s2member / src / includes / classes / brute-force.inc.php

brute-force.inc.php in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions trunk, at src/includes/classes/brute-force.inc.php

115 lines 4.6 KB

Raw Download Zip

1	<?php
2	// @codingStandardsIgnoreFile
3	/**
4	* s2Member's Brute Force protection routines.
5	*
6	* Copyright: © 2009-2011
7	* {@link http://websharks-inc.com/ WebSharks, Inc.}
8	* (coded in the USA)
9	*
10	* Released under the terms of the GNU General Public License.
11	* You should have received a copy of the GNU General Public License,
12	* along with this software. In the main directory, see: /licensing/
13	* If not, see: {@link http://www.gnu.org/licenses/}.
14	*
15	* @package s2Member\Brute_Force
16	* @since 3.5
17	*/
18	if(!defined('WPINC')) // MUST have WordPress.
19	exit('Do not access this file directly.');
20
21	if(!class_exists('c_ws_plugin__s2member_brute_force'))
22	{
23	/**
24	* s2Member's Brute Force protection routines.
25	*
26	* @package s2Member\Brute_Force
27	* @since 3.5
28	*/
29	class c_ws_plugin__s2member_brute_force
30	{
31	/**
32	* Tracks failed login attempts.
33	*
34	* Prevents an attacker from guessing Usernames/Passwords.
35	* Allows only 5 failed login attempts every 30 minutes.
36	*
37	* @package s2Member\Brute_Force
38	* @since 3.5
39	*
40	* @attaches-to ``add_action('wp_login_failed');``
41	*
42	* @param string $username Expects the $username to be passed in through the Hook.
43	*/
44	public static function track_failed_logins($username = '')
45	{
46	foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v;
47	do_action('ws_plugin__s2member_before_track_failed_logins', get_defined_vars());
48	unset($__refs, $__v);
49
50	if(($max = $GLOBALS['WS_PLUGIN__']['s2member']['o']['max_failed_login_attempts']))
51	{
52	$exp_secs = strtotime('+'.apply_filters('ws_plugin__s2member_track_failed_logins__exp_time', '30 minutes', get_defined_vars())) - time();
53	// If you add Filters to this value, you should use a string that is compatible with PHP's strtotime() function.
54
55	$ip = c_ws_plugin__s2member_utils_ip::current(); // Default value.
56	if(!empty($GLOBALS['s2member_pro_remote_op_auth_check_user_ip'])
57	&& c_ws_plugin__s2member_utils_conds::pro_is_installed()
58	&& c_ws_plugin__s2member_pro_remote_ops::is_remote_op('auth_check_user')
59	) $ip = $GLOBALS['s2member_pro_remote_op_auth_check_user_ip'];
60
61	$transient = 's2m_ipr_'.md5('s2member_transient_failed_login_attempts_'.$ip);
62	set_transient($transient, (int)get_transient($transient) + 1, $exp_secs);
63	}
64	do_action('ws_plugin__s2member_after_track_failed_logins', get_defined_vars());
65	}
66
67	/**
68	* Stops anyone attempting a Brute Force attack.
69	*
70	* Prevents an attacker from guessing Usernames/Passwords.
71	* Allows only 5 failed login attempts every 30 minutes.
72	*
73	* @package s2Member\Brute_Force
74	* @since 3.5
75	*
76	* @attaches-to ``add_filter('authenticate');``
77	*
78	* @param WP_User $user Expects a WP_User object, or possibly a null value.
79	* This parameter value is simply passed through this routine.
80	*
81	* @return WP_User\|null Either null, the ``$user`` obj, or a `WP_Error` obj.
82	*/
83	public static function stop_brute_force_logins($user = NULL)
84	{
85	foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v;
86	do_action('ws_plugin__s2member_before_stop_brute_force_logins', get_defined_vars());
87	unset($__refs, $__v);
88
89	if(($max = $GLOBALS['WS_PLUGIN__']['s2member']['o']['max_failed_login_attempts']))
90	{
91	$ip = c_ws_plugin__s2member_utils_ip::current(); // Default value.
92	if(!empty($GLOBALS['s2member_pro_remote_op_auth_check_user_ip'])
93	&& c_ws_plugin__s2member_utils_conds::pro_is_installed()
94	&& c_ws_plugin__s2member_pro_remote_ops::is_remote_op('auth_check_user')
95	) $ip = $GLOBALS['s2member_pro_remote_op_auth_check_user_ip'];
96
97	//260902.0444 The transient counts failures already completed; reaching the configured allowance means the next authentication must be blocked.
98	if((int)get_transient('s2m_ipr_'.md5('s2member_transient_failed_login_attempts_'.$ip)) >= $max)
99	{
100	$exp_secs = strtotime('+'.apply_filters('ws_plugin__s2member_track_failed_logins__exp_time', '30 minutes', get_defined_vars())) - time();
101	// If you add Filters to this value, you should use a string that is compatible with PHP's strtotime() function.
102
103	$about = c_ws_plugin__s2member_utils_time::approx_time_difference(time(), time() + $exp_secs);
104	$errors = new WP_Error('incorrect_password', sprintf(_x('Max failed logins. Please wait %s and try again.', 's2member-front', 's2member'), $about));
105
106	foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v;
107	do_action('ws_plugin__s2member_during_stop_brute_force_logins', get_defined_vars());
108	unset($__refs, $__v);
109	}
110	}
111	return apply_filters('ws_plugin__s2member_stop_brute_force_logins', !empty($errors) ? $errors : $user, get_defined_vars());
112	}
113	}
114	}
115