← All changes | init.php +141 -165 1.9.8 → trunk View file →

		@@ -4,9 +4,9 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '1.9.8');
	8	+define('LOGINIZER_VERSION', '2.1.0');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
		@@ -187,8 +187,29 @@
187	187	$wpdb->query("ALTER TABLE ".$wpdb->prefix."loginizer_logs ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;");
188	188
189	189	}
190	190
	191	+ // Setting alignment to left in social login ?
	192	+ if($version < 201){
	193	+ $social_settings = get_option('loginizer_social_settings', []);
	194	+
	195	+ if(!empty($social_settings)){
	196	+ if(!empty($social_settings['login']) && (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
	197	+ $social_settings['login']['button_alignment'] = 'left';
	198	+ }
	199	+
	200	+ if(!empty($social_settings['woocommerce']) && (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
	201	+ $social_settings['woocommerce']['button_alignment'] = 'left';
	202	+ }
	203	+
	204	+ if(!empty($social_settings['comment']) && !empty($social_settings['comment']['enable_buttons'])){
	205	+ $social_settings['comment']['button_alignment'] = 'left';
	206	+ }
	207	+
	208	+ update_option('loginizer_social_settings', $social_settings);
	209	+ }
	210	+ }
	211	+
191	212	// Save the new Version
192	213	update_option('loginizer_version', LOGINIZER_VERSION);
193	214
194	215	// TODO:: REMOVE THIS AFTER MARCH 2025
		@@ -268,8 +289,14 @@
268	289	}
269	290
270	291	// When was the database cleared last time
271	292	$loginizer['last_reset'] = get_option('loginizer_last_reset');
	293	+
	294	+ if(!isset($loginizer['ultimate-member-active'])){
	295	+ $um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
	296	+
	297	+ $loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
	298	+ }
272	299
273	300	//print_r($loginizer);
274	301
275	302	// Clear retries
		@@ -305,17 +332,22 @@
305	332	// Is called before displaying the error message so that we dont show that the username is wrong or the password
306	333	// Update Error message
307	334	add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
308	335	add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
309		- add_action('wp_login', 'loginizer_login_success', 10, 2);
	336	+ add_action('wp_login', 'loginizer_login_success', 11, 2);
	337	+ add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
	338	+
	339	+ if(!empty($loginizer['ultimate-member-active'])){
	340	+ add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
	341	+ }
310	342
311		- if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
	343	+ if(!empty($_COOKIE['lz_social_error']) && !empty($loginizer['social_settings'])){
312	344	add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
313	345	}
314	346	}
315	347
316	348	// Social Login Form Actions
317		- if(!empty($loginizer['social_settings']) && !loginizer_is_blacklisted()){
	349	+ if(!empty($loginizer['social_settings'])){
318	350	if(!empty($loginizer['social_settings']['login']['login_form'])){
319	351	add_action('login_form', 'loginizer_social_btn_login');
320	352	}
321	353	}
		@@ -326,63 +358,16 @@
326	358
327	359	if(is_admin()){
328	360	include_once LOGINIZER_DIR . '/main/admin.php';
329	361	}
330		-
	362	+
331	363	// ----------------
332	364	// PRO INIT END
333	365	// ----------------
334	366
335		- // Is the premium features there ?
336		- if(!defined('LOGINIZER_PREMIUM')){
337		-
338		- if(current_user_can('activate_plugins')){
339		- // The promo time
340		- $loginizer['promo_time'] = get_option('loginizer_promo_time');
341		- if(empty($loginizer['promo_time'])){
342		- $loginizer['promo_time'] = time();
343		- update_option('loginizer_promo_time', $loginizer['promo_time']);
344		- }
345		-
346		- // Are we to show the loginizer promo
347		- if(!empty($loginizer['promo_time']) && $loginizer['promo_time'] > 0 && $loginizer['promo_time'] < (time() - (30*24*3600))){
348		-
349		- add_action('admin_notices', 'loginizer_promo');
350		-
351		- }
352		-
353		- if(!empty($loginizer['csrf_promo']) && $loginizer['csrf_promo'] > 0 && $loginizer['csrf_promo'] < (time() - 86400)){
354		-
355		- add_action('admin_notices', 'loginizer_csrf_promo');
356		-
357		- }
358		-
359		- // Are we to disable the promo
360		- if(isset($_GET['loginizer_promo']) && (int)$_GET['loginizer_promo'] == 0){
361		- update_option('loginizer_promo_time', (0 - time()) );
362		- die('DONE');
363		- }
364		-
365		- $loginizer['backuply_promo'] = get_option('loginizer_backuply_promo_time');
366		-
367		- if(empty($loginizer['backuply_promo'])){
368		- $loginizer['backuply_promo'] = abs($loginizer['promo_time']);
369		- update_option('loginizer_backuply_promo_time', $loginizer['backuply_promo']);
370		- }
371		-
372		- // Setting CSRF Promo time
373		- $loginizer['csrf_promo'] = get_option('loginizer_csrf_promo_time');
374		-
375		- if(empty($loginizer['csrf_promo'])){
376		- $loginizer['csrf_promo'] = abs($loginizer['promo_time']);
377		- update_option('loginizer_csrf_promo_time', $loginizer['csrf_promo']);
378		- }
379		- }
380		- }
381		-
382	367	// Secuity checks for social login.
383		- if(!empty($_GET['lz_social_provider']) && loginizer_can_login()){
384		- include_once LOGINIZER_DIR . '/main/social-login.php';
	368	+ if(!empty($_GET['lz_social_provider']) && loginizer_can_login() && empty($_GET['lz_api'])){
	369	+ add_action('init', 'loginizer_social_login_load');
385	370	return;
386	371	}
387	372	}
388	373
		@@ -491,8 +476,11 @@
491	476	}
492	477
493	478	$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
494	479
	480	+ if(!empty($loginizer['ultimate-member-active']) && class_exists('UM')){
	481	+ \UM()->form()->add_error('blocked_msg', $lz_error['ip_blocked']);
	482	+ }
495	483	return false;
496	484	}
497	485	}
498	486
		@@ -507,26 +495,31 @@
507	495
508	496	if(empty($blacklist)){
509	497	return false;
510	498	}
511		-
	499	+
	500	+ $current_ip_inet = inet_ptoi($loginizer['current_ip']);
	501	+
512	502	foreach($blacklist as $k => $v){
513		-
	503	+
	504	+ $start_inet = inet_ptoi($v['start']);
	505	+ $end_inet = inet_ptoi($v['end']);
	506	+
514	507	// Is the IP in the blacklist ?
515		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	508	+ if($start_inet <= $current_ip_inet && $current_ip_inet <= $end_inet){
516	509	$result = 1;
517	510	break;
518	511	}
519		-
	512	+
520	513	// Is it in a wider range ?
521		- if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
	514	+ if($start_inet >= 0 && $end_inet < 0){
522	515
523	516	// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
524	517	// if the current IP is <= than the start of the range, it is within the range
525	518	// OR
526	519	// if the current IP is <= than the end of the range, it is within the range
527		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
528		- || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
	520	+ if($start_inet <= $current_ip_inet
	521	+ || $current_ip_inet <= $end_inet){
529	522	$result = 1;
530	523	break;
531	524	}
532	525
		@@ -532,9 +525,9 @@
532	525
533	526	}
534	527
535	528	}
536		-
	529	+
537	530	// You are blacklisted
538	531	if(!empty($result)){
539	532	$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
540	533	return true;
		@@ -543,52 +536,8 @@
543	536	return false;
544	537
545	538	}
546	539
547		-function loginizer_is_whitelisted(){
548		-
549		- global $wpdb, $loginizer, $lz_error;
550		-
551		- $whitelist = $loginizer['whitelist'];
552		-
553		- if(empty($whitelist)){
554		- return false;
555		- }
556		-
557		- foreach($whitelist as $k => $v){
558		-
559		- // Is the IP in the blacklist ?
560		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip']) && inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
561		- $result = 1;
562		- break;
563		- }
564		-
565		- // Is it in a wider range ?
566		- if(inet_ptoi($v['start']) >= 0 && inet_ptoi($v['end']) < 0){
567		-
568		- // Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi,
569		- // if the current IP is <= than the start of the range, it is within the range
570		- // OR
571		- // if the current IP is <= than the end of the range, it is within the range
572		- if(inet_ptoi($v['start']) <= inet_ptoi($loginizer['current_ip'])
573		- || inet_ptoi($loginizer['current_ip']) <= inet_ptoi($v['end'])){
574		- $result = 1;
575		- break;
576		- }
577		-
578		- }
579		-
580		- }
581		-
582		- // You are whitelisted
583		- if(!empty($result)){
584		- return true;
585		- }
586		-
587		- return false;
588		-
589		-}
590		-
591	540	// When the login fails, then this is called
592	541	// We need to update the database
593	542	function loginizer_login_failed($username, $is_2fa = ''){
594	543
		@@ -607,53 +556,78 @@
607	556
608	557	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
609	558
610	559	// The params which comes when social login returns an error, have some characters, which WordPress could not save.
611		- $server_uri = $_SERVER['REQUEST_URI'];
612		- if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
613		- $request_uri = explode('=', $_SERVER['REQUEST_URI']);
	560	+ // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
	561	+ $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
	562	+ $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
	563	+
	564	+ if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
	565	+ $request_uri = explode('=', $server_uri);
614	566	$server_uri = $request_uri[0];
615	567	}
616	568
617		- $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
618		- $url = esc_url($url);
	569	+ // No addslashes() here, $wpdb->prepare() below does the escaping
	570	+ $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
619	571
	572	+ // Must never be 0, we divide by it below
	573	+ $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
	574	+
	575	+ // This way is atomic now, the earlier one were causing race condition.
	576	+ // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
	577	+ // evaluate the assignments from left to right, so lockout must NOT add 1 again
	578	+ $upsert = $wpdb->prepare(
	579	+ "INSERT INTO `".$wpdb->prefix."loginizer_logs`
	580	+ (username, time, count, ip, lockout, url)
	581	+ VALUES
	582	+ (%s, %d, 1, %s, FLOOR(1 / %d), %s)
	583	+ ON DUPLICATE KEY UPDATE
	584	+ username = VALUES(username),
	585	+ time = VALUES(time),
	586	+ count = count + 1,
	587	+ lockout = FLOOR(count / %d),
	588	+ url = VALUES(url)",
	589	+ $username,
	590	+ time(),
	591	+ $loginizer['current_ip'],
	592	+ $max_retries,
	593	+ $url,
	594	+ $max_retries
	595	+ );
	596	+ $wpdb->query($upsert);
	597	+
	598	+ // Re-read the persisted row so email/retries-left reflect the actual count
620	599	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
621	600	$result = lz_selectquery($sel_query);
622		-
623		- if(!empty($result)){
624		- $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
625		-
626		- $update_data = array('username' => $username,
627		- 'time' => time(),
628		- 'count' => $result['count']+1,
629		- 'lockout' => $lockout,
630		- 'url' => $url);
631		-
632		- $where_data = array('ip' => $loginizer['current_ip']);
633		-
634		- $format = array('%s','%d','%d','%d','%s');
635		- $where_format = array('%s');
636		-
637		- $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
638		-
639		- // Do we need to email admin ?
640		- if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
641		-
642		- $lockout_time = $loginizer['lockout_time'];
643		-
644		- if($lockout >= $loginizer['max_lockouts']){
645		- // extended lockout is in hours so we have to convert to minute
646		- $lockout_time = $loginizer['lockouts_extend'];
647		- }
648		-
649		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
650		- $mail = array();
651		- $mail['to'] = $loginizer['notify_email_address'];
652		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
653		- $mail['message'] = 'Hi,
654	601
655		-'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
	602	+ if(empty($result)){
	603	+ $result = array('count' => 0);
	604	+ }
	605	+
	606	+ $count = (int) $result['count'];
	607	+ $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
	608	+
	609	+ // The lockout goes up only on every max_retries'th failure, which is the
	610	+ // attempt that actually locks the IP out. On the failures in between there
	611	+ // is nothing new to report, so we must not email on each one of them
	612	+ $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
	613	+
	614	+ // Do we need to email admin ?
	615	+ if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
	616	+
	617	+ $lockout_time = $loginizer['lockout_time'];
	618	+
	619	+ if($lockout >= $loginizer['max_lockouts']){
	620	+ $lockout_time = $loginizer['lockouts_extend'];
	621	+ }
	622	+
	623	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	624	+ $mail = array();
	625	+ $mail['to'] = $loginizer['notify_email_address'];
	626	+ $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	627	+ $mail['message'] = 'Hi,
	628	+
	629	+'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
656	630	'.home_url().'
657	631
658	632	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
659	633	Last User Attempt : '.$username.'
		@@ -661,35 +635,22 @@
661	635
662	636	Regards,
663	637	Loginizer';
664	638
665		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
666		- }
667		- }else{
668		- $result = array();
669		- $result['count'] = 0;
670		-
671		- $insert_data = array('username' => $username,
672		- 'time' => time(),
673		- 'count' => 1,
674		- 'ip' => $loginizer['current_ip'],
675		- 'lockout' => 0,
676		- 'url' => $url);
677		-
678		- $format = array('%s','%d','%d','%s','%d','%s');
679		-
680		- $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
	639	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
681	640	}
682		-
683		- // We need to add one as this is a failed attempt as well
684		- $result['count'] = $result['count'] + 1;
	641	+
685	642	loginizer_update_attempt_stats(0);
686		- $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
687		- $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
	643	+ $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
	644	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
688	645
689	646	}
690	647	}
691	648
	649	+function loginizer_rsssl_2fa_success($user){
	650	+ loginizer_login_success('', $user);
	651	+}
	652	+
692	653	function loginizer_login_success($user_login, $user) {
693	654	global $wp_version, $loginizer;
694	655
695	656	loginizer_update_attempt_stats(1);
		@@ -843,11 +804,22 @@
843	804	wc_add_notice( loginizer_retries_left(), 'error' );
844	805	}
845	806	}
846	807
	808	+function loginizer_ultimatemember_error_handler(){
	809	+
	810	+ if(class_exists('UM')){
	811	+ \UM()->form()->add_error('remaining_tries', loginizer_retries_left());
	812	+ }
	813	+}
	814	+
847	815	// Handles social login URL
848	816	function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
849	817	global $loginizer;
	818	+
	819	+ if(loginizer_is_blacklisted()){
	820	+ return $errors;
	821	+ }
850	822
851	823	loginizer_get_social_error();
852	824
853	825	if(empty($loginizer['social_errors'])){
		@@ -944,8 +916,12 @@
944	916	$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
945	917	}
946	918	}
947	919
	920	+}
	921	+
	922	+function loginizer_social_login_load(){
	923	+ include_once LOGINIZER_DIR . '/main/social-login.php';
948	924	}
949	925
950	926	// Checks if softaculous is installed on the server.
951	927	function loginizer_check_softaculous(){