| 1 |
<?php |
| 2 |
|
| 3 |
// Do not allow the file to be called directly. |
| 4 |
if ( ! defined( 'ABSPATH' ) ) { |
| 5 |
exit; |
| 6 |
} |
| 7 |
|
| 8 |
/** |
| 9 |
* This class is used to determine if the IP address of the |
| 10 |
* user is banned. Along with that we check the IP address whitelist. |
| 11 |
*/ |
| 12 |
class P_Ban extends P_Core { |
| 13 |
|
| 14 |
/** |
| 15 |
* Add the actions required for determining the ban. |
| 16 |
* |
| 17 |
* @param Patchstack $core |
| 18 |
* @return void |
| 19 |
*/ |
| 20 |
public function __construct( $core ) { |
| 21 |
parent::__construct( $core ); |
| 22 |
|
| 23 |
if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) { |
| 24 |
return; |
| 25 |
} |
| 26 |
|
| 27 |
add_action( 'init', array( $this, 'ip_ban' ), ~PHP_INT_MAX + 1 ); |
| 28 |
} |
| 29 |
|
| 30 |
/** |
| 31 |
* Determine if the IP address of the user is blocked. |
| 32 |
* |
| 33 |
* @return void |
| 34 |
*/ |
| 35 |
public function ip_ban() { |
| 36 |
if ( ! is_user_logged_in() && $this->is_ip_blocked( $this->get_ip() ) ) { |
| 37 |
$this->plugin->firewall_base->display_error_page( 22 ); |
| 38 |
} |
| 39 |
} |
| 40 |
|
| 41 |
/** |
| 42 |
* Check IP ban. |
| 43 |
* |
| 44 |
* @param string $ip The IP address of the user. |
| 45 |
* @return boolean Whether or not the user is blocked. |
| 46 |
*/ |
| 47 |
public function is_ip_blocked( $ip ) { |
| 48 |
$ip_rules = $this->get_option( 'patchstack_ip_block_list', '' ); |
| 49 |
if ( empty( $ip_rules ) ) { |
| 50 |
return false; |
| 51 |
} |
| 52 |
|
| 53 |
$blocked = false; |
| 54 |
$ip_rules = explode( "\n", $ip_rules ); |
| 55 |
foreach ( $ip_rules as $blocked_ip ) { |
| 56 |
$blocked_ip = trim( $blocked_ip ); |
| 57 |
if ( strpos( $blocked_ip, '*' ) !== false ) { |
| 58 |
$blocked = $this->check_wildcard_rule( $ip, $blocked_ip ); |
| 59 |
} elseif ( strpos( $blocked_ip, '-' ) !== false ) { |
| 60 |
$blocked = $this->check_range_rule( $ip, $blocked_ip ); |
| 61 |
} elseif ( strpos( $blocked_ip, '/' ) !== false ) { |
| 62 |
$blocked = $this->check_subnet_mask_rule( $ip, $blocked_ip ); |
| 63 |
} elseif ( $ip == $blocked_ip ) { |
| 64 |
return true; |
| 65 |
} |
| 66 |
|
| 67 |
if ( $blocked ) { |
| 68 |
return true; |
| 69 |
} |
| 70 |
} |
| 71 |
|
| 72 |
return $blocked; |
| 73 |
} |
| 74 |
|
| 75 |
/** |
| 76 |
* Check IP whitelist for login protection. |
| 77 |
* |
| 78 |
* @param string $ip The IP address of the user. |
| 79 |
* @return boolean Whether or not the user is whitelisted. |
| 80 |
*/ |
| 81 |
public function is_ip_whitelisted( $ip ) { |
| 82 |
$ipRules = explode( "\n", $this->get_option( 'patchstack_login_whitelist', '' ) ); |
| 83 |
if ( empty( $ipRules ) ) { |
| 84 |
return true; |
| 85 |
} |
| 86 |
|
| 87 |
$whitelisted = false; |
| 88 |
foreach ( $ipRules as $ipRule ) { |
| 89 |
if ( strpos( $ipRule, '*' ) !== false ) { |
| 90 |
$whitelisted = $this->check_wildcard_rule( $ip, $ipRule ); |
| 91 |
} elseif ( strpos( $ipRule, '-' ) !== false ) { |
| 92 |
$whitelisted = $this->check_range_rule( $ip, $ipRule ); |
| 93 |
} elseif ( strpos( $ipRule, '/' ) !== false ) { |
| 94 |
$whitelisted = $this->check_subnet_mask_rule( $ip, $ipRule ); |
| 95 |
} elseif ( $ip == $ipRule ) { |
| 96 |
return true; |
| 97 |
} |
| 98 |
|
| 99 |
if ( $whitelisted ) { |
| 100 |
return true; |
| 101 |
} |
| 102 |
} |
| 103 |
|
| 104 |
return $whitelisted; |
| 105 |
} |
| 106 |
|
| 107 |
/** |
| 108 |
* CIDR notation IP block check. |
| 109 |
* |
| 110 |
* @param string $ip The IP address of the user. |
| 111 |
* @param string $range The range to check. |
| 112 |
* @return boolean Whether or not the IP is in the range. |
| 113 |
*/ |
| 114 |
public function check_subnet_mask_rule( $ip, $range ) { |
| 115 |
list($range, $netmask) = explode( '/', $range, 2 ); |
| 116 |
$range_decimal = ip2long( $range ); |
| 117 |
$ip_decimal = ip2long( $ip ); |
| 118 |
$wildcard_decimal = pow( 2, ( 32 - $netmask ) ) - 1; |
| 119 |
$netmask_decimal = ~ $wildcard_decimal; |
| 120 |
return ( ( $ip_decimal & $netmask_decimal ) == ( $range_decimal & $netmask_decimal ) ); |
| 121 |
} |
| 122 |
|
| 123 |
/** |
| 124 |
* Wildcard IP block check. |
| 125 |
* |
| 126 |
* @param string $ip The IP address of the user. |
| 127 |
* @param string $rule The wildcard range to check against. |
| 128 |
* @return boolean Whether or not the IP is in the wilcard range. |
| 129 |
*/ |
| 130 |
public function check_wildcard_rule( $ip, $rule ) { |
| 131 |
$match = explode( '*', $rule ); |
| 132 |
$match = $match[0]; |
| 133 |
return ( substr( $ip, 0, strlen( $match ) ) == $match ); |
| 134 |
} |
| 135 |
|
| 136 |
/** |
| 137 |
* IP range block check. |
| 138 |
* |
| 139 |
* @param string|array $ip The IP address of the user. |
| 140 |
* @param string $rule The range to check against. |
| 141 |
* @return boolean Whether or not the IP is in the range. |
| 142 |
*/ |
| 143 |
public function check_range_rule( $ip, $rule ) { |
| 144 |
// Check if client has multiple IPs |
| 145 |
if ( is_array( $ip ) ) { |
| 146 |
$ip = $ip[0]; |
| 147 |
} |
| 148 |
|
| 149 |
$first_ip = explode( '-', $rule ); |
| 150 |
$second_ip = explode( '-', $rule ); |
| 151 |
|
| 152 |
$start_ip = ip2long( $first_ip[0] ); |
| 153 |
$end_ip = ip2long( $second_ip[1] ); |
| 154 |
$request_ip = ip2long( $ip ); |
| 155 |
|
| 156 |
return ( $request_ip >= $start_ip && $request_ip <= $end_ip ); |
| 157 |
} |
| 158 |
} |
| 159 |
|
