patchstack / includes / hide-login.php

hide-login.php in Patchstack – WordPress & Plugins Security 2.3.0, at includes/hide-login.php

161 lines 4.7 KB

Raw Download Zip

1	<?php
2
3	// Do not allow the file to be called directly.
4	if ( ! defined( 'ABSPATH' ) ) {
5	exit;
6	}
7
8	/**
9	* This class is used to hide the login page, if it's enabled.
10	*/
11	class P_Hide_Login extends P_Core {
12	/**
13	* Add the actions required to hide the login page.
14	*
15	* @param Patchstack $core
16	* @return void
17	*/
18	public function __construct( $core ) {
19	parent::__construct( $core );
20
21	if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
22	return;
23	}
24
25	// Update the renamed login page if it's set to our hardcoded one.
26	if ( get_option( 'patchstack_mv_wp_login' ) == 0 && get_option( 'patchstack_rename_wp_login' ) == 'swlogin' ) {
27	update_site_option( 'patchstack_rename_wp_login', md5( wp_generate_password( 32, true, true ) ) );
28	}
29
30	// No need to continue if it is not enabled.
31	if ( ! get_option( 'patchstack_mv_wp_login' ) \|\| ! get_option( 'patchstack_rename_wp_login' ) ) {
32	return;
33	}
34
35	// Register the filters and actions for the functionality.
36	add_action( 'init', [ $this, 'init' ], ~PHP_INT_MAX + 1 );
37	add_action( 'wp_logout', [ $this, 'wp_logout' ] );
38	}
39
40	/**
41	* Deny access to wp-login.php if the login page rename feature is enabled.
42	*
43	* @return void
44	*/
45	public function init() {
46	// Do not block the user if they are already logged in as that would block a logout.
47	if ( is_user_logged_in() ) {
48	return;
49	}
50
51	// Determine if the user is whitelisted.
52	if ( ( stripos( $_SERVER['REQUEST_URI'], 'wp-login.php' ) !== false \|\| $GLOBALS['pagenow'] === 'wp-login.php' \|\| $_SERVER['PHP_SELF'] === '/wp-login.php' ) && ! $this->is_whitelisted() ) {
53	if ( isset( $_REQUEST['action'] ) && in_array( $_REQUEST['action'], ['confirm_admin_email', 'postpass', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'checkemail', 'confirmaction'] ) ) {
54	return;
55	}
56
57	$this->plugin->firewall_base->display_error_page( 'login' );
58	}
59
60	// If the current page is the renamed login page we give the user access for 10 minutes to the login page.
61	if ( strpos( $_SERVER['REQUEST_URI'], get_option( 'patchstack_rename_wp_login' ) ) !== false ) {
62	// Whitelist the current IP address.
63	$this->whitelist_ip();
64
65	// Supported by a number of popular caching plugins.
66	if ( ! defined( 'DONOTCACHEPAGE' ) ) {
67	define( 'DONOTCACHEPAGE', true );
68	}
69
70	// Because WP Fastest Cache just has to be special...
71	if ( function_exists( 'wpfc_exclude_current_page' ) ) {
72	@wpfc_exclude_current_page();
73	}
74
75	// No caching.
76	send_nosniff_header();
77	nocache_headers();
78
79	// User should be whitelisted now, redirect to the login page.
80	wp_safe_redirect( 'wp-login.php', 307 );
81	exit;
82	}
83	}
84
85	/**
86	* If the user is logging out, whitelist them again so they don't see a blocked page.
87	*
88	* @return void
89	*/
90	public function wp_logout() {
91	$this->whitelist_ip();
92	}
93
94	/**
95	* Determine if the IP address is whitelisted.
96	*
97	* @return boolean
98	*/
99	private function is_whitelisted() {
100	// Process the whitelist, and remove old ones.
101	$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] );
102	$new_whitelist = [];
103	$allow = false;
104
105	// Only continue if there are actually any whitelist entries.
106	if ( is_array( $whitelist ) && count( $whitelist ) != 0 ){
107	$ip = $this->get_ip();
108	foreach ( $whitelist as $entry ) {
109
110	// Determine if the whitelist entry is still valid.
111	if ( ( time() - $entry[1] ) <= 600 ) {
112	array_push( $new_whitelist, $entry );
113
114	// Determine if the IP address matches.
115	if ( $ip === $entry[0] ) {
116	$allow = true;
117	}
118	}
119	}
120
121	update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist );
122	}
123
124	return $allow;
125	}
126
127	/**
128	* Whitelist the current IP address, or extend the time.
129	*
130	* @return void
131	*/
132	private function whitelist_ip() {
133	$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] );
134	$new_whitelist = [];
135
136	// If the IP address is already whitelisted, reset the timestamp.
137	if ( is_array( $whitelist ) && count( $whitelist ) != 0 ) {
138	$ip = $this->get_ip();
139	$whitelisted = false;
140	foreach ( $whitelist as $entry ) {
141	// Determine if we should extend the whitelist time or ignore if already whitelisted.
142	if ( $ip === $entry[0] ) {
143	$new_whitelist[] = [ $ip, time() ];
144	$whitelisted = true;
145	} else {
146	$new_whitelist[] = $entry;
147	}
148	}
149
150	// Whitelist the IP address.
151	if ( ! $whitelisted ) {
152	$new_whitelist[] = [ $ip, time() ];
153	}
154
155	update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist );
156	} else {
157	update_site_option( 'patchstack_rename_wp_login_whitelist', [ [ $this->get_ip(), time() ] ] );
158	}
159	}
160	}
161