries |
| 305 |
if((time() - $loginizer['last_reset']) >= $loginizer['reset_retries']){ |
| 306 |
loginizer_reset_retries(); |
| 307 |
} |
| 308 |
|
| 309 |
$ins_time = get_option('loginizer_ins_time'); |
| 310 |
if(empty($ins_time)){ |
| 311 |
$ins_time = time(); |
| 312 |
update_option('loginizer_ins_time', $ins_time); |
| 313 |
} |
| 314 |
$loginizer['ins_time'] = $ins_time; |
| 315 |
|
| 316 |
// Set the current IP |
| 317 |
$loginizer['current_ip'] = lz_getip(); |
| 318 |
|
| 319 |
// Is Brute Force Disabled ? |
| 320 |
$loginizer['disable_brute'] = get_option('loginizer_disable_brute'); |
| 321 |
|
| 322 |
// Filters and actions |
| 323 |
if(empty($loginizer['disable_brute'])){ |
| 324 |
|
| 325 |
// Use this to verify before WP tries to login |
| 326 |
// Is always called and is the first function to be called |
| 327 |
//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC |
| 328 |
add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI |
| 329 |
|
| 330 |
// Is called when a login attempt fails |
| 331 |
// Hence Update our records that the login failed |
| 332 |
add_action('wp_login_failed', 'loginizer_login_failed'); |
| 333 |
|
| 334 |
// Is called before displaying the error message so that we dont show that the username is wrong or the password |
| 335 |
// Update Error message |
| 336 |
add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2); |
| 337 |
add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001); |
| 338 |
add_action('wp_login', 'loginizer_login_success', 10, 2); |
| 339 |
|
| 340 |
if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){ |
| 341 |
add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2); |
| 342 |
} |
| 343 |
} |
| 344 |
|
| 345 |
// Social Login Form Actions |
| 346 |
if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){ |
| 347 |
if(!empty($loginizer['social_settings']['login']['login_form'])){ |
| 348 |
add_action('login_form', 'loginizer_social_btn_login'); |
| 349 |
} |
| 350 |
} |
| 351 |
|
| 352 |
if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){ |
| 353 |
include_once LOGINIZER_DIR . '/main/ajax.php'; |
| 354 |
} |
| 355 |
|
| 356 |
if(is_admin()){ |
| 357 |
include_once LOGINIZER_DIR . '/main/admin.php'; |
| 358 |
} |
| 359 |
|
| 360 |
// ---------------- |
| 361 |
// PRO INIT END |
| 362 |
// ---------------- |
| 363 |
|
| 364 |
// Is the premium features there ? |
| 365 |
if(!defined('LOGINIZER_PREMIUM')){ |
| 366 |
|
| 367 |
if(current_user_can('activate_plugins')){ |
| 368 |
// The promo time |
| 369 |
$loginizer['promo_time'] = get_option('loginizer_promo_time'); |
| 370 |
if(empty($loginizer['promo_time'])){ |
| 371 |
$loginizer['promo_time'] = time(); |
| 372 |
update_option('loginizer_promo_time', $loginizer['promo_time']); |
| 373 |
} |
| 374 |
|
| 375 |
// Are we to show the loginizer promo |
| 376 |
if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){ |
| 377 |
|
| 378 |
add_action('admin_notices', 'loginizer_promo'); |
| 379 |
|
| 380 |
} |
| 381 |
|
| 382 |
if(!empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){ |
| 383 |
|
| 384 |
add_action('admin_notices', 'loginizer_csrf_promo'); |
| 385 |
|
| 386 |
} |
| 387 |
|
| 388 |
// Are we to disable the promo |
| 389 |
if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){ |
| 390 |
update_option('loginizer_promo_time', (0 - time()) ); |
| 391 |
die('DONE'); |
| 392 |
} |
| 393 |
|
| 394 |
$loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time'); |
| 395 |
|
| 396 |
if(empty($loginizer['backuply_promo'])){ |
| 397 |
$loginizer['backuply_promo'] = abs($loginizer['promo_time']); |
| 398 |
update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']); |
| 399 |
} |
| 400 |
|
| 401 |
// Setting CSRF Promo time |
| 402 |
$loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time'); |
| 403 |
|
| 404 |
if(empty($loginizer['csrf_promo'])){ |
| 405 |
$loginizer['csrf_promo'] = abs($loginizer['promo_time']); |
| 406 |
update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']); |
| 407 |
} |
| 408 |
} |
| 409 |
} |
| 410 |
|
| 411 |
// Secuity checks for social login. |
| 412 |
if(!empty($_GET['lz_social_provider']) && loginizer_can_login()){ |
| 413 |
include_once LOGINIZER_DIR . '/main/social-login.php'; |
| 414 |
return; |
| 415 |
} |
| 416 |
} |
| 417 |
|
| 418 |
// Should return NULL if everything is fine |
| 419 |
function loginizer_wp_authenticate($user, $username, $password){ |
| 420 |
|
| 421 |
global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass; |
| 422 |
|
| 423 |
if(!empty($username) && !empty($password)){ |
| 424 |
$lz_user_pass = 1; |
| 425 |
} |
| 426 |
|
| 427 |
// Are you whitelisted ? |
| 428 |
if(loginizer_is_whitelisted()){ |
| 429 |
$loginizer['ip_is_whitelisted'] = 1; |
| 430 |
return $user; |
| 431 |
|
| 432 |
} else if (!empty($loginizer['trusted_ips'])){ |
| 433 |
$lz_cannot_login = 1; |
| 434 |
|
| 435 |
// This is used by WP Activity Log |
| 436 |
apply_filters( 'wp_login_blocked', $username ); |
| 437 |
|
| 438 |
// Shows a blocked screen |
| 439 |
if(!empty($loginizer['blocked_screen'])){ |
| 440 |
$lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'); |
| 441 |
loginizer_blocked_page($lz_error); |
| 442 |
} |
| 443 |
|
| 444 |
return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer')); |
| 445 |
} |
| 446 |
|
| 447 |
// Are you blacklisted ? |
| 448 |
if(loginizer_is_blacklisted()){ |
| 449 |
$lz_cannot_login = 1; |
| 450 |
|
| 451 |
// This is used by WP Activity Log |
| 452 |
apply_filters( 'wp_login_blocked', $username ); |
| 453 |
|
| 454 |
// Shows a blocked screen |
| 455 |
if(!empty($loginizer['blocked_screen'])){ |
| 456 |
loginizer_blocked_page($lz_error); |
| 457 |
} |
| 458 |
|
| 459 |
return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer'); |
| 460 |
} |
| 461 |
|
| 462 |
// Is the username blacklisted ? |
| 463 |
if(function_exists('loginizer_user_blacklisted')){ |
| 464 |
if(loginizer_user_blacklisted($username)){ |
| 465 |
$lz_cannot_login = 1; |
| 466 |
|
| 467 |
// This is used by WP Activity Log |
| 468 |
apply_filters( 'wp_login_blocked', $username ); |
| 469 |
|
| 470 |
return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer'); |
| 471 |
} |
| 472 |
} |
| 473 |
|
| 474 |
if(loginizer_can_login()){ |
| 475 |
return $user; |
| 476 |
} |
| 477 |
|
| 478 |
$lz_cannot_login = 1; |
| 479 |
|
| 480 |
// This is used by WP Activity Log |
| 481 |
apply_filters( 'wp_login_blocked', $username ); |
| 482 |
|
| 483 |
// Shows a blocked screen |
| 484 |
if(!empty($loginizer['blocked_screen'])){ |
| 485 |
loginizer_blocked_page($lz_error); |
| 486 |
} |
| 487 |
|
| 488 |
return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer'); |
| 489 |
|
| 490 |
} |
| 491 |
|
| 492 |
function loginizer_can_login(){ |
| 493 |
|
| 494 |
global $wpdb, $loginizer, $lz_error; |
| 495 |
|
| 496 |
// Get the logs |
| 497 |
$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']); |
| 498 |
$result = lz_selectquery($sel_query); |
| 499 |
|
| 500 |
if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){ |
| 501 |
|
| 502 |
// Has he reached max lockouts ? |
| 503 |
if($result['lockout'] >= $loginizer['max_lockouts']){ |
| 504 |
$loginizer['lockout_time'] = $loginizer['lockouts_extend']; |
| 505 |
} |
| 506 |
|
| 507 |
// Is he in the lockout time ? |
| 508 |
if($result['time'] >= (time() - $loginizer['lockout_time'])){ |
| 509 |
$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60); |
| 510 |
|
| 511 |
//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />'; |
| 512 |
//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />'; |
| 513 |
//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />'; |
| 514 |
|
| 515 |
$_time = $banlift.' '.$loginizer['msg']['minutes_err']; |
| 516 |
|
| 517 |
if($banlift > 60){ |
| 518 |
$banlift = ceil($banlift / 60); |
| 519 |
$_time = $banlift.' '.$loginizer['msg']['hours_err']; |
| 520 |
} |
| 521 |
|
| 522 |
$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time; |
| 523 |
|
| 524 |
return false; |
| 525 |
} |
| 526 |
} |
| 527 |
|
| 528 |
return true; |
| 529 |
} |
| 530 |
|
| 531 |
function loginizer_is_blacklisted(){ |
| 532 |
|
| 533 |
global $wpdb, $loginizer, $lz_error; |
| 534 |
|
| 535 |
$blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : []; |
| 536 |
|
| 537 |
if(empty($blacklist)){ |
| 538 |
return false; |
| 539 |
} |
| 540 |
|
| 541 |
foreach($blacklist as $k => $v){ |
| 542 |
|
| 543 |
// Is the IP in the blacklist ? |
| 544 |
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){ |
| 545 |
$result = 1; |
| 546 |
break; |
| 547 |
} |
| 548 |
|
| 549 |
// Is it in a wider range ? |
| 550 |
if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){ |
| 551 |
|
| 552 |
// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi, |
| 553 |
// if the current IP is <= than the start of the range, it is within the range |
| 554 |
// OR |
| 555 |
// if the current IP is <= than the end of the range, it is within the range |
| 556 |
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) |
| 557 |
|| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){ |
| 558 |
$result = 1; |
| 559 |
break; |
| 560 |
} |
| 561 |
|
| 562 |
} |
| 563 |
|
| 564 |
} |
| 565 |
|
| 566 |
// You are blacklisted |
| 567 |
if(!empty($result)){ |
| 568 |
$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted']; |
| 569 |
return true; |
| 570 |
} |
| 571 |
|
| 572 |
return false; |
| 573 |
|
| 574 |
} |
| 575 |
|
| 576 |
function loginizer_is_whitelisted(){ |
| 577 |
|
| 578 |
global $wpdb, $loginizer, $lz_error; |
| 579 |
|
| 580 |
$whitelist = $loginizer['whitelist']; |
| 581 |
|
| 582 |
if(empty($whitelist)){ |
| 583 |
return false; |
| 584 |
} |
| 585 |
|
| 586 |
foreach($whitelist as $k => $v){ |
| 587 |
|
| 588 |
// Is the IP in the blacklist ? |
| 589 |
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){ |
| 590 |
$result = 1; |
| 591 |
break; |
| 592 |
} |
| 593 |
|
| 594 |
// Is it in a wider range ? |
| 595 |
if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){ |
| 596 |
|
| 597 |
// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi, |
| 598 |
// if the current IP is <= than the start of the range, it is within the range |
| 599 |
// OR |
| 600 |
// if the current IP is <= than the end of the range, it is within the range |
| 601 |
if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) |
| 602 |
|| inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){ |
| 603 |
$result = 1; |
| 604 |
break; |
| 605 |
} |
| 606 |
|
| 607 |
} |
| 608 |
|
| 609 |
} |
| 610 |
|
| 611 |
// You are whitelisted |
| 612 |
if(!empty($result)){ |
| 613 |
return true; |
| 614 |
} |
| 615 |
|
| 616 |
return false; |
| 617 |
|
| 618 |
} |
| 619 |
|
| 620 |
// When the login fails, then this is called |
| 621 |
// We need to update the database |
| 622 |
function loginizer_login_failed($username, $is_2fa = ''){ |
| 623 |
|
| 624 |
global $wpdb, $loginizer, $lz_cannot_login; |
| 625 |
|
| 626 |
// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query |
| 627 |
if(empty($username) || is_null($username)){ |
| 628 |
$username = ''; |
| 629 |
} |
| 630 |
|
| 631 |
$fail_type = 'Login'; |
| 632 |
|
| 633 |
if(!empty($is_2fa)){ |
| 634 |
$fail_type = '2FA'; |
| 635 |
} |
| 636 |
|
| 637 |
if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){ |
| 638 |
|
| 639 |
// The params which comes when social login returns an error, have some characters, which WordPress could not save. |
| 640 |
$server_uri = $_SERVER['REQUEST_URI']; |
| 641 |
if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){ |
| 642 |
$request_uri = explode('=', $_SERVER['REQUEST_URI']); |
| 643 |
$server_uri = $request_uri[0]; |
| 644 |
} |
| 645 |
|
| 646 |
$url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri); |
| 647 |
$url = esc_url($url); |
| 648 |
|
| 649 |
$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']); |
| 650 |
$result = lz_selectquery($sel_query); |
| 651 |
|
| 652 |
if(!empty($result)){ |
| 653 |
$lockout = floor((($result['count']+1) / $loginizer['max_retries'])); |
| 654 |
|
| 655 |
$update_data = array('username' => $username, |
| 656 |
'time' => time(), |
| 657 |
'count' => $result['count']+1, |
| 658 |
'lockout' => $lockout, |
| 659 |
'url' => $url); |
| 660 |
|
| 661 |
$where_data = array('ip' => $loginizer['current_ip']); |
| 662 |
|
| 663 |
$format = array('%s','%d','%d','%d','%s'); |
| 664 |
$where_format = array('%s'); |
| 665 |
|
| 666 |
$wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format); |
| 667 |
|
| 668 |
// Do we need to email admin ? |
| 669 |
if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){ |
| 670 |
|
| 671 |
$lockout_time = $loginizer['lockout_time']; |
| 672 |
|
| 673 |
if($lockout >= $loginizer['max_lockouts']){ |
| 674 |
// extended lockout is in hours so we have to convert to minute |
| 675 |
$lockout_time = $loginizer['lockouts_extend']; |
| 676 |
} |
| 677 |
|
| 678 |
$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname'); |
| 679 |
$mail = array(); |
| 680 |
$mail['to'] = $loginizer['notify_email_address']; |
| 681 |
$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')'; |
| 682 |
$mail['message'] = 'Hi, |
| 683 |
|
| 684 |
'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site : |
| 685 |
'.home_url().' |
| 686 |
|
| 687 |
Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).' |
| 688 |
Last User Attempt : '.$username.' |
| 689 |
IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).' |
| 690 |
|
| 691 |
Regards, |
| 692 |
Loginizer'; |
| 693 |
|
| 694 |
@wp_mail($mail['to'], $mail['subject'], $mail['message']); |
| 695 |
} |
| 696 |
}else{ |
| 697 |
$result = array(); |
| 698 |
$result['count'] = 0; |
| 699 |
|
| 700 |
$insert_data = array('username' => $username, |
| 701 |
'time' => time(), |
| 702 |
'count' => 1, |
| 703 |
'ip' => $loginizer['current_ip'], |
| 704 |
'lockout' => 0, |
| 705 |
'url' => $url); |
| 706 |
|
| 707 |
$format = array('%s','%d','%d','%s','%d','%s'); |
| 708 |
|
| 709 |
$wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format); |
| 710 |
} |
| 711 |
|
| 712 |
// We need to add one as this is a failed attempt as well |
| 713 |
$result['count'] = $result['count'] + 1; |
| 714 |
loginizer_update_attempt_stats(0); |
| 715 |
$loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries'])); |
| 716 |
$loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left']; |
| 717 |
|
| 718 |
} |
| 719 |
} |
| 720 |
|
| 721 |
function loginizer_login_success($user_login, $user) { |
| 722 |
global $wp_version, $loginizer; |
| 723 |
|
| 724 |
loginizer_update_attempt_stats(1); |
| 725 |
|
| 726 |
if(empty($loginizer['login_mail'])){ |
| 727 |
return; |
| 728 |
} |
| 729 |
|
| 730 |
if(empty($loginizer['login_mail']['enable'])){ |
| 731 |
return; |
| 732 |
} |
| 733 |
|
| 734 |
if(!empty($loginizer['login_mail']['disable_whitelist'])){ |
| 735 |
// Check its whitelist ip |
| 736 |
if(loginizer_is_whitelisted()){ |
| 737 |
return; |
| 738 |
} |
| 739 |
} |
| 740 |
|
| 741 |
if(empty($user_login) && empty($user)){ |
| 742 |
error_log('Loginizer: No user information to send email'); |
| 743 |
return; |
| 744 |
} |
| 745 |
|
| 746 |
if(empty($user)){ |
| 747 |
$user = get_user_by('login', $user_login); |
| 748 |
} |
| 749 |
|
| 750 |
if(empty($user)){ |
| 751 |
error_log('Loginizer: Unable to get the user'); |
| 752 |
return; |
| 753 |
} |
| 754 |
|
| 755 |
if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){ |
| 756 |
return; |
| 757 |
} |
| 758 |
|
| 759 |
// Check if the user role is enabled for email notification. |
| 760 |
if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){ |
| 761 |
return; |
| 762 |
} |
| 763 |
|
| 764 |
// current_datetime & wp_timezone_string were introduced in WordPress 5.3 |
| 765 |
if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){ |
| 766 |
$time_zone = wp_timezone_string(); |
| 767 |
|
| 768 |
if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){ |
| 769 |
$time_zone = 'UTC'.$time_zone; |
| 770 |
} |
| 771 |
|
| 772 |
// Setting up data variables. |
| 773 |
$date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone; |
| 774 |
} else { |
| 775 |
$date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get(); |
| 776 |
} |
| 777 |
|
| 778 |
$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname'); |
| 779 |
$email = $user->data->user_email; |
| 780 |
|
| 781 |
$vars = array( |
| 782 |
'date' => $date, |
| 783 |
'ip' => esc_html($loginizer['current_ip']), |
| 784 |
'sitename' => $sitename, |
| 785 |
'user_login' => $user_login |
| 786 |
); |
| 787 |
|
| 788 |
$message = lz_lang_vars_name($loginizer['login_mail_body'], $vars); |
| 789 |
$subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars); |
| 790 |
|
| 791 |
$headers = []; |
| 792 |
|
| 793 |
// Do we need to send the email as HTML ? |
| 794 |
if(!empty($loginizer['login_mail']['html_mail'])){ |
| 795 |
$headers[] = 'Content-Type: text/html; charset=UTF-8'; |
| 796 |
|
| 797 |
if(!empty($loginizer['login_mail']['body'])){ |
| 798 |
$message = html_entity_decode($message); |
| 799 |
}else{ |
| 800 |
$message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message); |
| 801 |
$message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message); |
| 802 |
} |
| 803 |
} |
| 804 |
|
| 805 |
// Sending notification |
| 806 |
if(empty(wp_mail($email, $subject, $message, $headers))){ |
| 807 |
error_log(__('There was a problem sending your email.', 'loginizer')); |
| 808 |
return; |
| 809 |
} |
| 810 |
} |
| 811 |
|
| 812 |
function loginizer_update_attempt_stats($type){ |
| 813 |
|
| 814 |
$stats = get_option('loginizer_login_attempt_stats', []); |
| 815 |
$time = strtotime(date('Y-m-d H:00:00')); |
| 816 |
|
| 817 |
if(empty($stats[$time][$type])){ |
| 818 |
$stats[$time][$type] = 0; |
| 819 |
} |
| 820 |
|
| 821 |
$stats[$time][$type] += 1; |
| 822 |
|
| 823 |
update_option('loginizer_login_attempt_stats', $stats, false); |
| 824 |
} |
| 825 |
|
| 826 |
// Handles the error of the password not being there |
| 827 |
function loginizer_error_handler($errors, $redirect_to){ |
| 828 |
|
| 829 |
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login; |
| 830 |
|
| 831 |
//echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>'; |
| 832 |
if(is_null($errors) || empty($errors)){ |
| 833 |
return true; |
| 834 |
} |
| 835 |
|
| 836 |
// Remove the empty password error |
| 837 |
if(is_wp_error($errors)){ |
| 838 |
|
| 839 |
$codes = $errors->get_error_codes(); |
| 840 |
|
| 841 |
foreach($codes as $k => $v){ |
| 842 |
if($v == 'invalid_username' || $v == 'incorrect_password'){ |
| 843 |
$show_error = 1; |
| 844 |
} |
| 845 |
} |
| 846 |
|
| 847 |
$errors->remove('invalid_username'); |
| 848 |
$errors->remove('incorrect_password'); |
| 849 |
|
| 850 |
// Add the error |
| 851 |
if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){ |
| 852 |
$errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']); |
| 853 |
} |
| 854 |
|
| 855 |
// Add the number of retires left as well |
| 856 |
if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){ |
| 857 |
$errors->add('retries_left', loginizer_retries_left()); |
| 858 |
} |
| 859 |
|
| 860 |
} |
| 861 |
|
| 862 |
return $errors; |
| 863 |
|
| 864 |
} |
| 865 |
|
| 866 |
// Handles the error of the password not being there |
| 867 |
function loginizer_woocommerce_error_handler(){ |
| 868 |
|
| 869 |
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login; |
| 870 |
|
| 871 |
if(function_exists('wc_add_notice')){ |
| 872 |
wc_add_notice( loginizer_retries_left(), 'error' ); |
| 873 |
} |
| 874 |
} |
| 875 |
|
| 876 |
// Handles social login URL |
| 877 |
function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){ |
| 878 |
global $loginizer; |
| 879 |
|
| 880 |
loginizer_get_social_error(); |
| 881 |
|
| 882 |
if(empty($loginizer['social_errors'])){ |
| 883 |
return $errors; |
| 884 |
} |
| 885 |
|
| 886 |
if(is_null($errors) || empty($errors) || !is_wp_error($errors)){ |
| 887 |
$errors = new WP_Error(); |
| 888 |
} |
| 889 |
|
| 890 |
foreach($loginizer['social_errors'] as $key => $text){ |
| 891 |
$errors->add($key, $text); |
| 892 |
} |
| 893 |
|
| 894 |
return $errors; |
| 895 |
} |
| 896 |
|
| 897 |
// Returns a string with the number of retries left |
| 898 |
function loginizer_retries_left(){ |
| 899 |
|
| 900 |
global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login; |
| 901 |
|
| 902 |
// If we are to show the number of retries left |
| 903 |
if(isset($loginizer['retries_left'])){ |
| 904 |
$retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']); |
| 905 |
|
| 906 |
return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left']; |
| 907 |
} |
| 908 |
|
| 909 |
} |
| 910 |
|
| 911 |
function loginizer_reset_retries(){ |
| 912 |
|
| 913 |
global $wpdb, $loginizer; |
| 914 |
|
| 915 |
$deltime = time() - $loginizer['reset_retries']; |
| 916 |
|
| 917 |
$del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime); |
| 918 |
$result = $wpdb->query($del_query); |
| 919 |
|
| 920 |
update_option('loginizer_last_reset', time()); |
| 921 |
|
| 922 |
} |
| 923 |
|
| 924 |
// Sorry to see you going |
| 925 |
register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation'); |
| 926 |
|
| 927 |
function loginizer_deactivation(){ |
| 928 |
|
| 929 |
global $wpdb; |
| 930 |
|
| 931 |
$sql = array(); |
| 932 |
$sql[] = "DROP TABLE ".$wpdb->prefix."loginizer_logs;"; |
| 933 |
|
| 934 |
foreach($sql as $sk => $sv){ |
| 935 |
$wpdb->query($sv); |
| 936 |
} |
| 937 |
|
| 938 |
delete_option('loginizer_version'); |
| 939 |
delete_option('loginizer_options'); |
| 940 |
delete_option('loginizer_last_reset'); |
| 941 |
delete_option('loginizer_whitelist'); |
| 942 |
delete_option('loginizer_blacklist'); |
| 943 |
delete_option('loginizer_msg'); |
| 944 |
delete_option('loginizer_2fa_msg'); |
| 945 |
delete_option('loginizer_2fa_email_template'); |
| 946 |
delete_option('loginizer_security'); |
| 947 |
delete_option('loginizer_wp_admin'); |
| 948 |
delete_option('loginizer_csrf_promo_time'); |
| 949 |
delete_option('loginizer_backuply_promo_time'); |
| 950 |
delete_option('loginizer_promo_time'); |
| 951 |
delete_option('loginizer_ins_time'); |
| 952 |
delete_option('loginizer_2fa_whitelist'); |
| 953 |
delete_option('loginizer_checksums_last_run'); |
| 954 |
delete_option('loginizer_checksums_diff'); |
| 955 |
delete_option('loginizer_ip_method'); |
| 956 |
delete_option('loginizer_2fa_custom_redirect'); |
| 957 |
delete_option('external_updates-loginizer-security'); |
| 958 |
delete_option('loginizer_login_attempt_stats'); |
| 959 |
|
| 960 |
} |
