settings_login_protection.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.9

ninjafirewall / lib / settings_login_protection.php

ninjafirewall / lib Last commit date

settings_login_protection.php

598 lines

1	<?php
2	/*
3	+=====================================================================+
4	\| NinjaFirewall (WP+ Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+=====================================================================+ sa / 2
8	*/
9
10	if (! defined( 'NFW_ENGINE_VERSION' ) ) {
11	header('HTTP/1.1 404 Not Found');
12	header('Status: 404 Not Found');
13	exit;
14	}
15
16	// Block immediately if user is not allowed :
17	nf_not_allowed( 'block', __LINE__ );
18
19	echo '
20	<div class="wrap">
21	<h1><img style="vertical-align:top" src="'. plugins_url( '/ninjafirewall/images/ninjafirewall_32.png' ) .'"> ' . __('Login Protection', 'ninjafirewall') . '</h1>';
22
23	// Saved ?
24	if ( isset( $_POST['nfw_options'] ) ) {
25	if ( empty($_POST['nfwnonce'] ) \|\| ! wp_verify_nonce( $_POST['nfwnonce'], 'bfd_save' ) ) {
26	wp_nonce_ays('bfd_save');
27	}
28	$res = nf_sub_loginprot_save();
29	if (! $res ) {
30	echo '<div class="updated notice is-dismissible"><p>' . __('Your changes have been saved.', 'ninjafirewall') . '</p></div>';
31	} else {
32	echo '<div class="error notice is-dismissible"><p>' . $res . '</p></div>';
33	}
34	}
35
36	// Fetch the current configuration, if any :
37	if ( file_exists( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php' ) ) {
38
39	$bfconfig = nfw_read_bf_config( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php' );
40
41	if ( empty( $bfconfig['bf_enable'] ) \|\| ! preg_match('/^[12]$/', $bfconfig['bf_enable'] ) ) {
42	$bfconfig['bf_enable'] = 0;
43	}
44	if ( empty( $bfconfig['bf_request'] ) \|\| ! preg_match('/^(GET\|POST\|GETPOST)$/', $bfconfig['bf_request'] ) ) {
45	$bfconfig['bf_request'] = 'POST';
46	}
47	if ( $bfconfig['bf_request'] == 'GETPOST' ) {
48	$get_post = 'GET/POST';
49	} else {
50	$get_post = $bfconfig['bf_request'];
51	}
52	if ( empty( $bfconfig['bf_bantime'] ) \|\| ! preg_match('/^[1-9][0-9]?$/', $bfconfig['bf_bantime'] ) ) {
53	$bfconfig['bf_bantime'] = 5;
54	}
55	if ( empty( $bfconfig['bf_attempt'] ) \|\| ! preg_match('/^[1-9][0-9]?$/', $bfconfig['bf_attempt'] ) ) {
56	$bfconfig['bf_attempt'] = 8;
57	}
58	if ( empty( $bfconfig['bf_maxtime'] ) \|\| ! preg_match('/^[1-9][0-9]?$/', $bfconfig['bf_maxtime'] ) ) {
59	$bfconfig['bf_maxtime'] = 15;
60	}
61	if ( empty( $bfconfig['auth_pass'] ) ) {
62	$bfconfig['auth_pass'] = '';
63	}
64	if ( empty( $bfconfig['auth_name'] ) \|\| strlen( $bfconfig['auth_pass'] ) != 40 ) {
65	$bfconfig['auth_name']= '';
66	}
67	if ( empty( $bfconfig['auth_msgtxt'] ) ) {
68	// NinjaFirewall <= 3.4.2
69	if (! empty( $bfconfig['auth_msg'] ) ) {
70	$bfconfig['auth_msgtxt'] = $bfconfig['auth_msg'];
71	} else {
72	$bfconfig['auth_msgtxt'] = __('Access restricted', 'ninjafirewall');
73	}
74	} else {
75	$bfconfig['auth_msgtxt'] = base64_decode( $bfconfig['auth_msgtxt'] );
76	}
77	if ( strlen( $bfconfig['auth_msgtxt'] ) > 1024 ) {
78	$bfconfig['auth_msgtxt'] = mb_substr( $bfconfig['auth_msgtxt'], 0, 1024, 'utf-8' );
79	}
80	if ( empty( $bfconfig['captcha_text'] ) ) {
81	$bfconfig['captcha_text'] = __( 'Type the characters you see in the picture below:', 'ninjafirewall' );
82	} else {
83	$bfconfig['captcha_text'] = html_entity_decode( base64_decode( $bfconfig['captcha_text'] ) );
84	if ( strlen( $bfconfig['captcha_text'] ) > 255 ) {
85	$bfconfig['captcha_text'] = mb_substr( $bfconfig['captcha_text'], 0, 255, 'utf-8' );
86	}
87	}
88
89	if ( empty( $bfconfig['bf_xmlrpc'] ) ) {
90	$bfconfig['bf_xmlrpc'] = 0;
91	} else {
92	$bfconfig['bf_xmlrpc'] = 1;
93	}
94	if ( empty( $bfconfig['bf_authlog'] ) ) {
95	$bfconfig['bf_authlog'] = 0;
96	} else {
97	$bfconfig['bf_authlog'] = 1;
98	}
99	if ( empty( $bfconfig['bf_type'] ) ) {
100	// Password
101	$bfconfig['bf_type'] = 0;
102	} else {
103	// Captcha
104	$bfconfig['bf_type'] = 1;
105	}
106	if ( empty( $bfconfig['bf_allow_bot'] ) ) {
107	$bfconfig['bf_allow_bot'] = 0;
108	} else {
109	$bfconfig['bf_allow_bot'] = 1;
110	}
111	if ( empty( $bfconfig['bf_nosig'] ) ) {
112	$bfconfig['bf_nosig'] = 0;
113	} else {
114	$bfconfig['bf_nosig'] = 1;
115	}
116
117	} else {
118	// Default values :
119	$bfconfig['bf_type'] = 1;
120	$bfconfig['bf_enable'] = 0;
121	$bfconfig['bf_request'] = 'POST';
122	$bfconfig['bf_bantime'] = 5;
123	$bfconfig['bf_attempt'] = 8;
124	$bfconfig['bf_maxtime'] = 15;
125	$bfconfig['auth_name'] = '';
126	$bfconfig['auth_msgtxt'] = __('Access restricted', 'ninjafirewall');
127	$bfconfig['bf_xmlrpc'] = 0;
128	$bfconfig['bf_authlog'] = 0;
129	$bfconfig['bf_allow_bot'] = 0;
130	$bfconfig['captcha_text'] = __( 'Type the characters you see in the picture below:', 'ninjafirewall' );
131	$bfconfig['bf_nosig'] = 0;
132	$get_post = 'POST';
133	}
134	?>
135	<script type="text/javascript">
136	var bf_type = <?php echo $bfconfig['bf_type'] ?>;
137	var bf_enable = <?php echo $bfconfig['bf_enable'] ?>;
138	</script>
139	<br />
140	<?php
141	// Protection is disabled:
142	if ( empty( $bfconfig['bf_enable'] ) ) {
143	$ui_enabled = 0;
144	$show_bf_table = 0;
145	$show_bf_table_password = 0;
146	$show_bf_table_extra = 0;
147	$show_bf_table_captcha = 0;
148
149	// Protection set to "When under attack":
150	} elseif ( $bfconfig['bf_enable'] == 1 ) {
151	$ui_enabled = 1;
152	$show_bf_table = 1;
153	$show_bf_table_extra = 1;
154	// Password?
155	if ( empty( $bfconfig['bf_type'] ) ) {
156	$show_bf_table_password = 1;
157	$show_bf_table_captcha = 0;
158	// Captcha?
159	} else {
160	$show_bf_table_password = 0;
161	$show_bf_table_captcha = 1;
162	}
163
164	// Protection set to "Always ON" (2):
165	} else {
166	$ui_enabled = 1;
167	$show_bf_table = 0;
168	$show_bf_table_extra = 1;
169	// Password?
170	if ( empty( $bfconfig['bf_type'] ) ) {
171	$show_bf_table_password = 1;
172	$show_bf_table_captcha = 0;
173	// Captcha?
174	} else {
175	$show_bf_table_password = 0;
176	$show_bf_table_captcha = 1;
177	}
178	}
179
180	// Make sure we can display the captcha with the GD extension:
181	if ( function_exists( 'gd_info' ) ) {
182	$missing_gd = '';
183	$gd_disabled = '';
184	} else {
185	$missing_gd = '<p class="description">' .
186	__( 'GD Support is not available on your server, the CAPTCHA option is disabled.', 'ninjafirewall' ) . '</p>';
187	$gd_disabled = ' disabled="disabled"';
188	}
189	if ( $gd_disabled && $bfconfig['bf_type'] == 1 ) {
190	echo '<div class="error notice is-dismissible"><p>' .
191	__('Error: GD Support is not available on your server, the captcha protection will not work!', 'ninjafirewall') .'</p></div>';
192	}
193	nfw_contextual_help();
194	?>
195	<form method="post" name="bp_form" onSubmit="return check_login_fields();">
196
197	<?php wp_nonce_field('bfd_save', 'nfwnonce', 0); ?>
198
199	<table class="form-table nfw-table">
200	<tr style="background-color:#F9F9F9;border: solid 1px #DFDFDF;">
201	<th scope="row" class="row-med"><?php _e('Enable brute force attack protection', 'ninjafirewall') ?></th>
202	<td>
203	<?php nfw_toggle_switch( 'green', 'ui_enabled', __('Enabled', 'ninjafirewall'), __('Disabled', 'ninjafirewall'), 'large', $ui_enabled, false, 'onclick="nfwjs_up_down(\'submenu_table\');nfwjs_up_down(\'bf_table_extra\');"', 'ui-enabled' ) ?>
204	</td>
205	</tr>
206	</table>
207
208	<br />
209
210	<div class="nfw-table" id="submenu_table"<?php echo $ui_enabled == 1 ? '' : ' style="display:none"' ?>>
211
212	<table class="form-table">
213	<tr>
214	<th scope="row" class="row-med"><?php _e('Type of protection', 'ninjafirewall') ?></th>
215	<td>
216	<p><label><input type="radio" name="nfw_options[bf_type]" value="0"<?php checked($bfconfig['bf_type'], 0) ?> onclick="nfwjs_toggle_table(bf_enable, 0);"> <?php _e('Username + Password', 'ninjafirewall') ?></label></p>
217	<p><label><input type="radio" name="nfw_options[bf_type]" value="1"<?php checked($bfconfig['bf_type'], 1) ?> onclick="nfwjs_toggle_table(bf_enable, 1);"<?php echo $gd_disabled ?> /> <?php _e('Captcha image', 'ninjafirewall') ?></label></p>
218	<?php echo $missing_gd ?>
219	</td>
220	</tr>
221	<tr>
222	<th scope="row" class="row-med"><?php _e('When to enable the protection', 'ninjafirewall') ?></th>
223	<td>
224	<p><label><input type="radio" name="nfw_options[bf_enable]" value="2"<?php checked($bfconfig['bf_enable'], 2) ?> onclick="nfwjs_toggle_submenu(2);"> <?php _e('Always enabled', 'ninjafirewall') ?></label></p>
225	<p><label><input type="radio" name="nfw_options[bf_enable]" value="1"<?php checked($bfconfig['bf_enable'], 1) ?> onclick="nfwjs_toggle_submenu(1);"> <?php _e('When under attack', 'ninjafirewall') ?></label></p>
226	</td>
227	<td>
228	</tr>
229
230	</table>
231
232	<div id="bf_table"<?php echo $show_bf_table == 1 ? '' : ' style="display:none"' ?>>
233	<table class="form-table">
234	<tr>
235	<th scope="row" class="row-med"><?php _e('Protect the login page against', 'ninjafirewall') ?></th>
236	<td>
237	<p><label><input onclick="nfwjs_getpost(this.value);" type="radio" name="nfw_options[bf_request]" value="GET"<?php checked($bfconfig['bf_request'], 'GET') ?>> <?php _e('<code>GET</code> request attacks', 'ninjafirewall') ?></label></p>
238	<p><label><input onclick="nfwjs_getpost(this.value);" type="radio" name="nfw_options[bf_request]" value="POST"<?php checked($bfconfig['bf_request'], 'POST') ?>> <?php _e('<code>POST</code> request attacks (default)', 'ninjafirewall') ?></label></p>
239	<p><label><input onclick="nfwjs_getpost(this.value);" type="radio" name="nfw_options[bf_request]" value="GETPOST"<?php checked($bfconfig['bf_request'], 'GETPOST') ?>> <?php _e('<code>GET</code> and <code>POST</code> requests attacks', 'ninjafirewall') ?></label></p>
240	</td>
241	</tr>
242	<tr>
243	<th scope="row" class="row-med"><?php _e('Enable protection', 'ninjafirewall') ?></th>
244	<td>
245	<?php
246	printf( __('For %1$s minutes, if more than %2$s %3$s requests within %4$s seconds.', 'ninjafirewall'),
247	'<input maxlength="2" size="2" min="1" value="'. $bfconfig['bf_bantime'] .'" name="nfw_options[bf_bantime]" id="ban1" class="small-text" type="number" />',
248	'<input maxlength="2" size="2" min="1" value="'. $bfconfig['bf_attempt'] .'" name="nfw_options[bf_attempt]" id="ban2" class="small-text" type="number" />', '<code id="get_post">'. $get_post .'</code>',
249	'<input maxlength="2" size="2" min="1" value="'. $bfconfig['bf_maxtime'] .'" name="nfw_options[bf_maxtime]" id="ban3" class="small-text" type="number" />'
250	);
251	?>
252	</td>
253	</tr>
254	</table>
255	</div>
256
257	<?php
258	if ( empty( $bfconfig['auth_pass'] ) ) {
259	$placeholder = '';
260	} else {
261	$placeholder = '';
262	}
263	?>
264	<div id="bf_table_password"<?php echo $show_bf_table_password ? '' : ' style="display:none"' ?>>
265	<table class="form-table">
266	<tr>
267	<th scope="row" class="row-med"><?php _e('HTTP authentication', 'ninjafirewall') ?></th>
268	<td>
269	<?php _e('User:', 'ninjafirewall') ?> <input maxlength="255" type="text" autocomplete="off" value="<?php echo htmlspecialchars( $bfconfig['auth_name'] ) ?>" name="nfw_options[auth_name]" onkeyup="nfwjs_auth_user_valid();" />    <?php _e('Password:', 'ninjafirewall') ?> <input maxlength="255" placeholder="<?php echo $placeholder ?>" type="password" autocomplete="off" value="" name="nfw_options[auth_pass]" />
270	<br /><p class="description"> <?php _e('User and Password must be from 6 to 255 characters.', 'ninjafirewall') ?></p>
271	<br /><br /><?php _e('Message (max. 1024 characters, HTML tags allowed)', 'ninjafirewall') ?>:<br />
272	<textarea id="realm" name="nfw_options[auth_msgtxt]" class="large-text code" rows="5" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" oninput="nfwjs_realm_valid();"><?php echo htmlspecialchars( $bfconfig['auth_msgtxt'] ) ?></textarea>
273	</td>
274	</tr>
275	</table>
276	</div>
277
278
279	<div id="bf_table_captcha"<?php echo $show_bf_table_captcha ? '' : ' style="display:none"' ?>>
280	<table class="form-table">
281	<tr>
282	<th scope="row" class="row-med"><?php _e('Message', 'ninjafirewall') ?></th>
283	<td>
284	<input maxlength="255" class="large-text" type="text" autocomplete="off" value="<?php echo htmlspecialchars( $bfconfig['captcha_text'] ) ?>" name="nfw_options[captcha_text]" />
285	<p class="description"><?php _e('This message will be displayed above the captcha. Max. 255 characters.', 'ninjafirewall') ?></p>
286	</td>
287	</tr>
288	</table>
289	</div>
290
291	</div>
292
293	<br />
294
295	<div class="nfw-table" id="bf_table_extra"<?php echo $show_bf_table_extra ? '' : ' style="display:none"' ?>>
296	<h3>  <?php _e('Various options', 'ninjafirewall') ?></h3>
297	<table class="form-table">
298	<?php
299	// Warn the user if Jetpack is installed
300	if ( is_dir( WP_PLUGIN_DIR . '/jetpack' ) ) {
301	$is_JetPack = '<p class="description">'. __('If you are using the Jetpack plugin, blocking access to the XML-RPC API may prevent it from working correctly.', 'ninjafirewall') .'</p>';
302	} else {
303	$is_JetPack = '';
304	}
305	?>
306	<tr>
307	<th scope="row" class="row-med"><?php _e('Apply the protection to the <code>xmlrpc.php</code> script as well', 'ninjafirewall') ?></th>
308	<td>
309	<?php nfw_toggle_switch( 'info', 'nfw_options[bf_xmlrpc]', __('Yes', 'ninjafirewall'), __('No', 'ninjafirewall'), 'small', $bfconfig['bf_xmlrpc'] ) ?>
310	<?php echo $is_JetPack; ?>
311	</td>
312	</tr>
313
314	<tr>
315	<th scope="row" class="row-med"><?php _e('Enable bot protection', 'ninjafirewall') ?></th>
316	<td>
317	<?php
318	if ( $bfconfig['bf_allow_bot'] ) {
319	$bot = 0;
320	} else {
321	$bot = 1;
322	}
323
324	nfw_toggle_switch( 'info', 'nfw_options[bf_allow_bot]', __('Yes', 'ninjafirewall'), __('No', 'ninjafirewall'), 'small', $bot ) ?>
325	</td>
326	</tr>
327
328	<tr>
329	<th scope="row" class="row-med"><?php _e('Write the incident to the server Authentication log', 'ninjafirewall') ?></th>
330	<td>
331	<?php
332	// Ensure that openlog() and syslog() are not disabled:
333	if (! function_exists('syslog') \|\| ! function_exists('openlog') ) {
334	$bfconfig['bf_authlog'] = 0;
335	$bf_msg = __('Your server configuration is not compatible with that option.', 'ninjafirewall');
336	$disabled = 1;
337	} else {
338	$bf_msg = __('The login protection must be set to "When under attack" in order to use this option.', 'ninjafirewall');
339	if ( $bfconfig['bf_enable'] != 1 ) {
340	$disabled = 1;
341	} else {
342	$disabled = 0;
343	}
344	}
345	nfw_toggle_switch( 'info', 'nfw_options[bf_authlog]', __('Yes', 'ninjafirewall'), __('No', 'ninjafirewall'), 'small', $bfconfig['bf_authlog'], $disabled, false, 'nfw-authlog' ) ?>
346	<p class="description"><?php echo $bf_msg ?></p>
347	</td>
348	</tr>
349	<tr>
350	<th scope="row" class="row-med"><?php _e('Disable NinjaFirewall\'s signature on the login protection page', 'ninjafirewall') ?></th>
351	<td>
352	<?php nfw_toggle_switch( 'info', 'nfw_options[bf_nosig]', __('Yes', 'ninjafirewall'), __('No', 'ninjafirewall'), 'small', $bfconfig['bf_nosig'] ) ?>
353	</td>
354	</tr>
355	</table>
356	<br />
357	</div>
358
359	<br />
360
361	<div style="float:left;width:50%">
362	<input id="save_login" class="button-primary" type="submit" name="Save" value="<?php _e('Save Login Protection', 'ninjafirewall') ?>" />
363	</div>
364	<div style="float:right;width:50%;text-align:right">
365	<?php _e('See our benchmark and stress-test:', 'ninjafirewall') ?>
366	<br />
367	<a href="https://blog.nintechnet.com/wordpress-brute-force-attack-detection-plugins-comparison-2015/">Brute-force attack detection plugins comparison</a>
368	</div>
369
370	</form>
371	</div>
372
373	<?php
374
375	/* ================================================================== */
376
377	function nf_sub_loginprot_save() {
378
379	// Block immediately if user is not allowed
380	nf_not_allowed( 'block', __LINE__ );
381
382	// The directory must be writable
383	if (! is_writable( NFW_LOG_DIR . '/nfwlog/cache' ) ) {
384	return( sprintf( __('Error: %s directory is not writable. Please chmod it to 0777.', 'ninjafirewall'), '<code>'. htmlspecialchars(NFW_LOG_DIR) .'/nfwlog/cache</code>') );
385	}
386
387	$nfw_options = nfw_get_option( 'nfw_options' );
388
389	$bf_rand = '';
390	if ( file_exists( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php' ) ) {
391	require( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php' );
392	}
393
394	if ( empty( $_POST['ui_enabled'] ) ) {
395	$_POST['nfw_options']['bf_enable'] = 0;
396	}
397
398	if (! empty( $_POST['nfw_options']['bf_enable'] ) && preg_match( '/^[12]$/', $_POST['nfw_options']['bf_enable'] ) ) {
399	$bf_enable = (int) $_POST['nfw_options']['bf_enable'];
400	} else {
401	$bf_enable = 0;
402	// Clear session
403	NinjaFirewall_session::delete('nfw_bfd');
404	}
405
406	if (! empty( $_POST['nfw_options']['bf_type'] ) && preg_match( '/^[01]$/', $_POST['nfw_options']['bf_type'] ) ) {
407	$bf_type = (int) $_POST['nfw_options']['bf_type'];
408	} else {
409	$bf_type = 0;
410	}
411
412	// Ensure we have all values, otherwise set the default ones
413	if (! empty( $_POST['nfw_options']['bf_request'] ) && preg_match('/^(GET\|POST\|GETPOST)$/', $_POST['nfw_options']['bf_request'] ) ) {
414	$bf_request = $_POST['nfw_options']['bf_request'];
415	} else {
416	$bf_request = 'POST';
417	}
418
419	if (! empty( $_POST['nfw_options']['bf_bantime'] ) && preg_match('/^[1-9][0-9]?$/', $_POST['nfw_options']['bf_bantime'] ) ) {
420	$bf_bantime = (int) $_POST['nfw_options']['bf_bantime'];
421	} else {
422	$bf_bantime = 5;
423	}
424	if (! empty( $_POST['nfw_options']['bf_attempt'] ) && preg_match('/^[1-9][0-9]?$/', $_POST['nfw_options']['bf_attempt'] ) ) {
425	$bf_attempt = (int) $_POST['nfw_options']['bf_attempt'];
426	} else {
427	$bf_attempt = 8;
428	}
429	if (! empty( $_POST['nfw_options']['bf_maxtime'] ) && preg_match('/^[1-9][0-9]?$/', $_POST['nfw_options']['bf_maxtime'] ) ) {
430	$bf_maxtime = (int) $_POST['nfw_options']['bf_maxtime'];
431	} else {
432	$bf_maxtime = 15;
433	}
434
435	if ( empty($_POST['nfw_options']['bf_xmlrpc']) ) {
436	$bf_xmlrpc = 0;
437	} else {
438	$bf_xmlrpc = 1;
439	}
440
441	if ( empty($_POST['nfw_options']['bf_authlog']) ) {
442	$bf_authlog = 0;
443	} else {
444	$bf_authlog = 1;
445	}
446
447	if ( empty($_POST['nfw_options']['bf_allow_bot']) ) {
448	$bf_allow_bot = 1;
449	} else {
450	$bf_allow_bot = 0;
451	}
452
453	if ( empty($_POST['nfw_options']['bf_nosig']) ) {
454	$bf_nosig = 0;
455	} else {
456	$bf_nosig = 1;
457	}
458
459	if ( empty($_POST['nfw_options']['auth_name']) && ! empty( $bf_enable ) && empty( $bf_type ) ) {
460	return( __('Error: please enter a user name for HTTP authentication.', 'ninjafirewall') );
461	} elseif (! preg_match('`^[-/\\_.a-zA-Z0-9]{6,255}$`', $_POST['nfw_options']['auth_name']) && ! empty( $bf_enable ) && empty( $bf_type ) ) {
462	return( __('Error: HTTP authentication user name is not valid.', 'ninjafirewall') );
463	}
464	$auth_name = $_POST['nfw_options']['auth_name'];
465
466	if ( empty($_POST['nfw_options']['auth_pass']) && ! empty( $bf_enable ) && empty( $bf_type ) ) {
467	if ( empty($auth_name) \|\| empty($auth_pass) ) {
468	return( __('Error: please enter a user name and password for HTTP authentication.', 'ninjafirewall') );
469	}
470	} elseif ( (strlen($_POST['nfw_options']['auth_pass']) < 6 \|\| strlen($_POST['nfw_options']['auth_pass']) > 255 ) && ! empty( $bf_enable ) && empty( $bf_type ) ) {
471	return( __('Error: password must be from 6 to 255 characters.', 'ninjafirewall') );
472	} else {
473	// Use stripslashes() to prevent WordPress from escaping the password:
474	$auth_pass = sha1( stripslashes( $_POST['nfw_options']['auth_pass'] ) );
475	}
476
477	if ( empty( $_POST['nfw_options']['auth_msgtxt'] ) ) {
478	$auth_msgtxt = base64_encode( __('Access restricted', 'ninjafirewall') );
479	} else {
480	$auth_msgtxt = stripslashes( $_POST['nfw_options']['auth_msgtxt'] );
481	if ( strlen( $auth_msgtxt ) > 1024 ) {
482	$auth_msgtxt = mb_substr( $auth_msgtxt, 0, 1024, 'utf-8' );
483	}
484	$auth_msgtxt = base64_encode( $auth_msgtxt );
485	}
486
487	if ( empty( $_POST['nfw_options']['captcha_text'] ) ) {
488	$captcha_text = base64_encode( __('Type the characters you see in the picture below:', 'ninjafirewall') );
489	} else {
490	$captcha_text = stripslashes( $_POST['nfw_options']['captcha_text'] );
491	if ( strlen( $captcha_text ) > 255 ) {
492	$captcha_text = mb_substr( $captcha_text, 0, 255, 'utf-8' );
493	}
494	$captcha_text = base64_encode( htmlentities( $captcha_text ) );
495	}
496
497	// Generate a new rand value:
498	$bf_rand = mt_rand(100000, 999999);
499
500	// Save config:
501	$data = "<?php \$bf_enable={$bf_enable};\$bf_type={$bf_type};\$bf_request='{$bf_request}';\$bf_bantime={$bf_bantime};\$bf_attempt={$bf_attempt};\$bf_maxtime={$bf_maxtime};\$bf_xmlrpc={$bf_xmlrpc};\$bf_allow_bot={$bf_allow_bot};\$auth_name='{$auth_name}';\$auth_pass='{$auth_pass}';\$auth_msgtxt='{$auth_msgtxt}';\$bf_rand='{$bf_rand}';\$bf_authlog={$bf_authlog};\$captcha_text='{$captcha_text}';\$bf_nosig={$bf_nosig}; ?>";
502
503
504	$fh = fopen( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php', 'w' );
505	if (! $fh) {
506	return( sprintf( __('Error: unable to write to the %s configuration file', 'ninjafirewall'), '<code>' .
507	htmlspecialchars(NFW_LOG_DIR) . '/nfwlog/cache/bf_conf.php</code>') );
508	}
509	fwrite( $fh, $data );
510	fclose( $fh );
511	// Refresh the opcode cache so that the firewall will load the new content:
512	if ( function_exists( 'opcache_invalidate' ) ) {
513	@opcache_invalidate( NFW_LOG_DIR . '/nfwlog/cache/bf_conf.php', true );
514	}
515
516	// Whitelist the admin
517	if ( $bf_enable ) {
518	NinjaFirewall_session::write( ['nfw_bfd' => $bf_rand ] );
519	}
520
521	// Delete cached files
522	$dir = NFW_LOG_DIR .'/nfwlog/cache';
523	$list = NinjaFirewall_helpers::nfw_glob( $dir, '^bf_', false );
524	foreach( $list as $file ) {
525	// Keep the current configuration file
526	if ( $file == 'bf_conf.php') {
527	continue;
528	}
529	unlink( "$dir/$file" );
530	}
531
532	}
533
534	/* ================================================================== */
535
536	function nfw_read_bf_config( $file ) {
537
538	// Rather then including the file with include() or require(), we open
539	// and read it, because if the user had an opcode cache running, changes
540	// would not appear right away.
541
542	$conf = file_get_contents( $file );
543
544	$bfconfig = array();
545
546	if ( preg_match( '/\$bf_enable=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
547	$bfconfig['bf_enable'] = $match[1];
548	}
549	if ( preg_match( '/\$bf_type=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
550	$bfconfig['bf_type'] = $match[1];
551	}
552	if ( preg_match( '/\$bf_request=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
553	$bfconfig['bf_request'] = $match[1];
554	}
555	if ( preg_match( '/\$bf_bantime=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
556	$bfconfig['bf_bantime'] = $match[1];
557	}
558	if ( preg_match( '/\$bf_attempt=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
559	$bfconfig['bf_attempt'] = $match[1];
560	}
561	if ( preg_match( '/\$bf_maxtime=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
562	$bfconfig['bf_maxtime'] = $match[1];
563	}
564	if ( preg_match( '/\$bf_xmlrpc=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
565	$bfconfig['bf_xmlrpc'] = $match[1];
566	}
567	if ( preg_match( '/\$bf_allow_bot=[\'"]?(\d*)[\'"]?;/', $conf, $match ) ) {
568	$bfconfig['bf_allow_bot'] = $match[1];
569	}
570	if ( preg_match( '/\$auth_name=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
571	$bfconfig['auth_name'] = $match[1];
572	}
573	if ( preg_match( '/\$auth_pass=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
574	$bfconfig['auth_pass'] = $match[1];
575	}
576	if ( preg_match( '/\$auth_msgtxt=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
577	$bfconfig['auth_msgtxt'] = $match[1];
578	}
579	if ( preg_match( '/\$bf_rand=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
580	$bfconfig['bf_rand'] = $match[1];
581	}
582	if ( preg_match( '/\$bf_authlog=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
583	$bfconfig['bf_authlog'] = $match[1];
584	}
585	if ( preg_match( '/\$captcha_text=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
586	$bfconfig['captcha_text'] = $match[1];
587	}
588	if ( preg_match( '/\$bf_nosig=[\'"]?(.*?)[\'"]?;/', $conf, $match ) ) {
589	$bfconfig['bf_nosig'] = $match[1];
590	}
591
592	return $bfconfig;
593
594	}
595
596	/* ================================================================== */
597	// EOF
598