← All changes | init.php +63 -80 2.1.0 → 2.0.6 View file →

		@@ -4,9 +4,9 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '2.1.0');
	8	+define('LOGINIZER_VERSION', '2.0.6');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
		@@ -332,22 +332,21 @@
332	332	// Is called before displaying the error message so that we dont show that the username is wrong or the password
333	333	// Update Error message
334	334	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335	335	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336		- add_action('wp_login', 'loginizer_login_success', 11, 2);
337		- add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
	336	+ add_action('wp_login', 'loginizer_login_success', 10, 2);
338	337
339	338	if(!empty($loginizer['ultimate-member-active'])){
340	339	add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
341	340	}
342	341
343		- if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings'])){
	342	+ if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
344	343	add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
345	344	}
346	345	}
347	346
348	347	// Social Login Form Actions
349		- if(!empty($loginizer['social_settings'])){
	348	+ if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
350	349	if(!empty($loginizer['social_settings']['login']['login_form'])){
351	350	add_action('login_form', 'loginizer_social_btn_login');
352	351	}
353	352	}
		@@ -556,78 +555,53 @@
556	555
557	556	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
558	557
559	558	// The params which comes when social login returns an error, have some characters, which WordPress could not save.
560		- // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
561		- $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
562		- $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
563		-
564		- if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
565		- $request_uri = explode('=', $server_uri);
	559	+ $server_uri = $_SERVER['REQUEST_URI'];
	560	+ if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
	561	+ $request_uri = explode('=', $_SERVER['REQUEST_URI']);
566	562	$server_uri = $request_uri[0];
567	563	}
568	564
569		- // No addslashes() here, $wpdb->prepare() below does the escaping
570		- $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
	565	+ $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
	566	+ $url = esc_url($url);
571	567
572		- // Must never be 0, we divide by it below
573		- $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
574		-
575		- // This way is atomic now, the earlier one were causing race condition.
576		- // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
577		- // evaluate the assignments from left to right, so lockout must NOT add 1 again
578		- $upsert = $wpdb->prepare(
579		- "INSERT INTO `".$wpdb->prefix."loginizer_logs`
580		- (username, time, count, ip, lockout, url)
581		- VALUES
582		- (%s, %d, 1, %s, FLOOR(1 / %d), %s)
583		- ON DUPLICATE KEY UPDATE
584		- username = VALUES(username),
585		- time = VALUES(time),
586		- count = count + 1,
587		- lockout = FLOOR(count / %d),
588		- url = VALUES(url)",
589		- $username,
590		- time(),
591		- $loginizer['current_ip'],
592		- $max_retries,
593		- $url,
594		- $max_retries
595		- );
596		- $wpdb->query($upsert);
597		-
598		- // Re-read the persisted row so email/retries-left reflect the actual count
599	568	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
600	569	$result = lz_selectquery($sel_query);
	570	+
	571	+ if(!empty($result)){
	572	+ $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
	573	+
	574	+ $update_data = array('username' => $username,
	575	+ 'time' => time(),
	576	+ 'count' => $result['count']+1,
	577	+ 'lockout' => $lockout,
	578	+ 'url' => $url);
	579	+
	580	+ $where_data = array('ip' => $loginizer['current_ip']);
	581	+
	582	+ $format = array('%s','%d','%d','%d','%s');
	583	+ $where_format = array('%s');
	584	+
	585	+ $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
	586	+
	587	+ // Do we need to email admin ?
	588	+ if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
	589	+
	590	+ $lockout_time = $loginizer['lockout_time'];
	591	+
	592	+ if($lockout >= $loginizer['max_lockouts']){
	593	+ // extended lockout is in hours so we have to convert to minute
	594	+ $lockout_time = $loginizer['lockouts_extend'];
	595	+ }
	596	+
	597	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	598	+ $mail = array();
	599	+ $mail['to'] = $loginizer['notify_email_address'];
	600	+ $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	601	+ $mail['message'] = 'Hi,
601	602
602		- if(empty($result)){
603		- $result = array('count' => 0);
604		- }
605		-
606		- $count = (int) $result['count'];
607		- $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
608		-
609		- // The lockout goes up only on every max_retries'th failure, which is the
610		- // attempt that actually locks the IP out. On the failures in between there
611		- // is nothing new to report, so we must not email on each one of them
612		- $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
613		-
614		- // Do we need to email admin ?
615		- if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
616		-
617		- $lockout_time = $loginizer['lockout_time'];
618		-
619		- if($lockout >= $loginizer['max_lockouts']){
620		- $lockout_time = $loginizer['lockouts_extend'];
621		- }
622		-
623		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
624		- $mail = array();
625		- $mail['to'] = $loginizer['notify_email_address'];
626		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
627		- $mail['message'] = 'Hi,
628		-
629		-'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
	603	+'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
630	604	'.home_url().'
631	605
632	606	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
633	607	Last User Attempt : '.$username.'
		@@ -635,22 +609,35 @@
635	609
636	610	Regards,
637	611	Loginizer';
638	612
639		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	613	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
	614	+ }
	615	+ }else{
	616	+ $result = array();
	617	+ $result['count'] = 0;
	618	+
	619	+ $insert_data = array('username' => $username,
	620	+ 'time' => time(),
	621	+ 'count' => 1,
	622	+ 'ip' => $loginizer['current_ip'],
	623	+ 'lockout' => 0,
	624	+ 'url' => $url);
	625	+
	626	+ $format = array('%s','%d','%d','%s','%d','%s');
	627	+
	628	+ $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
640	629	}
641		-
	630	+
	631	+ // We need to add one as this is a failed attempt as well
	632	+ $result['count'] = $result['count'] + 1;
642	633	loginizer_update_attempt_stats(0);
643		- $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
644		- $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
	634	+ $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
	635	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
645	636
646	637	}
647	638	}
648	639
649		-function loginizer_rsssl_2fa_success($user){
650		- loginizer_login_success('', $user);
651		-}
652		-
653	640	function loginizer_login_success($user_login, $user) {
654	641	global $wp_version, $loginizer;
655	642
656	643	loginizer_update_attempt_stats(1);
		@@ -814,12 +801,8 @@
814	801
815	802	// Handles social login URL
816	803	function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
817	804	global $loginizer;
818		-
819		- if(loginizer_is_blacklisted()){
820		- return $errors;
821		- }
822	805
823	806	loginizer_get_social_error();
824	807
825	808	if(empty($loginizer['social_errors'])){