settings_dashboard.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.8.8

ninjafirewall / lib / settings_dashboard.php

ninjafirewall / lib Last commit date

settings_dashboard.php

557 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n+ / sa / 2
18	*/
19
20	if (! defined('NFW_ENGINE_VERSION') ) {
21	die('Forbidden');
22	}
23
24	nf_not_allowed('block', __LINE__ );
25
26	$nfw_options = nfw_get_option('nfw_options');
27
28	// Tab and div display
29	if ( empty( $_REQUEST['tab'] ) ) { $_REQUEST['tab'] = 'dashboard'; }
30
31	if ( $_REQUEST['tab'] == 'statistics' ) {
32	$dashboard_tab = ''; $dashboard_div = ' style="display:none"';
33	$statistics_tab = ' nav-tab-active'; $statistics_div = '';
34	$about_tab = ''; $about_div = ' style="display:none"';
35
36	} elseif ( $_REQUEST['tab'] == 'about' ) {
37	$dashboard_tab = ''; $dashboard_div = ' style="display:none"';
38	$statistics_tab = ''; $statistics_div = ' style="display:none"';
39	$about_tab = ' nav-tab-active'; $about_div = '';
40
41	} else {
42	$_REQUEST['tab'] = 'dashboard';
43	$dashboard_tab = ' nav-tab-active'; $dashboard_div = '';
44	$statistics_tab = ''; $statistics_div = ' style="display:none"';
45	$about_tab = ''; $about_div = ' style="display:none"';
46	}
47
48	if (! defined('NF_DISABLED') ) {
49	is_nfw_enabled();
50	}
51
52	if (! defined( 'NFW_WPWAF' ) && defined( 'NFW_PID' ) ) {
53	// Check if we have our PID. If we don't, that means there must
54	// be a Full WAF instance of the firewall running in a parent
55	// directory. Therefore, we need to allow Full WAF update from
56	// this page:
57	$nfw_pid = 0;
58	if ( file_exists( NFW_LOG_DIR .'/nfwlog/cache/.pid' ) ) {
59	$nfw_pid = trim( file_get_contents( NFW_LOG_DIR .'/nfwlog/cache/.pid' ) );
60	}
61	if ( NFW_PID != $nfw_pid ) {
62	define('NFW_WPWAF', 2);
63	}
64	}
65
66	// Search for Full WAF post-install
67	$res = get_transient( 'nfw_fullwaf' );
68	if ( $res !== false ) {
69	if ( defined( 'NFW_WPWAF' ) ) {
70	// 1: Apache mod_php
71	// 2: Apache + CGI/FastCGI or PHP-FPM
72	// 3: Apache + suPHP
73	// 4: Nginx + CGI/FastCGI or PHP-FPM
74	// 5: Litespeed
75	// 6: Openlitespeed
76	// 7: Other webserver + CGI/FastCGI or PHP-FPM
77	list( $httpserver, $time ) = explode( ':', $res );
78	$message = '';
79
80	if ( $httpserver == 6 ) {
81	$message = __('Make sure you followed the instructions and restarted Openlitespeed.', 'ninjafirewall' );
82	delete_transient( 'nfw_fullwaf' );
83
84	} elseif ( $httpserver == 1 \|\| $httpserver == 5 ) {
85	$message = sprintf( __('Make sure your HTTP server support the %s directive in .htaccess files. Maybe you need to restart your HTTP server to apply the change, or simply to wait a few seconds and reload this page?', 'ninjafirewall' ), '<code>php_value auto_prepend_file</code>' );
86	delete_transient( 'nfw_fullwaf' );
87
88	} else {
89	$now = time();
90	// <5 minutes
91	if ( $now < $time ) {
92	$time_left = $time - $now;
93	$message = sprintf( __('Because PHP caches INI files, you may need to wait up to five minutes before the changes are reloaded by the PHP interpreter. <strong>Please wait for <font id="nfw-waf-count">%d</font> seconds</strong> before trying again (you can navigate away from this page and come back in a few minutes).', 'ninjafirewall'), (int) $time_left );
94	$countdown = 1;
95	} else {
96	delete_transient( 'nfw_fullwaf' );
97	}
98	}
99	if (! empty( $message ) ) {
100	echo '<div class="notice-warning notice is-dismissible"><p>'.
101	__('Oops! Full WAF mode is not enabled yet.', 'ninjafirewall' ) .'<br />'.
102	$message .
103	'</p></div>';
104	if ( isset( $countdown ) ) {
105	echo '<script>fullwaf_count='. $time_left .';fullwaf=setInterval(nfwjs_fullwaf_countdown,1000);</script>';
106	}
107	}
108	}
109	}
110	// Error log deletion:
111	if (! empty( $_POST['delete-error-log'] ) ){
112	if ( empty( $_POST['nfwnonce_errorlog'] ) \|\| ! wp_verify_nonce( $_POST['nfwnonce_errorlog'], 'delete_error_log' ) ) {
113	wp_nonce_ays('delete_error_log');
114	}
115	if ( file_exists( NFW_LOG_DIR .'/nfwlog/error_log.php' ) ) {
116	@unlink( NFW_LOG_DIR .'/nfwlog/error_log.php' );
117	}
118	}
119	?>
120	<div class="wrap">
121	<h1><img style="vertical-align:top;width:33px;height:33px;" src="<?php echo plugins_url( '/ninjafirewall/images/ninjafirewall_32.png') ?>"> <?php _e('NinjaFirewall (WP Edition)', 'ninjafirewall') ?></h1>
122
123	<?php
124
125	// Display a one-time notice after two weeks of use
126	nfw_rate_notice( $nfw_options );
127
128	// Full WAF settings change
129	if (! empty( $_GET['nfwafconfig'] ) ) {
130	echo '<div class="updated notice is-dismissible"><p>' . esc_html__('Your changes have been saved.', 'ninjafirewall') . '</p></div>';
131	}
132	?>
133	<br />
134	<h2 class="nav-tab-wrapper wp-clearfix" style="cursor:pointer">
135	<a id="tab-dashboard" class="nav-tab<?php echo $dashboard_tab ?>" onClick="nfwjs_switch_tabs('dashboard', 'dashboard:statistics:about')"><?php _e( 'Dashboard', 'ninjafirewall' ) ?></a>
136	<a id="tab-statistics" class="nav-tab<?php echo $statistics_tab ?>" href="?page=NinjaFirewall&tab=statistics"><?php _e( 'Statistics', 'ninjafirewall' ) ?></a>
137	<a id="tab-about" class="nav-tab<?php echo $about_tab ?>" onClick="nfwjs_switch_tabs('about', 'dashboard:statistics:about')"><?php _e( 'About...', 'ninjafirewall' ) ?></a>
138	<?php nfw_contextual_help() ?>
139	</h2>
140
141	<br />
142
143	<!-- Dashboard -->
144
145	<div id="dashboard-options"<?php echo $dashboard_div ?>>
146
147	<h3><?php _e('Firewall Dashboard', 'ninjafirewall') ?></h3>
148
149	<table>
150	<tr>
151	<td>
152	<table class="form-table nfw-table">
153
154	<?php
155	if ( NF_DISABLED ) {
156	// An instance of the firewall running in Full WAF (or Pro/Pro+ Edition)
157	// in a parent directory will force us to run in Full WAF mode to override it.
158	if ( defined( 'NFW_STATUS' ) && ( NFW_STATUS > 19 && NFW_STATUS < 24 ) ) {
159	$msg = __('It seems that you may have another instance of NinjaFirewall running in a parent directory. Make sure to follow these instructions:', 'ninjafirewall');
160	$msg.= '<ol><li>';
161	$msg.= __('Temporarily disable the firewall in the parent folder by renaming its PHP INI or .htaccess file.', 'ninjafirewall');
162	$msg.= '</li><li>';
163	$msg.= __('Install NinjaFirewall on this site in Full WAF mode.', 'ninjafirewall');
164	$msg.= '</li><li>';
165	$msg.= __('Restore the PHP INI or .htaccess in the parent folder to re-enable the firewall.', 'ninjafirewall');
166	$msg.= '</li></ol>';
167
168	} elseif (! empty( $GLOBALS['err_fw'][NF_DISABLED] ) ) {
169	$msg = $GLOBALS['err_fw'][NF_DISABLED];
170	} else {
171	$msg = __('Unknown error', 'ninjafirewall') .' #'. NF_DISABLED;
172	}
173	?>
174	<tr>
175	<th scope="row" class="row-med"><?php _e('Firewall', 'ninjafirewall') ?></th>
176	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php echo $msg ?></td>
177	</tr>
178
179	<?php
180	} else {
181	?>
182	<tr>
183	<th scope="row" class="row-med"><?php _e('Firewall', 'ninjafirewall') ?></th>
184	<td><?php _e('Enabled', 'ninjafirewall') ?></td>
185	</tr>
186	<?php
187	}
188
189	?>
190	<tr>
191	<th scope="row" class="row-med"><?php esc_html_e('Mode', 'ninjafirewall') ?></th>
192	<td>
193	<?php
194	if ( defined( 'NFW_WPWAF' ) ) {
195	printf( esc_html__('NinjaFirewall is running in %s mode. For better protection, activate its Full WAF mode:', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/full_waf-vs-wordpress_waf/" target="_blank">WordPress WAF</a>');
196	?>
197	<p><input type="button" id="nfw-activate-thickbox" value="<?php esc_attr_e('Activate Full WAF mode', 'ninjafirewall') ?>" class="button-secondary"></p>
198	<?php
199	} else {
200	if (! NF_DISABLED ) {
201	printf( esc_html__('NinjaFirewall is running in %s mode.', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/full_waf-vs-wordpress_waf/" target="_blank">Full WAF</a>');
202	?>
203	<p><input type="button" id="nfw-configure-thickbox" value="<?php esc_attr_e('Configure', 'ninjafirewall') ?>" class="button-secondary"></p>
204	<?php
205	} else {
206	echo '-';
207	}
208	}
209	?>
210	</td>
211	</tr>
212	<?php
213
214	if (! empty( $nfw_options['debug'] ) ) {
215	?>
216	<tr>
217	<th scope="row" class="row-med"><?php _e('Debugging mode', 'ninjafirewall') ?></th>
218	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php _e('Enabled.', 'ninjafirewall') ?> <a href="?page=nfsubopt"><?php _e('Click here to turn Debugging Mode off', 'ninjafirewall') ?></a></td>
219	</tr>
220	<?php
221	}
222	?>
223	<tr>
224	<th scope="row" class="row-med"><?php _e('Edition', 'ninjafirewall') ?></th>
225	<td>WP Edition ~ <a href="?page=nfsubwplus"><?php _e('Need more security? Explore our supercharged premium version: NinjaFirewall (WP+ Edition)', 'ninjafirewall' ) ?></a></td>
226	</tr>
227	<tr>
228	<th scope="row" class="row-med"><?php _e('Version', 'ninjafirewall') ?></th>
229	<td><?php echo NFW_ENGINE_VERSION . ' ~ ' . __('Security rules:', 'ninjafirewall' ) . ' ' . preg_replace('/(\d{4})(\d\d)(\d\d)/', '$1-$2-$3', $nfw_options['rules_version']) ?></td>
230	</tr>
231
232	<tr>
233	<th scope="row" class="row-med"><?php _e('PHP SAPI', 'ninjafirewall') ?></th>
234	<td>
235	<?php
236	if ( defined('HHVM_VERSION') ) {
237	echo 'HHVM';
238	} else {
239	echo strtoupper(PHP_SAPI);
240	}
241	echo ' ~ '. PHP_MAJOR_VERSION .'.'. PHP_MINOR_VERSION .'.'. PHP_RELEASE_VERSION;
242	?>
243	</td>
244	</tr>
245	<?php
246
247	// If security rules updates are disabled, warn the user
248	if ( empty( $nfw_options['enable_updates'] ) ) {
249	?>
250	<tr>
251	<th scope="row" class="row-med"><?php _e('Updates', 'ninjafirewall') ?></th>
252	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><a href="?page=nfsubupdates&tab=updates"><?php _e( 'Security rules updates are disabled.', 'ninjafirewall' ) ?></a> <?php _e( 'If you want your blog to be protected against the latest threats, enable automatic security rules updates.', 'ninjafirewall' ) ?></td>
253	</tr>
254	<?php
255	}
256
257	if ( empty( NinjaFirewall_session::read('nfw_goodguy') ) ) {
258	?>
259	<tr>
260	<th scope="row" class="row-med"><?php _e('Admin user', 'ninjafirewall') ?></th>
261	<td><span class="dashicons dashicons-warning nfw-warning"></span><?php printf( __('You are not whitelisted. Ensure that the "Do not block WordPress administrator" option is enabled in the <a href="%s">Firewall Policies</a> menu, otherwise you could get blocked by the firewall while working from your administration dashboard.', 'ninjafirewall'), '?page=nfsubpolicies') ?></td>
262	</tr>
263	<?php
264	} else {
265	$current_user = wp_get_current_user();
266	?>
267	<tr>
268	<th scope="row" class="row-med"><?php _e('Admin user', 'ninjafirewall') ?></th>
269	<td><code><?php echo htmlspecialchars( $current_user->user_login ) ?></code>: <?php _e('You are whitelisted by the firewall.', 'ninjafirewall') ?></td>
270	</tr>
271	<?php
272	}
273	if ( defined('NFW_ALLOWED_ADMIN') && ! is_multisite() ) {
274	?>
275	<tr>
276	<th scope="row" class="row-med"><?php _e('Restrictions', 'ninjafirewall') ?></th>
277	<td><?php _e('Access to NinjaFirewall is restricted to specific users.', 'ninjafirewall') ?></td>
278	</tr>
279	<?php
280	}
281
282	// Try to find out if there is any "lost" session between the firewall
283	// and the plugin part of NinjaFirewall (could be a buggy plugin killing
284	// the session etc), unless we just installed it
285	if ( defined( 'NFW_SWL' ) && ! empty( NinjaFirewall_session::read('nfw_goodguy') ) && empty( $_REQUEST['nfw_firstrun'] ) ) {
286	?>
287	<tr>
288	<th scope="row" class="row-med"><?php esc_html_e('User session', 'ninjafirewall') ?></th>
289	<td><span class="dashicons dashicons-warning nfw-warning"></span><?php esc_html_e('It seems that the user session set by NinjaFirewall was not found by the firewall script.', 'ninjafirewall') ?></td>
290	</tr>
291	<?php
292	} else {
293	/**
294	* Don't display info about the session if we're using the NinjaFirewall's built-in session.
295	*/
296	if ( is_file( NFW_LOG_DIR .'/nfwlog/phpsession') ) {
297	?>
298	<tr>
299	<th scope="row" class="row-med"><?php esc_html_e('User session', 'ninjafirewall') ?></th>
300	<td><?php
301	printf(
302	/* Translators: path to the file */
303	esc_html__('You are using PHP sessions. If you want to switch to NinjaFirewall sessions, please delete the following file: %s.', 'nfwplus'),
304	'<code>'. esc_html( NFW_LOG_DIR .'/nfwlog/phpsession') .'</code>'
305	); ?>
306	</td>
307	</tr>
308	<?php
309	}
310	}
311
312	if ( ! empty( $nfw_options['clogs_pubkey'] ) ) {
313	$err_msg = $ok_msg = '';
314	if (! preg_match( '/^[a-f0-9]{40}:([a-f0-9:.]{3,39}\|\*)$/', $nfw_options['clogs_pubkey'], $match ) ) {
315	$err_msg = sprintf( __('the public key is invalid. Please <a href="%s">check your configuration</a>.', 'ninjafirewall'), '?page=nfsublog#clogs');
316
317	} else {
318	if ( $match[1] == '*' ) {
319	$ok_msg = __( "No IP address restriction.", 'ninjafirewall');
320
321	} elseif ( filter_var( $match[1], FILTER_VALIDATE_IP ) ) {
322	$ok_msg = sprintf( __("IP address %s is allowed to access NinjaFirewall's log on this server.", 'ninjafirewall'), htmlspecialchars( $match[1]) );
323
324	} else {
325	$err_msg = sprintf( __('the whitelisted IP is not valid. Please <a href="%s">check your configuration</a>.', 'ninjafirewall'), '?page=nfsublog#clogs');
326	}
327	}
328	?>
329	<tr>
330	<th scope="row" class="row-med"><?php _e('Centralized Logging', 'ninjafirewall') ?></th>
331	<?php
332	if ( $err_msg ) {
333	?>
334	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php printf( __('Error: %s', 'ninjafirewall'), $err_msg) ?></td>
335	</tr>
336	<?php
337	$err_msg = '';
338	} else {
339	?>
340	<td><a href="?page=nfsublog#clogs"><?php _e('Enabled', 'ninjafirewall'); echo "</a>. $ok_msg"; ?></td>
341	</tr>
342	<?php
343	}
344	}
345
346	if (! filter_var(NFW_REMOTE_ADDR, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE) ) {
347	?>
348	<tr>
349	<th scope="row" class="row-med"><?php _e('Source IP', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can use the IP Access Control section to easily configure all IP address related options (source, whitelist, blacklist, rate limiting etc).', 'ninjafirewall' ) ?>"></span></th>
350	<td><span class="dashicons dashicons-warning nfw-warning"></span><?php printf( __('You have a private IP : %s', 'ninjafirewall') .'<br />'. __('If your site is behind a reverse proxy or a load balancer, ensure that you have setup your HTTP server or PHP to forward the correct visitor IP, otherwise use the NinjaFirewall %s configuration file.', 'ninjafirewall'), htmlentities(NFW_REMOTE_ADDR), '<code><a href="https://blog.nintechnet.com/ninjafirewall-wp-edition-the-htninja-configuration-file/">.htninja</a></code>') ?></td>
351	</tr>
352	<?php
353	}
354	if (! empty( $_SERVER["HTTP_CF_CONNECTING_IP"] ) ) {
355	if ( NFW_REMOTE_ADDR != $_SERVER["HTTP_CF_CONNECTING_IP"] ) {
356	?>
357	<tr>
358	<th scope="row" class="row-med"><?php _e('CDN detection', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can use the IP Access Control section to easily configure all IP address related options (source, whitelist, blacklist, rate limiting etc).', 'ninjafirewall' ) ?>"></span></th>
359	<td><span class="dashicons dashicons-warning nfw-warning"></span><?php printf( __('%s detected: you seem to be using Cloudflare CDN services. Ensure that you have setup your HTTP server or PHP to forward the correct visitor IP, otherwise use the NinjaFirewall %s configuration file.', 'ninjafirewall'), '<code>HTTP_CF_CONNECTING_IP</code>', '<code><a href="https://blog.nintechnet.com/ninjafirewall-wp-edition-the-htninja-configuration-file/">.htninja</a></code>') ?></td>
360	</tr>
361	<?php
362	}
363	}
364	if (! empty( $_SERVER["HTTP_INCAP_CLIENT_IP"] ) ) {
365	if ( NFW_REMOTE_ADDR != $_SERVER["HTTP_INCAP_CLIENT_IP"] ) {
366	?>
367	<tr>
368	<th scope="row" class="row-med"><?php _e('CDN detection', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can use the IP Access Control section to easily configure all IP address related options (source, whitelist, blacklist, rate limiting etc).', 'ninjafirewall' ) ?>"></span></th>
369	<td><span class="dashicons dashicons-warning nfw-warning"></span><?php printf( __('%s detected: you seem to be using Incapsula CDN services. Ensure that you have setup your HTTP server or PHP to forward the correct visitor IP, otherwise use the NinjaFirewall %s configuration file.', 'ninjafirewall'), '<code>HTTP_INCAP_CLIENT_IP</code>', '<code><a href="https://blog.nintechnet.com/ninjafirewall-wp-edition-the-htninja-configuration-file/">.htninja</a></code>') ?></td>
370	</tr>
371	<?php
372	}
373	}
374
375	if (! is_writable( NFW_LOG_DIR . '/nfwlog' ) ) {
376	?>
377	<tr>
378	<th scope="row" class="row-med"><?php _e('Log dir', 'ninjafirewall') ?></th>
379	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php printf( __('%s directory is not writable! Please chmod it to 0777 or equivalent.', 'ninjafirewall'), '<code>'. htmlspecialchars(NFW_LOG_DIR) .'/nfwlog/</code>') ?></td>
380	</tr>
381	<?php
382	}
383
384	if (! is_writable( NFW_LOG_DIR . '/nfwlog/cache') ) {
385	?>
386	<tr>
387	<th scope="row" class="row-med"><?php _e('Log dir', 'ninjafirewall') ?></th>
388	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php printf(__('%s directory is not writable! Please chmod it to 0777 or equivalent.', 'ninjafirewall'), '<code>'. htmlspecialchars(NFW_LOG_DIR) . '/nfwlog/cache/</code>') ?></td>
389	</tr>
390	<?php
391	}
392
393
394	if (! defined('NF_DISABLE_PHPINICHECK') && ! defined('NFW_WPWAF') ) {
395
396	// Make sure the PHP INI is not viewable by webusers
397	if ( file_exists( ABSPATH .'php.ini' ) ) {
398	$res = nfw_is_inireadable( 'php.ini' );
399	if ( $res !== false ) {
400	?>
401	<tr>
402	<th scope="row" class="row-med">PHP INI</th>
403	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php printf( esc_html__('The php.ini file is readable by web users: %s', 'ninjafirewall'), '<code>'. htmlspecialchars( $res ) .'</code>' ) ?> <br /><a href="https://blog.nintechnet.com/protecting-ninjafirewalls-php-ini-file/" target="_blank"><?php esc_html_e('Consult our blog for more info.', 'ninjafirewall') ?></a></td>
404	</tr>
405	<?php
406	}
407	}
408	if ( file_exists( ABSPATH .'.user.ini' ) ) {
409	$res = nfw_is_inireadable( '.user.ini' );
410	if ( $res !== false ) {
411	?>
412	<tr>
413	<th scope="row" class="row-med">PHP INI</th>
414	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><?php printf( esc_html__('The .user.ini file is readable by web users: %s', 'ninjafirewall'), '<code>'. htmlspecialchars( $res ) .'</code>' ) ?><br /><a href="https://blog.nintechnet.com/protecting-ninjafirewalls-php-ini-file/" target="_blank"><?php esc_html_e('Consult our blog for more info.', 'ninjafirewall') ?></a></td>
415	</tr>
416	<?php
417	}
418	}
419	}
420
421	// Error log
422	$log = NFW_LOG_DIR . '/nfwlog/error_log.php';
423	if ( file_exists( $log ) ) {
424	$errlog_content = file( $log );
425	array_shift( $errlog_content );
426	if (! empty( $errlog_content ) ) {
427	?>
428	<tr id="error-log-alert">
429	<th scope="row" class="row-med"><?php _e('Error log', 'ninjafirewall') ?></th>
430	<td><span class="dashicons dashicons-dismiss nfw-danger"></span><input type="button" id="nfw-errorlog-thickbox" value="<?php _e('View error log', 'ninjafirewall') ?>" class="button-secondary"></td>
431	</tr>
432	<?php
433	}
434	}
435
436	/**
437	* Check for NinjaFirewall optional config file.
438	*/
439	$doc_root = rtrim( $_SERVER['DOCUMENT_ROOT'], '/');
440	if ( @file_exists( $file = $doc_root . '/.htninja') \|\|
441	@file_exists( $file = dirname( $doc_root ) . '/.htninja') ) {
442
443	echo '<tr>
444	<th scope="row" class="row-med">'. esc_html__('Optional configuration file',
445	'ninjafirewall') .'</th><td><code>'. htmlentities( $file ) .'</code></td>
446	</tr>';
447	/**
448	* Check if we have a MySQLi link identifier defined in the .htninja.
449	*/
450	if (! empty( $GLOBALS['nfw_mysqli'] ) && ! empty( $GLOBALS['nfw_table_prefix'] ) ) {
451	echo '<tr>
452	<th scope="row" class="row-med">'. esc_html__('MySQLi link identifier',
453	'ninjafirewall') .'</th><td>' .
454	esc_html__('A MySQLi link identifier was detected in your <code>.htninja</code>.',
455	'ninjafirewall') . '</td>
456	</tr>';
457	}
458	}
459	?>
460	<tr>
461	<th scope="row" class="row-med"><?php _e('Help & configuration', 'ninjafirewall') ?></th>
462	<td><a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/">Securing WordPress with NinjaFirewall (WP Edition)</a></td>
463	</tr>
464
465	</table>
466
467	</td>
468	<td style="vertical-align:top;text-align: center"><?php
469	/**
470	* Display a discount coupon, if any.
471	*/
472	if (! empty( $nfw_options['coupon']['date'] ) ) {
473	require_once __DIR__ .'/class-coupon.php';
474	$coupon = new NinjaFirewall_coupon();
475	$coupon->show();
476	}
477	?></td>
478	</tr>
479	</table>
480
481	</div>
482
483	<!-- Monthly statistics -->
484	<div id="statistics-options"<?php echo $statistics_div ?>>
485	<?php include __DIR__ .'/settings_dashboard_statistics.php'; ?>
486	</div>
487
488	<!-- About... -->
489	<div id="about-options"<?php echo $about_div ?>>
490	<?php include __DIR__ .'/settings_dashboard_about.php'; ?>
491	</div>
492
493	</div>
494	<?php
495
496	// Load thickbox
497	require __DIR__ .'/thickbox.php';
498
499	// ---------------------------------------------------------------------
500	// Verify if PHP INI file is readable by web users.
501
502	function nfw_is_inireadable( $ini ) {
503
504	if ( is_multisite() ) {
505	$url = network_home_url('/') . $ini;
506	} else {
507	$url = home_url('/') . $ini;
508	}
509	global $wp_version;
510	$opts = array(
511	'http' => array(
512	// We only care about the returned HTTP code
513	'ignore_errors' => true,
514	// Max 2 seconds
515	'timeout' => 2,
516	'method' => "GET",
517	'header' =>
518	"Accept-language: en-US,en;q=0.5\r\n" .
519	"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\n" .
520	"User-Agent: Mozilla/5.0 (compatible; NinjaFirewall/". NFW_ENGINE_VERSION ."; WordPress/$wp_version)\r\n"
521	)
522	);
523
524	if ( empty( $_SERVER['SERVER_ADDR'] ) ) {
525	return false;
526	}
527	$addr = $_SERVER['SERVER_ADDR'];
528	if (! filter_var( $addr, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE ) ) {
529	// We don't want a fatal error if we're running on localhost e.g., dev site etc
530	$opts['ssl']['verify_peer'] = false;
531	$opts['ssl']['verify_peer_name'] = false;
532	}
533	$context = stream_context_create( $opts );
534	// As we don't want monitoring/debugging plugins to throw a warning or error
535	// in the backend because the server returned a 403 error, we don't use
536	// the WordPress's API
537	@file_get_contents( $url, false, $context );
538	/**
539	* $http_response_header is deprecated in PHP 8.5, hence we use the
540	* http_get_last_response_headers() function instead (PHP >= 8.4).
541	*/
542	if ( function_exists('http_get_last_response_headers') ) {
543	$http_response_header = http_get_last_response_headers();
544	}
545	if ( empty( $http_response_header ) ) {
546	return false;
547	}
548	$response = explode( ' ', $http_response_header[0] );
549	if (! empty( $response[1] ) && (int) $response[1] == 200 ) {
550	return $url;
551	}
552	return false;
553
554	}
555	// ---------------------------------------------------------------------
556	// EOF
557