wp-ban / wp-ban.php

wp-ban.php in WP-Ban 1.69.1, at wp-ban.php

322 lines 9.5 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: WP-Ban
4	Plugin URI: https://lesterchan.net/portfolio/programming/php/
5	Description: Ban users by IP, IP Range, host name, user agent and referer url from visiting your WordPress's blog. It will display a custom ban message when the banned IP, IP range, host name, user agent or referer url tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.
6	Version: 1.69.1
7	Author: Lester 'GaMerZ' Chan
8	Author URI: https://lesterchan.net
9	Text Domain: wp-ban
10	*/
11
12
13	/*
14	Copyright 2022 Lester Chan (email : lesterchan@gmail.com)
15
16	This program is free software; you can redistribute it and/or modify
17	it under the terms of the GNU General Public License as published by
18	the Free Software Foundation; either version 2 of the License, or
19	(at your option) any later version.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29	*/
30
31
32	### Create Text Domain For Translation
33	add_action( 'plugins_loaded', 'ban_textdomain' );
34	function ban_textdomain() {
35	load_plugin_textdomain( 'wp-ban' );
36	}
37
38
39	### Function: Ban Menu
40	add_action('admin_menu', 'ban_menu');
41	function ban_menu() {
42	add_options_page(__('Ban', 'wp-ban'), __('Ban', 'wp-ban'), 'manage_options', 'wp-ban/ban-options.php');
43	}
44
45
46	### Function: Get IP Address (http://stackoverflow.com/a/2031935)
47	function ban_get_ip() {
48	$banned_options = get_option( 'banned_options' );
49
50	if( intval( $banned_options['reverse_proxy'] ) === 1 ) {
51	foreach ( array( 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR' ) as $key ) {
52	if ( array_key_exists( $key, $_SERVER ) === true ) {
53	foreach ( explode( ',', $_SERVER[$key] ) as $ip ) {
54	$ip = trim( $ip );
55	if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE) !== false ) {
56	return esc_attr( $ip );
57	}
58	}
59	}
60	}
61	} else if( !empty( $_SERVER['REMOTE_ADDR'] ) ) {
62	$ip = $_SERVER['REMOTE_ADDR'];
63	if( strpos( $ip, ',' ) !== false ) {
64	$ip = explode( ',', $ip );
65	$ip = $ip[0];
66	}
67	return esc_attr( $ip );
68	}
69
70	return '';
71	}
72
73
74	### Function: Preview Banned Message
75	add_action('wp_ajax_ban-admin', 'preview_banned_message');
76	function preview_banned_message() {
77	$banned_stats = get_option('banned_stats');
78	$banned_message = stripslashes(get_option('banned_message'));
79	$banned_message = str_replace("%SITE_NAME%", get_option('blogname'), $banned_message);
80	$banned_message = str_replace("%SITE_URL%", get_option('siteurl'), $banned_message);
81	$banned_message = str_replace("%USER_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['users'][ban_get_ip()]), $banned_message);
82	$banned_message = str_replace("%USER_IP%", ban_get_ip(), $banned_message);
83	$banned_message = str_replace("%USER_HOSTNAME%", @gethostbyaddr(ban_get_ip()), $banned_message);
84	$banned_message = str_replace("%TOTAL_ATTEMPTS_COUNT%", number_format_i18n($banned_stats['count']), $banned_message);
85	echo $banned_message;
86	exit();
87	}
88
89
90	### Function: Print Out Banned Message
91	function print_banned_message() {
92	$banned_ip = ban_get_ip();
93	$banned_stats = get_option( 'banned_stats' );
94	if ( isset( $banned_stats['count'] ) ) {
95	$banned_stats['count'] += 1;
96	} else {
97	$banned_stats['count'] = 1;
98	}
99	if ( isset( $banned_stats['users'][$banned_ip] ) ) {
100	$banned_stats['users'][$banned_ip] += 1;
101	} else {
102	$banned_stats['users'][$banned_ip] = 1;
103	}
104	update_option( 'banned_stats', $banned_stats );
105	$banned_message = str_replace(
106	array(
107	'%SITE_NAME%',
108	'%SITE_URL%',
109	'%USER_ATTEMPTS_COUNT%',
110	'%USER_IP%',
111	'%USER_HOSTNAME%',
112	'%TOTAL_ATTEMPTS_COUNT%'
113	),
114	array(
115	get_option( 'blogname' ),
116	get_option( 'siteurl' ),
117	number_format_i18n( $banned_stats['users'][$banned_ip] ),
118	$banned_ip,
119	@gethostbyaddr( $banned_ip ),
120	number_format_i18n( $banned_stats['count'] )
121	),
122	stripslashes( get_option( 'banned_message' ) )
123	);
124	echo '<!DOCTYPE html>' . "\n";
125	echo $banned_message;
126	exit();
127	}
128
129
130	### Function: Process Banning
131	function process_ban($banarray, $against) {
132	if(!empty($banarray) && !empty($against)) {
133	foreach($banarray as $cban) {
134	if(preg_match_wildcard($cban, $against)) {
135	print_banned_message();
136	}
137	}
138	}
139	return;
140	}
141
142
143	### Function: Process Banned IP Range
144	function process_ban_ip_range($banned_ips_range) {
145	if(!empty($banned_ips_range)) {
146	foreach($banned_ips_range as $banned_ip_range) {
147	$range = explode('-', $banned_ip_range);
148	$range_start = trim($range[0]);
149	$range_end = trim($range[1]);
150	if(check_ip_within_range(ban_get_ip(), $range_start, $range_end)) {
151	print_banned_message();
152	break;
153	}
154	}
155	}
156	}
157
158
159	### Function: Banned
160	add_action( 'init', 'banned' );
161	function banned() {
162	$ip = ban_get_ip();
163	if ( $ip === 'unknown' ) {
164	return;
165	}
166	$banned_ips = get_option( 'banned_ips' );
167	if ( is_array( $banned_ips ) )
168	$banned_ips = array_filter( $banned_ips );
169
170	$banned_ips_range = get_option( 'banned_ips_range' );
171	if ( is_array( $banned_ips_range ) )
172	$banned_ips_range = array_filter( $banned_ips_range );
173
174	$banned_hosts = get_option( 'banned_hosts' );
175	if ( is_array( $banned_hosts ) )
176	$banned_hosts = array_filter( $banned_hosts );
177
178	$banned_referers = get_option( 'banned_referers' );
179	if ( is_array( $banned_referers ) )
180	$banned_referers = array_filter( $banned_referers );
181
182	$banned_user_agents = get_option( 'banned_user_agents' );
183	if ( is_array( $banned_user_agents ) )
184	$banned_user_agents = array_filter( $banned_user_agents );
185
186	$banned_exclude_ips = get_option('banned_exclude_ips');
187	if ( is_array( $banned_exclude_ips ) )
188	$banned_exclude_ips = array_filter( $banned_exclude_ips );
189
190	$is_excluded = false;
191	if ( ! empty( $banned_exclude_ips ) ) {
192	foreach( $banned_exclude_ips as $banned_exclude_ip ) {
193	if ( $ip === $banned_exclude_ip ) {
194	$is_excluded = true;
195	break;
196	}
197	}
198	}
199
200	if ( ! $is_excluded ) {
201	if( ! empty( $banned_ips ) ) {
202	process_ban( $banned_ips, $ip );
203	}
204	if ( ! empty( $banned_ips_range ) ) {
205	process_ban_ip_range( $banned_ips_range );
206	}
207	if ( ! empty( $banned_hosts ) ) {
208	process_ban( $banned_hosts, @gethostbyaddr( $ip ) );
209	}
210	if ( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
211	process_ban( $banned_referers, $_SERVER['HTTP_REFERER'] );
212	}
213	if ( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
214	process_ban( $banned_user_agents, $_SERVER['HTTP_USER_AGENT'] );
215	}
216	}
217	}
218
219
220	### Function: Check Whether Or Not The IP Address Belongs To Admin
221	function is_admin_ip($check) {
222	return preg_match_wildcard($check, ban_get_ip());
223	}
224
225
226	### Function: Check Whether IP Within A Given IP Range
227	function check_ip_within_range($ip, $range_start, $range_end) {
228	$range_start = ip2long($range_start);
229	$range_end = ip2long($range_end);
230	$ip = ip2long($ip);
231	if($ip !== false && $ip >= $range_start && $ip <= $range_end) {
232	return true;
233	}
234	return false;
235	}
236
237
238	### Function: Check Whether Or Not The Hostname Belongs To Admin
239	function is_admin_hostname($check) {
240	return preg_match_wildcard($check, @gethostbyaddr(ban_get_ip()));
241	}
242
243
244	### Function: Check Whether Or Not The Referer Belongs To This Site
245	function is_admin_referer($check) {
246	$url_patterns = array(get_option('siteurl'), get_option('home'), get_option('siteurl').'/', get_option('home').'/', get_option('siteurl').'/ ', get_option('home').'/ ', $_SERVER['HTTP_REFERER']);
247	foreach($url_patterns as $url) {
248	if(preg_match_wildcard($check, $url)) {
249	return true;
250	}
251	}
252	return false;
253	}
254
255
256	### Function: Check Whether Or Not The User Agent Is Used by Admin
257	function is_admin_user_agent($check) {
258	return preg_match_wildcard($check, $_SERVER['HTTP_USER_AGENT']);
259	}
260
261
262	### Function: Wildcard Check
263	function preg_match_wildcard($regex, $subject) {
264	$regex = preg_quote($regex, '#');
265	$regex = str_replace('\', '.', $regex);
266	if(preg_match("#^$regex$#", $subject)) {
267	return true;
268	} else {
269	return false;
270	}
271	}
272
273
274	### Function: Activate Plugin
275	register_activation_hook( __FILE__, 'ban_activation' );
276	function ban_activation( $network_wide )
277	{
278	if ( is_multisite() && $network_wide )
279	{
280	$ms_sites = wp_get_sites();
281
282	if( 0 < sizeof( $ms_sites ) )
283	{
284	foreach ( $ms_sites as $ms_site )
285	{
286	switch_to_blog( $ms_site['blog_id'] );
287	ban_activate();
288	}
289	}
290
291	restore_current_blog();
292	}
293	else
294	{
295	ban_activate();
296	}
297	}
298
299	function ban_activate() {
300	add_option('banned_ips', array());
301	add_option('banned_hosts',array());
302	add_option('banned_stats', array('users' => array(), 'count' => 0));
303	add_option('banned_message', '<html>'."\n".
304	'<head>'."\n".
305	'<meta charset="utf-8">'."\n".
306	'<title>%SITE_NAME% - %SITE_URL%</title>'."\n".
307	'</head>'."\n".
308	'<body>'."\n".
309	'<div id="wp-ban-container">'."\n".
310	'<p style="text-align: center; font-weight: bold;">'.__('You Are Banned.', 'wp-ban').'</p>'."\n".
311	'</div>'."\n".
312	'</body>'."\n".
313	'</html>', 'Banned Message');
314	// Database Upgrade For WP-Ban 1.11
315	add_option('banned_referers', array());
316	add_option('banned_exclude_ips', array());
317	add_option('banned_ips_range', array());
318	// Database Upgrade For WP-Ban 1.30
319	add_option('banned_user_agents', array());
320	// Database Upgrade For WP-Ban 1.64
321	add_option( 'banned_options', array( 'reverse_proxy' => 0 ) );
322	}