s2member / includes / classes / brute-force.inc.php

brute-force.inc.php in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 110815, at includes/classes/brute-force.inc.php

105 lines 4.3 KB

Raw Download Zip

1	<?php
2	/**
3	* s2Member's Brute Force protection routines.
4	*
5	* Copyright: © 2009-2011
6	* {@link http://www.websharks-inc.com/ WebSharks, Inc.}
7	* ( coded in the USA )
8	*
9	* Released under the terms of the GNU General Public License.
10	* You should have received a copy of the GNU General Public License,
11	* along with this software. In the main directory, see: /licensing/
12	* If not, see: {@link http://www.gnu.org/licenses/}.
13	*
14	* @package s2Member\Brute_Force
15	* @since 3.5
16	*/
17	if (realpath (__FILE__) === realpath ($_SERVER["SCRIPT_FILENAME"]))
18	exit("Do not access this file directly.");
19	/**/
20	if (!class_exists ("c_ws_plugin__s2member_brute_force"))
21	{
22	/**
23	* s2Member's Brute Force protection routines.
24	*
25	* @package s2Member\Brute_Force
26	* @since 3.5
27	*/
28	class c_ws_plugin__s2member_brute_force
29	{
30	/**
31	* Tracks failed login attempts.
32	*
33	* Prevents an attacker from guessing Usernames/Passwords.
34	* Allows only 5 failed login attempts every 30 minutes.
35	*
36	* @package s2Member\Brute_Force
37	* @since 3.5
38	*
39	* @attaches-to ``add_action("wp_login_failed");``
40	*
41	* @param str $username Expects the $username to be passed in through the Hook.
42	* @return null
43	*/
44	public static function track_failed_logins ($username = FALSE)
45	{
46	eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;');
47	do_action ("ws_plugin__s2member_before_track_failed_logins", get_defined_vars ());
48	unset ($__refs, $__v); /* Unset defined __refs, __v. */
49	/**/
50	if (($max = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["max_failed_login_attempts"]))
51	{
52	$exp_secs = strtotime ("+" . apply_filters ("ws_plugin__s2member_track_failed_logins__exp_time", "30 minutes", get_defined_vars ())) - time ();
53	/* If you add Filters to this value, you should use a string that is compatible with PHP's strtotime() function. */
54	/**/
55	$transient = "s2m_ipr_" . md5 ("s2member_transient_failed_login_attempts_" . $_SERVER["REMOTE_ADDR"]);
56	set_transient ($transient, (int)get_transient ($transient) + 1, $exp_secs);
57	}
58	/**/
59	do_action ("ws_plugin__s2member_after_track_failed_logins", get_defined_vars ());
60	/**/
61	return; /* Return for uniformity. */
62	}
63	/**
64	* Stops anyone attempting a Brute Force attack.
65	*
66	* Prevents an attacker from guessing Usernames/Passwords.
67	* Allows only 5 failed login attempts every 30 minutes.
68	*
69	* @package s2Member\Brute_Force
70	* @since 3.5
71	*
72	* @attaches-to ``add_filter("authenticate");``
73	*
74	* @param obj $user Expects a WP_User object, or possibly a null value.
75	* This parameter value is simply passed through this routine.
76	* @return obj\|null Either null, the ``$user`` obj, or a `WP_Error` obj.
77	*/
78	public static function stop_brute_force_logins ($user = FALSE)
79	{
80	eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;');
81	do_action ("ws_plugin__s2member_before_stop_brute_force_logins", get_defined_vars ());
82	unset ($__refs, $__v); /* Unset defined __refs, __v. */
83	/**/
84	if (($max = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["max_failed_login_attempts"]))
85	{
86	$exp_secs = strtotime ("+" . apply_filters ("ws_plugin__s2member_track_failed_logins__exp_time", "30 minutes", get_defined_vars ())) - time ();
87	/* If you add Filters to this value, you should use a string that is compatible with PHP's strtotime() function. */
88	/**/
89	$about = c_ws_plugin__s2member_utils_time::approx_time_difference (time (), time () + $exp_secs);
90	/**/
91	if ((int)get_transient ("s2m_ipr_" . md5 ("s2member_transient_failed_login_attempts_" . $_SERVER["REMOTE_ADDR"])) > $max)
92	{
93	$errors = new WP_Error ("incorrect_password", "Max failed logins. Please wait " . $about . " and try again.");
94	/**/
95	eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;');
96	do_action ("ws_plugin__s2member_during_stop_brute_force_logins", get_defined_vars ());
97	unset ($__refs, $__v); /* Unset defined __refs, __v. */
98	}
99	}
100	/**/
101	return apply_filters ("ws_plugin__s2member_stop_brute_force_logins", ((!empty ($errors)) ? $errors : $user), get_defined_vars ());
102	}
103	}
104	}
105	?>