wp-ban / wp-ban.php

wp-ban.php in WP-Ban 1.67, at wp-ban.php

302 lines 10.8 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: WP-Ban
4	Plugin URI: http://lesterchan.net/portfolio/programming/php/
5	Description: Ban users by IP, IP Range, host name, user agent and referer url from visiting your WordPress's blog. It will display a custom ban message when the banned IP, IP range, host name, user agent or referer url tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.
6	Version: 1.67
7	Author: Lester 'GaMerZ' Chan
8	Author URI: http://lesterchan.net
9	Text Domain: wp-ban
10	*/
11
12
13	/*
14	Copyright 2015 Lester Chan (email : lesterchan@gmail.com)
15
16	This program is free software; you can redistribute it and/or modify
17	it under the terms of the GNU General Public License as published by
18	the Free Software Foundation; either version 2 of the License, or
19	(at your option) any later version.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29	*/
30
31
32	### Create Text Domain For Translation
33	add_action( 'plugins_loaded', 'ban_textdomain' );
34	function ban_textdomain() {
35	load_plugin_textdomain( 'wp-ban', false, dirname( plugin_basename( __FILE__ ) ) );
36	}
37
38
39	### Function: Ban Menu
40	add_action('admin_menu', 'ban_menu');
41	function ban_menu() {
42	add_options_page(__('Ban', 'wp-ban'), __('Ban', 'wp-ban'), 'manage_options', 'wp-ban/ban-options.php');
43	}
44
45
46	### Function: Get IP Address (http://stackoverflow.com/a/2031935)
47	function ban_get_ip() {
48	$banned_options = get_option( 'banned_options' );
49
50	if( intval( $banned_options['reverse_proxy'] ) === 1 ) {
51	foreach ( array( 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR' ) as $key ) {
52	if ( array_key_exists( $key, $_SERVER ) === true ) {
53	foreach ( explode( ',', $_SERVER[$key] ) as $ip ) {
54	$ip = trim( $ip );
55	if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE) !== false ) {
56	return esc_attr( $ip );
57	}
58	}
59	}
60	}
61	} else if( !empty( $_SERVER['REMOTE_ADDR'] ) ) {
62	$ip = $_SERVER['REMOTE_ADDR'];
63	if( strpos( $ip, ',' ) !== false ) {
64	$ip = explode( ',', $ip );
65	$ip = $ip[0];
66	}
67	return esc_attr( $ip );
68	}
69
70	return '';
71	}
72
73
74	### Function: Preview Banned Message
75	add_action('wp_ajax_ban-admin', 'preview_banned_message');
76	function preview_banned_message() {
77	$banned_stats = get_option('banned_stats');
78	$banned_message = stripslashes(get_option('banned_message'));
79	$banned_message = str_replace("%SITE_NAME%", get_option('blogname'), $banned_message);
80	$banned_message = str_replace("%SITE_URL%", get_option('siteurl'), $banned_message);
81	$banned_message = str_replace("%USER_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['users'][ban_get_ip()]), $banned_message);
82	$banned_message = str_replace("%USER_IP%", ban_get_ip(), $banned_message);
83	$banned_message = str_replace("%USER_HOSTNAME%", @gethostbyaddr(ban_get_ip()), $banned_message);
84	$banned_message = str_replace("%TOTAL_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['count']), $banned_message);
85	echo $banned_message;
86	exit();
87	}
88
89
90	### Function: Print Out Banned Message
91	function print_banned_message() {
92	// Credits To Joe (Ttech) - http://blog.fileville.net/
93	$banned_stats = get_option('banned_stats');
94	$banned_stats['count'] = intval($banned_stats['count']) + 1;
95	$banned_stats['users'][ban_get_ip()] = intval($banned_stats['users'][ban_get_ip()]) + 1;
96	update_option('banned_stats', $banned_stats);
97	$banned_message = stripslashes(get_option('banned_message'));
98	$banned_message = str_replace("%SITE_NAME%", get_option('blogname'), $banned_message);
99	$banned_message = str_replace("%SITE_URL%", get_option('siteurl'), $banned_message);
100	$banned_message = str_replace("%USER_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['users'][ban_get_ip()]), $banned_message);
101	$banned_message = str_replace("%USER_IP%", ban_get_ip(), $banned_message);
102	$banned_message = str_replace("%USER_HOSTNAME%", @gethostbyaddr(ban_get_ip()), $banned_message);
103	$banned_message = str_replace("%TOTAL_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['count']), $banned_message);
104	echo $banned_message;
105	exit();
106	}
107
108
109	### Function: Process Banning
110	function process_ban($banarray, $against) {
111	if(!empty($banarray) && !empty($against)) {
112	foreach($banarray as $cban) {
113	if(preg_match_wildcard($cban, $against)) {
114	print_banned_message();
115	}
116	}
117	}
118	return;
119	}
120
121
122	### Function: Process Banned IP Range
123	function process_ban_ip_range($banned_ips_range) {
124	if(!empty($banned_ips_range)) {
125	foreach($banned_ips_range as $banned_ip_range) {
126	$range = explode('-', $banned_ip_range);
127	$range_start = trim($range[0]);
128	$range_end = trim($range[1]);
129	if(check_ip_within_range(ban_get_ip(), $range_start, $range_end)) {
130	print_banned_message();
131	break;
132	}
133	}
134	}
135	}
136
137
138	### Function: Banned
139	add_action('init', 'banned');
140	function banned() {
141	$ip = ban_get_ip();
142	if($ip == 'unknown') {
143	return;
144	}
145	$banned_ips = get_option('banned_ips');
146	if(is_array($banned_ips))
147	$banned_ips = array_filter($banned_ips);
148
149	$banned_ips_range = get_option('banned_ips_range');
150	if(is_array($banned_ips_range))
151	$banned_ips_range = array_filter($banned_ips_range);
152
153	$banned_hosts = get_option('banned_hosts');
154	if(is_array($banned_hosts))
155	$banned_hosts = array_filter($banned_hosts);
156
157	$banned_referers = get_option('banned_referers');
158	if(is_array($banned_referers))
159	$banned_referers = array_filter($banned_referers);
160
161	$banned_user_agents = get_option('banned_user_agents');
162	if(is_array($banned_user_agents))
163	$banned_user_agents = array_filter($banned_user_agents);
164
165	$banned_exclude_ips = get_option('banned_exclude_ips');
166	if(is_array($banned_exclude_ips))
167	$banned_exclude_ips = array_filter($banned_exclude_ips);
168
169	$is_excluded = false;
170	if(!empty($banned_exclude_ips)) {
171	foreach($banned_exclude_ips as $banned_exclude_ip) {
172	if($ip == $banned_exclude_ip) {
173	$is_excluded = true;
174	break;
175	}
176	}
177	}
178
179	if( ! $is_excluded ) {
180	if( ! empty( $banned_ips ) ) {
181	process_ban( $banned_ips, $ip );
182	}
183	if( ! empty( $banned_ips_range ) ) {
184	process_ban_ip_range( $banned_ips_range );
185	}
186	if( ! empty( $banned_hosts ) ) {
187	process_ban( $banned_hosts, @gethostbyaddr( $ip ) );
188	}
189	if( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
190	process_ban( $banned_referers, $_SERVER['HTTP_REFERER'] );
191	}
192	if( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
193	process_ban( $banned_user_agents, $_SERVER['HTTP_USER_AGENT'] );
194	}
195	}
196	}
197
198
199	### Function: Check Whether Or Not The IP Address Belongs To Admin
200	function is_admin_ip($check) {
201	return preg_match_wildcard($check, ban_get_ip());
202	}
203
204
205	### Function: Check Whether IP Within A Given IP Range
206	function check_ip_within_range($ip, $range_start, $range_end) {
207	$range_start = ip2long($range_start);
208	$range_end = ip2long($range_end);
209	$ip = ip2long($ip);
210	if($ip !== false && $ip >= $range_start && $ip <= $range_end) {
211	return true;
212	}
213	return false;
214	}
215
216
217	### Function: Check Whether Or Not The Hostname Belongs To Admin
218	function is_admin_hostname($check) {
219	return preg_match_wildcard($check, @gethostbyaddr(ban_get_ip()));
220	}
221
222
223	### Function: Check Whether Or Not The Referer Belongs To This Site
224	function is_admin_referer($check) {
225	$url_patterns = array(get_option('siteurl'), get_option('home'), get_option('siteurl').'/', get_option('home').'/', get_option('siteurl').'/ ', get_option('home').'/ ', $_SERVER['HTTP_REFERER']);
226	foreach($url_patterns as $url) {
227	if(preg_match_wildcard($check, $url)) {
228	return true;
229	}
230	}
231	return false;
232	}
233
234
235	### Function: Check Whether Or Not The User Agent Is Used by Admin
236	function is_admin_user_agent($check) {
237	return preg_match_wildcard($check, $_SERVER['HTTP_USER_AGENT']);
238	}
239
240
241	### Function: Wildcard Check
242	function preg_match_wildcard($regex, $subject) {
243	$regex = preg_quote($regex, '#');
244	$regex = str_replace('\', '.', $regex);
245	if(preg_match("#^$regex$#", $subject)) {
246	return true;
247	} else {
248	return false;
249	}
250	}
251
252
253	### Function: Activate Plugin
254	register_activation_hook( __FILE__, 'ban_activation' );
255	function ban_activation( $network_wide )
256	{
257	if ( is_multisite() && $network_wide )
258	{
259	$ms_sites = wp_get_sites();
260
261	if( 0 < sizeof( $ms_sites ) )
262	{
263	foreach ( $ms_sites as $ms_site )
264	{
265	switch_to_blog( $ms_site['blog_id'] );
266	ban_activate();
267	}
268	}
269
270	restore_current_blog();
271	}
272	else
273	{
274	ban_activate();
275	}
276	}
277
278	function ban_activate() {
279	add_option('banned_ips', array());
280	add_option('banned_hosts',array());
281	add_option('banned_stats', array('users' => array(), 'count' => 0));
282	add_option('banned_message', '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">'."\n".
283	'<html xmlns="http://www.w3.org/1999/xhtml" '.get_language_attributes().'>'."\n".
284	'<head>'."\n".
285	'<meta http-equiv="Content-Type" content="text/html; charset='.get_option('blog_charset').'" />'."\n".
286	'<title>%SITE_NAME% - %SITE_URL%</title>'."\n".
287	'</head>'."\n".
288	'<body>'."\n".
289	'<div id="wp-ban-container">'."\n".
290	'<p style="text-align: center; font-weight: bold;">'.__('You Are Banned.', 'wp-ban').'</p>'."\n".
291	'</div>'."\n".
292	'</body>'."\n".
293	'</html>', 'Banned Message');
294	// Database Upgrade For WP-Ban 1.11
295	add_option('banned_referers', array());
296	add_option('banned_exclude_ips', array());
297	add_option('banned_ips_range', array());
298	// Database Upgrade For WP-Ban 1.30
299	add_option('banned_user_agents', array());
300	// Database Upgrade For WP-Ban 1.64
301	add_option( 'banned_options', array( 'reverse_proxy' => 0 ) );
302	}