wp-ban / wp-ban.php

wp-ban.php in WP-Ban 1.66, at wp-ban.php

306 lines 9.9 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: WP-Ban
4	Plugin URI: http://lesterchan.net/portfolio/programming/php/
5	Description: Ban users by IP, IP Range, host name, user agent and referer url from visiting your WordPress's blog. It will display a custom ban message when the banned IP, IP range, host name, user agent or referer url tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.
6	Version: 1.66
7	Author: Lester 'GaMerZ' Chan
8	Author URI: http://lesterchan.net
9	Text Domain: wp-ban
10	*/
11
12
13	/*
14	Copyright 2015 Lester Chan (email : lesterchan@gmail.com)
15
16	This program is free software; you can redistribute it and/or modify
17	it under the terms of the GNU General Public License as published by
18	the Free Software Foundation; either version 2 of the License, or
19	(at your option) any later version.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29	*/
30
31
32	### Create Text Domain For Translation
33	add_action( 'plugins_loaded', 'ban_textdomain' );
34	function ban_textdomain() {
35	load_plugin_textdomain( 'wp-ban', false, dirname( plugin_basename( __FILE__ ) ) );
36	}
37
38
39	### Function: Ban Menu
40	add_action('admin_menu', 'ban_menu');
41	function ban_menu() {
42	add_options_page(__('Ban', 'wp-ban'), __('Ban', 'wp-ban'), 'manage_options', 'wp-ban/ban-options.php');
43	}
44
45
46	### Function: Get IP Address (http://stackoverflow.com/a/2031935)
47	function ban_get_ip() {
48	$banned_options = get_option( 'banned_options' );
49
50	if( intval( $banned_options['reverse_proxy'] ) === 1 ) {
51	foreach ( array( 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR' ) as $key ) {
52	if ( array_key_exists( $key, $_SERVER ) === true ) {
53	foreach ( explode( ',', $_SERVER[$key] ) as $ip ) {
54	$ip = trim( $ip );
55	if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE) !== false ) {
56	return esc_attr( $ip );
57	}
58	}
59	}
60	}
61	} else if( !empty( $_SERVER['REMOTE_ADDR'] ) ) {
62	$ip = $_SERVER['REMOTE_ADDR'];
63	if( strpos( $ip, ',' ) !== false ) {
64	$ip = explode( ',', $ip );
65	$ip = $ip[0];
66	}
67	return esc_attr( $ip );
68	}
69
70	return '';
71	}
72
73
74	### Function: Preview Banned Message
75	add_action('wp_ajax_ban-admin', 'preview_banned_message');
76	function preview_banned_message()
77	{
78	$banned_stats = get_option('banned_stats');
79	$banned_message = stripslashes(get_option('banned_message'));
80	$banned_message = str_replace("%SITE_NAME%", get_option('blogname'), $banned_message);
81	$banned_message = str_replace("%SITE_URL%", get_option('siteurl'), $banned_message);
82	$banned_message = str_replace("%USER_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['users'][ban_get_ip()]), $banned_message);
83	$banned_message = str_replace("%USER_IP%", ban_get_ip(), $banned_message);
84	$banned_message = str_replace("%USER_HOSTNAME%", @gethostbyaddr(ban_get_ip()), $banned_message);
85	$banned_message = str_replace("%TOTAL_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['count']), $banned_message);
86	echo $banned_message;
87	exit();
88	}
89
90
91	### Function: Print Out Banned Message
92	function print_banned_message() {
93	// Credits To Joe (Ttech) - http://blog.fileville.net/
94	$banned_stats = get_option('banned_stats');
95	$banned_stats['count'] = intval($banned_stats['count']) + 1;
96	$banned_stats['users'][ban_get_ip()] = intval($banned_stats['users'][ban_get_ip()]) + 1;
97	update_option('banned_stats', $banned_stats);
98	$banned_message = stripslashes(get_option('banned_message'));
99	$banned_message = str_replace("%SITE_NAME%", get_option('blogname'), $banned_message);
100	$banned_message = str_replace("%SITE_URL%", get_option('siteurl'), $banned_message);
101	$banned_message = str_replace("%USER_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['users'][ban_get_ip()]), $banned_message);
102	$banned_message = str_replace("%USER_IP%", ban_get_ip(), $banned_message);
103	$banned_message = str_replace("%USER_HOSTNAME%", @gethostbyaddr(ban_get_ip()), $banned_message);
104	$banned_message = str_replace("%TOTAL_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['count']), $banned_message);
105	echo $banned_message;
106	exit();
107	}
108
109
110	### Function: Process Banning
111	function process_ban($banarray, $against) {
112	if(!empty($banarray) && !empty($against)) {
113	foreach($banarray as $cban) {
114	if(preg_match_wildcard($cban, $against)) {
115	print_banned_message();
116	}
117	}
118	}
119	return;
120	}
121
122
123	### Function: Process Banned IP Range
124	function process_ban_ip_range($banned_ips_range) {
125	if(!empty($banned_ips_range)) {
126	foreach($banned_ips_range as $banned_ip_range) {
127	$range = explode('-', $banned_ip_range);
128	$range_start = trim($range[0]);
129	$range_end = trim($range[1]);
130	if(check_ip_within_range(ban_get_ip(), $range_start, $range_end)) {
131	print_banned_message();
132	break;
133	}
134	}
135	}
136	}
137
138
139	### Function: Banned
140	add_action('init', 'banned');
141	function banned() {
142	$ip = ban_get_ip();
143	if($ip == 'unknown') {
144	return;
145	}
146	$banned_ips = get_option('banned_ips');
147	if(is_array($banned_ips))
148	$banned_ips = array_filter($banned_ips);
149
150	$banned_ips_range = get_option('banned_ips_range');
151	if(is_array($banned_ips_range))
152	$banned_ips_range = array_filter($banned_ips_range);
153
154	$banned_hosts = get_option('banned_hosts');
155	if(is_array($banned_hosts))
156	$banned_hosts = array_filter($banned_hosts);
157
158	$banned_referers = get_option('banned_referers');
159	if(is_array($banned_referers))
160	$banned_referers = array_filter($banned_referers);
161
162	$banned_user_agents = get_option('banned_user_agents');
163	if(is_array($banned_user_agents))
164	$banned_user_agents = array_filter($banned_user_agents);
165
166	$banned_exclude_ips = get_option('banned_exclude_ips');
167	if(is_array($banned_exclude_ips))
168	$banned_exclude_ips = array_filter($banned_exclude_ips);
169
170	$is_excluded = false;
171	if(!empty($banned_exclude_ips)) {
172	foreach($banned_exclude_ips as $banned_exclude_ip) {
173	if($ip == $banned_exclude_ip) {
174	$is_excluded = true;
175	break;
176	}
177	}
178	}
179
180	if( ! $is_excluded ) {
181	if( ! empty( $banned_ips ) ) {
182	process_ban( $banned_ips, $ip );
183	}
184	if( ! empty( $banned_ips_range ) ) {
185	process_ban_ip_range( $banned_ips_range );
186	}
187	if( ! empty( $banned_hosts ) ) {
188	process_ban( $banned_hosts, @gethostbyaddr( $ip ) );
189	}
190	if( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
191	process_ban( $banned_referers, $_SERVER['HTTP_REFERER'] );
192	}
193	if( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
194	process_ban( $banned_user_agents, $_SERVER['HTTP_USER_AGENT'] );
195	}
196	}
197	}
198
199
200	### Function: Check Whether Or Not The IP Address Belongs To Admin
201	function is_admin_ip($check) {
202	return preg_match_wildcard($check, ban_get_ip());
203	}
204
205
206	### Function: Check Whether IP Within A Given IP Range
207	function check_ip_within_range($ip, $range_start, $range_end) {
208	$range_start = ip2long($range_start);
209	$range_end = ip2long($range_end);
210	$ip = ip2long($ip);
211	if($ip !== false && $ip >= $range_start && $ip <= $range_end) {
212	return true;
213	}
214	return false;
215	}
216
217
218	### Function: Check Whether Or Not The Hostname Belongs To Admin
219	function is_admin_hostname($check) {
220	return preg_match_wildcard($check, @gethostbyaddr(ban_get_ip()));
221	}
222
223
224	### Function: Check Whether Or Not The Referer Belongs To This Site
225	function is_admin_referer($check) {
226	$url_patterns = array(get_option('siteurl'), get_option('home'), get_option('siteurl').'/', get_option('home').'/', get_option('siteurl').'/ ', get_option('home').'/ ', $_SERVER['HTTP_REFERER']);
227	foreach($url_patterns as $url) {
228	if(preg_match_wildcard($check, $url)) {
229	return true;
230	}
231	}
232	return false;
233	}
234
235
236	### Function: Check Whether Or Not The User Agent Is Used by Admin
237	function is_admin_user_agent($check) {
238	return preg_match_wildcard($check, $_SERVER['HTTP_USER_AGENT']);
239	}
240
241
242	### Function: Wildcard Check
243	function preg_match_wildcard($regex, $subject) {
244	$regex = preg_quote($regex, '#');
245	$regex = str_replace('\', '.', $regex);
246	if(preg_match("#^$regex$#", $subject))
247	{
248	return true;
249	}
250	else
251	{
252	return false;
253	}
254	}
255
256
257	### Function: Activate Plugin
258	register_activation_hook( __FILE__, 'ban_activation' );
259	function ban_activation( $network_wide )
260	{
261	if ( is_multisite() && $network_wide )
262	{
263	$ms_sites = wp_get_sites();
264
265	if( 0 < sizeof( $ms_sites ) )
266	{
267	foreach ( $ms_sites as $ms_site )
268	{
269	switch_to_blog( $ms_site['blog_id'] );
270	ban_activate();
271	}
272	}
273
274	restore_current_blog();
275	}
276	else
277	{
278	ban_activate();
279	}
280	}
281
282	function ban_activate() {
283	add_option('banned_ips', array());
284	add_option('banned_hosts',array());
285	add_option('banned_stats', array('users' => array(), 'count' => 0));
286	add_option('banned_message', '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">'."\n".
287	'<html xmlns="http://www.w3.org/1999/xhtml" '.get_language_attributes().'>'."\n".
288	'<head>'."\n".
289	'<meta http-equiv="Content-Type" content="text/html; charset='.get_option('blog_charset').'" />'."\n".
290	'<title>%SITE_NAME% - %SITE_URL%</title>'."\n".
291	'</head>'."\n".
292	'<body>'."\n".
293	'<div id="wp-ban-container">'."\n".
294	'<p style="text-align: center; font-weight: bold;">'.__('You Are Banned.', 'wp-ban').'</p>'."\n".
295	'</div>'."\n".
296	'</body>'."\n".
297	'</html>', 'Banned Message');
298	// Database Upgrade For WP-Ban 1.11
299	add_option('banned_referers', array());
300	add_option('banned_exclude_ips', array());
301	add_option('banned_ips_range', array());
302	// Database Upgrade For WP-Ban 1.30
303	add_option('banned_user_agents', array());
304	// Database Upgrade For WP-Ban 1.64
305	add_option( 'banned_options', array( 'reverse_proxy' => 0 ) );
306	}