| 1 |
<?php defined('ABSPATH') or die("Protected By WT!"); |
| 2 |
|
| 3 |
|
| 4 |
class WTSEC_LIBRARY_App |
| 5 |
{ |
| 6 |
|
| 7 |
public function __construct() |
| 8 |
{ |
| 9 |
$this->auth(); |
| 10 |
} |
| 11 |
|
| 12 |
public function auth(){ |
| 13 |
if(self::getOption('authorized') === false && (defined('WTSEC_DEACTIVATED') && !WTSEC_DEACTIVATED)){ |
| 14 |
wp_safe_redirect(admin_url('admin.php?page=' . WTSEC_PAGE_PREFIX . 'login')); |
| 15 |
exit; |
| 16 |
} |
| 17 |
} |
| 18 |
|
| 19 |
public static function authorized(){ |
| 20 |
return (boolean) self::getOption('authorized'); |
| 21 |
} |
| 22 |
|
| 23 |
public static function login($token){ |
| 24 |
define("WTSEC_DEACTIVATED", false); |
| 25 |
self::_set('authorized', true); |
| 26 |
self::_set('authToken', $token); |
| 27 |
} |
| 28 |
|
| 29 |
public static function logout(){ |
| 30 |
self::_delete(['authToken','authorized','api_key']); |
| 31 |
//self::_set('am_installed', false); |
| 32 |
} |
| 33 |
|
| 34 |
public static function clearDB(){ |
| 35 |
$options = ['api_key','authorized','authToken', |
| 36 |
'waf_installed_file','am_installed_file','am_installed', |
| 37 |
'color_scheme','check_login_attempt','time_zone', |
| 38 |
'token_expired','deactivated', 'antivirus_event', |
| 39 |
'antivirus_endCursor', 'antivirus_hasNextPage', |
| 40 |
'firewall_endCursor', 'firewall_hasNextPage', |
| 41 |
'reports_endCursor', 'reports_hasNextPage']; |
| 42 |
self::_delete($options); |
| 43 |
} |
| 44 |
|
| 45 |
public function getLocalDomains(){ |
| 46 |
return []; |
| 47 |
} |
| 48 |
|
| 49 |
public static function _set($name,$value){ |
| 50 |
return update_option(WTSEC_PLUGIN_PREFIX.$name,$value); |
| 51 |
} |
| 52 |
|
| 53 |
public static function _get($name){ |
| 54 |
return get_option(WTSEC_PLUGIN_PREFIX.$name); |
| 55 |
} |
| 56 |
|
| 57 |
public static function _delete($options){ |
| 58 |
if(is_array($options)){ |
| 59 |
foreach ($options as $option) { |
| 60 |
if ( ! delete_option(WTSEC_PLUGIN_PREFIX.$option)) |
| 61 |
return false; |
| 62 |
} |
| 63 |
} else{ |
| 64 |
delete_option(WTSEC_PLUGIN_PREFIX.$options); |
| 65 |
} |
| 66 |
return true; |
| 67 |
} |
| 68 |
|
| 69 |
public function set($name,$value){ |
| 70 |
return update_option(WTSEC_PLUGIN_PREFIX.$name,$value); |
| 71 |
} |
| 72 |
|
| 73 |
public function get($name){ |
| 74 |
return get_option(WTSEC_PLUGIN_PREFIX.$name); |
| 75 |
} |
| 76 |
|
| 77 |
public static function getOption($name){ |
| 78 |
return get_option(WTSEC_PLUGIN_PREFIX.$name); |
| 79 |
} |
| 80 |
|
| 81 |
public static function deleteOption($name){ |
| 82 |
return delete_option(WTSEC_PLUGIN_PREFIX.$name); |
| 83 |
} |
| 84 |
|
| 85 |
public static function getToken(){ |
| 86 |
return self::getOption('authToken'); |
| 87 |
} |
| 88 |
|
| 89 |
public static function getName(){ |
| 90 |
return self::getOption('username'); |
| 91 |
} |
| 92 |
|
| 93 |
|
| 94 |
// Limit login attempt |
| 95 |
public function wtsec_login_check($user, $username, $password){ |
| 96 |
|
| 97 |
if( ! $this->wtsec_is_need_check() ){ |
| 98 |
return $user; |
| 99 |
} |
| 100 |
|
| 101 |
require_once WTSEC_PLUGIN_PATH . 'library/Localization.php'; |
| 102 |
|
| 103 |
function wtsec_locale($lmsg, $args = []) |
| 104 |
{ |
| 105 |
return WTSEC_LIBRARY_Localization::lmsg($lmsg, $args); |
| 106 |
} |
| 107 |
|
| 108 |
$massage = wtsec_locale('login_attempt_message'); |
| 109 |
global $msg; |
| 110 |
|
| 111 |
$options = (object) [ |
| 112 |
// время снятия блокировки в секуда� |
| 113 |
|
| 114 |
'lock_time' => 1800, // 1800 |
| 115 |
// Количество попыток авторизоваться |
| 116 |
'lock_num' => 5, |
| 117 |
// Сообщение о блокировке |
| 118 |
'massage' => $massage, |
| 119 |
// время полной очистки файла - 4 дня |
| 120 |
'expire_time' => 3600 * 24 * 4, |
| 121 |
// добавить в названия файлов запрос REQUEST_URI - может пригодится для дебага |
| 122 |
'add_uri' => false, |
| 123 |
// использовать ли мякгий метод получения IP? |
| 124 |
'soft_get_ip' => false, |
| 125 |
]; |
| 126 |
|
| 127 |
// чтобы установить имя файла |
| 128 |
$action = @ $_GET['action']; |
| 129 |
if( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login' ), true ) ) |
| 130 |
$action = 'login'; |
| 131 |
|
| 132 |
// создаем директорию кэша если надо |
| 133 |
$cache_dir = plugin_dir_path(__FILE__) . 'cache'; |
| 134 |
if( ! file_exists($cache_dir) ) |
| 135 |
mkdir( $cache_dir, 0777 ); |
| 136 |
|
| 137 |
// оперделим название файла |
| 138 |
$REQUEST_URI = $options->add_uri ? ( '___'. preg_replace('/[^a-zA-Z0-9:=?_-]/', '-', $_SERVER['REQUEST_URI'] ) /*все на -*/ ) : ''; |
| 139 |
$domen = str_replace('www.', '', $_SERVER['HTTP_HOST'] ); |
| 140 |
$file_path = $cache_dir . "/{$domen}___{$action}{$REQUEST_URI}.ini"; |
| 141 |
|
| 142 |
// оперделим ip |
| 143 |
if( ! $ip = $this->wtsec_get_ip( $options->soft_get_ip ) ) |
| 144 |
die( 'No IP...' ); |
| 145 |
|
| 146 |
// парсим данные |
| 147 |
$data = @ parse_ini_file( $file_path ); |
| 148 |
$data = (!$data) ? [] : $data; |
| 149 |
$attempts = array_key_exists($ip,$data) ? count($data[$ip]) + 1 : 1; |
| 150 |
$last_access_time = array_key_exists($ip,$data) ? max( $data[$ip] ) : 0; |
| 151 |
$blocked_time = $last_access_time + ($options->lock_time * floor( $attempts / $options->lock_num) ); |
| 152 |
|
| 153 |
if ( $data['status'][$ip] == 'blocked' && $blocked_time > time() ){ |
| 154 |
$blocked_time = ($blocked_time - time()) / 60; |
| 155 |
|
| 156 |
// Вывод ошибки и блокировка |
| 157 |
$msg = sprintf($options->massage, $options->lock_num, $blocked_time); |
| 158 |
$error = new WP_Error(); |
| 159 |
$error->add('wp_to_many_try', $msg); |
| 160 |
return $error; |
| 161 |
} else{ |
| 162 |
file_put_contents( $file_path, sprintf("{$ip}[] = %d\n", time()), FILE_APPEND ); // добавляем ip и время |
| 163 |
|
| 164 |
if ($data['status'][$ip] == 'blocked'){ |
| 165 |
$new_content = preg_replace("~status\[" . $ip . "\] = [a-z]+\n~", '', file_get_contents($file_path) ); |
| 166 |
file_put_contents( $file_path, $new_content ); // снимает блокировку |
| 167 |
} |
| 168 |
|
| 169 |
if($attempts >= $options->lock_num && ( $attempts % $options->lock_num ) == 0) |
| 170 |
file_put_contents( $file_path, "status[{$ip}] = blocked\n", FILE_APPEND); // добавляем блокировку |
| 171 |
} |
| 172 |
|
| 173 |
// полная очистка файла |
| 174 |
if( empty($data['expire']) ){ |
| 175 |
file_put_contents( $file_path, 'expire = ' . time() . "\n", FILE_APPEND ); |
| 176 |
} |
| 177 |
elseif( $data['expire'] + $options->expire_time < time() ){ |
| 178 |
$content = 'expire = '. time() . "\n"; |
| 179 |
file_put_contents( $file_path, $content ); // очищаем файл полностью |
| 180 |
} |
| 181 |
return $user; |
| 182 |
} |
| 183 |
|
| 184 |
protected function wtsec_is_need_check(){ |
| 185 |
|
| 186 |
// работает только для POST запросов. |
| 187 |
if( empty($_POST) ) |
| 188 |
return false; |
| 189 |
|
| 190 |
$need_check = false; |
| 191 |
$settings_value = self::_get('check_login_attempt'); |
| 192 |
|
| 193 |
// для страницы '/wp-login.php' |
| 194 |
if( false !== strpos($_SERVER['REQUEST_URI'], '/wp-login.php') && $settings_value ) |
| 195 |
$need_check = true; |
| 196 |
|
| 197 |
|
| 198 |
return $need_check; |
| 199 |
} |
| 200 |
|
| 201 |
protected function wtsec_get_ip( $soft = false ){ |
| 202 |
|
| 203 |
if( $soft ){ |
| 204 |
$ip = isset($_SERVER['HTTP_CF_CONNECTING_IP']) ? $_SERVER['HTTP_CF_CONNECTING_IP'] : ''; // cloudflare IP support |
| 205 |
if( ! filter_var($ip, FILTER_VALIDATE_IP) ) $ip = isset($_SERVER['HTTP_CLIENT_IP']) ? $_SERVER['HTTP_CLIENT_IP'] : ''; |
| 206 |
if( ! filter_var($ip, FILTER_VALIDATE_IP) ) $ip = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : ''; |
| 207 |
if( ! filter_var($ip, FILTER_VALIDATE_IP) ) $ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : ''; |
| 208 |
} |
| 209 |
else { |
| 210 |
$ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : ''; |
| 211 |
} |
| 212 |
|
| 213 |
return $ip; |
| 214 |
} |
| 215 |
|
| 216 |
} |
