PluginProbe
Loginizer / 2.0.7
Loginizer v2.0.7
2.1.0 2.0.9 2.0.8 1.9.8 1.9.9 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 trunk 1.0 1.0.1 1.0.2 1.1.0 1.1.1 1.2.0 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 All 74 releases
← All changes | init.php +556 -1122 1.3.0 → 2.0.7 View file →
@@ -4,12 +4,14 @@
4 4 echo 'You are not allowed to access this page directly.';
5 5 exit;
6 6 }
7 7
8 -define('LOGINIZER_VERSION', '1.3.0');
9 -define('LOGINIZER_DIR', WP_PLUGIN_DIR.'/'.basename(dirname(LOGINIZER_FILE)));
8 +define('LOGINIZER_VERSION', '2.0.7');
9 +define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10 10 define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11 11 define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12 +define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
13 +define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');
12 14
13 15 include_once(LOGINIZER_DIR.'/functions.php');
14 16
15 17 // Ok so we are now ready to go
@@ -22,9 +24,9 @@
22 24
23 25 $sql = array();
24 26
25 27 $sql[] = "DROP TABLE IF EXISTS `".$wpdb->prefix."loginizer_logs`";
26 -
28 +
27 29 $sql[] = "CREATE TABLE `".$wpdb->prefix."loginizer_logs` (
28 30 `username` varchar(255) NOT NULL DEFAULT '',
29 31 `time` int(10) NOT NULL DEFAULT '0',
30 32 `count` int(10) NOT NULL DEFAULT '0',
@@ -29,10 +31,11 @@
29 31 `time` int(10) NOT NULL DEFAULT '0',
30 32 `count` int(10) NOT NULL DEFAULT '0',
31 33 `lockout` int(10) NOT NULL DEFAULT '0',
32 34 `ip` varchar(255) NOT NULL DEFAULT '',
35 + `url` varchar(255) NOT NULL DEFAULT '',
33 36 UNIQUE KEY `ip` (`ip`)
34 - ) ENGINE=MyISAM DEFAULT CHARSET=utf8;";
37 + ) DEFAULT CHARSET=utf8;";
35 38
36 39 foreach($sql as $sk => $sv){
37 40 $wpdb->query($sv);
38 41 }
@@ -41,12 +44,24 @@
41 44 add_option('loginizer_options', array());
42 45 add_option('loginizer_last_reset', 0);
43 46 add_option('loginizer_whitelist', array());
44 47 add_option('loginizer_blacklist', array());
45 -
48 + add_option('loginizer_2fa_whitelist', array());
49 +
50 + // TODO:: REMOVE THIS AFTER MARCH 2025
51 + $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
52 + if(!defined('SITEPAD') && empty($softwp_upgrade)){
53 + loginizer_check_softaculous();
54 + }
46 55 }
47 56
48 -// Checks if we are to update ?
57 +/**
58 + * Updates the database structure for Loginizer
59 + *
60 + * If the plugin files are updated but database structure is not updated
61 + * this function will update the database structure as per the plugin version
62 + * NOTE: This does not update plugin files it just updates the database structure
63 + */
49 64 function loginizer_update_check(){
50 65
51 66 global $wpdb;
52 67
@@ -74,9 +89,9 @@
74 89 // Trick the following if conditions to not run
75 90 $version = (int) str_replace('.', '', LOGINIZER_VERSION);
76 91
77 92 }
78 -
93 +
79 94 // Is it less than 1.0.1 ?
80 95 if($version < 101){
81 96
82 97 // TODO : GET the existing settings
@@ -106,9 +121,17 @@
106 121
107 122 // Update the existing failed logs to new table
108 123 if(is_array($lz_failed_logs)){
109 124 foreach($lz_failed_logs as $fk => $fv){
110 - $wpdb->query("INSERT INTO ".$wpdb->prefix."loginizer_logs SET `username` = '".$fv['username']."', `time` = '".$fv['time']."', `count` = '".$fv['count']."', `lockout` = '".$fv['lockout']."', `ip` = '".$fv['ip']."';");
125 + $insert_data = array('username' => $fv['username'],
126 + 'time' => $fv['time'],
127 + 'count' => $fv['count'],
128 + 'lockout' => $fv['lockout'],
129 + 'ip' => $fv['ip']);
130 +
131 + $format = array('%s','%d','%d','%d','%s');
132 +
133 + $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
111 134 }
112 135 }
113 136
114 137 // Update the existing options to new structure
@@ -157,11 +180,51 @@
157 180 }
158 181
159 182 }
160 183
184 + // Is it less than 1.3.9 ?
185 + if($version < 139){
186 +
187 + $wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188 +
189 + }
190 +
191 + // Setting alignment to left in social login ?
192 + if($version < 201){
193 + $social_settings = get_option('loginizer_social_settings', []);
194 +
195 + if(!empty($social_settings)){
196 + if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
197 + $social_settings['login']['button_alignment'] = 'left';
198 + }
199 +
200 + if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
201 + $social_settings['woocommerce']['button_alignment'] = 'left';
202 + }
203 +
204 + if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
205 + $social_settings['comment']['button_alignment'] = 'left';
206 + }
207 +
208 + update_option('loginizer_social_settings', $social_settings);
209 + }
210 + }
211 +
161 212 // Save the new Version
162 213 update_option('loginizer_version', LOGINIZER_VERSION);
163 214
215 + // TODO:: REMOVE THIS AFTER MARCH 2025
216 + $softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
217 + if(!defined('SITEPAD') && empty($softwp_upgrade)){
218 + loginizer_check_softaculous();
219 + }
220 +
221 + // In Sitepad Math Captcha is enabled by default
222 + if(defined('SITEPAD') && get_option('loginizer_captcha') === false){
223 + $option['captcha_no_google'] = 1;
224 + add_option('loginizer_captcha', $option);
225 + }
226 +
164 227 }
165 228
166 229 // Add the action to load the plugin
167 230 add_action('plugins_loaded', 'loginizer_load_plugin');
@@ -172,12 +235,27 @@
172 235 global $loginizer;
173 236
174 237 // Check if the installed version is outdated
175 238 loginizer_update_check();
239 +
240 + // Set the array
241 + if(empty($loginizer)){
242 + $loginizer = array();
243 + }
176 244
245 + $loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
246 + $loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
247 + $loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
248 + $loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
249 +
250 + // The IP Method to use
251 + $loginizer['ip_method'] = get_option('loginizer_ip_method');
252 + if($loginizer['ip_method'] == 3){
253 + $loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
254 + }
255 +
256 + // Load settings
177 257 $options = get_option('loginizer_options');
178 -
179 - $loginizer = array();
180 258 $loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
181 259 $loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
182 260 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
183 261 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
@@ -182,15 +260,43 @@
182 260 $loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
183 261 $loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
184 262 $loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
185 263 $loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
186 -
264 + $loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
265 + $loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
266 + $loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
267 + $loginizer['social_settings'] = get_option('loginizer_social_settings', []);
268 +
269 + if(!empty($options['notify_email_address'])){
270 + $loginizer['notify_email_address'] = $options['notify_email_address'];
271 + $loginizer['custom_notify_email'] = 1;
272 + }
273 +
274 + // Login Success Email Notification.
275 + $loginizer['login_mail'] = get_option('loginizer_login_mail', []);
276 + add_action('init', 'loginizer_load_translation_vars', 0);
277 +
278 + $loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
279 + $loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];
280 +
187 281 // Load the blacklist and whitelist
188 - $loginizer['blacklist'] = get_option('loginizer_blacklist');
189 - $loginizer['whitelist'] = get_option('loginizer_whitelist');
282 + $loginizer['blacklist'] = get_option('loginizer_blacklist', []);
283 + $loginizer['whitelist'] = get_option('loginizer_whitelist', []);
284 + $loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
190 285
286 + // It should not be false
287 + if(empty($loginizer['2fa_whitelist'])){
288 + $loginizer['2fa_whitelist'] = array();
289 + }
290 +
191 291 // When was the database cleared last time
192 292 $loginizer['last_reset'] = get_option('loginizer_last_reset');
293 +
294 + if(!isset($loginizer['ultimate-member-active'])){
295 + $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
296 +
297 + $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
298 + }
193 299
194 300 //print_r($loginizer);
195 301
196 302 // Clear retries
@@ -206,34 +312,63 @@
206 312 $loginizer['ins_time'] = $ins_time;
207 313
208 314 // Set the current IP
209 315 $loginizer['current_ip'] = lz_getip();
316 +
317 + // Is Brute Force Disabled ?
318 + $loginizer['disable_brute'] = get_option('loginizer_disable_brute');
210 319
211 - /* Filters and actions */
320 + // Filters and actions
321 + if(empty($loginizer['disable_brute'])){
212 322
213 - // Use this to verify before WP tries to login
214 - // Is always called and is the first function to be called
215 - //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
216 - add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
217 -
218 - // Is called when a login attempt fails
219 - // Hence Update our records that the login failed
220 - add_action('wp_login_failed', 'loginizer_login_failed');
221 -
222 - // Is called before displaying the error message so that we dont show that the username is wrong or the password
223 - // Update Error message
224 - add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
225 -
226 - // Is the premium features there ?
227 - if(file_exists(LOGINIZER_DIR.'/premium.php')){
323 + // Use this to verify before WP tries to login
324 + // Is always called and is the first function to be called
325 + //add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
326 + add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
228 327
229 - // Include the file
230 - include_once(LOGINIZER_DIR.'/premium.php');
328 + // Is called when a login attempt fails
329 + // Hence Update our records that the login failed
330 + add_action('wp_login_failed', 'loginizer_login_failed');
231 331
232 - loginizer_security_init();
332 + // Is called before displaying the error message so that we dont show that the username is wrong or the password
333 + // Update Error message
334 + add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335 + add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336 + add_action('wp_login', 'loginizer_login_success', 10, 2);
233 337
338 + if(!empty($loginizer['ultimate-member-active'])){
339 + add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
340 + }
341 +
342 + if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
343 + add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
344 + }
234 345 }
346 +
347 + // Social Login Form Actions
348 + if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
349 + if(!empty($loginizer['social_settings']['login']['login_form'])){
350 + add_action('login_form', 'loginizer_social_btn_login');
351 + }
352 + }
235 353
354 + if((function_exists('wp_doing_ajax') && wp_doing_ajax()) || (defined( 'DOING_AJAX' ) && DOING_AJAX)){
355 + include_once LOGINIZER_DIR . '/main/ajax.php';
356 + }
357 +
358 + if(is_admin()){
359 + include_once LOGINIZER_DIR . '/main/admin.php';
360 + }
361 +
362 + // ----------------
363 + // PRO INIT END
364 + // ----------------
365 +
366 + // Secuity checks for social login.
367 + if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
368 + add_action('init', 'loginizer_social_login_load');
369 + return;
370 + }
236 371 }
237 372
238 373 // Should return NULL if everything is fine
239 374 function loginizer_wp_authenticate($user, $username, $password){
@@ -247,24 +382,67 @@
247 382 // Are you whitelisted ?
248 383 if(loginizer_is_whitelisted()){
249 384 $loginizer['ip_is_whitelisted'] = 1;
250 385 return $user;
386 +
387 + } else if (!empty($loginizer['trusted_ips'])){
388 + $lz_cannot_login = 1;
389 +
390 + // This is used by WP Activity Log
391 + apply_filters( 'wp_login_blocked', $username );
392 +
393 + // Shows a blocked screen
394 + if(!empty($loginizer['blocked_screen'])){
395 + $lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
396 + loginizer_blocked_page($lz_error);
397 + }
398 +
399 + return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
251 400 }
252 401
253 402 // Are you blacklisted ?
254 403 if(loginizer_is_blacklisted()){
255 404 $lz_cannot_login = 1;
405 +
406 + // This is used by WP Activity Log
407 + apply_filters( 'wp_login_blocked', $username );
408 +
409 + // Shows a blocked screen
410 + if(!empty($loginizer['blocked_screen'])){
411 + loginizer_blocked_page($lz_error);
412 + }
413 +
256 414 return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
257 415 }
258 416
417 + // Is the username blacklisted ?
418 + if(function_exists('loginizer_user_blacklisted')){
419 + if(loginizer_user_blacklisted($username)){
420 + $lz_cannot_login = 1;
421 +
422 + // This is used by WP Activity Log
423 + apply_filters( 'wp_login_blocked', $username );
424 +
425 + return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
426 + }
427 + }
428 +
259 429 if(loginizer_can_login()){
260 430 return $user;
261 431 }
262 432
263 433 $lz_cannot_login = 1;
434 +
435 + // This is used by WP Activity Log
436 + apply_filters( 'wp_login_blocked', $username );
264 437
438 + // Shows a blocked screen
439 + if(!empty($loginizer['blocked_screen'])){
440 + loginizer_blocked_page($lz_error);
441 + }
442 +
265 443 return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');
266 -
444 +
267 445 }
268 446
269 447 function loginizer_can_login(){
270 448
@@ -270,12 +448,13 @@
270 448
271 449 global $wpdb, $loginizer, $lz_error;
272 450
273 451 // Get the logs
274 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
452 + $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
453 + $result = lz_selectquery($sel_query);
275 454
276 455 if(!empty($result['count']) && ($result['count'] % $loginizer['max_retries']) == 0){
277 -
456 +
278 457 // Has he reached max lockouts ?
279 458 if($result['lockout'] >= $loginizer['max_lockouts']){
280 459 $loginizer['lockout_time'] = $loginizer['lockouts_extend'];
281 460 }
@@ -283,21 +462,24 @@
283 462 // Is he in the lockout time ?
284 463 if($result['time'] >= (time() - $loginizer['lockout_time'])){
285 464 $banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
286 465
287 - //echo 'Current Time '.date('m/d/Y H:i:s', time()).'<br />';
288 - //echo 'Last attempt '.date('m/d/Y H:i:s', $result['time']).'<br />';
289 - //echo 'Unlock Time '.date('m/d/Y H:i:s', $result['time'] + $loginizer['lockout_time']).'<br />';
466 + //echo 'Current Time '.date('d/M/Y H:i:s P', time()).'<br />';
467 + //echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'<br />';
468 + //echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'<br />';
290 469
291 - $_time = $banlift.' minute(s)';
470 + $_time = $banlift.' '.$loginizer['msg']['minutes_err'];
292 471
293 472 if($banlift > 60){
294 473 $banlift = ceil($banlift / 60);
295 - $_time = $banlift.' hour(s)';
474 + $_time = $banlift.' '.$loginizer['msg']['hours_err'];
296 475 }
297 476
298 - $lz_error['ip_blocked'] = 'You have exceeded maximum login retries<br /> Please try after '.$_time;
477 + $lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
299 478
479 + if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
480 + \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
481 + }
300 482 return false;
301 483 }
302 484 }
303 485
@@ -307,27 +489,36 @@
307 489 function loginizer_is_blacklisted(){
308 490
309 491 global $wpdb, $loginizer, $lz_error;
310 492
311 - $blacklist = $loginizer['blacklist'];
312 -
493 + $blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
494 +
495 + if(empty($blacklist)){
496 + return false;
497 + }
498 +
499 + $current_ip_inet = inet_ptoi($loginizer['current_ip']);
500 +
313 501 foreach($blacklist as $k => $v){
314 -
502 +
503 + $start_inet = inet_ptoi($v['start']);
504 + $end_inet = inet_ptoi($v['end']);
505 +
315 506 // Is the IP in the blacklist ?
316 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
507 + if($start_inet <= $current_ip_inet && $current_ip_inet <= $end_inet){
317 508 $result = 1;
318 509 break;
319 510 }
320 -
511 +
321 512 // Is it in a wider range ?
322 - if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
513 + if($start_inet >= 0 && $end_inet < 0){
323 514
324 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
515 + // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
325 516 // if the current IP is <= than the start of the range, it is within the range
326 517 // OR
327 518 // if the current IP is <= than the end of the range, it is within the range
328 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
329 - || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
519 + if($start_inet <= $current_ip_inet
520 + || $current_ip_inet <= $end_inet){
330 521 $result = 1;
331 522 break;
332 523 }
333 524
@@ -333,12 +524,12 @@
333 524
334 525 }
335 526
336 527 }
337 -
528 +
338 529 // You are blacklisted
339 530 if(!empty($result)){
340 - $lz_error['ip_blacklisted'] = 'Your IP has been blacklisted';
531 + $lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
341 532 return true;
342 533 }
343 534
344 535 return false;
@@ -344,77 +535,78 @@
344 535 return false;
345 536
346 537 }
347 538
348 -function loginizer_is_whitelisted(){
539 +// When the login fails, then this is called
540 +// We need to update the database
541 +function loginizer_login_failed($username, $is_2fa = ''){
349 542
350 - global $wpdb, $loginizer, $lz_error;
543 + global $wpdb, $loginizer, $lz_cannot_login;
351 544
352 - $whitelist = $loginizer['whitelist'];
353 -
354 - foreach($whitelist as $k => $v){
355 -
356 - // Is the IP in the blacklist ?
357 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip']) && ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
358 - $result = 1;
359 - break;
360 - }
361 -
362 - // Is it in a wider range ?
363 - if(ip2long($v['start']) >= 0 && ip2long($v['end']) < 0){
364 -
365 - // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of ip2long,
366 - // if the current IP is <= than the start of the range, it is within the range
367 - // OR
368 - // if the current IP is <= than the end of the range, it is within the range
369 - if(ip2long($v['start']) <= ip2long($loginizer['current_ip'])
370 - || ip2long($loginizer['current_ip']) <= ip2long($v['end'])){
371 - $result = 1;
372 - break;
373 - }
374 -
375 - }
376 -
545 + // Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
546 + if(empty($username) || is_null($username)){
547 + $username = '';
377 548 }
378 -
379 - // You are whitelisted
380 - if(!empty($result)){
381 - return true;
382 - }
383 549
384 - return false;
550 + $fail_type = 'Login';
385 551
386 -}
552 + if(!empty($is_2fa)){
553 + $fail_type = '2FA';
554 + }
387 555
556 + if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
557 +
558 + // The params which comes when social login returns an error, have some characters, which WordPress could not save.
559 + $server_uri = $_SERVER['REQUEST_URI'];
560 + if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
561 + $request_uri = explode('=', $_SERVER['REQUEST_URI']);
562 + $server_uri = $request_uri[0];
563 + }
388 564
389 -// When the login fails, then this is called
390 -// We need to update the database
391 -function loginizer_login_failed($username){
392 -
393 - global $wpdb, $loginizer, $lz_cannot_login;
394 -
395 - if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
565 + $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
566 + $url = esc_url($url);
396 567
397 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = '".$loginizer['current_ip']."';");
568 + $sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
569 + $result = lz_selectquery($sel_query);
398 570
399 571 if(!empty($result)){
400 572 $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
401 - $sresult = $wpdb->query("UPDATE `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = `count`+1, `lockout` = '".$lockout."' WHERE `ip` = '".$loginizer['current_ip']."';");
402 573
574 + $update_data = array('username' => $username,
575 + 'time' => time(),
576 + 'count' => $result['count']+1,
577 + 'lockout' => $lockout,
578 + 'url' => $url);
579 +
580 + $where_data = array('ip' => $loginizer['current_ip']);
581 +
582 + $format = array('%s','%d','%d','%d','%s');
583 + $where_format = array('%s');
584 +
585 + $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
586 +
403 587 // Do we need to email admin ?
404 588 if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
405 589
590 + $lockout_time = $loginizer['lockout_time'];
591 +
592 + if($lockout >= $loginizer['max_lockouts']){
593 + // extended lockout is in hours so we have to convert to minute
594 + $lockout_time = $loginizer['lockouts_extend'];
595 + }
596 +
406 597 $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
407 598 $mail = array();
408 - $mail['to'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
409 - $mail['subject'] = 'Failed Login Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
599 + $mail['to'] = $loginizer['notify_email_address'];
600 + $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
410 601 $mail['message'] = 'Hi,
411 602
412 -'.($result['count']+1).' failed login attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].'
603 +'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
604 +'.home_url().'
413 605
414 -Last Login Attempt : '.date('d/m/Y H:i:s', time()).'
606 +Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
415 607 Last User Attempt : '.$username.'
416 -IP has been blocked until : '.date('d/m/Y H:i:s', time() + $loginizer['lockout_time']).'
608 +IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'
417 609
418 610 Regards,
419 611 Loginizer';
420 612
@@ -420,13 +612,26 @@
420 612
421 613 @wp_mail($mail['to'], $mail['subject'], $mail['message']);
422 614 }
423 615 }else{
424 - $insert = $wpdb->query("INSERT INTO `".$wpdb->prefix."loginizer_logs` SET `username` = '".$username."', `time` = '".time()."', `count` = '1', `ip` = '".$loginizer['current_ip']."', `lockout` = '0';");
616 + $result = array();
617 + $result['count'] = 0;
618 +
619 + $insert_data = array('username' => $username,
620 + 'time' => time(),
621 + 'count' => 1,
622 + 'ip' => $loginizer['current_ip'],
623 + 'lockout' => 0,
624 + 'url' => $url);
625 +
626 + $format = array('%s','%d','%d','%s','%d','%s');
627 +
628 + $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
425 629 }
426 630
427 631 // We need to add one as this is a failed attempt as well
428 632 $result['count'] = $result['count'] + 1;
633 + loginizer_update_attempt_stats(0);
429 634 $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
430 635 $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
431 636
432 637 }
@@ -431,15 +636,123 @@
431 636
432 637 }
433 638 }
434 639
640 +function loginizer_login_success($user_login, $user) {
641 + global $wp_version, $loginizer;
642 +
643 + loginizer_update_attempt_stats(1);
644 +
645 + if(empty($loginizer['login_mail'])){
646 + return;
647 + }
648 +
649 + if(empty($loginizer['login_mail']['enable'])){
650 + return;
651 + }
652 +
653 + if(!empty($loginizer['login_mail']['disable_whitelist'])){
654 + // Check its whitelist ip
655 + if(loginizer_is_whitelisted()){
656 + return;
657 + }
658 + }
659 +
660 + if(empty($user_login) && empty($user)){
661 + error_log('Loginizer: No user information to send email');
662 + return;
663 + }
664 +
665 + if(empty($user)){
666 + $user = get_user_by('login', $user_login);
667 + }
668 +
669 + if(empty($user)){
670 + error_log('Loginizer: Unable to get the user');
671 + return;
672 + }
673 +
674 + if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
675 + return;
676 + }
677 +
678 + // Check if the user role is enabled for email notification.
679 + if(!array_intersect($user->roles, $loginizer['login_mail']['roles'])){
680 + return;
681 + }
682 +
683 + // current_datetime & wp_timezone_string were introduced in WordPress 5.3
684 + if(!empty($wp_version) && version_compare($wp_version, '5.3', '>') && function_exists('current_datetime')){
685 + $time_zone = wp_timezone_string();
686 +
687 + if(!empty($time_zone) && isset($time_zone[1]) && is_numeric($time_zone[1])){
688 + $time_zone = 'UTC'.$time_zone;
689 + }
690 +
691 + // Setting up data variables.
692 + $date = current_datetime()->format('Y-m-d H:i:s') .' '. $time_zone;
693 + } else {
694 + $date = date("Y-m-d H:i:s", time()) . ' ' . date_default_timezone_get();
695 + }
696 +
697 + $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
698 + $email = $user->data->user_email;
699 +
700 + $vars = array(
701 + 'date' => $date,
702 + 'ip' => esc_html($loginizer['current_ip']),
703 + 'sitename' => $sitename,
704 + 'user_login' => $user_login
705 + );
706 +
707 + $message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
708 + $subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
709 +
710 + $headers = [];
711 +
712 + // Do we need to send the email as HTML ?
713 + if(!empty($loginizer['login_mail']['html_mail'])){
714 + $headers[] = 'Content-Type: text/html; charset=UTF-8';
715 +
716 + if(!empty($loginizer['login_mail']['body'])){
717 + $message = html_entity_decode($message);
718 + }else{
719 + $message = preg_replace("/\<br\s*\/\>/i", "<br/>", $message);
720 + $message = preg_replace('/(?<!<br\/>)\n/i', "<br/>\n", $message);
721 + }
722 + }
723 +
724 + // Sending notification
725 + if(empty(wp_mail($email, $subject, $message, $headers))){
726 + error_log(__('There was a problem sending your email.', 'loginizer'));
727 + return;
728 + }
729 +}
730 +
731 +function loginizer_update_attempt_stats($type){
732 +
733 + $stats = get_option('loginizer_login_attempt_stats', []);
734 + $time = strtotime(date('Y-m-d H:00:00'));
735 +
736 + if(empty($stats[$time][$type])){
737 + $stats[$time][$type] = 0;
738 + }
739 +
740 + $stats[$time][$type] += 1;
741 +
742 + update_option('loginizer_login_attempt_stats', $stats, false);
743 +}
744 +
435 745 // Handles the error of the password not being there
436 746 function loginizer_error_handler($errors, $redirect_to){
437 747
438 748 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
439 -
749 +
440 750 //echo 'loginizer_error_handler :';print_r($errors->errors);echo '<br>';
441 -
751 + if(is_null($errors) || empty($errors)){
752 + return true;
753 + }
754 +
442 755 // Remove the empty password error
443 756 if(is_wp_error($errors)){
444 757
445 758 $codes = $errors->get_error_codes();
@@ -451,1091 +764,197 @@
451 764 }
452 765
453 766 $errors->remove('invalid_username');
454 767 $errors->remove('incorrect_password');
768 +
769 + // Add the error
770 + if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
771 + $errors->add('invalid_userpass', '<b>ERROR:</b> ' . $loginizer['msg']['inv_userpass']);
772 + }
455 773
774 + // Add the number of retires left as well
775 + if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
776 + $errors->add('retries_left', loginizer_retries_left());
777 + }
778 +
456 779 }
457 780
458 - // Add the error
459 - if(!empty($lz_user_pass) && !empty($show_error) && empty($lz_cannot_login)){
460 - $errors->add('invalid_userpass', '<b>ERROR:</b> Incorrect Username or Password');
461 - }
462 -
463 - // Add the number of retires left as well
464 - if(count($errors->get_error_codes()) > 0 && isset($loginizer['retries_left'])){
465 - $errors->add('retries_left', loginizer_retries_left());
466 - }
467 -
468 781 return $errors;
469 782
470 783 }
471 784
472 -// Returns a string with the number of retries left
473 -function loginizer_retries_left(){
474 -
785 +// Handles the error of the password not being there
786 +function loginizer_woocommerce_error_handler(){
787 +
475 788 global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
476 789
477 - // If we are to show the number of retries left
478 - if(isset($loginizer['retries_left'])){
479 - return '<b>'.$loginizer['retries_left'].'</b> attempt(s) left';
790 + if(function_exists('wc_add_notice')){
791 + wc_add_notice( loginizer_retries_left(), 'error' );
480 792 }
481 -
482 793 }
483 794
484 -function loginizer_reset_retries(){
795 +function loginizer_ultimatemember_error_handler(){
485 796
486 - global $wpdb, $loginizer;
487 -
488 - $deltime = time() - $loginizer['reset_retries'];
489 - $result = $wpdb->query("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= '".$deltime."';");
490 -
491 - update_option('loginizer_last_reset', time());
492 -
797 + if(class_exists('UM')){
798 + \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
799 + }
493 800 }
494 801
495 -add_filter("plugin_action_links_$plugin_loginizer", 'loginizer_plugin_action_links');
802 +// Handles social login URL
803 +function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
804 + global $loginizer;
496 805
497 -// Add settings link on plugin page
498 -function loginizer_plugin_action_links($links) {
499 -
500 - if(!defined('LOGINIZER_PREMIUM')){
501 - $links[] = '<a href="'.LOGINIZER_PRO_URL.'" style="color:#3db634;" target="_blank">'._x('Upgrade', 'Plugin action link label.', 'loginizer').'</a>';
806 + loginizer_get_social_error();
807 +
808 + if(empty($loginizer['social_errors'])){
809 + return $errors;
502 810 }
503 811
504 - $settings_link = '<a href="admin.php?page=loginizer">Settings</a>';
505 - array_unshift($links, $settings_link);
506 -
507 - return $links;
812 + if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
813 + $errors = new WP_Error();
814 + }
815 +
816 + foreach($loginizer['social_errors'] as $key => $text){
817 + $errors->add($key, $text);
818 + }
819 +
820 + return $errors;
508 821 }
509 822
510 -add_action('admin_menu', 'loginizer_admin_menu');
511 -
512 -// Shows the admin menu of Loginizer
513 -function loginizer_admin_menu() {
823 +// Returns a string with the number of retries left
824 +function loginizer_retries_left(){
514 825
515 - global $wp_version, $loginizer;
826 + global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
516 827
517 - // Add the menu page
518 - add_menu_page(__('Loginizer Dashboard'), __('Loginizer Security'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
519 -
520 - // Dashboard
521 - add_submenu_page('loginizer', __('Loginizer Dashboard'), __('Dashboard'), 'activate_plugins', 'loginizer', 'loginizer_page_dashboard');
522 -
523 - // Brute Force
524 - add_submenu_page('loginizer', __('Loginizer Brute Force Settings'), __('Brute Force'), 'activate_plugins', 'loginizer_brute_force', 'loginizer_page_brute_force');
525 -
526 - if(defined('LOGINIZER_PREMIUM')){
527 -
528 - // PasswordLess
529 - add_submenu_page('loginizer', __('Loginizer PasswordLess Settings'), __('PasswordLess'), 'activate_plugins', 'loginizer_passwordless', 'loginizer_page_passwordless');
828 + // If we are to show the number of retries left
829 + if(isset($loginizer['retries_left'])){
830 + $retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
530 831
531 - // Two Factor Auth
532 - add_submenu_page('loginizer', __('Loginizer Two Factor Authentication'), __('Two Factor Auth'), 'activate_plugins', 'loginizer_2fa', 'loginizer_page_2fa');
533 -
534 - // reCaptcha
535 - add_submenu_page('loginizer', __('Loginizer reCAPTCHA Settings'), __('reCAPTCHA'), 'activate_plugins', 'loginizer_recaptcha', 'loginizer_page_recaptcha');
536 -
537 - // Security Settings
538 - add_submenu_page('loginizer', __('Loginizer Security Settings'), __('Security Settings'), 'activate_plugins', 'loginizer_security', 'loginizer_page_security');
539 -
540 - // Security Settings
541 - add_submenu_page('loginizer', __('Loginizer File Checksums'), __('File Checksums'), 'activate_plugins', 'loginizer_checksums', 'loginizer_page_checksums');
542 -
543 - }elseif(!defined('LOGINIZER_PREMIUM') && !empty($loginizer['ins_time']) && $loginizer['ins_time'] < (time() - (30*24*3600))){
544 -
545 - // Go Pro link
546 - add_submenu_page('loginizer', __('Loginizer Go Pro'), __('Go Pro'), 'activate_plugins', LOGINIZER_PRO_URL);
547 -
832 + return '<b>'.esc_html($retries_left).'</b> '.$loginizer['msg']['attempts_left'];
548 833 }
549 834
550 835 }
551 836
552 -// The Loginizer Admin Options Page
553 -function loginizer_page_header($title = 'Loginizer'){
554 - /*wp_enqueue_script('common');
555 - wp_enqueue_script('wp-lists');
556 - wp_enqueue_script('postbox');
557 - wp_nonce_field('closedpostboxes', 'closedpostboxesnonce', false);
558 -
559 - echo '
560 -<script>
561 -jQuery(document).ready( function() {
562 - //add_postbox_toggles("loginizer");
563 -});
564 -</script>';*/
837 +function loginizer_reset_retries(){
565 838
566 -?>
567 -<style>
568 -.lz-right-ul{
569 - padding-left: 10px !important;
570 -}
839 + global $wpdb, $loginizer;
571 840
572 -.lz-right-ul li{
573 - list-style: circle !important;
574 -}
575 -</style>
576 -<?php
577 -
578 - echo '<div style="margin: 10px 20px 0 2px;">
579 -<div class="metabox-holder columns-2">
580 -<div class="postbox-container">
581 -<div id="top-sortables" class="meta-box-sortables ui-sortable">
582 -
583 - <table cellpadding="2" cellspacing="1" width="100%" class="fixed" border="0">
584 - <tr>
585 - <td valign="top"><h3>'.$title.'</h3></td>
586 - <td align="right"><a target="_blank" class="button button-primary" href="https://wordpress.org/support/view/plugin-reviews/loginizer">Review Loginizer</a></td>
587 - </tr>
588 - </table>
589 - <hr />
590 -
591 - <!--Main Table-->
592 - <table cellpadding="8" cellspacing="1" width="100%" class="fixed">
593 - <tr>
594 - <td valign="top">';
841 + $deltime = time() - $loginizer['reset_retries'];
595 842
596 -}
843 + $del_query = $wpdb->prepare("DELETE FROM `".$wpdb->prefix."loginizer_logs` WHERE `time` <= %d", $deltime);
844 + $result = $wpdb->query($del_query);
597 845
598 -// The Loginizer Theme footer
599 -function loginizer_page_footer(){
600 -
601 - echo '</td>
602 - <td width="200" valign="top" id="loginizer-right-bar">';
603 -
604 - if(!defined('LOGINIZER_PREMIUM')){
605 -
606 - echo '
607 - <div class="postbox" style="min-width:0px !important;">
608 - <h2 class="hndle ui-sortable-handle">
609 - <span>Premium Version</span>
610 - </h2>
611 - <div class="inside">
612 - <i>Upgrade to the premium version and get the following features </i>:<br>
613 - <ul class="lz-right-ul">
614 - <li>PasswordLess Login</li>
615 - <li>Two Factor Auth - Email</li>
616 - <li>Two Factor Auth - App</li>
617 - <li>Login Challenge Question</li>
618 - <li>reCAPTCHA</li>
619 - <li>Rename Login Page</li>
620 - <li>Disable XML-RPC</li>
621 - <li>And many more ...</li>
622 - </ul>
623 - <center><a class="button button-primary" href="https://loginizer.com/members/cart.php">Upgrade</a></center>
624 - </div>
625 - </div>';
626 -
627 - }else{
628 -
629 - echo '
630 - <div class="postbox" style="min-width:0px !important;">
631 - <h2 class="hndle ui-sortable-handle">
632 - <span>Recommedations</span>
633 - </h2>
634 - <div class="inside">
635 - <i>We recommed that you enable atleast one of the following security features</i>:<br>
636 - <ul class="lz-right-ul">
637 - <li>Rename Login Page</li>
638 - <li>Login Challenge Question</li>
639 - <li>reCAPTCHA</li>
640 - <li>Two Factor Auth - Email</li>
641 - <li>Two Factor Auth - App</li>
642 - </ul>
643 - </div>
644 - </div>';
645 - }
646 -
647 - echo '</td>
648 - </tr>
649 - </table>
650 - <br />
651 - <div style="width:45%;background:#FFF;padding:15px; margin:auto">
652 - <b>Let your friends know that you have secured your website :</b>
653 - <form method="get" action="http://twitter.com/intent/tweet" id="tweet" onsubmit="return dotweet(this);">
654 - <textarea name="text" cols="45" row="3" style="resize:none;">I just secured my @WordPress site against #bruteforce using @loginizer</textarea>
655 - &nbsp; &nbsp; <input type="submit" value="Tweet!" class="button button-primary" onsubmit="return false;" id="twitter-btn" style="margin-top:20px;"/>
656 - </form>
657 -
658 - </div>
659 - <br />
660 -
661 - <script>
662 - function dotweet(ele){
663 - window.open(jQuery("#"+ele.id).attr("action")+"?"+jQuery("#"+ele.id).serialize(), "_blank", "scrollbars=no, menubar=no, height=400, width=500, resizable=yes, toolbar=no, status=no");
664 - return false;
665 - }
666 - </script>
667 -
668 - <hr />
669 - <a href="http://loginizer.com" target="_blank">Loginizer</a> v'.LOGINIZER_VERSION.'. You can report any bugs <a href="http://wordpress.org/support/plugin/loginizer" target="_blank">here</a>.
846 + update_option('loginizer_last_reset', time());
670 847
671 -</div>
672 -</div>
673 -</div>
674 -</div>';
675 -
676 848 }
677 849
678 -// The Loginizer Admin Options Page
679 -function loginizer_page_dashboard(){
850 +function loginizer_load_translation_vars(){
851 + global $loginizer;
680 852
681 - global $loginizer, $lz_error, $lz_env;
682 -
683 - // Is there a license key ?
684 - if(isset($_POST['save_lz'])){
685 -
686 - $license = lz_optpost('lz_license');
687 -
688 - // Check if its a valid license
689 - if(empty($license)){
690 - $lz_error['lic_invalid'] = __('The license key was not submitted', 'loginizer');
691 - return loginizer_page_dashboard_T();
692 - }
693 -
694 - $resp = wp_remote_get(LOGINIZER_API.'license.php?license='.$license);
695 -
696 - if(is_array($resp)){
697 - $json = json_decode($resp['body'], true);
698 - //print_r($json);
699 - }
700 -
701 - // Save the License
702 - if(empty($json)){
703 -
704 - $lz_error['lic_invalid'] = __('The license key is invalid', 'loginizer');
705 - return loginizer_page_dashboard_T();
706 -
707 - }else{
708 -
709 - update_option('loginizer_license', $json);
710 -
711 - // Mark as saved
712 - $GLOBALS['lz_saved'] = true;
713 - }
714 -
715 - }
716 -
717 - loginizer_page_dashboard_T();
718 -
719 -}
853 + $loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
854 + $loginizer['login_mail_default_msg'] = __('Hello $user_login,
720 855
721 -// The Loginizer Admin Options Page - THEME
722 -function loginizer_page_dashboard_T(){
723 -
724 - global $loginizer, $lz_error, $lz_env;
856 +Your account was recently logged in from the IP : $ip
857 +Time : $date
858 +If it was not you who logged in then please report this to us immediately.
725 859
726 - loginizer_page_header('Loginizer Dashboard');
727 -?>
728 -<style>
729 -.welcome-panel{
730 - margin: 0px;
731 - padding: 10px;
732 -}
860 +Regards,
861 +$sitename','loginizer');
733 862
734 -input[type="text"], textarea, select {
735 - width: 70%;
736 -}
737 -
738 -.form-table label{
739 - font-weight:bold;
740 -}
741 -
742 -.exp{
743 - font-size:12px;
744 -}
745 -</style>
746 -
747 - <?php
748 - echo '<script src="http://api.loginizer.com/'.(defined('LOGINIZER_PREMIUM') ? 'news_security.js' : 'news.js').'"></script><br>';
749 -
750 - // Saved ?
751 - if(!empty($GLOBALS['lz_saved'])){
752 - echo '<div id="message" class="updated"><p>'. __('The settings were saved successfully', 'loginizer'). '</p></div><br />';
863 + if(empty($loginizer['login_mail_subject'])){
864 + $loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
753 865 }
754 866
755 - // Any errors ?
756 - if(!empty($lz_error)){
757 - lz_report_error($lz_error);echo '<br />';
867 + if(empty($loginizer['login_mail_body'])){
868 + $loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
758 869 }
759 870
760 - ?>
871 + // Default messages
872 + $loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
873 + $loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
874 + $loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
875 + $loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries<br /> Please try after', 'loginizer');
876 + $loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
877 + $loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
761 878
762 - <div class="postbox">
879 + // Message Strings
880 + $loginizer['msg'] = get_option('loginizer_msg', []);
763 881
764 - <button class="handlediv button-link" aria-expanded="true" type="button">
765 - <span class="screen-reader-text">Toggle panel: Getting Started</span>
766 - <span class="toggle-indicator" aria-hidden="true"></span>
767 - </button>
768 -
769 - <h2 class="hndle ui-sortable-handle">
770 - <span><?php echo __('Getting Started', 'loginizer'); ?></span>
771 - </h2>
772 -
773 - <div class="inside">
774 -
775 - <form action="" method="post" enctype="multipart/form-data">
776 - <?php wp_nonce_field('loginizer-options'); ?>
777 - <table class="form-table">
778 - <tr>
779 - <td scope="row" valign="top" colspan="2" style="line-height:150%">
780 - <i>Welcome to Loginizer Security. By default the <b>Brute Force Protection</b> is immediately enabled. You should start by going over the default settings and tweaking them as per your needs.</i>
781 - <?php
782 - if(defined('LOGINIZER_PREMIUM')){
783 - echo '<br><i>In the Premium version of Loginizer you have many more features. We recommend you enable features like <b>reCAPTCHA, Two Factor Auth or Email based PasswordLess</b> login. These features will improve your websites security.</i>';
784 - }
785 - ?>
786 - </td>
787 - </tr>
788 - </table>
789 - </form>
790 -
791 - </div>
792 - </div>
882 + foreach($loginizer['d_msg'] as $lk => $lv){
883 + if(empty($loginizer['msg'][$lk])){
884 + $loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
885 + }
886 + }
793 887
794 - <div class="postbox">
888 + $loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
889 + $loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
890 + $loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
891 + $loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
892 + $loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
795 893
796 - <button class="handlediv button-link" aria-expanded="true" type="button">
797 - <span class="screen-reader-text">Toggle panel: System Information</span>
798 - <span class="toggle-indicator" aria-hidden="true"></span>
799 - </button>
800 -
801 - <h2 class="hndle ui-sortable-handle">
802 - <span><?php echo __('System Information', 'loginizer'); ?></span>
803 - </h2>
804 -
805 - <div class="inside">
806 -
807 - <form action="" method="post" enctype="multipart/form-data">
808 - <?php wp_nonce_field('loginizer-options'); ?>
809 - <table class="wp-list-table fixed striped users" cellspacing="1" border="0" width="95%" cellpadding="10" align="center">
810 - <?php
811 - echo '
812 - <tr>
813 - <th align="left" width="25%">'.__('Loginizer Version', 'loginizer').'</th>
814 - <td>'.LOGINIZER_VERSION.(defined('LOGINIZER_PREMIUM') ? ' (Security PRO Version)' : '').'</td>
815 - </tr>';
816 -
817 - if(defined('LOGINIZER_PREMIUM')){
818 - echo '
819 - <tr>
820 - <th align="left" valign="top">'.__('Loginizer License', 'loginizer').'</th>
821 - <td align="left">
822 - '.(empty($loginizer['license']) ? '<span style="color:red">Unlicensed</span> &nbsp; &nbsp;' : '').'
823 - <input type="text" name="lz_license" value="'.(empty($loginizer['license']) ? '' : $loginizer['license']['license']).'" size="30" placeholder="e.g. WXCSE-SFJJX-XXXXX-AAAAA-BBBBB" style="width:300px;" /> &nbsp;
824 - <input name="save_lz" class="button button-primary" value="Update License" type="submit" />';
825 -
826 - if(!empty($loginizer['license'])){
827 -
828 - $expires = $loginizer['license']['expires'];
829 - $expires = substr($expires, 0, 4).'/'.substr($expires, 4, 2).'/'.substr($expires, 6);
830 -
831 - echo '<div style="margin-top:10px;">License Active : '.(empty($loginizer['license']['active']) ? '<span style="color:red">No</span>' : 'Yes').' &nbsp; &nbsp; &nbsp;
832 - License Expires : '.($loginizer['license']['expires'] <= date('Ymd') ? '<span style="color:red">'.$expires.'</span>' : $expires).'
833 - </div>';
834 - }
835 -
836 -
837 - echo
838 - '</td>
839 - </tr>';
840 - }
841 -
842 - echo '<tr>
843 - <th align="left">'.__('URL', 'loginizer').'</th>
844 - <td>'.get_site_url().'</td>
845 - </tr>
846 - <tr>
847 - <th align="left">'.__('Path', 'loginizer').'</th>
848 - <td>'.ABSPATH.'</td>
849 - </tr>
850 - <tr>
851 - <th align="left">'.__('Server\'s IP Address', 'loginizer').'</th>
852 - <td>'.$_SERVER['SERVER_ADDR'].'</td>
853 - </tr>
854 - <tr>
855 - <th align="left">'.__('Your IP Address', 'loginizer').'</th>
856 - <td>'.$_SERVER['REMOTE_ADDR'].'</td>
857 - </tr>
858 - <tr>
859 - <th align="left">'.__('wp-config.php is writable', 'loginizer').'</th>
860 - <td>'.(is_writable(ABSPATH.'/wp-config.php') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
861 - </tr>';
862 -
863 - if(file_exists(ABSPATH.'/.htaccess')){
864 - echo '
865 - <tr>
866 - <th align="left">'.__('.htaccess is writable', 'loginizer').'</th>
867 - <td>'.(is_writable(ABSPATH.'/.htaccess') ? '<span style="color:red">Yes</span>' : '<span style="color:green">No</span>').'</td>
868 - </tr>';
869 -
870 - }
871 -
872 - ?>
873 - </table>
874 - </form>
875 -
876 - </div>
877 - </div>
894 + // Message Strings
895 + $loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
878 896
879 - <div id="" class="postbox">
897 + foreach($loginizer['2fa_d_msg'] as $lk => $lv){
898 + if(empty($loginizer['2fa_msg'][$lk])){
899 + $loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
900 + }
901 + }
880 902
881 - <button class="handlediv button-link" aria-expanded="true" type="button">
882 - <span class="screen-reader-text">Toggle panel: File Permissions</span>
883 - <span class="toggle-indicator" aria-hidden="true"></span>
884 - </button>
885 -
886 - <h2 class="hndle ui-sortable-handle">
887 - <span><?php echo __('File Permissions', 'loginizer'); ?></span>
888 - </h2>
889 -
890 - <div class="inside">
891 -
892 - <form action="" method="post" enctype="multipart/form-data">
893 - <?php wp_nonce_field('loginizer-options'); ?>
894 - <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
895 - <?php
896 -
897 - echo '
898 - <tr>
899 - <th style="background:#EFEFEF;">'.__('Relative Path', 'loginizer').'</th>
900 - <th style="width:10%; background:#EFEFEF;">'.__('Suggested', 'loginizer').'</th>
901 - <th style="width:10%; background:#EFEFEF;">'.__('Actual', 'loginizer').'</th>
902 - </tr>';
903 -
904 - $wp_content = basename(dirname(dirname(dirname(__FILE__))));
905 -
906 - $files_to_check = array('/' => '0755',
907 - '/wp-admin' => '0755',
908 - '/wp-includes' => '0755',
909 - '/wp-config.php' => '0444',
910 - '/'.$wp_content => '0755',
911 - '/'.$wp_content.'/themes' => '0755',
912 - '/'.$wp_content.'/plugins' => '0755',
913 - '.htaccess' => '0444');
914 -
915 - $root = ABSPATH;
916 -
917 - foreach($files_to_check as $k => $v){
918 -
919 - $path = $root.'/'.$k;
920 - $stat = @stat($path);
921 - $suggested = $v;
922 - $actual = substr(sprintf('%o', $stat['mode']), -4);
923 -
924 - echo '
925 - <tr>
926 - <td>'.$k.'</td>
927 - <td>'.$suggested.'</td>
928 - <td><span '.($suggested != $actual ? 'style="color: red;"' : '').'>'.$actual.'</span></td>
929 - </tr>';
930 -
931 - }
932 -
933 - ?>
934 - </table>
935 - </form>
936 -
937 - </div>
938 - </div>
903 +}
939 904
940 -<?php
941 -
942 - loginizer_page_footer();
943 -
905 +function loginizer_social_login_load(){
906 + include_once LOGINIZER_DIR . '/main/social-login.php';
944 907 }
945 908
946 -// The Loginizer Admin Options Page
947 -function loginizer_page_brute_force(){
909 +// Checks if softaculous is installed on the server.
910 +function loginizer_check_softaculous(){
948 911
949 - global $wpdb, $wp_roles, $loginizer;
950 -
951 - if(!current_user_can('manage_options')){
952 - wp_die('Sorry, but you do not have permissions to change settings.');
912 + // Checking if we have Softaculous installed?
913 + if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
914 + return false;
953 915 }
954 916
955 - /* Make sure post was from this page */
956 - if(count($_POST) > 0){
957 - check_admin_referer('loginizer-options');
917 + if(empty($matches) || empty($matches[0])){
918 + return false;
958 919 }
959 -
960 - // BEGIN THEME
961 - loginizer_page_header('Loginizer - Brute Force Settings');
962 -
963 - // Load the blacklist and whitelist
964 - $loginizer['blacklist'] = get_option('loginizer_blacklist');
965 - $loginizer['whitelist'] = get_option('loginizer_whitelist');
966 -
967 - if(isset($_POST['save_lz'])){
968 -
969 - $max_retries = (int) lz_optpost('max_retries');
970 - $lockout_time = (int) lz_optpost('lockout_time');
971 - $max_lockouts = (int) lz_optpost('max_lockouts');
972 - $lockouts_extend = (int) lz_optpost('lockouts_extend');
973 - $reset_retries = (int) lz_optpost('reset_retries');
974 - $notify_email = (int) lz_optpost('notify_email');
975 -
976 - $lockout_time = $lockout_time * 60;
977 - $lockouts_extend = $lockouts_extend * 60 * 60;
978 - $reset_retries = $reset_retries * 60 * 60;
979 -
980 - if(empty($error)){
981 -
982 - $option['max_retries'] = $max_retries;
983 - $option['lockout_time'] = $lockout_time;
984 - $option['max_lockouts'] = $max_lockouts;
985 - $option['lockouts_extend'] = $lockouts_extend;
986 - $option['reset_retries'] = $reset_retries;
987 - $option['notify_email'] = $notify_email;
988 -
989 - // Save the options
990 - update_option('loginizer_options', $option);
991 -
992 - $saved = true;
993 -
994 - }else{
995 - lz_report_error($error);
996 - }
997 -
998 - if(!empty($notice)){
999 - lz_report_notice($notice);
1000 - }
1001 -
1002 - if(!empty($saved)){
1003 - echo '<div id="message" class="updated"><p>'
1004 - . __('The settings were saved successfully', 'loginizer')
1005 - . '</p></div><br />';
1006 - }
1007 -
920 +
921 + $softaculous_path = $matches[0] . '.softaculous/installations.php';
922 + if(!file_exists($softaculous_path)){
923 + return false;
1008 924 }
1009 925
1010 - // Delete a Blackist IP range
1011 - if(isset($_GET['bdelid'])){
1012 -
1013 - $delid = (int) lz_optreq('bdelid');
1014 -
1015 - // Unset and save
1016 - $blacklist = $loginizer['blacklist'];
1017 - unset($blacklist[$delid]);
1018 - update_option('loginizer_blacklist', $blacklist);
1019 -
1020 - echo '<div id="message" class="updated fade"><p>'
1021 - . __('The Blacklist IP range has been deleted successfully', 'loginizer')
1022 - . '</p></div><br />';
1023 -
926 + // Checking if users has changed the branding of Softaculous.
927 + $universal_file = '';
928 + // Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
929 + if(file_exists('/usr/local/softaculous/enduser/universal.php')){
930 + $universal_file = '/usr/local/softaculous/enduser/universal.php';
931 + }else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
932 + $universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
933 + }else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
934 + $universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
935 + }else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
936 + $universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
1024 937 }
1025 -
1026 - // Delete a Whitelist IP range
1027 - if(isset($_GET['delid'])){
1028 -
1029 - $delid = (int) lz_optreq('delid');
1030 -
1031 - // Unset and save
1032 - $whitelist = $loginizer['whitelist'];
1033 - unset($whitelist[$delid]);
1034 - update_option('loginizer_whitelist', $whitelist);
1035 -
1036 - echo '<div id="message" class="updated fade"><p>'
1037 - . __('The Whitelist IP range has been deleted successfully', 'loginizer')
1038 - . '</p></div><br />';
1039 -
938 +
939 + if(empty($universal_file)){
940 + return false;
1040 941 }
1041 -
1042 - if(isset($_POST['blacklist_iprange'])){
1043 942
1044 - $start_ip = lz_optpost('start_ip');
1045 - $end_ip = lz_optpost('end_ip');
1046 -
1047 - if(empty($start_ip)){
1048 - $error[] = 'Please enter the Start IP';
1049 - }
1050 -
1051 - // If no end IP we consider only 1 IP
1052 - if(empty($end_ip)){
1053 - $end_ip = $start_ip;
1054 - }
1055 -
1056 - if(!lz_valid_ip($start_ip)){
1057 - $error[] = 'Please provide a valid start IP';
1058 - }
1059 -
1060 - if(!lz_valid_ip($end_ip)){
1061 - $error[] = 'Please provide a valid end IP';
1062 - }
1063 -
1064 - // Regular ranges will work
1065 - if(ip2long($start_ip) > ip2long($end_ip)){
1066 -
1067 - // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1068 - if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1069 - // This is right
1070 - }else{
1071 - $error[] = 'The End IP cannot be smaller than the Start IP';
1072 - }
1073 -
1074 - }
1075 -
1076 - if(empty($error)){
1077 -
1078 - $blacklist = $loginizer['blacklist'];
1079 -
1080 - foreach($blacklist as $k => $v){
1081 -
1082 - // This is to check if there is any other range exists with the same Start or End IP
1083 - if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1084 - || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1085 - ){
1086 - $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1087 - break;
1088 - }
1089 -
1090 - // This is to check if there is any other range exists with the same Start IP
1091 - if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1092 - $error[] = 'The Start IP is present in an existing range !';
1093 - break;
1094 - }
1095 -
1096 - // This is to check if there is any other range exists with the same End IP
1097 - if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1098 - $error[] = 'The End IP is present in an existing range!';
1099 - break;
1100 - }
1101 -
1102 - }
1103 -
1104 - $newid = ( empty($blacklist) ? 0 : max(array_keys($blacklist)) ) + 1;
1105 -
1106 - if(empty($error)){
1107 -
1108 - $blacklist[$newid] = array();
1109 - $blacklist[$newid]['start'] = $start_ip;
1110 - $blacklist[$newid]['end'] = $end_ip;
1111 - $blacklist[$newid]['time'] = time();
1112 -
1113 - update_option('loginizer_blacklist', $blacklist);
1114 -
1115 - echo '<div id="message" class="updated fade"><p>'
1116 - . __('Blacklist IP range added successfully', 'loginizer')
1117 - . '</p></div><br />';
1118 -
1119 - }
1120 -
1121 - }
1122 -
1123 - if(!empty($error)){
1124 - lz_report_error($error);echo '<br />';
1125 - }
1126 -
943 + $universal = file_get_contents($universal_file);
944 +
945 + if(empty($universal)){
946 + return false;
1127 947 }
1128 -
1129 - if(isset($_POST['whitelist_iprange'])){
1130 948
1131 - $start_ip = lz_optpost('start_ip_w');
1132 - $end_ip = lz_optpost('end_ip_w');
1133 -
1134 - if(empty($start_ip)){
1135 - $error[] = 'Please enter the Start IP';
1136 - }
1137 -
1138 - // If no end IP we consider only 1 IP
1139 - if(empty($end_ip)){
1140 - $end_ip = $start_ip;
1141 - }
1142 -
1143 - if(!lz_valid_ip($start_ip)){
1144 - $error[] = 'Please provide a valid start IP';
1145 - }
1146 -
1147 - if(!lz_valid_ip($end_ip)){
1148 - $error[] = 'Please provide a valid end IP';
1149 - }
1150 -
1151 - if(ip2long($start_ip) > ip2long($end_ip)){
1152 -
1153 - // BUT, if 0.0.0.1 - 255.255.255.255 is given, it will not work
1154 - if(ip2long($start_ip) >= 0 && ip2long($end_ip) < 0){
1155 - // This is right
1156 - }else{
1157 - $error[] = 'The End IP cannot be smaller than the Start IP';
1158 - }
1159 -
1160 - }
1161 -
1162 - if(empty($error)){
1163 -
1164 - $whitelist = $loginizer['whitelist'];
1165 -
1166 - foreach($whitelist as $k => $v){
1167 -
1168 - // This is to check if there is any other range exists with the same Start or End IP
1169 - if(( ip2long($start_ip) <= ip2long($v['start']) && ip2long($v['start']) <= ip2long($end_ip) )
1170 - || ( ip2long($start_ip) <= ip2long($v['end']) && ip2long($v['end']) <= ip2long($end_ip) )
1171 - ){
1172 - $error[] = 'The Start IP or End IP submitted conflicts with an existing IP range !';
1173 - break;
1174 - }
1175 -
1176 - // This is to check if there is any other range exists with the same Start IP
1177 - if(ip2long($v['start']) <= ip2long($start_ip) && ip2long($start_ip) <= ip2long($v['end'])){
1178 - $error[] = 'The Start IP is present in an existing range !';
1179 - break;
1180 - }
1181 -
1182 - // This is to check if there is any other range exists with the same End IP
1183 - if(ip2long($v['start']) <= ip2long($end_ip) && ip2long($end_ip) <= ip2long($v['end'])){
1184 - $error[] = 'The End IP is present in an existing range!';
1185 - break;
1186 - }
1187 -
1188 - }
1189 -
1190 - $newid = ( empty($whitelist) ? 0 : max(array_keys($whitelist)) ) + 1;
1191 -
1192 - if(empty($error)){
1193 -
1194 - $whitelist[$newid] = array();
1195 - $whitelist[$newid]['start'] = $start_ip;
1196 - $whitelist[$newid]['end'] = $end_ip;
1197 - $whitelist[$newid]['time'] = time();
1198 -
1199 - update_option('loginizer_whitelist', $whitelist);
1200 -
1201 - echo '<div id="message" class="updated fade"><p>'
1202 - . __('Whitelist IP range added successfully', 'loginizer')
1203 - . '</p></div><br />';
1204 -
1205 - }
1206 -
1207 - }
1208 -
1209 - if(!empty($error)){
1210 - lz_report_error($error);echo '<br />';
1211 - }
949 + // Checking if Softaculous is being whitelabeled
950 + if(preg_match('/\$globals\[["\']sn["\']\]\s.?=\s.?["\']Softaculous["\']/', $universal)){
951 + update_option('loginizer_softwp_upgrade', time());
1212 952 }
1213 -
1214 - // Count the Results
1215 - $tmp = lz_selectquery("SELECT COUNT(*) AS num FROM `".$wpdb->prefix."loginizer_logs`");
1216 - //print_r($tmp);
1217 -
1218 - // Which Page is it
1219 - $lz_env['res_len'] = 10;
1220 - $lz_env['cur_page'] = lz_get_page('lzpage', $lz_env['res_len']);
1221 - $lz_env['num_res'] = $tmp['num'];
1222 - $lz_env['max_page'] = ceil($lz_env['num_res'] / $lz_env['res_len']);
1223 -
1224 - // Get the logs
1225 - $result = lz_selectquery("SELECT * FROM `".$wpdb->prefix."loginizer_logs`
1226 - ORDER BY `time` DESC
1227 - LIMIT ".$lz_env['cur_page'].", ".$lz_env['res_len']."", 1);
1228 - //print_r($result);
1229 -
1230 - $lz_env['cur_page'] = ($lz_env['cur_page'] / $lz_env['res_len']) + 1;
1231 - $lz_env['cur_page'] = $lz_env['cur_page'] < 1 ? 1 : $lz_env['cur_page'];
1232 - $lz_env['next_page'] = ($lz_env['cur_page'] + 1) > $lz_env['max_page'] ? $lz_env['max_page'] : ($lz_env['cur_page'] + 1);
1233 - $lz_env['prev_page'] = ($lz_env['cur_page'] - 1) < 1 ? 1 : ($lz_env['cur_page'] - 1);
1234 -
1235 - // Reload the settings
1236 - $loginizer['blacklist'] = get_option('loginizer_blacklist');
1237 - $loginizer['whitelist'] = get_option('loginizer_whitelist');
1238 -
1239 - ?>
1240 953
1241 - <div id="" class="postbox">
1242 -
1243 - <button class="handlediv button-link" aria-expanded="true" type="button">
1244 - <span class="screen-reader-text">Toggle panel: Failed Login Attempts Logs</span>
1245 - <span class="toggle-indicator" aria-hidden="true"></span>
1246 - </button>
1247 -
1248 - <h2 class="hndle ui-sortable-handle">
1249 - <?php echo __('<span>Failed Login Attempts Logs</span> &nbsp; (Past '.($loginizer['reset_retries']/60/60).' hours)','loginizer'); ?>
1250 - </h2>
1251 -
1252 - <script>
1253 - function yesdsd(){
1254 - window.location = '<?php echo menu_page_url('loginizer_brute_force', false);?>&lzpage='+jQuery("#current-page-selector").val();
1255 - return false;
1256 - }
1257 - </script>
1258 -
1259 - <form method="get" onsubmit="return yesdsd();">
1260 - <div class="tablenav">
1261 - <p class="tablenav-pages" style="margin: 5px 10px" align="right">
1262 - <span class="displaying-num"><?php echo $lz_env['num_res'];?> items</span>
1263 - <span class="pagination-links">
1264 - <a class="first-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage=1';?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
1265 - <a class="prev-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['prev_page'];?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
1266 - <span class="paging-input">
1267 - <label for="current-page-selector" class="screen-reader-text">Current Page</label>
1268 - <input class="current-page" id="current-page-selector" name="lzpage" value="<?php echo $lz_env['cur_page'];?>" size="3" aria-describedby="table-paging" type="text"><span class="tablenav-paging-text"> of <span class="total-pages"><?php echo $lz_env['max_page'];?></span></span>
1269 - </span>
1270 - <a class="next-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['next_page'];?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
1271 - <a class="last-page" href="<?php echo menu_page_url('loginizer_brute_force', false).'&lzpage='.$lz_env['max_page'];?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
1272 - </span>
1273 - </p>
1274 - </div>
1275 - </form>
1276 -
1277 - <div class="inside">
1278 - <table class="wp-list-table widefat fixed users" border="0">
1279 - <tr>
1280 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('IP','loginizer'); ?></th>
1281 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Last Failed Attempt (DD/MM/YYYY)','loginizer'); ?></th>
1282 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Failed Attempts Count','loginizer'); ?></th>
1283 - <th scope="row" valign="top" style="background:#EFEFEF;" width="150"><?php echo __('Lockouts Count','loginizer'); ?></th>
1284 - </tr>
1285 - <?php
1286 - if(empty($result)){
1287 - echo '
1288 - <tr>
1289 - <td colspan="4">
1290 - No Logs. You will see logs about failed login attempts here.
1291 - </td>
1292 - </tr>';
1293 - }else{
1294 - foreach($result as $ik => $iv){
1295 - $status_button = (!empty($iv['status']) ? 'disable' : 'enable');
1296 - echo '
1297 - <tr>
1298 - <td>
1299 - '.$iv['ip'].'
1300 - </td>
1301 - <td>
1302 - '.date('d/m/Y H:i:s', $iv['time']).'
1303 - </td>
1304 - <td>
1305 - '.$iv['count'].'
1306 - </td>
1307 - <td>
1308 - '.$iv['lockout'].'
1309 - </td>
1310 - </tr>';
1311 - }
1312 - }
1313 - ?>
1314 - </table>
1315 - </div>
1316 - </div>
1317 - <br />
1318 -
1319 - <div id="" class="postbox">
1320 -
1321 - <button class="handlediv button-link" aria-expanded="true" type="button">
1322 - <span class="screen-reader-text">Toggle panel: Brute Force Settings</span>
1323 - <span class="toggle-indicator" aria-hidden="true"></span>
1324 - </button>
1325 -
1326 - <h2 class="hndle ui-sortable-handle">
1327 - <span><?php echo __('Brute Force Settings', 'loginizer'); ?></span>
1328 - </h2>
1329 -
1330 - <div class="inside">
1331 -
1332 - <form action="" method="post" enctype="multipart/form-data">
1333 - <?php wp_nonce_field('loginizer-options'); ?>
1334 - <table class="form-table">
1335 - <tr>
1336 - <th scope="row" valign="top"><label for="max_retries"><?php echo __('Max Retries','loginizer'); ?></label></th>
1337 - <td>
1338 - <input type="text" size="3" value="<?php echo lz_optpost('max_retries', $loginizer['max_retries']); ?>" name="max_retries" id="max_retries" /> <?php echo __('Maximum failed attempts allowed before lockout','loginizer'); ?> <br />
1339 - </td>
1340 - </tr>
1341 - <tr>
1342 - <th scope="row" valign="top"><label for="lockout_time"><?php echo __('Lockout Time','loginizer'); ?></label></th>
1343 - <td>
1344 - <input type="text" size="3" value="<?php echo (!empty($lockout_time) ? $lockout_time : $loginizer['lockout_time']) / 60; ?>" name="lockout_time" id="lockout_time" /> <?php echo __('minutes','loginizer'); ?> <br />
1345 - </td>
1346 - </tr>
1347 - <tr>
1348 - <th scope="row" valign="top"><label for="max_lockouts"><?php echo __('Max Lockouts','loginizer'); ?></label></th>
1349 - <td>
1350 - <input type="text" size="3" value="<?php echo lz_optpost('max_lockouts', $loginizer['max_lockouts']); ?>" name="max_lockouts" id="max_lockouts" /> <?php echo __('','loginizer'); ?> <br />
1351 - </td>
1352 - </tr>
1353 - <tr>
1354 - <th scope="row" valign="top"><label for="lockouts_extend"><?php echo __('Extend Lockout','loginizer'); ?></label></th>
1355 - <td>
1356 - <input type="text" size="3" value="<?php echo (!empty($lockouts_extend) ? $lockouts_extend : $loginizer['lockouts_extend']) / 60 / 60; ?>" name="lockouts_extend" id="lockouts_extend" /> <?php echo __('hours. Extend Lockout time after Max Lockouts','loginizer'); ?> <br />
1357 - </td>
1358 - </tr>
1359 - <tr>
1360 - <th scope="row" valign="top"><label for="reset_retries"><?php echo __('Reset Retries','loginizer'); ?></label></th>
1361 - <td>
1362 - <input type="text" size="3" value="<?php echo (!empty($reset_retries) ? $reset_retries : $loginizer['reset_retries']) / 60 / 60; ?>" name="reset_retries" id="reset_retries" /> <?php echo __('hours','loginizer'); ?> <br />
1363 - </td>
1364 - </tr>
1365 - <tr>
1366 - <th scope="row" valign="top"><label for="notify_email"><?php echo __('Email Notification','loginizer'); ?></label></th>
1367 - <td>
1368 - <?php echo __('after ','loginizer'); ?>
1369 - <input type="text" size="3" value="<?php echo (!empty($notify_email) ? $notify_email : $loginizer['notify_email']); ?>" name="notify_email" id="notify_email" /> <?php echo __('lockouts <br />0 to disable email notifications','loginizer'); ?>
1370 - </td>
1371 - </tr>
1372 - </table><br />
1373 - <input name="save_lz" class="button button-primary action" value="<?php echo __('Save Settings','loginizer'); ?>" type="submit" />
1374 - </form>
1375 -
1376 - </div>
1377 - </div>
1378 - <br />
1379 -
1380 - <div id="" class="postbox">
1381 -
1382 - <button class="handlediv button-link" aria-expanded="true" type="button">
1383 - <span class="screen-reader-text">Toggle panel: Blacklist IP</span>
1384 - <span class="toggle-indicator" aria-hidden="true"></span>
1385 - </button>
1386 -
1387 - <h2 class="hndle ui-sortable-handle">
1388 - <span><?php echo __('Blacklist IP','loginizer'); ?></span>
1389 - </h2>
1390 -
1391 - <div class="inside">
1392 -
1393 - <?php echo __('Enter the IP you want to blacklist from login','loginizer'); ?>
1394 -
1395 - <form action="" method="post">
1396 - <?php wp_nonce_field('loginizer-options'); ?>
1397 - <table class="form-table">
1398 - <tr>
1399 - <th scope="row" valign="top"><label for="start_ip"><?php echo __('Start IP','loginizer'); ?></label></th>
1400 - <td>
1401 - <input type="text" size="25" value="<?php echo(lz_optpost('start_ip')); ?>" name="start_ip" id="start_ip"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1402 - </td>
1403 - </tr>
1404 - <tr>
1405 - <th scope="row" valign="top"><label for="end_ip"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1406 - <td>
1407 - <input type="text" size="25" value="<?php echo(lz_optpost('end_ip')); ?>" name="end_ip" id="end_ip"/> <?php echo __('End IP of the range. <br />If you want to blacklist single IP leave this field blank.','loginizer'); ?> <br />
1408 - </td>
1409 - </tr>
1410 - </table><br />
1411 - <input name="blacklist_iprange" class="button button-primary action" value="<?php echo __('Add Blacklist IP Range','loginizer'); ?>" type="submit" />
1412 - </form>
1413 - </div>
1414 -
1415 - <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1416 - <tr>
1417 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1418 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1419 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1420 - <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1421 - </tr>
1422 - <?php
1423 - if(empty($loginizer['blacklist'])){
1424 - echo '
1425 - <tr>
1426 - <td colspan="4">
1427 - No Blacklist IPs. You will see blacklisted IP ranges here.
1428 - </td>
1429 - </tr>';
1430 - }else{
1431 - foreach($loginizer['blacklist'] as $ik => $iv){
1432 - echo '
1433 - <tr>
1434 - <td>
1435 - '.$iv['start'].'
1436 - </td>
1437 - <td>
1438 - '.$iv['end'].'
1439 - </td>
1440 - <td>
1441 - '.date('d/m/Y', $iv['time']).'
1442 - </td>
1443 - <td>
1444 - <a class="submitdelete" href="admin.php?page=loginizer_brute_force&bdelid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1445 - </td>
1446 - </tr>';
1447 - }
1448 - }
1449 - ?>
1450 - </table>
1451 - <br />
1452 -
1453 - </div>
1454 -
1455 - <br />
1456 -
1457 - <div id="" class="postbox">
1458 -
1459 - <button class="handlediv button-link" aria-expanded="true" type="button">
1460 - <span class="screen-reader-text">Toggle panel: Whitelist IP</span>
1461 - <span class="toggle-indicator" aria-hidden="true"></span>
1462 - </button>
1463 -
1464 - <h2 class="hndle ui-sortable-handle">
1465 - <span><?php echo __('Whitelist IP', 'loginizer'); ?></span>
1466 - </h2>
1467 -
1468 - <div class="inside">
1469 -
1470 - <?php echo __('Enter the IP you want to whitelist for login','loginizer'); ?>
1471 - <form action="" method="post">
1472 - <?php wp_nonce_field('loginizer-options'); ?>
1473 - <table class="form-table">
1474 - <tr>
1475 - <th scope="row" valign="top"><label for="start_ip_w"><?php echo __('Start IP','loginizer'); ?></label></th>
1476 - <td>
1477 - <input type="text" size="25" value="<?php echo(lz_optpost('start_ip_w')); ?>" name="start_ip_w" id="start_ip_w"/> <?php echo __('Start IP of the range','loginizer'); ?> <br />
1478 - </td>
1479 - </tr>
1480 - <tr>
1481 - <th scope="row" valign="top"><label for="end_ip_w"><?php echo __('End IP (Optional)','loginizer'); ?></label></th>
1482 - <td>
1483 - <input type="text" size="25" value="<?php echo(lz_optpost('end_ip_w')); ?>" name="end_ip_w" id="end_ip_w"/> <?php echo __('End IP of the range. <br />If you want to whitelist single IP leave this field blank.','loginizer'); ?> <br />
1484 - </td>
1485 - </tr>
1486 - </table><br />
1487 - <input name="whitelist_iprange" class="button button-primary action" value="<?php echo __('Add Whitelist IP Range','loginizer'); ?>" type="submit" />
1488 - </form>
1489 - </div>
1490 -
1491 - <table class="wp-list-table fixed striped users" border="0" width="95%" cellpadding="10" align="center">
1492 - <tr>
1493 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Start IP','loginizer'); ?></th>
1494 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('End IP','loginizer'); ?></th>
1495 - <th scope="row" valign="top" style="background:#EFEFEF;"><?php echo __('Date (DD/MM/YYYY)','loginizer'); ?></th>
1496 - <th scope="row" valign="top" style="background:#EFEFEF;" width="100"><?php echo __('Options','loginizer'); ?></th>
1497 - </tr>
1498 - <?php
1499 - if(empty($loginizer['whitelist'])){
1500 - echo '
1501 - <tr>
1502 - <td colspan="4">
1503 - No Whitelist IPs. You will see whitelisted IP ranges here.
1504 - </td>
1505 - </tr>';
1506 - }else{
1507 - foreach($loginizer['whitelist'] as $ik => $iv){
1508 - echo '
1509 - <tr>
1510 - <td>
1511 - '.$iv['start'].'
1512 - </td>
1513 - <td>
1514 - '.$iv['end'].'
1515 - </td>
1516 - <td>
1517 - '.date('d/m/Y', $iv['time']).'
1518 - </td>
1519 - <td>
1520 - <a class="submitdelete" href="admin.php?page=loginizer_brute_force&delid='.$ik.'" onclick="return confirm(\'Are you sure you want to delete this IP range ?\')">Delete</a>
1521 - </td>
1522 - </tr>';
1523 - }
1524 - }
1525 - ?>
1526 - </table>
1527 - <br />
1528 -
1529 - </div>
1530 -
1531 -<?php
1532 -
1533 -loginizer_page_footer();
1534 -
954 + return false;
1535 955 }
1536 956
1537 -
1538 957 // Sorry to see you going
1539 958 register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');
1540 959
1541 960 function loginizer_deactivation(){
@@ -1553,7 +972,22 @@
1553 972 delete_option('loginizer_options');
1554 973 delete_option('loginizer_last_reset');
1555 974 delete_option('loginizer_whitelist');
1556 975 delete_option('loginizer_blacklist');
976 + delete_option('loginizer_msg');
977 + delete_option('loginizer_2fa_msg');
978 + delete_option('loginizer_2fa_email_template');
979 + delete_option('loginizer_security');
980 + delete_option('loginizer_wp_admin');
981 + delete_option('loginizer_csrf_promo_time');
982 + delete_option('loginizer_backuply_promo_time');
983 + delete_option('loginizer_promo_time');
984 + delete_option('loginizer_ins_time');
985 + delete_option('loginizer_2fa_whitelist');
986 + delete_option('loginizer_checksums_last_run');
987 + delete_option('loginizer_checksums_diff');
988 + delete_option('loginizer_ip_method');
989 + delete_option('loginizer_2fa_custom_redirect');
990 + delete_option('external_updates-loginizer-security');
991 + delete_option('loginizer_login_attempt_stats');
1557 992
1558 -}
1559 -
993 +}