← All changes | init.php +165 -141 trunk → 1.9.5 View file →

		@@ -4,9 +4,9 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '2.1.0');
	8	+define('LOGINIZER_VERSION', '1.9.5');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
		@@ -187,29 +187,8 @@
187	187	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188	188
189	189	}
190	190
191		- // Setting alignment to left in social login ?
192		- if($version < 201){
193		- $social_settings = get_option('loginizer_social_settings', []);
194		-
195		- if(!empty($social_settings)){
196		- if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
197		- $social_settings['login']['button_alignment'] = 'left';
198		- }
199		-
200		- if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
201		- $social_settings['woocommerce']['button_alignment'] = 'left';
202		- }
203		-
204		- if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
205		- $social_settings['comment']['button_alignment'] = 'left';
206		- }
207		-
208		- update_option('loginizer_social_settings', $social_settings);
209		- }
210		- }
211		-
212	191	// Save the new Version
213	192	update_option('loginizer_version', LOGINIZER_VERSION);
214	193
215	194	// TODO:: REMOVE THIS AFTER MARCH 2025
		@@ -289,14 +268,8 @@
289	268	}
290	269
291	270	// When was the database cleared last time
292	271	$loginizer['last_reset'] = get_option('loginizer_last_reset');
293		-
294		- if(!isset($loginizer['ultimate-member-active'])){
295		- $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
296		-
297		- $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
298		- }
299	272
300	273	//print_r($loginizer);
301	274
302	275	// Clear retries
		@@ -332,22 +305,17 @@
332	305	// Is called before displaying the error message so that we dont show that the username is wrong or the password
333	306	// Update Error message
334	307	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335	308	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336		- add_action('wp_login', 'loginizer_login_success', 11, 2);
337		- add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
338		-
339		- if(!empty($loginizer['ultimate-member-active'])){
340		- add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
341		- }
	309	+ add_action('wp_login', 'loginizer_login_success', 10, 2);
342	310
343		- if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings'])){
	311	+ if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
344	312	add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
345	313	}
346	314	}
347	315
348	316	// Social Login Form Actions
349		- if(!empty($loginizer['social_settings'])){
	317	+ if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
350	318	if(!empty($loginizer['social_settings']['login']['login_form'])){
351	319	add_action('login_form', 'loginizer_social_btn_login');
352	320	}
353	321	}
		@@ -358,16 +326,63 @@
358	326
359	327	if(is_admin()){
360	328	include_once LOGINIZER_DIR . '/main/admin.php';
361	329	}
362		-
	330	+
363	331	// ----------------
364	332	// PRO INIT END
365	333	// ----------------
366	334
	335	+ // Is the premium features there ?
	336	+ if(!defined('LOGINIZER_PREMIUM')){
	337	+
	338	+ if(current_user_can('activate_plugins')){
	339	+ // The promo time
	340	+ $loginizer['promo_time'] = get_option('loginizer_promo_time');
	341	+ if(empty($loginizer['promo_time'])){
	342	+ $loginizer['promo_time'] = time();
	343	+ update_option('loginizer_promo_time', $loginizer['promo_time']);
	344	+ }
	345	+
	346	+ // Are we to show the loginizer promo
	347	+ if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
	348	+
	349	+ add_action('admin_notices', 'loginizer_promo');
	350	+
	351	+ }
	352	+
	353	+ if(!empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
	354	+
	355	+ add_action('admin_notices', 'loginizer_csrf_promo');
	356	+
	357	+ }
	358	+
	359	+ // Are we to disable the promo
	360	+ if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
	361	+ update_option('loginizer_promo_time', (0 - time()) );
	362	+ die('DONE');
	363	+ }
	364	+
	365	+ $loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
	366	+
	367	+ if(empty($loginizer['backuply_promo'])){
	368	+ $loginizer['backuply_promo'] = abs($loginizer['promo_time']);
	369	+ update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
	370	+ }
	371	+
	372	+ // Setting CSRF Promo time
	373	+ $loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
	374	+
	375	+ if(empty($loginizer['csrf_promo'])){
	376	+ $loginizer['csrf_promo'] = abs($loginizer['promo_time']);
	377	+ update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
	378	+ }
	379	+ }
	380	+ }
	381	+
367	382	// Secuity checks for social login.
368		- if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
369		- add_action('init', 'loginizer_social_login_load');
	383	+ if(!empty($_GET['lz_social_provider']) && loginizer_can_login()){
	384	+ include_once LOGINIZER_DIR . '/main/social-login.php';
370	385	return;
371	386	}
372	387	}
373	388
		@@ -476,11 +491,8 @@
476	491	}
477	492
478	493	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
479	494
480		- if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
481		- \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
482		- }
483	495	return false;
484	496	}
485	497	}
486	498
		@@ -495,31 +507,26 @@
495	507
496	508	if(empty($blacklist)){
497	509	return false;
498	510	}
499		-
500		- $current_ip_inet = inet_ptoi($loginizer['current_ip']);
501		-
	511	+
502	512	foreach($blacklist as $k => $v){
503		-
504		- $start_inet = inet_ptoi($v['start']);
505		- $end_inet = inet_ptoi($v['end']);
506		-
	513	+
507	514	// Is the IP in the blacklist ?
508		- if($start_inet <= $current_ip_inet && $current_ip_inet <= $end_inet){
	515	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
509	516	$result = 1;
510	517	break;
511	518	}
512		-
	519	+
513	520	// Is it in a wider range ?
514		- if($start_inet >= 0 && $end_inet < 0){
	521	+ if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
515	522
516	523	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
517	524	// if the current IP is <= than the start of the range, it is within the range
518	525	// OR
519	526	// if the current IP is <= than the end of the range, it is within the range
520		- if($start_inet <= $current_ip_inet
521		- || $current_ip_inet <= $end_inet){
	527	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
	528	+ || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
522	529	$result = 1;
523	530	break;
524	531	}
525	532
		@@ -525,9 +532,9 @@
525	532
526	533	}
527	534
528	535	}
529		-
	536	+
530	537	// You are blacklisted
531	538	if(!empty($result)){
532	539	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
533	540	return true;
		@@ -536,8 +543,52 @@
536	543	return false;
537	544
538	545	}
539	546
	547	+function loginizer_is_whitelisted(){
	548	+
	549	+ global $wpdb, $loginizer, $lz_error;
	550	+
	551	+ $whitelist = $loginizer['whitelist'];
	552	+
	553	+ if(empty($whitelist)){
	554	+ return false;
	555	+ }
	556	+
	557	+ foreach($whitelist as $k => $v){
	558	+
	559	+ // Is the IP in the blacklist ?
	560	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	561	+ $result = 1;
	562	+ break;
	563	+ }
	564	+
	565	+ // Is it in a wider range ?
	566	+ if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
	567	+
	568	+ // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
	569	+ // if the current IP is <= than the start of the range, it is within the range
	570	+ // OR
	571	+ // if the current IP is <= than the end of the range, it is within the range
	572	+ if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
	573	+ || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	574	+ $result = 1;
	575	+ break;
	576	+ }
	577	+
	578	+ }
	579	+
	580	+ }
	581	+
	582	+ // You are whitelisted
	583	+ if(!empty($result)){
	584	+ return true;
	585	+ }
	586	+
	587	+ return false;
	588	+
	589	+}
	590	+
540	591	// When the login fails, then this is called
541	592	// We need to update the database
542	593	function loginizer_login_failed($username, $is_2fa = ''){
543	594
		@@ -556,78 +607,53 @@
556	607
557	608	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
558	609
559	610	// The params which comes when social login returns an error, have some characters, which WordPress could not save.
560		- // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
561		- $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
562		- $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
563		-
564		- if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
565		- $request_uri = explode('=', $server_uri);
	611	+ $server_uri = $_SERVER['REQUEST_URI'];
	612	+ if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
	613	+ $request_uri = explode('=', $_SERVER['REQUEST_URI']);
566	614	$server_uri = $request_uri[0];
567	615	}
568	616
569		- // No addslashes() here, $wpdb->prepare() below does the escaping
570		- $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
	617	+ $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
	618	+ $url = esc_url($url);
571	619
572		- // Must never be 0, we divide by it below
573		- $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
574		-
575		- // This way is atomic now, the earlier one were causing race condition.
576		- // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
577		- // evaluate the assignments from left to right, so lockout must NOT add 1 again
578		- $upsert = $wpdb->prepare(
579		- "INSERT INTO `".$wpdb->prefix."loginizer_logs`
580		- (username, time, count, ip, lockout, url)
581		- VALUES
582		- (%s, %d, 1, %s, FLOOR(1 / %d), %s)
583		- ON DUPLICATE KEY UPDATE
584		- username = VALUES(username),
585		- time = VALUES(time),
586		- count = count + 1,
587		- lockout = FLOOR(count / %d),
588		- url = VALUES(url)",
589		- $username,
590		- time(),
591		- $loginizer['current_ip'],
592		- $max_retries,
593		- $url,
594		- $max_retries
595		- );
596		- $wpdb->query($upsert);
597		-
598		- // Re-read the persisted row so email/retries-left reflect the actual count
599	620	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
600	621	$result = lz_selectquery($sel_query);
	622	+
	623	+ if(!empty($result)){
	624	+ $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
	625	+
	626	+ $update_data = array('username' => $username,
	627	+ 'time' => time(),
	628	+ 'count' => $result['count']+1,
	629	+ 'lockout' => $lockout,
	630	+ 'url' => $url);
	631	+
	632	+ $where_data = array('ip' => $loginizer['current_ip']);
	633	+
	634	+ $format = array('%s','%d','%d','%d','%s');
	635	+ $where_format = array('%s');
	636	+
	637	+ $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
	638	+
	639	+ // Do we need to email admin ?
	640	+ if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
	641	+
	642	+ $lockout_time = $loginizer['lockout_time'];
	643	+
	644	+ if($lockout >= $loginizer['max_lockouts']){
	645	+ // extended lockout is in hours so we have to convert to minute
	646	+ $lockout_time = $loginizer['lockouts_extend'];
	647	+ }
	648	+
	649	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	650	+ $mail = array();
	651	+ $mail['to'] = $loginizer['notify_email_address'];
	652	+ $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	653	+ $mail['message'] = 'Hi,
601	654
602		- if(empty($result)){
603		- $result = array('count' => 0);
604		- }
605		-
606		- $count = (int) $result['count'];
607		- $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
608		-
609		- // The lockout goes up only on every max_retries'th failure, which is the
610		- // attempt that actually locks the IP out. On the failures in between there
611		- // is nothing new to report, so we must not email on each one of them
612		- $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
613		-
614		- // Do we need to email admin ?
615		- if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
616		-
617		- $lockout_time = $loginizer['lockout_time'];
618		-
619		- if($lockout >= $loginizer['max_lockouts']){
620		- $lockout_time = $loginizer['lockouts_extend'];
621		- }
622		-
623		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
624		- $mail = array();
625		- $mail['to'] = $loginizer['notify_email_address'];
626		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
627		- $mail['message'] = 'Hi,
628		-
629		-'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
	655	+'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
630	656	'.home_url().'
631	657
632	658	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
633	659	Last User Attempt : '.$username.'
		@@ -635,22 +661,35 @@
635	661
636	662	Regards,
637	663	Loginizer';
638	664
639		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	665	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	666	+ }
	667	+ }else{
	668	+ $result = array();
	669	+ $result['count'] = 0;
	670	+
	671	+ $insert_data = array('username' => $username,
	672	+ 'time' => time(),
	673	+ 'count' => 1,
	674	+ 'ip' => $loginizer['current_ip'],
	675	+ 'lockout' => 0,
	676	+ 'url' => $url);
	677	+
	678	+ $format = array('%s','%d','%d','%s','%d','%s');
	679	+
	680	+ $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
640	681	}
641		-
	682	+
	683	+ // We need to add one as this is a failed attempt as well
	684	+ $result['count'] = $result['count'] + 1;
642	685	loginizer_update_attempt_stats(0);
643		- $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
644		- $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
	686	+ $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
	687	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
645	688
646	689	}
647	690	}
648	691
649		-function loginizer_rsssl_2fa_success($user){
650		- loginizer_login_success('', $user);
651		-}
652		-
653	692	function loginizer_login_success($user_login, $user) {
654	693	global $wp_version, $loginizer;
655	694
656	695	loginizer_update_attempt_stats(1);
		@@ -804,22 +843,11 @@
804	843	wc_add_notice( loginizer_retries_left(), 'error' );
805	844	}
806	845	}
807	846
808		-function loginizer_ultimatemember_error_handler(){
809		-
810		- if(class_exists('UM')){
811		- \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
812		- }
813		-}
814		-
815	847	// Handles social login URL
816	848	function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
817	849	global $loginizer;
818		-
819		- if(loginizer_is_blacklisted()){
820		- return $errors;
821		- }
822	850
823	851	loginizer_get_social_error();
824	852
825	853	if(empty($loginizer['social_errors'])){
		@@ -916,12 +944,8 @@
916	944	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
917	945	}
918	946	}
919	947
920		-}
921		-
922		-function loginizer_social_login_load(){
923		- include_once LOGINIZER_DIR . '/main/social-login.php';
924	948	}
925	949
926	950	// Checks if softaculous is installed on the server.
927	951	function loginizer_check_softaculous(){