protect-login / protect-login.php

protect-login.php in Protect Login trunk, at protect-login.php

150 lines 5.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Protect Login
4	* Plugin URI: https://github.com/protecthaus/protect-login
5	* Description: Add an additional layer of protection to your WordPress login and make sure bad actors have a hard time guessing your user's login credentials.
6	* Version: 1.5.1
7	* Tags: login, security, authentication
8	* Requires at least: 5.7
9	* Requires PHP: 7.4
10	* Author: protect.haus Team
11	* Author URI: https://github.com/protecthaus
12	* License: GPL-3.0-or-later
13	* License URI: https://www.gnu.org/licenses/gpl-3.0.html
14	* Text Domain: protect-login
15	* Domain Path: /languages
16	*
17	* @package Protect Login
18	*
19	* Copyright 2008 - 2011 Johan Eenfeldt
20	* Copyright 2024 – 2025 protect.haus team, sponsored by group.one
21	*
22	* Thanks to Michael Skerwiderski for reverse proxy handling suggestions.
23	*
24	* Licenced under the GNU GPL:
25	*
26	* This program is free software; you can redistribute it and/or modify
27	* it under the terms of the GNU General Public License as published by
28	* the Free Software Foundation; either version 3 of the License, or
29	* (at your option) any later version.
30	*
31	* This program is distributed in the hope that it will be useful,
32	* but WITHOUT ANY WARRANTY; without even the implied warranty of
33	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
34	* GNU General Public License for more details.
35	*
36	* You should have received a copy of the GNU General Public License
37	* along with this program; if not, write to the Free Software
38	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
39	*/
40
41	use ProtectLogin\Modules\RemoteApi\Requests\RandomPasswordRequest;
42	use ProtectLogin\Modules\LimitLoginAttempts\Controllers\OptionsPage as ProtectLoginLimitLoginsOptionsPage;
43
44	if ( ! \defined( 'ABSPATH' ) ) {
45	exit;
46	}
47
48	require_once __DIR__ . '/includes/setup.php';
49
50	\add_action(
51	'admin_menu',
52	function () {
53	new ProtectLoginLimitLoginsOptionsPage();
54	}
55	);
56	\add_action(
57	'network_admin_menu',
58	function () {
59	new ProtectLoginLimitLoginsOptionsPage();
60	}
61	);
62
63	use ProtectLogin\Modules\LimitLoginAttempts\Controllers\LoginHandler;
64
65	if ( ! isset( $protect_login_handler ) ) {
66	$protect_login_handler = LoginHandler::get_instance();
67	}
68
69	\add_action( 'plugins_loaded', 'protect_login_setup' );
70
71	\register_activation_hook(
72	__FILE__,
73	'protect_login_ensure_activation'
74	);
75
76	\register_uninstall_hook(
77	__FILE__,
78	'protect_login_uninstall_plugin'
79	);
80
81	\add_action( 'wpmu_new_blog', 'protect_login_new_multisite', 10, 6 );
82
83	/**
84	* Filters that allow overriding Protect Login settings programmatically.
85	*
86	* Each filter is applied when the corresponding setting is read, so returning a
87	* value from one of these filters overrides the stored option for the current
88	* request. Example:
89	*
90	* add_filter( 'protect_login_max_retries', fn() => 5 );
91	*
92	* Available filters:
93	* - protect_login_lockout_duration (int, seconds)
94	* - protect_login_max_retries (int)
95	* - protect_login_max_allowed_lockouts (int)
96	* - protect_login_long_duration (int, seconds)
97	* - protect_login_password_minimum_strength (int, 1-3)
98	* - protect_login_show_in_widget (bool)
99	*/
100
101	\add_action( 'wp_login_failed', [ $protect_login_handler, 'protect_login_on_failed_login' ] );
102	\add_filter( 'authenticate', [ $protect_login_handler, 'protect_login_on_successful_login' ], 30, 3 );
103
104	\add_action( 'admin_enqueue_scripts', 'protect_login_enqueue_custom_password_js', 10 );
105	\add_filter( 'login_errors', [ 'ProtectLogin\Modules\LimitLoginAttempts\Controllers\LoginHandler', 'print__error_message' ] );
106
107	\add_action( 'admin_init', 'protect_login_admin_init' );
108
109	\add_action( 'rest_api_init', 'protect_login_register_api_endpoints' );
110
111	\add_action( 'admin_init', 'protect_login_handle_balist_save' );
112
113	/**
114	* Handles saving the block-/allowlist form on the plugin settings page.
115	*
116	* Runs only inside wp-admin (via admin_init) so the current user and
117	* capabilities are reliably available, and requires both the
118	* `manage_options` capability and a valid nonce before changing any list.
119	*
120	* @return void
121	*/
122	function protect_login_handle_balist_save() {
123	if ( ! isset( $_GET['_nonce'] ) \|\| ! isset( $_POST['save_protect_login_balist_list_type'] ) ) {
124	return;
125	}
126
127	if (
128	! \current_user_can( 'manage_options' ) \|\|
129	! \wp_verify_nonce( \sanitize_key( \wp_unslash( $_GET['_nonce'] ) ), PROTECT_LOGIN_NONCE_ACTION )
130	) {
131	\wp_die( \esc_html__( 'You are not allowed to perform this action.', 'protect-login' ), 403 );
132	}
133
134	$list_type = \sanitize_text_field( \wp_unslash( $_POST['save_protect_login_balist_list_type'] ) );
135	$ips_to_add = '';
136
137	if ( isset( $_POST['new_ips'] ) && isset( $_POST['new_ips'][0] ) && $_POST['new_ips'][0] !== '' ) {
138	$ips_to_add = \trim( \sanitize_text_field( \wp_unslash( $_POST['new_ips'][0] ) ) );
139	}
140
141	protect_login_update_block_or_allowlist( $list_type, $ips_to_add );
142	}
143
144	if ( null === \get_option( 'protect_login_remote_api_host_key', null ) ) {
145	\update_option( 'protect_login_remote_api_host_key', RandomPasswordRequest::generate( 16 ) );
146	}
147
148	\add_filter( 'plugin_action_links_' . PROTECT_LOGIN_SLUG . '/' . PROTECT_LOGIN_SLUG . '.php', 'protect_login_settings' );
149	\add_filter( 'dashboard_glance_items', 'protect_login_add_at_a_glance_item', 10, 1 );
150