← All changes | init.php +68 -60 2.0.9 → trunk View file →

		@@ -4,9 +4,9 @@
4	4	echo 'You are not allowed to access this page directly.';
5	5	exit;
6	6	}
7	7
8		-define('LOGINIZER_VERSION', '2.0.9');
	8	+define('LOGINIZER_VERSION', '2.1.0');
9	9	define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
10	10	define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
11	11	define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
12	12	define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
		@@ -556,53 +556,78 @@
556	556
557	557	if(empty($lz_cannot_login) && empty($loginizer['ip_is_whitelisted']) && empty($loginizer['no_loginizer_logs'])){
558	558
559	559	// The params which comes when social login returns an error, have some characters, which WordPress could not save.
560		- $server_uri = $_SERVER['REQUEST_URI'];
561		- if(!empty($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'lz_social_provider') !== FALSE){
562		- $request_uri = explode('=', $_SERVER['REQUEST_URI']);
	560	+ // REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
	561	+ $server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
	562	+ $http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
	563	+
	564	+ if(!empty($server_uri) && strpos($server_uri, 'lz_social_provider') !== FALSE){
	565	+ $request_uri = explode('=', $server_uri);
563	566	$server_uri = $request_uri[0];
564	567	}
565	568
566		- $url = @addslashes((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$server_uri);
567		- $url = esc_url($url);
	569	+ // No addslashes() here, $wpdb->prepare() below does the escaping
	570	+ $url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
568	571
	572	+ // Must never be 0, we divide by it below
	573	+ $max_retries = (int) $loginizer['max_retries'] < 1 ? 1 : (int) $loginizer['max_retries'];
	574	+
	575	+ // This way is atomic now, the earlier one were causing race condition.
	576	+ // NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
	577	+ // evaluate the assignments from left to right, so lockout must NOT add 1 again
	578	+ $upsert = $wpdb->prepare(
	579	+ "INSERT INTO `".$wpdb->prefix."loginizer_logs`
	580	+ (username, time, count, ip, lockout, url)
	581	+ VALUES
	582	+ (%s, %d, 1, %s, FLOOR(1 / %d), %s)
	583	+ ON DUPLICATE KEY UPDATE
	584	+ username = VALUES(username),
	585	+ time = VALUES(time),
	586	+ count = count + 1,
	587	+ lockout = FLOOR(count / %d),
	588	+ url = VALUES(url)",
	589	+ $username,
	590	+ time(),
	591	+ $loginizer['current_ip'],
	592	+ $max_retries,
	593	+ $url,
	594	+ $max_retries
	595	+ );
	596	+ $wpdb->query($upsert);
	597	+
	598	+ // Re-read the persisted row so email/retries-left reflect the actual count
569	599	$sel_query = $wpdb->prepare("SELECT * FROM `".$wpdb->prefix."loginizer_logs` WHERE `ip` = %s", $loginizer['current_ip']);
570	600	$result = lz_selectquery($sel_query);
571		-
572		- if(!empty($result)){
573		- $lockout = floor((($result['count']+1) / $loginizer['max_retries']));
574		-
575		- $update_data = array('username' => $username,
576		- 'time' => time(),
577		- 'count' => $result['count']+1,
578		- 'lockout' => $lockout,
579		- 'url' => $url);
580		-
581		- $where_data = array('ip' => $loginizer['current_ip']);
582		-
583		- $format = array('%s','%d','%d','%d','%s');
584		- $where_format = array('%s');
585		-
586		- $wpdb->update($wpdb->prefix.'loginizer_logs', $update_data, $where_data, $format, $where_format);
587		-
588		- // Do we need to email admin ?
589		- if(!empty($loginizer['notify_email']) && $lockout >= $loginizer['notify_email']){
590		-
591		- $lockout_time = $loginizer['lockout_time'];
592		-
593		- if($lockout >= $loginizer['max_lockouts']){
594		- // extended lockout is in hours so we have to convert to minute
595		- $lockout_time = $loginizer['lockouts_extend'];
596		- }
597		-
598		- $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
599		- $mail = array();
600		- $mail['to'] = $loginizer['notify_email_address'];
601		- $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
602		- $mail['message'] = 'Hi,
603	601
604		-'.($result['count']+1).' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
	602	+ if(empty($result)){
	603	+ $result = array('count' => 0);
	604	+ }
	605	+
	606	+ $count = (int) $result['count'];
	607	+ $lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;
	608	+
	609	+ // The lockout goes up only on every max_retries'th failure, which is the
	610	+ // attempt that actually locks the IP out. On the failures in between there
	611	+ // is nothing new to report, so we must not email on each one of them
	612	+ $is_new_lockout = !empty($count) && ($count % $max_retries) == 0;
	613	+
	614	+ // Do we need to email admin ?
	615	+ if(!empty($loginizer['notify_email']) && !empty($is_new_lockout) && $lockout >= $loginizer['notify_email']){
	616	+
	617	+ $lockout_time = $loginizer['lockout_time'];
	618	+
	619	+ if($lockout >= $loginizer['max_lockouts']){
	620	+ $lockout_time = $loginizer['lockouts_extend'];
	621	+ }
	622	+
	623	+ $sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	624	+ $mail = array();
	625	+ $mail['to'] = $loginizer['notify_email_address'];
	626	+ $mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
	627	+ $mail['message'] = 'Hi,
	628	+
	629	+'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
605	630	'.home_url().'
606	631
607	632	Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
608	633	Last User Attempt : '.$username.'
		@@ -610,31 +635,14 @@
610	635
611	636	Regards,
612	637	Loginizer';
613	638
614		- @wp_mail($mail['to'], $mail['subject'], $mail['message']);
615		- }
616		- }else{
617		- $result = array();
618		- $result['count'] = 0;
619		-
620		- $insert_data = array('username' => $username,
621		- 'time' => time(),
622		- 'count' => 1,
623		- 'ip' => $loginizer['current_ip'],
624		- 'lockout' => 0,
625		- 'url' => $url);
626		-
627		- $format = array('%s','%d','%d','%s','%d','%s');
628		-
629		- $wpdb->insert($wpdb->prefix.'loginizer_logs', $insert_data, $format);
	639	+ @wp_mail($mail['to'], $mail['subject'], $mail['message']);
630	640	}
631		-
632		- // We need to add one as this is a failed attempt as well
633		- $result['count'] = $result['count'] + 1;
	641	+
634	642	loginizer_update_attempt_stats(0);
635		- $loginizer['retries_left'] = ($loginizer['max_retries'] - ($result['count'] % $loginizer['max_retries']));
636		- $loginizer['retries_left'] = $loginizer['retries_left'] == $loginizer['max_retries'] ? 0 : $loginizer['retries_left'];
	643	+ $loginizer['retries_left'] = $max_retries - ($count % $max_retries);
	644	+ $loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
637	645
638	646	}
639	647	}
640	648