← All changes | init.php +105 -164 2.0.1 → 2.1.1 View file →

		@@ -4,9 +4,9 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '2.0.1');
	8	+define('LOGINIZER_VERSION', '2.1.1');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
		@@ -225,9 +225,9 @@
225	225	}
226	226
227	227	}
228	228
229		-// Add the action to load the plugin
	229	+// Add the action to load the plugin
230	230	add_action('plugins_loaded', 'loginizer_load_plugin');
231	231
232	232	// The function that will be called when the plugin is loaded
233	233	function loginizer_load_plugin(){
		@@ -235,8 +235,18 @@
235	235	global $loginizer;
236	236
237	237	// Check if the installed version is outdated
238	238	loginizer_update_check();
	239	+
	240	+ // There was an issue were for some users update was stuck, and free was able to get updated through auto updater option
	241	+ // removing these filters fixes that issue, and our Pro update blocker was improved in 2.1.1
	242	+ // This check can be removed 1 year from 28.09.2026
	243	+ if(defined('LOGINIZER_PRO_VERSION') && version_compare(LOGINIZER_PRO_VERSION, '2.1.1', '<')){
	244	+ foreach(['site_transient_update_plugins', 'pre_site_transient_update_plugins'] as $hook){
	245	+ remove_filter($hook, 'loginizer_pro_disable_manual_update_for_plugin'); // Older Pro used the default priority
	246	+ remove_filter($hook, 'loginizer_pro_disable_manual_update_for_plugin', 99);
	247	+ }
	248	+ }
239	249
240	250	// Set the array
241	251	if(empty($loginizer)){
242	252	$loginizer = array();
		@@ -332,21 +342,22 @@
332	342	// Is called before displaying the error message so that we dont show that the username is wrong or the password
333	343	// Update Error message
334	344	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
335	345	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
336		- add_action('wp_login', 'loginizer_login_success', 10, 2);
	346	+ add_action('wp_login', 'loginizer_login_success', 11, 2);
	347	+ add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
337	348
338	349	if(!empty($loginizer['ultimate-member-active'])){
339	350	add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
340	351	}
341	352
342		- if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
	353	+ if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings'])){
343	354	add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
344	355	}
345	356	}
346	357
347	358	// Social Login Form Actions
348		- if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
	359	+ if(!empty($loginizer['social_settings'])){
349	360	if(!empty($loginizer['social_settings']['login']['login_form'])){
350	361	add_action('login_form', 'loginizer_social_btn_login');
351	362	}
352	363	}
		@@ -357,60 +368,13 @@
357	368
358	369	if(is_admin()){
359	370	include_once LOGINIZER_DIR . '/main/admin.php';
360	371	}
361		-
	372	+
362	373	// ----------------
363	374	// PRO INIT END
364	375	// ----------------
365	376
366		- // Is the premium features there ?
367		- if(!defined('LOGINIZER_PREMIUM')){
368		-
369		- if(current_user_can('activate_plugins')){
370		- // The promo time
371		- $loginizer['promo_time'] = get_option('loginizer_promo_time');
372		- if(empty($loginizer['promo_time'])){
373		- $loginizer['promo_time'] = time();
374		- update_option('loginizer_promo_time', $loginizer['promo_time']);
375		- }
376		-
377		- // Are we to show the loginizer promo
378		- if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
379		-
380		- add_action('admin_notices', 'loginizer_promo');
381		-
382		- }
383		-
384		- if(!empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
385		-
386		- add_action('admin_notices', 'loginizer_csrf_promo');
387		-
388		- }
389		-
390		- // Are we to disable the promo
391		- if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
392		- update_option('loginizer_promo_time', (0 - time()) );
393		- die('DONE');
394		- }
395		-
396		- $loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
397		-
398		- if(empty($loginizer['backuply_promo'])){
399		- $loginizer['backuply_promo'] = abs($loginizer['promo_time']);
400		- update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
401		- }
402		-
403		- // Setting CSRF Promo time
404		- $loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
405		-
406		- if(empty($loginizer['csrf_promo'])){
407		- $loginizer['csrf_promo'] = abs($loginizer['promo_time']);
408		- update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
409		- }
410		- }
411		- }
412		-
413	377	// Secuity checks for social login.
414	378	if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
415	379	add_action('init', 'loginizer_social_login_load');
416	380	return;
		@@ -541,26 +505,31 @@
541	505
542	506	if(empty($blacklist)){
543	507	return false;
544	508	}
545		-
	509	+
	510	+ $current_ip_inet = inet_ptoi($loginizer['current_ip']);
	511	+
546	512	foreach($blacklist as $k => $v){
547		-
	513	+
	514	+ $start_inet = inet_ptoi($v['start']);
	515	+ $end_inet = inet_ptoi($v['end']);
	516	+
548	517	// Is the IP in the blacklist ?
549		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	518	+ if($start_inet <= $current_ip_inet && $current_ip_inet <= $end_inet){
550	519	$result = 1;
551	520	break;
552	521	}
553		-
	522	+
554	523	// Is it in a wider range ?
555		- if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
	524	+ if($start_inet >= 0 && $end_inet < 0){
556	525
557	526	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
558	527	// if the current IP is <= than the start of the range, it is within the range
559	528	// OR
560	529	// if the current IP is <= than the end of the range, it is within the range
561		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
562		- || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	530	+ if($start_inet <= $current_ip_inet
	531	+ || $current_ip_inet <= $end_inet){
563	532	$result = 1;
564	533	break;
565	534	}
566	535
		@@ -566,9 +535,9 @@
566	535
567	536	}
568	537
569	538	}
570		-
	539	+
571	540	// You are blacklisted
572	541	if(!empty($result)){
573	542	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
574	543	return true;
		@@ -577,52 +546,8 @@
577	546	return false;
578	547
579	548	}
580	549
581		-function loginizer_is_whitelisted(){
582		-
583		- global $wpdb, $loginizer, $lz_error;
584		-
585		- $whitelist = $loginizer['whitelist'];
586		-
587		- if(empty($whitelist)){
588		- return false;
589		- }
590		-
591		- foreach($whitelist as $k => $v){
592		-
593		- // Is the IP in the blacklist ?
594		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
595		- $result = 1;
596		- break;
597		- }
598		-
599		- // Is it in a wider range ?
600		- if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
601		-
602		- // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
603		- // if the current IP is <= than the start of the range, it is within the range
604		- // OR
605		- // if the current IP is <= than the end of the range, it is within the range
606		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
607		- || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
608		- $result = 1;
609		- break;
610		- }
611		-
612		- }
613		-
614		- }
615		-
616		- // You are whitelisted
617		- if(!empty($result)){
618		- return true;
619		- }
620		-
621		- return false;
622		-
623		-}
624		-
625	550	// When the login fails, then this is called
626	551	// We need to update the database
627	552	function loginizer_login_failed($username, $is_2fa = ''){
628	553
		@@ -641,53 +566,78 @@
641	566
642	567	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
643	568
644	569	// The params which comes when social login returns an error, have some characters, which WordPress could not save.
645		- $server_uri = $_SERVER['REQUEST_URI'];
646		- if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
647		- $request_uri = explode('=', $_SERVER['REQUEST_URI']);
	570	+ // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
	571	+ $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
	572	+ $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
	573	+
	574	+ if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
	575	+ $request_uri = explode('=', $server_uri);
648	576	$server_uri = $request_uri[0];
649	577	}
650	578
651		- $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
652		- $url = esc_url($url);
	579	+ // No addslashes() here, $wpdb->prepare() below does the escaping
	580	+ $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
653	581
	582	+ // Must never be 0, we divide by it below
	583	+ $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
	584	+
	585	+ // This way is atomic now, the earlier one were causing race condition.
	586	+ // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
	587	+ // evaluate the assignments from left to right, so lockout must NOT add 1 again
	588	+ $upsert = $wpdb->prepare(
	589	+ "INSERT INTO `".$wpdb->prefix."loginizer_logs`
	590	+ (username, time, count, ip, lockout, url)
	591	+ VALUES
	592	+ (%s, %d, 1, %s, FLOOR(1 / %d), %s)
	593	+ ON DUPLICATE KEY UPDATE
	594	+ username = VALUES(username),
	595	+ time = VALUES(time),
	596	+ count = count + 1,
	597	+ lockout = FLOOR(count / %d),
	598	+ url = VALUES(url)",
	599	+ $username,
	600	+ time(),
	601	+ $loginizer['current_ip'],
	602	+ $max_retries,
	603	+ $url,
	604	+ $max_retries
	605	+ );
	606	+ $wpdb->query($upsert);
	607	+
	608	+ // Re-read the persisted row so email/retries-left reflect the actual count
654	609	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
655	610	$result = lz_selectquery($sel_query);
656		-
657		- if(!empty($result)){
658		- $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
659		-
660		- $update_data = array('username' => $username,
661		- 'time' => time(),
662		- 'count' => $result['count']+1,
663		- 'lockout' => $lockout,
664		- 'url' => $url);
665		-
666		- $where_data = array('ip' => $loginizer['current_ip']);
667		-
668		- $format = array('%s','%d','%d','%d','%s');
669		- $where_format = array('%s');
670		-
671		- $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
672		-
673		- // Do we need to email admin ?
674		- if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
675		-
676		- $lockout_time = $loginizer['lockout_time'];
677		-
678		- if($lockout >= $loginizer['max_lockouts']){
679		- // extended lockout is in hours so we have to convert to minute
680		- $lockout_time = $loginizer['lockouts_extend'];
681		- }
682		-
683		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
684		- $mail = array();
685		- $mail['to'] = $loginizer['notify_email_address'];
686		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
687		- $mail['message'] = 'Hi,
688	611
689		-'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
	612	+ if(empty($result)){
	613	+ $result = array('count' => 0);
	614	+ }
	615	+
	616	+ $count = (int) $result['count'];
	617	+ $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
	618	+
	619	+ // The lockout goes up only on every max_retries'th failure, which is the
	620	+ // attempt that actually locks the IP out. On the failures in between there
	621	+ // is nothing new to report, so we must not email on each one of them
	622	+ $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
	623	+
	624	+ // Do we need to email admin ?
	625	+ if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
	626	+
	627	+ $lockout_time = $loginizer['lockout_time'];
	628	+
	629	+ if($lockout >= $loginizer['max_lockouts']){
	630	+ $lockout_time = $loginizer['lockouts_extend'];
	631	+ }
	632	+
	633	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	634	+ $mail = array();
	635	+ $mail['to'] = $loginizer['notify_email_address'];
	636	+ $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	637	+ $mail['message'] = 'Hi,
	638	+
	639	+'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
690	640	'.home_url().'
691	641
692	642	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
693	643	Last User Attempt : '.$username.'
		@@ -695,35 +645,22 @@
695	645
696	646	Regards,
697	647	Loginizer';
698	648
699		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
700		- }
701		- }else{
702		- $result = array();
703		- $result['count'] = 0;
704		-
705		- $insert_data = array('username' => $username,
706		- 'time' => time(),
707		- 'count' => 1,
708		- 'ip' => $loginizer['current_ip'],
709		- 'lockout' => 0,
710		- 'url' => $url);
711		-
712		- $format = array('%s','%d','%d','%s','%d','%s');
713		-
714		- $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
	649	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
715	650	}
716		-
717		- // We need to add one as this is a failed attempt as well
718		- $result['count'] = $result['count'] + 1;
	651	+
719	652	loginizer_update_attempt_stats(0);
720		- $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
721		- $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
	653	+ $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
	654	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
722	655
723	656	}
724	657	}
725	658
	659	+function loginizer_rsssl_2fa_success($user){
	660	+ loginizer_login_success('', $user);
	661	+}
	662	+
726	663	function loginizer_login_success($user_login, $user) {
727	664	global $wp_version, $loginizer;
728	665
729	666	loginizer_update_attempt_stats(1);
		@@ -887,8 +824,12 @@
887	824
888	825	// Handles social login URL
889	826	function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
890	827	global $loginizer;
	828	+
	829	+ if(loginizer_is_blacklisted()){
	830	+ return $errors;
	831	+ }
891	832
892	833	loginizer_get_social_error();
893	834
894	835	if(empty($loginizer['social_errors'])){