wfAlerts.php — Wordfence Security – Firewall, Malware Scan, and Login Security 8.0.3

wordfence / lib / wfAlerts.php

wordfence / lib Last commit date

wfAlerts.php

263 lines

1	<?php
2
3	abstract class wfBaseAlert {
4
5	public abstract function send();
6	}
7
8	class wfBlockAlert extends wfBaseAlert {
9
10	private $IP;
11	private $reason;
12	private $secsToGo;
13
14
15	/**
16	* wfBlockAlert constructor.
17	* @param $IP
18	* @param $reason
19	* @param $secsToGo
20	*/
21	public function __construct($IP, $reason, $secsToGo) {
22	$this->IP = $IP;
23	$this->reason = $reason;
24	$this->secsToGo = $secsToGo;
25	}
26
27	public function send() {
28	if (wfConfig::get('alertOn_block')) {
29	$message = sprintf(/* translators: IP address. */ __('Wordfence has blocked IP address %s.', 'wordfence'), $this->IP) . "\n";
30	$message .= sprintf(/* translators: Description of firewall action. */ __('The reason is: "%s".', 'wordfence'), $this->reason);
31	if ($this->secsToGo > 0) {
32	$message .= "\n" . sprintf(/* translators: Time until. */ __('The duration of the block is %s.', 'wordfence'), wfUtils::makeDuration($this->secsToGo, true));
33	}
34	wordfence::alert(sprintf(/* translators: IP address. */__('Blocking IP %s', 'wordfence'), $this->IP), $message, $this->IP);
35	}
36	}
37
38	}
39
40	class wfAutoUpdatedAlert extends wfBaseAlert {
41
42	private $version;
43
44	/**
45	* @param $version
46	*/
47	public function __construct($version) {
48	$this->version = $version;
49	}
50
51	public function send() {
52	if (wfConfig::get('alertOn_update') == '1' && $this->version) {
53	wordfence::alert(sprintf(/* translators: Software version. / __("Wordfence Upgraded to version %s", 'wordfence'), $this->version), sprintf(/ translators: Software version. */ __("Your Wordfence installation has been upgraded to version %s", 'wordfence'), $this->version), false);
54	}
55	}
56
57	}
58
59	class wfWafDeactivatedAlert extends wfBaseAlert {
60
61	private $username;
62	private $IP;
63
64	/**
65	* @param $username
66	* @param $IP
67	*/
68	public function __construct($username, $IP) {
69	$this->username = $username;
70	$this->IP = $IP;
71	}
72
73	public function send() {
74	if (wfConfig::get('alertOn_wafDeactivated')) {
75	wordfence::alert(__('Wordfence WAF Deactivated', 'wordfence'), sprintf(/* translators: WP username. */__('A user with username "%s" deactivated the Wordfence Web Application Firewall on your WordPress site.', 'wordfence'), $this->username), $this->IP);
76	}
77	}
78
79	}
80
81	class wfWordfenceDeactivatedAlert extends wfBaseAlert {
82	private $username;
83	private $IP;
84
85	/**
86	* @param $username
87	* @param $IP
88	*/
89	public function __construct($username, $IP) {
90	$this->username = $username;
91	$this->IP = $IP;
92	}
93
94	public function send() {
95	if (wfConfig::get('alertOn_wordfenceDeactivated')) {
96	wordfence::alert(__("Wordfence Deactivated", 'wordfence'), sprintf(/* translators: WP username. */ __("A user with username \"%s\" deactivated Wordfence on your WordPress site.", 'wordfence'), $this->username), $this->IP);
97	}
98	}
99
100	}
101
102	class wfLostPasswdFormAlert extends wfBaseAlert {
103
104	private $user;
105	private $IP;
106
107	/**
108	* @param $user
109	* @param $IP
110	*/
111	public function __construct($user, $IP) {
112	$this->user = $user;
113	$this->IP = $IP;
114	}
115
116	public function send() {
117	if (wfConfig::get('alertOn_lostPasswdForm')) {
118	wordfence::alert(__("Password recovery attempted", 'wordfence'), sprintf(/* translators: Email address. */__("Someone tried to recover the password for user with email address: %s", 'wordfence'), wp_kses($this->user->user_email, array())), $this->IP);
119	}
120	}
121
122	}
123
124	class wfLoginLockoutAlert extends wfBaseAlert {
125
126	private $IP;
127	private $reason;
128
129	/**
130	* @param $IP
131	* @param $reason
132	*/
133	public function __construct($IP, $reason) {
134	$this->IP = $IP;
135	$this->reason = $reason;
136	}
137
138	public function send() {
139	if (wfConfig::get('alertOn_loginLockout')) {
140	$message = sprintf(
141	/* translators: 1. IP address. 2. Description of firewall action. */
142	__('A user with IP address %1$s has been locked out from signing in or using the password recovery form for the following reason: %2$s.', 'wordfence'), $this->IP, $this->reason);
143	if (wfBlock::lockoutDuration() > 0) {
144	$message .= "\n" . sprintf(/* translators: Time until. */ __('The duration of the lockout is %s.', 'wordfence'), wfUtils::makeDuration(wfBlock::lockoutDuration(), true));
145	}
146	wordfence::alert(__('User locked out from signing in', 'wordfence'), $message, $this->IP);
147	}
148	}
149	}
150
151	class wfAdminLoginAlert extends wfBaseAlert {
152
153	private $cookieName;
154	private $username;
155	private $IP;
156	private $cookieValue;
157
158	/**
159	* @param $cookieName
160	* @param $cookieValue
161	* @param $username
162	* @param $IP
163	*/
164	public function __construct($cookieName, $cookieValue, $username, $IP) {
165	$this->cookieName = $cookieName;
166	$this->cookieValue = $cookieValue;
167	$this->username = $username;
168	$this->IP = $IP;
169	}
170
171	public function send() {
172	if (wfConfig::get('alertOn_adminLogin')) {
173	$shouldAlert = true;
174	if (wfConfig::get('alertOn_firstAdminLoginOnly') && isset($_COOKIE[$this->cookieName])) {
175	$shouldAlert = !hash_equals($this->cookieValue, $_COOKIE[$this->cookieName]);
176	}
177
178	if ($shouldAlert) {
179	wordfence::alert(__("Admin Login", 'wordfence'), sprintf(/* translators: WP username. */ __("A user with username \"%s\" who has administrator access signed in to your WordPress site.", 'wordfence'), $this->username), $this->IP);
180	}
181	}
182	}
183	}
184
185	class wfNonAdminLoginAlert extends wfBaseAlert {
186
187	private $cookieName;
188	private $username;
189	private $IP;
190	private $cookieValue;
191
192	/**
193	* @param $cookieName
194	* @param $cookieValue
195	* @param $username
196	* @param $IP
197	*/
198	public function __construct($cookieName, $cookieValue, $username, $IP) {
199	$this->cookieName = $cookieName;
200	$this->cookieValue = $cookieValue;
201	$this->username = $username;
202	$this->IP = $IP;
203	}
204
205	public function send() {
206	if (wfConfig::get('alertOn_nonAdminLogin')) {
207	$shouldAlert = true;
208	if (wfConfig::get('alertOn_firstNonAdminLoginOnly') && isset($_COOKIE[$this->cookieName])) {
209	$shouldAlert = !hash_equals($this->cookieValue, $_COOKIE[$this->cookieName]);
210	}
211
212	if ($shouldAlert) {
213	wordfence::alert(__("User login", 'wordfence'), sprintf(/* translators: WP username. */ __("A non-admin user with username \"%s\" signed in to your WordPress site.", 'wordfence'), $this->username), $this->IP);
214	}
215	}
216	}
217	}
218
219	class wfBreachLoginAlert extends wfBaseAlert {
220
221	private $username;
222	private $lostPasswordUrl;
223	private $supportUrl;
224	private $IP;
225
226	/**
227	* @param $username
228	* @param $lostPasswordUrl
229	* @param $supportUrl
230	* @param $IP
231	*/
232	public function __construct($username, $lostPasswordUrl, $supportUrl, $IP) {
233	$this->username = $username;
234	$this->lostPasswordUrl = $lostPasswordUrl;
235	$this->supportUrl = $supportUrl;
236	$this->IP = $IP;
237	}
238
239	public function send() {
240	if (wfConfig::get('alertOn_breachLogin')) {
241	wordfence::alert(__('User login blocked for insecure password', 'wordfence'), sprintf(
242	/* translators: 1. WP username. 2. Reset password URL. 3. Support URL. */
243	__('A user with username "%1$s" tried to sign in to your WordPress site. Access was denied because the password being used exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please change or reset the password (%2$s) to reactivate this account. Learn More: %3$s', 'wordfence'), $this->username, $this->lostPasswordUrl, $this->supportUrl), $this->IP);
244	}
245	}
246	}
247
248	class wfIncreasedAttackRateAlert extends wfBaseAlert {
249
250	private $message;
251
252	/**
253	* @param $message
254	*/
255	public function __construct($message) {
256	$this->message = $message;
257	}
258
259	public function send() {
260	wordfence::alert(__('Increased Attack Rate', 'wordfence'), $this->message, false);
261	}
262	}
263