| 1 |
<?php |
| 2 |
|
| 3 |
// Do not allow the file to be called directly. |
| 4 |
if ( ! defined( 'ABSPATH' ) ) { |
| 5 |
exit; |
| 6 |
} |
| 7 |
|
| 8 |
/** |
| 9 |
* This class is used to hide the login page, if it's enabled. |
| 10 |
*/ |
| 11 |
class P_Hide_Login extends P_Core { |
| 12 |
/** |
| 13 |
* Add the actions required to hide the login page. |
| 14 |
* |
| 15 |
* @param Patchstack $core |
| 16 |
* @return void |
| 17 |
*/ |
| 18 |
public function __construct( $core ) { |
| 19 |
parent::__construct( $core ); |
| 20 |
|
| 21 |
if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) { |
| 22 |
return; |
| 23 |
} |
| 24 |
|
| 25 |
// Update the renamed login page if it's set to our hardcoded one. Write with the |
| 26 |
// same scope it is read back with below, otherwise this would rewrite every request. |
| 27 |
if ( (int) get_option( 'patchstack_mv_wp_login', 0 ) == 0 && get_option( 'patchstack_rename_wp_login' ) == 'swlogin' ) { |
| 28 |
update_option( 'patchstack_rename_wp_login', md5( wp_generate_password( 32, true, true ) ) ); |
| 29 |
} |
| 30 |
|
| 31 |
// No need to continue if it is not enabled. |
| 32 |
if ( ! get_option( 'patchstack_mv_wp_login' ) || ! get_option( 'patchstack_rename_wp_login' ) ) { |
| 33 |
return; |
| 34 |
} |
| 35 |
|
| 36 |
// Register the filters and actions for the functionality. |
| 37 |
add_action( 'init', [ $this, 'init' ], ~PHP_INT_MAX + 1 ); |
| 38 |
add_action( 'wp_logout', [ $this, 'wp_logout' ] ); |
| 39 |
} |
| 40 |
|
| 41 |
/** |
| 42 |
* Deny access to wp-login.php if the login page rename feature is enabled. |
| 43 |
* |
| 44 |
* @return void |
| 45 |
*/ |
| 46 |
public function init() { |
| 47 |
// Do not block the user if they are already logged in as that would block a logout. |
| 48 |
if ( is_user_logged_in() ) { |
| 49 |
return; |
| 50 |
} |
| 51 |
|
| 52 |
// Determine if the user is whitelisted. |
| 53 |
if ( ( ( isset( $_SERVER['REQUEST_URI'] ) && stripos( $_SERVER['REQUEST_URI'], 'wp-login.php' ) !== false ) || ( isset( $GLOBALS['pagenow'] ) && $GLOBALS['pagenow'] === 'wp-login.php' ) || ( isset( $_SERVER['PHP_SELF'] ) && $_SERVER['PHP_SELF'] === '/wp-login.php' ) ) && ! $this->is_whitelisted() ) { |
| 54 |
if ( isset( $_REQUEST['action'] ) && in_array( $_REQUEST['action'], ['confirm_admin_email', 'postpass', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'checkemail', 'confirmaction'] ) ) { |
| 55 |
return; |
| 56 |
} |
| 57 |
|
| 58 |
$this->plugin->firewall_base->display_error_page( 'login' ); |
| 59 |
} |
| 60 |
|
| 61 |
// If the current page is the renamed login page we give the user access for 10 minutes to the login page. |
| 62 |
if ( isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], get_option( 'patchstack_rename_wp_login' ) ) !== false ) { |
| 63 |
// Whitelist the current IP address. |
| 64 |
$this->whitelist_ip(); |
| 65 |
|
| 66 |
// Supported by a number of popular caching plugins. |
| 67 |
if ( ! defined( 'DONOTCACHEPAGE' ) ) { |
| 68 |
define( 'DONOTCACHEPAGE', true ); |
| 69 |
} |
| 70 |
|
| 71 |
// Because WP Fastest Cache just has to be special... |
| 72 |
if ( function_exists( 'wpfc_exclude_current_page' ) ) { |
| 73 |
@wpfc_exclude_current_page(); |
| 74 |
} |
| 75 |
|
| 76 |
// No caching. |
| 77 |
send_nosniff_header(); |
| 78 |
nocache_headers(); |
| 79 |
|
| 80 |
// User should be whitelisted now, redirect to the login page. |
| 81 |
wp_safe_redirect( 'wp-login.php', 307 ); |
| 82 |
exit; |
| 83 |
} |
| 84 |
} |
| 85 |
|
| 86 |
/** |
| 87 |
* If the user is logging out, whitelist them again so they don't see a blocked page. |
| 88 |
* |
| 89 |
* @return void |
| 90 |
*/ |
| 91 |
public function wp_logout() { |
| 92 |
$this->whitelist_ip(); |
| 93 |
} |
| 94 |
|
| 95 |
/** |
| 96 |
* Determine if the IP address is whitelisted. |
| 97 |
* |
| 98 |
* @return boolean |
| 99 |
*/ |
| 100 |
private function is_whitelisted() { |
| 101 |
// Process the whitelist, and remove old ones. |
| 102 |
$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] ); |
| 103 |
$new_whitelist = []; |
| 104 |
$allow = false; |
| 105 |
|
| 106 |
// Only continue if there are actually any whitelist entries. |
| 107 |
if ( is_array( $whitelist ) && count( $whitelist ) != 0 ){ |
| 108 |
$ip = $this->get_ip(); |
| 109 |
foreach ( $whitelist as $entry ) { |
| 110 |
|
| 111 |
// Determine if the whitelist entry is still valid. |
| 112 |
if ( ( time() - $entry[1] ) <= 600 ) { |
| 113 |
array_push( $new_whitelist, $entry ); |
| 114 |
|
| 115 |
// Determine if the IP address matches. |
| 116 |
if ( $ip === $entry[0] ) { |
| 117 |
$allow = true; |
| 118 |
} |
| 119 |
} |
| 120 |
} |
| 121 |
|
| 122 |
update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist ); |
| 123 |
} |
| 124 |
|
| 125 |
return $allow; |
| 126 |
} |
| 127 |
|
| 128 |
/** |
| 129 |
* Whitelist the current IP address, or extend the time. |
| 130 |
* |
| 131 |
* @return void |
| 132 |
*/ |
| 133 |
private function whitelist_ip() { |
| 134 |
$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] ); |
| 135 |
$new_whitelist = []; |
| 136 |
|
| 137 |
// If the IP address is already whitelisted, reset the timestamp. |
| 138 |
if ( is_array( $whitelist ) && count( $whitelist ) != 0 ) { |
| 139 |
$ip = $this->get_ip(); |
| 140 |
$whitelisted = false; |
| 141 |
foreach ( $whitelist as $entry ) { |
| 142 |
// Determine if we should extend the whitelist time or ignore if already whitelisted. |
| 143 |
if ( $ip === $entry[0] ) { |
| 144 |
$new_whitelist[] = [ $ip, time() ]; |
| 145 |
$whitelisted = true; |
| 146 |
} else { |
| 147 |
$new_whitelist[] = $entry; |
| 148 |
} |
| 149 |
} |
| 150 |
|
| 151 |
// Whitelist the IP address. |
| 152 |
if ( ! $whitelisted ) { |
| 153 |
$new_whitelist[] = [ $ip, time() ]; |
| 154 |
} |
| 155 |
|
| 156 |
update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist ); |
| 157 |
} else { |
| 158 |
update_site_option( 'patchstack_rename_wp_login_whitelist', [ [ $this->get_ip(), time() ] ] ); |
| 159 |
} |
| 160 |
} |
| 161 |
} |
| 162 |
|
