← All changes | protect/lp.php +40 -39 5.38 → trunk View file →

		@@ -1,9 +1,9 @@
1	1	<?php
2	2	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3	3
4		-if (!class_exists('MCProtectLP')) :
5		-class MCProtectLP {
	4	+if (!class_exists('WPRProtectLP_V672')) :
	5	+class WPRProtectLP_V672 {
6	6	private $ip;
7	7	private $time;
8	8	private $ipstore;
9	9	private $logger;
		@@ -8,9 +8,9 @@
8	8	private $ipstore;
9	9	private $logger;
10	10	private $brand_name;
11	11
12		- private $mode = MCProtectLP::MODE_DISABLED;
	12	+ private $mode = WPRProtectLP_V672::MODE_DISABLED;
13	13	private $captcha_limit = 3;
14	14	private $temp_block_limit = 10;
15	15	private $block_all_limit = 100;
16	16	private $failed_login_gap = 1800;
		@@ -16,9 +16,9 @@
16	16	private $failed_login_gap = 1800;
17	17	private $success_login_gap = 1800;
18	18	private $all_blocked_gap = 1800;
19	19
20		- private $category = MCProtectLP::CATEGORY_ALLOWED;
	20	+ private $category = WPRProtectLP_V672::CATEGORY_ALLOWED;
21	21	private $username = '';
22	22	private $message = '';
23	23
24	24	private static $instance;
		@@ -45,11 +45,11 @@
45	45
46	46	private function __construct($request, $config, $brand_name) {
47	47	$this->ip = $request->getIP();
48	48	$this->brand_name = $brand_name;
49		- $this->ipstore = new MCProtectIpstore();
50		- $this->logger = new MCProtectLogger(MCProtectLP::TABLE_NAME);
51		- $this->time = strtotime(date("Y-m-d H:i:s"));
	49	+ $this->ipstore = new WPRProtectIpstore_V672();
	50	+ $this->logger = new WPRProtectLogger_V672(WPRProtectLP_V672::TABLE_NAME);
	51	+ $this->time = strtotime(gmdate("Y-m-d H:i:s"));
52	52
53	53	if (is_array($config)) {
54	54	if (array_key_exists('mode', $config) && is_int($config['mode'])) {
55	55	$this->mode = $config['mode'];
		@@ -89,9 +89,9 @@
89	89	return self::$instance;
90	90	}
91	91
92	92	public static function uninstall() {
93		- MCProtect::$db->dropBVTable(MCProtectLP::TABLE_NAME);
	93	+ WPRProtect_V672::$db->dropBVTable(WPRProtectLP_V672::TABLE_NAME);
94	94	}
95	95
96	96	public function init() {
97	97	if ($this->isActive()) {
		@@ -101,9 +101,9 @@
101	101	}
102	102	}
103	103
104	104	private function getCaptchaLink() {
105		- $account = WPRAccount::apiPublicAccount(MCProtect::$settings);
	105	+ $account = WPRAccount::apiPublicAccount(WPRProtect_V672::$settings);
106	106
107	107	$url = $account->authenticatedUrl('/captcha/solve');
108	108	$url .= "&adminurl=".base64_encode(get_admin_url());
109	109
		@@ -110,22 +110,22 @@
110	110	return $url;
111	111	}
112	112
113	113	private function getAllowLoginsTransient() {
114		- return MCProtect::$settings->getTransient('bvlp_allow_logins');
	114	+ return WPRProtect_V672::$settings->getTransient('bvlp_allow_logins');
115	115	}
116	116
117	117	private function getBlockLoginsTransient() {
118		- return MCProtect::$settings->getTransient('bvlp_block_logins');
	118	+ return WPRProtect_V672::$settings->getTransient('bvlp_block_logins');
119	119	}
120	120
121	121	private function terminateTemplate() {
122	122	$templates = array (
123	123	1 => "<p>Too many failed attempts, You are barred from logging into this site.</p>" .
124		- "<a href=" . $this->getCaptchaLink() ." class='btn btn-default'>Click here</a>" .
	124	+ "<a href=" . esc_url($this->getCaptchaLink()) . " class='btn btn-default'>Click here</a>" .
125	125	" to unblock yourself.",
126	126	2 => "You cannot login to this site for 30 minutes because of too many failed login attempts.",
127		- 3 => "<p>Logins to this site are currently blocked.</p><a href=" . $this->getCaptchaLink() .
	127	+ 3 => "<p>Logins to this site are currently blocked.</p><a href=" . esc_url($this->getCaptchaLink()) .
128	128	" class='btn btn-default'>Click here</a> to unblock yourself.",
129	129	5 => "Your IP is blacklisted."
130	130	);
131	131
		@@ -132,21 +132,21 @@
132	132	return "
133	133	<div style='height: 98vh;'>
134	134	<div style='text-align: center; padding: 10% 0; font-family: Arial, Helvetica, sans-serif;'>
135	135	<div><p><img src=". plugins_url('/../img/icon.png', __FILE__) . "><h2>Login Protection</h2><h3>powered by</h3><h2>"
136		- . $this->brand_name . " Firewall</h2></p><div>
	136	+ . esc_html($this->brand_name) . " Firewall</h2></p><div>
137	137	<p>" . $templates[$this->category] . "</p>
138		- <p>Reference ID: " . WPRInfo::getRequestID() . "</p>
	138	+ <p>Reference ID: " . esc_html(WPRInfo::getRequestID()) . "</p>
139	139	</div>
140	140	</div>";
141	141	}
142	142
143	143	private function isProtecting() {
144		- return $this->mode === MCProtectLP::MODE_PROTECT;
	144	+ return $this->mode === WPRProtectLP_V672::MODE_PROTECT;
145	145	}
146	146
147	147	private function isActive() {
148		- return $this->mode !== MCProtectLP::MODE_DISABLED;
	148	+ return $this->mode !== WPRProtectLP_V672::MODE_DISABLED;
149	149	}
150	150
151	151	private function isBlacklistedIP() {
152	152	return $this->ipstore->isLPIPBlacklisted($this->ip);
		@@ -156,13 +156,13 @@
156	156	return $this->ipstore->isLPIPWhitelisted($this->ip);
157	157	}
158	158
159	159	private function isUnBlockedIP() {
160		- $transient_name = MCProtectLP::UNBLOCK_IP_TRANSIENT_PREFIX . $this->ip;
161		- $attempts = MCProtect::$settings->getTransient($transient_name);
	160	+ $transient_name = WPRProtectLP_V672::UNBLOCK_IP_TRANSIENT_PREFIX . $this->ip;
	161	+ $attempts = WPRProtect_V672::$settings->getTransient($transient_name);
162	162
163	163	if ($attempts && $attempts > 0) {
164		- MCProtect::$settings->setTransient($transient_name, $attempts - 1, 600 * $attempts);
	164	+ WPRProtect_V672::$settings->setTransient($transient_name, $attempts - 1, 600 * $attempts);
165	165	return true;
166	166	}
167	167
168	168	return false;
		@@ -169,9 +169,9 @@
169	169	}
170	170
171	171	private function isLoginBlocked() {
172	172	if ($this->getAllowLoginsTransient() ||
173		- ($this->getLoginCount(MCProtectLP::LOGIN_STATUS_FAILURE, null, $this->all_blocked_gap) < $this->block_all_limit)) {
	173	+ ($this->getLoginCount(WPRProtectLP_V672::LOGIN_STATUS_FAILURE, null, $this->all_blocked_gap) < $this->block_all_limit)) {
174	174	return false;
175	175	}
176	176
177	177	return true;
		@@ -192,14 +192,15 @@
192	192	}
193	193
194	194	private function terminateLogin() {
195	195	$this->message = 'Login Blocked';
196		- $this->log(MCProtectLP::LOGIN_STATUS_BLOCKED);
	196	+ $this->log(WPRProtectLP_V672::LOGIN_STATUS_BLOCKED);
197	197	if ($this->isProtecting()) {
198	198	header("Cache-Control: no-cache, no-store, must-revalidate");
199	199	header("Pragma: no-cache");
200	200	header("Expires: 0");
201	201	header('HTTP/1.0 403 Forbidden');
	202	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Already Escaped
202	203	die($this->terminateTemplate());
203	204	exit;
204	205	}
205	206	}
		@@ -205,30 +206,30 @@
205	206	}
206	207
207	208	public function loginInit($user, $username = '', $password = '') {
208	209	if ($this->isUnBlockedIP()) {
209		- $this->category = MCProtectLP::CATEGORY_UNBLOCKED;
	210	+ $this->category = WPRProtectLP_V672::CATEGORY_UNBLOCKED;
210	211	} else {
211		- $failed_attempts = $this->getLoginCount(MCProtectLP::LOGIN_STATUS_FAILURE,
	212	+ $failed_attempts = $this->getLoginCount(WPRProtectLP_V672::LOGIN_STATUS_FAILURE,
212	213	$this->ip, $this->failed_login_gap);
213	214
214	215	if ($this->isWhitelistedIP()) {
215		- $this->category = MCProtectLP::CATEGORY_BYPASSED;
216		- } elseif (MCProtectUtils::isPrivateIP($this->ip)) {
217		- $this->category = MCProtectLP::CATEGORY_PRIVATEIP;
	216	+ $this->category = WPRProtectLP_V672::CATEGORY_BYPASSED;
	217	+ } elseif (WPRProtectUtils_V672::isPrivateIP($this->ip)) {
	218	+ $this->category = WPRProtectLP_V672::CATEGORY_PRIVATEIP;
218	219	} elseif ($this->isBlacklistedIP()) {
219		- $this->category = MCProtectLP::CATEGORY_BLACKLISTED;
	220	+ $this->category = WPRProtectLP_V672::CATEGORY_BLACKLISTED;
220	221	$this->terminateLogin();
221	222	} elseif ($this->isKnownLogin()) {
222		- $this->category = MCProtectLP::CATEGORY_BYPASSED;
	223	+ $this->category = WPRProtectLP_V672::CATEGORY_BYPASSED;
223	224	} elseif ($this->isLoginBlocked()) {
224		- $this->category = MCProtectLP::CATEGORY_ALL_BLOCKED;
	225	+ $this->category = WPRProtectLP_V672::CATEGORY_ALL_BLOCKED;
225	226	$this->terminateLogin();
226	227	} elseif ($failed_attempts >= $this->temp_block_limit) {
227		- $this->category = MCProtectLP::CATEGORY_TEMP_BLOCK;
	228	+ $this->category = WPRProtectLP_V672::CATEGORY_TEMP_BLOCK;
228	229	$this->terminateLogin();
229	230	} elseif ($failed_attempts >= $this->captcha_limit) {
230		- $this->category = MCProtectLP::CATEGORY_CAPTCHA_BLOCK;
	231	+ $this->category = WPRProtectLP_V672::CATEGORY_CAPTCHA_BLOCK;
231	232	$this->terminateLogin();
232	233	}
233	234	}
234	235
		@@ -240,33 +241,33 @@
240	241	}
241	242
242	243	public function loginFailed($username) {
243	244	$this->username = $username;
244		- $this->log(MCProtectLP::LOGIN_STATUS_FAILURE);
	245	+ $this->log(WPRProtectLP_V672::LOGIN_STATUS_FAILURE);
245	246	}
246	247
247	248	public function loginSuccess($username) {
248	249	$this->username = $username;
249	250	$this->message = 'Login Success';
250		- $this->log(MCProtectLP::LOGIN_STATUS_SUCCESS);
	251	+ $this->log(WPRProtectLP_V672::LOGIN_STATUS_SUCCESS);
251	252	}
252	253
253	254	private function isKnownLogin() {
254		- return $this->getLoginCount(MCProtectLP::LOGIN_STATUS_SUCCESS,
	255	+ return $this->getLoginCount(WPRProtectLP_V672::LOGIN_STATUS_SUCCESS,
255	256	$this->ip, $this->success_login_gap) > 0;
256	257	}
257	258
258	259	private function getLoginCount($status, $ip, $gap) {
259		- $table = MCProtect::$db->getBVTable(MCProtectLP::TABLE_NAME);
	260	+ $table = WPRProtect_V672::$db->getBVTable(WPRProtectLP_V672::TABLE_NAME);
260	261	$query_str = "SELECT COUNT(*) as count from `$table` WHERE status=%d && time > %d";
261	262	$query_args = array($status, ($this->time - $gap));
262	263
263		- $query = MCProtect::$db->prepare($query_str, $query_args);
	264	+ $query = WPRProtect_V672::$db->prepare($query_str, $query_args);
264	265	if ($ip) {
265		- $query .= MCProtect::$db->prepare(" && ip=%s", $ip);
	266	+ $query .= WPRProtect_V672::$db->prepare(" && ip=%s", $ip);
266	267	}
267	268
268		- $rows = MCProtect::$db->getResult($query);
	269	+ $rows = WPRProtect_V672::$db->getResult($query);
269	270	if (!$rows) {
270	271	return 0;
271	272	}
272	273