+ ';
+
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP error. Output already escaped.
+ echo $error_msg;
+ } else {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce already checked above.
+ $this->block_spammer_ip_records((filter_var(wp_unslash($_REQUEST['item']), FILTER_VALIDATE_IP)));
+ }
+ }
+ }
+
+
+
+ /**
+ * This function will add the selected IP addresses to the blacklist.
+ *
+ * @param int|array $entries - either an array of IDs or a single ID of ip to be blocked
+ *
+ * @return void
+ */
+ public function block_spammer_ip_records($entries) {
+ if (is_array($entries)) {
+ $entries = array_map('esc_sql', $entries); // Escape every array element
+ //Bulk selection using checkboxes were used
+ foreach ($entries as $ip_add) {
+ AIOWPSecurity_Blocking::add_ip_to_block_list($ip_add, 'spam');
+ }
+ }
+
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected IP addresses are now permanently blocked.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ /**
+ * This function prepare the items rendered on the table
+ *
+ * @return void
+ */
+ public function prepare_items() {
+ //First, lets decide how many records per page to show
+ $per_page = 100;
+ $columns = $this->get_columns();
+ $hidden = array();
+ $sortable = $this->get_sortable_columns();
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ $this->process_bulk_action();
+
+ global $wpdb;
+ global $aio_wp_security;
+ $minimum_comments_per_ip = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments');
+ if (empty($minimum_comments_per_ip)) {
+ $minimum_comments_per_ip = 5;
+ }
+ // Ordering parameters
+ //Parameters that are going to be used to order the result
+ isset($_GET["orderby"]) ? $orderby = wp_strip_all_tags(wp_unslash($_GET["orderby"])) : $orderby = ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check.
+ isset($_GET["order"]) ? $order = wp_strip_all_tags(wp_unslash($_GET["order"])) : $order = ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check.
+
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'amount';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ // status is not a key in the database so we don't want to sort the database results, but sort the array later
+ if ('status' == $orderby) {
+ $sql = $wpdb->prepare("SELECT comment_author_IP, COUNT(*) AS amount
+ FROM $wpdb->comments
+ WHERE comment_approved = 'spam'
+ GROUP BY comment_author_IP
+ HAVING amount >= %d
+ ", $minimum_comments_per_ip);
+ } else {
+ // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby cannot be prepared.
+ $sql = $wpdb->prepare("SELECT comment_author_IP, COUNT(*) AS amount
+ FROM $wpdb->comments
+ WHERE comment_approved = 'spam'
+ GROUP BY comment_author_IP
+ HAVING amount >= %d
+ ORDER BY $orderby $order
+ ", $minimum_comments_per_ip);
+ // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby cannot be prepared.
+ }
+
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- Preparing done in conditional above.
+ $data = $wpdb->get_results($sql, ARRAY_A);
+
+ // Get all permanently blocked IP addresses
+ $block_list = AIOWPSecurity_Blocking::get_list_blocked_ips();
+
+ foreach ($data as $key => $value) {
+ if (in_array($value['comment_author_IP'], $block_list)) {
+ $data[$key]['status'] = 'blocked';
+ } else {
+ $data[$key]['status'] = 'not blocked';
+ }
+ }
+
+ if ('status' == $orderby) {
+ $keys = array_column($data, 'status');
+ if ('asc' == $order) {
+ array_multisort($keys, SORT_ASC, SORT_STRING, $data);
+ } else {
+ array_multisort($keys, SORT_DESC, SORT_STRING, $data);
+ }
+ }
+
+ $current_page = $this->get_pagenum();
+ $total_items = count($data);
+ $data = array_slice($data, (($current_page - 1) * $per_page), $per_page);
+ $this->items = $data;
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, //WE have to calculate the total number of items
+ 'per_page' => $per_page, //WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) //WE have to calculate the total number of pages
+ ));
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-debug.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-debug.php
new file mode 100755
index 00000000..4b3d221d
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-debug.php
@@ -0,0 +1,149 @@
+ 'entry', //singular name of the listed records
+ 'plural' => 'entries', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+
+ }
+
+ /**
+ * Returns logtime column in datetime format as per user setting time zone.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the datetime
+ */
+ public function column_logtime($item) {
+ return AIOWPSecurity_Utility::convert_timestamp($item['logtime']);
+ }
+
+ /**
+ * This function renders a default column item
+ *
+ * @param array $item - Item object
+ * @param string $column_name - Column name to be rendered from item object
+ *
+ * @return mixed - data to be rendered for column
+ */
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Sets the columns for the table
+ *
+ * @return array
+ */
+ public function get_columns() {
+ return array(
+ 'logtime' => __('Date and time', 'all-in-one-wp-security-and-firewall'),
+ 'level' => __('Level', 'all-in-one-wp-security-and-firewall'),
+ 'network_id' => __('Network ID', 'all-in-one-wp-security-and-firewall'),
+ 'site_id' => __('Site ID', 'all-in-one-wp-security-and-firewall'),
+ 'message' => __('Message', 'all-in-one-wp-security-and-firewall'),
+ 'type' => __('Type', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+
+ /**
+ * Sets which of the columns the table data can be sorted by
+ *
+ * @return array
+ */
+ public function get_sortable_columns() {
+ return array(
+ 'logtime' => array('logtime', false),
+ 'level' => array('level', false),
+ 'network_id' => array('network_id', false),
+ 'site_id' => array('site_id', false),
+ 'message'=>array('message', false),
+ 'type' => array('type', false)
+ );
+ }
+
+ /**
+ * Grabs the data from database and handles the pagination
+ *
+ * @param boolean $ignore_pagination - whether to not paginate
+ *
+ * @return void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ /**
+ * First, lets decide how many records per page to show
+ */
+ if (defined('AIOWPSEC_DEBUG_LOG_PER_PAGE')) {
+ $per_page = absint(AIOWPSEC_DEBUG_LOG_PER_PAGE);
+ }
+
+ $per_page = empty($per_page) ? 15 : $per_page;
+ $current_page = $this->get_pagenum();
+ $offset = ($current_page - 1) * $per_page;
+ $columns = $this->get_columns();
+ $hidden = array('id'); // we really don't need the IDs of the log entries displayed
+ if (!is_multisite()) {
+ $hidden[] = 'network_id';
+ $hidden[] = 'site_id';
+ }
+ $sortable = $this->get_sortable_columns();
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ global $wpdb;
+
+ $debug_log_tbl = AIOWPSEC_TBL_DEBUG_LOG;
+
+ /* -- Ordering parameters -- */
+
+ //Parameters that are going to be used to order the result
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ isset($_GET["orderby"]) ? $orderby = sanitize_text_field(wp_unslash($_GET["orderby"])) : $orderby = '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ isset($_GET["order"]) ? $order = sanitize_text_field(wp_unslash($_GET["order"])) : $order = '';
+
+ // By default show the most recent debug log entries.
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'logtime';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ $orderby = sanitize_sql_orderby($orderby);
+ $order = sanitize_sql_orderby($order);
+
+ $where_sql = (!is_super_admin()) ? 'WHERE site_id = '.get_current_blog_id() : '';
+
+ if ($ignore_pagination) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$debug_log_tbl}$where_sql ORDER BY $orderby $order", 'ARRAY_A');
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$debug_log_tbl} $where_sql ORDER BY $orderby $order LIMIT $per_page OFFSET $offset", 'ARRAY_A');
+ }
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $total_items = $wpdb->get_var("SELECT COUNT(*) FROM {$debug_log_tbl} $where_sql");
+ $this->items = $data;
+
+ if ($ignore_pagination) return;
+
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, //WE have to calculate the total number of items
+ 'per_page' => $per_page, //WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) //WE have to calculate the total number of pages
+ ));
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-locked-ip.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-locked-ip.php
new file mode 100755
index 00000000..a0d92106
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-locked-ip.php
@@ -0,0 +1,318 @@
+ 'item', //singular name of the listed records
+ 'plural' => 'items', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+
+ }
+
+ /**
+ * Returns created column in datetime format as per user setting time zone.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the datetime
+ */
+ public function column_created($item) {
+ return AIOWPSecurity_Utility::convert_timestamp($item['created']);
+ }
+
+ /**
+ * Returns released column in datetime format as per user setting time zone.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the datetime
+ */
+ public function column_released($item) {
+ return AIOWPSecurity_Utility::convert_timestamp($item['released']);
+ }
+
+ /**
+ * This function renders a column
+ *
+ * @param array $item - Item object
+ * @param string $column_name - Column name to be rendered from item object
+ *
+ * @return string - data to be rendered for column_name
+ */
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Function to populate the locked ip actions column in the table
+ *
+ * @param array $item - Contains the current item data
+ *
+ * @return string
+ */
+ public function column_failed_login_ip($item) {
+ $actions = array(
+ 'unlock' => ''.esc_html__('Unlock', 'all-in-one-wp-security-and-firewall').'',
+ 'delete' => ''.esc_html__('Delete', 'all-in-one-wp-security-and-firewall').'',
+ );
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /*$1%s*/ $item['failed_login_ip'],
+ /*$2%s*/ $this->row_actions($actions)
+ );
+ }
+
+
+ /**
+ * This function renders the checkbox column
+ *
+ * @param array $item - item object
+ *
+ * @return string
+ */
+ public function column_cb($item) {
+ return sprintf(
+ '',
+ /*$1%s*/ $this->_args['singular'], //Let's simply repurpose the table's singular label
+ /*$2%s*/ $item['id'] //The value of the checkbox should be the record's id
+ );
+ }
+
+ /**
+ * Returns ip_lookup_result column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_ip_lookup_result($item) {
+ if (empty($item['ip_lookup_result'])) return __('There is no IP lookup result available.', 'all-in-one-wp-security-and-firewall');
+
+ $ip_lookup_result = json_decode($item['ip_lookup_result'], true);
+
+ // check that the json decode worked
+ if (null === $ip_lookup_result) return __('There is no IP lookup result available.', 'all-in-one-wp-security-and-firewall');
+
+ foreach ($ip_lookup_result as $key => $value) {
+ $ip_lookup_result[$key] = empty($value) ? __('Not Found', 'all-in-one-wp-security-and-firewall') : $value;
+ }
+
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r -- PCP warning. Part of error reporting system.
+ $ip_lookup_result = print_r($ip_lookup_result, true);
+
+ $output = sprintf('%s', esc_attr($item['id']), esc_html__('IP lookup result', 'all-in-one-wp-security-and-firewall'), esc_html__('Show result', 'all-in-one-wp-security-and-firewall'));
+ $output .= sprintf('', esc_attr($item['id']), esc_html($ip_lookup_result));
+
+ return $output;
+ }
+
+ /**
+ * Sets the columns for the table
+ *
+ * @return array
+ */
+ public function get_columns() {
+ return array(
+ 'cb' => '', //Render a checkbox
+ 'failed_login_ip' => __('Locked IP/range', 'all-in-one-wp-security-and-firewall'),
+ 'user_id' => __('User ID', 'all-in-one-wp-security-and-firewall'),
+ 'user_login' => __('Username', 'all-in-one-wp-security-and-firewall'),
+ 'lock_reason' => __('Reason', 'all-in-one-wp-security-and-firewall'),
+ 'created' => __('Date locked', 'all-in-one-wp-security-and-firewall'),
+ 'released' => __('Release date', 'all-in-one-wp-security-and-firewall'),
+ 'ip_lookup_result' => __('IP lookup result', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+
+ /**
+ * This function returns sortable columns
+ *
+ * @return array[]
+ */
+ public function get_sortable_columns() {
+ return array(
+ 'failed_login_ip' => array('failed_login_ip',false),
+ 'user_id' => array('user_id',false),
+ 'user_login' => array('user_login',false),
+ 'lock_reason' => array('lock_reason',false),
+ 'created' => array('created',false),
+ 'released' => array('released',false)
+ );
+ }
+
+ /**
+ * This returns the bulk actions for the table
+ *
+ * @return array
+ */
+ public function get_bulk_actions() {
+ return array(
+ 'unlock' => __('Unlock', 'all-in-one-wp-security-and-firewall'),
+ 'delete' => __('Delete', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ /**
+ * Process bulk actions.
+ *
+ * @return void
+ */
+ private function process_bulk_action() {
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- PCP warning. This is the nonce.
+ if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return;
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning. This is the nonce.
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($_REQUEST['_wpnonce'], 'bulk-items');
+ if (is_wp_error($result)) return;
+
+ if ('delete' == $this->current_action()) { // Process delete bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning. Sanitized later.
+ $this->delete_lockout_records(wp_unslash($_REQUEST['item']));
+ }
+ }
+
+ if ('unlock' == $this->current_action()) { //Process unlock bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning. Sanitized later.
+ $this->unlock_ips((wp_unslash($_REQUEST['item'])));
+ }
+ }
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended -- PCP warning. This is the nonce.
+ }
+
+ /**
+ * Unlocks multiple IP addresses by modifying the released column of records in the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @param array $entries IDs that correspond to IP addresses in the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @return void
+ */
+ public function unlock_ips($entries) {
+ global $wpdb;
+
+ $lockout_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+
+ // Unlock multiple records
+ $entries = array_filter($entries, 'is_numeric'); // Discard non-numeric ID values
+ $id_list = '(' .implode(',', $entries) .')'; // Create comma separate list for DB operation
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $result = $wpdb->query("UPDATE $lockout_table SET `released` = UNIX_TIMESTAMP() WHERE `id` IN $id_list");
+
+ if (null != $result) {
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected IP entries were unlocked successfully.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Deletes one or more records from the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @param array|string|integer $entries - ids or a single id
+ *
+ * @return void|string
+ */
+ public function delete_lockout_records($entries) {
+ global $wpdb, $aio_wp_security;
+ $lockout_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ if (is_array($entries)) {
+ // Delete multiple records
+ $entries = array_filter($entries, 'is_numeric'); //discard non-numeric ID values
+ $id_list = "(" .implode(",", $entries) .")"; //Create comma separate list for DB operation
+ $delete_command = "DELETE FROM ".$lockout_table." WHERE id IN ".$id_list;
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query($delete_command);
+ if ($result) {
+ AIOWPSecurity_Admin_Menu::show_msg_record_deleted_st();
+ } else {
+ // Error on bulk delete
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from login lockout table. Database error: '.$wpdb->last_error, 4);
+ AIOWPSecurity_Admin_Menu::show_msg_record_not_deleted_st();
+ }
+ } elseif (null != $entries) {
+ // Delete single record
+ $delete_command = "DELETE FROM ".$lockout_table." WHERE id = '".absint($entries)."'";
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query($delete_command);
+ if ($result) {
+ return AIOWPSecurity_Admin_Menu::show_msg_record_deleted_st(true);
+ } elseif (false === $result) {
+ // Error on single delete
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from login lockout table. Database error: '.$wpdb->last_error, 4);
+ return AIOWPSecurity_Admin_Menu::show_msg_record_not_deleted_st(true);
+ }
+ }
+ }
+
+ /**
+ * Retrieves all items from AIOWPSEC_TBL_LOGIN_LOCKOUT. It may paginate and then assigns to $this->items.
+ *
+ * @param Boolean $ignore_pagination - whether to not paginate
+ *
+ * @return Void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ global $wpdb;
+
+ $lockout_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+
+ $this->process_bulk_action();
+
+ // How many records per page to show
+ $per_page = 100;
+ $columns = $this->get_columns();
+ $hidden = array();
+ $sortable = $this->get_sortable_columns();
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ // Parameters that are going to be used to order the result
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $orderby = isset($_GET['orderby']) ? sanitize_text_field(wp_unslash($_GET['orderby'])) : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $order = isset($_GET['order']) ? sanitize_text_field(wp_unslash($_GET['order'])) : '';
+
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'created';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ $current_page = $this->get_pagenum();
+ $offset = ($current_page - 1) * $per_page;
+
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $total_items = $wpdb->get_var("SELECT COUNT(*) FROM {$lockout_table} WHERE `released` > UNIX_TIMESTAMP()");
+
+ if ($ignore_pagination) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$lockout_table} WHERE `released` > UNIX_TIMESTAMP() ORDER BY {$orderby} {$order}", 'ARRAY_A');
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$lockout_table} WHERE `released` > UNIX_TIMESTAMP() ORDER BY {$orderby} {$order} LIMIT {$per_page} OFFSET {$offset}", 'ARRAY_A');
+ }
+
+ $this->items = $data;
+
+ if ($ignore_pagination) return;
+
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, // WE have to calculate the total number of items
+ 'per_page' => $per_page, // WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) // WE have to calculate the total number of pages
+ ));
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-logged-in-users.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-logged-in-users.php
new file mode 100755
index 00000000..284608e2
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-logged-in-users.php
@@ -0,0 +1,260 @@
+ 'item', //singular name of the listed records
+ 'plural' => 'items', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+
+ }
+
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Returns user id column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_user_id($item) {
+ //Build row actions
+ $actions = array(
+ 'logout' => ''.__('Force logout', 'all-in-one-wp-security-and-firewall').'',
+ );
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /*$1%s*/ $item['user_id'],
+ /*$2%s*/ $this->row_actions($actions)
+ );
+ }
+
+ /**
+ * Sets the columns for the table
+ *
+ * @return array
+ */
+ public function get_columns() {
+ $columns = array(
+ 'cb' => '',
+ 'user_id' => __('User ID', 'all-in-one-wp-security-and-firewall'),
+ 'username' => __('Login name', 'all-in-one-wp-security-and-firewall'),
+ 'ip_address' => __('IP address', 'all-in-one-wp-security-and-firewall'),
+ 'site_id' => __('Site ID', 'all-in-one-wp-security-and-firewall'),
+ );
+ return $columns;
+ }
+
+ /**
+ * Returns cb column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_cb($item) {
+ return sprintf(
+ '',
+ /* $1%s */ $this->_args['singular'], // Let's simply repurpose the table's singular label
+ /* $2%s */ $item['user_id'] // The value of the checkbox should be the record's id and its ip address
+ );
+ }
+
+ /**
+ * Sets which of the columns the table data can be sorted by
+ *
+ * @return array
+ */
+ public function get_sortable_columns() {
+ return array(
+ 'user_id' => array('user_id',false),
+ 'username' => array('username',false),
+ 'ip_address' => array('ip_address',false),
+ 'site_id' => array('site_id',false),
+ );
+ }
+
+ /**
+ * Adds a bulk action user interface
+ *
+ * @return array
+ */
+ public function get_bulk_actions() {
+ return array(
+ 'force_logout_all' => __('Logout all', 'all-in-one-wp-security-and-firewall'),
+ 'force_logout_selected' => __('Logout selected', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ /**
+ * Process Bulk action from menu
+ *
+ * @return void
+ */
+ private function process_bulk_action() {
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput -- PCP warning. Nonce used.
+ if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return;
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($_REQUEST['_wpnonce'], 'bulk-items');
+ if (is_wp_error($result)) return;
+
+ if ('force_logout_all' === $this->current_action()) {
+ $this->force_user_logout(array(), true);
+ } elseif ('force_logout_selected' === $this->current_action()) {
+ if (isset($_REQUEST['item'])) {
+
+ if (is_array($_REQUEST['item'])) $this->force_user_logout(wp_unslash($_REQUEST['item']));
+ }
+ }
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended -- PCP warning. Nonce used.
+ }
+
+ /**
+ * This function will force selected user(s) to be logged out.
+ *
+ * @param int|array $users - id of selected user or array of user ids to be logged out
+ * @param bool $logout_all - Boolean to show if all users should be logged out
+ *
+ * @return void|string
+ */
+ public function force_user_logout($users, $logout_all = false) {
+ global $wpdb, $aio_wp_security;
+
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+
+ if ($logout_all) {
+ // get all user_id(except for the admin) in the table and make it an array for users
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $users = $wpdb->get_col("SELECT user_id FROM $logged_in_users_table");
+ }
+
+ if (is_array($users)) {
+
+ if (empty($users)) {
+ AIOWPSecurity_Admin_Menu::show_msg_record_not_deleted_st();
+ return;
+ }
+
+ $errors = 0;
+
+ // Escape the user IDs for security
+ $users = array_map('esc_sql', $users);
+
+ foreach ($users as $user_id) {
+ if (is_numeric($user_id) && !is_super_admin($user_id) && AIOWPSecurity_Utility::is_user_member_of_blog($user_id)) {
+ if ($aio_wp_security->user_login_obj->delete_logged_in_user($user_id)) {
+ $this->logout_user($user_id);
+ continue;
+ }
+ }
+ $errors++;
+ }
+
+ if ($errors > 0) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__("Some users were not logged out due to the ID being invalid, or them being a super admin or a member of a different subsite on a multisite", 'all-in-one-wp-security-and-firewall'));
+ return;
+ }
+
+ AIOWPSecurity_Admin_Menu::show_msg_record_deleted_st();
+ }
+ }
+
+
+ /**
+ * This function handles logging out a user using user_id
+ *
+ * @param int $user_id - id of user being logged out
+ *
+ * @return void
+ */
+ public function logout_user($user_id) {
+ $user_id = absint($user_id);
+ $manager = WP_Session_Tokens::get_instance($user_id);
+ $manager->destroy_all();
+ }
+
+ /**
+ * Prepares the items for the logged in users table
+ *
+ * @param bool $ignore_pagination - this is to check if data should be paginated or not
+ *
+ * @return void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ global $wpdb;
+
+ //First, lets decide how many records per page to show
+ $per_page = 100;
+ $columns = $this->get_columns();
+ $hidden = array();
+ $sortable = $this->get_sortable_columns();
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+ $current_page = $this->get_pagenum();
+ $offset = ($current_page - 1) * $per_page;
+
+ // Parameters that are going to be used to order the result
+ // phpcs:disable -- Rule won't be silenced any other way. No nonce.
+ $orderby = isset($_GET["orderby"]) ? sanitize_text_field(wp_unslash($_GET["orderby"])) : '';
+ $order = isset($_GET["order"]) ? sanitize_text_field(wp_unslash($_GET["order"])) : '';
+ // phpcs:enable -- Rule won't be silenced any other way. No nonce.
+
+ // By default show the most recent logged in user entries.
+ $orderby = empty($orderby) ? 'created' : esc_sql($orderby);
+ $order = empty($order) ? 'DESC' : esc_sql($order);
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ $orderby = sanitize_sql_orderby($orderby);
+ $order = sanitize_sql_orderby($order);
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ $this->process_bulk_action(); // Process bulk actions
+
+ $where_sql = $this->get_where_sql();
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $total_items = $wpdb->get_var("SELECT COUNT(*) FROM `{$logged_in_users_table}` $where_sql");
+
+ if ($ignore_pagination) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM `{$logged_in_users_table}` $where_sql ORDER BY $orderby $order", 'ARRAY_A');
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM `{$logged_in_users_table}` $where_sql ORDER BY $orderby $order LIMIT $per_page OFFSET $offset", 'ARRAY_A');
+ }
+
+ $this->items = $data;
+
+ if ($ignore_pagination) return;
+
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, //WE have to calculate the total number of items
+ 'per_page' => $per_page, //WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items/$per_page) //WE have to calculate the total number of pages
+ ));
+ }
+
+ /**
+ * This function will build and return the SQL WHERE statement
+ *
+ * @return string - the SQL WHERE statement
+ */
+ private function get_where_sql() {
+ if (is_main_site() && is_super_admin()) return '';
+
+ return is_multisite() ? sprintf("WHERE site_id = %d", get_current_blog_id()) : '';
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-permanent-blocked-ip.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-permanent-blocked-ip.php
new file mode 100755
index 00000000..2e5c4753
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-permanent-blocked-ip.php
@@ -0,0 +1,238 @@
+ 'item', //singular name of the listed records
+ 'plural' => 'items', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+
+ }
+
+ /**
+ * Returns created column in datetime format as per user setting time zone.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the datetime
+ */
+ public function column_created($item) {
+ return AIOWPSecurity_Utility::convert_timestamp($item['created']);
+ }
+
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Function to populate the permanent blocked ip actions column in the table
+ *
+ * @param array $item - Contains the current item data
+ *
+ * @return string
+ */
+ public function column_id($item) {
+ $actions = array(
+ 'unblock' => 'Unblock',
+ );
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /*$1%s*/
+ $item['id'],
+ /*$2%s*/
+ $this->row_actions($actions)
+ );
+ }
+
+
+ public function column_cb($item) {
+ return sprintf(
+ '',
+ /*$1%s*/
+ $this->_args['singular'], //Let's simply repurpose the table's singular label
+ /*$2%s*/
+ $item['id'] //The value of the checkbox should be the record's id
+ );
+ }
+
+ public function get_columns() {
+ return array(
+ 'cb' => '', //Render a checkbox
+ 'id' => 'ID',
+ 'blocked_ip' => __('Blocked IP', 'all-in-one-wp-security-and-firewall'),
+ 'block_reason' => __('Reason', 'all-in-one-wp-security-and-firewall'),
+ 'created' => __('Date and Time', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+
+ public function get_sortable_columns() {
+ return array(
+ 'id' => array('id', false),
+ 'blocked_ip' => array('blocked_ip', false),
+ 'block_reason' => array('block_reason', false),
+ 'created' => array('created', false)
+ );
+ }
+
+ public function get_bulk_actions() {
+ return array(
+ 'unblock' => __('Unblock', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+
+ private function process_bulk_action() {
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- PCP warning. It IS the nonce. Ignore.
+ if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return;
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning. Ignore.
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($_REQUEST['_wpnonce'], 'bulk-items');
+ if (is_wp_error($result)) return;
+
+ if ('unblock' === $this->current_action()) { // Process unlock bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOS_Helper::set_message('aios_list_message', __('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'), 'error');
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- PCP warning. Sanitized later
+ $this->unblock_ip_address(wp_unslash($_REQUEST['item']));
+ }
+ }
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended -- PCP warning. It IS the nonce. Ignore.
+ }
+
+ /**
+ * Deletes one or more records from the AIOWPSEC_TBL_PERM_BLOCK table.
+ *
+ * @param array|string|integer $entries - ids or a single id
+ *
+ * @return void|string
+ */
+ public function unblock_ip_address($entries) {
+ global $wpdb, $aio_wp_security;
+ if (is_array($entries)) {
+ // multiple records
+
+ $entries = array_filter($entries, 'is_numeric'); //discard non-numeric ID values
+ $id_list = "(" . implode(",", $entries) . ")"; //Create comma separate list for DB operation
+ $delete_command = "DELETE FROM " . AIOWPSEC_TBL_PERM_BLOCK . " WHERE id IN " . $id_list; // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- $id_list cannot be prepared.
+ $result = $wpdb->query($delete_command);
+ if ($result) {
+ AIOS_Helper::set_message('aios_list_message', __('Successfully unblocked and deleted the selected record(s).', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // Error on bulk delete
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from Perm Block table. Database error: '.$wpdb->last_error, 4);
+ AIOS_Helper::set_message('aios_list_message', __('Failed to unblock and delete the selected record(s).', 'all-in-one-wp-security-and-firewall'), 'error');
+ }
+ } elseif (!empty($entries)) {
+ //Delete single record
+ $delete_command = "DELETE FROM " . AIOWPSEC_TBL_PERM_BLOCK . " WHERE id = %d";
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query($wpdb->prepare($delete_command, absint($entries)));
+ if (false === $result) {
+ // Error on single delete
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from Perm Block table. Database error: '.$wpdb->last_error, 4);
+ }
+
+ return $result;
+ }
+ }
+
+ /**
+ * This function will build and return the SQL WHERE statement
+ *
+ * @param string $search_term - the search term applied
+ *
+ * @return string - the SQL WHERE statement
+ */
+ private function get_permanent_blocked_ip_list_where_sql($search_term) {
+ $where = '';
+ if (!empty($search_term)) {
+ $where = " WHERE";
+
+ // We don't use FILTER_VALIDATE_IP here as we want to be able to search for partial IP's
+ if (preg_match('/^[0-9a-f:\.]+$/i', $search_term)) {
+ $where .= " `blocked_ip` LIKE '%".esc_sql($search_term)."%' OR";
+ }
+
+ $where .= " `block_reason` LIKE '%".esc_sql($search_term)."%'";
+ $where .= " OR `country_origin` LIKE '%".esc_sql($search_term)."%'";
+ }
+
+ return $where;
+ }
+
+ /**
+ * Grabs the data from database and handles the pagination
+ *
+ * @param boolean $ignore_pagination - whether to not paginate
+ *
+ * @return void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ /**
+ * First, lets decide how many records per page to show
+ */
+ $per_page = 100;
+ $columns = $this->get_columns();
+ $hidden = array();
+ $sortable = $this->get_sortable_columns();
+
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $search = isset($_REQUEST['s']) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : '';
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ $this->process_bulk_action();
+
+ global $wpdb;
+ $block_table_name = AIOWPSEC_TBL_PERM_BLOCK;
+
+ // Ordering parameters
+ // Parameters that are going to be used to order the result
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $orderby = isset($_GET["orderby"]) ? sanitize_text_field(wp_unslash($_GET["orderby"])) : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $order = isset($_GET["order"]) ? sanitize_text_field(wp_unslash($_GET["order"])) : '';
+
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'id';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ $current_page = $this->get_pagenum();
+ $offset = ($current_page - 1) * $per_page;
+
+
+ $search_query = $this->get_permanent_blocked_ip_list_where_sql($search);
+
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $total_items = $wpdb->get_var("SELECT COUNT(*) FROM {$block_table_name}{$search_query}");
+
+ if ($ignore_pagination) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$block_table_name} {$search_query} ORDER BY $orderby$order", 'ARRAY_A');
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$block_table_name}{$search_query} ORDER BY $orderby $order LIMIT $per_page OFFSET $offset", 'ARRAY_A');
+ }
+
+ $this->items = $data;
+
+ if ($ignore_pagination) return;
+
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, //WE have to calculate the total number of items
+ 'per_page' => $per_page, //WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) //WE have to calculate the total number of pages
+ ));
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-registered-users.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-registered-users.php
new file mode 100755
index 00000000..992eda21
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-registered-users.php
@@ -0,0 +1,355 @@
+ 'item', //singular name of the listed records
+ 'plural' => 'items', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+
+ }
+
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Returns ID column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_ID($item) {
+ //Build row actions
+ $actions = array(
+ 'view' => ''.__('View', 'all-in-one-wp-security-and-firewall').'',
+ 'approve_acct' => ''. __('Approve', 'all-in-one-wp-security-and-firewall') . '',
+ 'delete_acct' => ''. __('Delete', 'all-in-one-wp-security-and-firewall') . '',
+ 'block_ip' => ''. __('Block IP', 'all-in-one-wp-security-and-firewall') . '',
+ );
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /*$1%s*/ $item['ID'],
+ /*$2%s*/ $this->row_actions($actions)
+ );
+ }
+
+ /**
+ * Returns IP address column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_ip_address($item) {
+ if (AIOWPSecurity_Blocking::is_ip_blocked($item['ip_address'])) {
+ return $item['ip_address'].'
'.__('blocked', 'all-in-one-wp-security-and-firewall').''; + } else { + return $item['ip_address']; + } + } + + public function column_cb($item) { + return sprintf( + '', + /*$1%s*/ $this->_args['singular'], //Let's simply repurpose the table's singular label + /*$2%s*/ $item['ID'] //The value of the checkbox should be the record's id + ); + } + + + /** + * Returns array of columns to be rendered. + * + * @return array + */ + public function get_columns() { + $columns = array( + 'cb' => '', // Render a checkbox + 'ID' => __('User ID', 'all-in-one-wp-security-and-firewall'), + 'user_login' => __('Login name', 'all-in-one-wp-security-and-firewall'), + 'user_email' => __('Email', 'all-in-one-wp-security-and-firewall'), + 'user_registered' => __('Register date', 'all-in-one-wp-security-and-firewall'), + 'account_status' => __('Account status', 'all-in-one-wp-security-and-firewall'), + 'ip_address' => __('IP address', 'all-in-one-wp-security-and-firewall') + ); + return $columns; + } + + public function get_sortable_columns() { + $sortable_columns = array( + // 'ID' => array('ID',false), + // 'user_login' => array('user_login',false), + // 'user_email' => array('user_email',false), + // 'user_registered' => array('user_registered',false), + // 'account_status' => array('account_status',false), + ); + return $sortable_columns; + } + + public function get_bulk_actions() { + $actions = array( + 'approve' => __('Approve', 'all-in-one-wp-security-and-firewall'), + 'delete' => __('Delete', 'all-in-one-wp-security-and-firewall'), + 'block' => __('Block IP', 'all-in-one-wp-security-and-firewall') + ); + return $actions; + } + + /** + * Process bulk actions. + * + * @return void + */ + private function process_bulk_action() { + if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap(sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])), 'bulk-items'); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + if (is_wp_error($result)) return; + + if ('approve' == $this->current_action()) { //Process approve bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->approve_selected_accounts(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + if ('delete' == $this->current_action()) { //Process delete bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->delete_selected_accounts(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + if ('block' == $this->current_action()) { //Process block bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->block_selected_ips(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + } + + /** + * This function approves selected user accounts + * + * @param array|int $entries - this is an array of users or user_id to be approved + * + * @return void|string + */ + public function approve_selected_accounts($entries) { + global $aio_wp_security; + $meta_key = 'aiowps_account_status'; + $meta_value = 'approved'; // set account status + $failed_accts = ''; // string to store comma separated accounts which failed to update + $at_least_one_updated = false; + if (is_array($entries)) { + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and approve + foreach ($entries as $user_id) { + $result = update_user_meta($user_id, $meta_key, $meta_value); + if (false === $result) { + $failed_accts .= ' '.$user_id.', '; + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::approve_selected_accounts() - could not approve account ID: $user_id", 4); + } else { + $at_least_one_updated = true; + $user = get_user_by('id', $user_id); + if (false === $user) { + //don't send mail + } else { + $this->send_email_upon_account_activation($user); + } + } + } + if ($at_least_one_updated) { + AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected accounts were approved successfully.', 'all-in-one-wp-security-and-firewall')); + } + if ('' != $failed_accts) { + //display any failed account updates + rtrim($failed_accts); + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('The following accounts failed to update successfully:', 'all-in-one-wp-security-and-firewall') . ' ' . $failed_accts); + } + } + } + + /** + * This function sends an email to an approved user + * + * @param WP_User $user - the object for the approved user + * + * @return bool + */ + public function send_email_upon_account_activation($user) { + global $aio_wp_security; + if (!($user instanceof WP_User)) { + return false; + } + + $to_email_address = $user->user_email; + $email_msg = ''; + $subject = '['.network_site_url().'] '. __('Your account is now active', 'all-in-one-wp-security-and-firewall'); + /* translators: %s: Username */ + $email_msg .= sprintf(__('Your account with username: %s is now active', 'all-in-one-wp-security-and-firewall'), $user->user_login) . "\n"; + $subject = apply_filters('aiowps_register_approval_email_subject', $subject); + $email_msg = apply_filters('aiowps_register_approval_email_msg', $email_msg, $user); //also pass the WP_User object + + $sendMail = wp_mail($to_email_address, $subject, $email_msg); + if (false === $sendMail) { + $aio_wp_security->debug_logger->log_debug("Manual account approval notification email failed to send to " . $to_email_address, 4); + } + return $sendMail; + } + + /** + * This function deletes selected entries pending approval + * + * @param array|int $entries - this is an array of users or single user to be deleted + * + * @return void|string + */ + public function delete_selected_accounts($entries) { + global $aio_wp_security; + if (is_array($entries)) { + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and delete account + foreach ($entries as $user_id) { + $result = wp_delete_user($user_id); + if (true !== $result) { + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::delete_selected_accounts() - could not delete account ID: $user_id", 4); + } + } + AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected accounts were deleted successfully.', 'all-in-one-wp-security-and-firewall')); + } + } + + /** + * This function blocks selected ip + * + * @param array|int $entries - this is an array of ips or ip to be blocked + * + * @return void|string + */ + public function block_selected_ips($entries) { + global $aio_wp_security; + if (is_array($entries)) { + $entries = array_filter($entries, function ($entry) { + return AIOWPSecurity_Utility_IP::get_user_ip_address() != $entry; + }); + + if (empty($entries)) { + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Only invalid IP addresses were provided: you can not block your own IP address', 'all-in-one-wp-security-and-firewall')); + return; + } + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and block IP + $total_success = 0; + foreach ($entries as $id) { + $ip_address = get_user_meta($id, 'aiowps_registrant_ip', true); + $result = AIOWPSecurity_Blocking::add_ip_to_block_list($ip_address, 'registration_spam'); + if (false === $result) { + if (AIOWPSecurity_Utility_IP::get_user_ip_address() == $ip_address) { + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('You cannot block your own IP address:', 'all-in-one-wp-security-and-firewall') . ' ' . $ip_address); + } + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::block_selected_ips() - could not block IP : $ip_address", 4); + } else { + $total_success++; + } + } + if ($total_success > 0) { + $msg = __('The selected IP addresses were successfully added to the permanent block list.', 'all-in-one-wp-security-and-firewall'); + $msg .= ' '.__('View Blocked IPs', 'all-in-one-wp-security-and-firewall').''; + AIOWPSecurity_Admin_Menu::show_msg_updated_st($msg); + } + } + } + + /** + * Grabs the data from database and handles the pagination + * + * @param boolean $ignore_pagination - whether to not paginate + * @return void + */ + public function prepare_items($ignore_pagination = false) { + //First, lets decide how many records per page to show + $per_page = 100; + $columns = $this->get_columns(); + $current_page = $this->get_pagenum(); + $offset = ($current_page - 1) * $per_page; + $hidden = array(); + $sortable = $this->get_sortable_columns(); + $search = isset($_REQUEST['s']) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + + $this->_column_headers = array($columns, $hidden, $sortable); + + $this->process_bulk_action(); + + //Get registered users which have the special 'aiowps_account_status' meta key set to 'pending' + if ($ignore_pagination) { + $result = $this->get_registered_user_data('pending', $search); + } else { + $result = $this->get_registered_user_data('pending', $search, $per_page, $offset); + } + + $total_items = $result['total']; + $this->items = $result['data']; + + if ($ignore_pagination) return; + + $this->set_pagination_args(array( + 'total_items' => $total_items, //WE have to calculate the total number of items + 'per_page' => $per_page, //WE have to determine how many items to show on a page + 'total_pages' => ceil($total_items/$per_page) //WE have to calculate the total number of pages + )); + } + + /** + * Returns all users who have the special 'aiowps_account_status' meta key + * + * @param string $status - the status we want to search for + * @param string $search - the search query + * @param null $per_page - how many results per page + * @param int $offset - the page offset + * + * @return array - an array of users that match the search + */ + public function get_registered_user_data($status = '', $search = '', $per_page = null, $offset = 0) { + $user_fields = array( 'ID', 'user_login', 'user_email', 'user_registered'); + $user_query = new WP_User_Query(array('meta_key' => 'aiowps_account_status', 'meta_value' => $status, 'fields' => $user_fields, 'number' => $per_page, 'offset' => $offset)); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- ignore this + $user_results = $user_query->results; + $user_total = $user_query->get_total(); + + $final_data = array(); + foreach ($user_results as $user) { + $temp_array = get_object_vars($user); //Turn the object into array + $temp_array['account_status'] = get_user_meta($temp_array['ID'], 'aiowps_account_status', true); + $ip = get_user_meta($temp_array['ID'], 'aiowps_registrant_ip', true); + $temp_array['ip_address'] = empty($ip) ? '' : $ip; + if (empty($search)) { + $final_data[] = $temp_array; + } else { + $input = preg_quote($search, '~'); // don't forget to quote input string! + + $result = preg_grep('~' . $input . '~', $temp_array); + if (!empty($result)) $final_data[] = $temp_array; + } + } + + return array( + 'data' => $final_data, + 'total' => $user_total, + ); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php new file mode 100755 index 00000000..179a49e5 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php @@ -0,0 +1,90 @@ +query('TRUNCATE ' . $wpdb->prefix . 'aiowps_login_lockdown'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_global_meta'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_events'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_permanent_block'); + // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Ignore. + if (is_main_site()) { + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_LOGGED_IN_USERS); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_MESSAGE_STORE); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_DEBUG_LOG); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_AUDIT_LOG); + } + // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Ignore. + return true; + } + } + +endif; diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php new file mode 100755 index 00000000..13556c04 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php @@ -0,0 +1,157 @@ + array( + 'title' => __('General settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_general_settings'), + ), + 'htaccess-file-operations' => array( + 'title' => '.htaccess '.__('file', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_htaccess_file_operations'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + 'wp-config-file-operations' => array( + 'title' => 'wp-config.php '.__('file', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_wp_config_file_operations'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + 'delete-plugin-settings' => array( + 'title' => __('Delete plugin settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_delete_plugin_settings_tab') + ), + 'wp-version-info' => array( + 'title' => __('WP version info', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_wp_version_info'), + ), + 'settings-file-operations' => array( + 'title' => __('Import/Export', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_settings_file_operations'), + ), + 'advanced-settings' => array( + 'title' => __('Advanced settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_advanced_settings'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + ); + + $menu_tabs = apply_filters('aiowpsecurity_setting_tabs', $menu_tabs); + $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab')); + } + + /** + * Renders the submenu's general settings tab. + * + * @return void + */ + protected function render_general_settings() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/general-settings.php', false, array()); + } + + /** + * Renders the submenu's htaccess file operations tab. + * + * @return void + */ + protected function render_htaccess_file_operations() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/htaccess-file-operations.php', false, array()); + } + + /** + * Renders the submenu's wp config file operations tab. + * + * @return void + */ + protected function render_wp_config_file_operations() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/wp-config-file-operations.php', false, array()); + } + + /** + * Renders the submenu's delete plugin settings tab. + * + * @return void + */ + protected function render_delete_plugin_settings_tab() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/delete-plugin-settings.php', false, array()); + } + + /** + * Renders the submenu's wp version info tab. + * + * @return void + */ + protected function render_wp_version_info() { + global $aio_wp_security, $aiowps_feature_mgr; + + $aio_wp_security->include_template('wp-admin/settings/wp-version-info.php', false, array('aiowps_feature_mgr' => $aiowps_feature_mgr)); + } + + /** + * Renders the submenu's settings file operations tab. + * + * @return void + */ + protected function render_settings_file_operations() { + global $aio_wp_security; + + $events_table_name = AIOWPSEC_TBL_EVENTS; + AIOWPSecurity_Utility::cleanup_table($events_table_name, 500); + + $aio_wp_security->include_template('wp-admin/settings/settings-file-operations.php', false, array()); + } + + /** + * Renders advanced settings tab. + * + * @return void + */ + protected function render_advanced_settings() { + if (!is_main_site()) { + return; + } + + global $aio_wp_security; + + $aios_commands = new AIOWPSecurity_Commands(); + + $advanced_settings_data = $aios_commands->get_ip_address_detection_data(); + + $aio_wp_security->include_template('wp-admin/settings/advanced-settings.php', false, $advanced_settings_data); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php new file mode 100755 index 00000000..1c13d061 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php @@ -0,0 +1,93 @@ + array( + 'title' => __('Comment spam', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_comment_spam'), + ), + 'comment-spam-ip-monitoring' => array( + 'title' => __('Comment spam IP monitoring', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_comment_spam_ip_monitoring'), + ), + ); + + $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab')); + } + + /** + * Renders the submenu's comment spam ip monitoring tab body. + * + * @return Void + */ + protected function render_comment_spam() { + global $aiowps_feature_mgr, $aio_wp_security; + $aio_wp_security->include_template('wp-admin/spam-prevention/comment-spam.php', false, array('aiowps_feature_mgr' => $aiowps_feature_mgr)); + } + + /** + * Renders the submenu's comment spam ip monitoring tab body. + * + * @return Void + */ + protected function render_comment_spam_ip_monitoring() { + global $aio_wp_security, $aiowps_feature_mgr, $wpdb; + include_once 'wp-security-list-comment-spammer-ip.php'; // For rendering the AIOWPSecurity_List_Table in tab2 + $spammer_ip_list = new AIOWPSecurity_List_Comment_Spammer_IP(); + + $block_comments_output = ''; + + $min_block_comments = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments_block'); + if (!empty($min_block_comments)) { + // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore. + $total_res = $wpdb->get_results($wpdb->prepare('SELECT * FROM '.AIOWPSEC_TBL_PERM_BLOCK.' WHERE block_reason=%s', 'spam')); + $block_comments_output = '
';
+ }
+ }
+
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $page = isset($_REQUEST['page']) ? sanitize_text_field(wp_unslash($_REQUEST['page'])) : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $tab = isset($_REQUEST['tab']) ? sanitize_text_field(wp_unslash($_REQUEST['tab'])) : '';
+
+ $aio_wp_security->include_template('wp-admin/spam-prevention/comment-spam-ip-monitoring.php', false, array('spammer_ip_list' => $spammer_ip_list, 'aiowps_feature_mgr' => $aiowps_feature_mgr, 'block_comments_output' => $block_comments_output, 'page' => $page, 'tab' => $tab));
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-tools-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-tools-menu.php
new file mode 100755
index 00000000..a41827c8
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-tools-menu.php
@@ -0,0 +1,98 @@
+ array(
+ 'title' => __('Password tool', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_password_tool'),
+ ),
+ 'whois-lookup' => array(
+ 'title' => __('WHOIS lookup', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_whois_lookup_tab'),
+ ),
+ 'custom-rules' => array(
+ 'title' => __('Custom .htaccess rules', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_custom_rules'),
+ 'display_condition_callback' => array('AIOWPSecurity_Utility', 'allow_to_write_to_htaccess'),
+ ),
+ 'visitor-lockout' => array(
+ 'title' => __('Visitor lockout', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_visitor_lockout'),
+ ),
+ );
+
+ $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab'));
+ }
+
+ /**
+ * Render the 'Custom (htaccess) rules' tab
+ *
+ * @return void
+ */
+ protected function render_custom_rules() {
+ global $aio_wp_security;
+
+ $aio_wp_security->include_template('wp-admin/tools/custom-htaccess.php');
+ }
+
+ /**
+ * Renders the submenu's password tool tab
+ *
+ * @return Void
+ */
+ protected function render_password_tool() {
+ global $aio_wp_security;
+
+ wp_enqueue_script('aiowpsec-pw-tool-js');
+ $aio_wp_security->include_template('wp-admin/tools/password-tool.php');
+ }
+
+ /**
+ * Renders the submenu's whois-lookup tab body.
+ *
+ * @return Void
+ */
+ protected function render_whois_lookup_tab() {
+ global $aio_wp_security;
+
+ $aio_wp_security->include_template('wp-admin/tools/whois-lookup.php', false, array());
+ }
+
+ /**
+ * Renders the submenu's visitor lockout tab
+ *
+ * @return void
+ */
+ protected function render_visitor_lockout() {
+ global $aio_wp_security;
+
+ $aio_wp_security->include_template('wp-admin/tools/visitor-lockout.php', false, array());
+ }
+
+} // End of class
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-user-security-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-user-security-menu.php
new file mode 100755
index 00000000..721f2a43
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-user-security-menu.php
@@ -0,0 +1,296 @@
+ array(
+ 'title' => __('User accounts', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_wp_user_account'),
+ ),
+ 'login-lockout' => array(
+ 'title' => __('Login lockout', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_login_lockout'),
+ ),
+ 'force-logout' => array(
+ 'title' => __('Force logout', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_force_logout'),
+ ),
+ 'logged-in-users' => array(
+ 'title' => __('Logged in users', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_logged_in_users'),
+ ),
+ 'manual-approval' => array(
+ 'title' => __('Manual approval', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_manual_approval'),
+ ),
+ 'salt' => array(
+ 'title' => __('Salt', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_salt_tab'),
+ 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'),
+ ),
+ 'http-authentication' => array(
+ 'title' => __('HTTP authentication', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_http_authentication'),
+ ),
+ 'hibp' => array(
+ 'title' => __('HIBP', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_hibp'),
+ 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'),
+ ),
+ 'additional' => array(
+ 'title' => __('Additional settings', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_additional'),
+ ),
+ );
+
+ $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab'));
+ }
+
+ /**
+ * Renders the submenu's WP User Account tab
+ *
+ * @return Void
+ */
+ protected function render_wp_user_account() {
+ global $aio_wp_security, $aiowps_feature_mgr;
+
+ if (is_multisite()) { // Multi-site: get admin accounts for current site
+ $blog_id = get_current_blog_id();
+ $user_accounts = $this->get_all_admin_accounts($blog_id);
+ } else {
+ $user_accounts = $this->get_all_admin_accounts();
+ }
+
+ $aio_wp_security->include_template('wp-admin/user-security/user-accounts.php', false, array('aiowps_feature_mgr' => $aiowps_feature_mgr, 'user_accounts' => $user_accounts, 'AIOWPSecurity_User_Security_Menu' => $this));
+ }
+
+
+ /**
+ * This function will retrieve all user accounts which have 'administrator' role and will return html code with results in a table
+ *
+ * @param string $blog_id - the blog we want to get the user account information from
+ *
+ * @return string - the html from the result
+ */
+ private function get_all_admin_accounts($blog_id = '') {
+ // TODO: Have included the "blog_id" variable for future use for cases where people want to search particular blog (eg, multi-site)
+ if ($blog_id) {
+ $admin_users = get_users('blog_id='.$blog_id.'&orderby=login&role=administrator');
+ } else {
+ $admin_users = get_users('orderby=login&role=administrator');
+ }
+ // now let's put the results in an HTML table
+ $account_output = "";
+ if (!empty($admin_users)) {
+ $account_output .= '+ +
+ + + ++ bootstrap, PATHINFO_BASENAME)); + ?> +
+bootstrap); ?>+ +
bootstrap->get_contents()); ?>+ + render_try_again_button(); + $this->render_manual_notice_footer(); + } + + /** + * Notice is shown if auto_prepend_file directive is already set in user.ini + * + * @param string $directive_value + * @return void + */ + private function render_userini_directive_set_notice($directive_value) { + + $firewall_file = AIOWPSecurity_Utility_Firewall::get_server_file(); + + $this->render_manual_notice_header(); + ?> +
+ +
++ +
+ ++ +
+ + + ++ +
+get_contents()); ?>+
+ +
+ render_try_again_button(); + $this->render_manual_notice_footer(); + } + + /** + * Shows when the firewall has successfully installed + * + * @return void + */ + private function render_firewall_installed_notice() { + global $aio_wp_security; + + $aio_wp_security->include_template('notices/firewall-installed-notice.php', false); + } + + /** + * Renders the 'manual setup' dashboard notice + * + * @return void + */ + private function render_manual_setup_notice() { + + $firewall_file = AIOWPSecurity_Utility_Firewall::get_server_file(); + + if (AIOWPSecurity_Utility_Firewall::MANUAL_SETUP === $firewall_file) { + //Show users how to manually add the firewall via php.ini if we can't detect their server + $bootstrap_path = AIOWPSecurity_Utility_Firewall::get_bootstrap_path(); + + $this->render_manual_notice_header(); + ?> ++ +
++ +
+ ++ +
+ render_manual_notice_footer(); + } else { + //Show users how to manually add the firewall via their own server file + $this->render_manual_notice_header(); + $firewall_file_name = pathinfo($firewall_file, PATHINFO_BASENAME); + ?> ++ +
+ +
+get_contents()); ?>+
+ +
+ render_try_again_button(); + $this->render_manual_notice_footer(); + } + } + + /** + * The header for notices that require manual intervention + * + * @return void + */ + private function render_manual_notice_header() { + ?> +
+
+
+
+ should_not_show_notice()) {
+ return;
+ }
+ ?>
+ + +
++ +
++ +
+ ++ +
+
+
+
+
+
+ is_dismissed() && !AIOWPSecurity_Utility_Firewall::is_firewall_page()) {
+ return true;
+ }
+
+ if ($this->any_pending_notices()) {
+ return true; //only display if there are no other notices waiting to be displayed
+ }
+
+ return false;
+ }
+
+ /**
+ * Renders the 'Set up now' dashboard notice
+ *
+ * @return void
+ */
+ private function render_automatic_setup_notice() {
+ global $aio_wp_security;
+
+ if ($this->should_not_show_notice()) {
+ return;
+ }
+ $aio_wp_security->include_template('notices/firewall-setup-notice.php', false, array('show_dismiss' => !AIOWPSecurity_Utility_Firewall::is_firewall_page()));
+ }
+
+ /**
+ * Ensures only one instance of the class can be created (singleton)
+ *
+ * @return AIOWPSecurity_Firewall_Setup_Notice|null
+ */
+ public static function get_instance() {
+
+ if (null === self::$instance) {
+ self::$instance = new self();
+ }
+
+ return self::$instance;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-404.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-404.php
new file mode 100755
index 00000000..2780ad93
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-404.php
@@ -0,0 +1,362 @@
+ 'item', //singular name of the listed records
+ 'plural' => 'items', //plural name of the listed records
+ 'ajax' => false //does this table support ajax?
+ ));
+ }
+
+ /**
+ * Returns created column in datetime format as per user setting time zone.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the datetime
+ */
+ public function column_created($item) {
+ return AIOWPSecurity_Utility::convert_timestamp($item['created']);
+ }
+
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Returns id column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - html string for column rendered
+ */
+ public function column_id($item) {
+ $ip = $item['ip_or_host'];
+
+ $is_locked = AIOWPSecurity_Utility::check_locked_ip($ip, '404');
+ $blacklist_tab = 'blacklist';
+ $is_blacklist = AIOWPSecurity_Utility::check_blacklist_ip($ip);
+ $actions = array();
+ $actions['delete'] = '' . __('Delete', 'all-in-one-wp-security-and-firewall') . '';
+
+ if ($is_locked) {
+ // Build row actions for locked items
+ $actions['unblock'] = '' . __('Unblock', 'all-in-one-wp-security-and-firewall') . '';
+ } elseif ($is_blacklist) {
+ $unblock_url_nonce = wp_nonce_url(sprintf('admin.php?page=%s&tab=%s', AIOWPSEC_FIREWALL_MENU_SLUG, $blacklist_tab), "404_log_item_action", "aiowps_nonce");
+ $actions = array(
+ 'unblock' => ''.__('Unblock', 'all-in-one-wp-security-and-firewall').'',
+ );
+ } else {
+ // Build row actions for other items
+ $actions['temp_block'] = '' . __('Temporarily block', 'all-in-one-wp-security-and-firewall') . '';
+ $actions['blacklist_ip'] = '' . __('Blacklist IP', 'all-in-one-wp-security-and-firewall') . '';
+ }
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /* $1%s */ $item['id'],
+ /* $2%s */ $this->row_actions($actions)
+ );
+ }
+
+ /**
+ * Returns status column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - html string for column rendered
+ */
+ public function column_status($item) {
+ global $aio_wp_security;
+ $ip = $item['ip_or_host'];
+ //Check if this IP address is locked
+ $is_locked = AIOWPSecurity_Utility::check_locked_ip($ip, '404');
+ $blacklisted_string = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses');
+ $banned = strpos($blacklisted_string, $ip);
+
+ if (false !== $banned) {
+ return 'blacklisted';
+ } elseif ($is_locked) {
+ return 'temporarily blocked';
+ } else {
+ return '';
+ }
+ }
+
+ /**
+ * Returns checkbox column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - html string for column rendered
+ */
+ public function column_cb($item) {
+ return sprintf('',
+ /* $1%s */ $this->_args['singular'], //Let's simply repurpose the table's singular label
+ /* $2%s */ $item['id'] //The value of the checkbox should be the record's id
+ );
+ }
+
+ public function get_columns() {
+ $columns = array(
+ 'cb' => '', //Render a checkbox
+ 'id' => 'ID',
+ 'event_type' => __('Event type', 'all-in-one-wp-security-and-firewall'),
+ 'ip_or_host' => __('IP address', 'all-in-one-wp-security-and-firewall'),
+ 'url' => __('Attempted URL', 'all-in-one-wp-security-and-firewall'),
+ 'referer_info' => __('Referer', 'all-in-one-wp-security-and-firewall'),
+ 'created' => __('Date and time', 'all-in-one-wp-security-and-firewall'),
+ 'status' => __('Lock status', 'all-in-one-wp-security-and-firewall'),
+ );
+ $columns = apply_filters('list_404_get_columns', $columns);
+ return $columns;
+ }
+
+ public function get_sortable_columns() {
+ $sortable_columns = array(
+ 'id' => array('id', false),
+ 'event_type' => array('event_type', false),
+ 'ip_or_host' => array('ip_or_host', false),
+ 'url' => array('url', false),
+ 'referer_info' => array('referer_info', false),
+ 'created' => array('created', false),
+ );
+ $sortable_columns = apply_filters('list_404_get_sortable_columns', $sortable_columns);
+ return $sortable_columns;
+ }
+
+ /**
+ * Get bulk actions for the current WordPress screen.
+ *
+ * @return array An associative array of bulk actions where the keys are action names
+ * and the values are the corresponding action labels.
+ */
+ public function get_bulk_actions() {
+ return array(
+ //'unlock' => 'Unlock',
+ 'bulk_block_ip' => __('Temporarily block IP', 'all-in-one-wp-security-and-firewall'),
+ 'bulk_blacklist_ip' => __('Blacklist IP', 'all-in-one-wp-security-and-firewall'),
+ 'delete' => __('Delete', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+
+ /**
+ * Process bulk actions for the current WordPress screen.
+ *
+ * This method checks for the presence of a valid nonce and user capabilities,
+ * then performs the appropriate action based on the selected bulk action.
+ *
+ * @return void
+ */
+ private function process_bulk_action() {
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- PCP warning. This is the nonce.
+ if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return;
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning. Ignore.
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($_REQUEST['_wpnonce'], 'bulk-items');
+ if (is_wp_error($result)) return;
+
+ if ('bulk_block_ip' === $this->current_action()) {//Process delete bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning, ignore. Sanitized later.
+ $this->block_ip(wp_unslash($_REQUEST['item']));
+ }
+ }
+
+ if ('bulk_blacklist_ip' === $this->current_action()) {//Process delete bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning, ignore. Sanitized later.
+ $this->blacklist_ip_address(wp_unslash($_REQUEST['item']));
+ }
+ }
+ if ('delete' === $this->current_action()) {//Process delete bulk actions
+ if (!isset($_REQUEST['item'])) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- PCP warning, ignore. Sanitized later.
+ $this->delete_404_event_records(wp_unslash($_REQUEST['item']));
+ }
+ }
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended -- PCP warning. This is the nonce.
+ }
+
+ /**
+ * Locks an IP address by adding it to the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @param array|string $entries - ids that correspond to ip addresses in the AIOWPSEC_TBL_EVENTS table or a single ip address
+ * @param string $username - (optional)username of user being locked
+ *
+ * @return boolean|void
+ */
+ public function block_ip($entries, $username = '') {
+ global $wpdb;
+ if (is_array($entries)) {
+ //lock multiple records
+ $entries = array_filter($entries, 'is_numeric'); //discard non-numeric ID values
+ $id_list = "(" .implode(",", $entries) .")"; //Create comma separate list for DB operation
+ $events_table = AIOWPSEC_TBL_EVENTS;
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $results = $wpdb->get_col("SELECT ip_or_host FROM $events_table WHERE ID IN " . $id_list);
+ if (empty($results)) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Could not process the request because the IP addresses for the selected entries could not be found.', 'all-in-one-wp-security-and-firewall'));
+ return false;
+ } else {
+ foreach ($results as $entry) {
+ if (filter_var($entry, FILTER_VALIDATE_IP)) {
+ AIOWPSecurity_Utility::lock_IP($entry, '404', $username);
+ }
+ }
+ }
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected IP addresses are now temporarily blocked.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Permanently blocks an IP address by adding it to the blacklist and writing rules to the htaccess file.
+ *
+ * @param array|string $entries - ids that correspond to ip addresses in the AIOWPSEC_TBL_EVENTS table or a single ip address
+ *
+ * @return boolean|void
+ */
+ public function blacklist_ip_address($entries) {
+ global $wpdb, $aio_wp_security;
+ $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG);
+ $bl_ip_addresses = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'); //get the currently saved blacklisted IPs
+ $ip_list_array = AIOWPSecurity_Utility_IP::create_ip_list_array_from_string_with_newline($bl_ip_addresses);
+
+ if (is_array($entries)) {
+ //Get the selected IP addresses
+ $entries = array_filter($entries, 'is_numeric'); //discard non-numeric ID values
+ $id_list = "(" .implode(",", $entries) .")"; //Create comma separate list for DB operation
+ $events_table = AIOWPSEC_TBL_EVENTS;
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $results = $wpdb->get_col("SELECT ip_or_host FROM $events_table WHERE ID IN " . $id_list);
+ if (empty($results)) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Could not process the request because the IP addresses for the selected entries could not be found.', 'all-in-one-wp-security-and-firewall'));
+ return false;
+ } else {
+ foreach ($results as $entry) {
+ $ip_list_array[] = $entry;
+ }
+ }
+ }
+
+ $validated_ip_list_array = AIOWPSecurity_Utility_IP::validate_ip_list($ip_list_array, 'blacklist');
+ if (is_wp_error($validated_ip_list_array)) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(nl2br($validated_ip_list_array->get_error_message()));
+ } else {
+ $banned_ip_data = implode("\n", $validated_ip_list_array);
+ $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', '1'); // Force blacklist feature to be enabled.
+ $aio_wp_security->configs->set_value('aiowps_banned_ip_addresses', $banned_ip_data);
+ $aio_wp_security->configs->save_config();
+
+ $aiowps_firewall_config->set_value('aiowps_blacklist_ips', $validated_ip_list_array);
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected IP addresses have been added to the blacklist and will be permanently blocked.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Deletes one or more records from the AIOWPSEC_TBL_EVENTS table.
+ *
+ * @param array|string|integer $entries - ids or a single id
+ *
+ * @return void|string
+ */
+ public function delete_404_event_records($entries) {
+ global $wpdb, $aio_wp_security;
+ $events_table = AIOWPSEC_TBL_EVENTS;
+ if (is_array($entries)) {
+ //Delete multiple records
+ $entries = array_map('esc_sql', $entries); //escape every array element
+ $entries = array_filter($entries, 'is_numeric'); //discard non-numeric ID values
+ $id_list = "(" . implode(",", $entries) . ")"; //Create comma separate list for DB operation
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query("DELETE FROM " . $events_table . " WHERE id IN " . $id_list);
+ if ($result) {
+ AIOWPSecurity_Admin_Menu::show_msg_record_deleted_st();
+ } else {
+ // Error on bulk delete
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from Events table. Database error: '.$wpdb->last_error, 4);
+ AIOWPSecurity_Admin_Menu::show_msg_record_not_deleted_st();
+ }
+ }
+ }
+
+ /**
+ * Retrieves all items from AIOWPSEC_TBL_EVENTS according to a search term inside $_REQUEST['s'] and only '404' events if there is no search term. It then assigns to $this->items.
+ *
+ * @param Boolean $ignore_pagination - whether to not paginate
+ *
+ * @return Void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ /**
+ * First, lets decide how many records per page to show
+ */
+ $per_page = 100;
+ $columns = $this->get_columns();
+ $hidden = array();
+ $sortable = $this->get_sortable_columns();
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. Nonce checked in previous function.
+ $search_term = isset($_REQUEST['s']) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : '';
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ $this->process_bulk_action();
+
+ global $wpdb;
+ $events_table_name = AIOWPSEC_TBL_EVENTS;
+
+ // Ordering parameters
+ // Parameters that are going to be used to order the result
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $orderby = isset($_GET['orderby']) ? sanitize_text_field(wp_unslash($_GET['orderby'])) : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $order = isset($_GET['order']) ? sanitize_text_field(wp_unslash($_GET['order'])) : '';
+
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'id';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ if (empty($search_term)) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM $events_table_name WHERE `event_type` = '404' ORDER BY $orderby $order", ARRAY_A);
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQueryWithPlaceholder, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $data = $wpdb->get_results($wpdb->prepare("SELECT * FROM $events_table_name WHERE `ip_or_host` LIKE '%%%s%%' OR `url` LIKE '%%%s%%' OR `referer_info` LIKE '%%%s%%' ORDER BY $orderby $order", $wpdb->esc_like($search_term), $wpdb->esc_like($search_term), $wpdb->esc_like($search_term)), ARRAY_A);
+ }
+
+ if (!$ignore_pagination) {
+ $current_page = $this->get_pagenum();
+ $total_items = count($data);
+ $data = array_slice($data, (($current_page - 1) * $per_page), $per_page);
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, //WE have to calculate the total number of items
+ 'per_page' => $per_page, //WE have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) //WE have to calculate the total number of pages
+ ));
+ }
+
+ foreach ($data as $index => $row) {
+ // Insert an empty status column - we will use later
+ $data[$index]['status'] = '';
+ }
+
+ $this->items = $data;
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-audit.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-audit.php
new file mode 100755
index 00000000..4c5c1702
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-audit.php
@@ -0,0 +1,527 @@
+ 'item', // singular name of the listed records
+ 'plural' => 'items', // plural name of the listed records
+ 'ajax' => true, // does this table support ajax?
+ 'data' => $data // Request data
+ ));
+
+ }
+
+ /**
+ * Returns the default column item
+ *
+ * @param object $item - item from which column data is returned
+ * @param string $column_name - column name to be fetched from item
+ * @return string
+ */
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ /**
+ * Returns cb column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_cb($item) {
+ return sprintf(
+ '',
+ /* $1%s */ $this->_args['singular'], // Let's simply repurpose the table's singular label
+ /* $2%s */ $item['id'] // The value of the checkbox should be the record's id
+ );
+ }
+
+ /**
+ * Returns created column html to be rendered.
+ *
+ * @param array $item Data for the columns on the current row.
+ *
+ * @return string The html to be rendered.
+ */
+ public function column_created($item) {
+ $actions = array(
+ 'delete' => '' . esc_html__('Delete', 'all-in-one-wp-security-and-firewall') . ''
+ );
+
+ return AIOWPSecurity_Utility::convert_timestamp($item['created']) . '' . $this->row_actions($actions);
+ }
+
+ /**
+ * Returns ip column html to be rendered.
+ *
+ * @param array $item Data for the columns on the current row.
+ *
+ * @return string The html to be rendered.
+ */
+ public function column_ip($item) {
+ $ip = $item['ip'];
+
+ $unblacklist_ip_warning_translation = __('Are you sure you want to unblacklist this IP address?', 'all-in-one-wp-security-and-firewall');
+ $unlock_ip_warning_translation = __('Are you sure you want to unlock this IP address?', 'all-in-one-wp-security-and-firewall');
+ $lock_ip_warning_translation = __('Are you sure you want to temporarily lock this IP address?', 'all-in-one-wp-security-and-firewall');
+ $blacklist_ip_warning_translation = __('Are you sure you want to blacklist this IP address?', 'all-in-one-wp-security-and-firewall');
+
+ // Build row actions.
+ if (AIOWPSecurity_Utility_Permissions::is_main_site_and_super_admin() && AIOWPSecurity_Utility::check_blacklist_ip($ip)) {
+ $actions = array(
+ 'unblacklist' => '' . esc_html__('Unblacklist', 'all-in-one-wp-security-and-firewall') . '',
+ );
+ } elseif (AIOWPSecurity_Utility::check_locked_ip($ip, 'audit-log')) {
+ $actions = array(
+ 'unlock' => '' . esc_html__('Unlock', 'all-in-one-wp-security-and-firewall') . '',
+ );
+ } else {
+ $actions = array(
+ 'lock_ip' => '' . esc_html__('Lock IP', 'all-in-one-wp-security-and-firewall') . '',
+ );
+
+ if (AIOWPSecurity_Utility_Permissions::is_main_site_and_super_admin()) {
+ $actions['blacklist_ip'] = '' . esc_html__('Blacklist IP', 'all-in-one-wp-security-and-firewall') . '';
+ }
+ }
+
+ return $ip . '' . $this->row_actions($actions);
+ }
+
+ /**
+ * Returns event type column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_event_type($item) {
+ if (empty($item['event_type'])) return __('No event type available.', 'all-in-one-wp-security-and-firewall');
+
+ $output = isset(AIOWPSecurity_Audit_Events::$event_types[$item['event_type']]) ? AIOWPSecurity_Audit_Events::$event_types[$item['event_type']] : $item['event_type'];
+
+ return $output;
+ }
+
+ /**
+ * Returns details column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_details($item) {
+ $details = json_decode($item['details'], true);
+
+ if (!is_array($details)) return $item['details'];
+
+ $key = array_keys($details)[0];
+
+ if (method_exists("AIOWPSecurity_Audit_Text_Handler", "{$key}_to_text")) {
+ return call_user_func("AIOWPSecurity_Audit_Text_Handler::{$key}_to_text", $details[$key]);
+ }
+
+ return $item['details'];
+ }
+
+ /**
+ * Returns stack trace column html to be rendered.
+ *
+ * @param array $item - data for the columns on the current row
+ *
+ * @return string - the html to be rendered
+ */
+ public function column_stacktrace($item) {
+ if (empty($item['stacktrace'])) return __('No stack trace available.', 'all-in-one-wp-security-and-firewall');
+
+ if (is_serialized($item['stacktrace'])) {
+ $stacktrace = AIOWPSecurity_Utility::unserialize($item['stacktrace']);
+ } else {
+ $stacktrace = $item['stacktrace'];
+ }
+ ob_start();
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_var_dump -- Part of error reporting system.
+ var_dump($stacktrace);
+ $stacktrace_output = ob_get_contents();
+ ob_end_clean();
+
+ $output = sprintf('%s', $item['id'], esc_html__('Stack trace', 'all-in-one-wp-security-and-firewall'), esc_html__('Show trace', 'all-in-one-wp-security-and-firewall'));
+ $output .= sprintf('', $item['id'], htmlspecialchars($stacktrace_output));
+
+ return $output;
+ }
+
+ /**
+ * Sets the columns for the table
+ *
+ * @return array
+ */
+ public function get_columns() {
+ $columns = array(
+ 'cb' => '', //Render a checkbox
+ 'created' => __('Date and time', 'all-in-one-wp-security-and-firewall'),
+ 'level' => __('Level', 'all-in-one-wp-security-and-firewall'),
+ 'network_id' => __('Network ID', 'all-in-one-wp-security-and-firewall'),
+ 'site_id' => __('Site ID', 'all-in-one-wp-security-and-firewall'),
+ 'username' => __('Username', 'all-in-one-wp-security-and-firewall'),
+ 'ip' => __('IP', 'all-in-one-wp-security-and-firewall'),
+ 'event_type' => __('Event', 'all-in-one-wp-security-and-firewall'),
+ 'details' => __('Details', 'all-in-one-wp-security-and-firewall'),
+ 'stacktrace' => __('Stack trace', 'all-in-one-wp-security-and-firewall')
+ );
+ $columns = apply_filters('list_auditlogs_get_columns', $columns);
+ return $columns;
+ }
+
+ /**
+ * Sets which of the columns the table data can be sorted by
+ *
+ * @return array
+ */
+ public function get_sortable_columns() {
+ $sortable_columns = array(
+ 'created' => array('created', false),
+ 'network_id' => array('network_id', false),
+ 'site_id' => array('site_id', false),
+ 'level' => array('level', false),
+ 'username' => array('username', false),
+ 'ip' => array('ip', false),
+ 'event_type' => array('event_type', false),
+ 'details' => array('details', false),
+ 'stacktrace' => array('stacktrace', false)
+ );
+ $sortable_columns = apply_filters('list_auditlogs_get_sortable_columns', $sortable_columns);
+ return $sortable_columns;
+ }
+
+ /**
+ * This function will display a list of bulk actions for the list table
+ *
+ * @return array
+ */
+ public function get_bulk_actions() {
+ $actions = array(
+ 'delete_all' => __('Delete all', 'all-in-one-wp-security-and-firewall'),
+ 'delete_selected' => __('Delete selected', 'all-in-one-wp-security-and-firewall'),
+ 'delete_filtered' => __('Delete filtered', 'all-in-one-wp-security-and-firewall')
+ );
+ return $actions;
+ }
+
+ /**
+ * This function will process the bulk action request, $search_term and $filters are only used if the user is trying to bulk delete the filtered items
+ *
+ * @param string $search_term - The search term used for filtering records.
+ * @param array $filters - An array containing filters applied to the records.
+ * @param string $action - The bulk action to be performed.
+ * @param array $items - An array of record IDs on which the action will be performed. Default is an empty array.
+ *
+ * @return void
+ */
+ private function process_bulk_action($search_term, $filters, $action, $items = array()) {
+ global $wpdb;
+
+ if ('delete_selected' === $action) { // Process delete bulk actions
+ if (!isset($items)) {
+ AIOS_Helper::set_message('aios_list_message', __('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'), 'error');
+ } else {
+ $this->delete_audit_event_records($items);
+ }
+ } elseif ('delete_filtered' === $action) {
+ if (!empty($filters) || '' !== $search_term) {
+ $audit_log_tbl = AIOWPSEC_TBL_AUDIT_LOG;
+ $where_sql = $this->get_audit_list_where_sql($search_term, $filters);
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $results = $wpdb->get_results("SELECT id FROM {$audit_log_tbl} {$where_sql}", 'ARRAY_A');
+ $items = array_column($results, 'id');
+ $this->delete_audit_event_records($items);
+ } else {
+ AIOS_Helper::set_message('aios_list_message', __('Please select the level or the event type filter or filter by a search term', 'all-in-one-wp-security-and-firewall'), 'error');
+ }
+ } elseif ('delete_all' === $action) {
+ $this->delete_audit_event_records(null, true);
+ }
+ }
+
+ /**
+ * Outputs extra controls to be displayed between bulk actions and pagination
+ *
+ * @param string $which - where we are outputting content (top or bottom)
+ *
+ * @return void
+ */
+ protected function extra_tablenav($which) {
+ switch ($which) {
+ case 'top':
+ ?>
+
+
+
+
+
+ query($delete_command);
+ } elseif (is_array($entries)) {
+ // Delete multiple records
+ $entries = array_map('esc_sql', $entries); // Escape every array element
+ $entries = array_filter($entries, 'is_numeric'); // Discard non-numeric ID values
+ $chunks = array_chunk($entries, 1000);
+
+ $site_id_where_sql = (!is_super_admin()) ? ' AND site_id = ' . get_current_blog_id() : '';
+
+ // Processing each chunk
+ foreach ($chunks as $chunk) {
+ $id_list = "(" . implode(",", $chunk) . ")"; // Create comma separate list for DB operation
+ $delete_command = "DELETE FROM " . $audit_log_tbl . " WHERE id IN " . $id_list . $site_id_where_sql;
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query($delete_command);
+ if (!$result) {
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from Audit log table. Database error: '.$wpdb->last_error, 4);
+ AIOS_Helper::set_message('aios_list_message', __('The selected record(s) have failed to delete.', 'all-in-one-wp-security-and-firewall'), 'error');
+ return;
+ }
+ }
+ } elseif (!empty($entries)) {
+ // Delete single record
+ $site_id_where_sql = (!is_super_admin()) ? ' AND site_id = ' . get_current_blog_id() : '';
+ $delete_command = "DELETE FROM " . $audit_log_tbl . " WHERE id = '" . absint($entries) . "'" . $site_id_where_sql;
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $result = $wpdb->query($delete_command);
+ }
+
+ if ($result || 0 < $result) {
+ $aios_list_message = __('The selected record(s) has been deleted successfully.', 'all-in-one-wp-security-and-firewall');
+ AIOS_Helper::set_message('aios_list_message', $aios_list_message);
+ } else {
+ $aios_list_message = __('The selected record(s) have failed to delete.', 'all-in-one-wp-security-and-firewall');
+ $aio_wp_security->debug_logger->log_debug('Database error occurred when deleting rows from Audit log table. Database error: '.$wpdb->last_error, 4);
+ AIOS_Helper::set_message('aios_list_message', $aios_list_message, 'error');
+ }
+
+ return $aios_list_message;
+ }
+
+ /**
+ * This function will build and return the SQL WHERE statement
+ *
+ * @param string $search_term - the search term applied
+ * @param array $filters - the filters applied
+ *
+ * @return string - the SQL WHERE statement
+ */
+ private function get_audit_list_where_sql($search_term, $filters) {
+
+ $where_sql = '';
+
+ if ('' == $search_term) {
+ $where_sql = (!is_super_admin()) ? 'WHERE site_id = '.get_current_blog_id() : '';
+ $extra_where = '';
+
+ if (!empty($filters)) {
+ $where_sql = empty($where_sql) ? 'WHERE ' : $where_sql . ' AND ';
+ foreach ($filters as $filter => $value) {
+ if (!empty($extra_where)) $extra_where .= ' AND ';
+ $extra_where .= "`{$filter}` = '".esc_sql($value)."'";
+ }
+ }
+
+ $where_sql .= $extra_where;
+ } else {
+ $where_sql = (!is_super_admin()) ? 'WHERE site_id = '.get_current_blog_id().' AND ' : 'WHERE ';
+ $extra_where = '';
+
+ if (!empty($filters)) {
+ foreach ($filters as $filter => $value) {
+ if (!empty($extra_where)) $extra_where .= ' AND ';
+ $extra_where .= "`{$filter}` = '".esc_sql($value)."'";
+ }
+ $where_sql .= $extra_where . ' AND (';
+ $extra_where = '';
+ }
+
+ // We don't use FILTER_VALIDATE_IP here as we want to be able to search for partial IP's
+ if (preg_match('/^[0-9a-f:\.]+$/i', $search_term)) {
+ $extra_where .= "`ip` LIKE '".esc_sql($search_term)."%'";
+ }
+
+ if (in_array($search_term, AIOWPSecurity_Audit_Events::$log_levels) && !isset($filters['level'])) {
+ if (!empty($extra_where)) $extra_where .= ' OR ';
+ $extra_where .= "`level` = '".esc_sql($search_term)."'";
+ }
+
+ if (!empty($extra_where)) $extra_where .= ' OR ';
+ if (isset($filters['event_type'])) {
+ $extra_where .= "`username` LIKE '".esc_sql($search_term)."%'";
+ } else {
+ $extra_where .= "(`username` LIKE '".esc_sql($search_term)."%' or `event_type` LIKE '%".esc_sql($search_term)."%')";
+ }
+ if (!empty($filters)) $extra_where .= ')';
+
+ $where_sql .= $extra_where;
+ }
+
+ return $where_sql;
+ }
+
+ /**
+ * Grabs the data from database and handles the pagination
+ *
+ * @param boolean $ignore_pagination - whether to not paginate
+ *
+ * @return void
+ */
+ public function prepare_items($ignore_pagination = false) {
+ /**
+ * First, lets decide how many records per page to show
+ */
+ $no_action = -1;
+ $per_page = defined('AIOWPSEC_AUDIT_LOG_PER_PAGE') ? absint(AIOWPSEC_AUDIT_LOG_PER_PAGE) : 100;
+ $per_page = empty($per_page) ? 100 : $per_page;
+ $current_page = $this->get_pagenum();
+ $offset = (!$ignore_pagination && $per_page > 0) ? ($current_page - 1) * $per_page : 0;
+ $columns = $this->get_columns();
+ $hidden = array('id'); // we really don't need the IDs of the log entries displayed
+ if (!is_multisite()) {
+ $hidden[] = 'network_id';
+ $hidden[] = 'site_id';
+ }
+ $sortable = $this->get_sortable_columns();
+ $filters = array();
+ if (isset($this->_args['data']['level-filter']) && $no_action != $this->_args['data']['level-filter']) $filters['level'] = sanitize_text_field($this->_args['data']['level-filter']);
+ if (isset($this->_args['data']['event-filter']) && $no_action != $this->_args['data']['event-filter']) $filters['event_type'] = sanitize_text_field($this->_args['data']['event-filter']);
+ $search_term = isset($this->_args['data']['s']) ? sanitize_text_field(stripslashes($this->_args['data']['s'])) : '';
+
+ $this->_column_headers = array($columns, $hidden, $sortable);
+
+ $items = array();
+
+ if (isset($this->_args['data']['items'])) {
+ if (is_array($this->_args['data']['items'])) {
+ foreach ($this->_args['data']['items'] as $item) {
+ $sanitized_item = sanitize_text_field($item);
+ $items[] = $sanitized_item;
+ }
+ } else {
+ $sanitized_item = sanitize_text_field($this->_args['data']['items']);
+ $items[] = $sanitized_item;
+ }
+ } else {
+ $items = null;
+ }
+
+ if (isset($this->_args['data']['action'])) $action = sanitize_text_field($this->_args['data']['action']);
+ else $action = $no_action;
+
+ if (isset($action) && $no_action !== $action) {
+ $this->process_bulk_action($search_term, $filters, $action, $items);
+ }
+
+ global $wpdb;
+
+ $audit_log_tbl = AIOWPSEC_TBL_AUDIT_LOG;
+
+ // Parameters that are going to be used to order the result
+ isset($this->_args['data']["orderby"]) ? $orderby = wp_strip_all_tags($this->_args['data']["orderby"]) : $orderby = '';
+ isset($this->_args['data']["order"]) ? $order = wp_strip_all_tags($this->_args['data']["order"]) : $order = '';
+ // By default show the most recent audit log entries.
+ $orderby = !empty($orderby) ? esc_sql($orderby) : 'created';
+ $order = !empty($order) ? esc_sql($order) : 'DESC';
+
+ $orderby = AIOWPSecurity_Utility::sanitize_value_by_array($orderby, $sortable);
+ $order = AIOWPSecurity_Utility::sanitize_value_by_array($order, array('DESC' => '1', 'ASC' => '1'));
+
+ $orderby = sanitize_sql_orderby($orderby);
+ $order = sanitize_sql_orderby($order);
+
+ $where_sql = $this->get_audit_list_where_sql($search_term, $filters);
+
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $total_items = $wpdb->get_var("SELECT COUNT(*) FROM {$audit_log_tbl} {$where_sql}");
+ if ($ignore_pagination) {
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$audit_log_tbl} {$where_sql} ORDER BY {$orderby} {$order}", 'ARRAY_A');
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore.
+ $data = $wpdb->get_results("SELECT * FROM {$audit_log_tbl} {$where_sql} ORDER BY {$orderby} {$order} LIMIT {$per_page} OFFSET {$offset}", 'ARRAY_A');
+ }
+
+ // Filter the 'details' section
+ foreach ($data as $key => $entry) {
+ $details = json_decode($entry['details'], true);
+ $details = is_null($details) ? $entry['details'] : $details; // check if the decode worked, if not pass the json string
+ $data[$key]['details'] = wp_json_encode(apply_filters('aios_audit_filter_details', $details, $entry['event_type']));
+ }
+
+ $this->items = $data;
+
+ if ($ignore_pagination) return;
+
+ $this->set_pagination_args(array(
+ 'total_items' => $total_items, // We have to calculate the total number of items
+ 'per_page' => $per_page, // We have to determine how many items to show on a page
+ 'total_pages' => ceil($total_items / $per_page) // We have to calculate the total number of pages
+ ));
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-comment-spammer-ip.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-comment-spammer-ip.php
new file mode 100755
index 00000000..1c48ccc9
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-list-comment-spammer-ip.php
@@ -0,0 +1,221 @@
+ 'item', // singular name of the listed records
+ 'plural' => 'items', // plural name of the listed records
+ 'ajax' => false // does this table support ajax?
+ ));
+
+ }
+
+ public function column_default($item, $column_name) {
+ return $item[$column_name];
+ }
+
+ public function column_comment_author_IP($item) {
+ //Build row actions
+ if (!is_main_site() || 'blocked' === $item['status']) {
+ //Suppress the block link if site is a multi site AND not the main site or the status is blocked
+ $actions = array(); //blank array
+ } else {
+ //Add IP to block URL
+ $ip = $item['comment_author_IP'];
+ $actions = array(
+ 'block' => ''.__('Block', 'all-in-one-wp-security-and-firewall').'',
+ );
+ }
+
+ //Return the user_login contents
+ return sprintf('%1$s %2$s',
+ /*$1%s*/ $item['comment_author_IP'],
+ /*$2%s*/ $this->row_actions($actions)
+ );
+ }
+
+
+ public function column_cb($item) {
+ return sprintf(
+ '',
+ /*$1%s*/ $this->_args['singular'], //Let's simply repurpose the table's singular label
+ /*$2%s*/ esc_attr($item['comment_author_IP']) //The value of the checkbox should be the record's id
+ );
+ }
+
+ public function get_columns() {
+ $columns = array(
+ 'cb' => '', //Render a checkbox
+ 'comment_author_IP' => __('Spammer IP', 'all-in-one-wp-security-and-firewall'),
+ 'amount' => __('Number of spam comments from this IP', 'all-in-one-wp-security-and-firewall'),
+ 'status' => __('Status', 'all-in-one-wp-security-and-firewall'),
+ );
+ return $columns;
+ }
+
+ public function get_sortable_columns() {
+ $sortable_columns = array(
+ 'comment_author_IP' => array('comment_author_IP',false),
+ 'amount' => array('amount',false),
+ 'status' => array('status',false),
+ );
+ return $sortable_columns;
+ }
+
+ public function get_bulk_actions() {
+ if (!is_main_site()) {
+ //Suppress the block link if site is a multi site AND not the main site
+ $actions = array(); //blank array
+ } else {
+ $actions = array(
+ 'block' => __('Block', 'all-in-one-wp-security-and-firewall')
+ );
+ }
+ return $actions;
+ }
+
+ /**
+ * This function handles bulk actions on the table
+ *
+ * @return void
+ */
+ private function process_bulk_action() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This IS the nonce check.
+ if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return;
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput -- This IS the nonce check.
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($_REQUEST['_wpnonce'], 'bulk-items');
+ if (is_wp_error($result)) return;
+
+
+ if ('block' === $this->current_action()) {
+ //Process block bulk actions
+ if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce already checked above.
+ $error_msg = ''; + $error_msg .= esc_html__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall'); + $error_msg .= '
'.__('blocked', 'all-in-one-wp-security-and-firewall').''; + } else { + return $item['ip_address']; + } + } + + public function column_cb($item) { + return sprintf( + '', + /*$1%s*/ $this->_args['singular'], //Let's simply repurpose the table's singular label + /*$2%s*/ $item['ID'] //The value of the checkbox should be the record's id + ); + } + + + /** + * Returns array of columns to be rendered. + * + * @return array + */ + public function get_columns() { + $columns = array( + 'cb' => '', // Render a checkbox + 'ID' => __('User ID', 'all-in-one-wp-security-and-firewall'), + 'user_login' => __('Login name', 'all-in-one-wp-security-and-firewall'), + 'user_email' => __('Email', 'all-in-one-wp-security-and-firewall'), + 'user_registered' => __('Register date', 'all-in-one-wp-security-and-firewall'), + 'account_status' => __('Account status', 'all-in-one-wp-security-and-firewall'), + 'ip_address' => __('IP address', 'all-in-one-wp-security-and-firewall') + ); + return $columns; + } + + public function get_sortable_columns() { + $sortable_columns = array( + // 'ID' => array('ID',false), + // 'user_login' => array('user_login',false), + // 'user_email' => array('user_email',false), + // 'user_registered' => array('user_registered',false), + // 'account_status' => array('account_status',false), + ); + return $sortable_columns; + } + + public function get_bulk_actions() { + $actions = array( + 'approve' => __('Approve', 'all-in-one-wp-security-and-firewall'), + 'delete' => __('Delete', 'all-in-one-wp-security-and-firewall'), + 'block' => __('Block IP', 'all-in-one-wp-security-and-firewall') + ); + return $actions; + } + + /** + * Process bulk actions. + * + * @return void + */ + private function process_bulk_action() { + if (empty($_REQUEST['_wpnonce']) || !isset($_REQUEST['_wp_http_referer'])) return; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap(sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])), 'bulk-items'); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + if (is_wp_error($result)) return; + + if ('approve' == $this->current_action()) { //Process approve bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->approve_selected_accounts(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + if ('delete' == $this->current_action()) { //Process delete bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->delete_selected_accounts(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + if ('block' == $this->current_action()) { //Process block bulk actions + if (!isset($_REQUEST['item'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Please select some records using the checkboxes', 'all-in-one-wp-security-and-firewall')); + } else { + $this->block_selected_ips(array_map('sanitize_text_field', wp_unslash($_REQUEST['item']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + } + } + + } + + /** + * This function approves selected user accounts + * + * @param array|int $entries - this is an array of users or user_id to be approved + * + * @return void|string + */ + public function approve_selected_accounts($entries) { + global $aio_wp_security; + $meta_key = 'aiowps_account_status'; + $meta_value = 'approved'; // set account status + $failed_accts = ''; // string to store comma separated accounts which failed to update + $at_least_one_updated = false; + if (is_array($entries)) { + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and approve + foreach ($entries as $user_id) { + $result = update_user_meta($user_id, $meta_key, $meta_value); + if (false === $result) { + $failed_accts .= ' '.$user_id.', '; + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::approve_selected_accounts() - could not approve account ID: $user_id", 4); + } else { + $at_least_one_updated = true; + $user = get_user_by('id', $user_id); + if (false === $user) { + //don't send mail + } else { + $this->send_email_upon_account_activation($user); + } + } + } + if ($at_least_one_updated) { + AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected accounts were approved successfully.', 'all-in-one-wp-security-and-firewall')); + } + if ('' != $failed_accts) { + //display any failed account updates + rtrim($failed_accts); + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('The following accounts failed to update successfully:', 'all-in-one-wp-security-and-firewall') . ' ' . $failed_accts); + } + } + } + + /** + * This function sends an email to an approved user + * + * @param WP_User $user - the object for the approved user + * + * @return bool + */ + public function send_email_upon_account_activation($user) { + global $aio_wp_security; + if (!($user instanceof WP_User)) { + return false; + } + + $to_email_address = $user->user_email; + $email_msg = ''; + $subject = '['.network_site_url().'] '. __('Your account is now active', 'all-in-one-wp-security-and-firewall'); + /* translators: %s: Username */ + $email_msg .= sprintf(__('Your account with username: %s is now active', 'all-in-one-wp-security-and-firewall'), $user->user_login) . "\n"; + $subject = apply_filters('aiowps_register_approval_email_subject', $subject); + $email_msg = apply_filters('aiowps_register_approval_email_msg', $email_msg, $user); //also pass the WP_User object + + $sendMail = wp_mail($to_email_address, $subject, $email_msg); + if (false === $sendMail) { + $aio_wp_security->debug_logger->log_debug("Manual account approval notification email failed to send to " . $to_email_address, 4); + } + return $sendMail; + } + + /** + * This function deletes selected entries pending approval + * + * @param array|int $entries - this is an array of users or single user to be deleted + * + * @return void|string + */ + public function delete_selected_accounts($entries) { + global $aio_wp_security; + if (is_array($entries)) { + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and delete account + foreach ($entries as $user_id) { + $result = wp_delete_user($user_id); + if (true !== $result) { + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::delete_selected_accounts() - could not delete account ID: $user_id", 4); + } + } + AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The selected accounts were deleted successfully.', 'all-in-one-wp-security-and-firewall')); + } + } + + /** + * This function blocks selected ip + * + * @param array|int $entries - this is an array of ips or ip to be blocked + * + * @return void|string + */ + public function block_selected_ips($entries) { + global $aio_wp_security; + if (is_array($entries)) { + $entries = array_filter($entries, function ($entry) { + return AIOWPSecurity_Utility_IP::get_user_ip_address() != $entry; + }); + + if (empty($entries)) { + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Only invalid IP addresses were provided: you can not block your own IP address', 'all-in-one-wp-security-and-firewall')); + return; + } + $entries = array_map('esc_sql', $entries); // Escape every array element + //Let's go through each entry and block IP + $total_success = 0; + foreach ($entries as $id) { + $ip_address = get_user_meta($id, 'aiowps_registrant_ip', true); + $result = AIOWPSecurity_Blocking::add_ip_to_block_list($ip_address, 'registration_spam'); + if (false === $result) { + if (AIOWPSecurity_Utility_IP::get_user_ip_address() == $ip_address) { + AIOWPSecurity_Admin_Menu::show_msg_error_st(__('You cannot block your own IP address:', 'all-in-one-wp-security-and-firewall') . ' ' . $ip_address); + } + $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_List_Registered_Users::block_selected_ips() - could not block IP : $ip_address", 4); + } else { + $total_success++; + } + } + if ($total_success > 0) { + $msg = __('The selected IP addresses were successfully added to the permanent block list.', 'all-in-one-wp-security-and-firewall'); + $msg .= ' '.__('View Blocked IPs', 'all-in-one-wp-security-and-firewall').''; + AIOWPSecurity_Admin_Menu::show_msg_updated_st($msg); + } + } + } + + /** + * Grabs the data from database and handles the pagination + * + * @param boolean $ignore_pagination - whether to not paginate + * @return void + */ + public function prepare_items($ignore_pagination = false) { + //First, lets decide how many records per page to show + $per_page = 100; + $columns = $this->get_columns(); + $current_page = $this->get_pagenum(); + $offset = ($current_page - 1) * $per_page; + $hidden = array(); + $sortable = $this->get_sortable_columns(); + $search = isset($_REQUEST['s']) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pcp check ingore this + + $this->_column_headers = array($columns, $hidden, $sortable); + + $this->process_bulk_action(); + + //Get registered users which have the special 'aiowps_account_status' meta key set to 'pending' + if ($ignore_pagination) { + $result = $this->get_registered_user_data('pending', $search); + } else { + $result = $this->get_registered_user_data('pending', $search, $per_page, $offset); + } + + $total_items = $result['total']; + $this->items = $result['data']; + + if ($ignore_pagination) return; + + $this->set_pagination_args(array( + 'total_items' => $total_items, //WE have to calculate the total number of items + 'per_page' => $per_page, //WE have to determine how many items to show on a page + 'total_pages' => ceil($total_items/$per_page) //WE have to calculate the total number of pages + )); + } + + /** + * Returns all users who have the special 'aiowps_account_status' meta key + * + * @param string $status - the status we want to search for + * @param string $search - the search query + * @param null $per_page - how many results per page + * @param int $offset - the page offset + * + * @return array - an array of users that match the search + */ + public function get_registered_user_data($status = '', $search = '', $per_page = null, $offset = 0) { + $user_fields = array( 'ID', 'user_login', 'user_email', 'user_registered'); + $user_query = new WP_User_Query(array('meta_key' => 'aiowps_account_status', 'meta_value' => $status, 'fields' => $user_fields, 'number' => $per_page, 'offset' => $offset)); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- ignore this + $user_results = $user_query->results; + $user_total = $user_query->get_total(); + + $final_data = array(); + foreach ($user_results as $user) { + $temp_array = get_object_vars($user); //Turn the object into array + $temp_array['account_status'] = get_user_meta($temp_array['ID'], 'aiowps_account_status', true); + $ip = get_user_meta($temp_array['ID'], 'aiowps_registrant_ip', true); + $temp_array['ip_address'] = empty($ip) ? '' : $ip; + if (empty($search)) { + $final_data[] = $temp_array; + } else { + $input = preg_quote($search, '~'); // don't forget to quote input string! + + $result = preg_grep('~' . $input . '~', $temp_array); + if (!empty($result)) $final_data[] = $temp_array; + } + } + + return array( + 'data' => $final_data, + 'total' => $user_total, + ); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php new file mode 100755 index 00000000..179a49e5 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-reset-settings.php @@ -0,0 +1,90 @@ +query('TRUNCATE ' . $wpdb->prefix . 'aiowps_login_lockdown'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_global_meta'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_events'); + $wpdb->query('TRUNCATE ' . $wpdb->prefix . 'aiowps_permanent_block'); + // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Ignore. + if (is_main_site()) { + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_LOGGED_IN_USERS); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_MESSAGE_STORE); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_DEBUG_LOG); + $wpdb->query('TRUNCATE ' . AIOWPSEC_TBL_AUDIT_LOG); + } + // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Ignore. + return true; + } + } + +endif; diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php new file mode 100755 index 00000000..13556c04 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-settings-menu.php @@ -0,0 +1,157 @@ + array( + 'title' => __('General settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_general_settings'), + ), + 'htaccess-file-operations' => array( + 'title' => '.htaccess '.__('file', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_htaccess_file_operations'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + 'wp-config-file-operations' => array( + 'title' => 'wp-config.php '.__('file', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_wp_config_file_operations'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + 'delete-plugin-settings' => array( + 'title' => __('Delete plugin settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_delete_plugin_settings_tab') + ), + 'wp-version-info' => array( + 'title' => __('WP version info', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_wp_version_info'), + ), + 'settings-file-operations' => array( + 'title' => __('Import/Export', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_settings_file_operations'), + ), + 'advanced-settings' => array( + 'title' => __('Advanced settings', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_advanced_settings'), + 'display_condition_callback' => array('AIOWPSecurity_Utility_Permissions', 'is_main_site_and_super_admin'), + ), + ); + + $menu_tabs = apply_filters('aiowpsecurity_setting_tabs', $menu_tabs); + $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab')); + } + + /** + * Renders the submenu's general settings tab. + * + * @return void + */ + protected function render_general_settings() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/general-settings.php', false, array()); + } + + /** + * Renders the submenu's htaccess file operations tab. + * + * @return void + */ + protected function render_htaccess_file_operations() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/htaccess-file-operations.php', false, array()); + } + + /** + * Renders the submenu's wp config file operations tab. + * + * @return void + */ + protected function render_wp_config_file_operations() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/wp-config-file-operations.php', false, array()); + } + + /** + * Renders the submenu's delete plugin settings tab. + * + * @return void + */ + protected function render_delete_plugin_settings_tab() { + global $aio_wp_security; + + $aio_wp_security->include_template('wp-admin/settings/delete-plugin-settings.php', false, array()); + } + + /** + * Renders the submenu's wp version info tab. + * + * @return void + */ + protected function render_wp_version_info() { + global $aio_wp_security, $aiowps_feature_mgr; + + $aio_wp_security->include_template('wp-admin/settings/wp-version-info.php', false, array('aiowps_feature_mgr' => $aiowps_feature_mgr)); + } + + /** + * Renders the submenu's settings file operations tab. + * + * @return void + */ + protected function render_settings_file_operations() { + global $aio_wp_security; + + $events_table_name = AIOWPSEC_TBL_EVENTS; + AIOWPSecurity_Utility::cleanup_table($events_table_name, 500); + + $aio_wp_security->include_template('wp-admin/settings/settings-file-operations.php', false, array()); + } + + /** + * Renders advanced settings tab. + * + * @return void + */ + protected function render_advanced_settings() { + if (!is_main_site()) { + return; + } + + global $aio_wp_security; + + $aios_commands = new AIOWPSecurity_Commands(); + + $advanced_settings_data = $aios_commands->get_ip_address_detection_data(); + + $aio_wp_security->include_template('wp-admin/settings/advanced-settings.php', false, $advanced_settings_data); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php new file mode 100755 index 00000000..1c13d061 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/admin/wp-security-spam-menu.php @@ -0,0 +1,93 @@ + array( + 'title' => __('Comment spam', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_comment_spam'), + ), + 'comment-spam-ip-monitoring' => array( + 'title' => __('Comment spam IP monitoring', 'all-in-one-wp-security-and-firewall'), + 'render_callback' => array($this, 'render_comment_spam_ip_monitoring'), + ), + ); + + $this->menu_tabs = array_filter($menu_tabs, array($this, 'should_display_tab')); + } + + /** + * Renders the submenu's comment spam ip monitoring tab body. + * + * @return Void + */ + protected function render_comment_spam() { + global $aiowps_feature_mgr, $aio_wp_security; + $aio_wp_security->include_template('wp-admin/spam-prevention/comment-spam.php', false, array('aiowps_feature_mgr' => $aiowps_feature_mgr)); + } + + /** + * Renders the submenu's comment spam ip monitoring tab body. + * + * @return Void + */ + protected function render_comment_spam_ip_monitoring() { + global $aio_wp_security, $aiowps_feature_mgr, $wpdb; + include_once 'wp-security-list-comment-spammer-ip.php'; // For rendering the AIOWPSecurity_List_Table in tab2 + $spammer_ip_list = new AIOWPSecurity_List_Comment_Spammer_IP(); + + $block_comments_output = ''; + + $min_block_comments = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments_block'); + if (!empty($min_block_comments)) { + // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Ignore. + $total_res = $wpdb->get_results($wpdb->prepare('SELECT * FROM '.AIOWPSEC_TBL_PERM_BLOCK.' WHERE block_reason=%s', 'spam')); + $block_comments_output = '
';
+ if (empty($total_res)) {
+ $block_comments_output .= '
';
+ } else {
+ $total_count = count($total_res);
+ $todays_blocked_count = 0;
+ foreach ($total_res as $blocked_item) {
+ $now_date_time = new DateTime('now', new DateTimeZone('UTC'));
+ $blocked_date = new DateTime('@'.$blocked_item->created); //@ with timestamp creates correct DateTime
+ if ($blocked_date->format('Y-m-d') == $now_date_time->format('Y-m-d')) {
+ //there was an IP added to permanent block list today
+ ++$todays_blocked_count;
+ }
+ }
+ $block_comments_output .= ''.esc_html__('You currently have no IP addresses permanently blocked due to spam.', 'all-in-one-wp-security-and-firewall').'
'.esc_html__('Spammer IPs added to permanent block list today:', 'all-in-one-wp-security-and-firewall'). ' ' . esc_html($todays_blocked_count).'
'.''.esc_html__('All time total:', 'all-in-one-wp-security-and-firewall'). ' ' .esc_html($total_count).'
'.''.esc_html__('View blocked IPs', 'all-in-one-wp-security-and-firewall').'
| '.esc_html(__('Account login name', 'all-in-one-wp-security-and-firewall')).' | ||
|---|---|---|
| '.esc_html($entry->user_login).' | '; + } else { + $account_output .= ''.esc_html($entry->user_login).' | '; + } + $user_acct_edit_link = admin_url('user-edit.php?user_id=' . $entry->ID); + $account_output .= ''.esc_html(__('Edit user', 'all-in-one-wp-security-and-firewall')).' | '; + $account_output .= '
' . __('You must use alphanumeric characters for your login page slug.', 'all-in-one-wp-security-and-firewall'); + } + } + + if ($error) { + $success = false; + $message = $error; + } else { + $options['aiowps_enable_rename_login_page'] = isset($data["aiowps_enable_rename_login_page"]) ? '1' : ''; + $options['aiowps_login_page_slug'] = $aiowps_login_page_slug; + + $this->save_settings($options); + + if (get_option('permalink_structure')) { + $home_url = trailingslashit(home_url()); + } else { + $home_url = trailingslashit(home_url()) . '?'; + } + + $message = __('The settings have been successfully updated.', 'all-in-one-wp-security-and-firewall'); + $args['badges'] = array("bf-rename-login-page"); + $args['content'] = array('aios-rename-login-notice' => $aio_wp_security->include_template('wp-admin/brute-force/partials/rename-login-notice.php', true, array('home_url' => $home_url))); + } + + return $this->handle_response($success, $message, $args); + } + + /** + * Handles the AJAX request to enable or configure cookie-based brute force prevention. + * + * @param array $data The data received from the AJAX request. + * + * @return array The response containing the status, message, and badge. + */ + public function perform_cookie_based_brute_force_prevention($data) { + global $aio_wp_security; + + $options = array(); + $values = array(); + $info = array(); + + $success = true; + $message = ''; + $result = ''; + + if (isset($data['aiowps_enable_brute_force_attack_prevention'])) { + $brute_force_feature_secret_word = sanitize_text_field($data['aiowps_brute_force_secret_word']); + $redirect_url = sanitize_text_field($data['aiowps_cookie_based_brute_force_redirect_url']); + if (empty($brute_force_feature_secret_word)) { + $brute_force_feature_secret_word = AIOS_DEFAULT_BRUTE_FORCE_FEATURE_SECRET_WORD; + $info[] = __('You entered an invalid value for the secret word.', 'all-in-one-wp-security-and-firewall'). ' ' . __('It has been set to the default value.', 'all-in-one-wp-security-and-firewall'); + } elseif (!ctype_alnum($brute_force_feature_secret_word)) { + $message = '
' . __('Settings have not been saved - your secret word must consist only of alphanumeric characters i.e., letters and/or numbers only.', 'all-in-one-wp-security-and-firewall') . '
'; + $success = false; + } + + if (filter_var($redirect_url, FILTER_VALIDATE_URL)) { + $redirect_url = esc_url_raw($redirect_url); + } else { + $redirect_url = 'http://127.0.0.1'; + $info[] = __('You entered an invalid value for the redirect url.', 'all-in-one-wp-security-and-firewall'). ' ' . __('It has been set to the default value.', 'all-in-one-wp-security-and-firewall'); + } + + $options['aiowps_cookie_based_brute_force_redirect_url'] = $redirect_url; + + if ($success) { + $options['aiowps_enable_brute_force_attack_prevention'] = '1'; + $options['aiowps_brute_force_secret_word'] = $brute_force_feature_secret_word; + + $result = '' . __('You have successfully enabled the cookie based brute force prevention feature', 'all-in-one-wp-security-and-firewall') . '
'; + $result .= '' . __('From now on you will need to log into your WP Admin using the following URL:', 'all-in-one-wp-security-and-firewall') . '
'; + $result .= ''.AIOWPSEC_WP_URL.'/?'.esc_html($brute_force_feature_secret_word).'=1
'; + $result .= '' . __('It is important that you save this URL value somewhere in case you forget it, OR,', 'all-in-one-wp-security-and-firewall') . '
'; + $result .= '' . sprintf(__('simply remember to add a "?%s=1" to your current site URL address.', 'all-in-one-wp-security-and-firewall'), esc_html($brute_force_feature_secret_word)) . '
'; + AIOWPSecurity_Utility::set_cookie_value(AIOWPSecurity_Utility::get_brute_force_secret_cookie_name(), AIOS_Helper::get_hash($brute_force_feature_secret_word)); + } + } else { + $options['aiowps_enable_brute_force_attack_prevention'] = ''; + $message = __('You have successfully saved cookie based brute force prevention feature settings.', 'all-in-one-wp-security-and-firewall'); + $brute_force_feature_secret_word = $aio_wp_security->configs->get_value('aiowps_brute_force_secret_word'); + $redirect_url = $aio_wp_security->configs->get_value('aiowps_cookie_based_brute_force_redirect_url'); + } + + $options['aiowps_brute_force_attack_prevention_pw_protected_exception'] = isset($data['aiowps_brute_force_attack_prevention_pw_protected_exception']) ? '1' : ''; + $options['aiowps_brute_force_attack_prevention_ajax_exception'] = isset($data['aiowps_brute_force_attack_prevention_ajax_exception']) ? '1' : ''; + + if ($success) { + $this->save_settings($options); + + AIOWPSecurity_Configure_Settings::set_cookie_based_bruteforce_firewall_configs(); + + $message = __('The settings have been successfully updated.', 'all-in-one-wp-security-and-firewall'); + $values['aiowps_brute_force_secret_word'] = $brute_force_feature_secret_word; + $values['aiowps_cookie_based_brute_force_redirect_url'] = $redirect_url; + } + $content = array( + 'aios-brute-force-info-box' => $result + ); + + $badges = array("firewall-enable-brute-force-attack-prevention"); + + $args = array( + 'badges' => $badges, + 'info' => $info, + 'values' => $values, + 'content' => $content + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * Handles the AJAX request for performing cookie test. + * + * @return array The response containing the status, message, and badge. + */ + public function perform_cookie_test() { + global $aio_wp_security; + + $success = true; + + $random_suffix = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(10); + $test_cookie_name = 'aiowps_cookie_test_'.$random_suffix; + $aio_wp_security->configs->set_value('aiowps_cookie_brute_test', $test_cookie_name, true); + $set_cookie = AIOWPSecurity_Utility::set_cookie_value($test_cookie_name, '1'); + $aiowps_cookie_test_success = ''; + $args = array(); + + if ($set_cookie) { + $aiowps_cookie_test_success = '1'; + $message = __('The cookie test was successful, you can now enable this feature.', 'all-in-one-wp-security-and-firewall'); + $result = '' . __('The cookie test was successful, you can now enable this feature.', 'all-in-one-wp-security-and-firewall') . '
' . __('The cookie test failed on this server.', 'all-in-one-wp-security-and-firewall') .' '. __('Consequently, this feature cannot be used on this site.', 'all-in-one-wp-security-and-firewall') . '
';
+ if (empty($result) || 0 == $result->total_count) {
+ $block_comments_output .= '
';
+ }
+
+ return $block_comments_output;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-file-scan-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-file-scan-commands.php
new file mode 100755
index 00000000..a53bf6fb
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-file-scan-commands.php
@@ -0,0 +1,280 @@
+configs->get_value('aiowps_fcd_exclude_filetypes')) {
+ $reset_scan_data = true;
+ }
+ }
+
+ if (!empty($data['aiowps_fcd_exclude_files'])) {
+ $files = sanitize_textarea_field(trim($data['aiowps_fcd_exclude_files']));
+ // Get the currently saved config value and check if this has changed. If so do another scan to reset the scan data so it omits these files/dirs
+ if ($files != $aio_wp_security->configs->get_value('aiowps_fcd_exclude_files')) {
+ $reset_scan_data = true;
+ }
+ }
+
+ // Explode by end-of-line character, then trim and filter empty lines
+ $email_list_array = array_filter(array_map('trim', explode("\n", $data['aiowps_fcd_scan_email_address'])), 'strlen');
+ foreach ($email_list_array as $key => $value) {
+ $email_sane = sanitize_email($value);
+ if (!is_email($email_sane)) {
+ $errors[] = __('The following address was removed because it is not a valid email address:', 'all-in-one-wp-security-and-firewall') . ' ' . htmlspecialchars($value);
+ unset($email_list_array[$key]);
+ }
+ }
+ $email_address = implode("\n", $email_list_array);
+ if (!empty($errors)) {
+ $info[] = implode(''.esc_html__('You currently have no IP addresses permanently blocked due to spam.', 'all-in-one-wp-security-and-firewall').'
'; + } else { + $todays_blocked_count = $result->todays_blocked_count; + $total_count = $result->total_count; + + $block_comments_output .= ''.esc_html__('Spammer IPs added to permanent block list today:', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html($todays_blocked_count) . '
'; + $block_comments_output .= ''.esc_html__('All time total:', 'all-in-one-wp-security-and-firewall'). ' ' . $total_count.'
'; + $block_comments_output .= ''.esc_html__('View blocked IPs', 'all-in-one-wp-security-and-firewall').'
'; + } + $block_comments_output .= '', $errors); + } + + // Save all the form values to the options + $options['aiowps_enable_automated_fcd_scan'] = isset($data["aiowps_enable_automated_fcd_scan"]) ? '1' : ''; + $options['aiowps_fcd_scan_frequency'] = absint($fcd_scan_frequency); + $options['aiowps_fcd_scan_interval'] = sanitize_text_field($data["aiowps_fcd_scan_interval"]); + $options['aiowps_fcd_exclude_filetypes'] = $file_types; + $options['aiowps_fcd_exclude_files'] = $files; + $options['aiowps_send_fcd_scan_email'] = isset($data["aiowps_send_fcd_scan_email"]) ? '1' : ''; + $options['aiowps_fcd_scan_email_address'] = $email_address; + $this->save_settings($options); + + $content['aios-file-change-info-box'] = ''; + // Let's check if backup interval was set to less than 24 hours + if (isset($data["aiowps_enable_automated_fcd_scan"]) && ($fcd_scan_frequency < 24) && 0 == $data["aiowps_fcd_scan_interval"]) { + $content['aios-file-change-info-box'] = '
';
+ $content['aios-file-change-info-box'] .= '
';
+ }
+
+ if ($reset_scan_data) {
+ $aio_wp_security->scan_obj->execute_file_change_detection_scan();
+ $new_scan_alert = __('New scan completed: The plugin has detected that you have made changes to the "File Types To Ignore" or "Files To Ignore" fields.', 'all-in-one-wp-security-and-firewall').' '.__('In order to ensure that future scan results are accurate, the old scan data has been refreshed.', 'all-in-one-wp-security-and-firewall');
+ $info[] = $new_scan_alert;
+ }
+
+ $next_fcd_scan_time = AIOWPSecurity_Scan::get_next_scheduled_scan();
+
+ if (false == $next_fcd_scan_time) {
+ $next_scheduled_scan = '' . esc_html__('Nothing is currently scheduled', 'all-in-one-wp-security-and-firewall') . '';
+ } else {
+ $scan_time = AIOWPSecurity_Utility::convert_timestamp($next_fcd_scan_time, 'D, F j, Y H:i');
+ $next_scheduled_scan = '' . esc_html($scan_time) . '';
+ }
+
+ $content['aiowps-next-files-scan-inner'] = $next_scheduled_scan;
+ $values = array('aiowps_fcd_scan_frequency' => absint($fcd_scan_frequency));
+ $badges = array('scan-file-change-detection');
+
+ $args = array(
+ 'content' => $content,
+ 'values' => $values,
+ 'badges' => $badges,
+ 'info' => $info
+ );
+
+ return $this->handle_response(true, '', $args);
+ }
+
+ /**
+ * Retrieves the last file scan data and returns the data to UDC.
+ *
+ * @param array $data The request data.
+ *
+ * @return array|string[]|WP_Error
+ */
+ public function get_last_scan_data($data) {
+ global $aio_wp_security;
+
+ if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) {
+ return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if ($data['reset_change_detected']) {
+ $aio_wp_security->configs->set_value('aiowps_fcds_change_detected', false, true);
+ }
+
+ $fcd_data = AIOWPSecurity_Scan::get_fcd_data();
+
+ $data = $fcd_data['last_scan_result'];
+
+ foreach (array('files_added', 'files_removed', 'files_changed') as $key) {
+ /* Normalize missing or non-array buckets to an empty array and skip processing */
+ if (!isset($data[$key]) || !is_array($data[$key])) {
+ $data[$key] = array();
+ continue;
+ }
+
+ /* Convert last_modified for each entry */
+ foreach ($data[$key] as &$info) {
+ if (is_array($info) && array_key_exists('last_modified', $info) && is_numeric($info['last_modified'])) {
+ $info['last_modified'] = AIOWPSecurity_Utility::convert_timestamp($info['last_modified']);
+ }
+ }
+
+ unset($info);
+ }
+
+ $fcd_data['last_scan_result'] = $data;
+
+ return $this->handle_response(true, false, array('extra_args' => $fcd_data));
+ }
+
+ /**
+ * Gets the last file scan result and returns the scan result HTML template
+ *
+ * @param array $data - the request data
+ *
+ * @return array
+ */
+ public function get_last_scan_results($data) {
+ global $aio_wp_security;
+
+ if ($data['reset_change_detected']) $aio_wp_security->configs->set_value('aiowps_fcds_change_detected', false, true);
+
+ $fcd_data = AIOWPSecurity_Scan::get_fcd_data();
+
+ if (!$fcd_data || !isset($fcd_data['last_scan_result'])) {
+ // no fcd data found
+ $message = __('No previous scan data was found; either run a manual scan or schedule regular file scans', 'all-in-one-wp-security-and-firewall');
+ return $this->handle_response(false, $message);
+ }
+
+ $content = array('aiowps_previous_scan_wrapper' => $aio_wp_security->include_template('wp-admin/scanner/scan-result.php', true, array('fcd_data' => $fcd_data)));
+
+ return $this->handle_response(true, false, array('content' => $content));
+ }
+
+ /**
+ * Performs a file scan and returns the scan result
+ *
+ * @return array
+ */
+ public function perform_file_scan() {
+ global $aio_wp_security;
+
+ $content = array();
+ $extra_args = array();
+
+ $result = $aio_wp_security->scan_obj->execute_file_change_detection_scan();
+
+ if (false === $result) {
+ // error case
+ $message = __('There was an error during the file change detection scan.', 'all-in-one-wp-security-and-firewall') . ' ' . __('Please check the plugin debug logs.', 'all-in-one-wp-security-and-firewall');
+ return $this->handle_response(false, $message);
+ }
+
+ $aio_wp_security->configs->set_value('aiowps_last_scan_time', time(), true);
+
+ // If this is first scan display special message
+ if (1 == $result['initial_scan']) {
+ $extra_args['result'] = __('This is your first file change detection scan.', 'all-in-one-wp-security-and-firewall').' '.__('The details from this scan will be used for future scans.', 'all-in-one-wp-security-and-firewall'). ' ' . __('View the file scan results', 'all-in-one-wp-security-and-firewall') . '';
+ $content['aiowps-previous-files-scan-inner'] = '' . __('View last file scan results', 'all-in-one-wp-security-and-firewall') . '';
+ } elseif (!$aio_wp_security->configs->get_value('aiowps_fcds_change_detected')) {
+ $extra_args['result'] = __('The scan is complete - There were no file changes detected.', 'all-in-one-wp-security-and-firewall');
+ } elseif ($aio_wp_security->configs->get_value('aiowps_fcds_change_detected')) {
+ $extra_args['result'] = __('The scan has detected that there was a change in your website\'s files.', 'all-in-one-wp-security-and-firewall'). ' ' . __('View the file scan results', 'all-in-one-wp-security-and-firewall') . '';
+ }
+
+ $args = array(
+ 'extra_args' => $extra_args,
+ 'content' => $content
+ );
+
+ return $this->handle_response(true, false, $args);
+ }
+
+ /**
+ * Render the legacy UDC Scanner.
+ *
+ * @return array
+ */
+ public function get_scanner_contents() {
+ global $aio_wp_security;
+
+ $GLOBALS['aiowps_feature_mgr'] = $this->get_feature_mgr_object();
+
+ $scanner_data = $this->get_scanner_data();
+
+ $content = $aio_wp_security->include_template('wp-admin/scanner/file-change-detect.php', true, $scanner_data);
+
+ return array(
+ 'status' => 'success',
+ 'content' => $content,
+ );
+ }
+
+ /**
+ * Return file scanner data.
+ *
+ * @return array Array of option values,
+ */
+ public function get_scanner_data() {
+ global $aio_wp_security;
+
+ $fcd_data = AIOWPSecurity_Scan::get_fcd_data();
+ $previous_scan = isset($fcd_data['last_scan_result']);
+
+ $next_fcd_scan_time = AIOWPSecurity_Scan::get_next_scheduled_scan();
+
+ $aiowps_fcds_change_detected = $aio_wp_security->configs->get_value('aiowps_fcds_change_detected');
+ $aiowps_enable_automated_fcd_scan = $aio_wp_security->configs->get_value('aiowps_enable_automated_fcd_scan');
+ $aiowps_fcd_scan_frequency = $aio_wp_security->configs->get_value('aiowps_fcd_scan_frequency');
+ $aiowps_fcd_scan_interval = $aio_wp_security->configs->get_value('aiowps_fcd_scan_interval');
+ $aiowps_fcd_exclude_filetypes = $aio_wp_security->configs->get_value('aiowps_fcd_exclude_filetypes');
+ $aiowps_fcd_exclude_files = $aio_wp_security->configs->get_value('aiowps_fcd_exclude_files');
+ $aiowps_send_fcd_scan_email = $aio_wp_security->configs->get_value('aiowps_send_fcd_scan_email');
+ $aiowps_fcd_scan_email_address = $aio_wp_security->configs->get_value('aiowps_fcd_scan_email_address');
+ $aiowps_last_scan_time = $aio_wp_security->configs->get_value('aiowps_last_scan_time');
+
+ return array(
+ 'previous_scan' => $previous_scan,
+ 'next_fcd_scan_time' => false === $next_fcd_scan_time ? '' : AIOWPSecurity_Utility::convert_timestamp($next_fcd_scan_time, 'D, F j, Y H:i'),
+ 'aiowps_fcds_change_detected' => $aiowps_fcds_change_detected,
+ 'aiowps_enable_automated_fcd_scan' => $aiowps_enable_automated_fcd_scan,
+ 'aiowps_fcd_scan_frequency' => $aiowps_fcd_scan_frequency,
+ 'aiowps_fcd_scan_interval' => $aiowps_fcd_scan_interval,
+ 'aiowps_fcd_exclude_filetypes' => $aiowps_fcd_exclude_filetypes,
+ 'aiowps_fcd_exclude_files' => $aiowps_fcd_exclude_files,
+ 'aiowps_send_fcd_scan_email' => $aiowps_send_fcd_scan_email,
+ 'aiowps_fcd_scan_email_address' => $aiowps_fcd_scan_email_address,
+ 'aiowps_last_scan_time' => AIOWPSecurity_Utility::convert_timestamp($aiowps_last_scan_time, 'D, F j, Y H:i'),
+ );
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-files-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-files-commands.php
new file mode 100755
index 00000000..16dd18b1
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-files-commands.php
@@ -0,0 +1,224 @@
+ $aio_wp_security->include_template('wp-admin/filesystem-security/partials/file-permissions-table.php', true, array('files_dirs_to_check' => $files_dirs_to_check, 'file_utility' => new AIOWPSecurity_Utility_File())));
+ $args = array(
+ 'content' => $content,
+ 'badges' => $badges,
+ );
+
+ return $this->handle_response($success, $message, $args);
+ }
+
+ /**
+ * This function performs file protection settings
+ *
+ * @param array $data - the request data contains the settings
+ *
+ * @return array
+ */
+ public function perform_file_protection_settings($data) {
+ global $aio_wp_security;
+
+ $success = true;
+ $message = '';
+
+ $options = array();
+ // Update settings for delete readme.html and wp-config-sample.php.
+ $options['aiowps_auto_delete_default_wp_files'] = isset($data['aiowps_auto_delete_default_wp_files']) ? '1' : '';
+
+ // Update settings for prevent hotlinking.
+ $options['aiowps_prevent_hotlinking'] = isset($data['aiowps_prevent_hotlinking']) ? '1' : '';
+
+ // Update settings for php file editing
+ $disable_file_editing = isset($data["aiowps_disable_file_editing"]) ? '1' : '';
+ $disable_file_editing_status = $disable_file_editing ? AIOWPSecurity_Utility::disable_file_edits() : AIOWPSecurity_Utility::enable_file_edits();
+ if ($disable_file_editing_status) {
+ // Save settings if no errors
+ $options['aiowps_disable_file_editing'] = $disable_file_editing;
+ } else {
+ $message = __('Disable PHP file editing failed: unable to modify or make a backup of the wp-config.php file.', 'all-in-one-wp-security-and-firewall');
+ return $this->handle_response(false, $message);
+ }
+
+ $this->save_settings($options);
+
+
+ if (AIOWPSecurity_Utility_Htaccess::write_to_htaccess() && '' !== $options['aiowps_prevent_hotlinking']) {
+
+ // Now let's write the applicable rules to the .htaccess file
+ $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess();
+
+ if ($res) {
+ $message = __('The settings have been successfully updated', 'all-in-one-wp-security-and-firewall');
+ } else {
+ $success = false;
+ $message = __('Could not write to the .htaccess file.', 'all-in-one-wp-security-and-firewall');
+
+ // revert options affected by .htaccess write fail
+ $options['aiowps_prevent_hotlinking'] = $aio_wp_security->configs->get_value('aiowps_prevent_hotlinking');
+ $this->save_settings($options);
+ }
+ }
+
+ $features = array(
+ "auto-delete-wp-files",
+ "prevent-hotlinking",
+ "filesystem-file-editing",
+ );
+
+ return $this->handle_response($success, $message, array('badges' => $features));
+ }
+
+ /**
+ * This function performs deleting default wp files
+ *
+ * @return array
+ */
+ public function perform_delete_default_wp_files() {
+ $success = true;
+ $message = __('The files have been deleted successfully.', 'all-in-one-wp-security-and-firewall');
+
+ $result = AIOWPSecurity_Utility::delete_unneeded_default_files();
+
+ if (!empty($result['error'])) {
+ $success = false;
+ $message = sprintf(__('Failed to delete the %s file(s).', 'all-in-one-wp-security-and-firewall'), $result['error']) . '' . __('You have configured your file change detection scan to occur at least once daily.', 'all-in-one-wp-security-and-firewall') . '
'; + $content['aios-file-change-info-box'] .= '' . __('For most websites we recommended that you choose a less frequent schedule such as once every few days, once a week or once a month.', 'all-in-one-wp-security-and-firewall') . '
'; + $content['aios-file-change-info-box'] .= '' . __('Choosing a less frequent schedule will also help reduce your server load.', 'all-in-one-wp-security-and-firewall') . '
'; + $content['aios-file-change-info-box'] .= '' . __('Please try to delete them manually.', 'all-in-one-wp-security-and-firewall'); + } + + return $this->handle_response($success, $message, array('info' => $result['info'])); + } + + /** + * This function performs save copy protection settings + * + * @param array $data - the request data + * + * @return array + */ + public function perform_save_copy_protection($data) { + $this->save_settings(array('aiowps_copy_protection' => isset($data["aiowps_copy_protection"]) ? '1' : '')); + + return $this->handle_response(true, '', array('badges' => array('enable-copy-protection'))); + } + + /** + * This function performs save frame display prevent setting + * + * @param array $data - the request data + * + * @return array + */ + public function perform_save_frame_display_prevent($data) { + $this->save_settings(array('aiowps_prevent_site_display_inside_frame' => isset($data["aiowps_prevent_site_display_inside_frame"]) ? '1' : '')); + + return $this->handle_response(true, '', array('badges' => array('enable-frame-protection'))); + } + + /** + * This function performs host system logs + * + * @param array $data - the request data contains the lgos settings + * + * @return array + */ + public function perform_host_system_logs($data) { + + $content = array(); + $success = true; + $message = false; + + if (isset($data['aiowps_system_log_file'])) { + if ('' != $data['aiowps_system_log_file']) { + $sys_log_file = basename(sanitize_text_field($data['aiowps_system_log_file'])); + } else { + $sys_log_file = 'error_log'; + } + $this->save_settings(array('aiowps_system_log_file' => $sys_log_file)); + } + + $logResults = AIOWPSecurity_Utility_File::recursive_file_search($sys_log_file, 0, ABSPATH); + + if (empty($logResults) || '' == $logResults) { + $success = false; + $message = __('No system logs were found.', 'all-in-one-wp-security-and-firewall'); + } else { + $content['aios-host-system-logs-results'] = ''; + foreach ($logResults as $file) { + $content['aios-host-system-logs-results'] .= $this->display_system_logs_in_table($file); + } + } + + $values = array('aiowps_system_log_file' => $sys_log_file); + + $args = array( + 'content' => $content, + 'values' => $values + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * Displays the last 50 entries of a system log file in a table format. + * + * This function reads the contents of the specified file and returns a + * rendered template displaying the last 50 entries of the log file. + * + * @param string $filepath The path to the log file to be read. + * + * @return string The rendered HTML template displaying the log entries. + */ + private function display_system_logs_in_table($filepath) { + global $aio_wp_security; + // Get contents of the error_log file + $last_50_entries = AIOWPSecurity_Utility_File::read_file_lines($filepath, -1, 50, true); + return $aio_wp_security->include_template('wp-admin/filesystem-security/filesystem-log-result.php', true, array('filepath' => $filepath, 'last_50_entries' => $last_50_entries)); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-firewall-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-firewall-commands.php new file mode 100755 index 00000000..152f6ff6 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-firewall-commands.php @@ -0,0 +1,787 @@ +set_value('aiowps_enable_pingback_firewall', $enable_pingback); + $options['aiowps_disable_xmlrpc_pingback_methods'] = isset($data["aiowps_disable_xmlrpc_pingback_methods"]) ? '1' : ''; //this disables only pingback methods of xmlrpc but leaves other methods so that Jetpack and other apps will still work + $options['aiowps_disable_rss_and_atom_feeds'] = isset($data['aiowps_disable_rss_and_atom_feeds']) ? '1' : ''; + $aiowps_firewall_config->set_value('aiowps_forbid_proxy_comments', isset($data['aiowps_forbid_proxy_comments'])); + $aiowps_firewall_config->set_value('aiowps_deny_bad_query_strings', isset($data['aiowps_deny_bad_query_strings'])); + $aiowps_firewall_config->set_value('aiowps_advanced_char_string_filter', isset($data['aiowps_advanced_char_string_filter'])); + + $block_request_methods = array_map('strtolower', AIOS_Abstracted_Ids::get_firewall_block_request_methods()); + $current_request_methods_settings = $aiowps_firewall_config->get_value('aiowps_6g_block_request_methods'); + $current_other_settings = array( + $aiowps_firewall_config->get_value('aiowps_6g_block_query'), + $aiowps_firewall_config->get_value('aiowps_6g_block_request'), + $aiowps_firewall_config->get_value('aiowps_6g_block_referrers'), + $aiowps_firewall_config->get_value('aiowps_6g_block_agents'), + ); + + $are_methods_set = !empty($current_request_methods_settings); + $are_others_set = array_reduce($current_other_settings, function($carry, $item) { + return $carry || $item; + }); + + if (($are_methods_set || $are_others_set) && '1' !== $aio_wp_security->configs->get_value('aiowps_enable_6g_firewall')) { + $options['aiowps_enable_6g_firewall'] = '1'; + } + + if (isset($data['aiowps_enable_6g_firewall'])) { + $aiowps_6g_block_request_methods = array_filter(AIOS_Abstracted_Ids::get_firewall_block_request_methods(), function($block_request_method) { + return ('PUT' != $block_request_method); + }); + + if (false === $are_methods_set && false === $are_others_set) { + $aiowps_firewall_config->set_value('aiowps_6g_block_request_methods', $aiowps_6g_block_request_methods); + $aiowps_firewall_config->set_value('aiowps_6g_block_query', true); + $aiowps_firewall_config->set_value('aiowps_6g_block_request', true); + $aiowps_firewall_config->set_value('aiowps_6g_block_referrers', true); + $aiowps_firewall_config->set_value('aiowps_6g_block_agents', true); + } else { + $methods = array(); + + foreach ($block_request_methods as $block_request_method) { + if (isset($data['aiowps_block_request_method_'.$block_request_method])) { + $methods[] = strtoupper($block_request_method); + } + } + + $aiowps_firewall_config->set_value('aiowps_6g_block_request_methods', $methods); + $aiowps_firewall_config->set_value('aiowps_6g_block_query', isset($data['aiowps_block_query'])); + $aiowps_firewall_config->set_value('aiowps_6g_block_request', isset($data['aiowps_block_request'])); + $aiowps_firewall_config->set_value('aiowps_6g_block_referrers', isset($data['aiowps_block_refs'])); + $aiowps_firewall_config->set_value('aiowps_6g_block_agents', isset($data['aiowps_block_agents'])); + } + + $options['aiowps_enable_6g_firewall'] = '1'; + + //shows the success notice + } else { + AIOWPSecurity_Configure_Settings::turn_off_all_6g_firewall_configs(); + $options['aiowps_enable_6g_firewall'] = ''; + } + + $aiowps_firewall_config->set_value('aiowps_ban_post_blank_headers', isset($data['aiowps_ban_post_blank_headers'])); + + if (isset($data['aiowps_block_fake_googlebots'])) { + $validated_ip_list_array = AIOWPSecurity_Utility::get_googlebot_ip_ranges(); + + if (is_wp_error($validated_ip_list_array)) { + $info[] = __('The attempt to save the \'Block fake Googlebots\' settings failed, because it was not possible to validate the Googlebot IP addresses:', 'all-in-one-wp-security-and-firewall') . ' ' . $validated_ip_list_array->get_error_message(); + } else { + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', true); + $aiowps_firewall_config->set_value('aiowps_googlebot_ip_ranges', $validated_ip_list_array); + } + } else { + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', false); + } + $options['aiowps_disallow_unauthorized_rest_requests'] = isset($data["aiowps_disallow_unauthorized_rest_requests"]) ? '1' : ''; + + $aios_whitelisted_rest_routes = array(); + $route_namespaces = AIOWPSecurity_Utility::get_rest_namespaces(); + foreach ($route_namespaces as $route_namespace) { + if (isset($data['aios_whitelisted_rest_routes_'.str_replace('-', '_', $route_namespace)])) { + $aios_whitelisted_rest_routes[] = $route_namespace; + } + } + $options['aios_whitelisted_rest_routes'] = $aios_whitelisted_rest_routes; + + $aios_roles_disallowed_rest_requests = array(); + $user_roles = AIOWPSecurity_Utility_Permissions::get_user_roles(); + foreach ($user_roles as $id => $name) { + if (!isset($data['aios_allowed_roles_rest_requests_'.$id])) { + $aios_roles_disallowed_rest_requests[] = $id; + } + } + $options['aios_roles_disallowed_rest_requests'] = $aios_roles_disallowed_rest_requests; + + // Commit the config settings + $this->save_settings($options); + + $block_request_methods = array_map('strtolower', AIOS_Abstracted_Ids::get_firewall_block_request_methods()); + $methods = $aiowps_firewall_config->get_value('aiowps_6g_block_request_methods'); + if (empty($methods)) { + $methods = array(); + } + + $blocked_query = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_query'); + $blocked_request = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_request'); + $blocked_referrers = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_referrers'); + $blocked_agents = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_agents'); + $content = array('aios-6g-firewall-settings-container .aios-advanced-options-panel' => $aio_wp_security->include_template('wp-admin/firewall/partials/advanced-settings-6g.php', true, compact('methods', 'blocked_query', 'blocked_request', 'blocked_referrers', 'blocked_agents', 'block_request_methods'))); + + $features = array( + 'firewall-pingback-rules', + 'firewall-disable-rss-and-atom', + 'firewall-forbid-proxy-comments', + 'firewall-deny-bad-queries', + 'firewall-advanced-character-string-filter', + 'firewall-enable-6g', + 'firewall-block-fake-googlebots', + 'firewall-ban-post-blank-headers', + 'disallow-unauthorised-requests', + ); + + $args = array( + 'badges' => $features, + 'content' => $content, + 'info' => $info, + 'extra_args' => array('xmlprc_warning' => $enable_pingback ? $aio_wp_security->include_template('wp-admin/firewall/partials/xmlrpc-warning-notice.php', true) : '') + ); + + return $this->handle_response(true, '', $args); + } + + /** + * Perform saving .htaccess firewall settings + * + * @param array $data - the request data contains the firewall settings + * + * @return array - containing a status and message + */ + public function perform_htaccess_firewall_settings($data) { + global $aio_wp_security; + + + $options = array(); + $info = array(); + $message = ''; + $success = true; + + // Max file upload size in basic rules + $upload_size = absint($data['aiowps_max_file_upload_size']); + + $max_allowed = apply_filters('aiowps_max_allowed_upload_config', 250); // Set a filterable limit of 250MB + $max_allowed = absint($max_allowed); + + if ($upload_size > $max_allowed) { + $upload_size = $max_allowed; + } elseif (empty($upload_size) || 0 > $upload_size) { + $upload_size = AIOS_FIREWALL_MAX_FILE_UPLOAD_LIMIT_MB; + $info[] = __('Max file upload limit was set to default value, because you entered a negative or zero value'); + } + + // Store the current value in case the .htaccess write operation fails and we need to revert it + $original_options = array( + 'aiowps_enable_basic_firewall' => $aio_wp_security->configs->get_value("aiowps_enable_basic_firewall"), + 'aiowps_max_file_upload_size' => $aio_wp_security->configs->get_value('aiowps_max_file_upload_size'), + 'aiowps_block_debug_log_file_access' => $aio_wp_security->configs->get_value("aiowps_block_debug_log_file_access"), + 'aiowps_disable_index_views' => $aio_wp_security->configs->get_value('aiowps_disable_index_views'), + ); + + + // Save settings + $options['aiowps_enable_basic_firewall'] = isset($data["aiowps_enable_basic_firewall"]) ? '1' : ''; + $options['aiowps_max_file_upload_size'] = $upload_size; + $options['aiowps_block_debug_log_file_access'] = isset($data["aiowps_block_debug_log_file_access"]) ? '1' : ''; + $options['aiowps_disable_index_views'] = isset($data['aiowps_disable_index_views']) ? '1' : ''; + + // Commit the config settings + $this->save_settings($options); + + //Now let's write the applicable rules to the .htaccess file + $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess(); + + if (!$res) { + $success = false; + $message = __('Could not write to the .htaccess file', 'all-in-one-wp-security-and-firewall'); + + $this->save_settings($original_options); + } + + $features = array( + 'firewall-basic-rules', + 'firewall-block-debug-file-access', + 'firewall-disable-index-views', + ); + + $values = array('aiowps_max_file_upload_size' => $upload_size); + + $args = array( + 'badges' => $features, + 'info' => $info, + 'values' => $values + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * Save and update the 5G firewall settings, and conditionally update the .htaccess file if needed. + * + * This function handles the saving of the 5G firewall settings based on user input. It checks if + * the 5G firewall setting has been modified and writes the applicable rules to the .htaccess file + * if necessary. In case of failure to write to the .htaccess file, it returns an error message. + * + * @param array $data The data array containing the 5G firewall setting. + * + * @global object $aio_wp_security The global instance of the All-In-One WP Security & Firewall plugin. + * + * @return array An array containing the status ('success' or 'error') and a message indicating + * the result of the operation. + */ + public function perform_save_5g_settings($data) { + global $aio_wp_security; + + $response = array( + 'status' => 'success', + 'message' => __('The settings were successfully updated.', 'all-in-one-wp-security-and-firewall') + ); + + $options = array(); + + // If the user has changed the 5G firewall checkbox settings, then there is a need to write htaccess rules again. + $is_5G_firewall_option_changed = ((isset($data['aiowps_enable_5g_firewall']) && '1' != $aio_wp_security->configs->get_value('aiowps_enable_5g_firewall')) || (!isset($data['aiowps_enable_5g_firewall']) && '1' == $aio_wp_security->configs->get_value('aiowps_enable_5g_firewall'))); + + // Save settings + $options['aiowps_enable_5g_firewall'] = isset($data['aiowps_enable_5g_firewall']) ? '1' : ''; + $this->save_settings($options); + + $res = true; + + if ($is_5G_firewall_option_changed) { + $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess(); // let's write the applicable rules to the .htaccess file + } + + if (!$res) { + $response['status'] = 'error'; + $response['message'] = __('Could not write to the .htaccess file for the 5G firewall settings, please check the file permissions.', 'all-in-one-wp-security-and-firewall'); + // revert settings + $options['aiowps_enable_5g_firewall'] = ''; + $this->save_settings($options); + } + + return $response; + } + + /** + * Perform saving blacklist settings + * + * @param array $data - the request data contains blacklist settings + * + * @return array - containing a status, message and feature badge html + */ + public function perform_save_blacklist_settings($data) { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $options = array(); + $message = ''; + $success = true; + + $result = 1; + $aiowps_enable_blacklisting = isset($data["aiowps_enable_blacklisting"]) ? '1' : ''; + + if (!empty($data['aiowps_banned_ip_addresses'])) { + $ip_addresses = sanitize_textarea_field(stripslashes($data['aiowps_banned_ip_addresses'])); + $ip_list_array = AIOWPSecurity_Utility_IP::create_ip_list_array_from_string_with_newline($ip_addresses); + $validated_ip_list_array = AIOWPSecurity_Utility_IP::validate_ip_list($ip_list_array, 'blacklist'); + if (is_wp_error($validated_ip_list_array)) { + $result = -1; + $success = false; + $message = nl2br($validated_ip_list_array->get_error_message()); + } else { + $banned_ip_addresses_list = preg_split('/\R/', $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses')); // Historical settings where the separator may have depended on PHP_EOL. + if ($banned_ip_addresses_list !== $validated_ip_list_array) { + $banned_ip_data = implode("\n", $validated_ip_list_array); + $options['aiowps_banned_ip_addresses'] = $banned_ip_data; + $aiowps_firewall_config->set_value('aiowps_blacklist_ips', $validated_ip_list_array); + } + $data['aiowps_banned_ip_addresses'] = ''; // Clear the post variable for the banned address list. + } + } else { + $options['aiowps_banned_ip_addresses'] = ''; // Clear the IP address config value + $aiowps_firewall_config->set_value('aiowps_blacklist_ips', array()); + } + + if (!empty($data['aiowps_banned_user_agents'])) { + $this->validate_user_agent_list(stripslashes($data['aiowps_banned_user_agents'])); + } else { + // Clear the user agent list + $options['aiowps_banned_user_agents'] = ''; + $aiowps_firewall_config->set_value('aiowps_blacklist_user_agents', array()); + } + + if (1 == $result) { + $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', $aiowps_enable_blacklisting, true); + if ('1' == $aio_wp_security->configs->get_value('aiowps_is_ip_blacklist_settings_notice_on_upgrade')) { + $aio_wp_security->configs->delete_value('aiowps_is_ip_blacklist_settings_notice_on_upgrade'); + } + } + + $this->save_settings($options); + + $args = array( + 'badges' => array("blacklist-manager-ip-user-agent-blacklisting") + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * The AJAX function for storing ips in firewall allowlist + * + * @param array $data - the request data contains data to updated + * + * @return array - containing a status and message + */ + public function perform_firewall_allowlist($data) { + $aiowps_firewall_allow_list = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::ALLOW_LIST); + + $message = ''; + $success = true; + $allowlist = $data['aios_firewall_allowlist']; + + if (empty($allowlist)) { + $aiowps_firewall_allow_list::add_ips(''); + return $this->handle_response(true, ''); + } + + $ips = sanitize_textarea_field(wp_unslash($allowlist)); + $ips = AIOWPSecurity_Utility_IP::create_ip_list_array_from_string_with_newline($ips); + $validated_ip_list_array = AIOWPSecurity_Utility_IP::validate_ip_list($ips, 'firewall_allowlist'); + + if (is_wp_error($validated_ip_list_array)) { + $success = false; + $message = nl2br($validated_ip_list_array->get_error_message()); + } else { + $aiowps_firewall_allow_list::add_ips($validated_ip_list_array); + } + + return $this->handle_response($success, $message); + } + + /** + * The AJAX function for saving PHP firewall and block and allowlists in UDC. + * + * @param array $data The data send from UDC. + * + * @return array|WP_Error + */ + public function perform_save_firewall($data) { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + $response = $this->perform_firewall_allowlist($data); + if ('error' === $response['status']) { + return $response; + } + + $response = $this->perform_save_blacklist_settings($data); + if ('error' === $response['status']) { + return $response; + } + + return $this->perform_php_firewall_settings($data); + } + + /** + * Perform the setup process for the firewall. + * + * This function handles the setup form for the firewall and renders notices accordingly. + * + * @return array An array containing the content and message for the response. + */ + public function perform_setup_firewall() { + global $aio_wp_security; + + $firewall_setup = AIOWPSecurity_Firewall_Setup_Notice::get_instance(); + $content = array('aiowps-firewall-status-container' => $aio_wp_security->include_template('wp-admin/firewall/partials/firewall-set-up-button.php', true)); + + $firewall_setup->do_setup(); + ob_start(); + $firewall_setup->render_notices(); + $result = ob_get_clean(); + + + $args = array( + 'content' => $content, + 'extra_args' => array('info_box' => $result) + ); + + $message = false; + + if (AIOWPSecurity_Utility_Firewall::is_firewall_setup()) { + $content['aiowps-firewall-status-container'] = $aio_wp_security->include_template('wp-admin/firewall/partials/firewall-downgrade-button.php', true); + $message = __('Firewall has been setup successfully.', 'all-in-one-wp-security-and-firewall'); + $args['content'] = $content; + } + + return $this->handle_response(AIOWPSecurity_Utility_Firewall::is_firewall_setup(), $message, $args); + } + + /** + * Perform the downgrade process for the firewall. + * + * This function removes the firewall and returns a response indicating success. + * + * @return array An array containing the status, content, and message for the response. + */ + public function perform_downgrade_firewall() { + global $aio_wp_security; + + AIOWPSecurity_Utility_Firewall::remove_firewall(); + + $message = AIOWPSecurity_Utility_Firewall::is_firewall_setup() ? __('Something went wrong please try again later.', 'all-in-one-wp-security-and-firewall') : __('Firewall has been downgraded successfully.', 'all-in-one-wp-security-and-firewall'); + $success = true; + $downgrade_button = $aio_wp_security->include_template('wp-admin/firewall/partials/firewall-set-up-button.php', true); + $extra_args = array(); + + if (AIOWPSecurity_Utility_Firewall::is_firewall_setup()) { + $success = false; + $downgrade_button = $aio_wp_security->include_template('wp-admin/firewall/partials/firewall-downgrade-button.php', true); + } else { + $extra_args['info_box'] = $aio_wp_security->include_template('notices/firewall-setup-notice.php', true, array('show_dismiss' => false)); + } + + $args = array( + 'content' => array('aiowps-firewall-status-container' => $downgrade_button), + 'extra_args' => $extra_args + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * Validates posted user agent list and set, save as config. + * + * @param string $banned_user_agents - List of banned user agents + * + * @return void + */ + private function validate_user_agent_list($banned_user_agents) { + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + $submitted_agents = AIOWPSecurity_Utility::splitby_newline_trim_filter_empty($banned_user_agents); + $agents = array_unique( + array_filter( + array_map( + 'sanitize_text_field', + $submitted_agents + ), + 'strlen' + ) + ); + $aiowps_firewall_config->set_value('aiowps_blacklist_user_agents', $agents); + $this->save_settings(array( + 'aiowps_banned_user_agents' => implode("\n", $agents) + )); + } + + /** + * This function performs save upgrade unsafe http calls settings. + * + * @param array $data - The request data. + * + * @return array + */ + public function perform_save_upgrade_unsafe_http_calls_settings($data) { + $upgrade_unsafe_http_calls_url_exceptions = sanitize_textarea_field(wp_unslash($data['aiowps_upgrade_unsafe_http_calls_url_exceptions'])); + + $errors = ''; + + if (!empty($upgrade_unsafe_http_calls_url_exceptions)) { + foreach (preg_split('/\R/', $upgrade_unsafe_http_calls_url_exceptions) as $url) { + $url = sanitize_url($url); + + if (empty($url)) { + continue; + } + + if (0 === strpos($url, '#')) { + continue; + } + + $parsed_url = parse_url($url); // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Using the same function as WordPress in order to not preclude URLs that would be allowed by WordPress. + + if (empty($parsed_url['scheme'])) { // The same weak sanity check used by the WordPress wp_remote_* functions. + /* translators: %s URL entered by user. */ + $errors .= "\n" . sprintf(__('%s is not a valid url.', 'all-in-one-wp-security-and-firewall'), $url); + continue; + } + } + } + + if (!empty($errors)) { + return $this->handle_response(false, nl2br(trim($errors)), array('badges' => array('upgrade-unsafe-http-calls'))); + } + + $this->save_settings(array( + 'aiowps_upgrade_unsafe_http_calls' => isset($data['aiowps_upgrade_unsafe_http_calls']) ? '1' : '', + 'aiowps_upgrade_unsafe_http_calls_url_exceptions' => $upgrade_unsafe_http_calls_url_exceptions + )); + + return $this->handle_response(true, '', array('badges' => array('upgrade-unsafe-http-calls'))); + } + + /** + * Render the PHP firewall rules for the legacy UDC theme. + * + * @return array + */ + public function get_php_firewall_contents() { + global $aio_wp_security; + + $GLOBALS['aiowps_feature_mgr'] = $this->get_feature_mgr_object(); + $php_firewall_data = $this->get_php_firewall_data(); + + $content = $aio_wp_security->include_template('/wp-admin/firewall/php-firewall-rules.php', true, compact('php_firewall_data')); + + return array( + 'status' => 'success', + 'content' => $php_firewall_data['no_firewall'] . $content, + ); + } + + /** + * Render the .htaccess firewall rules for the legacy UDC theme. + * + * @return array + */ + public function get_htaccess_contents() { + global $aio_wp_security; + + $GLOBALS['aiowps_feature_mgr'] = $this->get_feature_mgr_object(); + + $htaccess_rules_data = $this->get_htaccess_rules_data(); + + $content = $aio_wp_security->include_template('/wp-admin/firewall/htaccess-firewall-rules.php', true, compact('htaccess_rules_data')); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Render the Block & Allow Lists for the legacy UDC theme. + * + * @return array + */ + public function get_block_allow_lists_contents() { + global $aio_wp_security; + + /* Needed for submit_button() */ + require_once(ABSPATH . 'wp-admin/includes/template.php'); + + $GLOBALS['aiowps_feature_mgr'] = $this->get_feature_mgr_object(); + + $block_allowlist_data = $this->get_block_allow_lists_data(); + + $content = $aio_wp_security->include_template('wp-admin/firewall/block-and-allow-lists.php', true, $block_allowlist_data); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Render the Advanced Settings for the legacy UDC theme. + * + * @return array + */ + public function get_advanced_settings_contents() { + global $aio_wp_security; + + $GLOBALS['aiowps_feature_mgr'] = $this->get_feature_mgr_object(); + + $advanced_settings_data = $this->get_firewall_advanced_settings_data(); + + $content = $aio_wp_security->include_template('wp-admin/firewall/advanced-settings.php', true, compact('advanced_settings_data')); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Return data for the advanced firewall. + * + * @return array + */ + public function get_firewall_advanced_settings_data() { + global $aio_wp_security; + + $aiowps_upgrade_unsafe_http_calls = $aio_wp_security->configs->get_value('aiowps_upgrade_unsafe_http_calls'); + $aiowps_upgrade_unsafe_http_calls_url_exceptions = $aio_wp_security->configs->get_value('aiowps_upgrade_unsafe_http_calls_url_exceptions'); + + return array( + 'aiowps_upgrade_unsafe_http_calls' => $aiowps_upgrade_unsafe_http_calls, + 'aiowps_upgrade_unsafe_http_calls_url_exceptions' => $aiowps_upgrade_unsafe_http_calls_url_exceptions, + ); + } + + + /** + * Return data for the allow & block lists. + * + * @return array + */ + public function get_block_allow_lists_data() { + global $aio_wp_security; + + $aiowps_enable_blacklisting = $aio_wp_security->configs->get_value('aiowps_enable_blacklisting'); + $aiowps_banned_ip_addresses = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'); + $aiowps_banned_user_agents = $aio_wp_security->configs->get_value('aiowps_banned_user_agents'); + + $aiowps_firewall_allow_list = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::ALLOW_LIST); + $allowlist = $aiowps_firewall_allow_list::get_ips(); + + return array( + 'aiowps_enable_blacklisting' => $aiowps_enable_blacklisting, + 'aiowps_banned_ip_addresses' => $aiowps_banned_ip_addresses, + 'aiowps_banned_user_agents' => $aiowps_banned_user_agents, + 'allowlist' => $allowlist, + ); + } + + /** + * Return data for the .htaccess rules. + * + * @return array + */ + public function get_htaccess_rules_data() { + global $aio_wp_security; + + $aiowps_enable_basic_firewall = $aio_wp_security->configs->get_value('aiowps_enable_basic_firewall'); + $aiowps_max_file_upload_size = $aio_wp_security->configs->get_value('aiowps_max_file_upload_size'); + $aiowps_block_debug_log_file_access = $aio_wp_security->configs->get_value('aiowps_block_debug_log_file_access'); + $aiowps_disable_index_views = $aio_wp_security->configs->get_value('aiowps_disable_index_views'); + + return array( + 'aiowps_enable_basic_firewall' => $aiowps_enable_basic_firewall, + 'aiowps_max_file_upload_size' => $aiowps_max_file_upload_size, + 'aiowps_block_debug_log_file_access' => $aiowps_block_debug_log_file_access, + 'aiowps_disable_index_views' => $aiowps_disable_index_views, + ); + } + + /** + * Return data for the PHP firewall. + * + * @return array + */ + public function get_php_firewall_data() { + global $aio_wp_security, $aiowps_firewall_config, $aiowps_feature_mgr; + + $is_udc_request = AIOS_Helper::is_updraft_central_request(); + + $block_request_methods = array_map('strtolower', AIOS_Abstracted_Ids::get_firewall_block_request_methods()); + + $no_firewall_notice = ''; + $user_roles = array(); + + // Load required data from config + if (!empty($aiowps_firewall_config)) { + // firewall config is available + $methods = $aiowps_firewall_config->get_value('aiowps_6g_block_request_methods'); + if (empty($methods)) { + $methods = array(); + } + + $blocked_query = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_query'); + $blocked_request = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_request'); + $blocked_referrers = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_referrers'); + $blocked_agents = (bool) $aiowps_firewall_config->get_value('aiowps_6g_block_agents'); + + if (empty($methods) && (!$blocked_query && !$blocked_request && !$blocked_referrers && !$blocked_agents) && '1' == $aio_wp_security->configs->get_value('aiowps_enable_6g_firewall')) { + $aio_wp_security->configs->set_value('aiowps_enable_6g_firewall', ''); + $aio_wp_security->configs->save_config(); + $aiowps_feature_mgr->check_feature_status_and_recalculate_points(); + } + + } else { + if ($is_udc_request) { + ob_start(); + } + + ?> +
+
+ configs->get_value('aiowps_enable_6g_firewall');
+ $advanced_options_disabled = '1' != $aiowps_enable_6g_firewall;
+
+ $settings = array_merge(array('methods' => $methods), compact('aiowps_enable_6g_firewall', 'blocked_query', 'blocked_request', 'blocked_referrers', 'blocked_agents', 'block_request_methods', 'aiowps_firewall_config', 'advanced_options_disabled'));
+
+ $aiowps_enable_pingback_firewall = $aiowps_firewall_config->get_value('aiowps_enable_pingback_firewall');
+ $aiowps_disable_xmlrpc_pingback_methods = $aio_wp_security->configs->get_value('aiowps_disable_xmlrpc_pingback_methods');
+ $aiowps_disable_rss_and_atom_feeds = $aio_wp_security->configs->get_value('aiowps_disable_rss_and_atom_feeds');
+ $aiowps_forbid_proxy_comments = $aiowps_firewall_config->get_value('aiowps_forbid_proxy_comments');
+ $aiowps_deny_bad_query_strings = $aiowps_firewall_config->get_value('aiowps_deny_bad_query_strings');
+ $aiowps_advanced_char_string_filter = $aiowps_firewall_config->get_value('aiowps_advanced_char_string_filter');
+
+ $aiowps_disallow_unauthorized_rest_requests = $aio_wp_security->configs->get_value('aiowps_disallow_unauthorized_rest_requests');
+ $aios_roles_disallowed_rest_requests = $aio_wp_security->configs->get_value('aios_roles_disallowed_rest_requests');
+ $aios_whitelisted_rest_routes = $aio_wp_security->configs->get_value('aios_whitelisted_rest_routes');
+ $aiowps_block_fake_googlebots = $aiowps_firewall_config->get_value('aiowps_block_fake_googlebots');
+ $aiowps_ban_post_blank_headers = $aiowps_firewall_config->get_value('aiowps_ban_post_blank_headers');
+
+ $wp_user_roles = AIOWPSecurity_Utility_Permissions::get_user_roles();
+ foreach ($wp_user_roles as $role => $role_name) {
+ $user_roles[] = $role;
+ }
+
+
+ return array(
+ 'aiowps_enable_pingback_firewall' => $aiowps_enable_pingback_firewall,
+ 'aiowps_disable_xmlrpc_pingback_methods' => $aiowps_disable_xmlrpc_pingback_methods,
+ 'aiowps_disable_rss_and_atom_feeds' => $aiowps_disable_rss_and_atom_feeds,
+ 'aiowps_forbid_proxy_comments' => $aiowps_forbid_proxy_comments,
+ 'aiowps_deny_bad_query_strings' => $aiowps_deny_bad_query_strings,
+ 'aiowps_advanced_char_string_filter' => $aiowps_advanced_char_string_filter,
+ 'aiowps_disallow_unauthorized_rest_requests' => $aiowps_disallow_unauthorized_rest_requests,
+ 'aios_roles_disallowed_rest_requests' => $aios_roles_disallowed_rest_requests,
+ 'aios_whitelisted_rest_routes' => $aios_whitelisted_rest_routes,
+ 'user_roles' => $user_roles,
+ 'aiowps_block_fake_googlebots' => $aiowps_block_fake_googlebots,
+ 'aiowps_ban_post_blank_headers' => $aiowps_ban_post_blank_headers,
+ 'ng_settings' => $settings,
+ 'no_firewall' => $no_firewall_notice,
+ );
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-ip-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-ip-commands.php
new file mode 100755
index 00000000..5cfc124f
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-ip-commands.php
@@ -0,0 +1,133 @@
+handle_response(false, __('No IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!filter_var($data['ip'], FILTER_VALIDATE_IP)) {
+ return $this->handle_response(false, __('Invalid IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!AIOWPSecurity_Utility::unlock_ip($data['ip'])) {
+ return $this->handle_response(false, __('Failed to unlock the selected IP address.', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ return $this->handle_response(true, __('The selected IP address was unlocked successfully.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Unblacklists an IP.
+ *
+ * @param array $data Contains the IP address to be unblacklisted.
+ *
+ * @return array
+ */
+ public function unblacklist_ip($data) {
+
+ if (!isset($data['ip'])) {
+ return $this->handle_response(false, __('No IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!filter_var($data['ip'], FILTER_VALIDATE_IP)) {
+ return $this->handle_response(false, __('Invalid IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!AIOWPSecurity_Utility::unblacklist_ip($data['ip'])) {
+ return $this->handle_response(false, __('Failed to unblacklist the selected IP address.', 'all-in-one-wp-security-and-firewall'));
+ } else {
+ return $this->handle_response(true, __('The selected IP address was unblacklisted successfully.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Unblocks an IP by permanent block record ID.
+ *
+ * @param array $data Contains the ID of the entry in the AIOWPSEC_TBL_PERM_BLOCK table.
+ *
+ * @return array
+ */
+ public function blocked_ip_list_unblock_ip($data) {
+
+ if (!isset($data['id'])) {
+ return $this->handle_response(false, __('Invalid blocked IP ID provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ include_once AIO_WP_SECURITY_PATH . '/admin/wp-security-list-permanent-blocked-ip.php'; // For rendering the AIOWPSecurity_List_Table
+ $blocked_ip_list = new AIOWPSecurity_List_Blocked_IP(); // For rendering the AIOWPSecurity_List_Table
+ $result = $blocked_ip_list->unblock_ip_address($data['id']);
+
+ if (false === $result) {
+ $message = __('Failed to unblock and delete the selected record(s).', 'all-in-one-wp-security-and-firewall');
+ } else {
+ $message = __('Successfully unblocked and deleted the selected record(s).', 'all-in-one-wp-security-and-firewall');
+ }
+ return $this->handle_response(true, $message);
+ }
+
+ /**
+ * Locks an IP.
+ *
+ * @param array $data Contains the IP address to be locked.
+ *
+ * @return array
+ */
+ public function lock_ip($data) {
+
+ if (!isset($data['ip'])) {
+ return $this->handle_response(false, __('No IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!filter_var($data['ip'], FILTER_VALIDATE_IP)) {
+ return $this->handle_response(false, __('Invalid IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!isset($data['lock_reason'])) {
+ return $this->handle_response(false, __('No lockout reason provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ AIOWPSecurity_Utility::lock_ip($data['ip'], $data['lock_reason']);
+
+ return $this->handle_response(true, __('The selected IP address is now temporarily locked.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ /**
+ * Blacklists an IP.
+ *
+ * @param array $data Contains the IP address to be blacklisted.
+ *
+ * @return array
+ */
+ public function blacklist_ip($data) {
+
+ if (!isset($data['ip'])) {
+ return $this->handle_response(false, __('No IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!filter_var($data['ip'], FILTER_VALIDATE_IP)) {
+ return $this->handle_response(false, __('Invalid IP provided.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ $result = AIOWPSecurity_Utility::blacklist_ip($data['ip']);
+
+ if (is_wp_error($result)) {
+ return $this->handle_response(false, nl2br($result->get_error_message()));
+ } else {
+ return $this->handle_response(true, __('The selected IP address has been added to the blacklist.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-log-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-log-commands.php
new file mode 100755
index 00000000..f527439d
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-log-commands.php
@@ -0,0 +1,345 @@
+handle_response(false, AIOWPSecurity_Admin_Menu::show_msg_error_st(__('No audit log ID provided.', 'all-in-one-wp-security-and-firewall'), true));
+ }
+
+ include_once AIO_WP_SECURITY_PATH.'/admin/wp-security-list-audit.php';
+ $audit_log_list = new AIOWPSecurity_List_Audit_Log();
+
+ return $this->handle_response(true, $audit_log_list->delete_audit_event_records($data['id']));
+ }
+
+ /**
+ * Deletes an IP lockout record.
+ *
+ * @param array $data Contains the ID of the entry in the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @return array
+ */
+ public function delete_locked_ip_record($data) {
+
+ if (!isset($data['id'])) {
+ return $this->handle_response(false, AIOWPSecurity_Admin_Menu::show_msg_error_st(__('No locked IP record ID provided.', 'all-in-one-wp-security-and-firewall'), true));
+ }
+
+ include_once AIO_WP_SECURITY_PATH . '/admin/wp-security-list-locked-ip.php';
+
+ $locked_ip_list = new AIOWPSecurity_List_Locked_IP();
+ $result = $locked_ip_list->delete_lockout_records($data['id']);
+ return $this->handle_response(true, $result);
+ }
+
+ /**
+ * Clear debug logs
+ *
+ * @return array
+ */
+ public function clear_debug_logs() {
+ global $aio_wp_security;
+
+ $ret = $aio_wp_security->debug_logger->clear_logs();
+
+ if (is_wp_error($ret)) {
+ return $this->handle_response(false, AIOWPSecurity_Admin_Menu::show_msg_error_st(esc_html($ret->get_error_message()).'+ + + + + +
'.esc_html($ret->get_error_data()).'
', true)); + } else { + return $this->handle_response(true, AIOWPSecurity_Admin_Menu::show_msg_updated_st(__('The debug logs have been cleared.', 'all-in-one-wp-security-and-firewall'), true)); + } + } + + /** + * Renders the audit log tab content. + * + * This function handles the rendering of the audit log tab content based on the + * provided data via AJAX request. The data is used to filter the audit log or perform actions + * + * @access public + * @return void + */ + public function render_audit_log_tab() { + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. Nonce checked in previous function. + if (empty($_POST['data'])) return; + + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput -- PCP warning. Nonce checked in previous function and sanitization done at later. + $data = wp_unslash($_POST['data']); + + // Needed for rendering the audit log table + include_once(AIO_WP_SECURITY_PATH.'/admin/wp-security-list-audit.php'); + $audit_log_list = new AIOWPSecurity_List_Audit_Log($data); + $audit_log_list->ajax_response(); + } + + /** + * Exports the audit logs as a CSV file and sends the data as an AJAX response. + * + * This function retrieves audit log data, prepares it for export, and generates a CSV string. + * The CSV data is then sent back as part of an AJAX response, along with the filename for the CSV file. + * + * @return array + */ + public function export_audit_logs() { + + // Needed for rendering the audit log table + include_once(AIO_WP_SECURITY_PATH.'/admin/wp-security-list-audit.php'); + $audit_log_list = new AIOWPSecurity_List_Audit_Log(); + + $audit_log_list->prepare_items(true); + $export_keys = array( + 'id' => 'ID', + 'created' => __('Date and time', 'all-in-one-wp-security-and-firewall'), + 'level' => __('Level', 'all-in-one-wp-security-and-firewall'), + 'network_id' => __('Network ID', 'all-in-one-wp-security-and-firewall'), + 'site_id' => __('Site ID', 'all-in-one-wp-security-and-firewall'), + 'username' => __('Username', 'all-in-one-wp-security-and-firewall'), + 'ip' => __('IP', 'all-in-one-wp-security-and-firewall'), + 'event_type' => __('Event', 'all-in-one-wp-security-and-firewall'), + 'details' => __('Details', 'all-in-one-wp-security-and-firewall'), + 'stacktrace' => __('Stack trace', 'all-in-one-wp-security-and-firewall') + ); + + $title = 'audit_event_logs.csv'; + ob_start(); + AIOWPSecurity_Admin_Init::aiowps_output_csv($audit_log_list->items, $export_keys, $title); + + $data = ob_get_clean(); + + return array( + 'title' => $title, + 'data' => $data + ); + } + + /** + * Initializing the WP List API, since UDC commands do not load all parts of WP. + * + * @return void + */ + private function init_wp_list() { + if (!function_exists('submit_button')) { + require_once(ABSPATH . 'wp-admin/includes/template.php'); + } + + if (!function_exists('render_screen_reader_content')) { + require_once(ABSPATH . 'wp-admin/includes/class-wp-screen.php'); + } + + if (!function_exists('get_column_headers')) { + require_once(ABSPATH . 'wp-admin/includes/screen.php'); + } + } + + /** + * Returns the data for downloading the audit log. + * + * @return array|WP_Error + */ + public function process_audit_log_export() { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + $this->init_wp_list(); + + return $this->export_audit_logs(); + } + + /** + * Returns the HTML for the audit log. + * + * @return array + */ + public function get_audit_log_contents() { + global $aio_wp_security; + + $this->init_wp_list(); + + // Needed for rendering the audit log table + include_once AIO_WP_SECURITY_PATH . '/admin/wp-security-list-audit.php'; + $data = array(); + // phpcs:disable WordPress.Security.NonceVerification.Recommended -- PCP warning. Processing form data without nonce verification. No nonce. + if (isset($_GET['event-filter'])) $data['event-filter'] = sanitize_text_field(wp_unslash($_GET['event-filter'])); // Failed logins and logins only to show as audit log + $audit_log_list = new AIOWPSecurity_List_Audit_Log($data); + + $tab = isset($_GET["tab"]) ? sanitize_text_field(wp_unslash($_GET["tab"])) : ''; + $page = isset($_GET['page']) ? sanitize_text_field(wp_unslash($_GET['page'])) : ''; + // phpcs:enable WordPress.Security.NonceVerification.Recommended -- PCP warning. Processing form data without nonce verification. No nonce. + + $content = $aio_wp_security->include_template('wp-admin/dashboard/audit-logs.php', true, array('audit_log_list' => $audit_log_list, 'page' => $page, 'tab' => $tab)); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Deletes entry from audit log. + * + * @param array $data Table config data. + * + * @return array|WP_Error + */ + public function do_delete_audit_log($data) { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + $this->init_wp_list(); + + if (!class_exists('AIOWPSecurity_Admin_Menu')) { + include_once AIO_WP_SECURITY_PATH . '/admin/wp-security-admin-menu.php'; + } + + return $this->delete_audit_log($data); + } + + /** + * Renders audit log after actions (delete/orderby, block/unblock, etc.) + * + * @param array $data Table config data. + * + * @return array + */ + public function do_render_audit_log_tab($data) { + $this->init_wp_list(); + + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. Nonce checked in previous function. + if (empty($data)) return array(); + + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput -- PCP warning. Nonce checked in previous function and sanitization done at later. + $data = wp_unslash($data); + + if (!class_exists('AIOWPSecurity_Admin_Menu')) { + include_once AIO_WP_SECURITY_PATH . '/admin/wp-security-admin-menu.php'; + } + + // Needed for rendering the audit log table + include_once(AIO_WP_SECURITY_PATH.'/admin/wp-security-list-audit.php'); + $audit_log_list = new AIOWPSecurity_List_Audit_Log($data); + + return $audit_log_list->ajax_response(true); + } + + /** + * Parses raw audit log data for human-readable output. + * + * @param AIOWPSecurity_List_Audit_Log $audit_log_list Audit log object. + * @param array $data Raw audit log data. + * + * @return array + */ + private function parse_audit_log_data($audit_log_list, $data) { + $items = array(); + + foreach ($data as $db_item) { + if (empty($db_item)) { + continue; + } + + $item = array(); + + foreach ($db_item as $key => $value) { + switch ($key) { + case 'created': + $item[$key] = AIOWPSecurity_Utility::convert_timestamp($value); + break; + case 'event_type': + $item[$key] = $audit_log_list->column_event_type($db_item); + break; + case 'details': + $item[$key] = $audit_log_list->column_details($db_item); + break; + case 'stacktrace': + $item[$key] = $audit_log_list->column_stacktrace($db_item); + break; + default: + $item[$key] = $value; + break; + } + } + + $items[] = $item; + } + + return $items; + } + + /** + * Returns the data for the audit log table. + * + * @param array $data Configuration data. + * + * @return array + */ + public function get_audit_log_data($data) { + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput -- PCP warning. Nonce checked in previous function and sanitization done at later. + $data = isset($data) ? wp_unslash($data) : array(); + + $data = isset($data['data']) ? $data['data'] : $data; + + $this->init_wp_list(); + $final_column = array(); + + // Needed for rendering the audit log table + include_once(AIO_WP_SECURITY_PATH.'/admin/wp-security-list-audit.php'); + $audit_log_list = new AIOWPSecurity_List_Audit_Log($data); + + $audit_log_list->prepare_items(); + + list($columns, $hidden) = $audit_log_list->get_column_info(); + + foreach ($columns as $column_key => $column_display_name) { + if ('cb' !== $column_key) { + if (!in_array($column_key, $hidden, true)) { + $final_column[$column_key] = array('label' => $column_display_name); + } + } + } + + $audit_log_items = isset($audit_log_list->items) ? $audit_log_list->items : array(); + + foreach ($audit_log_items as $key => $item) { + $ip = isset($item['ip']) ? $item['ip'] : ''; + + if ('' !== $ip) { + $audit_log_items[$key]['is_ip_locked'] = AIOWPSecurity_Utility::check_locked_ip($ip, 'audit-log'); + $audit_log_items[$key]['is_ip_blacklisted'] = AIOWPSecurity_Utility::check_blacklist_ip($ip); + } + } + + $items = $this->parse_audit_log_data($audit_log_list, $audit_log_items); + + $bulk_actions = $audit_log_list->get_bulk_actions(); + + $paged = !empty($data['paged']) ? (int) $data['paged'] : 1; + + AIOWPSecurity_Audit_Events::setup_event_types(); + + return array( + 'audit_log_data' => array( + 'bulk_actions' => $bulk_actions, + 'event_types' => AIOWPSecurity_Audit_Events::$event_types, + 'log_levels' => AIOWPSecurity_Audit_Events::$log_levels, + 'columns' => $final_column, + 'items' => $items, + 'is_multisite' => is_multisite(), + 'pagination' => array('page' => $paged, 'pages' => $audit_log_list->get_pagination_arg('total_pages'), 'results' => $audit_log_list->get_pagination_arg('total_items')), + ), + ); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-settings-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-settings-commands.php new file mode 100755 index 00000000..59133c07 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-settings-commands.php @@ -0,0 +1,562 @@ +handle_response($success, $message, array('info' => $info)); + } + + /** + * Performs the action to disable all firewall rules. + * + * This method disables all firewall rules provided by the AIOWPSecurity_Settings_Tasks class. + * + * @return array An associative array containing the status and message of the operation. + * - 'status' : (string) The status of the operation, either 'success' or 'error'. + * - 'message' : (string) A message indicating the outcome of the operation. + * If the operation is successful, it contains an update message. + * If there is an error, it contains an error message. + */ + public function perform_disable_all_firewall_rules() { + $msg = AIOWPSecurity_Settings_Tasks::disable_all_firewall_rules(); + $success = true; + $message = ''; + + if (isset($msg['updated'])) { + $message = $msg['updated']; + } elseif (isset($msg['error'])) { + $message = $msg['error']; + $success = false; + } + + return $this->handle_response($success, $message); + } + + /** + * Performs the action to reset all settings. + * + * This method resets all settings provided by the AIOWPSecurity_Settings_Tasks class to their default values. + * + * @return array An associative array containing the status and message of the operation. + * - 'status' : (string) The status of the operation, either 'success' or 'error'. + * - 'message' : (string) A message indicating the outcome of the operation. + * If the operation is successful, it contains an update message. + * If there is an error, it contains an error message. + */ + public function perform_reset_all_settings() { + $msg = AIOWPSecurity_Settings_Tasks::reset_all_settings(); + + $success = true; + $message = ''; + + if (isset($msg['updated'])) { + $message = $msg['updated']; + } elseif (isset($msg['error'])) { + $message = $msg['error']; + $success = false; + } + + return $this->handle_response($success, $message); + } + + /** + * Performs the action to save debug settings. + * + * This method updates the debug settings in the AIOWPSecurity_Configs instance based on the provided data. + * + * @param array $data An associative array containing the data to update the debug settings. + * - 'aiowps_enable_debug': (bool) Indicates whether debug mode should be enabled. + * @return array An associative array containing the status and message of the operation. + * - 'status' : (string) The status of the operation, which is always 'success'. + * - 'message' : (string) A message indicating that the settings have been updated successfully. + */ + public function perform_save_debug_settings($data) { + global $aio_wp_security; + + $aio_wp_security->configs->set_value('aiowps_enable_debug', '1' === $data["aiowps_enable_debug"] ? '1' : '', true); + + return $this->handle_response(true); + } + + /** + * Performs the action to backup the .htaccess file. + * + * This method creates a backup of the .htaccess file and renames it with a random prefix. + * It also provides a message indicating the outcome of the backup operation. + * + * @global object $aio_wp_security The global instance of the All-in-One WP Security & Firewall plugin. + * @return array An associative array containing the status and message of the backup operation. + * - 'status' : (string) The status of the operation, which can be 'success' or 'error'. + * - 'message' : (string) A message indicating the outcome of the backup operation. + */ + public function perform_backup_htaccess_file() { + global $aio_wp_security; + + $home_path = AIOWPSecurity_Utility_File::get_home_path(); + $htaccess_path = $home_path . '.htaccess'; + + $result = AIOWPSecurity_Utility_File::backup_and_rename_htaccess($htaccess_path); //Backup the htaccess file + $extra_args = array(); + + if ($result) { + $aiowps_backup_dir = WP_CONTENT_DIR.'/'.AIO_WP_SECURITY_BACKUPS_DIR_NAME; + $success = true; + $message = __('Your .htaccess file was successfully backed up.', 'all-in-one-wp-security-and-firewall'); + $extra_args['data'] = file_get_contents($aiowps_backup_dir.'/'. $result .'.txt'); + $extra_args['title'] = $result; + } else { + $aio_wp_security->debug_logger->log_debug("htaccess - Backup operation failed!", 4); + $success = false; + $message = __('htaccess backup failed.', 'all-in-one-wp-security-and-firewall'); + } + + return $this->handle_response($success, $message, array('extra_args' => $extra_args)); + } + + /** + * Performs the action to restore the .htaccess file. + * + * This method restores the .htaccess file using the provided data, which includes the contents of the .htaccess file. + * It also verifies that the file chosen has valid contents relevant to the .htaccess file. + * + * @global object $aio_wp_security The global instance of the All-in-One WP Security & Firewall plugin. + * @param array $data An associative array containing the data needed to restore the .htaccess file. + * - 'aiowps_htaccess_file' : (string) The name of the .htaccess file to restore from. + * - 'aiowps_htaccess_file_contents' : (string) The contents of the .htaccess file to restore. + * @return array An associative array containing the status and message of the restore operation. + * - 'status' : (string) The status of the operation, which can be 'success' or 'error'. + * - 'message' : (string) A message indicating the outcome of the restore operation. + */ + public function perform_restore_htaccess_file($data) { + global $aio_wp_security; + + $success = true; + + $home_path = AIOWPSecurity_Utility_File::get_home_path(); + $htaccess_path = $home_path . '.htaccess'; + + if (empty($data['aiowps_htaccess_file']) && empty($data['aiowps_htaccess_file_contents'])) { + $message = __('Please choose a valid .htaccess to restore from.', 'all-in-one-wp-security-and-firewall'); + $success = false; + } else { + $htaccess_file_contents = trim(stripslashes($data['aiowps_htaccess_file_contents'])); + //Verify that file chosen has contents which are relevant to .htaccess file + $is_htaccess = AIOWPSecurity_Utility_Htaccess::check_if_htaccess_contents($htaccess_file_contents); + if (1 == $is_htaccess) { + if (!file_put_contents($htaccess_path, $htaccess_file_contents)) { + //Failed to make a backup copy + $aio_wp_security->debug_logger->log_debug("htaccess - Restore from .htaccess operation failed.", 4); + $message = __('The restoration of the .htaccess file failed; please attempt to restore the .htaccess file manually using FTP.', 'all-in-one-wp-security-and-firewall'); + $success = false; + } else { + $message = __('Your .htaccess file has successfully been restored.', 'all-in-one-wp-security-and-firewall'); + } + } else { + $aio_wp_security->debug_logger->log_debug("htaccess restore failed - Contents of restore file appear invalid.", 4); + $success = false; + $message = __('The restoration .htaccess file has failed, please check the contents of the file you are trying to restore from.', 'all-in-one-wp-security-and-firewall'); + } + } + + return $this->handle_response($success, $message); + } + + /** + * Performs the action to restore the wp-config.php file. + * + * This method restores the wp-config.php file using the provided data, which includes the contents of the wp-config.php file. + * It also verifies that the file chosen is a valid wp-config.php file. + * + * @global object $aio_wp_security The global instance of the All-in-One WP Security & Firewall plugin. + * @param array $data An associative array containing the data needed to restore the wp-config.php file. + * - 'aiowps_wp_config_file' : (string) The name of the wp-config.php file to restore from. + * - 'aiowps_wp_config_file_contents' : (string) The contents of the wp-config.php file to restore. + * @return array An associative array containing the status and message of the restore operation. + * - 'status' : (string) The status of the operation, which can be 'success' or 'error'. + * - 'message' : (string) A message indicating the outcome of the restore operation. + */ + public function perform_restore_wp_config_file($data) { + global $aio_wp_security; + + $success = true; + + if (empty($data['aiowps_wp_config_file']) && empty($data['aiowps_wp_config_file_contents'])) { + $message = __('Please choose a wp-config.php file to restore from.', 'all-in-one-wp-security-and-firewall'); + $success = false; + } else { + $wp_config_file_contents = trim(stripslashes($data['aiowps_wp_config_file_contents'])); + + //Verify that file chosen is a wp-config.file + $is_wp_config = AIOWPSecurity_Utility_File::check_if_wp_config_contents($wp_config_file_contents); + if ($is_wp_config) { + $active_root_wp_config = AIOWPSecurity_Utility_File::get_wp_config_file_path(); + if (!file_put_contents($active_root_wp_config, $wp_config_file_contents)) { + //Failed to make a backup copy + $aio_wp_security->debug_logger->log_debug("wp-config.php - Restore from backed up wp-config operation failed.", 4); + $message = __('The restoration of the wp-config.php file failed, please attempt to restore this file manually using FTP.', 'all-in-one-wp-security-and-firewall'); + $success = false; + } else { + $message =__('Your wp-config.php file has successfully been restored.', 'all-in-one-wp-security-and-firewall'); + } + } else { + $aio_wp_security->debug_logger->log_debug("wp-config.php restore failed - Contents of restore file appear invalid.", 4); + $message = __('The restoration of the wp-config.php file failed, please check the contents of the file you are trying to restore from.', 'all-in-one-wp-security-and-firewall'); + $success = false; + } + } + + return $this->handle_response($success, $message); + } + + /** + * Performs the action to delete plugin settings. + * + * This method deletes specific plugin settings based on the provided data. + * + * @param array $data An associative array containing the data needed to delete plugin settings. + * - 'aiowps_on_uninstall_delete_db_tables' : (string) Indicates whether to delete plugin database tables on uninstallation. + * - 'aiowps_on_uninstall_delete_configs' : (string) Indicates whether to delete plugin configuration settings on uninstallation. + * @return array An associative array containing the status and message of the delete operation. + * - 'status' : (string) The status of the operation, which can be 'success'. + * - 'message' : (string) A message indicating that the plugin settings have been successfully deleted. + */ + public function perform_delete_plugin_settings($data) { + + $options = array(); + //Save settings + $options['aiowps_on_uninstall_delete_db_tables'] = isset($data['aiowps_on_uninstall_delete_db_tables']) ? '1' : ''; + $options['aiowps_on_uninstall_delete_configs'] = isset($data['aiowps_on_uninstall_delete_configs']) ? '1' : ''; + $this->save_settings($options); + + return $this->handle_response(true); + } + + /** + * Performs the action to remove WordPress version information settings. + * + * This method sets the option to remove WordPress version information meta tags based on the provided data. + * + * @param array $data An associative array containing the data needed to configure the removal of WordPress version information. + * - 'aiowps_remove_wp_generator_meta_info' : (string) Indicates whether to remove WordPress version information meta tags. + * @return array An associative array containing the status, message, and additional badges related to the removal of WordPress version information. + * - 'status' : (string) The status of the operation, which can be 'success'. + * - 'message' : (string) A message indicating that the settings have been successfully updated. + * - 'badges' : (array) An array containing feature IDs and HTML for additional badges. + */ + public function perform_remove_wp_version_info_settings($data) { + global $aio_wp_security; + + $aio_wp_security->configs->set_value('aiowps_remove_wp_generator_meta_info', '1' === $data["aiowps_remove_wp_generator_meta_info"] ? '1' : '', true); + + return $this->handle_response(true, '', array('badges' => array('wp-generator-meta-tag'))); + } + + /** + * Performs the action to restore AIOWPS settings from an imported file. + * + * This method restores AIOWPS settings from the provided data representing an imported file. + * + * @param array $data An associative array containing the data needed to restore AIOWPS settings. + * - 'aiowps_import_settings_file' : (string) The name of the file containing the AIOWPS settings. + * - 'aiowps_import_settings_file_contents': (string) The contents of the file containing the AIOWPS settings. + * @return array An associative array containing the status and messages related to the restoration of AIOWPS settings. + * - 'status' : (string) The status of the operation, which can be 'success' or 'error'. + * - 'messages' : (array) An array of messages indicating the outcome of the restoration process. + * - 'redirect_url' : (string|null) The URL to redirect to after the restoration process, if applicable. + */ + public function perform_restore_aiowps_settings($data) { + global $aio_wp_security, $simba_two_factor_authentication; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $success = true; + $info = array(); + $extra_args = array(); + + $msg_updated = __('Your AIOS settings were successfully imported.', 'all-in-one-wp-security-and-firewall'); + $msg_error = sprintf(__('Could not write to the %s file.', 'all-in-one-wp-security-and-firewall'), AIOWPSecurity_Utility_File::get_home_path().'.htaccess') . ' ' . __('Please check the file permissions.', 'all-in-one-wp-security-and-firewall'); + + if (empty($data['aiowps_import_settings_file']) && empty($data['aiowps_import_settings_file_contents'])) { + $success = false; + $message = __('Please choose a file to import your settings from.', 'all-in-one-wp-security-and-firewall'); + } else { + // Let's get the uploaded import file contents + $import_file_contents = trim($data['aiowps_import_settings_file_contents']); // stripslashes not required wp_unslash applied already AIOWPSecurity_Ajax::set_data + + // Verify that file chosen has valid AIOS settings contents + $aiowps_settings_file_contents = AIOWPSecurity_Utility_File::check_if_valid_aiowps_settings_content($import_file_contents); + + if ($aiowps_settings_file_contents) { + $is_enabled_cookie_bruteforce_before_import = $aio_wp_security->configs->get_value('aiowps_enable_brute_force_attack_prevention'); + // Apply the settings + $settings_array = json_decode($import_file_contents, true); + if (array_key_exists('general', $settings_array)) { + $aiowps_settings_applied = update_option('aio_wp_security_configs', $settings_array['general']); + + if (!$aiowps_settings_applied && get_option('aio_wp_security_configs') === $settings_array['general']) { + $aiowps_settings_applied = true; + } + + if (is_main_site() && is_super_admin()) { + if (array_key_exists('tfa', $settings_array) && true == $simba_two_factor_authentication->is_tfa_integrated) { + $tfa_settings_applied = $simba_two_factor_authentication->set_configs($settings_array['tfa']); + + if (!$tfa_settings_applied && $simba_two_factor_authentication->get_configs() !== $settings_array['tfa']) { + $aiowps_settings_applied = false; + } + } + + if (array_key_exists('firewall', $settings_array)) { + $aiowps_settings_applied = $aiowps_settings_applied && $aiowps_firewall_config->set_contents($settings_array['firewall']); + } + } + } else { + $aiowps_settings_applied = update_option('aio_wp_security_configs', $settings_array); + + if (!$aiowps_settings_applied && get_option('aio_wp_security_configs') === $settings_array) { + $aiowps_settings_applied = true; + } + } + + if (!$aiowps_settings_applied) { + // Failed to import settings + $aio_wp_security->debug_logger->log_debug('Import AIOS settings operation failed.', 4); + $success = false; + $message = __('Import AIOS settings operation failed.', 'all-in-one-wp-security-and-firewall'); + } else { + $aio_wp_security->configs->load_config(); // Refresh the configs global variable + + //Just in case user submits partial config settings + //Run add_option_values to make sure any missing config items are at least set to default + AIOWPSecurity_Configure_Settings::add_option_values(); + + $res = true; + + if (AIOWPSecurity_Utility::allow_to_write_to_htaccess()) $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess(); + + // Now let's refresh the .htaccess file with any modified rules if applicable + + $is_enabled_cookie_bruteforce = $aio_wp_security->configs->get_value('aiowps_enable_brute_force_attack_prevention'); + + if ($is_enabled_cookie_bruteforce_before_import != $is_enabled_cookie_bruteforce && 1 == $is_enabled_cookie_bruteforce) { + $url = 'admin.php?page='.AIOWPSEC_SETTINGS_MENU_SLUG."&tab=settings-file-operations&success=import_settings"; + $url .= empty($aio_wp_security->configs->get_value('aiowps_brute_force_secret_word')) ? '' : '&'.$aio_wp_security->configs->get_value('aiowps_brute_force_secret_word').'=1'; + $url .= $res ? '' : '&error=write_htaccess'; + $extra_args['redirect_url'] = admin_url(sanitize_url($url)); + } + + $message = $msg_updated; + if (!$res) { + $info[] = $msg_error; + } + } + } else { + // Invalid settings file + $aio_wp_security->debug_logger->log_debug("The contents of your settings file are invalid.", 4); + $success = false; + $message = __('The contents of your settings file are invalid, please check the contents of the file you are trying to import settings from.', 'all-in-one-wp-security-and-firewall'); + } + } + + $args = array( + 'info' => $info, + 'extra_args' => $extra_args + ); + + return $this->handle_response($success, $message, $args); + } + + /** + * Performs the action to save IP settings. + * + * This method saves the IP settings based on the provided data. + * + * @param array $data An associative array containing the data needed to save IP settings. + * - 'aiowps_ip_retrieve_method': (string) The ID of the IP retrieval method. + * @return array An associative array containing the status and message related to saving IP settings. + * - 'status': (string) The status of the operation, which can be 'success' or 'error'. + * - 'message': (string|null) A message indicating the outcome of saving IP settings, or null if no message is provided. + */ + public function perform_save_ip_settings($data) { + global $wpdb, $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $ip_retrieve_method_id = sanitize_text_field($data["aiowps_ip_retrieve_method"]); + + $message = false; + + if (in_array($ip_retrieve_method_id, array_keys(AIOS_Abstracted_Ids::get_ip_retrieve_methods()))) { + $aio_wp_security->configs->set_value('aiowps_ip_retrieve_method', $ip_retrieve_method_id, true); + $aiowps_firewall_config->set_value('aios_ip_retrieve_method', $ip_retrieve_method_id); + $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS; + + //Clear logged in list because it might be showing wrong addresses + if (AIOWPSecurity_Utility::is_multisite_install()) { + $current_blog_id = get_current_blog_id(); + $wpdb->query($wpdb->prepare("DELETE FROM `{$logged_in_users_table}` WHERE site_id = %d", $current_blog_id)); + } + $wpdb->query("DELETE FROM `{$logged_in_users_table}`"); + + $message = ''; + } + + return $this->handle_response(true, $message); + } + + /** + * Perform saving the wp-config.php file. + * + * This method backs up the wp-config.php file and retrieves its content. + * It returns the status of the operation, the file content, and the backup title. + * + * @return array An array containing the status, file content, and backup title. + */ + public function perform_save_wp_config() { + $wp_config_path = AIOWPSecurity_Utility_File::get_wp_config_file_path(); + AIOWPSecurity_Utility_File::backup_and_rename_wp_config($wp_config_path); // Backup the wp_config.php file + $title = "wp-config-backup.txt"; + $file_content = file_get_contents($wp_config_path); + + $extra_args = array( + 'data' => $file_content, + 'title' => $title + ); + + return $this->handle_response(true, false, array('extra_args' => $extra_args)); + } + + /** + * Perform exporting All-In-One Security settings. + * + * This method exports general settings, firewall settings, and two-factor authentication settings + * if applicable. It then returns the exported data in JSON format along with a title for the export. + * + * @return array An array containing the status, exported data in JSON format, and a title for the export. + */ + public function perform_export_aios_settings() { + global $simba_two_factor_authentication; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $config_data = array(); + $config_data['general'] = get_option('aio_wp_security_configs'); + + if (is_main_site() && is_super_admin()) { + $config_data['firewall'] = $aiowps_firewall_config->get_contents(); + + if (true == $simba_two_factor_authentication->is_tfa_integrated) { + $config_data['tfa'] = $simba_two_factor_authentication->get_configs(); + } + } + + $output = json_encode($config_data); + + $extra_args = array( + 'data' => $output, + 'title' => 'aiowps_' . current_time('Y-m-d_H-i') . '.txt' + ); + + return $this->handle_response(true, false, array('extra_args' => $extra_args)); + } + + /** + * Render the Import/Export settings UI for legacy UDC. + * + * @return array + */ + public function get_import_export_contents() { + global $aio_wp_security; + + $content = $aio_wp_security->include_template('wp-admin/settings/settings-file-operations.php', true, array()); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Render the reset settings UI for legacy UDC. + * + * @return array + */ + public function get_reset_contents() { + global $aio_wp_security; + + $content = $aio_wp_security->include_template('wp-admin/settings/general-settings.php', true, array()); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Return ip address detection data for the advanced settings. + * + * @return array + */ + public function get_ip_address_detection_data() { + global $aio_wp_security; + + $ip_retrieve_methods_postfixes = array( + 'REMOTE_ADDR' => __('Default - if correct, then this is the best option', 'all-in-one-wp-security-and-firewall'), + 'HTTP_CF_CONNECTING_IP' => __("Only use if you're using Cloudflare.", 'all-in-one-wp-security-and-firewall'), + ); + + $ip_retrieve_methods = array(); + + foreach (AIOS_Abstracted_Ids::get_ip_retrieve_methods() as $id => $ip_method) { + $ip_retrieve_methods[$id]['ip_method'] = $ip_method; + + if (isset($_SERVER[$ip_method])) { + /* translators: %s: IP Method */ + $ip_retrieve_methods[$id]['ip_method'] .= ' ' . sprintf(__('(current value: %s)', 'all-in-one-wp-security-and-firewall'), sanitize_text_field(wp_unslash($_SERVER[$ip_method]))); + $ip_retrieve_methods[$id]['is_enabled'] = true; + } else { + $ip_retrieve_methods[$id]['ip_method'] .= ' (' . __('no value (i.e. empty) on your server', 'all-in-one-wp-security-and-firewall') . ')'; + $ip_retrieve_methods[$id]['is_enabled'] = false; + } + + if (!empty($ip_retrieve_methods_postfixes[$ip_method])) { + $ip_retrieve_methods[$id]['ip_method'] .= ' (' . $ip_retrieve_methods_postfixes[$ip_method] . ')'; + } + } + + return array( + 'is_localhost' => AIOWPSecurity_Utility::is_localhost(), + 'current_ip_retrieve_method' => $aio_wp_security->configs->get_value('aiowps_ip_retrieve_method'), + 'ip_retrieve_methods' => $ip_retrieve_methods, + 'server_suitable_ip_methods' => AIOWPSecurity_Utility_IP::get_server_suitable_ip_methods() + ); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tfa-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tfa-commands.php new file mode 100755 index 00000000..5797b662 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tfa-commands.php @@ -0,0 +1,216 @@ +init_tfa(); + + $controller = $tfa->get_controller(); + + $old_algorithm = $controller->get_user_otp_algorithm($current_user->ID); + + if ($old_algorithm != $data['tfa_algorithm_type']) { + $controller->changeUserAlgorithmTo($current_user->ID, $data['tfa_algorithm_type']); + } + + return array( + 'status' => 'success', + ); + } + + /** + * Saves the TFA activation setting. + * + * @param array $data Passed arguments. + * + * @return array|WP_Error + */ + public function save_activation_setting($data) { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + global $current_user; + + $tfa = $this->init_tfa(); + + $tfa->change_tfa_enabled_status($current_user->ID, $data['tfa_enable_tfa']); + + return array( + 'status' => 'success', + ); + } + + /** + * Updates the TFA private key. + * + * @return array|WP_Error + */ + public function update_private_key() { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + global $current_user; + + $user_id = $current_user->ID; + + delete_user_meta($user_id, 'tfa_priv_key_64'); + delete_user_meta($user_id, 'simba_tfa_emergency_codes_64'); + + return array( + 'status' => 'success', + ); + } + + /** + * Updates the TFA OTP Code. + * + * @param array $data Passed arguments. + * + * @return array|WP_Error + */ + public function update_otp_code($data) { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + global $current_user; + + $tfa = $this->init_tfa(); + + if ('refreshotp' == $data['subaction']) { + $code = $tfa->get_controller()->get_current_code($current_user->ID); + + if (false === $code) { + return array( + 'status' => 'error', + 'code' => '', + ); + } + + return array( + 'status' => 'success', + 'code' => $code, + ); + } elseif ('untrust_device' == $data['subaction']) { + global $current_user; + + $trusted_devices = $tfa->user_get_trusted_devices(); + + $trusted_device = $trusted_devices[wp_unslash($data['device_id'])]; + + if (isset($trusted_device)) { + unset($trusted_device); + } + + $current_user_id = $current_user->ID; + + $tfa->user_set_trusted_devices($current_user_id, $trusted_devices); + + $trusted_list = $tfa->include_template('trusted-devices-inner-box.php', array('trusted_devices' => $tfa->user_get_trusted_devices()), true); + + return array( + 'status' => 'success', + 'trusted_list' => $trusted_list, + ); + } + + exit; + } + + /** + * Renders the TFA UI. + * + * @return array + */ + public function get_tfa_contents() { + if (!function_exists('submit_button')) { + require_once(ABSPATH . 'wp-admin/includes/template.php'); + } + + $tfa = $this->init_tfa(); + + $content = $tfa->include_template('user-settings.php', array('simba_tfa' => $tfa), true); + + return array( + 'status' => 'success', + 'content' => $content, + ); + } + + /** + * Get the TFA settings data for the new UDC theme. + * + * @return array + */ + public function get_tfa_data() { + $tfa = $this->init_tfa(); + + return array( + 'tfa_required_administrator' => $tfa->get_option('tfa_required_administrator'), + 'tfa_administrator' => $tfa->get_option('tfa_administrator'), + ); + } + + /** + * Save the TFA settings data for the new UDC theme. + * + * @param array $data The data to save. + * + * @return array|WP_Error + */ + public function perform_save_tfa($data) { + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return new WP_Error(esc_html__('Sorry, you do not have enough privilege to execute the requested action.', 'all-in-one-wp-security-and-firewall')); + } + + $success = false; + $message = ''; + + $tfa = $this->init_tfa(); + + $value = isset($data["tfa_required_administrator"]) ? '1' : ''; + + if ($tfa->update_option('tfa_required_administrator', $value)) { + $tfa->update_option('tfa_administrator', $value); + + $success = true; + } + + return $this->handle_response($success, $message); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tools-commands.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tools-commands.php new file mode 100755 index 00000000..18196dab --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/commands/wp-security-tools-commands.php @@ -0,0 +1,253 @@ +')) { + if (!(filter_var($ip_or_domain, FILTER_VALIDATE_IP) || filter_var($ip_or_domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME))) $invalid_domain = true; // phpcs:ignore PHPCompatibility.Constants.NewConstants.filter_validate_domainFound -- This code only runs on php 7.0+ so ignore the warning + } + + if ($invalid_domain) { + $result = __('Please enter a valid IP address or domain name to look up.', 'all-in-one-wp-security-and-firewall'); + $result .= __('Nothing to show.', 'all-in-one-wp-security-and-firewall'); + } else { + $result = $this->whois_lookup($ip_or_domain); + + if (is_wp_error($result)) { + $result = htmlspecialchars($result->get_error_message()); + $result .= __('Nothing to show.', 'all-in-one-wp-security-and-firewall'); + } else { + $result = htmlspecialchars($result); + } + } + + $args = array( + 'content' => array('aios-who-is-lookup-result-container' => $aio_wp_security->include_template('wp-admin/tools/partials/who-is-lookup-result.php', true, array('result' => $result, 'ip_or_domain' => $ip_or_domain))) + ); + + return $this->handle_response(true, false, $args); + } + + /** + * Store custom .htaccess settings provided by the user. + * + * @param array $data The data containing the custom .htaccess settings. + * It should include keys 'aiowps_enable_custom_rules', 'aiowps_custom_rules', + * and 'aiowps_place_custom_rules_at_top' if applicable. + * @return array An array containing the status of the operation and any relevant messages. + * The 'status' key indicates whether the operation was successful. + * The 'message' key contains any informational or error messages. + */ + public function perform_store_custom_htaccess_settings($data) { + global $aio_wp_security; + + $success = true; + $message = ''; + + $options = array(); + // Save settings + if (isset($data["aiowps_enable_custom_rules"]) && empty($data['aiowps_custom_rules'])) { + $message = __('You must enter some .htaccess directives in the text box below', 'all-in-one-wp-security-and-firewall'); + return $this->handle_response(false, $message); + } else { + if (!empty($data['aiowps_custom_rules'])) { + // Sanitize textarea shoud not be used as';
+ $badge_html .= '';
+ $badge_html .= ''.$security_level.'';
+ $badge_html .= '';
+ $badge_html .= $current_security_points.'/'.$max_security_points.'';
+ $badge_html .= '
';
+
+ if ($return_instead_of_echo) {
+ return $badge_html;
+ } else {
+ echo $badge_html;
+ }
+ }
+
+ /**
+ * This function will calculate the total points for the AJAX save function
+ *
+ * @return void
+ */
+ public function calculate_total_feature_points() {
+ $this->calculate_total_points();
+ }
+
+ /**
+ * This function will setup the feature status and calculate the total points
+ *
+ * @return void
+ */
+ public function check_feature_status_and_recalculate_points() {
+ $this->check_and_set_feature_status();
+ $this->calculate_total_points();
+ }
+
+ /**
+ * This function will calculate the total points for the site
+ *
+ * @return void
+ */
+ private function calculate_total_points() {
+ foreach ($this->feature_items as $item) {
+ if ($item->is_active()) $this->total_points = $this->total_points + intval($item->item_points);
+ }
+ }
+
+ /**
+ * This function will calculate the total achievable points
+ *
+ * @return void
+ */
+ private function calculate_total_achievable_points() {
+ foreach ($this->feature_items as $item) {
+ $this->total_achievable_points = $this->total_achievable_points + intval($item->item_points);
+ }
+ }
+
+ /**
+ * This function will return the total points for the site
+ *
+ * @return int - the total points for the site
+ */
+ public function get_total_site_points() {
+ if (empty($this->total_points)) $this->calculate_total_points();
+ return $this->total_points;
+ }
+
+ /**
+ * This function will return the total achievable points
+ *
+ * @return int - the total achievable points
+ */
+ public function get_total_achievable_points() {
+ if (empty($this->total_achievable_points)) $this->calculate_total_achievable_points();
+ return $this->total_achievable_points;
+ }
+
+ /**
+ * This function will loop over each feature item, checking if it's enabled and setting it's feature status
+ *
+ * @return void
+ */
+ private function check_and_set_feature_status() {
+ foreach ($this->feature_items as $item) {
+ call_user_func($item->callback, $item);
+ }
+ }
+
+ /**
+ * This function will check if the feature database value is active and set the feature status
+ *
+ * @param AIOWPSecurity_Feature_Item $item - the item we want to check is active
+ *
+ * @return void
+ */
+ private function is_feature_enabled($item) {
+ global $aio_wp_security;
+ $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG);
+
+ $enabled = false;
+ foreach ($item->feature_options as $option) {
+ if ('1' == $aiowps_firewall_config->get_value($option) || '1' == $aio_wp_security->configs->get_value($option)) $enabled = true;
+ }
+
+ if ($enabled) {
+ $item->set_feature_status($this->feature_active);
+ } else {
+ $item->set_feature_status($this->feature_inactive);
+ }
+ }
+
+ /**
+ * This function will check if the default admin user exists and set the feature status
+ *
+ * @param AIOWPSecurity_Feature_Item $item - the item we want to check is active
+ *
+ * @return void
+ */
+ private function check_user_accounts_change_admin_user_feature($item) {
+ if (AIOWPSecurity_Utility::check_user_exists('admin')) {
+ $item->set_feature_status($this->feature_inactive);
+ } else {
+ $item->set_feature_status($this->feature_active);
+ }
+ }
+
+ /**
+ * This function will check if the username and nicknames are identical and set the feature status
+ *
+ * @param AIOWPSecurity_Feature_Item $item - the item we want to check is active
+ *
+ * @return void
+ */
+ private function check_user_accounts_display_name_feature($item) {
+ if (AIOWPSecurity_Utility::check_identical_login_and_nick_names()) {
+ $item->set_feature_status($this->feature_inactive);
+ } else {
+ $item->set_feature_status($this->feature_active);
+ }
+ }
+
+ /**
+ * This function will check if the default database prefix is in use and set the feature status
+ *
+ * @param AIOWPSecurity_Feature_Item $item - the item we want to check is active
+ *
+ * @return void
+ */
+ private function check_db_security_db_prefix_feature($item) {
+ global $wpdb;
+ $site_id = get_current_blog_id();
+ $default_prefix = (1 === $site_id) ? 'wp_' : "wp_{$site_id}_";
+ if ($default_prefix === $wpdb->prefix) {
+ $item->set_feature_status($this->feature_inactive);
+ } else {
+ $item->set_feature_status($this->feature_active);
+ }
+ }
+
+ /**
+ * This function will check the filesystem permissions and set the feature status
+ *
+ * @param AIOWPSecurity_Feature_Item $item - the item we want to check is active
+ *
+ * @return void
+ */
+ private function check_filesystem_permissions_feature($item) {
+ //TODO
+ $is_secure = 1;
+ $files_dirs_to_check = AIOWPSecurity_Utility_File::get_files_and_dirs_to_check();
+
+ foreach ($files_dirs_to_check as $file_or_dir) {
+ $actual_perm = AIOWPSecurity_Utility_File::get_file_permission($file_or_dir['path']);
+ $is_secure = $is_secure*AIOWPSecurity_Utility_File::is_file_permission_secure($file_or_dir['permissions'], $actual_perm);
+ }
+
+ //Only if all of the files' permissions are deemed secure give this a thumbs up
+ if (1 == $is_secure) {
+ $item->set_feature_status($this->feature_active);
+ } else {
+ $item->set_feature_status($this->feature_inactive);
+ }
+ }
+
+ /**
+ * This function will check if an item should be added to the feature list
+ *
+ * @param array $item - the item we want to check if it should be added
+ * @return bool
+ */
+ public static function should_add_item($item) {
+ if (empty($item['feature_condition_callback'])) {
+ return true;
+ } elseif (is_callable($item['feature_condition_callback'])) {
+ return call_user_func($item['feature_condition_callback']);
+ } else {
+ error_log("Callback function set but not callable (coding error). Feature: " . $item['name']);
+ return false;
+ }
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/grade-system/wp-security-feature-item.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/grade-system/wp-security-feature-item.php
new file mode 100755
index 00000000..1ea89f58
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/grade-system/wp-security-feature-item.php
@@ -0,0 +1,78 @@
+feature_id = $feature_id;
+ $this->feature_name = $feature_name;
+ $this->item_points = $item_points;
+ $this->security_level = $security_level;
+ $this->feature_options = $feature_options;
+ $this->callback = $callback;
+ }
+
+ /**
+ * This function will set the status of the feature
+ *
+ * @param string $status - the status of the feature
+ *
+ * @return void
+ */
+ public function set_feature_status($status) {
+ $this->feature_status = $status;
+ }
+
+ /**
+ * This function will return the string version of the level
+ *
+ * @return string - the string value of the level
+ */
+ public function get_security_level_string() {
+ $level_string = "";
+ if ("1" == $this->security_level) {
+ $level_string = __('Basic', 'all-in-one-wp-security-and-firewall');
+ } elseif ("2" == $this->security_level) {
+ $level_string = __('Intermediate', 'all-in-one-wp-security-and-firewall');
+ } elseif ("3" == $this->security_level) {
+ $level_string = __('Advanced', 'all-in-one-wp-security-and-firewall');
+ }
+ return $level_string;
+ }
+
+ /**
+ * This function will return a boolean to indicate if the feature is on or not
+ *
+ * @return boolean - true if the feature is on otherwise false
+ */
+ public function is_active() {
+ return ('active' == $this->feature_status);
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/index.html b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/index.html
new file mode 100755
index 00000000..e69de29b
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/index.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/index.php
new file mode 100755
index 00000000..a64ea405
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/index.php
@@ -0,0 +1,4 @@
+commands = new AIOWPSecurity_Commands();
+ }
+
+ /**
+ * Magic method to pass on the command to AIOWPSecurity_Commands
+ *
+ * @param string $name - command name
+ * @param array $arguments - command parameters
+ *
+ * @return array - response
+ */
+ public function __call($name, $arguments) {
+ if (!is_callable(array($this->commands, $name))) {
+ return $this->_generic_error_response('aios_no_such_command', $name);
+ }
+
+ $result = call_user_func_array(array($this->commands, $name), $arguments);
+
+ if (is_wp_error($result)) {
+ return $this->_generic_error_response($result->get_error_code(), $result->get_error_data());
+ } else {
+ return $this->_response($result);
+ }
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/updraftcentral.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/updraftcentral.php
new file mode 100755
index 00000000..8c0c0370
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/updraftcentral.php
@@ -0,0 +1,43 @@
+ 'REMOTE_ADDR',
+ '1' => 'HTTP_CF_CONNECTING_IP',
+ '2' => 'HTTP_X_FORWARDED_FOR',
+ '3' => 'HTTP_X_FORWARDED',
+ '4' => 'HTTP_CLIENT_IP',
+ '5' => 'HTTP_X_REAL_IP',
+ '6' => 'HTTP_X_CLUSTER_CLIENT_IP',
+ );
+ }
+
+ /**
+ * Get AIOS custom admin notice ids.
+ *
+ * @return array
+ */
+ public static function custom_admin_notice_ids() {
+ return array(
+ 'automated-database-backup',
+ 'ip-retrieval-settings',
+ 'load-firewall-resources-failed',
+ 'end-of-support-php-56',
+ );
+ }
+
+ /**
+ * Get notice ids for notices that have transformed HTACESS rules to PHP.
+ *
+ * @return array notice ids.
+ */
+ public static function htaccess_to_php_feature_notice_ids() {
+ return array(
+ 'login-whitelist-disabled-on-upgrade',
+ 'ip-blacklist-settings-on-upgrade',
+ 'upgrade-firewall-tab-rules',
+ );
+ }
+
+ /**
+ * Get locale codes that are more than 2 char long supported by Google ReCaptcha.
+ *
+ * @return array
+ */
+ public static function get_google_recaptcha_locale_codes() {
+ /**
+ * Google reCaptcha accepts 2 char language codes and also more than 2 char language codes.
+ * Most are 2 chars in length e.g. 'ar' for Arabic.
+ * Few are more than 2 char in length e.g 'de-AT' for German (Austria)
+ *
+ * Below is the list of more than 2 char language codes supported by Google reCaptcha.
+ * if determine_locale() detects any of the below we return it, otherwise,
+ * we would return the 2 letter code.
+ */
+ return array(
+ 'zh-HK', // Chinese (Hong Kong).
+ 'zh-CN', // Chinese (Simplified).
+ 'zh-TW', // Chinese (Traditional).
+ 'en-GB', // UK.
+ 'fr-CA', // French (Canadian).
+ 'de-AT', // German (Austria).
+ 'de-CH', // German (Switzerland).
+ 'pt-BR', // Portuguese (Brazil).
+ 'pt-PT', // Portuguese (Portugal).
+ );
+ }
+
+ /**
+ * Get IP Lookup services.
+ *
+ * @return array
+ */
+ public static function get_ip_lookup_services() {
+ return array(
+ 'ipify' => 'http://api.ipify.org/',
+ 'ipecho' => 'http://ipecho.net/plain',
+ 'ident' => 'http://ident.me',
+ 'tnedi' => 'http://tnedi.me',
+ );
+ }
+
+ /**
+ * Get Reverse IP Lookup services.
+ *
+ * @return array
+ */
+ public static function get_reverse_ip_lookup_services() {
+ return array(
+ 'ip-api' => 'http://ip-api.com/json/%s',
+ 'ipinfo' => 'https://ipinfo.io/%s/json'
+ );
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-ajax.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-ajax.php
new file mode 100755
index 00000000..6e459749
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-ajax.php
@@ -0,0 +1,253 @@
+commands_object = new AIOWPSecurity_Commands();
+
+ add_action('wp_ajax_aios_ajax', array($this, 'handle_ajax_requests'));
+ add_action('wp_ajax_nopriv_get_antibot_keys', array($this->commands_object, 'get_antibot_keys'));
+ }
+
+ /**
+ * Return singleton instance
+ *
+ * @return AIOWPSecurity_Ajax Returns AIOWPSecurity_Ajax object
+ */
+ public static function get_instance() {
+ static $instance = null;
+ if (null === $instance) {
+ $instance = new self();
+ }
+ return $instance;
+ }
+
+ /**
+ * Handles ajax requests
+ *
+ * @return void
+ */
+ public function handle_ajax_requests() {
+ $this->set_nonce();
+ $this->set_subaction();
+ $this->set_data();
+
+ $result = AIOWPSecurity_Utility_Permissions::check_nonce_and_user_cap($this->nonce, 'wp-security-ajax-nonce');
+ if (is_wp_error($result)) {
+ wp_send_json(array(
+ 'result' => false,
+ 'error_code' => $result->get_error_code(),
+ 'error_message' => $result->get_error_message(),
+ ));
+ }
+
+ if (is_multisite() && !current_user_can('manage_network_options')) {
+ if (!$this->is_valid_multisite_command()) {
+ $this->send_invalid_multisite_command_error_response();
+ }
+ }
+
+ if ($this->is_invalid_command()) {
+ $this->add_invalid_command_error_log_entry();
+ $this->set_invalid_command_error_response();
+ } else {
+ $this->execute_command();
+ $this->set_error_response_on_wp_error();
+ $this->maybe_set_results_as_null();
+ }
+
+ $this->json_encode_results();
+
+ $json_last_error = json_last_error();
+ if ($json_last_error) {
+ $this->set_error_response_on_json_encode_error($json_last_error);
+ }
+
+ echo $this->results; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Variable is an array containing escaped data.
+ die;
+ }
+
+ /**
+ * Sets nonce property value
+ *
+ * @return void
+ */
+ private function set_nonce() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput -- It's the actual nonce. It does not need sanitizing.
+ $this->nonce = empty($_POST['nonce']) ? '' : $_POST['nonce'];
+ }
+
+ /**
+ * Sets subaction property value
+ *
+ * @return void
+ */
+ private function set_subaction() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce already checked.
+ $this->subaction = empty($_POST['subaction']) ? '' : sanitize_text_field(wp_unslash($_POST['subaction']));
+ }
+
+ /**
+ * Sets data property value
+ *
+ * @return void
+ */
+ private function set_data() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce already checked.
+ $this->data = isset($_POST['data']) ? wp_unslash($_POST['data']) : null;
+ }
+
+ /**
+ * Checks whether it is multisite setup and command is valid multisite command
+ *
+ * @return bool
+ */
+ private function is_valid_multisite_command() {
+ /**
+ * Filters the commands allowed to the sub site admins. Other commands are only available to network admin. Only used in a multisite context.
+ */
+ $allowed_commands = apply_filters('aios_multisite_allowed_commands', array(
+ 'delete_audit_log',
+ 'delete_locked_ip_record',
+ 'clear_debug_logs',
+ 'unlock_ip',
+ 'blocked_ip_list_unblock_ip',
+ 'lock_ip',
+ 'dismiss_notice',
+ ));
+
+ return in_array($this->subaction, $allowed_commands);
+ }
+
+ /**
+ * Sends the invalid multisite command error response
+ *
+ * @return void
+ */
+ private function send_invalid_multisite_command_error_response() {
+ wp_send_json(array(
+ 'result' => false,
+ 'error_code' => 'update_failed',
+ 'error_message' => __('Options can only be saved by network admin', 'all-in-one-wp-security-and-firewall')
+ ));
+ }
+
+ /**
+ * Checks if applied ajax command is an invalid command or not
+ *
+ * @return bool Returns true if ajax command is an invalid command, false otherwise
+ */
+ private function is_invalid_command() {
+ return !is_callable(array($this->commands_object, $this->subaction));
+ }
+
+ /**
+ * Log an error message for invalid ajax command
+ *
+ * @return void
+ */
+ private function add_invalid_command_error_log_entry() {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Part of error reporting.
+ error_log("AIOS: ajax_handler: no such command (" . $this->subaction . ")");
+ }
+
+ /**
+ * Set `results` property with error response array for invalid ajax command
+ *
+ * @return void
+ */
+ private function set_invalid_command_error_response() {
+ $this->results = array(
+ 'result' => false,
+ 'error_code' => 'command_not_found',
+ /* translators: %s: Subaction */
+ 'error_message' => sprintf(__('The command "%s" was not found', 'all-in-one-wp-security-and-firewall'), $this->subaction)
+ );
+ }
+
+ /**
+ * Execute the ajax command
+ *
+ * @return void
+ */
+ private function execute_command() {
+ $this->results = call_user_func(array($this->commands_object, $this->subaction), $this->data);
+ }
+
+ /**
+ * Set `results` property with error message
+ *
+ * @return void
+ */
+ private function set_error_response_on_wp_error() {
+ if (is_wp_error($this->results)) {
+ $this->results = array(
+ 'result' => false,
+ 'error_code' => $this->results->get_error_code(),
+ 'error_message' => $this->results->get_error_message(),
+ 'error_data' => $this->results->get_error_data(),
+ );
+ }
+ }
+
+ /**
+ * Set `results` property to null, if it is not yet set
+ *
+ * @return void
+ */
+ private function maybe_set_results_as_null() {
+ // if nothing was returned for some reason, set as result null.
+ if (empty($this->results)) {
+ $this->results = array(
+ 'result' => null
+ );
+ }
+ }
+
+ /**
+ * Sets `results` property with json encode error
+ *
+ * @param int $json_last_error
+ *
+ * @return void
+ */
+ private function set_error_response_on_json_encode_error($json_last_error) {
+ $this->results = array(
+ 'result' => false,
+ 'error_code' => $json_last_error,
+ 'error_message' => 'json_encode error : ' . $json_last_error,
+ 'error_data' => '',
+ );
+
+ $this->results = wp_json_encode($this->results);
+ }
+
+ /**
+ * Json encode the `results` property value
+ *
+ * @return void
+ */
+ private function json_encode_results() {
+ $this->results = wp_json_encode($this->results);
+ }
+ }
+
+endif;
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-event-handler.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-event-handler.php
new file mode 100755
index 00000000..47a67c20
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-event-handler.php
@@ -0,0 +1,159 @@
+add_bulk_events($events);
+ }, 10, 4);
+ add_action('aiowps_clean_old_events', array($this, 'delete_old_events'), 10);
+
+ if (!wp_next_scheduled('aiowps_clean_old_events')) {
+ wp_schedule_event(time(), 'daily', 'aiowps_clean_old_events');
+ }
+
+ AIOWPSecurity_Audit_Events::add_event_actions();
+ }
+
+ /**
+ * This function records an event in the audit log
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ *
+ * @param string $event_type - the event type
+ * @param array $details - details about the event
+ * @param string $event_level - the event level
+ * @param string $username - the username, this is only used if there is no user logged in
+ *
+ * @return void
+ */
+ public function record_event($event_type, $details, $event_level = 'info', $username = '') {
+
+ if (!function_exists('wp_get_current_user')) {
+ global $aio_wp_security;
+
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Audit_Event_Handler::record_event() called before plugins_loaded hook has run.", 4);
+ return;
+ }
+
+ $record_event = apply_filters('aios_audit_log_record_event', true, $event_type, $details, $event_level, $username);
+
+ if (!$record_event) return;
+
+ $user = wp_get_current_user();
+ $username = (is_a($user, 'WP_User') && 0 !== $user->ID) ? $user->user_login : $username;
+ $ip = apply_filters('aios_audit_log_event_user_ip', AIOWPSecurity_Utility_IP::get_user_ip_address());
+ $data = apply_filters('aios_audit_log_event_user_country_code', array('ip' => $ip));
+ $country_code = isset($data['country_code']) ? $data['country_code'] : '';
+ $stacktrace = maybe_serialize(AIOWPSecurity_Utility::normalise_call_stack_args(debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS))); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace -- Required for the stacktrace to work.
+ $network_id = get_current_network_id();
+ $site_id = get_current_blog_id();
+ $details = wp_json_encode($details, true);
+
+ $this->add_new_event($network_id, $site_id, $username, $ip, $event_level, $event_type, $details, $stacktrace, $country_code);
+ }
+
+ /**
+ * This function adds the event to the audit log database table
+ *
+ * @param integer $network_id - the id of the current network
+ * @param integer $site_id - the id of the current site
+ * @param string $username - the username of the user who triggered the event
+ * @param string $ip - the IP address of the user
+ * @param string $event_level - the event level
+ * @param string $event_type - the event type
+ * @param string $details - details about the event
+ * @param string $stacktrace - the event stacktrace
+ * @param string $country_code - the country code
+ *
+ * @return void
+ */
+ private function add_new_event($network_id, $site_id, $username, $ip, $event_level, $event_type, $details, $stacktrace, $country_code) {
+ global $wpdb;
+
+ $wpdb->query($wpdb->prepare("INSERT INTO ".AIOWPSEC_TBL_AUDIT_LOG." (network_id, site_id, username, ip, level, event_type, details, stacktrace, created, country_code) VALUES (%d, %d, %s, %s, %s, %s, %s, %s, UNIX_TIMESTAMP(), %s)", $network_id, $site_id, $username, $ip, $event_level, $event_type, $details, $stacktrace, $country_code)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- We can't use %i because our plugin supports wordpress < 6.2.
+ }
+
+ /**
+ * This function adds multiple events to the audit log database table
+ *
+ * @param array $events - each event in the array must contain the keys (network_id, site_id, username, ip, level, event_type, details, stacktrace and created)
+ *
+ * @return void
+ */
+ private function add_bulk_events($events) {
+ global $wpdb;
+
+ $sql = "INSERT INTO ".AIOWPSEC_TBL_AUDIT_LOG." (network_id, site_id, username, ip, level, event_type, details, stacktrace, created, country_code) VALUES ";
+ $values = array();
+
+ foreach ($events as $event) {
+ $sql .= "(%d, %d, %s, %s, %s, %s, %s, %s, %d, %s),";
+
+ $record_event = apply_filters('aios_audit_log_record_event', true, $event['event_type'], $event['details'], $event['level'], $event['username']);
+ if (!$record_event) continue;
+
+ $event['ip'] = apply_filters('aios_audit_log_event_user_ip', $event['ip']);
+ $data = apply_filters('aios_audit_log_event_user_country_code', array('ip' => $event['ip']));
+ $event['country_code'] = isset($data['country_code']) ? $data['country_code'] : '';
+ $values[] = $event['network_id'];
+ $values[] = $event['site_id'];
+ $values[] = $event['username'];
+ $values[] = $event['ip'];
+ $values[] = $event['level'];
+ $values[] = $event['event_type'];
+ $values[] = $event['details'];
+ $values[] = $event['stacktrace'];
+ $values[] = $event['created'];
+ $values[] = $event['country_code'];
+ }
+
+ // remove last ',' character from query
+ $sql = rtrim($sql, ',');
+
+ $wpdb->query($wpdb->prepare($sql, $values)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- The sql query is being dynamically built.
+ }
+
+ /**
+ * This method will try to delete all audit logs older than 3 months from the database.
+ *
+ * @return void
+ */
+ public function delete_old_events() {
+ global $wpdb;
+
+ $after_days = 90;
+
+ if (defined('AIOWPSEC_PURGE_AUDIT_LOGS_AFTER_DAYS')) {
+ $after_days = abs(AIOWPSEC_PURGE_AUDIT_LOGS_AFTER_DAYS);
+ }
+
+ $after_days = empty($after_days) ? 90 : $after_days;
+ $older_than_date = strtotime("-{$after_days} days", time());
+
+ $wpdb->query($wpdb->prepare("DELETE FROM ".AIOWPSEC_TBL_AUDIT_LOG." WHERE created < %s", $older_than_date)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- We can't use %i because our plugin supports wordpress < 6.2.
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-events.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-events.php
new file mode 100755
index 00000000..1614470f
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-events.php
@@ -0,0 +1,641 @@
+ __('Core updated', 'all-in-one-wp-security-and-firewall'),
+ 'plugin_installed' => __('Plugin installed', 'all-in-one-wp-security-and-firewall'),
+ 'plugin_activated' => __('Plugin activated', 'all-in-one-wp-security-and-firewall'),
+ 'plugin_updated' => __('Plugin updated', 'all-in-one-wp-security-and-firewall'),
+ 'plugin_deactivated' => __('Plugin deactivated', 'all-in-one-wp-security-and-firewall'),
+ 'plugin_deleted' => __('Plugin deleted', 'all-in-one-wp-security-and-firewall'),
+ 'theme_installed' => __('Theme installed', 'all-in-one-wp-security-and-firewall'),
+ 'theme_activated' => __('Theme activated', 'all-in-one-wp-security-and-firewall'),
+ 'theme_updated' => __('Theme updated', 'all-in-one-wp-security-and-firewall'),
+ 'theme_deleted' => __('Theme deleted', 'all-in-one-wp-security-and-firewall'),
+ 'translation_updated' => __('Translation updated', 'all-in-one-wp-security-and-firewall'),
+ 'entity_changed' => __('Entity changed', 'all-in-one-wp-security-and-firewall'),
+ 'successful_login' => __('Successful login', 'all-in-one-wp-security-and-firewall'),
+ 'successful_logout' => __('Successful logout', 'all-in-one-wp-security-and-firewall'),
+ 'failed_login' => __('Failed login', 'all-in-one-wp-security-and-firewall'),
+ 'user_registration' => __('User registration', 'all-in-one-wp-security-and-firewall'),
+ 'user_deleted' => __('User deleted', 'all-in-one-wp-security-and-firewall'),
+ 'user_removed' => __('User removed from blog', 'all-in-one-wp-security-and-firewall'),
+ 'table_migration' => __('Table migration', 'all-in-one-wp-security-and-firewall'),
+ 'rule_triggered' => __('Rule triggered', 'all-in-one-wp-security-and-firewall'),
+ 'rule_not_triggered' => __('Rule not triggered', 'all-in-one-wp-security-and-firewall'),
+ 'rule_active' => __('Rule active', 'all-in-one-wp-security-and-firewall'),
+ 'rule_not_active' => __('Rule not active', 'all-in-one-wp-security-and-firewall'),
+ 'password_reset' => __('Password reset', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ /**
+ * Adds a core updated event to the audit log
+ *
+ * @param string $new_version - the wp version we updated to
+ *
+ * @return void
+ */
+ public static function core_updated($new_version) {
+ global $wp_version;
+
+ $details = array(
+ 'core_updated' => array(
+ 'old_version' => $wp_version,
+ 'new_version' => $new_version
+ )
+ );
+ do_action('aiowps_record_event', 'core_updated', $details, 'info');
+ }
+
+ /**
+ * Adds a plugin installed event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ * @param array $hook_extra - Array of bulk item update data
+ *
+ * @return void
+ */
+ public static function plugin_installed($upgrader, $hook_extra) {
+ // If this is empty then we have no way to know if this is a plugin/theme install/update so create an entity changed event
+ if (empty($hook_extra)) {
+ self::event_entity_changed($upgrader);
+ return;
+ }
+ if ('plugin' !== $hook_extra['type'] || 'install' !== $hook_extra['action']) return;
+ self::$installed_plugin_info = $upgrader->new_plugin_data;
+ self::event_plugin_changed('installed', '', '');
+ }
+
+ /**
+ * Adds a plugin activated event to the audit log
+ *
+ * @param string $plugin - Path to the plugin file relative to the plugins directory
+ * @param boolean $network_activation - Whether to enable the plugin for all sites in the network or just the current site
+ *
+ * @return void
+ */
+ public static function plugin_activated($plugin, $network_activation) {
+ $network = $network_activation ? 'network' : '';
+ self::event_plugin_changed('activated', $plugin, $network);
+ }
+
+ /**
+ * Adds a plugin updated event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ * @param array $hook_extra - Array of bulk item update data
+ *
+ * @return void
+ */
+ public static function plugin_updated($upgrader, $hook_extra) {
+ // If this is empty then we have no way to know if this is a plugin/theme install/update so return as we catch this in plugin_installed()
+ if (empty($hook_extra)) return;
+ if ('plugin' !== $hook_extra['type'] || 'update' !== $hook_extra['action']) return;
+ if (isset($hook_extra['plugin'])) {
+ $plugin = $hook_extra['plugin'];
+ self::event_plugin_changed('updated', $plugin, '');
+ } elseif (isset($hook_extra['plugins'])) {
+ foreach ($hook_extra['plugins'] as $plugin) {
+ self::event_plugin_changed('updated', $plugin, '');
+ }
+ }
+ }
+
+ /**
+ * Adds a plugin deactivated event to the audit log
+ *
+ * @param string $plugin - Path to the plugin file relative to the plugins directory
+ * @param boolean $network_deactivation - Whether to disable the plugin for all sites in the network or just the current site
+ *
+ * @return void
+ */
+ public static function plugin_deactivated($plugin, $network_deactivation) {
+ $network = $network_deactivation ? 'network' : '';
+ self::event_plugin_changed('deactivated', $plugin, $network, 'warning');
+ }
+
+ /**
+ * Records the plugin info of the plugin that is about to be deleted
+ *
+ * @param string $plugin - Path to the plugin file relative to the plugins directory
+ *
+ * @return void
+ */
+ public static function plugin_delete($plugin) {
+ $filename = WP_PLUGIN_DIR . '/' . $plugin;
+ if (!file_exists($filename)) return;
+
+ self::$removed_plugin_info = get_plugin_data($filename);
+ }
+
+ /**
+ * Adds a plugin deleted event to the audit log
+ *
+ * @param string $plugin - Path to the plugin file relative to the plugins directory
+ * @param boolean $deleted - Whether the plugin deletion was successful
+ *
+ * @return void
+ */
+ public static function plugin_deleted($plugin, $deleted) {
+ if ($deleted) self::event_plugin_changed('deleted', $plugin, '', 'warning');
+ }
+
+ /**
+ * This function will construct the event details and send it to be recorded
+ *
+ * @param string $action - the action taken (activated, deactivated)
+ * @param string $plugin - Path to the plugin file relative to the plugins directory
+ * @param string $network - status of if the plugin was network activated/deactivated
+ * @param string $level - the log level
+ *
+ * @return void
+ */
+ private static function event_plugin_changed($action, $plugin, $network, $level = 'info') {
+ if ('deleted' == $action) {
+ $info = self::$removed_plugin_info;
+ } elseif ('installed' == $action) {
+ $info = self::$installed_plugin_info;
+ } else {
+ $filename = WP_PLUGIN_DIR . '/' . $plugin;
+ if (!file_exists($filename)) return;
+ $info = get_plugin_data($filename);
+ }
+
+ $name = empty($info['Name']) ? 'Unknown' : $info['Name'];
+ $version = empty($info['Version']) ? '0.0.0' : $info['Version'];
+
+ $details = array(
+ 'plugin' => array(
+ 'name' => $name,
+ 'version' => $version,
+ 'action' => $action,
+ 'network' => $network
+ )
+ );
+ do_action('aiowps_record_event', 'plugin_' . $action, $details, $level);
+ }
+
+ /**
+ * Adds a theme installed event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ * @param array $hook_extra - Array of bulk item update data
+ *
+ * @return void
+ */
+ public static function theme_installed($upgrader, $hook_extra) {
+ // If this is empty then we have no way to know if this is a plugin/theme install/update so return as we catch this in plugin_installed()
+ if (empty($hook_extra)) return;
+ if ('theme' !== $hook_extra['type'] || 'install' !== $hook_extra['action']) return;
+ self::$installed_theme_info = $upgrader->new_theme_data;
+ self::event_theme_changed('installed', '', '');
+ }
+
+ /**
+ * Adds a theme activated event to the audit log
+ *
+ * @param string $new_name - Name of the new active theme
+ *
+ * @return void
+ */
+ public static function theme_activated($new_name) {
+ $details = array(
+ 'theme' => array(
+ 'name' => $new_name,
+ 'action' => 'activated',
+ )
+ );
+ do_action('aiowps_record_event', 'theme_activated', $details);
+ }
+
+ /**
+ * Adds a theme updated event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ * @param array $hook_extra - Array of bulk item update data
+ *
+ * @return void
+ */
+ public static function theme_updated($upgrader, $hook_extra) {
+ // If this is empty then we have no way to know if this is a plugin/theme install/update so return as we catch this in plugin_installed()
+ if (empty($hook_extra)) return;
+ if ('theme' !== $hook_extra['type'] || 'update' !== $hook_extra['action']) return;
+ if (isset($hook_extra['theme'])) {
+ $theme = $hook_extra['theme'];
+ self::event_theme_changed('updated', $theme, '');
+ } elseif (isset($hook_extra['themes'])) {
+ foreach ($hook_extra['themes'] as $theme) {
+ self::event_theme_changed('updated', $theme, '');
+ }
+ }
+ }
+
+ /**
+ * Records the theme info of the plugin that is about to be deleted
+ *
+ * @param string $theme - Path to the theme file relative to the themes directory
+ *
+ * @return void
+ */
+ public static function theme_delete($theme) {
+ $info_object = wp_get_theme($theme);
+ $info = array(
+ 'Name' => $info_object->get('Name'),
+ 'Version' => $info_object->get('Version'),
+ );
+ self::$removed_theme_info = $info;
+ }
+
+ /**
+ * Adds a theme deleted event to the audit log
+ *
+ * @param string $theme - Path to the theme file relative to the themes directory
+ * @param boolean $deleted - Whether the theme deletion was successful
+ *
+ * @return void
+ */
+ public static function theme_deleted($theme, $deleted) {
+ if ($deleted) self::event_theme_changed('deleted', $theme, '', 'warning');
+ }
+
+ /**
+ * This function will construct the event details and send it to be recorded
+ *
+ * @param string $action - the action taken (activated, deactivated)
+ * @param string $theme - Path to the theme file relative to the themes directory
+ * @param string $network - status of if the theme was network activated/deactivated
+ * @param string $level - the log level
+ *
+ * @return void
+ */
+ private static function event_theme_changed($action, $theme, $network, $level = 'info') {
+ if ('deleted' == $action) {
+ $info = self::$removed_theme_info;
+ } elseif ('installed' == $action) {
+ $info = self::$installed_theme_info;
+ } else {
+ $info_object = wp_get_theme($theme);
+ $info = array(
+ 'Name' => $info_object->get('Name'),
+ 'Version' => $info_object->get('Version'),
+ );
+ }
+
+ $name = empty($info['Name']) ? 'Unknown' : $info['Name'];
+ $version = empty($info['Version']) ? '0.0.0' : $info['Version'];
+
+ $details = array(
+ 'theme' => array(
+ 'name' => $name,
+ 'version' => $version,
+ 'action' => $action,
+ 'network' => $network
+ )
+ );
+ do_action('aiowps_record_event', 'theme_' . $action, $details, $level);
+ }
+
+ /**
+ * Adds a translation updated event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ * @param array $hook_extra - Array of bulk item update data
+ *
+ * @return void
+ */
+ public static function translation_updated($upgrader, $hook_extra) {
+
+ // If this is empty then we have no way to know if this is a plugin/theme/translation install/update so return as we catch this in plugin_installed()
+ if (empty($hook_extra)) return;
+
+ if ('translation' !== $hook_extra['type'] || 'update' !== $hook_extra['action']) return;
+
+ if (!isset($hook_extra['translations']) || empty($hook_extra['translations'])) return;
+
+ foreach ($hook_extra['translations'] as $info) {
+ $details = array(
+ 'translation_updated' => $info
+ );
+ do_action('aiowps_record_event', 'translation_updated', $details, 'info');
+ }
+ }
+
+ /**
+ * Adds a entity changed event to the audit log
+ *
+ * @param WP_Upgrader $upgrader - WP_Upgrader instance
+ *
+ * @return void
+ */
+ public static function event_entity_changed($upgrader) {
+
+ $entity = (isset($upgrader->result) && isset($upgrader->result['destination_name'])) ? $upgrader->result['destination_name'] : false;
+
+ $details = array(
+ 'entity_changed' => array(
+ 'entity' => $entity,
+ )
+ );
+ do_action('aiowps_record_event', 'entity_changed', $details, 'warning');
+ }
+
+ /**
+ * Adds all the firewall rule events to the audit log
+ *
+ * @return void
+ */
+ public static function rule_event() {
+ $aiowps_firewall_message_store = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::MESSAGE_STORE);
+ $events = array();
+ foreach (array('active', 'not_active', 'triggered', 'not_triggered') as $event) {
+ $data = $aiowps_firewall_message_store->get('rule_'.$event);
+
+ if (empty($data)) continue;
+
+ foreach ($data as $rule) {
+
+ $details = array(
+ 'firewall_event' => array(
+ 'event' => $event,
+ 'rule_name' => $rule['name'],
+ 'rule_family' => $rule['family'],
+ )
+ );
+
+ $blog_id = AIOWPSecurity_Utility::get_blog_id_from_request($rule['request']);
+
+ $rule['request'] = apply_filters('aios_audit_filter_request', $rule['request'], $event);
+
+ $events[] = array(
+ 'network_id' => get_current_network_id(),
+ 'site_id' => $blog_id,
+ 'username' => (isset($rule['potential_user']) ? AIOWPSecurity_Utility::verify_username($rule['potential_user']) : false),
+ 'ip' => $rule['ip'],
+ 'level' => 'triggered' === $event ? 'warning' : 'info',
+ 'event_type' => 'rule_'.$event,
+ 'details' => wp_json_encode($details, true),
+ 'stacktrace' => (isset($rule['request']) ? print_r($rule['request'], true) : ''), // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r -- PCP warning. Part of AOIS error reporting system.
+ 'created' => $rule['time']
+ );
+ }
+ }
+
+ if (empty($events)) return;
+
+ do_action('aiowps_bulk_record_events', $events);
+ }
+
+ /**
+ * Adds a password reset event to the audit log
+ *
+ * @param object $user_data - Object containing user's data
+ */
+ public static function password_reset($user_data) {
+
+ $user_login = (false === $user_data) ? 'unknown' : $user_data->user_login;
+
+ $details = array(
+ 'password_reset' => array(
+ 'user_login' => $user_login
+ )
+ );
+ do_action('aiowps_record_event', 'password_reset', $details, 'warning');
+ }
+
+ /**
+ * Adds a user deleted event to the audit log
+ *
+ * @param int $user_id - the id of the deleted user
+ * @param int|null $reassign - the id of the user to reassign data to or null
+ * @param object $user_data - Object containing user's data
+ *
+ * @return void
+ */
+ public static function user_deleted($user_id, $reassign, $user_data) {
+
+ $user_login = (false === $user_data) ? 'unknown' : $user_data->user_login;
+
+ $details = array(
+ 'user_deleted' => array(
+ 'user_id' => $user_id,
+ 'reassign' => $reassign,
+ 'user_login' => $user_login
+
+ )
+ );
+ do_action('aiowps_record_event', 'user_deleted', $details, 'warning');
+ }
+
+ /**
+ * Adds a user removed event to the audit log
+ *
+ * @param int $user_id - the id of the removed user
+ * @param int $blog_id - the id of the blog the user was removed from
+ * @param int $reassign - the id of the user to reassign data to or null
+ *
+ * @return void
+ */
+ public static function user_removed_from_blog($user_id, $blog_id, $reassign) {
+ $user_data = get_user_by('ID', $user_id);
+ $user_login = is_a($user_data, 'WP_User') && 0 !== $user_data->ID ? $user_data->user_login : 'unknown';
+
+ $details = array(
+ 'user_removed' => array(
+ 'user_id' => $user_id,
+ 'blog_id' => $blog_id,
+ 'reassign' => $reassign,
+ 'user_login' => $user_login
+
+ )
+ );
+ do_action('aiowps_record_event', 'user_removed', $details, 'warning');
+ }
+
+ /**
+ * Adds a failed login event to the audit log
+ *
+ * @param string $username - the username for the failed login attempt
+ *
+ * @return void
+ */
+ public static function event_failed_login($username) {
+ $user = is_email($username) ? get_user_by('email', $username) : get_user_by('login', $username);
+ $details = array(
+ 'failed_login' => array(
+ 'imported' => false,
+ 'username' => $username,
+ 'known' => true,
+ )
+ );
+ if (is_a($user, 'WP_User')) {
+ do_action('aiowps_record_event', 'failed_login', $details, 'warning', $username);
+ } else {
+ $details['failed_login']['known'] = false;
+ do_action('aiowps_record_event', 'failed_login', $details, 'warning', $username);
+ }
+ }
+
+ /**
+ * Adds a user registration event to the audit log
+ *
+ * @param integer $user_id - the user ID of the newly registered user
+ * @param string $type - the type of registration valid values (admin, pending, registered)
+ *
+ * @return void
+ */
+ public static function event_user_registration($user_id, $type) {
+ $registered_user = get_user_by('ID', $user_id);
+ $registered_username = is_a($registered_user, 'WP_User') && 0 !== $registered_user->ID ? $registered_user->user_login : '';
+
+ $details = array(
+ 'user_registration' => array(
+ 'registered_username' => $registered_username,
+ 'type' => $type,
+ )
+ );
+
+ if ('admin' == $type) {
+ $admin_user = wp_get_current_user();
+ $admin_username = is_a($admin_user, 'WP_User') ? $admin_user->user_login : '';
+ $details['user_registration']['admin_username'] = $admin_username;
+ do_action('aiowps_record_event', 'user_registration', $details, 'info');
+ } elseif ('pending' == $type) {
+ do_action('aiowps_record_event', 'user_registration', $details, 'info', $registered_username);
+ } elseif ('registered' == $type) {
+ do_action('aiowps_record_event', 'user_registration', $details, 'info', $registered_username);
+ }
+ }
+
+ /**
+ * Adds a successful login event to the audit log
+ *
+ * @param string $username - the username for the successful login
+ *
+ * @return void
+ */
+ public static function event_successful_login($username) {
+ $details = array(
+ 'successful_login' => array(
+ 'username' => $username,
+ )
+ );
+ do_action('aiowps_record_event', 'successful_login', $details, 'info', $username);
+ }
+
+ /**
+ * Adds a successful logout event to the audit log
+ *
+ * @param string $username - the username for the successful logout
+ * @param boolean $force_logout - if the logout was a force logout
+ *
+ * @return void
+ */
+ public static function event_successful_logout($username, $force_logout = false) {
+ $details = array(
+ 'successful_logout' => array(
+ 'username' => $username,
+ 'force_logout' => $force_logout ? __('(force logout)', 'all-in-one-wp-security-and-firewall') : ''
+ )
+ );
+ do_action('aiowps_record_event', 'successful_logout', $details, 'info', $username);
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-text-handler.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-text-handler.php
new file mode 100755
index 00000000..8b1dec19
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-audit-text-handler.php
@@ -0,0 +1,238 @@
+ $info['event'],
+ 'rule_name' => $info['rule_name'],
+ 'rule_family' => $info['rule_family'],
+ );
+ break;
+ }
+
+ // Add a link to the rule, if present
+ if (isset($info['location'])) {
+ $output .= "".__('Configure this rule', 'all-in-one-wp-security-and-firewall').''; + } + + return is_array($output) ? wp_json_encode($output) : $output; + } + + /** + * Return the text version of 'password_reset' event + * + * @param array $info + * @return string + */ + public static function password_reset_to_text($info) { + /* translators: %s: User login */ + return sprintf(__('Password for user account: `%s` successfully changed', 'all-in-one-wp-security-and-firewall'), $info['user_login']); + } + + /** + * Return the text version of 'user_deleted' event + * + * @param array $info + * @return string + */ + public static function user_deleted_to_text($info) { + if (empty($info['reassign'])) { + /* translators: 1: User login, 2: User ID */ + return sprintf(__('User account: %1$s with ID: `%2$s` has been deleted', 'all-in-one-wp-security-and-firewall'), $info['user_login'], $info['user_id']); + } else { + /* translators: 1: User login, 2: User ID, 3: Reassign */ + return sprintf(__('User account: `%1$s` with ID: `%2$s` has been deleted and all content has been reassigned to user with ID: `%3$s`', 'all-in-one-wp-security-and-firewall'), $info['user_login'], $info['user_id'], $info['reassign']); + } + } + + /** + * Return the text version of 'user_removed' event + * + * @param array $info + * @return string + */ + public static function user_removed_to_text($info) { + if (empty($info['reassign'])) { + /* translators: 1: User login, 2: User ID, 3: Blog ID */ + return sprintf(__('User account: %1$s with ID: `%2$s` has been removed from the blog with ID: `%3$s`', 'all-in-one-wp-security-and-firewall'), $info['user_login'], $info['user_id'], $info['blog_id']); + } else { + /* translators: 1: User login, 2: User ID, 3: Blog ID, 4: Reassign */ + return sprintf(__('User account: `%1$s` with ID: `%2$s` has been removed from the blog with ID: `%3$s` and all content has been reassigned to user with ID: `%4$s`', 'all-in-one-wp-security-and-firewall'), $info['user_login'], $info['user_id'], $info['blog_id'], $info['reassign']); + } + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-base-tasks.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-base-tasks.php new file mode 100755 index 00000000..c5935336 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-base-tasks.php @@ -0,0 +1,43 @@ +get_col("SELECT blog_id FROM $wpdb->blogs"); + foreach ($blog_ids as $blog_id) { + switch_to_blog($blog_id); + static::run_for_a_site(); + restore_current_blog(); + } + } else { + static::run_for_a_site(); + } + } + + /** + * Run uninstallation task for a single site. + * + * This method must be implemented in child classes. + * Since static abstract methods are not allowed in PHP, we enforce it at runtime. + * + * @throws Exception If not overridden in a child class. + * @return void + */ + protected static function run_for_a_site() { + throw new Exception( + sprintf('%s : Child classes must implement run_for_a_site() method.', get_called_class()) + ); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-block-bootstrap.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-block-bootstrap.php new file mode 100755 index 00000000..ca57abef --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-block-bootstrap.php @@ -0,0 +1,207 @@ +file_path); + + if (!isset($info['dirname'])) { + return new WP_Error( + 'file_no_directory', + 'No directory has been set', + $this->file_path + ); + } + + // phpcs:disable WordPress.WP.AlternativeFunctions -- wp_filesystem not recommended for firewall. + if (!is_writable($info['dirname'])) { + return new WP_Error( + 'file_directory_not_writable', + 'The directory has incorrect write permissions. Please double check its permissions and try again.', + $info['dirname'] + ); + } + + return (false !== @file_put_contents($this->file_path, $this->get_contents())); // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged -- ignore this + // phpcs:enable WordPress.WP.AlternativeFunctions -- wp_filesystem not recommended for firewall. + } + + /** + * Checks whether the bootstrap contents are valid + * + * @param string $contents + * @return boolean + */ + protected function is_content_valid($contents) { + + //Ensure we're using the correct version of the file + $version = $this->get_bootstrap_version(); + + if (false === $version) return false; + + if ($version['full_version'] !== $this->version) return false; + + //Ensure the required paths are valid + $regexes = array('/file_exists\((?
'; + $cap_form .= '
';
+ $maths_question_output = $aio_wp_security->captcha_obj->generate_maths_question($maths_captcha_input_id);
+ $cap_form .= $maths_question_output . '
';
+
+ $cust_html_code .= $cap_form;
+ return $cust_html_code;
+ break;
+ default:
+ return '';
+ break;
+ }
+ }
+
+ /**
+ * Inserts captcha into the password-protected page form.
+ *
+ * @param string $cust_html_code The HTML code for the password form.
+ * @return string The modified HTML code with the captcha inserted.
+ */
+ public function insert_captcha_password_protected($cust_html_code) {
+ global $post, $aio_wp_security;
+
+ $loginurl = esc_url(site_url('/wp-login.php?action=postpass'));
+
+ $label = 'pwbox-' . empty($post->ID) ? rand() : $post->ID;
+ $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha');
+
+ $cust_html_code = '
+
+
';
+ return $cust_html_code;
+ }
+
+ /**
+ * Validates the password form on password protected pages with captcha.
+ *
+ * @return void
+ */
+ public function validate_password_protected_password_form_with_captcha() {
+ // Check password protected page captcha
+ $verify = $this->verify_captcha_submit();
+ if (!$verify) {
+ wp_die(__('Captcha verification failed.', 'all-in-one-wp-security-and-firewall'). ' ' . __('Please try again.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ /**
+ * Insert CAPTCHA question form on WooCommerce my account page forms or other forms.
+ *
+ * This function determines the type of CAPTCHA to display based on the configured default CAPTCHA type.
+ * It handles special cases for WooCommerce "my account" page where both login and register forms need
+ * CAPTCHAs rendered explicitly. For other forms, it renders CAPTCHA normally.
+ *
+ * @global object $aio_wp_security The global instance of the aio_wp_security class, which holds configuration settings.
+ *
+ * @return void
+ */
+ public function insert_captcha_question_form() {
+ global $aio_wp_security;
+
+ $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha');
+
+ switch ($default_captcha) {
+ case 'cloudflare-turnstile':
+ case 'google-recaptcha-v2':
+ // WooCommerce "my account" page needs special consideration, ie,
+ // need to display two CAPTCHA forms on same page (for login and register forms)
+ // For this case we use the "explicit" CAPTCHA display
+ $calling_hook = current_filter();
+ if ('woocommerce_login_form' == $calling_hook || 'woocommerce_lostpassword_form' == $calling_hook || 'woocommerce_after_checkout_billing_form' == $calling_hook) {
+ $this->get_captcha_form($default_captcha, 1);
+ return;
+ }
+
+ if ('woocommerce_register_form' == $calling_hook) {
+ $this->get_captcha_form($default_captcha, 1);
+ return;
+ }
+
+ // For all other forms simply display CAPTCHA as normal
+ $this->display_captcha_form($default_captcha);
+ break;
+ case 'simple-math':
+ // Display plain maths CAPTCHA form
+ $this->display_captcha_form($default_captcha);
+ break;
+ default:
+ break;
+ }
+ }
+
+ /**
+ * For WooCommerce my account page - display two separate CAPTCHA forms "explicitly"
+ *
+ * @return void
+ */
+ public function print_captcha_api_woo() {
+ global $aio_wp_security;
+
+
+ //captcha should only show for woo account and checkout page
+ if ((function_exists('is_account_page') && !is_account_page()) && (function_exists('is_checkout') && !is_checkout()) && !apply_filters('aios_print_captcha_api_woo', false)) return;
+
+ $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha');
+
+ if ('cloudflare-turnstile' == $default_captcha) :
+ $site_key = esc_html($aio_wp_security->configs->get_value('aiowps_turnstile_site_key'));
+ ?>
+
+ configs->get_value('aiowps_recaptcha_site_key'));
+ ?>
+
+
+ configs->get_value('aiowps_enable_bp_register_captcha') == '1' && defined('BP_VERSION')) {
+ //if buddy press feature active add action hook so buddy press can display our errors properly on bp registration form
+ do_action('bp_aiowps-captcha-answer_errors');
+ }
+
+ switch ($default_captcha) {
+ case 'cloudflare-turnstile':
+ if ('1' == $aio_wp_security->configs->get_value('aios_cloudflare_turnstile_invalid_configuration')) return;
+ if ($return_instead_of_echo) return $this->get_captcha_form($default_captcha, 0, $return_instead_of_echo);
+ $this->get_captcha_form($default_captcha);
+ break;
+ case 'google-recaptcha-v2':
+ if ('1' == $aio_wp_security->configs->get_value('aios_google_recaptcha_invalid_configuration')) return;
+ if ($return_instead_of_echo) return $this->get_captcha_form($default_captcha, 0, $return_instead_of_echo);
+ $this->get_captcha_form($default_captcha);
+ break;
+ case 'simple-math':
+ $maths_captcha_input_id = uniqid('aiowps-captcha-answer-'); // Generate a unique DOM-safe ID for the maths captcha input field to avoid duplicate IDs (when multiple forms appear on the same page).
+ $cap_form = '';
+ if ($return_instead_of_echo) return $cap_form;
+ echo $cap_form;
+ break;
+ }
+ }
+
+ /**
+ * It generates a random math problem, stores the answer in the database, and returns the math problem
+ *
+ * @param string $maths_captcha_input_id A unique identifier used for the captcha input field's ID attribute to prevent duplicate IDs in the DOM (e.g., when multiple forms exist on a page).
+ *
+ * @return string - contains the HTML for the captcha.
+ */
+ private function generate_maths_question($maths_captcha_input_id) {
+ global $aio_wp_security;
+ //For now we will only do plus, minus, multiplication
+ $equation_string = '';
+ $operator_type = array('+', '−', '×');
+
+ $operand_display = array('word', 'number');
+
+ //let's now generate an equation
+ $operator = $operator_type[rand(0, 2)];
+
+ if ('×' === $operator) {
+ //Don't make the question too hard if multiplication
+ $first_digit = rand(1, 5);
+ $second_digit = rand(1, 5);
+ } else {
+ $first_digit = rand(1, 20);
+ $second_digit = rand(1, 20);
+ }
+
+ if ('word' == $operand_display[rand(0, 1)]) {
+ $first_operand = $this->number_word_mapping($first_digit);
+ } else {
+ $first_operand = $first_digit;
+ }
+
+ if ('word' == $operand_display[rand(0, 1)]) {
+ $second_operand = $this->number_word_mapping($second_digit);
+ } else {
+ $second_operand = $second_digit;
+ }
+
+ //Let's calculate the result and construct the equation string
+ if ('+' === $operator) {
+ //Addition
+ $result = $first_digit+$second_digit;
+ $equation_string .= $first_operand . ' ' . $operator . ' ' . $second_operand . ' = ';
+ } elseif ('−' === $operator) {
+ //Subtraction
+ //If we are going to be negative let's swap operands around
+ if ($first_digit < $second_digit) {
+ $equation_string .= $second_operand . ' ' . $operator . ' ' . $first_operand . ' = ';
+ $result = $second_digit-$first_digit;
+ } else {
+ $equation_string .= $first_operand . ' ' . $operator . ' ' . $second_operand . ' = ';
+ $result = $first_digit-$second_digit;
+ }
+ } elseif ('×' === $operator) {
+ //Multiplication
+ $equation_string .= $first_operand . ' ' . $operator . ' ' . $second_operand . ' = ';
+ $result = $first_digit*$second_digit;
+ }
+
+ //Let's encode correct answer
+ $captcha_secret_string = $aio_wp_security->configs->get_value('aiowps_captcha_secret_key');
+ $current_time = time();
+ $enc_result = base64_encode($current_time.$captcha_secret_string.$result);
+ $random_str = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(10);
+ if (is_multisite()) {
+ update_site_option('aiowps_captcha_string_info_'.$random_str, $enc_result);
+ update_site_option('aiowps_captcha_string_info_time_'.$random_str, $current_time);
+ } else {
+ update_option('aiowps_captcha_string_info_'.$random_str, $enc_result, false);
+ update_option('aiowps_captcha_string_info_time_'.$random_str, $current_time, false);
+ }
+ $equation_string .= '';
+ $equation_string .= '';
+ $equation_string .= '';
+ return $equation_string;
+ }
+
+ /**
+ * This function takes a number and returns the word that represents that number
+ *
+ * @param integer $num - the number we want to map to a word
+ *
+ * @return string - the mapped word
+ */
+ private function number_word_mapping($num) {
+ $number_map = array(
+ 1 => __('one', 'all-in-one-wp-security-and-firewall'),
+ 2 => __('two', 'all-in-one-wp-security-and-firewall'),
+ 3 => __('three', 'all-in-one-wp-security-and-firewall'),
+ 4 => __('four', 'all-in-one-wp-security-and-firewall'),
+ 5 => __('five', 'all-in-one-wp-security-and-firewall'),
+ 6 => __('six', 'all-in-one-wp-security-and-firewall'),
+ 7 => __('seven', 'all-in-one-wp-security-and-firewall'),
+ 8 => __('eight', 'all-in-one-wp-security-and-firewall'),
+ 9 => __('nine', 'all-in-one-wp-security-and-firewall'),
+ 10 => __('ten', 'all-in-one-wp-security-and-firewall'),
+ 11 => __('eleven', 'all-in-one-wp-security-and-firewall'),
+ 12 => __('twelve', 'all-in-one-wp-security-and-firewall'),
+ 13 => __('thirteen', 'all-in-one-wp-security-and-firewall'),
+ 14 => __('fourteen', 'all-in-one-wp-security-and-firewall'),
+ 15 => __('fifteen', 'all-in-one-wp-security-and-firewall'),
+ 16 => __('sixteen', 'all-in-one-wp-security-and-firewall'),
+ 17 => __('seventeen', 'all-in-one-wp-security-and-firewall'),
+ 18 => __('eighteen', 'all-in-one-wp-security-and-firewall'),
+ 19 => __('nineteen', 'all-in-one-wp-security-and-firewall'),
+ 20 => __('twenty', 'all-in-one-wp-security-and-firewall'),
+ );
+ return $number_map[$num];
+ }
+
+ /**
+ * This function will return the CAPTCHA script URL
+ *
+ * @param string $default_captcha - the default CAPTCHA
+ *
+ * @return string - the CAPTCHA script URL
+ */
+ private function get_captcha_script_url($default_captcha) {
+ $url = '';
+ switch ($default_captcha) {
+ case 'cloudflare-turnstile':
+ $url = 'https://challenges.cloudflare.com/turnstile/v0/api.js';
+ break;
+ case 'google-recaptcha-v2':
+ $url = 'https://www.google.com/recaptcha/api.js?hl=' . $this->get_google_recaptcha_compatible_site_locale();
+ break;
+ default:
+ break;
+ }
+
+ return $url;
+ }
+
+ /**
+ * This function will return the CAPTCHA form
+ *
+ * @param string $default_captcha - the default CAPTCHA
+ * @param integer $include_wc_id - the WooCommerce form id to include, if 0 no id is included if 1 dynamic id included
+ * @param boolean $return_instead_of_echo - if we should return the form rather than echo it to page
+ *
+ * @return string - can return the CAPTCHA form
+ */
+ public function get_captcha_form($default_captcha, $include_wc_id = 0, $return_instead_of_echo = false) {
+ global $aio_wp_security;
+ static $aios_wc_element_id;
+ $captcha_form = '';
+ $captcha_data_callback = '';
+ $wc_form_id = !empty($include_wc_id) ? 'id="woo_recaptcha_'.(++$aios_wc_element_id).'"' : '';
+ $captcha_data_callback = apply_filters('aios_captcha_data_callback', false) ? ' data-callback="data_callback"' : '';
+
+ switch ($default_captcha) {
+ case 'cloudflare-turnstile':
+ $site_key = esc_html($aio_wp_security->configs->get_value('aiowps_turnstile_site_key'));
+ $turnstile_theme = esc_html($aio_wp_security->configs->get_value('aiowps_turnstile_theme'));
+ if (empty($turnstile_theme)) $turnstile_theme = 'auto';
+ $captcha_form = '';
+ break;
+ case 'google-recaptcha-v2':
+ $site_key = esc_html($aio_wp_security->configs->get_value('aiowps_recaptcha_site_key'));
+ $captcha_form = '
';
+ break;
+ default:
+ return '';
+ break;
+ }
+
+ if ($return_instead_of_echo) return $captcha_form;
+ echo $captcha_form;
+ }
+
+ /**
+ * Verifies the math or Google reCAPTCHA v2 forms
+ * Returns TRUE if correct answer.
+ * Returns FALSE on wrong CAPTCHA result or missing data.
+ *
+ * @return boolean
+ */
+ public function verify_captcha_submit() {
+ global $aio_wp_security;
+
+ $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha');
+
+ switch ($default_captcha) {
+ case 'cloudflare-turnstile':
+ // Cloudflare Turnstile enabled
+ if ('1' == $aio_wp_security->configs->get_value('aios_cloudflare_turnstile_invalid_configuration')) return true;
+
+ // Expected CAPTCHA field in $_POST but got none!
+ if (!array_key_exists('cf-turnstile-response', $_POST)) return false;
+
+ $cf_turnstile_response = isset($_POST['cf-turnstile-response']) ? stripslashes($_POST['cf-turnstile-response']) : '';
+ $verify_captcha = $this->verify_turnstile_recaptcha($cf_turnstile_response);
+ return $verify_captcha;
+ break;
+ case 'google-recaptcha-v2':
+ // Google reCAPTCHA enabled
+ if ('1' == $aio_wp_security->configs->get_value('aios_google_recaptcha_invalid_configuration')) return true;
+
+ // Expected CAPTCHA field in $_POST but got none!
+ if (!array_key_exists('g-recaptcha-response', $_POST)) return false;
+
+ $g_recaptcha_response = isset($_POST['g-recaptcha-response']) ? stripslashes($_POST['g-recaptcha-response']) : '';
+ $verify_captcha = $this->verify_google_recaptcha($g_recaptcha_response);
+ return $verify_captcha;
+ break;
+ case 'simple-math':
+ // Math CAPTCHA is enabled
+ if (!array_key_exists('aiowps-captcha-answer', $_POST)) return false;
+ $captcha_answer = isset($_POST['aiowps-captcha-answer']) ? stripslashes($_POST['aiowps-captcha-answer']) : '';
+
+ $verify_captcha = $this->verify_math_captcha_answer($captcha_answer);
+ return $verify_captcha;
+ break;
+ default:
+ return true;
+ break;
+ }
+ }
+
+ /**
+ * Verifies the math CAPTCHA answer entered by the user
+ *
+ * @param type $captcha_answer
+ *
+ * @return boolean
+ */
+ private function verify_math_captcha_answer($captcha_answer = '') {
+ global $aio_wp_security;
+ $captcha_secret_string = $aio_wp_security->configs->get_value('aiowps_captcha_secret_key');
+ $captcha_temp_string = sanitize_text_field($_POST['aiowps-captcha-temp-string']);
+ $submitted_encoded_string = base64_encode($captcha_temp_string.$captcha_secret_string.$captcha_answer);
+ $trans_handle = sanitize_text_field($_POST['aiowps-captcha-string-info']);
+ if (is_multisite()) {
+ $captcha_string_info_option = get_site_option('aiowps_captcha_string_info_'.$trans_handle);
+ } else {
+ $captcha_string_info_option = get_option('aiowps_captcha_string_info_'.$trans_handle);
+ }
+ if ($submitted_encoded_string === $captcha_string_info_option) {
+ return true;
+ } else {
+ return false; // wrong answer was entered
+ }
+ }
+
+ /**
+ * Send a query to Cloudflare API to verify Turnstile submission
+ *
+ * @param string $resp_token
+ *
+ * @return boolean
+ */
+ private function verify_turnstile_recaptcha($resp_token = '') {
+ global $aio_wp_security;
+
+ $url = $this->cloudflare_verify_turnstile_url;
+ $secret = $aio_wp_security->configs->get_value('aiowps_turnstile_secret_key');
+ return $this->verify_captcha_response($url, $secret, $resp_token);
+ }
+
+ /**
+ * Send a query to Google API to verify reCAPTCHA submission
+ *
+ * @param string $resp_token
+ *
+ * @return boolean
+ */
+ private function verify_google_recaptcha($resp_token = '') {
+ global $aio_wp_security;
+
+ $url = $this->google_verify_recaptcha_url;
+ $secret = $aio_wp_security->configs->get_value('aiowps_recaptcha_secret_key');
+ return $this->verify_captcha_response($url, $secret, $resp_token);
+ }
+
+ /**
+ * This function sends a remote request to verify the captcha response.
+ *
+ * @param string $url - The URL to the CAPTCHA API.
+ * @param string $secret - The secret key you got from the CAPTCHA provider.
+ * @param string $resp_token - The value of the CAPTCHA response form field.
+ *
+ * @return boolean - true if valid otherwise false
+ */
+ private function verify_captcha_response($url, $secret, $resp_token) {
+
+ $is_humanoid = false;
+
+ if (empty($resp_token)) return $is_humanoid;
+
+ $ip_address = AIOWPSecurity_Utility_IP::get_user_ip_address();
+ $response = wp_safe_remote_post($url, array(
+ 'body' => array(
+ 'secret' => $secret,
+ 'response' => $resp_token,
+ 'remoteip' => $ip_address,
+ ),
+ ));
+
+ if (wp_remote_retrieve_response_code($response) != 200) return $is_humanoid;
+
+ $response = wp_remote_retrieve_body($response);
+ $response = json_decode($response, true);
+
+ if (isset($response['success']) && true == $response['success']) $is_humanoid = true;
+
+ // We did not get a success response so check for the "timeout-or-duplicate" error code because it's possible we have sent this request a second time if another plugin has recalled the WP authentication code and this error code means the captcha has already been solved so return success
+ if (isset($response['error-codes']) && in_array('timeout-or-duplicate', $response['error-codes'])) $is_humanoid = true;
+
+ return $is_humanoid;
+ }
+
+ /**
+ * Get site locale code for Google reCaptcha.
+ *
+ * @return string The site locale code.
+ */
+ private function get_google_recaptcha_compatible_site_locale() {
+ $google_recaptcha_locale_codes = AIOS_Abstracted_Ids::get_google_recaptcha_locale_codes();
+ $locale = str_replace('_', '-', determine_locale());
+
+ if (in_array($locale, $google_recaptcha_locale_codes, true)) {
+ return $locale;
+ }
+
+ // Return 2 letter locale code.
+ $locale = explode('-', $locale);
+ return $locale[0];
+ }
+
+ /**
+ * Verify Cloudflare Turnstile configuration.
+ *
+ * @param String $site_key
+ * @param String $secret_key
+ *
+ * @return Boolean
+ */
+ public function cloudflare_turnstile_verify_configuration($site_key, $secret_key) {
+ if (empty($site_key) || empty($secret_key)) return false;
+ return true;
+ }
+
+ /**
+ * Verify Google reCAPTCHA configuration.
+ *
+ * @param String $site_key
+ * @param String $secret_key
+ *
+ * @return Boolean
+ */
+ public function google_recaptcha_verify_configuration($site_key, $secret_key) {
+ $site_key_verify_params = array('k' => $site_key, 'size' => 'checkbox');
+ $site_key_verify_url = esc_url(add_query_arg($site_key_verify_params, 'https://www.google.com/recaptcha/api2/anchor'));
+ $site_key_verify_response_body = wp_remote_retrieve_body(wp_remote_get($site_key_verify_url));
+
+ $secret_key_verify_params = array('secret' => $secret_key);
+ $secret_key_verify_url = esc_url(add_query_arg($secret_key_verify_params, $this->google_verify_recaptcha_url));
+ $secret_key_verify_response_body = wp_remote_retrieve_body(wp_remote_get($secret_key_verify_url));
+ $secret_key_verify_json = json_decode($secret_key_verify_response_body, true);
+
+ if (false !== strpos($site_key_verify_response_body, 'Invalid site key') || is_null($secret_key_verify_json) || (isset($secret_key_verify_json['error-codes']) && in_array('invalid-input-secret', $secret_key_verify_json['error-codes']))) {
+ return false;
+ } else {
+ return true;
+ }
+ }
+
+ /**
+ * This function adds captcha to contact form 7
+ *
+ * @param array $form_properties - this is the array containing properties for the form
+ *
+ * @return array $form_properties - containing the edited form with the captcha if everything is set
+ */
+ public function add_contact_form_7_captcha($form_properties) {
+ global $aio_wp_security;
+
+ if (!class_exists('WPCF7_RECAPTCHA') || is_admin()) return $form_properties; // if wpc7_recaptcha does not exist or the call is from the admin page
+
+ $recaptcha_service = WPCF7_RECAPTCHA::get_instance();
+
+ // if recaptcha is active return form
+ if ($recaptcha_service->is_active()) return $form_properties;
+
+ $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha');
+
+ // check if default captcha configuration is correct
+ if (!$this->verify_captcha_configuration($default_captcha)) {
+ $aio_wp_security->debug_logger->log_debug("The captcha $default_captcha is not correctly configured", 4);
+ return $form_properties;
+ }
+ $form = isset($form_properties['form']) ? $form_properties['form'] : '';
+ if (empty($form)) return $form_properties;
+
+ // enqueue script
+ wp_enqueue_script($default_captcha, $this->get_captcha_script_url($default_captcha), array());
+
+ $field = $this->display_captcha_form($default_captcha, true);
+ $field .= ""; // add validation field for the captcha
+ $captcha_shortcode = sprintf('[%s]', AIOWPSEC_CAPTCHA_SHORTCODE);
+
+ if (false !== strpos($form, $captcha_shortcode)) {
+ $replacement_string = $captcha_shortcode;
+ } else {
+ $replacement_string = '[submit';
+ // if shortcode doesn't exist in form then use the submit button as placement for the captcha
+ if (false !== stripos($form, $replacement_string)) {
+ $field .= $replacement_string;
+ } else {
+ $pattern = '/
+
+
+
+
+
+ verify_captcha_submit()) {
+ $errors[] = sprintf(__('%s: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'), '' . __('ERROR', 'all-in-one-wp-security-and-firewall') . '');
+ }
+
+ return $errors;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cleanup.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cleanup.php
new file mode 100755
index 00000000..f3345fd8
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cleanup.php
@@ -0,0 +1,48 @@
+aiowps_feature_mgr)) return true;
+
+ $this->aiowps_feature_mgr = new AIOWPSecurity_Feature_Item_Manager();
+
+ $initialized = true;
+
+ return true;
+ }
+
+ /**
+ * Retrieves the feature manager object.
+ *
+ * This method initializes the feature manager if necessary and returns the
+ * AIOWPSecurity_Feature_Item_Manager instance. If the initialization fails or
+ * the feature manager object is empty, it returns a WP_Error.
+ *
+ * @return AIOWPSecurity_Feature_Item_Manager|WP_Error
+ */
+ private function get_feature_mgr_object() {
+
+ $do_init = $this->feature_mgr_init();
+
+ if (true === $do_init && !empty($this->aiowps_feature_mgr)) return $this->aiowps_feature_mgr;
+
+ return new WP_Error('not_initialized', __('The feature item manager could not be initialized.', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ /**
+ * Get IP address of given method.
+ *
+ * @param array $data - the request data
+ *
+ * @return array|WP_Error - an array response or a WP_Error if there was an error
+ */
+ public function get_ip_address_of_given_method($data) {
+ $ip_method_id = $data['ip_retrieve_method'];
+ $ip_retrieve_methods = AIOS_Abstracted_Ids::get_ip_retrieve_methods();
+ if (isset($ip_retrieve_methods[$ip_method_id])) {
+ return array(
+ 'ip_address' => isset($_SERVER[$ip_retrieve_methods[$ip_method_id]]) ? sanitize_text_field(wp_unslash($_SERVER[$ip_retrieve_methods[$ip_method_id]])) : '',
+ );
+ } else {
+ return new WP_Error('aios-invalid-ip-retrieve-method', __('Invalid IP retrieve method.', 'all-in-one-wp-security-and-firewall'));
+ }
+ die;
+ }
+
+ /**
+ * Dismiss a notice
+ *
+ * @param array $data - the request data contains the notice to dismiss
+ *
+ * @return array
+ */
+ public function dismiss_notice($data) {
+ global $aio_wp_security;
+
+ $time_now = $aio_wp_security->notices->get_time_now();
+
+ if (in_array($data['notice'], array('dismissdashnotice', 'dismiss_season'))) {
+ $aio_wp_security->configs->set_value($data['notice'], $time_now + (366 * 86400));
+ } elseif (in_array($data['notice'], array('dismiss_page_notice_until', 'dismiss_notice'))) {
+ $aio_wp_security->configs->set_value($data['notice'], $time_now + (84 * 86400));
+ } elseif ('dismiss_review_notice' == $data['notice']) {
+ if (empty($data['dismiss_forever'])) {
+ $aio_wp_security->configs->set_value($data['notice'], $time_now + (84 * 86400));
+ } else {
+ $aio_wp_security->configs->set_value($data['notice'], $time_now + (100 * 365.25 * 86400));
+ }
+ } elseif ('dismiss_automated_database_backup_notice' == $data['notice']) {
+ $aio_wp_security->delete_automated_backup_configs();
+ } elseif ('dismiss_ip_retrieval_settings_notice' == $data['notice']) {
+ $aio_wp_security->configs->set_value($data['notice'], 1);
+ } elseif ('dismiss_ip_retrieval_settings_notice' == $data['notice']) {
+ $aio_wp_security->configs->set_value('aiowps_is_login_whitelist_disabled_on_upgrade', 1);
+ } elseif ('dismiss_login_whitelist_disabled_on_upgrade_notice' == $data['notice']) {
+ if (isset($data['turn_it_back_on']) && '1' == $data['turn_it_back_on']) {
+ $aio_wp_security->configs->set_value('aiowps_enable_whitelisting', '1');
+ }
+ $aio_wp_security->configs->delete_value('aiowps_is_login_whitelist_disabled_on_upgrade');
+ } elseif ('dismiss_ip_blacklist_notice' == $data['notice']) {
+ if (isset($data['turn_it_back_on']) && '1' == $data['turn_it_back_on']) {
+ $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', '1');
+ AIOWPSecurity_Configure_Settings::set_blacklist_ip_firewall_configs();
+ AIOWPSecurity_Configure_Settings::set_user_agent_firewall_configs();
+ }
+ $aio_wp_security->configs->delete_value('aiowps_is_ip_blacklist_settings_notice_on_upgrade');
+ } elseif ('dismiss_firewall_settings_disabled_on_upgrade_notice' == $data['notice']) {
+ $is_reactivated = (isset($data['turn_it_back_on']) && '1' == $data['turn_it_back_on']);
+ if ($is_reactivated) {
+ $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG);
+ $active_settings = $aio_wp_security->configs->get_value('aiowps_firewall_active_upgrade');
+
+ if (!empty($active_settings)) {
+ $active_settings = json_decode($active_settings);
+ if (!empty($active_settings)) {
+ foreach ($active_settings as $setting) {
+ $aiowps_firewall_config->set_value($setting, true);
+ }
+ }
+ }
+ }
+
+ $aio_wp_security->configs->delete_value('aiowps_firewall_active_upgrade');
+ } elseif ('php_56_eol_dismiss_forever' == $data['notice']) {
+ $aio_wp_security->configs->set_value('php_56_eol_dismiss_forever', $time_now + (100 * 365.25 * 86400));
+ }
+
+
+ $aio_wp_security->configs->save_config();
+
+ return array();
+ }
+
+
+ /**
+ * This is a helper function to save settings options using key/value pairs
+ *
+ * @param array $options - An array of options to save to the config
+ * @param null $callback - A callback function to call when the options are saved
+ *
+ * @return bool
+ */
+ public function save_settings($options, $callback = null) {
+ global $aio_wp_security;
+
+ $aiowps_feature_mgr = $this->get_feature_mgr_object();
+ if (is_wp_error($aiowps_feature_mgr)) return false;
+
+
+ foreach ($options as $key => $value) {
+ $aio_wp_security->configs->set_value($key, $value);
+ }
+ //commit the config changes
+ $aio_wp_security->configs->save_config();
+
+ if (is_callable($callback)) {
+ call_user_func($callback, $options);
+ }
+
+ $aiowps_feature_mgr->calculate_total_feature_points();
+
+ return true;
+ }
+
+ /**
+ * This is a helper function to get the output feature details badge
+ *
+ * @param string $feature_id - the id of the feature we want to get the badge for
+ *
+ * @return string
+ */
+ public function get_feature_details_badge($feature_id) {
+ $aiowps_feature_mgr = $this->get_feature_mgr_object();
+ if (is_wp_error($aiowps_feature_mgr)) return '';
+ return $aiowps_feature_mgr->output_feature_details_badge($feature_id, true);
+ }
+
+ /**
+ * Retrieves the IDs and HTML content for features.
+ *
+ * This method processes an array of features and returns an associative array containing
+ * the IDs and corresponding HTML content for each feature badge.
+ *
+ * @param array $features - An array containing the features to retrieve IDs and HTML for.
+ *
+ * @return array An associative array containing the IDs and HTML content for each feature badge.
+ */
+ public function get_features_id_and_html($features) {
+ $result = array();
+ foreach ($features as $feature) {
+ $result[] = array(
+ 'id' => '#' . $feature . '-badge',
+ 'html' => $this->get_feature_details_badge($feature)
+ );
+ }
+
+ return $result;
+ }
+
+ /**
+ * Prepares and returns a structured response for AJAX commands.
+ *
+ * @param bool $success Indicates whether the operation was successful (true for success, false for failure).
+ * @param string|bool $message The message to include in the response (optional).
+ * If false, no message is passed with the response.
+ * If empty string, it defaults to a success or error message based on the $success flag.
+ * @param array $args Optional. An associative array of additional response data, such as badges, info, values, or content.
+ *
+ * @return array The constructed response array containing status, message, and any additional data from $args.
+ */
+ public function handle_response($success, $message = '', $args = array()) {
+ $response = array(
+ 'status' => $success ? 'success' : 'error',
+ );
+
+ if (false !== $message) {
+ $response['message'] = $this->get_message($success, $message);
+ }
+
+ $allowed_keys = array('badges', 'info', 'values', 'content', 'extra_args');
+ foreach ($allowed_keys as $key) {
+ if (!empty($args[$key])) {
+ $response[$key] = 'badges' === $key ? $this->get_features_id_and_html($args[$key]) : $args[$key];
+ }
+ }
+
+ return $response;
+ }
+
+ /**
+ * Get the appropriate message based on success flag and provided message.
+ *
+ * @param bool $success Indicates whether the operation was successful.
+ * @param string $message The provided message.
+ *
+ * @return string The final message to be used in the response.
+ */
+ private function get_message($success, $message) {
+ if ('' === $message) {
+ return $success ? __('The settings have been successfully updated.', 'all-in-one-wp-security-and-firewall') : __('The settings update was unsuccessful.', 'all-in-one-wp-security-and-firewall');
+ }
+ return $message;
+ }
+
+ /**
+ * Get antibot keys for the spam detection
+ *
+ * @return array
+ */
+ public function get_antibot_keys() {
+ global $aio_wp_security;
+
+ $response = array(
+ 'status' => 'success',
+ 'data' => array(),
+ );
+
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. It is the nonce.
+ $nonce = empty($_POST['nonce']) ? '' : sanitize_key(wp_unslash($_POST['nonce']));
+ if (!wp_verify_nonce($nonce, 'wp-security-ajax-nonce')) {
+ $response['status'] = false;
+ $response['error_code'] = 'invalid_nonce';
+ $response['error_message'] = 'Invalid nonce (wp-security-ajax-nonce) provided for this action.';
+ } else {
+ $key_map_arr = AIOWPSecurity_Comment::generate_antibot_keys(true);
+ $response['data'] = $key_map_arr[0];
+ if ('1' == $aio_wp_security->configs->get_value('aiowps_spambot_detect_usecookies')) {
+ AIOWPSecurity_Comment::insert_antibot_keys_in_cookie();
+ }
+ }
+
+ echo wp_json_encode($response);
+ exit;
+ }
+
+ /**
+ * This function will send the diagnostic report email
+ *
+ * @param array $data - the request data
+ *
+ * @return array
+ */
+ public function send_report_email($data) {
+ global $aio_wp_security;
+
+ // Sanitize the email address first.
+ $sanitized_email = !empty($data['report_email']) ? sanitize_email($data['report_email']) : '';
+
+ if ('' === $sanitized_email || !is_email($sanitized_email)) {
+ return array(
+ 'status' => 'error',
+ 'message' => __('Invalid email address.', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ $result = $aio_wp_security->debug_obj->send_report($sanitized_email, wp_kses_post(html_entity_decode($data['report_sections'])));
+
+ if ($result) {
+ return array(
+ 'status' => 'success',
+ 'message' => __('The diagnostic report has been sent successfully.', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ return array(
+ 'status' => 'error',
+ 'message' => __('There was an error sending the diagnostic report.', 'all-in-one-wp-security-and-firewall'),
+ );
+ }
+
+ /**
+ * Returns an array of translations used by the AIOS plugin. Primarily used for UpdraftCentral consumption.
+ *
+ * @param array $params - The parameters passed to the function.
+ *
+ * @return array - The AIOS translations array
+ */
+ public function get_js_translation($params) {
+ $translations = array();
+
+ if (isset($params['return_formatted_response'])) {
+ return array(
+ 'error' => false,
+ 'data' => array(
+ 'translations' => $translations,
+ )
+ );
+ }
+
+ return $translations;
+ }
+
+ /**
+ * Get multiple widgets data. Primarily used for UpdraftCentral consumption.
+ *
+ * @param array $args - The arguments containing the widgets to retrieve data for.
+ *
+ * @return array - An array containing error status and data for each widget.
+ */
+ public function get_widgets_data($args) {
+ // Widgets.
+ $widgets = isset($args['widgets']) ? $args['widgets'] : array();
+
+ // Return early if no widgets supplied.
+ if (!is_array($widgets) || empty($widgets)) {
+ return array('error' => false, 'data' => array());
+ }
+
+ // Get the data for each widget.
+ $data = array();
+
+ // Loop through the widgets and get their data.
+ foreach ($widgets as $widget) {
+ $method = 'get_' . $widget . '_data';
+
+ if (method_exists($this, $method)) {
+ $data[$widget] = $this->$method($args);
+ }
+ }
+
+ return array('error' => false, 'data' => $data);
+ }
+
+ /**
+ * Get the AIOS premium upsell data for UDC widget.
+ *
+ * @return array
+ */
+ public function get_is_premium_data() {
+ $is_premium = AIOWPSecurity_Utility_Permissions::is_premium_installed();
+ $upgrade_to_premium_data = array();
+
+ if (false === $is_premium) {
+ $upgrade_to_premium_data = array(
+ 'heading' => __('AIOS premium', 'all-in-one-wp-security-and-firewall'),
+ 'checklist' => array(
+ __('Advanced malware scanning', 'all-in-one-wp-security-and-firewall'),
+ __('Real-time response time monitoring', 'all-in-one-wp-security-and-firewall'),
+ __('Custom two-factor authentication', 'all-in-one-wp-security-and-firewall'),
+ __('404 error protection & bot blocking', 'all-in-one-wp-security-and-firewall'),
+ __('Country-based traffic blocking', 'all-in-one-wp-security-and-firewall'),
+ __('Country whitelist management', 'all-in-one-wp-security-and-firewall'),
+ __('Guaranteed premium support', 'all-in-one-wp-security-and-firewall'),
+ ),
+ 'cta' => array(
+ 'text' => __('Upgrade Now', 'all-in-one-wp-security-and-firewall'),
+ 'url' => 'https://teamupdraft.com/all-in-one-security/pricing/',
+ ),
+ );
+ }
+
+ return array(
+ 'is_premium' => $is_premium,
+ 'upgrade_to_premium_data' => $upgrade_to_premium_data,
+ );
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-comment.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-comment.php
new file mode 100755
index 00000000..014654bd
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-comment.php
@@ -0,0 +1,216 @@
+configs->get_value('aiowps_enable_trash_spam_comments') && absint($aio_wp_security->configs->get_value('aiowps_trash_spam_comments_after_days'))) {
+ $date_before = absint($aio_wp_security->configs->get_value('aiowps_trash_spam_comments_after_days')).' days ago';
+ $comment_ids = get_comments(array(
+ 'fields' => 'ids',
+ 'status' => 'spam',
+ 'date_query' => array(
+ array(
+ 'before' => $date_before,
+ 'inclusive' => true,
+ ),
+ )
+ ));
+
+ if (!empty($comment_ids)) {
+ foreach ($comment_ids as $comment_id) {
+ wp_trash_comment($comment_id);
+ }
+ }
+ }
+ }
+
+ /**
+ * Delete ip from aiowps_permanent_block table once the comment's spam status changed.
+ *
+ * @param object $comment_data comment object.
+ */
+ public function comment_spam_status_change($comment_data) {
+ global $wpdb, $aio_wp_security;
+ $comment_ip = $comment_data->comment_author_IP;
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Direct query necessary. No caching required.
+ $total_spam_comment = $wpdb->get_var(
+ $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->comments} WHERE comment_author_IP = %s AND comment_approved = 'spam'", $comment_ip)
+ );
+ $min_comment_before_block = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments_block');
+ if ($total_spam_comment < $min_comment_before_block) {
+ $where = array('blocked_ip' => $comment_ip, 'block_reason' => 'spam');
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Direct query necessary. No caching required.
+ $wpdb->delete(AIOWPSEC_TBL_PERM_BLOCK, $where, array('%s'));
+ }
+ }
+
+ /**
+ * Checks if comment posted by spambot.
+ *
+ * @return boolean.
+ */
+ public static function is_comment_spam_detected() {
+ $return = false;
+ if (!is_user_logged_in()) {
+ if (empty($_SERVER['HTTP_REFERER']) || false === stristr(sanitize_url(wp_unslash($_SERVER['HTTP_REFERER'])), wp_parse_url(home_url(), PHP_URL_HOST)) || empty($_SERVER['HTTP_USER_AGENT'])) {
+ $return = true;
+ } elseif (self::is_bot_detected()) {
+ $return = true;
+ }
+ }
+ return apply_filters('aiowps_is_comment_spam_detected', $return);
+ }
+
+ /**
+ * Check if bot posted comment form based on form posted fields and cookie values
+ *
+ * @return boolean
+ */
+ public static function is_bot_detected() {
+ global $aio_wp_security;
+ $return = false;
+ $key_map_arr = self::generate_antibot_keys();
+ foreach ($key_map_arr[0] as $key) {
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. Nonce checked in earlier function.
+ if (empty($_POST[$key[0]]) || sanitize_text_field(wp_unslash($_POST[$key[0]])) != $key[1]) {
+ $return = true;
+ break;
+ }
+ }
+ if (!$return && '1' == $aio_wp_security->configs->get_value('aiowps_spambot_detect_usecookies')) {
+ foreach ($key_map_arr[1] as $key) {
+ if (AIOWPSecurity_Utility::get_cookie_value($key[0]) != $key[1]) {
+ $return = true;
+ break;
+ }
+ }
+ }
+ return apply_filters('aios_is_bot_detected', $return);
+ }
+
+ /**
+ * Set cookies in browser for antibot check
+ *
+ * @return void
+ */
+ public static function insert_antibot_keys_in_cookie() {
+ $key_map_arr = self::generate_antibot_keys();
+ $expiry_seconds = AIOS_UPDATE_ANTIBOT_KEYS_AFTER_DAYS * 86400;
+ if (!empty($key_map_arr[1])) {
+ foreach ($key_map_arr[1] as $key) {
+ AIOWPSecurity_Utility::set_cookie_value($key[0], $key[1], $expiry_seconds);
+ }
+ }
+ }
+
+ /**
+ * Comment Form to post back hidden fields for antibot check
+ *
+ * @return string
+ */
+ public static function insert_antibot_keys_in_comment_form() {
+ $html_antibot_hidden_fields = '
+
+
+ %1$s
'; + $antibot_hidden_fields = ''; + $key_map_arr = self::generate_antibot_keys(); + foreach ($key_map_arr[0] as $key) { + $antibot_hidden_fields .=''; + } + if (isset($key_map_arr[2])) { + $antibot_hidden_fields .=''; + } + wp_register_script('aios-front-js', AIO_WP_SECURITY_URL. '/js/wp-security-front-script.js', array('jquery'), AIO_WP_SECURITY_VERSION, true); + wp_enqueue_script('aios-front-js'); + wp_localize_script('aios-front-js', 'AIOS_FRONT', array( + 'ajaxurl' => admin_url('admin-ajax.php'), // URL to wp-admin/admin-ajax.php to process the request + 'ajax_nonce' => wp_create_nonce('wp-security-ajax-nonce'), + )); + $html_antibot_hidden_fields = sprintf($html_antibot_hidden_fields, $antibot_hidden_fields); + return $html_antibot_hidden_fields; + } + + /** + * Get antibot key-value pairs to check on post back + * + * @param boolean $update generate and save in database + * + * @return array + */ + public static function generate_antibot_keys($update = false) { + $key_map_arr = get_site_option('aios_antibot_key_map_info'); + if (!$update && is_array($key_map_arr)) { + return $key_map_arr; + } + if ($update && is_array($key_map_arr) && isset($key_map_arr[2]) && $key_map_arr[2] > time()) { + return $key_map_arr; + } + $key_map_arr = array(); + + // values for to check post back key + $max = wp_rand(2, 4); + for ($i = 1; $i <= $max; $i++) { + $string1 = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(8); + $string2 = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(12); + $key_map_arr[0][] = array($string1, $string2); + } + + // values for to check for cookie back key + $max = wp_rand(2, 4); + for ($i = 1; $i <= $max; $i++) { + $string1 = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(8); + $string2 = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(12); + $key_map_arr[1][] = array($string1, $string2); + } + // expiration time of keys + $current_time = time(); + $key_map_arr[2] = (($current_time - ($current_time % 86400)) + AIOS_UPDATE_ANTIBOT_KEYS_AFTER_DAYS * 86400); + update_site_option('aios_antibot_key_map_info', $key_map_arr); + return $key_map_arr; + } + + /** + * Update antibot key-value pairs to rotate values so it is not valid forever + * + * @return void + */ + public function update_antibot_keys() { + if ((intval(gmdate('z')) % AIOS_UPDATE_ANTIBOT_KEYS_AFTER_DAYS) == 0) self::generate_antibot_keys(true); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-config.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-config.php new file mode 100755 index 00000000..cc48759d --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-config.php @@ -0,0 +1,109 @@ +configs = get_option('aio_wp_security_configs'); + } + + public function get_value($key) { + return isset($this->configs[$key]) ? $this->configs[$key] : ''; + } + + /** + * Gets for main site config value for a given $key. + * + * @param string $key + * + * @return string|array + */ + public function get_site_value($key) { + if (is_multisite() && !is_main_site()) { + $mainsite_aio_config = get_blog_option(get_main_site_id(), 'aio_wp_security_configs'); + return isset($mainsite_aio_config[$key]) ? $mainsite_aio_config[$key] : ''; + } else { + return $this->get_value($key); + } + } + + /** + * Sets a given config $value for a given $key. + * + * @param string $key + * @param mixed $value + * @param boolean $save_config - Whether or not to also save the $configs array to the database. + * + * @return boolean + */ + public function set_value($key, $value, $save_config = false) { + $this->configs[$key] = $value; + + if ($save_config) { + return $this->save_config(); + } else { + return true; + } + } + + public function add_value($key, $value) { + if (!is_array($this->configs)) { + $this->configs = array(); + } + + if (array_key_exists($key, $this->configs)) { + //Don't update the value for this key + } else {//It is safe to update the value for this key + $this->configs[$key] = $value; + } + } + + /** + * Save configuration that are set. + * + * @return boolean True on save config, Otherwise false. + */ + public function save_config() { + return update_option('aio_wp_security_configs', $this->configs); + } + + /** + * Remove key element from config. + * + * @param String $key config key + * + * @return boolean True if removed, otherwise false. + */ + public function delete_value($key) { + if (!is_array($this->configs)) { + $this->configs = array(); + } + + if (array_key_exists($key, $this->configs)) { + unset($this->configs[$key]); + if (!isset($this->configs[$key])) { + return true; + } + } + + return false; + } + + public static function get_instance() { + if (empty(self::$_this)) { + self::$_this = new AIOWPSecurity_Config(); + self::$_this->load_config(); + return self::$_this; + } + return self::$_this; + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-configure-settings.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-configure-settings.php new file mode 100755 index 00000000..e8280513 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-configure-settings.php @@ -0,0 +1,739 @@ +configs->set_value('aiowps_enable_debug', '');//Checkbox + + //PHP backtrace + $aio_wp_security->configs->set_value('aiowps_enable_php_backtrace_in_email', '');//Checkbox + + //WP Generator Meta Tag feature + $aio_wp_security->configs->set_value('aiowps_remove_wp_generator_meta_info', '');//Checkbox + + //Prevent Image Hotlinks + $aio_wp_security->configs->set_value('aiowps_prevent_hotlinking', '');//Checkbox + //General Settings Page + + //User password feature + + //Lockout feature + $aio_wp_security->configs->set_value('aiowps_enable_login_lockdown', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_allow_unlock_requests', '1'); // Checkbox + $aio_wp_security->configs->set_value('aiowps_max_login_attempts', '3'); + $aio_wp_security->configs->set_value('aiowps_retry_time_period', '5'); + $aio_wp_security->configs->set_value('aiowps_lockout_time_length', '5'); + $aio_wp_security->configs->set_value('aiowps_max_lockout_time_length', '60'); + $aio_wp_security->configs->set_value('aiowps_set_generic_login_msg', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_email_notify', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_email_address', $blog_email_address);//text field + $aio_wp_security->configs->set_value('aiowps_enable_forced_logout', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_logout_time_period', '60'); + $aio_wp_security->configs->set_value('aiowps_enable_invalid_username_lockdown', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_instantly_lockout_specific_usernames', array()); // Textarea (list of strings) + $aio_wp_security->configs->set_value('aiowps_unlock_request_secret_key', AIOWPSecurity_Utility::generate_alpha_numeric_random_string(20));//Hidden secret value which will be used to do some unlock request processing. This will be assigned a random string generated when lockdown settings saved + $aio_wp_security->configs->set_value('aiowps_lockdown_enable_whitelisting', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_lockdown_allowed_ip_addresses', ''); + + // HTTP authentication + $aio_wp_security->configs->set_value('aiowps_http_authentication_admin', ''); // Checkbox + $aio_wp_security->configs->set_value('aiowps_http_authentication_frontend', ''); // Checkbox + $aio_wp_security->configs->set_value('aiowps_http_authentication_username', 'root'); + $aio_wp_security->configs->set_value('aiowps_http_authentication_password', 'password'); + $aio_wp_security->configs->set_value('aiowps_http_authentication_failure_message', 'Unauthorized
'); + + // CAPTCHA feature + $aio_wp_security->configs->set_value('aiowps_default_captcha', ''); + $aio_wp_security->configs->set_value('aiowps_enable_login_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_custom_login_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_password_protected_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_woo_login_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_woo_lostpassword_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_woo_register_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_woo_checkout_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_lost_password_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_contact_form_7_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_captcha_secret_key', AIOWPSecurity_Utility::generate_alpha_numeric_random_string(20)); // Hidden secret value which will be used to do some CAPTCHA processing. This will be assigned a random string generated when CAPTCHA settings saved + + //Login Whitelist feature + $aio_wp_security->configs->set_value('aiowps_enable_whitelisting', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_allowed_ip_addresses', ''); + + //User registration + $aio_wp_security->configs->set_value('aiowps_enable_manual_registration_approval', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_registration_page_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_registration_honeypot', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enforce_strong_password', '');//Checkbox + + //DB Security feature + //$aio_wp_security->configs->set_value('aiowps_new_manual_db_pefix', ''); //text field + $aio_wp_security->configs->set_value('aiowps_enable_random_prefix', '');//Checkbox + + //Filesystem Security feature + AIOWPSecurity_Utility::enable_file_edits(); + $aio_wp_security->configs->set_value('aiowps_disable_file_editing', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_prevent_default_wp_file_access', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_auto_delete_default_wp_files', ''); // Checkbox + $aio_wp_security->configs->set_value('aiowps_system_log_file', 'error_log'); + + //Blacklist feature + $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_banned_ip_addresses', ''); + $aio_wp_security->configs->set_value('aiowps_banned_user_agents', ''); + + //Firewall features + $aio_wp_security->configs->set_value('aiowps_enable_basic_firewall', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_max_file_upload_size', AIOS_FIREWALL_MAX_FILE_UPLOAD_LIMIT_MB); //Default + $aio_wp_security->configs->set_value('aiowps_disable_xmlrpc_pingback_methods', '');//Checkbox - Disables only pingback methods in XMLRPC functionality + $aio_wp_security->configs->set_value('aiowps_disable_rss_and_atom_feeds', ''); // Checkbox + $aio_wp_security->configs->set_value('aiowps_block_debug_log_file_access', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_disable_index_views', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_disable_trace_and_track', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_5g_firewall', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_6g_firewall', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_custom_rules', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_place_custom_rules_at_top', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_custom_rules', ''); + + // Upgrade unsafe HTTP calls + $aio_wp_security->configs->set_value('aiowps_upgrade_unsafe_http_calls', ''); // Checkbox + $aio_wp_security->configs->set_value('aiowps_upgrade_unsafe_http_calls_url_exceptions', ''); + + //404 detection + $aio_wp_security->configs->set_value('aiowps_enable_404_logging', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_404_IP_lockout', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_404_lockout_time_length', '60'); + $aio_wp_security->configs->set_value('aiowps_404_lock_redirect_url', 'http://127.0.0.1'); + + //Brute Force features + $aio_wp_security->configs->set_value('aiowps_enable_rename_login_page', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_login_honeypot', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_disable_application_password', '');//Checkbox + + $aio_wp_security->configs->set_value('aiowps_enable_brute_force_attack_prevention', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_brute_force_secret_word', ''); + $aio_wp_security->configs->set_value('aiowps_cookie_brute_test', ''); + $aio_wp_security->configs->set_value('aiowps_cookie_based_brute_force_redirect_url', 'http://127.0.0.1'); + $aio_wp_security->configs->set_value('aiowps_brute_force_attack_prevention_pw_protected_exception', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_brute_force_attack_prevention_ajax_exception', '');//Checkbox + + //Maintenance menu - Visitor lockout feature + $aio_wp_security->configs->set_value('aiowps_site_lockout', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_site_lockout_msg', '');//Text area/msg box + + // Spam prevention menu + $aio_wp_security->configs->set_value('aiowps_enable_comment_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_autoblock_spam_ip', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_spam_ip_min_comments_block', ''); + $aio_wp_security->configs->set_value('aiowps_enable_bp_register_captcha', ''); + $aio_wp_security->configs->set_value('aiowps_enable_bbp_new_topic_captcha', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_enable_spambot_detecting', ''); + $aio_wp_security->configs->set_value('aiowps_spambot_detect_usecookies', ''); + $aio_wp_security->configs->set_value('aiowps_spam_comments_should', ''); + + $aio_wp_security->configs->set_value('aiowps_enable_trash_spam_comments', ''); + $aio_wp_security->configs->set_value('aiowps_trash_spam_comments_after_days', '14'); + + //Filescan features + //File change detection feature + $aio_wp_security->configs->set_value('aiowps_enable_automated_fcd_scan', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_fcd_scan_frequency', '4'); + $aio_wp_security->configs->set_value('aiowps_fcd_scan_interval', '2'); //Dropdown box where (0,1,2) => (hours,days,weeks) + $aio_wp_security->configs->set_value('aiowps_fcd_exclude_filetypes', ''); + $aio_wp_security->configs->set_value('aiowps_fcd_exclude_files', ''); + $aio_wp_security->configs->set_value('aiowps_send_fcd_scan_email', '');//Checkbox + $aio_wp_security->configs->set_value('aiowps_fcd_scan_email_address', $blog_email_address); + $aio_wp_security->configs->set_value('aiowps_fcds_change_detected', false); //used to display a global alert on site when file change detected + + //Misc Options + //Copy protection feature + $aio_wp_security->configs->set_value('aiowps_copy_protection', '');//Checkbox + //Prevent others from displaying your site in iframe + $aio_wp_security->configs->set_value('aiowps_prevent_site_display_inside_frame', '');//Checkbox + //Prevent users enumeration + $aio_wp_security->configs->set_value('aiowps_prevent_users_enumeration', '');//Checkbox + + //REST API Security + $aio_wp_security->configs->set_value('aiowps_disallow_unauthorized_rest_requests', '');//Checkbox + $aio_wp_security->configs->set_value('aios_roles_disallowed_rest_requests', array()); + $aio_wp_security->configs->set_value('aios_whitelisted_rest_routes', array()); + + // IP retrieval setting + $aio_wp_security->configs->set_value('aiowps_ip_retrieve_method', '0'); // Default is $_SERVER['REMOTE_ADDR'] + + // Cloudflare Turnstile + $aio_wp_security->configs->set_value('aiowps_turnstile_site_key', ''); + $aio_wp_security->configs->set_value('aiowps_turnstile_secret_key', ''); + + // Google reCAPTCHA + $aio_wp_security->configs->set_value('aiowps_recaptcha_site_key', ''); + $aio_wp_security->configs->set_value('aiowps_recaptcha_secret_key', ''); + $aio_wp_security->configs->set_value('aiowps_default_recaptcha', ''); // Not used since 5.1.2 + + // Deactivation Handler + $aio_wp_security->configs->set_value('aiowps_on_uninstall_delete_db_tables', '1'); //Checkbox + $aio_wp_security->configs->set_value('aiowps_on_uninstall_delete_configs', '1'); //Checkbox + + // Reset the PHP 5.6 end of support notice + $aio_wp_security->configs->delete_value('php_56_eol_dismiss_forever'); + + //TODO - keep adding default options for any fields that require it + + if (is_main_site()) { + $aiowps_firewall_config->set_value('aiowps_enable_pingback_firewall', false);//Checkbox - blocks all access to XMLRPC + $aiowps_firewall_config->set_value('aiowps_forbid_proxy_comments', false);//Checkbox + $aiowps_firewall_config->set_value('aiowps_deny_bad_query_strings', false);//Checkbox + $aiowps_firewall_config->set_value('aiowps_advanced_char_string_filter', false);//Checkbox + $aiowps_firewall_config->set_value('aiowps_ban_post_blank_headers', false); // Checkbox + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', false); // Checkbox + $aiowps_firewall_config->set_value('aiowps_googlebot_ip_ranges', array()); + + self::turn_off_all_6g_firewall_configs(); + self::set_cookie_based_bruteforce_firewall_configs(); + self::set_user_agent_firewall_configs(); + self::set_ip_retrieve_method_configs(); + self::set_blacklist_ip_firewall_configs(); + } + + // Save it + return $aio_wp_security->configs->save_config(); + } + + /** + * Add config settings. + * + * @return Void + */ + public static function add_option_values() { + + global $aio_wp_security; + + $blog_email_address = get_bloginfo('admin_email'); //Get the blog admin email address - we will use as the default value + + $aio_wp_security->configs->load_config(); + + //Debug + $aio_wp_security->configs->add_value('aiowps_enable_debug', '');//Checkbox + + //PHP backtrace + $aio_wp_security->configs->add_value('aiowps_enable_php_backtrace_in_email', '');//Checkbox + + //WP Generator Meta Tag feature + $aio_wp_security->configs->add_value('aiowps_remove_wp_generator_meta_info', '');//Checkbox + + //Prevent Image Hotlinks + $aio_wp_security->configs->add_value('aiowps_prevent_hotlinking', '');//Checkbox + + //General Settings Page + + //User password feature + + //Lockout feature + $aio_wp_security->configs->add_value('aiowps_enable_login_lockdown', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_allow_unlock_requests', '1'); // Checkbox + $aio_wp_security->configs->add_value('aiowps_max_login_attempts', '3'); + $aio_wp_security->configs->add_value('aiowps_retry_time_period', '5'); + $aio_wp_security->configs->add_value('aiowps_lockout_time_length', '5'); + $aio_wp_security->configs->add_value('aiowps_max_lockout_time_length', '60'); + $aio_wp_security->configs->add_value('aiowps_set_generic_login_msg', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_email_notify', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_email_address', $blog_email_address);//text field + $aio_wp_security->configs->add_value('aiowps_enable_forced_logout', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_logout_time_period', '60'); + $aio_wp_security->configs->add_value('aiowps_enable_invalid_username_lockdown', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_instantly_lockout_specific_usernames', array()); // Textarea (list of strings) + $aio_wp_security->configs->add_value('aiowps_unlock_request_secret_key', AIOWPSecurity_Utility::generate_alpha_numeric_random_string(20));//Hidden secret value which will be used to do some unlock request processing. This will be assigned a random string generated when lockdown settings saved + $aio_wp_security->configs->add_value('aiowps_lockdown_enable_whitelisting', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_lockdown_allowed_ip_addresses', ''); + + // HTTP authentication + $aio_wp_security->configs->add_value('aiowps_http_authentication_admin', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_http_authentication_frontend', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_http_authentication_username', 'root'); + $aio_wp_security->configs->add_value('aiowps_http_authentication_password', 'password'); + $aio_wp_security->configs->add_value('aiowps_http_authentication_failure_message', 'Unauthorized
'); + + //Login Whitelist feature + $aio_wp_security->configs->add_value('aiowps_enable_whitelisting', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_allowed_ip_addresses', ''); + + // CAPTCHA feature + $aio_wp_security->configs->add_value('aiowps_default_captcha', ''); + $aio_wp_security->configs->add_value('aiowps_enable_login_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_custom_login_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_password_protected_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_woo_login_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_woo_register_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_woo_checkout_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_woo_lostpassword_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_contact_form_7_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_captcha_secret_key', AIOWPSecurity_Utility::generate_alpha_numeric_random_string(20)); // Hidden secret value which will be used to do some CAPTCHA processing. This will be assigned a random string generated when CAPTCHA settings saved + + //User registration + $aio_wp_security->configs->add_value('aiowps_enable_manual_registration_approval', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_registration_page_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_registration_honeypot', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_enforce_strong_password', ''); // Checkbox + + //DB Security feature + //$aio_wp_security->configs->add_value('aiowps_new_manual_db_pefix', ''); //text field + $aio_wp_security->configs->add_value('aiowps_enable_random_prefix', '');//Checkbox + + //Filesystem Security feature + $aio_wp_security->configs->add_value('aiowps_disable_file_editing', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_prevent_default_wp_file_access', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_auto_delete_default_wp_files', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_system_log_file', 'error_log'); + + //Blacklist feature + $aio_wp_security->configs->add_value('aiowps_enable_blacklisting', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_banned_ip_addresses', ''); + + //Firewall features + $aio_wp_security->configs->add_value('aiowps_enable_basic_firewall', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_max_file_upload_size', AIOS_FIREWALL_MAX_FILE_UPLOAD_LIMIT_MB); + $aio_wp_security->configs->add_value('aiowps_disable_xmlrpc_pingback_methods', '');//Checkbox - Disables only pingback methods in XMLRPC functionality + $aio_wp_security->configs->add_value('aiowps_disable_rss_and_atom_feeds', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_block_debug_log_file_access', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_disable_index_views', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_disable_trace_and_track', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_5g_firewall', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_6g_firewall', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_custom_rules', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_place_custom_rules_at_top', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_custom_rules', ''); + + // Upgrade unsafe HTTP calls + $aio_wp_security->configs->add_value('aiowps_upgrade_unsafe_http_calls', ''); // Checkbox + $aio_wp_security->configs->add_value('aiowps_upgrade_unsafe_http_calls_url_exceptions', ''); + + //404 detection + $aio_wp_security->configs->add_value('aiowps_enable_404_logging', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_404_IP_lockout', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_404_lockout_time_length', '60'); + $aio_wp_security->configs->add_value('aiowps_404_lock_redirect_url', 'http://127.0.0.1'); + + //Brute Force features + $aio_wp_security->configs->add_value('aiowps_enable_rename_login_page', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_login_honeypot', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_disable_application_password', ''); // Checkbox + + $aio_wp_security->configs->add_value('aiowps_enable_brute_force_attack_prevention', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_brute_force_secret_word', ''); + $aio_wp_security->configs->add_value('aiowps_cookie_brute_test', ''); + $aio_wp_security->configs->add_value('aiowps_cookie_based_brute_force_redirect_url', 'http://127.0.0.1'); + $aio_wp_security->configs->add_value('aiowps_brute_force_attack_prevention_pw_protected_exception', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_brute_force_attack_prevention_ajax_exception', '');//Checkbox + + //Maintenance menu - Visitor lockout feature + $aio_wp_security->configs->add_value('aiowps_site_lockout', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_site_lockout_msg', '');//Text area/msg box + + // Spam prevention menu + $aio_wp_security->configs->add_value('aiowps_enable_spambot_blocking', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_comment_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_spam_ip_min_comments_block', ''); + $aio_wp_security->configs->add_value('aiowps_enable_bp_register_captcha', ''); + $aio_wp_security->configs->add_value('aiowps_enable_bbp_new_topic_captcha', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_enable_spambot_detecting', ''); + $aio_wp_security->configs->add_value('aiowps_spambot_detect_usecookies', ''); + $aio_wp_security->configs->add_value('aiowps_spam_comments_should', ''); + $aio_wp_security->configs->add_value('aiowps_enable_trash_spam_comments', ''); + $aio_wp_security->configs->add_value('aiowps_trash_spam_comments_after_days', '14'); + + //Filescan features + //File change detection feature + $aio_wp_security->configs->add_value('aiowps_enable_automated_fcd_scan', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_fcd_scan_frequency', '4'); + $aio_wp_security->configs->add_value('aiowps_fcd_scan_interval', '2'); //Dropdown box where (0,1,2) => (hours,days,weeks) + $aio_wp_security->configs->add_value('aiowps_fcd_exclude_filetypes', ''); + $aio_wp_security->configs->add_value('aiowps_fcd_exclude_files', ''); + $aio_wp_security->configs->add_value('aiowps_send_fcd_scan_email', '');//Checkbox + $aio_wp_security->configs->add_value('aiowps_fcd_scan_email_address', $blog_email_address); + $aio_wp_security->configs->add_value('aiowps_fcds_change_detected', false); //used to display a global alert on site when file change detected + + //Misc Options + //Copy protection feature + $aio_wp_security->configs->add_value('aiowps_copy_protection', '');//Checkbox + //Prevent others from displaying your site in iframe + $aio_wp_security->configs->add_value('aiowps_prevent_site_display_inside_frame', '');//Checkbox + //Prevent users enumeration + $aio_wp_security->configs->add_value('aiowps_prevent_users_enumeration', '');//Checkbox + + //REST API Security + $aio_wp_security->configs->add_value('aiowps_disallow_unauthorized_rest_requests', '');//Checkbox + $aio_wp_security->configs->add_value('aios_roles_disallowed_rest_requests', array()); + $aio_wp_security->configs->add_value('aios_whitelisted_rest_routes', array()); + + // IP retrieval setting + // Commented the below code line because the IP retrieve method will be configured when the AIOS plugin is activated for the first time. + // $aio_wp_security->configs->add_value('aiowps_ip_retrieve_method', '0'); // Default is $_SERVER['REMOTE_ADDR'] + + // Cloudflare Turnstile + $aio_wp_security->configs->add_value('aiowps_turnstile_site_key', ''); + $aio_wp_security->configs->add_value('aiowps_turnstile_secret_key', ''); + + // Google reCAPTCHA + $aio_wp_security->configs->add_value('aiowps_recaptcha_site_key', ''); + $aio_wp_security->configs->add_value('aiowps_recaptcha_secret_key', ''); + $aio_wp_security->configs->add_value('aiowps_default_recaptcha', ''); // Not used since 5.1.2 + + // Deactivation Handler + $aio_wp_security->configs->add_value('aiowps_on_uninstall_delete_db_tables', '1'); //Checkbox + $aio_wp_security->configs->add_value('aiowps_on_uninstall_delete_configs', '1'); //Checkbox + + $aio_wp_security->configs->add_value('installed-at', current_time('timestamp', true)); + + //TODO - keep adding default options for any fields that require it + + //Save it + $aio_wp_security->configs->save_config(); + + // For Cookie based brute force prevention backward compatibility + if (!headers_sent() && '1' == $aio_wp_security->configs->get_value('aiowps_enable_brute_force_attack_prevention')) { + $brute_force_secret_word = $aio_wp_security->configs->get_value('aiowps_brute_force_secret_word'); + if (empty($brute_force_secret_word)) { + $brute_force_secret_word = AIOS_DEFAULT_BRUTE_FORCE_FEATURE_SECRET_WORD; + } + AIOWPSecurity_Utility::set_cookie_value(AIOWPSecurity_Utility::get_brute_force_secret_cookie_name(), AIOS_Helper::get_hash($brute_force_secret_word)); + } + + // Login whitelisting started to work on non-apache server from db_version 1.9.5 + if (is_main_site() && version_compare(get_option('aiowpsec_db_version'), '1.9.6', '<') && '1' == $aio_wp_security->configs->get_value('aiowps_enable_whitelisting') && !empty($aio_wp_security->configs->get_value('aiowps_allowed_ip_addresses'))) { + $aio_wp_security->configs->set_value('aiowps_enable_whitelisting', '0'); + $aio_wp_security->configs->set_value('aiowps_is_login_whitelist_disabled_on_upgrade', '1'); + $aio_wp_security->configs->save_config(); + } + + if (is_main_site() && version_compare(get_option('aiowpsec_db_version'), '2.0.0', '<') && '1' == $aio_wp_security->configs->get_value('aiowps_enable_blacklisting') && !empty($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses')) && (false !== strpos($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'), '*') || false !== strpos($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'), '/'))) { + $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', '0'); + $aio_wp_security->configs->set_value('aiowps_is_ip_blacklist_settings_notice_on_upgrade', '1'); + $aio_wp_security->configs->save_config(); + self::set_user_agent_firewall_configs(); + self::send_blacklist_manager_disabled_email(); + } + + if (is_main_site() && version_compare(get_option('aiowpsec_db_version'), '2.0.0', '<') && '1' == $aio_wp_security->configs->get_value('aiowps_enable_spambot_blocking')) { + $aio_wp_security->configs->set_value('aiowps_enable_spambot_detecting', '1'); + $aio_wp_security->configs->set_value('aiowps_spambot_detect_usecookies', ''); + $aio_wp_security->configs->set_value('aiowps_spam_comments_should', '0'); + $aio_wp_security->configs->save_config(); + } + + + if (is_main_site() && version_compare(get_option('aiowpsec_db_version'), '2.0.3', '<')) { + $aio_wp_security->configs->set_value('aiowps_enable_pingback_firewall', '0');//Checkbox - blocks all access to XMLRPC + $aio_wp_security->configs->set_value('aiowps_forbid_proxy_comments', '0');//Checkbox + $aio_wp_security->configs->set_value('aiowps_deny_bad_query_strings', '0');//Checkbox + $aio_wp_security->configs->set_value('aiowps_advanced_char_string_filter', '0');//Checkbox + $aio_wp_security->configs->save_config(); + } + + if (is_main_site()) { + AIOWPSecurity_Utility_Htaccess::write_to_htaccess(false); + } + + // Add expiration for antibot keys for previous versions + if (version_compare(get_option('aiowpsec_db_version'), '2.1.1', '<')) { + AIOWPSecurity_Comment::generate_antibot_keys(true); + } + + // Add ContactForm7 related authentication scheme for salt postfix + if (version_compare(get_option('aiowpsec_db_version'), '2.1.4', '<') && '1' == $aio_wp_security->configs->get_value('aiowps_enable_salt_postfix')) { + $salt_postfixes = $aio_wp_security->configs->get_value('aiowps_salt_postfixes'); + $salt_postfixes['wpcf7_submission'] = wp_generate_password(64, true, true); + $aio_wp_security->configs->set_value('aiowps_salt_postfixes', $salt_postfixes, true); + } + } + + /** + * Method to update the plugin db version. + * + * @return void + */ + public static function update_aiowpsec_db_version() { + update_option('aiowpsec_db_version', AIO_WP_SECURITY_DB_VERSION); + } + + /** + * Upgrades from the old config to the firewall's config + * + * @return void + */ + public static function upgrade_basic_firewall_rules_configs() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $settings = array( + 'aiowps_enable_pingback_firewall', + 'aiowps_forbid_proxy_comments', + 'aiowps_deny_bad_query_strings', + 'aiowps_advanced_char_string_filter', + ); + + // The settings that have been activated by the user + $active = array(); + + foreach ($settings as $setting) { + if (('1' === $aio_wp_security->configs->get_value($setting))) { + $active[] = $setting; + $aiowps_firewall_config->set_value($setting, false); + $aio_wp_security->configs->delete_value($setting); + $aio_wp_security->configs->save_config(); + } + + } + + if (!empty($active)) { + $aio_wp_security->configs->set_value('aiowps_firewall_active_upgrade', wp_json_encode($active)); + $aio_wp_security->configs->save_config(); + self::send_basic_firewall_upgrade_email(); + } + } + + /** + * Send an email notifying that the upgraded settings have been disabled + * + * @return void + */ + private static function send_basic_firewall_upgrade_email() { + global $aio_wp_security; + $dashboard_link = 'admin.php?page=aiowpsec'; + $dashboard_link = is_multisite() ? network_admin_url($dashboard_link) : admin_url($dashboard_link); + $subject = __('Basic firewall settings disabled', 'all-in-one-wp-security-and-firewall'); + /* translators: %s: Dashboard link. */ + $email_msg = __('Our basic firewall rules have been upgraded and to prevent any unexpected site issues we have disabled the features.', 'all-in-one-wp-security-and-firewall') . "\n\n" . __('You can enable the features again by logging into your WordPress dashboard.', 'all-in-one-wp-security-and-firewall') . "\n\n" .sprintf(__('Go to dashboard: %s', 'all-in-one-wp-security-and-firewall'), $dashboard_link) . "\n\n" . __('Once logged in you will see a notification where you can decide on which course of action you wish to take.', 'all-in-one-wp-security-and-firewall') . "\n"; + $email = get_bloginfo('admin_email'); + if (false === wp_mail($email, $subject, $email_msg)) { + $aio_wp_security->debug_logger->log_debug("Basic firewall rules notification email failed to send to " . $email, 4); + } + } + + /** + * This function send blacklist ip manager disabled email. + * + * @return void + */ + public static function send_blacklist_manager_disabled_email() { + global $aio_wp_security; + $dashboard_link = 'admin.php?page=aiowpsec'; + $dashboard_link = is_multisite() ? network_admin_url($dashboard_link) : admin_url($dashboard_link); + $subject = '['. get_option('siteurl'). '] '. __('Blacklist manager disabled notification', 'all-in-one-wp-security-and-firewall'); + /* translators: %s: Dashboard link */ + $email_msg = __('The blacklist manager feature has been updated and to prevent any unexpected site lockouts we have disabled the feature.', 'all-in-one-wp-security-and-firewall') . "\n\n" . __('You can enable the feature again by logging into your WordPress dashboard.', 'all-in-one-wp-security-and-firewall') . "\n\n" .sprintf(__('Go to dashboard: %s', 'all-in-one-wp-security-and-firewall'), $dashboard_link) . "\n\n" . __('Once logged in before turning the blacklist manger on please double check your settings to ensure you have not entered your own details.', 'all-in-one-wp-security-and-firewall') . "\n"; + $email = get_bloginfo('admin_email'); + $mail_sent = wp_mail($email, $subject, $email_msg); + if (false === $mail_sent) { + $aio_wp_security->debug_logger->log_debug("Blacklist IP manager disabled notification email failed to send to " . $email, 4); + } + } + + /** + * Firewall configs set based on version. + * + * @return void + */ + public static function set_firewall_configs() { + if (is_main_site()) { + $firewall_version = get_option('aiowpsec_firewall_version'); + if (version_compare($firewall_version, '1.0.1', '<')) { + self::set_cookie_based_bruteforce_firewall_configs(); + } + if (version_compare($firewall_version, '1.0.3', '<')) { + self::set_ip_retrieve_method_configs(); + } + if (version_compare($firewall_version, '1.0.4', '<')) { + self::set_blacklist_ip_firewall_configs(); + } + if (version_compare($firewall_version, '1.0.5', '<')) { + self::upgrade_basic_firewall_rules_configs(); + } + if (version_compare($firewall_version, '1.0.6', '<')) { //1.0.2 set but here making sure the blank user agent is not saved in settings.php which may show a 403 error due to not empty user agent check removed from the rule + self::set_user_agent_firewall_configs(); + } + if (version_compare($firewall_version, '1.0.8', '<')) { + self::port_block_fake_googlebots_config(); + } + } + update_option('aiowpsec_firewall_version', AIO_WP_SECURITY_FIREWALL_VERSION); + } + + /** + * Blacklist IP firewall configs set. + * + * @return void. + */ + public static function set_blacklist_ip_firewall_configs() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + $aiowps_firewall_config->set_value('aiowps_ip_retrieve_method', $aio_wp_security->configs->get_value('aiowps_ip_retrieve_method')); + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_blacklisting') && !empty($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'))) { + $aiowps_firewall_config->set_value('aiowps_blacklist_ips', explode("\n", preg_replace("/\r/", "", trim($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses'))))); + } else { + $aiowps_firewall_config->set_value('aiowps_blacklist_ips', array()); + } + } + + /** + * Cookie based bruteforce firewall configs set. + * + * @return void. + */ + public static function set_cookie_based_bruteforce_firewall_configs() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + $aiowps_firewall_config->set_value('aios_enable_rename_login_page', $aio_wp_security->configs->get_value('aiowps_enable_rename_login_page')); + + $aiowps_firewall_config->set_value('aios_login_page_slug', $aio_wp_security->configs->get_value('aiowps_login_page_slug')); + + $aios_enable_brute_force_attack_prevention = $aio_wp_security->configs->get_value('aiowps_enable_brute_force_attack_prevention'); + $aiowps_firewall_config->set_value('aios_enable_brute_force_attack_prevention', $aios_enable_brute_force_attack_prevention); + + $aiowps_firewall_config->set_value('aios_brute_force_secret_word', $aio_wp_security->configs->get_value('aiowps_brute_force_secret_word')); + + $aiowps_firewall_config->set_value('aios_cookie_based_brute_force_redirect_url', $aio_wp_security->configs->get_value('aiowps_cookie_based_brute_force_redirect_url')); + + $aiowps_firewall_config->set_value('aios_brute_force_attack_prevention_pw_protected_exception', $aio_wp_security->configs->get_value('aiowps_brute_force_attack_prevention_pw_protected_exception')); + + $aiowps_firewall_config->set_value('aios_brute_force_attack_prevention_ajax_exception', $aio_wp_security->configs->get_value('aiowps_brute_force_attack_prevention_ajax_exception')); + + $aiowps_firewall_config->set_value('aios_brute_force_secret_cookie_name', AIOWPSecurity_Utility::get_brute_force_secret_cookie_name()); + } + + /** + * User agent firewall configs set. + * + * @return void. + */ + public static function set_user_agent_firewall_configs() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_blacklisting') && !empty($aio_wp_security->configs->get_value('aiowps_banned_user_agents'))) { + $aiowps_firewall_config->set_value('aiowps_blacklist_user_agents', explode("\n", preg_replace("/\r/", "", trim($aio_wp_security->configs->get_value('aiowps_banned_user_agents'))))); + } else { + $aiowps_firewall_config->set_value('aiowps_blacklist_user_agents', array()); + } + } + + /** + * Port block fake Googlebots config to firewall config. + * + * @global AIO_WP_Security $aio_wp_security + * @global AIOWPS\Firewall\Config $aiowps_firewall_config + * + * @return void + */ + private static function port_block_fake_googlebots_config() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + if ('1' == $aio_wp_security->configs->get_value('aiowps_block_fake_googlebots')) { + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', true); + + $validated_ip_list_array = AIOWPSecurity_Utility::get_googlebot_ip_ranges(); + + if (!is_wp_error($validated_ip_list_array)) { + $aiowps_firewall_config->set_value('aiowps_googlebot_ip_ranges', $validated_ip_list_array); + } + } else { + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', false); + } + } + + /** + * IP retrieve method configs set. + * + * @return void. + */ + public static function set_ip_retrieve_method_configs() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + $aiowps_firewall_config->set_value('aios_ip_retrieve_method', $aio_wp_security->configs->get_value('aiowps_ip_retrieve_method')); + } + + /** + * Turn off all security features. + * + * @return void. + */ + public static function turn_off_all_security_features() { + global $aio_wp_security; + AIOWPSecurity_Configure_Settings::set_default_settings(); + + //Refresh the .htaccess file based on the new settings + $serverType = AIOWPSecurity_Utility::get_server_type(); + if (!in_array($serverType, array('-1', 'nginx', 'iis'))) { + $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess(); + } else { + $res = true; + } + if (!$res) { + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - Could not write to the .htaccess file. Please check the file permissions.", 4); + } + } + + /** + * Turn off 6g firewall configs. + * + * @return void. + */ + public static function turn_off_all_6g_firewall_configs() { + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + $aiowps_firewall_config->set_value('aiowps_6g_block_request_methods', array()); + $aiowps_firewall_config->set_value('aiowps_6g_block_query', false); + $aiowps_firewall_config->set_value('aiowps_6g_block_request', false); + $aiowps_firewall_config->set_value('aiowps_6g_block_referrers', false); + $aiowps_firewall_config->set_value('aiowps_6g_block_agents', false); + } + + + /** + * Turn off all firewall configs. + * + * @return void. + */ + public static function turn_off_firewall_configs() { + global $aiowps_firewall_config, $aio_wp_security; + $aio_wp_security->configs->set_value('aiowps_disable_xmlrpc_pingback_methods', ''); + $aio_wp_security->configs->set_value('aiowps_disable_rss_and_atom_feeds', ''); + $aio_wp_security->configs->set_value('aiowps_enable_basic_firewall', ''); + $aio_wp_security->configs->set_value('aiowps_max_file_upload_size', AIOS_FIREWALL_MAX_FILE_UPLOAD_LIMIT_MB); //Default + $aio_wp_security->configs->set_value('aiowps_block_debug_log_file_access', ''); + $aio_wp_security->configs->set_value('aiowps_disable_index_views', ''); + $aio_wp_security->configs->set_value('aiowps_disable_trace_and_track', ''); + $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', ''); + $aio_wp_security->configs->set_value('aiowps_enable_5g_firewall', ''); + $aio_wp_security->configs->set_value('aiowps_disallow_unauthorized_rest_requests', ''); + $aio_wp_security->configs->save_config(); + + self::turn_off_all_6g_firewall_configs(); + $aiowps_firewall_config->set_value('aiowps_enable_pingback_firewall', false); + $aiowps_firewall_config->set_value('aiowps_forbid_proxy_comments', false); + $aiowps_firewall_config->set_value('aiowps_deny_bad_query_strings', false); + $aiowps_firewall_config->set_value('aiowps_advanced_char_string_filter', false); + $aiowps_firewall_config->set_value('aiowps_ban_post_blank_headers', false); + $aiowps_firewall_config->set_value('aiowps_block_fake_googlebots', false); + $aiowps_firewall_config->set_value('aiowps_googlebot_ip_ranges', array()); + $aiowps_firewall_config->set_value('aiowps_blacklist_user_agents', array()); + $aiowps_firewall_config->set_value('aiowps_blacklist_ips', array()); + Allow_List::add_ips(array()); // Remove firewall whitelisted IPs + } + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cronjob-handler.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cronjob-handler.php new file mode 100755 index 00000000..fa566e3a --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-cronjob-handler.php @@ -0,0 +1,157 @@ + 900, // 15 * 60 + 'display' => __('Every 15 minutes', 'all-in-one-wp-security-and-firewall') + ); + return $schedules; + } + + /** + * Run cron event every 5 minute. + * + * @return void + */ + public function aios_15_minutes_cron_event() { + global $aio_wp_security; + + if (!class_exists('Updraft_Semaphore_3_0')) { + require_once(AIO_WP_SECURITY_PATH.'/vendor/team-updraft/common-libs/src/updraft-semaphore/class-updraft-semaphore.php'); + } + + $fifteen_minutes_cron_semaphore = new Updraft_Semaphore_3_0('aios_15_minutes_cron_event', 60); + + if ($fifteen_minutes_cron_semaphore->lock(2)) { + try { + $aio_wp_security->user_login_obj->send_login_lockout_emails(); + } catch (Exception $e) { + $log_message = 'Exception ('.get_class($e).') occurred during the 5 minutes cron event action call: '.$e->getMessage().' (Code: '.$e->getCode().', line '.$e->getLine().' in '.$e->getFile().')'; + $aio_wp_security->debug_logger->log_debug($log_message, 4); + // @codingStandardsIgnoreLine + } catch (Error $e) { + $log_message = 'PHP Fatal error ('.get_class($e).') occurred during the the 5 minutes cron event action call. Error Message: '.$e->getMessage().' (Code: '.$e->getCode().', line '.$e->getLine().' in '.$e->getFile().')'; + $aio_wp_security->debug_logger->log_debug($log_message, 4); + } + + $fifteen_minutes_cron_semaphore->release(); + } else { + $aio_wp_security->debug_logger->log_debug('The 15 minutes cron event lock could not get the lock.'); + } + } + + public function aiowps_hourly_cron_event_handler() { + //Do stuff that needs checking hourly + AIOWPSecurity_Comment::trash_spam_comments(); + do_action('aiowps_perform_fcd_scan_tasks'); + do_action('delete_expired_logged_in_users_event'); + } + + /** + * Run daily cron event + * + * @return void + */ + public function aiowps_daily_cron_event_handler() { + do_action('aiowps_perform_db_cleanup_tasks'); + do_action('aiowps_purge_old_debug_logs'); + do_action('aiowps_send_lockout_email'); + do_action('aios_perform_update_antibot_keys'); + do_action('aios_update_googlebot_ip_ranges'); + } + + /** + * Purges debug logs older than 90 days + * The 90 days can be modified using the constant AIOWPSEC_PURGE_DEBUG_LOGS_AFTER_DAYS + * + * @return void + */ + public function purge_old_debug_logs() { + + global $wpdb, $aio_wp_security; + + $debug_tbl_name = AIOWPSEC_TBL_DEBUG_LOG; + $after_days = 90; + + if (defined('AIOWPSEC_PURGE_DEBUG_LOGS_AFTER_DAYS')) { + $after_days = abs(AIOWPSEC_PURGE_DEBUG_LOGS_AFTER_DAYS); + } + + $after_days = empty($after_days) ? 90 : $after_days; + $older_than_date_time = strtotime('-' . $after_days . ' days', time()); + + // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore + $ret = $wpdb->query($wpdb->prepare('DELETE FROM ' . $debug_tbl_name . ' WHERE logtime < %s', $older_than_date_time)); + if (false === $ret) { + $error_msg = empty($wpdb->last_error) ? 'Could not receive the reason for the failure' : $wpdb->last_error; + $aio_wp_security->debug_logger->log_debug_cron("Failed to purge older debug logs : {$error_msg}", 4); + } + } + /** + * Send email notification to an user who has flag is_lockout_email_sent is 0. + * + * @return Void + */ + public function send_lockout_email() { + global $aio_wp_security; + $aio_wp_security->user_login_obj->send_login_lockout_emails(); + } + + /** + * Update Googlebot IP ranges for the firewall configuration. + * + * This function updates the Googlebot IP ranges in the firewall configuration. + * It checks if the 'Block fake Googlebots' feature is enabled and then retrieves + * the validated Googlebot IP ranges. If the IP ranges are retrieved successfully, + * they are saved to the firewall configuration. If there is an error in retrieving + * the IP ranges, a debug message is logged. + * + * @global object $aio_wp_security The main AIO WP Security object. + * @global object $aiowps_firewall_config The AIO WP Security firewall configuration object. + * + * @return void + */ + public function aios_update_googlebot_ip_ranges() { + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + if ($aiowps_firewall_config->get_value('aiowps_block_fake_googlebots')) { + $validated_ip_list_array = AIOWPSecurity_Utility::get_googlebot_ip_ranges(); + + if (is_wp_error($validated_ip_list_array)) { + $aio_wp_security->debug_logger->log_debug('The attempt to save the IP addresses failed, because it was not possible to validate the Googlebot IP addresses: ' . $validated_ip_list_array->get_error_message(), 4); + } + + $aiowps_firewall_config->set_value('aiowps_googlebot_ip_ranges', $validated_ip_list_array); + } + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-deactivation-tasks.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-deactivation-tasks.php new file mode 100755 index 00000000..66e1ba4c --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-deactivation-tasks.php @@ -0,0 +1,47 @@ +configs->load_config(); + + if (is_main_site()) { + // Remove all firewall and other .htaccess rules and remove all settings from .htaccess file that were added by this plugin. + AIOWPSecurity_Utility_Htaccess::delete_from_htaccess(); + + // Remove user meta info so next activation if force logout on it do not logs user out + AIOWPSecurity_User_Login::remove_login_activity(); + + // Deactivate PHP-based firewall. + AIOWPSecurity_Utility_Firewall::remove_firewall(); + } + + self::clear_cron_events(); + } + + /** + * Helper function which clears aiowps cron events + */ + private static function clear_cron_events() { + wp_clear_scheduled_hook('aiowps_hourly_cron_event'); + wp_clear_scheduled_hook('aiowps_daily_cron_event'); + wp_clear_scheduled_hook('aios_15_minutes_cron_event'); + } + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug-logger.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug-logger.php new file mode 100755 index 00000000..f844c280 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug-logger.php @@ -0,0 +1,100 @@ +debug_logger->log_debug("Log messaged goes here"); + */ +if (!defined('ABSPATH')) { + exit;//Exit if accessed directly +} + +class AIOWPSecurity_Logger { + + private $debug_enabled = false; + + private $debug_readable_level = array('SUCCESS','STATUS','NOTICE','WARNING','FAILURE','CRITICAL'); + + public function __construct($debug_enabled) { + $this->debug_enabled = $debug_enabled; + } + + /** + * Translates the level code to its readable form + * + * @param integer $level_code - The level code to translate (e.g: 2) + * @return string - The level as its readable value (e.g: NOTICE) + */ + private function get_readable_level_from_code($level_code) { + return isset($this->debug_readable_level[$level_code]) ? $this->debug_readable_level[$level_code] : 'UNKNOWN'; + } + + /** + * Clears the debug logs + * + * @return int|WP_Error the amount of records deleted or WP_Error if query failed + */ + public function clear_logs() { + global $wpdb; + + $debug_log_tbl = AIOWPSEC_TBL_DEBUG_LOG; + + if (is_super_admin()) { + $ret = $wpdb->query("DELETE FROM $debug_log_tbl"); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We can't use %i because our plugin supports wordpress < 6.2. + } else { + $ret = $wpdb->query($wpdb->prepare("DELETE FROM $debug_log_tbl WHERE site_id = %d", get_current_blog_id())); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We can't use %i because our plugin supports wordpress < 6.2. + } + + if (false === $ret) { + $error_msg = empty($wpdb->last_error) ? __('Unable to get the reason why', 'all-in-one-wp-security-and-firewall') : $wpdb->last_error; + $ret = new WP_Error('db_unable_delete', __('Unable to clear the logs', 'all-in-one-wp-security-and-firewall'), $error_msg); + } + + return $ret; + } + + /** + * Logs the debug messages to the database + * + * @param string $message - The main debug message + * @param integer $level_code - The level code which indicates the severity of the message + * @param string $type - The type of debug message. Separates general debug messages from those generated by the cron, for example. + * @return void + */ + public function log_debug($message, $level_code = 0, $type = 'debug') { + + if (!$this->debug_enabled) { + return; + } + + global $wpdb; + $debug_tbl_name = AIOWPSEC_TBL_DEBUG_LOG; + + $data = array( + 'created' => current_time('mysql'), + 'level' => $this->get_readable_level_from_code($level_code), + 'network_id' => get_current_network_id(), + 'site_id' => get_current_blog_id(), + 'message' => $message, + 'type' => $type, + ); + + $ret = $wpdb->query($wpdb->prepare("INSERT INTO ".$debug_tbl_name." (created, logtime, level, network_id, site_id, message, type) VALUES (%s, UNIX_TIMESTAMP(), %s, %d, %d, %s, %s)", $data['created'], $data['level'], $data['network_id'], $data['site_id'], $data['message'], $data['type'])); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- We can't use %i because our plugin supports wordpress < 6.2. + if (false === $ret) { + $error_msg = empty($wpdb->last_error) ? 'Could not write to the debug log' : $wpdb->last_error; + error_log("All In One WP Security : {$error_msg}"); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- We can't replace error_log with our debug logger here because the debug logger has failed. + } + } + + /** + * Logs the debug messages that relate to the cron + * + * @param string $message - The main debug message + * @param integer $level_code - The level code which indicates the severity of the message + * @return void + */ + public function log_debug_cron($message, $level_code = 0) { + $this->log_debug($message, $level_code, 'cron_debug'); + } + + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug.php new file mode 100755 index 00000000..203c7671 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-debug.php @@ -0,0 +1,588 @@ + 'get_aios_info', + 'Server information' => 'get_server_info', + 'WordPress information' => 'get_wordpress_info', + 'PHP information' => 'get_php_info', + 'Database information' => 'get_database_info', + 'Plugin information' => 'get_plugins_list', + 'Must-use plugin information' => 'get_mu_plugins_list', + 'Drop-in information' => 'get_dropin_plugins_list', + 'Theme information' => 'get_themes_list', + 'IP detection methods' => 'get_ip_detection_methods', + 'Cron information' => 'get_cron_jobs_list', + ); + + /** + * Constructor + * + * @return void + */ + public function __construct() { + add_action('aiowp_security_additional_report_actions', array($this, 'add_sender_report_actions')); + } + + /** + * Get AIOS Information + * + * @return array AIOS information + */ + private static function get_aios_info() { + + $aios_info = array( + 'AIOS plugin version' => AIO_WP_SECURITY_VERSION, + 'AIOS DB version' => AIO_WP_SECURITY_DB_VERSION, + 'AIOS firewall version' => AIO_WP_SECURITY_FIREWALL_VERSION, + 'AIOS Premium installed' => AIOWPSecurity_Utility_Permissions::is_premium_installed() ? 'Yes' : 'No', + ); + + if (AIOWPSecurity_Utility_Permissions::is_premium_installed()) { + $aios_info['AIOS Premium version'] = AIOWPS_PREMIUM_VERSION; + } + + return apply_filters('aiowp_security_get_aios_info', $aios_info); + } + + /** + * Get Server Information + * + * @return array Server information + */ + private static function get_server_info() { + + $server_info = array( + 'Operating system' => php_uname('s') . ' ' . php_uname('r'), + 'Server' => $_SERVER['SERVER_SOFTWARE'], + 'Memory usage' => AIOWPSecurity_Utility::convert_numeric_size_to_text(memory_get_peak_usage(true)), + ); + + if (function_exists('disk_total_space')) { + $server_info = array_merge($server_info, array( + 'Total space' => AIOWPSecurity_Utility::convert_numeric_size_to_text(disk_total_space('/')), + 'Used space' => AIOWPSecurity_Utility::convert_numeric_size_to_text(disk_total_space('/') - disk_free_space('/')), + )); + } + return apply_filters('aiowp_security_get_server_info', $server_info); + } + + /** + * Get PHP Information + * + * @return array PHP information + */ + private static function get_php_info() { + + $php_info = array( + 'PHP version' => phpversion(), + 'PHP expose php' => ini_get('expose_php') ? 'Active' : 'Inactive', + 'PHP allow url fopen' => ini_get('allow_url_fopen') ? 'Active' : 'Inactive', + 'PHP memory limit' => ini_get('memory_limit'), + 'PHP upload max filesize' => ini_get('upload_max_filesize'), + 'PHP post max size' => ini_get('post_max_size'), + 'PHP max execution time' => ini_get('max_execution_time'), + 'PHP max input time' => ini_get('max_input_time'), + 'Process owner' => (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) ? posix_getpwuid(posix_geteuid())['name'] : 'Unknown', + 'OpenSSL support' => extension_loaded('openssl') ? 'OK' : 'Not Installed', + 'OpenSSL version' => extension_loaded('openssl') ? OPENSSL_VERSION_TEXT : 'Unknown', + 'cURL support' => function_exists('curl_init') ? 'OK' : 'Not Installed', + 'cURL features code' => function_exists('curl_version') ? curl_version()['features'] : 'Unknown', + 'cURL host' => function_exists('curl_version') ? curl_version()['host'] : 'Unknown', + 'cURL support protocols' => function_exists('curl_version') ? implode(', ', curl_version()['protocols']) : 'Unknown', + 'cURL SSL version' => function_exists('curl_version') ? curl_version()['ssl_version'] : 'Unknown', + 'cURL libz version' => function_exists('curl_version') ? curl_version()['libz_version'] : 'Unknown', + 'Checking display_errors' => ini_get('display_errors') ? 'Enabled' : 'Disabled', + ); + + return apply_filters('aiowp_security_get_php_info', $php_info); + } + + /** + * Retrieves detailed information about the WordPress configuration. + * + * @return array WordPress configuration information + */ + private static function get_wordpress_info() { + + // Include version.php to retrieve the actual WordPress version + require_once ABSPATH . WPINC . '/version.php'; + + global $wp_version; + + $wp_info = array( + 'WordPress version' => $wp_version, + 'Multisite' => is_multisite() ? 'Yes' : 'No', // Checking if the site is multisite + 'ABSPATH' => ABSPATH, + 'WP_DEBUG' => (defined('WP_DEBUG') && WP_DEBUG) ? 'On' : 'Off', + 'WP_DEBUG_LOG' => (defined('WP_DEBUG_LOG') && WP_DEBUG_LOG) ? 'Enabled' : 'Disabled', + 'WP_DEBUG_DISPLAY' => (defined('WP_DEBUG_DISPLAY') && WP_DEBUG_DISPLAY) ? 'Enabled' : 'Disabled', + 'SCRIPT_DEBUG' => (defined('SCRIPT_DEBUG') && SCRIPT_DEBUG) ? 'On' : 'Off', + 'SAVEQUERIES' => (defined('SAVEQUERIES') && SAVEQUERIES) ? 'On' : 'Off', + 'DB_CHARSET' => defined('DB_CHARSET') ? DB_CHARSET : '(not set)', + 'DB_COLLATE' => defined('DB_COLLATE') ? DB_COLLATE : '(not set)', + 'WP_SITEURL' => defined('WP_SITEURL') ? WP_SITEURL : '(not set)', + 'WP_HOME' => defined('WP_HOME') ? WP_HOME : '(not set)', + 'WP_CONTENT_DIR' => defined('WP_CONTENT_DIR') ? WP_CONTENT_DIR : '(not set)', + 'WP_CONTENT_URL' => defined('WP_CONTENT_URL') ? WP_CONTENT_URL : '(not set)', + 'WP_PLUGIN_DIR' => defined('WP_PLUGIN_DIR') ? WP_PLUGIN_DIR : '(not set)', + 'WP_LANG_DIR' => defined('WP_LANG_DIR') ? WP_LANG_DIR : '(not set)', + 'WPLANG' => defined('WPLANG') ? WPLANG : '(not set)', + 'UPLOADS' => defined('UPLOADS') ? UPLOADS : '(not set)', + 'TEMPLATEPATH' => defined('TEMPLATEPATH') ? TEMPLATEPATH : '(not set)', + 'STYLESHEETPATH' => defined('STYLESHEETPATH') ? STYLESHEETPATH : '(not set)', + 'AUTOSAVE_INTERVAL' => defined('AUTOSAVE_INTERVAL') ? AUTOSAVE_INTERVAL : '', + 'WP_POST_REVISIONS' => defined('WP_POST_REVISIONS') ? WP_POST_REVISIONS : 'Unlimited', + 'COOKIE_DOMAIN' => defined('COOKIE_DOMAIN') ? COOKIE_DOMAIN : '(not set)', + 'COOKIEPATH' => defined('COOKIEPATH') ? COOKIEPATH : '/', + 'SITECOOKIEPATH' => defined('SITECOOKIEPATH') ? SITECOOKIEPATH : '/', + 'ADMIN_COOKIE_PATH' => defined('ADMIN_COOKIE_PATH') ? ADMIN_COOKIE_PATH : '/', + 'PLUGINS_COOKIE_PATH' => defined('PLUGINS_COOKIE_PATH') ? PLUGINS_COOKIE_PATH : '/wp-content/plugins', + 'NOBLOGREDIRECT' => defined('NOBLOGREDIRECT') ? NOBLOGREDIRECT : '(not set)', + 'CONCATENATE_SCRIPTS' => defined('CONCATENATE_SCRIPTS') ? (CONCATENATE_SCRIPTS ? 'Yes' : 'No') : 'No', // Checking if CONCATENATE_SCRIPTS is defined + 'WP_MEMORY_LIMIT' => defined('WP_MEMORY_LIMIT') ? WP_MEMORY_LIMIT : '', + 'WP_MAX_MEMORY_LIMIT' => defined('WP_MAX_MEMORY_LIMIT') ? WP_MAX_MEMORY_LIMIT : '', + 'WP_CACHE' => defined('WP_CACHE') ? (WP_CACHE ? 'Enabled' : 'Disabled') : 'Disabled', + 'CUSTOM_USER_TABLE' => defined('CUSTOM_USER_TABLE') ? CUSTOM_USER_TABLE : '(not set)', + 'CUSTOM_USER_META_TABLE' => defined('CUSTOM_USER_META_TABLE') ? CUSTOM_USER_META_TABLE : '(not set)', + 'FS_CHMOD_DIR' => defined('FS_CHMOD_DIR') ? FS_CHMOD_DIR : '(not set)', + 'FS_CHMOD_FILE' => defined('FS_CHMOD_FILE') ? FS_CHMOD_FILE : '(not set)', + 'ALTERNATE_WP_CRON' => defined('ALTERNATE_WP_CRON') ? (ALTERNATE_WP_CRON ? 'Enabled' : 'Disabled') : 'Disabled', + 'DISABLE_WP_CRON' => defined('DISABLE_WP_CRON') ? (DISABLE_WP_CRON ? 'Cron is disabled' : 'Cron is enabled') : 'Cron is enabled', + 'WP_CRON_LOCK_TIMEOUT' => defined('WP_CRON_LOCK_TIMEOUT') ? WP_CRON_LOCK_TIMEOUT : '', + 'EMPTY_TRASH_DAYS' => defined('EMPTY_TRASH_DAYS') ? EMPTY_TRASH_DAYS : '', + 'WP_ALLOW_REPAIR' => defined('WP_ALLOW_REPAIR') ? (WP_ALLOW_REPAIR ? 'Enabled' : 'Disabled') : 'Disabled', + 'DO_NOT_UPGRADE_GLOBAL_TABLES' => defined('DO_NOT_UPGRADE_GLOBAL_TABLES') ? (DO_NOT_UPGRADE_GLOBAL_TABLES ? 'Yes' : 'No') : 'No', // Checking if DO_NOT_UPGRADE_GLOBAL_TABLES is defined + 'DISALLOW_FILE_EDIT' => defined('DISALLOW_FILE_EDIT') ? (DISALLOW_FILE_EDIT ? 'Yes' : 'No') : 'No', // Checking if DISALLOW_FILE_EDIT is defined + 'DISALLOW_FILE_MODS' => defined('DISALLOW_FILE_MODS') ? (DISALLOW_FILE_MODS ? 'Yes' : 'No') : 'No', // Checking if DISALLOW_FILE_MODS is defined + 'IMAGE_EDIT_OVERWRITE' => defined('IMAGE_EDIT_OVERWRITE') ? (IMAGE_EDIT_OVERWRITE ? 'Yes' : 'No') : 'No', // Checking if IMAGE_EDIT_OVERWRITE is defined + 'FORCE_SSL_ADMIN' => defined('FORCE_SSL_ADMIN') ? (FORCE_SSL_ADMIN ? 'Yes' : 'No') : 'No', // Checking if FORCE_SSL_ADMIN is defined + 'WP_HTTP_BLOCK_EXTERNAL' => defined('WP_HTTP_BLOCK_EXTERNAL') ? (WP_HTTP_BLOCK_EXTERNAL ? 'Yes' : 'No') : 'No', // Checking if WP_HTTP_BLOCK_EXTERNAL is defined + 'WP_ACCESSIBLE_HOSTS' => defined('WP_ACCESSIBLE_HOSTS') ? WP_ACCESSIBLE_HOSTS : '(not set)', + 'WP_AUTO_UPDATE_CORE' => defined('WP_AUTO_UPDATE_CORE') ? WP_AUTO_UPDATE_CORE : 'Default', + 'WP_PROXY_HOST' => defined('WP_PROXY_HOST') ? WP_PROXY_HOST : '(not set)', + 'WP_PROXY_PORT' => defined('WP_PROXY_PORT') ? WP_PROXY_PORT : '(not set)', + 'MULTISITE' => defined('MULTISITE') ? (MULTISITE ? 'Yes' : 'No') : 'No', // Checking if MULTISITE is defined + 'WP_ALLOW_MULTISITE' => defined('WP_ALLOW_MULTISITE') ? (WP_ALLOW_MULTISITE ? 'Yes' : 'No') : 'No', // Checking if WP_ALLOW_MULTISITE is defined + 'SUNRISE' => defined('SUNRISE') ? (SUNRISE ? 'Yes' : 'No') : 'No', // Checking if SUNRISE is defined + 'SUBDOMAIN_INSTALL' => defined('SUBDOMAIN_INSTALL') ? (SUBDOMAIN_INSTALL ? 'Yes' : 'No') : 'No', // Checking if SUBDOMAIN_INSTALL is defined + 'VHOST' => defined('VHOST') ? (VHOST ? 'Yes' : 'No') : 'No', // Checking if VHOST is defined + 'DOMAIN_CURRENT_SITE' => defined('DOMAIN_CURRENT_SITE') ? DOMAIN_CURRENT_SITE : '(not set)', + 'PATH_CURRENT_SITE' => defined('PATH_CURRENT_SITE') ? PATH_CURRENT_SITE : '(not set)', + 'BLOG_ID_CURRENT_SITE' => defined('BLOG_ID_CURRENT_SITE') ? BLOG_ID_CURRENT_SITE : '(not set)', + 'WP_DISABLE_FATAL_ERROR_HANDLER' => defined('WP_DISABLE_FATAL_ERROR_HANDLER') ? (WP_DISABLE_FATAL_ERROR_HANDLER ? 'Yes' : 'No') : 'No', // Checking if WP_DISABLE_FATAL_ERROR_HANDLER is defined + 'AUTOMATIC_UPDATER_DISABLED' => defined('AUTOMATIC_UPDATER_DISABLED') ? (AUTOMATIC_UPDATER_DISABLED ? 'Yes' : 'No') : 'No' // Checking if AUTOMATIC_UPDATER_DISABLED is defined + ); + + return apply_filters('aiowp_security_get_wordpress_info', $wp_info); + } + + /** + * Get a list of active and inactive plugins. + * + * @return array List of plugins with their status (active/inactive). + */ + private static function get_plugins_list() { + $plugins = get_plugins(); + $active_plugins = get_option('active_plugins', array()); + + $plugins_list = array(); + + if (empty($plugins)) { + return array('No plugins found' => '-'); + } + + foreach ($plugins as $plugin_path => $plugin_info) { + $plugin_slug = strtolower(basename($plugin_path, '.php')); + $plugin_status = in_array($plugin_path, $active_plugins) ? 'Active' : 'Inactive'; + $plugin_version = $plugin_info['Version']; + $plugin_name = $plugin_info['Name']; + + $plugin_key = "$plugin_name ($plugin_slug) [$plugin_version]"; + + $plugins_list[$plugin_key] = $plugin_status; + } + + return apply_filters('aiowp_security_get_plugins_info', $plugins_list); + } + + /** + * Get a list of themes with their status (active/inactive), version, and slug. + * + * @return array List of themes. + */ + private static function get_themes_list() { + $themes = wp_get_themes(); + $active_theme = wp_get_theme(); + $themes_list = array(); + + if (empty($themes)) { + return array('No themes found' => '-'); + } + + foreach ($themes as $theme_slug => $theme_info) { + $theme_name = $theme_info->get('Name'); + $theme_version = $theme_info->get('Version'); + $theme_status = $theme_info->get_stylesheet() === $active_theme->get_stylesheet() ? 'Active' : 'Inactive'; + + $theme_key = "$theme_name ($theme_slug) [$theme_version]"; + $themes_list[$theme_key] = $theme_status; + } + + return apply_filters('aiowp_security_get_themes_info', $themes_list); + } + + /** + * Get database information + * + * @return array Database information + */ + private static function get_database_info() { + global $wpdb; + + $database_info = array( + 'Database version' => $wpdb->db_version(), + 'DELETE' => self::check_mysql_privilege('DELETE'), + 'INSERT' => self::check_mysql_privilege('INSERT'), + 'UPDATE' => self::check_mysql_privilege('UPDATE'), + 'SELECT' => self::check_mysql_privilege('SELECT'), + 'CREATE TABLE' => self::check_mysql_privilege('CREATE TABLE'), + 'ALTER TABLE' => self::check_mysql_privilege('ALTER TABLE'), + 'DROP' => self::check_mysql_privilege('DROP'), + 'TRUNCATE' => self::check_mysql_privilege('TRUNCATE') + ); + + return apply_filters('aiowp_security_get_database_info', $database_info); + } + + /** + * Get a list of Must Use (MU) plugins. + * + * @return array List of MU plugins. + */ + private static function get_mu_plugins_list() { + $mu_plugins = get_mu_plugins(); + $mu_plugins_list = array(); + + if (empty($mu_plugins)) { + return array('No Must-use plugins found' => '-'); + } + + foreach ($mu_plugins as $mu_plugin_path => $mu_plugin_info) { + $mu_plugin_slug = basename($mu_plugin_path, '.php'); + $mu_plugin_version = $mu_plugin_info['Version']; + $mu_plugin_name = $mu_plugin_info['Name']; + + $mu_plugin_key = "$mu_plugin_name ($mu_plugin_slug) [$mu_plugin_version]"; + + $mu_plugins_list[$mu_plugin_key] = 'Active'; + } + + return apply_filters('aiowp_security_get_mu_plugins_info', $mu_plugins_list); + } + + /** + * Get a list of drop-in plugins. + * + * @return array List of drop-in plugins. + */ + private static function get_dropin_plugins_list() { + $dropins = _get_dropins(); + $dropins_list = array(); + + if ('' === $dropins) { + return array('No drop-in plugins found' => '-'); + } + + foreach ($dropins as $dropin_file => $dropin_info) { + $dropin_status = true === $dropin_info[1] ? 'Active' : 'Inactive'; + $dropin_description = $dropin_info[0]; + + $dropin_key = "$dropin_file [$dropin_description]"; + $dropins_list[$dropin_key] = $dropin_status; + } + + return apply_filters('aiowp_security_get_dropin_plugins_info', $dropins_list); + } + + /** + * Get a list of cron jobs scheduled in WordPress. + * + * @return array List of cron jobs. + */ + public static function get_cron_jobs_list() { + $cron_jobs = _get_cron_array(); + $cron_jobs_list = array(); + + $failed_jobs = 0; + + if (empty($cron_jobs)) { + return array(); // Return an empty array if no cron jobs are found. + } + + $current_timestamp = time(); + $cron_jobs_list['Failed cron jobs'] = $failed_jobs; + foreach ($cron_jobs as $timestamp => $cron_events) { + foreach ($cron_events as $event_hook => $event_data) { + foreach ($event_data as $schedule => $callback) { + if ($timestamp < $current_timestamp) { + $failed_jobs++; + } + $schedule = $callback['schedule']; + $cron_jobs_list[$event_hook] = $schedule; + } + } + } + + return apply_filters('aiowp_security_get_cron_jobs_info', $cron_jobs_list); + } + + /** + * Get debug log + * + * @param bool $html Whether to return the debug log as HTML + * + * @return string Debug log + */ + private static function get_debug_log($html = false) { + global $wpdb, $aio_wp_security; + + if ('1' === $aio_wp_security->configs->get_value('aiowps_enable_debug')) { + + $debug_log_tbl = AIOWPSEC_TBL_DEBUG_LOG; + + $where_sql = is_super_admin() ? '' : 'WHERE site_id = %d'; + $query = "SELECT * FROM {$debug_log_tbl} {$where_sql} ORDER BY id DESC LIMIT 100"; + + $debug_logs = is_super_admin() ? $wpdb->get_results($query, ARRAY_A) : $wpdb->get_results($wpdb->prepare($query, get_current_blog_id()), ARRAY_A); + + if ($html) { + $debug_log = "Debug log
"; + } else { + $debug_log = "\n --- Debug log --- \n\n"; + } + + foreach ($debug_logs as $log) { + $date_time = esc_html($log['created']); + $level = esc_html($log['level']); + $message = esc_html($log['message']); + $type = esc_html($log['type']); + + if ($html) { + $debug_log .= "Only the most recent 100 logs are displayed"; + $debug_log .= "Date and time: $date_time
"; + $debug_log .= "Level: $level
"; + $debug_log .= "Message: $message
"; + $debug_log .= "Type: $type
"; + } else { + $debug_log .= "Only the most recent 100 logs are displayed.\n"; + $debug_log .= "Date and time: $date_time\n"; + $debug_log .= "Level: $level\n"; + $debug_log .= "Message: $message\n"; + $debug_log .= "Type: $type\n\n"; + } + } + + return apply_filters('aiowp_security_get_debug_log_info', $debug_log); + } + } + + /** + * Get the IP address detection methods and their status + * + * @return array IP detection methods and their status + */ + private static function get_ip_detection_methods() { + global $aio_wp_security; + $ip_detection_methods = AIOS_Abstracted_Ids::get_ip_retrieve_methods(); + + $active_method = $aio_wp_security->configs->get_site_value('aiowps_ip_retrieve_method'); // In a multisite network, this setting is available for the main site only. + $active_method = empty($active_method) ? 0 : (int) $active_method; + + $ip_detection_list = array(); + + foreach ($ip_detection_methods as $method => $variable) { + $status = ($method === $active_method) ? ' - ' . __('status', 'all-in-one-wp-security-and-firewall') . ': ' . __('On', 'all-in-one-wp-security-and-firewall') : ''; + $ip_address = (!empty($_SERVER[$variable])) ? $_SERVER[$variable] : ''; + $ip_detection_list[$variable] = __('IP', 'all-in-one-wp-security-and-firewall') . ': ' . $ip_address . $status; + } + + return $ip_detection_list; + } + + /** + * Check if the current MySQL user has the specified privilege + * + * @param string $privilege Privilege to check + * + * @return string 'OK' if the user has the privilege, 'Not OK' otherwise + */ + private static function check_mysql_privilege($privilege) { + global $wpdb; + $grants = $wpdb->get_results("SHOW GRANTS FOR CURRENT_USER", ARRAY_N); + foreach ($grants as $grant) { + foreach ($grant as $grant_string) { + if (strpos(strtoupper($grant_string), 'ALL PRIVILEGES') !== false || strpos(strtoupper($grant_string), strtoupper($privilege)) !== false) { + return 'OK'; + } + } + } + return 'Not OK'; + } + + /** + * Generate the debug report + * + * @return string Debug report + */ + public static function generate_report() { + + $data = ''; + $section_content = array(); + + foreach (self::$sections as $title => $method) { + $section_title = esc_html($title); + $section_content = self::$method(); + + // Check if the section content is empty, and handle accordingly. + if (empty($section_content)) { + $section_content = array('No data available'); + } + + $data .= AIOWPSecurity_Reporting::generate_report_sections('table', $section_content, $section_title); + } + + return $data; + } + + /** + * Generate a report for the diagnostics page + * + * @param string $title The title of the report + * + * @return string Report textarea + */ + public static function generate_report_textarea($title) { + $main_content = ''; + + $report_content = $title . "\n\n===================================\n"; + + foreach (self::$sections as $title => $method) { + $section_title = esc_html($title); + $section_content = self::$method(); + $main_content .= AIOWPSecurity_Reporting::generate_report_sections('text', $section_content, $section_title); + } + + $main_content .= self::get_debug_log(); + + $report_content = apply_filters('aiowp_security_generate_report_content', $report_content . $main_content); + + $escaped_content = esc_textarea($report_content); + + return ''; + } + + /** + * Generate sender action button and field + * + * @return string sender action button and email field + */ + public static function add_sender_report_actions() { + $report_sections = ''; + foreach (self::$sections as $title => $method) { + $section_title = esc_html($title); + $section_content = self::$method(); + $report_sections .= AIOWPSecurity_Reporting::generate_report_sections('table', $section_content, $section_title); + } + $encoded_report_sections = htmlentities($report_sections); + + $data = '
';
+
+ // Allow only safe HTML in the response
+ echo wp_kses($data, array(
+ 'div' => array(),
+ 'form' => array(
+ 'action' => true,
+ 'method' => true,
+ ),
+ 'input' => array(
+ 'type' => true,
+ 'id' => true,
+ 'placeholder' => true,
+ 'value' => true,
+ 'required' => true,
+ ),
+ 'button' => array(
+ 'class' => true,
+ 'id' => true,
+ ),
+ 'br' => array(),
+ ));
+ }
+
+ /**
+ * Get the current user email if admin or the site admin email
+ *
+ * @return string The email address
+ */
+ private static function get_current_user_email() {
+ $user = wp_get_current_user();
+ if ($user && in_array('administrator', (array) $user->roles, true)) {
+ return $user->user_email;
+ } else {
+ return get_option('admin_email');
+ }
+ }
+
+ /**
+ * Send the report email
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ *
+ * @param string $email The email address to send the report to.
+ * @param string $sections The report sections html.
+ *
+ * @return boolean True if the email was sent successfully, false otherwise
+ */
+ public static function send_report($email, $sections) {
+ global $aio_wp_security;
+
+ $report = '';
+ $report .= '
' . esc_html('All-In-One Security diagnostics report') . '
'; + + $site_name = esc_html(get_bloginfo('name')); + $report .= '' . 'Site name' . ': ' . $site_name . "
"; + + $site_url = esc_url(get_bloginfo('url')); + $report .= '' . 'Site URL' . ': ' . '' . $site_url . '
'; + + $current_datetime = date_i18n(get_option('date_format') . ' ' . get_option('time_format')); + $report .= '' . 'Date and time' . ': ' . $current_datetime . "
"; + + $report .= $sections; + + $report .= self::get_debug_log(true); + + $report .= '' . esc_html('This report was generated by the All-In-One Security plugin.') . '
'; + $subject = esc_html('All-In-One Security - diagnostic report'); + + $result = $aio_wp_security->sender_obj->send_email($email, $subject, $report); + + return $result; + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-file-scan.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-file-scan.php new file mode 100755 index 00000000..cbc1ec83 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-file-scan.php @@ -0,0 +1,381 @@ +configs->get_value('aiowps_fcd_filename'); + if (empty($fcd_filename)) { + // means that we haven't done a scan before, or, + // the fcd file containing the results doesn't exist + $random_suffix = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(10); + $fcd_filename = 'aiowps_fcd_data_' . $random_suffix; + $aio_wp_security->configs->set_value('aiowps_fcd_filename', $fcd_filename, true); + } + + $fcd_data = self::get_fcd_data(); // get previous scan data if any + + if (false === $fcd_data) { + // an error occurred so return + return false; + } + + $scanned_data = $this->do_file_change_scan(); + + if (empty($fcd_data)) { + $this->save_fcd_data($scanned_data); + $scan_result['initial_scan'] = '1'; + return $scan_result; + } else { + + $scan_result = $this->compare_scan_data($fcd_data['file_scan_data'], $scanned_data); + + $scan_result['initial_scan'] = ''; + $this->save_fcd_data($scanned_data, $scan_result); + if (!empty($scan_result['files_added']) || !empty($scan_result['files_removed']) || !empty($scan_result['files_changed'])) { + //This means there was a change detected + $aio_wp_security->configs->set_value('aiowps_fcds_change_detected', true, true); + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - change to filesystem detected!"); + + $this->aiowps_send_file_change_alert_email($scan_result); //Send file change scan results via email if applicable + } else { + //Reset the change flag + $aio_wp_security->configs->set_value('aiowps_fcds_change_detected', false, true); + } + return $scan_result; + } + } + + /** + * Send email with notification about file changes detected by last scan. + * + * @global AIO_WP_Security $aio_wp_security + * @param array $scan_result Array with scan result returned by compare_scan_data() method. + */ + public function aiowps_send_file_change_alert_email($scan_result) { + global $aio_wp_security; + if ('1' == $aio_wp_security->configs->get_value('aiowps_send_fcd_scan_email')) { + $subject = __('All In One WP Security - File change detected', 'all-in-one-wp-security-and-firewall') . ' ' . AIOWPSecurity_Utility::convert_timestamp(null, 'l, F jS, Y \a\\t g:i a'); + //$attachment = array(); + $message = __('A file change was detected on your system for site URL', 'all-in-one-wp-security-and-firewall') . ' ' . network_site_url() . __('. Scan was generated on', 'all-in-one-wp-security-and-firewall') . ' ' . AIOWPSecurity_Utility::convert_timestamp(null, 'l, F jS, Y \a\\t g:i a'); + $message .= "\r\n\r\n".__('A summary of the scan results is shown below:', 'all-in-one-wp-security-and-firewall'); + $message .= "\r\n\r\n"; + $message .= self::get_file_change_summary($scan_result); + $message .= "\r\n".__('Login to your site to view the scan details.', 'all-in-one-wp-security-and-firewall'); + + // Get the email address(es). + $addresses = AIOWPSecurity_Utility::get_array_from_textarea_val($aio_wp_security->configs->get_value('aiowps_fcd_scan_email_address')); + // If no explicit email address(es) are given, send email to site admin. + $to = empty($addresses) ? array(get_site_option('admin_email')) : $addresses; + if (!wp_mail($to, $subject, $message)) { + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - File change notification email failed to send.", 4); + } + + } + } + + /** + * This function is called via the following filter 'aiowps_perform_fcd_scan_tasks' and will start the file scan + * + * @return void + */ + public function aiowps_scheduled_fcd_scan_handler() { + global $aio_wp_security; + + if ('1' != $aio_wp_security->configs->get_value('aiowps_enable_automated_fcd_scan')) return; + + $aio_wp_security->debug_logger->log_debug_cron(__METHOD__ . " - Scheduled fcd_scan is enabled. Checking now to see if scan needs to be done..."); + + $current_time = time(); + + $next_fcd_scan_time = self::get_next_scheduled_scan(); + + if ($next_fcd_scan_time <= $current_time) { + // It's time to do a filescan + $result = $this->execute_file_change_detection_scan(); + if (false === $result) { + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - Scheduled filescan operation failed.", 4); + } else { + $aio_wp_security->configs->set_value('aiowps_last_fcd_scan_time', $current_time, true); + } + } + + } + + /** + * This function will get the next scheduled scan timestamp and return it + * + * @return int|bool - the next scheduled scan timestamp, or false if the scheduled scan is not setup + */ + public static function get_next_scheduled_scan() { + global $aio_wp_security; + + if ('1' != $aio_wp_security->configs->get_value('aiowps_enable_automated_fcd_scan')) return false; + + $fcd_scan_frequency = $aio_wp_security->configs->get_value('aiowps_fcd_scan_frequency'); // Number of hours or days or months interval + $interval_setting = $aio_wp_security->configs->get_value('aiowps_fcd_scan_interval'); // Hours/Days/Months + switch ($interval_setting) { + case '0': + $interval = 'hours'; + break; + case '1': + $interval = 'days'; + break; + case '2': + $interval = 'weeks'; + break; + } + $last_fcd_scan_time = $aio_wp_security->configs->get_value('aiowps_last_fcd_scan_time'); + if (null == $last_fcd_scan_time) { + // Set the last scan time to now so it can trigger for the next scheduled period + $last_fcd_scan_time = time(); + $aio_wp_security->configs->set_value('aiowps_last_fcd_scan_time', $last_fcd_scan_time, true); + } elseif (is_string($last_fcd_scan_time)) { + $last_fcd_scan_time = strtotime($last_fcd_scan_time); + $aio_wp_security->configs->set_value('aiowps_last_fcd_scan_time', $last_fcd_scan_time, true); + } + $next_fcd_scan_time = strtotime("+".abs($fcd_scan_frequency).$interval, $last_fcd_scan_time); + + return $next_fcd_scan_time; + } + + /** + * Get the last filechange detection data which is stored in the special file. + * + * @global AIO_WP_Security $aio_wp_security + * @return bool|array - false on failure, array on success + */ + public static function get_fcd_data() { + // phpcs:disable WordPress.WP.AlternativeFunctions -- Silence wp_filesystem method suggestion. We cannot use that method. + global $aio_wp_security; + $aiowps_backup_dir = WP_CONTENT_DIR.'/'.AIO_WP_SECURITY_BACKUPS_DIR_NAME; + + $fcd_filename = $aio_wp_security->configs->get_value('aiowps_fcd_filename'); + if (empty($fcd_filename)) { + // means that we haven't done a scan before, or, + // the fcd file containing the results doesn't exist + $random_suffix = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(10); + $fcd_filename = 'aiowps_fcd_data_' . $random_suffix; + $aio_wp_security->configs->set_value('aiowps_fcd_filename', $fcd_filename, true); + } + $results_file = $aiowps_backup_dir. '/'. $fcd_filename; + + if (!is_file($results_file)) { + if (is_dir($results_file)) { + $new_dir_name = $results_file . '_backup'; + rename($results_file, $new_dir_name); //Rename the folder to create backup of the folder. This condition should not really happen, but if it does (user sets some non-sensible value), then it's better to not nuke the existing folder + } + $fp = @fopen($results_file, 'w'); //open for write - will create file if doesn't exist + return array(); + } + + if (empty(filesize($results_file))) { + return array(); // if newly created file return empty array + } + + $fp = @fopen($results_file, 'r'); //open for read and write - will create file if doesn't exist + if (false === $fp) { + // Error + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - fopen returned false when opening fcd data file"); + return false; + } + + $contents = fread($fp, filesize($results_file)); + fclose($fp); + if (false === $contents) { + // Error + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - fread returned false when reading fcd data file"); + return false; + } else { + + $fcd_file_contents = json_decode($contents, true); + if (isset($fcd_file_contents['file_scan_data'])) { + return $fcd_file_contents; + } else { + return array(); + } + + } + + // phpcs:enable WordPress.WP.AlternativeFunctions -- Silence wp_filesystem method suggestion. We cannot use that method. + } + + /** + * Recursively scan the entire $start_dir directory and return file size + * and last modified date of every regular file. Ignore files and file + * types specified in file scanner settings. + * + * @global AIO_WP_Security $aio_wp_security + * @param string $start_dir + * @return array + */ + public function do_file_change_scan($start_dir = ABSPATH) { + global $aio_wp_security; + $filescan_data = array(); + // Iterator key is absolute file path, iterator value is SplFileInfo object, + // iteration skips '..' and '.' records, because we're not interested in directories. + $dit = new RecursiveDirectoryIterator($start_dir, FilesystemIterator::KEY_AS_PATHNAME | FilesystemIterator::CURRENT_AS_FILEINFO | FilesystemIterator::SKIP_DOTS); + $rit = new RecursiveIteratorIterator($dit, RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD); + + // Grab files/directories to skip + $files_to_skip = AIOWPSecurity_Utility::explode_trim_filter_empty($aio_wp_security->configs->get_value('aiowps_fcd_exclude_files')); + // Grab (lowercased) file types to skip + $file_types_to_skip = AIOWPSecurity_Utility::explode_trim_filter_empty(strtolower($aio_wp_security->configs->get_value('aiowps_fcd_exclude_filetypes'))); + + $start_dir_length = strlen($start_dir); + + foreach ($rit as $filename => $fileinfo) { + + if (!file_exists($filename) || is_dir($filename)) { + continue; // if file doesn't exist or is a directory move on to next iteration + } + + if ($fileinfo->getFilename() == 'wp-security-log-cron-job.txt' || $fileinfo->getFilename() == 'wp-security-log.txt') { + continue; // Skip AIOS log files + } + + // Let's omit any file types from the scan which were specified in the settings if necessary + if (!empty($file_types_to_skip)) { + //$current_file_ext = strtolower($fileinfo->getExtension()); //getExtension() only available on PHP 5.3.6 or higher + $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); + if (in_array($ext, $file_types_to_skip)) { + continue; + } + } + + // Let's omit specific files or directories from the scan which were specified in the settings + if (!empty($files_to_skip)) { + + $skip_this = false; + foreach ($files_to_skip as $f_or_dir) { + // Expect files/dirs to be specified relatively to $start_dir, + // so start searching at $start_dir_length offset. + if (strpos($filename, $f_or_dir, $start_dir_length) !== false) { + $skip_this = true; + break; // ! + } + } + if ($skip_this) { + continue; + } + } + + $filescan_data[$filename] = array( + 'last_modified' => $fileinfo->getMTime(), + 'filesize' => $fileinfo->getSize(), + ); + + } + return $filescan_data; + } + + public function compare_scan_data($last_scan_data, $new_scanned_data) { + // Identify new files added: get all files which are in the new scan but not present in the old scan + $files_added = @array_diff_key($new_scanned_data, $last_scan_data); + // Identify files deleted: get all files which are in the old scan but not present in the new scan + $files_removed = @array_diff_key($last_scan_data, $new_scanned_data); + // Identify existing files: get all files which are in new scan, but were not added + $files_kept = @array_diff_key($new_scanned_data, $files_added); + + $files_changed = array(); + + // Loop through existing files and determine, if they have been changed + foreach ($files_kept as $filename => $new_scan_meta) { + $last_scan_meta = $last_scan_data[$filename]; + // Check filesize and last_modified values + if (($new_scan_meta['last_modified'] !== $last_scan_meta['last_modified']) || ($new_scan_meta['filesize'] !== $last_scan_meta['filesize'])) { + $files_changed[$filename] = $new_scan_meta; + } + } + + // Create single array of all changes + return array( + 'files_added' => $files_added, + 'files_removed' => $files_removed, + 'files_changed' => $files_changed, + ); + } + + public static function get_file_change_summary($scan_result) { + $scan_summary = ""; + if (!empty($scan_result['files_added'])) { + //Output of files added + $scan_summary .= "\r\n".__('The following files were added to your host', 'all-in-one-wp-security-and-firewall').":\r\n"; + foreach ($scan_result['files_added'] as $key => $value) { + $scan_summary .= "\r\n".$key.' ('.__('modified on:', 'all-in-one-wp-security-and-firewall'). ' ' . AIOWPSecurity_Utility::convert_timestamp($value['last_modified']).')'; + } + $scan_summary .= "\r\n======================================\r\n"; + } + if (!empty($scan_result['files_removed'])) { + //Output of files removed + $scan_summary .= "\r\n".__('The following files were removed from your host', 'all-in-one-wp-security-and-firewall').":\r\n"; + foreach ($scan_result['files_removed'] as $key => $value) { + $scan_summary .= "\r\n".$key.' ('.__('modified on:', 'all-in-one-wp-security-and-firewall'). ' ' . AIOWPSecurity_Utility::convert_timestamp($value['last_modified']).')'; + } + $scan_summary .= "\r\n======================================\r\n"; + } + + if (!empty($scan_result['files_changed'])) { + //Output of files changed + $scan_summary .= "\r\n".__('The following files were changed on your host', 'all-in-one-wp-security-and-firewall').":\r\n"; + foreach ($scan_result['files_changed'] as $key => $value) { + $scan_summary .= "\r\n".$key.' ('.__('modified on:', 'all-in-one-wp-security-and-firewall'). ' ' . AIOWPSecurity_Utility::convert_timestamp($value['last_modified']).')'; + } + $scan_summary .= "\r\n======================================\r\n"; + } + + return $scan_summary; + } + + /** + * Saves file change detection data into a special file + * + * @global AIO_WP_Security $aio_wp_security + * @param type $scanned_data + * @param type $scan_result + * @return boolean + */ + public function save_fcd_data($scanned_data, $scan_result = array()) { + global $aio_wp_security; + + $date_time = current_time('mysql'); + $data = array('date_time' => $date_time, 'file_scan_data' => $scanned_data, 'last_scan_result' => $scan_result); + + $fcd_filename = $aio_wp_security->configs->get_value('aiowps_fcd_filename'); + $aiowps_backup_dir = WP_CONTENT_DIR.'/'.AIO_WP_SECURITY_BACKUPS_DIR_NAME; + + if (!AIOWPSecurity_Utility_File::create_dir($aiowps_backup_dir)) { + $aio_wp_security->debug_logger->log_debug(__METHOD__ . " - Creation of DB backup directory failed!", 4); + return false; + } + + // phpcs:disable WordPress.WP.AlternativeFunctions -- Silence wp_filesystem method suggestion. We cannot use that method. + $results_file = $aiowps_backup_dir. '/'. $fcd_filename; + $fp = fopen($results_file, 'w'); + fwrite($fp, json_encode($data)); + fclose($fp); + // phpcs:enable WordPress.WP.AlternativeFunctions -- Silence wp_filesystem method suggestion. We cannot use that method. + + return true; + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource-unavailable.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource-unavailable.php new file mode 100755 index 00000000..923b1ec9 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource-unavailable.php @@ -0,0 +1,74 @@ +resource = $resource; + do_action('aios_firewall_unavailable_resource', $this->resource); + } + + /** + * Handles call operation on an unavailable firewall resource. + * + * @param string $name + * @param array $arguments + * + * @return void + */ + public function __call($name, $arguments) { + do_action('aios_firewall_unavailable_resource_method_call', $this->resource, $name, $arguments); + } + + /** + * Handles call operation on an unavailable static firewall resource. + * + * @param string $name + * @param array $arguments + * + * @return void + */ + public static function __callStatic($name, $arguments) { + do_action('aios_firewall_unavailable_resource_static_method_call', $name, $arguments); + } + + /** + * Handles get operation on an unavailable firewall resource. + * + * @param string $name + * + * @return void + */ + public function __get($name) { + do_action('aios_firewall_unavailable_resource_get_property', $this->resource, $name); + } + + /** + * Handles set operation on an unavailable firewall resource. + * + * @param string $name + * @param mixed $value + * + * @return void + */ + public function __set($name, $value) { + do_action('aios_firewall_unavailable_resource_set_property', $this->resource, $name, $value); + } + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource.php new file mode 100755 index 00000000..a00df11a --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-firewall-resource.php @@ -0,0 +1,53 @@ +configs->get_value('aiowps_disable_xmlrpc_pingback_methods')) { + add_filter('xmlrpc_methods', array($this, 'aiowps_disable_xmlrpc_pingback_methods')); + add_filter('wp_headers', array($this, 'aiowps_remove_x_pingback_header')); + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_disable_rss_and_atom_feeds')) { + add_action('do_feed', array($this, 'block_feed'), 1); + add_action('do_feed_rdf', array($this, 'block_feed'), 1); + add_action('do_feed_rss', array($this, 'block_feed'), 1); + add_action('do_feed_rss2', array($this, 'block_feed'), 1); + add_action('do_feed_atom', array($this, 'block_feed'), 1); + add_action('do_feed_rss2_comments', array($this, 'block_feed'), 1); + add_action('do_feed_atom_comments', array($this, 'block_feed'), 1); + + remove_action('wp_head', 'feed_links_extra', 3); + remove_action('wp_head', 'feed_links', 2); + } + + // Check permanent block list and block if applicable (ie, do PHP blocking) + if (!is_user_logged_in()) { + AIOWPSecurity_Blocking::check_visitor_ip_and_perform_blocking(); + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_spambot_detecting') && '0' == $aio_wp_security->configs->get_value('aiowps_spam_comments_should')) { + add_action('pre_comment_on_post', array($this, 'spam_detecting_and_process_comments_discard'), 10, 2); //this hook gets fired before comment is added + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_spambot_detecting') && '1' == $aio_wp_security->configs->get_value('aiowps_spam_comments_should')) { + add_filter('pre_comment_approved', array($this, 'spam_detecting_and_process_comments_mark_spam'), 10, 2); //this hook filters a comments approval status before it is set + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_autoblock_spam_ip')) { + add_action('comment_post', array($this, 'spam_detect_process_comment_post'), 10, 2); //this hook gets fired just after comment is saved to DB + add_action('transition_comment_status', array($this, 'process_transition_comment_status'), 10, 3); //this hook gets fired when a comment's status changes + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_rename_login_page')) { + add_action('widgets_init', array($this, 'remove_standard_wp_meta_widget')); + add_filter('retrieve_password_message', array($this, 'decode_reset_pw_msg'), 10, 4); //Fix for non decoded html entities in password reset link + // Gravity form preview exposed renamed login page when called auth_redirect + add_filter('login_url', array($this, 'login_url_reauth_redirect'), 10, 3); + } + + if (AIOWPSecurity_Utility_Permissions::has_manage_cap() && is_admin()) { + if ('1' == $aio_wp_security->configs->get_value('aios_google_recaptcha_invalid_configuration')) { + add_action('all_admin_notices', array($this, 'google_recaptcha_notice')); + } + + if (is_main_site() && is_super_admin()) { + add_action('all_admin_notices', array($this, 'do_firewall_notice')); + add_action('admin_post_aiowps_firewall_setup', array(AIOWPSecurity_Firewall_Setup_Notice::get_instance(), 'handle_setup_form')); + add_action('admin_post_aiowps_firewall_downgrade', array(AIOWPSecurity_Firewall_Setup_Notice::get_instance(), 'handle_downgrade_protection_form')); + add_action('admin_post_aiowps_firewall_setup_dismiss', array(AIOWPSecurity_Firewall_Setup_Notice::get_instance(), 'handle_dismiss_form')); + } + } + + /** + * Send X-Frame-Options: SAMEORIGIN in HTTP header + */ + if ('1' == $aio_wp_security->configs->get_value('aiowps_prevent_site_display_inside_frame')) { + add_action('template_redirect', 'send_frame_options_header'); + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_remove_wp_generator_meta_info')) { + add_filter('the_generator', array($this,'remove_wp_generator_meta_info')); + add_filter('style_loader_src', array($this,'remove_wp_css_js_meta_info')); + add_filter('script_loader_src', array($this,'remove_wp_css_js_meta_info')); + } + + // For the cookie based brute force prevention feature + // Already logged in user should not redirected to brute_force_redirect_url in any case so added condition !is_user_logged_in() + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_brute_force_attack_prevention')) { + $bfcf_secret_word = $aio_wp_security->configs->get_value('aiowps_brute_force_secret_word'); + if (isset($_GET[$bfcf_secret_word])) { + AIOWPSecurity_Utility_IP::check_login_whitelist_and_forbid(); + + // If URL contains secret word in query param then set cookie and then redirect to the login page + AIOWPSecurity_Utility::set_cookie_value(AIOWPSecurity_Utility::get_brute_force_secret_cookie_name(), AIOS_Helper::get_hash($bfcf_secret_word)); + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_rename_login_page') && !is_user_logged_in()) { + $login_url = home_url((get_option('permalink_structure') ? '' : '?') . $aio_wp_security->configs->get_value('aiowps_login_page_slug')); + AIOWPSecurity_Utility::redirect_to_url($login_url); + } elseif (!is_user_logged_in()) { + AIOWPSecurity_Utility::redirect_to_url(AIOWPSEC_WP_URL.'/wp-admin'); + } + } + } + // Stop users enumeration feature + if (1 == $aio_wp_security->configs->get_value('aiowps_prevent_users_enumeration')) { + include_once(AIO_WP_SECURITY_PATH.'/other-includes/wp-security-stop-users-enumeration.php'); + add_filter('rest_request_before_callbacks', array($this, 'rest_request_before_callbacks'), 10, 1); + add_filter('oembed_response_data', array($this, 'oembed_response_data'), 10, 1); + } + + // REST API security + if ($aio_wp_security->configs->get_value('aiowps_disallow_unauthorized_rest_requests') == 1) { + add_action('rest_api_init', array($this, 'check_rest_api_requests'), 10, 1); + } + + // For user unlock request feature + if (isset($_POST['aiowps_unlock_request']) || isset($_POST['aiowps_wp_submit_unlock_request'])) { + nocache_headers(); + remove_action('wp_head', 'head_addons', 7); + include_once(AIO_WP_SECURITY_PATH.'/other-includes/wp-security-unlock-request.php'); + exit(); + } + + if (isset($_GET['aiowps_auth_key'])) { + //If URL contains unlock key in query param then process the request + $unlock_key = sanitize_text_field($_GET['aiowps_auth_key']); + AIOWPSecurity_User_Login::process_unlock_request($unlock_key); + } + + // For honeypot feature + if (isset($_POST['aio_special_field'])) { + $special_field_value = sanitize_text_field($_POST['aio_special_field']); + if (!empty($special_field_value)) { + //This means a robot has submitted the login form! + //Redirect back to its localhost + AIOWPSecurity_Utility::redirect_to_url('http://127.0.0.1'); + } + } + + // For 404 IP lockout feature + if ($aio_wp_security->configs->get_value('aiowps_enable_404_IP_lockout') == '1') { + if (!is_user_logged_in() || !current_user_can('administrator')) { + $this->do_404_lockout_tasks(); + } + } + + + // For login CAPTCHA feature + if ($aio_wp_security->configs->get_value('aiowps_enable_login_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('login_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + if (AIOWPSecurity_Utility::is_memberpress_plugin_active()) { + add_action('mepr-login-form-before-submit', array($aio_wp_security->captcha_obj, 'add_captcha_script')); + add_action('mepr-login-form-before-submit', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); // for memberpress login form + } + } + } + + // For woo form CAPTCHA features + if ($aio_wp_security->configs->get_value('aiowps_enable_woo_login_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('woocommerce_login_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + } + if (isset($_POST['woocommerce-login-nonce'])) { + add_filter('woocommerce_process_login_errors', array($this, 'aiowps_validate_woo_login_or_reg_captcha'), 10, 3); + } + } + + if ($aio_wp_security->configs->get_value('aiowps_enable_woo_register_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('woocommerce_register_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + } + + if (isset($_POST['woocommerce-register-nonce'])) { + add_filter('woocommerce_process_registration_errors', array($this, 'aiowps_validate_woo_login_or_reg_captcha'), 10, 3); + } + } + + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_woo_checkout_captcha') && !is_user_logged_in()) { + add_action('woocommerce_after_checkout_billing_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + add_action('woocommerce_after_checkout_validation', array($this, 'aiowps_validate_woo_checkout_captcha'), 10, 2); + } + + if ($aio_wp_security->configs->get_value('aiowps_enable_woo_lostpassword_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('woocommerce_lostpassword_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + } + if (isset($_POST['woocommerce-lost-password-nonce'])) { + add_action('lostpassword_post', array($this, 'process_woo_lost_password_form_post')); + } + } + + // For bbPress new topic form CAPTCHA + if ($aio_wp_security->configs->get_value('aiowps_enable_bbp_new_topic_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('bbp_theme_before_topic_form_submit_wrapper', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + } + } + + // For custom login form CAPTCHA feature, ie, when wp_login_form() function is used to generate login form + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_custom_login_captcha') && !is_user_logged_in()) { + add_filter('login_form_middle', array($aio_wp_security->captcha_obj, 'insert_captcha_custom_login'), 10, 2); //For cases where the WP wp_login_form() function is used + add_filter('login_form_bottom', array($aio_wp_security->captcha_obj, 'add_captcha_script'), 20); + } + + // For password protected pages CAPTCHA feature + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_password_protected_captcha')) { + add_filter('the_password_form', array($aio_wp_security->captcha_obj, 'insert_captcha_password_protected')); + add_action('login_form_postpass', array($aio_wp_security->captcha_obj, 'validate_password_protected_password_form_with_captcha')); + } + + // For honeypot feature + if ($aio_wp_security->configs->get_value('aiowps_enable_login_honeypot') == '1') { + if (!is_user_logged_in()) { + add_action('login_form', array($this, 'insert_honeypot_hidden_field')); + } + } + + // For registration honeypot feature + if ($aio_wp_security->configs->get_value('aiowps_enable_registration_honeypot') == '1') { + if (!is_user_logged_in()) { + add_action('register_form', array($this, 'insert_honeypot_hidden_field')); + } + } + + // For disable application password feature hide generate password + if ('1' == $aio_wp_security->configs->get_value('aiowps_disable_application_password')) { + add_filter('wp_is_application_passwords_available', '__return_false'); + add_action('edit_user_profile', array($this, 'show_disabled_application_password_message')); + add_action('show_user_profile', array($this, 'show_disabled_application_password_message')); + + // Override the wp_die handler for app passwords were disabled. + if (!empty($_SERVER['SCRIPT_FILENAME']) && ABSPATH . 'wp-admin/authorize-application.php' == $_SERVER['SCRIPT_FILENAME']) { + add_filter('wp_die_handler', function () { + return function ($message, $title, $args) { + if ('Application passwords are not available.' == $message) { + $message = htmlspecialchars(__('Application passwords have been disabled by All-In-One Security plugin.', 'all-in-one-wp-security-and-firewall')); + } + _default_wp_die_handler($message, $title, $args); + }; + }, 10, 1); + } + } + + // For lost password CAPTCHA feature + if ($aio_wp_security->configs->get_value('aiowps_enable_lost_password_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('lostpassword_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + add_action('lostpassword_post', array($this, 'process_lost_password_form_post')); + + if (AIOWPSecurity_Utility::is_memberpress_plugin_active()) { + add_action('mepr-forgot-password-form', array($aio_wp_security->captcha_obj, 'add_captcha_script')); + add_action('mepr-forgot-password-form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); // for memberpress forgot password form + add_filter('mepr-validate-forgot-password', array($aio_wp_security->captcha_obj, 'verify_memberpress_form')); // for memberpress forgot password form + } + } + } + + // For registration manual approval feature + if ($aio_wp_security->configs->get_value('aiowps_enable_manual_registration_approval') == '1') { + add_filter('wp_login_errors', array($this, 'modify_registration_page_messages'), 10, 2); + } + + // For registration page CAPTCHA feature + if (is_multisite()) { + $blog_id = get_current_blog_id(); + switch_to_blog($blog_id); + if ($aio_wp_security->configs->get_value('aiowps_enable_registration_page_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('signup_extra_fields', array($this, 'insert_captcha_question_form_multi')); + //add_action('preprocess_signup_form', array($this, 'process_signup_form_multi')); + add_filter('wpmu_validate_user_signup', array($this, 'process_signup_form_multi')); + } + } + restore_current_blog(); + } else { + if ($aio_wp_security->configs->get_value('aiowps_enable_registration_page_captcha') == '1') { + if (!is_user_logged_in()) { + add_action('register_form', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + } + } + } + + if ($aio_wp_security->configs->get_value('aiowps_enable_registration_page_captcha') == '1') { + if (AIOWPSecurity_Utility::is_memberpress_plugin_active()) { + add_action('mepr-checkout-after-password-fields', array($aio_wp_security->captcha_obj, 'add_captcha_script')); + add_action('mepr-checkout-after-password-fields', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); // for memberpress register form + add_filter('mepr-validate-signup', array($aio_wp_security->captcha_obj, 'verify_memberpress_form')); // for memberpress register form + } + } + + // For comment CAPTCHA feature or custom login form CAPTCHA + if (is_multisite()) { + $blog_id = get_current_blog_id(); + switch_to_blog($blog_id); + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_comment_captcha') && !is_user_logged_in()) { + add_action('comment_form_after_fields', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form'), 1); + add_action('comment_form_after_fields', array($aio_wp_security->captcha_obj, 'add_captcha_script'), 10); + add_filter('preprocess_comment', array($this, 'process_comment_post')); + } + restore_current_blog(); + } else { + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_comment_captcha') && !is_user_logged_in()) { + add_action('comment_form_after_fields', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form'), 1); + add_action('comment_form_after_fields', array($aio_wp_security->captcha_obj, 'add_captcha_script'), 10); + add_filter('preprocess_comment', array($this, 'process_comment_post')); + } + } + + // For BuddyPress registration CAPTCHA feature + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_bp_register_captcha')) { + add_action('bp_before_registration_submit_buttons', array($aio_wp_security->captcha_obj, 'insert_captcha_question_form')); + add_action('bp_before_registration_submit_buttons', array($aio_wp_security->captcha_obj, 'add_captcha_script'), 10); + add_action('bp_signup_validate', array($this, 'buddy_press_signup_validate_captcha')); + } + + // For 404 event logging + if ($aio_wp_security->configs->get_value('aiowps_enable_404_logging') == '1') { + add_action('template_redirect', array($this, 'check_404_event')); + } + + // For antibot post page set cookies. + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_spambot_detecting') && !is_user_logged_in()) { + if ('1' == $aio_wp_security->configs->get_value('aiowps_spambot_detect_usecookies')) { + add_action('template_redirect', array($this, 'post_antibot_cookie')); + } + add_filter('comment_form_submit_field', array($this, 'comment_form_submit_field'), 10, 1); + } + + // For delete readme.html and wp-config-sample.php. + if ('1' == $aio_wp_security->configs->get_value('aiowps_auto_delete_default_wp_files')) { + add_action('upgrader_process_complete', array($this, 'delete_unneeded_files_after_upgrade'), 10, 2); + } + + // filter php firewall templates array + add_filter('aiowps_modify_php_firewall_rules_template', array($this, 'filter_templates'), 10, 1); + + // For HTTP authentication. + if ('1' == $aio_wp_security->configs->get_value('aiowps_http_authentication_admin') || '1' == $aio_wp_security->configs->get_value('aiowps_http_authentication_frontend')) { + $this->http_authentication(); + } + + // for enforcing strong passwords + if ('1' == $aio_wp_security->configs->get_value('aiowps_enforce_strong_password')) { + wp_register_script('remove-weak-pw', AIO_WP_SECURITY_URL.'/js/remove-weak-pw.js', array('jquery'), AIO_WP_SECURITY_VERSION, true); + wp_enqueue_script('remove-weak-pw'); + } + + // For HIBP. + if ('1' == $aio_wp_security->configs->get_site_value('aiowps_hibp_user_profile_update')) { + add_action('user_profile_update_errors', 'AIOS_HIBP::user_profile_update_check', 1, 3); + } + + if ('1' == $aio_wp_security->configs->get_site_value('aiowps_http_password_reset')) { + add_action('validate_password_reset', 'AIOS_HIBP::password_reset_check', 1, 2); + } + + // For Upgrade unsafe HTTP calls. + if ('1' == $aio_wp_security->configs->get_site_value('aiowps_upgrade_unsafe_http_calls')) { + add_filter('http_request_reject_unsafe_urls', array($this, 'http_request_reject_unsafe_urls'), 10, 2); + } + + // Add more tasks that need to be executed at init time + + add_filter('aiowps_modify_captcha_settings_template', array($this, 'filter_captcha_settings_templates'), 10, 1); + } // end _construct() + + public function aiowps_disable_xmlrpc_pingback_methods($methods) { + unset($methods['pingback.ping']); + unset($methods['pingback.extensions.getPingbacks']); + return $methods; + } + + public function aiowps_remove_x_pingback_header($headers) { + unset($headers['X-Pingback']); + return $headers; + } + + /** + * Blocks feed by redirecting user to home url. + * + * @return Void + */ + public function block_feed() { + wp_redirect(home_url()); + } + + /** + * Spam detection and discard comment. + * + * @param int $comment_post_id + * + * @return void + */ + public function spam_detecting_and_process_comments_discard($comment_post_id) { + $is_comment_should_not_allowed = AIOWPSecurity_Comment::is_comment_spam_detected(); + if ($is_comment_should_not_allowed) { + $this->spam_discard_auto_block_ip(); + $comments = get_comments(array('number' => '1', 'post_id' => $comment_post_id)); + if ($comments) { + $loc = get_comment_link($comments[0]->comment_ID); + } else { + $loc = get_permalink($comment_post_id) . '#spam-comment-msg'; + } + wp_safe_redirect($loc); + exit; + } + } + + /** + * Block IP for spam discard after minimum comments reached. + * + * @return void + */ + public function spam_discard_auto_block_ip() { + global $aio_wp_security, $wpdb; + + if ('1' != $aio_wp_security->configs->get_value('aiowps_enable_autoblock_spam_ip')) return; + + AIOWPSecurity_Utility::event_logger('spam_discard'); + $comment_ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); + $spam_count = $wpdb->get_var($wpdb->prepare("SELECT COUNT(id) FROM ".AIOWPSEC_TBL_EVENTS." WHERE ip_or_host = %s AND event_type=%s", $comment_ip, 'spam_discard')); + $min_comment_before_block = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments_block'); + if (!empty($min_comment_before_block) && $spam_count > $min_comment_before_block) { + AIOWPSecurity_Blocking::add_ip_to_block_list($comment_ip, 'spam_discard'); + } + } + + /** + * Spam detection and mark as spam comment. + * + * @param string $approved + * + * @return string status + */ + public function spam_detecting_and_process_comments_mark_spam($approved) { + return AIOWPSecurity_Comment::is_comment_spam_detected() ? 'spam' : $approved; + } + + public function spam_detect_process_comment_post($comment_id, $comment_approved) { + if ("spam" === $comment_approved) { + $this->block_comment_ip($comment_id); + } + + } + + public function process_transition_comment_status($new_status, $old_status, $comment) { + if ('spam' == $new_status) { + $this->block_comment_ip($comment->comment_ID); + } + + } + + /** + * Will check auto-spam blocking settings and will add IP to blocked table accordingly + * + * @param int $comment_id + */ + public function block_comment_ip($comment_id) { + global $aio_wp_security, $wpdb; + $comment_obj = get_comment($comment_id); + $comment_ip = $comment_obj->comment_author_IP; + //Get number of spam comments from this IP + $sql = $wpdb->prepare("SELECT * FROM $wpdb->comments + WHERE comment_approved = 'spam' + AND comment_author_IP = %s + ", $comment_ip); + $comment_data = $wpdb->get_results($sql, ARRAY_A); + $spam_count = count($comment_data); + $min_comment_before_block = $aio_wp_security->configs->get_value('aiowps_spam_ip_min_comments_block'); + if (!empty($min_comment_before_block) && $spam_count >= ($min_comment_before_block - 1)) { + AIOWPSecurity_Blocking::add_ip_to_block_list($comment_ip, 'spam'); + } + } + + public function remove_standard_wp_meta_widget() { + unregister_widget('WP_Widget_Meta'); + } + + public function remove_wp_generator_meta_info() { + return ''; + } + + /** + * This function removes wp meta info from style and script src + * + * @param string|null $src - the src for the style or script + * @return string + */ + public function remove_wp_css_js_meta_info($src) { + global $wp_version; + static $wp_version_hash = null; // Cache hash value for all function calls + + if (empty($src)) return ''; + + // Replace only version number of assets with WP version + if (strpos($src, 'ver=' . $wp_version) !== false) { + if (!$wp_version_hash) { + $wp_version_hash = wp_hash($wp_version); + } + // Replace version number with computed hash + $src = add_query_arg('ver', $wp_version_hash, $src); + } + return $src; + } + + public function do_404_lockout_tasks() { + global $aio_wp_security; + $redirect_url = $aio_wp_security->configs->get_value('aiowps_404_lock_redirect_url'); //This is the redirect URL for blocked users + + $visitor_ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); + + $is_locked = AIOWPSecurity_Utility::check_locked_ip($visitor_ip, '404'); + + if ($is_locked) { + //redirect blocked user to configured URL + AIOWPSecurity_Utility::redirect_to_url($redirect_url); + } else { + //allow through + } + } + + public function insert_captcha_question_form_multi() { + global $aio_wp_security; + $default_captcha = $aio_wp_security->configs->get_value('aiowps_default_captcha'); + $aio_wp_security->captcha_obj->display_captcha_form($default_captcha); + } + + public function process_signup_form_multi($result) { + global $aio_wp_security; + // Check if CAPTCHA enabled + $verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit(); + if (false === $verify_captcha) { + // wrong answer was entered + $result['errors']->add('generic', __('ERROR: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall')); + } + return $result; + } + + /** + * This function echos a honeypot hidden field into login or register form + * + * @return void + */ + public function insert_honeypot_hidden_field() { + $honey_input = ''; + echo $honey_input; + } + + /** + * Shows application password disabled message on user edit profile page. + * If logged user is admin showing the Change Setting option. + * + * @return void + */ + public function show_disabled_application_password_message() { + if (is_user_logged_in() && is_admin()) { + $disabled_message = ''.__('Application passwords', 'all-in-one-wp-security-and-firewall').'
'; + $disabled_message .= '| '.__('Disabled', 'all-in-one-wp-security-and-firewall').' | '; + $disabled_message .= ''.htmlspecialchars(__('Application passwords have been disabled by All-In-One Security plugin.', 'all-in-one-wp-security-and-firewall'));
+ if (AIOWPSecurity_Utility_Permissions::has_manage_cap()) {
+ $change_setting_url = admin_url('admin.php?page=aiowpsec_usersec&tab=additional');
+ $disabled_message .= ' '.__('Change setting', 'all-in-one-wp-security-and-firewall').' '; + } else { + $disabled_message .= ' '.__('Site admin can only change this setting.', 'all-in-one-wp-security-and-firewall'); + } + $disabled_message .= ' | ';
+ $disabled_message .= '
|---|
'; + /* translators: %s: Admin Dashboard > WP Security > Brute Force > Login CAPTCHA Tab Link */ + printf(__('Your Google reCAPTCHA configuration is invalid.', 'all-in-one-wp-security-and-firewall').' '.__('Please enter the correct reCAPTCHA keys %s to use the Google reCAPTCHA feature.', 'all-in-one-wp-security-and-firewall'), ''.__('here', 'all-in-one-wp-security-and-firewall').''); + echo '
' . + esc_html__('The All in One Security plugin has deactivated some of the firewall settings that you had activated.', 'all-in-one-wp-security-and-firewall') . + '
'; + $firewall_upgrade_text .= '' . + esc_html__('We have upgraded the following settings so that they are now part of the PHP firewall instead of .htaccess directives:', 'all-in-one-wp-security-and-firewall') . + '
'; + $firewall_upgrade_text .= '- ';
+
+ $active_settings = $aio_wp_security->configs->get_value('aiowps_firewall_active_upgrade');
+
+ if (!empty($active_settings)) {
+ $active_settings = json_decode($active_settings);
+ if (!empty($active_settings)) {
+
+ foreach ($active_settings as $setting) {
+ switch ($setting) {
+ case 'aiowps_enable_pingback_firewall':
+ $firewall_upgrade_text .= '
- ' . esc_html__('Completely block xmlrpc.php', 'all-in-one-wp-security-and-firewall').' '; + break; + case 'aiowps_forbid_proxy_comments': + $firewall_upgrade_text .= '
- ' . esc_html__('Forbid proxy comment posting', 'all-in-one-wp-security-and-firewall').' '; + break; + case 'aiowps_deny_bad_query_strings': + $firewall_upgrade_text .= '
- ' . esc_html__('Deny bad query strings', 'all-in-one-wp-security-and-firewall').' '; + break; + case 'aiowps_advanced_char_string_filter': + $firewall_upgrade_text .= '
- ' . esc_html__('Advanced character filter', 'all-in-one-wp-security-and-firewall').' '; + break; + default: + continue 2; + } + } + } + } else { + $firewall_upgrade_text .= '
' . esc_html__('None of the settings that have been upgraded were active.', 'all-in-one-wp-security-and-firewall').'
'; + } + + $firewall_upgrade_text .= '' . esc_html__('What would you like to do?', 'all-in-one-wp-security-and-firewall') .'
'; + + $login_whitelist_notice_text = '' . + esc_html__('The All in One Security plugin has disabled the login whitelist setting that you have enabled in the past.', 'all-in-one-wp-security-and-firewall') . + '
' . + ''; + if (AIOWPSecurity_Utility::is_apache_server()) { + $login_whitelist_notice_text .= esc_html__('Your website is running on an Apache webserver, the login whitelisting might not be functional until the recent update of AIOS (because it relied upon Apache-specific module features).', 'all-in-one-wp-security-and-firewall'); + } else { + $login_whitelist_notice_text .= esc_html__('Your website is running on a non-Apache webserver, so the login whitelisting was not functional until the recent update of AIOS (because it relied upon Apache-specific features).', 'all-in-one-wp-security-and-firewall'); + } + $login_whitelist_notice_text .= ' ' . esc_html__('It began working with AIOS version 5.0.8.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('We have disabled it so that your login page will not be blocked unexpectedly.', 'all-in-one-wp-security-and-firewall') . + '
'; + + $allowed_ip_addresses = explode("\n", $aio_wp_security->configs->get_value('aiowps_allowed_ip_addresses')); + $allowed_ip_addresses = array_map('trim', $allowed_ip_addresses); + $login_whitelist_notice_text .= '' . + esc_html__('Whitelisted login IP address(es):', 'all-in-one-wp-security-and-firewall') . ' ' . htmlspecialchars(implode(', ', $allowed_ip_addresses)) . + '
' . + '' . + esc_html__('Would you like to re-enable login whitelisting?', 'all-in-one-wp-security-and-firewall') . + '
'; + + $child_notice_content = array( + // Upgrade AIOS backup to UDP backup in the 5.0.0 version + 'automated-database-backup' => array( + 'title' => esc_html__('Removed database backup feature from the All-In-One Security plugin', 'all-in-one-wp-security-and-firewall'), + 'text' => '' . + esc_html__('Beginning with version 5.0.0, AIOS has replaced the AIOS backup method with the superior UpdraftPlus method.', 'all-in-one-wp-security-and-firewall') . ' '. + esc_html__('It remains free and is fully supported by the UpdraftPlus team.', 'all-in-one-wp-security-and-firewall') . + '
' . + '' . + esc_html__('You are seeing this notice because you have previously set up automated database backups in AIOS.', 'all-in-one-wp-security-and-firewall') . ' ' . + esc_html__('Would you like to set up scheduled backups with UpdraftPlus?', 'all-in-one-wp-security-and-firewall') . + '
', + 'button_link' => add_query_arg(array( + 'page' => 'aiowpsec_database', + 'tab' => 'database-backup', + ), admin_url('admin.php')) . '#automated-scheduled-backups-heading', + 'button_meta' => esc_html__('Setup UpdraftPlus backup plugin', 'all-in-one-wp-security-and-firewall'), + 'dismiss_time' => 'dismiss_automated_database_backup_notice', + 'supported_positions' => array('automated-database-backup'), + 'validity_function' => 'should_show_automated_database_backup_notice', + ), + 'ip-retrieval-settings' => array( + 'title' => esc_html__('Important: set up your IP address detection settings', 'all-in-one-wp-security-and-firewall'), + 'text' => '' . + esc_html__("The All in One Security plugin couldn't be certain about the correct method to detect the IP address for your site visitors with your currently-configured IP address detection settings.", 'all-in-one-wp-security-and-firewall') . ' '. + esc_html__('It is important for your security to set the IP address detection settings properly.', 'all-in-one-wp-security-and-firewall') . + '
' . + '' . + esc_html__('Please go to the settings and set them now.', 'all-in-one-wp-security-and-firewall') . + '
', + 'button_link' => add_query_arg(array( + 'page' => 'aiowpsec_settings', + 'tab' => 'advanced-settings', + ), admin_url('admin.php')) . '#automated-scheduled-backups-heading', + 'button_meta' => esc_html__('Setup IP address detection settings', 'all-in-one-wp-security-and-firewall'), + 'dismiss_time' => 'dismiss_ip_retrieval_settings_notice', + 'supported_positions' => array('ip-retrieval-settings'), + 'validity_function' => 'should_show_ip_retrieval_settings_notice', + ), + 'load-firewall-resources-failed' => array( + 'title' => '', + 'text' => '' . + esc_html__('Failed to load the firewall resources.', 'all-in-one-wp-security-and-firewall') . ' ' . + esc_html__('The firewall won\'t operate correctly.', 'all-in-one-wp-security-and-firewall') . + '
', + 'dismiss_time' => '', + 'supported_positions' => array('load-firewall-resources-failed'), + 'validity_function' => 'should_show_load_firewall_resources_failed_notice', + ), + 'end-of-support-php-56' => array( + 'title' => esc_html__('AIOS PHP 5.6 support will end soon', 'all-in-one-wp-security-and-firewall'), + 'text' => $this->get_end_of_support_php_56_text(), + 'dismiss_time' => 'php_56_eol_dismiss_forever', + 'supported_positions' => array('end-of-support-php-56'), + 'validity_function' => 'should_show_end_of_support_php_56', + ), + 'upgrade-firewall-tab-rules' => array( + 'title' => esc_html__('Important: Disabled firewall settings', 'all-in-one-wp-security-and-firewall'), + 'text' => $firewall_upgrade_text, + 'button_link' => add_query_arg(array( + 'page' => esc_html(AIOWPSEC_FIREWALL_MENU_SLUG), + 'tab' => 'basic-firewall', + ), admin_url('admin.php')), + 'action_button_text' => esc_html__('Reactivate', 'all-in-one-wp-security-and-firewall'), + 'button_meta' => esc_html__('Configure manually', 'all-in-one-wp-security-and-firewall'), + 'dismiss_time' => 'dismiss_firewall_settings_disabled_on_upgrade_notice', + 'supported_positions' => array('upgrade-firewall-tab-rules'), + 'dismiss_text' => esc_html__('Keep deactivated', 'all-in-one-wp-security-and-firewall'), + 'validity_function' => 'should_show_upgrade_firewall_settings_notice', + ), + 'ip-blacklist-settings-on-upgrade' => array( + 'title' => esc_html__('Important: Blacklist manager disabled', 'all-in-one-wp-security-and-firewall'), + 'text' => '' . + esc_html__("The blacklist manager feature has been disabled to prevent any unexpected site lockouts.", 'all-in-one-wp-security-and-firewall') . + '
' . + '' . + esc_html__("This feature will block any IP address or range listed in its settings, please double check your own details are not included before turning it back on.", 'all-in-one-wp-security-and-firewall') . + '
' , + 'button_link' => add_query_arg(array( + 'page' => esc_html(AIOWPSEC_FIREWALL_MENU_SLUG), + 'tab' => 'blacklist' + ), admin_url('admin.php')) . '#poststuff', + 'action_button_text' => 'Turn it on', + 'button_meta' => esc_html__('Edit the settings', 'all-in-one-wp-security-and-firewall'), + 'dismiss_time' => 'dismiss_ip_blacklist_notice', + 'dismiss_text' => 'Keep it off', + 'supported_positions' => array('ip-blacklist-settings-on-upgrade'), + 'validity_function' => 'should_show_ip_blacklist_settings_on_upgrade', + ), + 'login-whitelist-disabled-on-upgrade' => array( + 'title' => esc_html__('Important: Disabled login whitelist setting', 'all-in-one-wp-security-and-firewall'), + 'text' => $login_whitelist_notice_text, + 'button_link' => add_query_arg(array( + 'page' => esc_html(AIOWPSEC_BRUTE_FORCE_MENU_SLUG), + 'tab' => 'login-whitelist', + ), admin_url('admin.php')) . '#poststuff', + 'action_button_text' => esc_html__('Turn it back on', 'all-in-one-wp-security-and-firewall'), + 'button_meta' => esc_html__('Edit the settings', 'all-in-one-wp-security-and-firewall'), + 'dismiss_time' => 'dismiss_login_whitelist_disabled_on_upgrade_notice', + 'supported_positions' => array('login-whitelist-disabled-on-upgrade'), + 'dismiss_text' => esc_html__('Keep it off', 'all-in-one-wp-security-and-firewall'), + 'validity_function' => 'should_show_login_whitelist_disabled_on_upgrade_notice', + ), + 'rate_plugin' => array( + 'text' => $this->safe_sprintf(esc_html__('We noticed AIOS has kept your site safe for a while.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('If you like us, please consider leaving a positive review.', 'all-in-one-wp-security-and-firewall'). ' ' . esc_html__('If you have any issues or questions, please contact %s.', 'all-in-one-wp-security-and-firewall'), '' . esc_html__('support', 'all-in-one-wp-security-and-firewall').'') . '' . esc_html__('Thank you so much!', 'all-in-one-wp-security-and-firewall') . '
- ' . esc_html__('All-In-One Security (AIOS)', 'all-in-one-wp-security-and-firewall').'', + 'image' => 'plugin-logos/aios-icon.png', + 'button_link' => 'https://wordpress.org/support/plugin/all-in-one-wp-security-and-firewall/reviews/?rate=5#new-post', + 'button_meta' => 'review', + 'dismiss_time' => 'dismiss_review_notice', + 'supported_positions' => $this->dashboard_top, + 'validity_function' => 'show_rate_notice' + ), + 'updraftplus' => array( + 'prefix' => '', + 'title' => esc_html__('Enhance your security even more by backing up your site', 'all-in-one-wp-security-and-firewall'), + 'text' => esc_html__('UpdraftPlus is the world\'s most trusted backup plugin.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('From the owners of All-In-One Security (AIOS).', 'all-in-one-wp-security-and-firewall'), + 'image' => 'plugin-logos/updraftplus-icon.png', + 'button_link' => 'https://wordpress.org/plugins/updraftplus/', + 'button_meta' => 'updraftplus', + 'dismiss_time' => 'dismiss_page_notice_until', + 'supported_positions' => $this->dashboard_top_or_report, + 'validity_function' => 'updraftplus_not_installed', + ), + 'wp-optimize' => array( + 'prefix' => '', + 'title' => esc_html__('Speed up your site', 'all-in-one-wp-security-and-firewall'), + 'text' => esc_html__("After you've secured your site, we recommend you install our WP-Optimize plugin to streamline it for better website performance.", 'all-in-one-wp-security-and-firewall'), + 'image' => 'plugin-logos/wp-optimize-icon.png', + 'button_link' => 'https://wordpress.org/plugins/wp-optimize/', + 'button_meta' => 'wp-optimize', + 'dismiss_time' => 'dismiss_notice', + 'supported_positions' => $this->anywhere, + 'validity_function' => 'wp_optimize_not_installed', + ), + + // The sale adverts content starts here + 'blackfriday' => array( + 'prefix' => '', + 'title' => esc_html__('20% off - Black Friday Sale', 'all-in-one-wp-security-and-firewall'), + 'text' => $sale_description, + 'text2' => esc_html__('at checkout.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('Hurry, offer ends 2 December.', 'all-in-one-wp-security-and-firewall') . '', + 'image' => 'notices/sale_20.png', + 'button_text' => sprintf(__('Save 20%% with code %s', 'all-in-one-wp-security-and-firewall'), 'blackfridaysale2025'), + 'button_link' => add_query_arg( + array( + 'utm_source' => 'aios-plugin', + 'utm_medium' => 'referral', + 'utm_campaign' => 'bf25-aios-plugin-banner', + 'utm_content' => 'bf-sale', + 'utm_creative_format' => 'advert', + ), + 'https://teamupdraft.com/plugin-black-friday/?utm_source=aios-plugin&utm_medium=referral&utm_campaign=bf25-aios-plugin-banner&utm_content=bf-sale&utm_creative_format=advert'), + 'campaign' => 'blackfriday', + 'button_meta' => 'inline', + 'dismiss_time' => 'dismiss_season', + // 'discount_code' => '‘bf22aiosupgrade’', + 'valid_from' => '2025-11-14 00:00:00', + 'valid_to' => '2025-12-02 23:59:59', + 'supported_positions' => $this->dashboard_top_or_report, + ) + ); + + return array_merge($parent_notice_content, $child_notice_content); + } + + /** + * Decides whether to show the automated database backup notice. + * + * @return Boolean True if the automated database notice should be shown, otherwise false. + */ + protected function should_show_automated_database_backup_notice() { + if ($this->is_database_backup_admin_page_tab()) { + return false; + } + + if (defined('AIOS_FORCE_AUTOMATED_DATABASE_BACKUP_NOTICE') && AIOS_FORCE_AUTOMATED_DATABASE_BACKUP_NOTICE) { + return true; + } + + if ($this->is_updraftplus_plugin_active() && $this->is_schedule_database_backup_set_in_updraftplus()) { + return false; + } + + global $aio_wp_security; + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_automated_backups')) { + return true; + } + + return false; + } + + /** + * Determines whether to show the PHP 5.6 end of support notice + * + * @return boolean + */ + protected function should_show_end_of_support_php_56() { + return version_compare(PHP_VERSION, '7.0.0', '<'); + } + + /** + * Gets the text to display with the PHP 5.6 end of support notice + * + * @return string + */ + protected function get_end_of_support_php_56_text() { + $text = '
' . esc_html__('AIOS will end support for PHP 5.6 on the 1st September 2025.', 'all-in-one-wp-security-and-firewall') . '
'; + + $text .= '' . esc_html__('PHP 5.6 is outdated and no longer receives security updates.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('To keep things secure and compatible with modern WordPress standards, AIOS will move to a minimum requirement of PHP 7.0.', 'all-in-one-wp-security-and-firewall') . '
'; + + $text .= '' . esc_html__('After the 1st September 2025, AIOS may not operate correctly on PHP versions below 7.0.', 'all-in-one-wp-security-and-firewall') . '
'; + + $text .= '' . esc_html__('If you require help upgrading your PHP version, please contact your hosting provider.', 'all-in-one-wp-security-and-firewall') . '
'; + + return $text; + } + + /** + * Decides whether to show the load firewall resources failed notice. + * + * @return boolean + */ + protected function should_show_load_firewall_resources_failed_notice() { + return !AIOS_Firewall_Resource::all_loaded(); + } + + /** + * Determines whether to show the notice which handles the firewall settings notice + * + * @return boolean + */ + protected function should_show_upgrade_firewall_settings_notice() { + if (!is_main_site()) { + return false; + } + + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + $is_firewall_page = ('admin.php' == $GLOBALS['pagenow'] && isset($_GET['page']) && AIOWPSEC_FIREWALL_MENU_SLUG == $_GET['page']); + if ($is_firewall_page) return false; + + global $aio_wp_security; + + $active_settings = $aio_wp_security->configs->get_value('aiowps_firewall_active_upgrade'); + + if (empty($active_settings)) return false; + + $active_settings = json_decode($active_settings); + + if (empty($active_settings)) return false; + + return true; + } + + /** + * Whether the current page is the AIOS database backup admin page + * + * @return Boolean True if the current page is the AIOS database backup admin page, otherwise false. + */ + private function is_database_backup_admin_page_tab() { + return $this->is_database_security_admin_page() && $this->is_database_backup_tab(); + } + + /** + * Whether the current page is the database security admin page. + * + * @return Boolean True if the current page is the database security admin page, otherwise false. + */ + private function is_database_security_admin_page() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return ('admin.php' == $GLOBALS['pagenow'] && isset($_GET['page']) && 'aiowpsec_database' == $_GET['page']); + } + + /** + * Whether the current tab is the database backup tab. + * + * @return Boolean True if the current tab is the database backup tab, otherwise false. + */ + private function is_database_backup_tab() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return (isset($_GET['tab']) && 'database-backup' == $_GET['tab']); + } + + /** + * Decides whether to show the IP address detection settings notice. + * + * @return Boolean True if the IP address detection settings notice should be shown, otherwise false. + */ + protected function should_show_ip_retrieval_settings_notice() { + if (!is_main_site()) { + return false; + } + + if ($this->is_ip_settings_admin_page_tab()) { + return false; + } + + if (defined('AIOS_FORCE_IP_RETRIEVAL_SETTINGS_NOTICE') && AIOS_FORCE_IP_RETRIEVAL_SETTINGS_NOTICE) { + return true; + } + + global $aio_wp_security; + $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG); + + // Is notice dismissed. + if ('1' == $aio_wp_security->configs->get_value('dismiss_ip_retrieval_settings_notice')) { + return false; + } + + $configured_ip_method_id = $aio_wp_security->configs->get_value('aiowps_ip_retrieve_method'); + + if (AIOWPSecurity_Utility_IP::is_server_suitable_ip_methods_give_same_ip_address()) { + if ('' === $configured_ip_method_id) { + $server_suitable_ip_methods = AIOWPSecurity_Utility_IP::get_server_suitable_ip_methods(); + $most_suitable_ip_method = reset($server_suitable_ip_methods); + if (!empty($most_suitable_ip_method)) { + $most_suitable_ip_method_id = array_search($most_suitable_ip_method, AIOS_Abstracted_Ids::get_ip_retrieve_methods()); + $aio_wp_security->configs->set_value('aiowps_ip_retrieve_method', $most_suitable_ip_method_id); + $aiowps_firewall_config->set_value('aios_ip_retrieve_method', $most_suitable_ip_method_id, true); + } + } + + return false; + } + + // If the IP retrieval method is not set. + $configured_ip_method_id = $aio_wp_security->configs->get_value('aiowps_ip_retrieve_method'); + if ('' === $configured_ip_method_id) { + return true; + } + + $server_user_ip_address = AIOS_Helper::get_server_detected_user_ip_address(); + return empty($server_user_ip_address); + } + + /** + * Whether the current page is the AIOS IP retrieval admin page + * + * @return Boolean True if the current page is the AIOS database backup admin page, otherwise false. + */ + private function is_ip_settings_admin_page_tab() { + return $this->is_settings_admin_page() && $this->is_advanced_settings_tab(); + } + + /** + * Whether the current page is the AIOS settings admin page + * + * @return Boolean True if the current page is the AIOS settings admin page, otherwise false. + */ + private function is_settings_admin_page() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return ('admin.php' == $GLOBALS['pagenow'] && isset($_GET['page']) && 'aiowpsec_settings' == $_GET['page']); + } + + /** + * Whether the current tab is the advanced settings tab. + * + * @return Boolean True if the current tab is the advanced settings tab, otherwise false. + */ + private function is_advanced_settings_tab() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return (isset($_GET['tab']) && 'advanced-settings' == $_GET['tab']); + } + + /** + * Check whether the UpdraftPlus plugin is active or not. + * + * @return bool True if the UpdraftPlus plugin is active, otherwise false. + */ + private function is_updraftplus_plugin_active() { + return class_exists('UpdraftPlus'); + } + + /** + * Check whether the database backup scheduled in the UpdraftPlus plugin. + * + * @return bool + */ + private function is_schedule_database_backup_set_in_updraftplus() { + $updraft_interval_database_option_val = get_option('updraft_interval_database', ''); + if (empty($updraft_interval_database_option_val) || 'manual' == $updraft_interval_database_option_val) { + return false; + } + + return true; + } + + /** + * Decides whether to show the IP Blacklist settings notice. + * + * @return Boolean True if the IP Blacklist settings notice should be shown, otherwise false. + */ + protected function should_show_ip_blacklist_settings_on_upgrade() { + if (!is_main_site()) { + return false; + } + + if ($this->is_blacklist_admin_page()) { + return false; + } + + global $aio_wp_security; + + if ('1' == $aio_wp_security->configs->get_value('aiowps_is_ip_blacklist_settings_notice_on_upgrade')) { + return true; + } + + return false; + } + + /** + * Whether the current page is the AIOS blacklist admin page + * + * @return Boolean True if the current page is the AIOS blacklist admin page, otherwise false. + */ + private function is_blacklist_admin_page() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return ('admin.php' == $GLOBALS['pagenow'] && isset($_GET['page']) && AIOWPSEC_FIREWALL_MENU_SLUG == $_GET['page'] && isset($_GET['tab']) && 'blacklist' == $_GET['tab']); + } + + /** + * Decides whether to show the IP address detection settings notice. + * + * @return Boolean True if the IP address detection settings notice should be shown, otherwise false. + */ + protected function should_show_login_whitelist_disabled_on_upgrade_notice() { + if (!is_main_site()) { + return false; + } + + if ($this->is_login_whitelist_admin_page_tab()) { + return false; + } + + if (defined('AIOS_FORCE_LOGIN_WHITELIST_DISABLED_ON_UPGRADE_NOTICE') && AIOS_FORCE_LOGIN_WHITELIST_DISABLED_ON_UPGRADE_NOTICE) { + return true; + } + + global $aio_wp_security; + + if ('1' == $aio_wp_security->configs->get_value('aiowps_is_login_whitelist_disabled_on_upgrade') && '1' != $aio_wp_security->configs->get_value('aiowps_enable_whitelisting')) { + return true; + } + + return false; + } + + /** + * Whether the current page is the AIOS IP retrieval admin page + * + * @return Boolean True if the current page is the AIOS database backup admin page, otherwise false. + */ + private function is_login_whitelist_admin_page_tab() { + return $this->is_brute_force_admin_page() && $this->is_login_whitelist_tab(); + } + + /** + * Whether the current page is the AIOS settings admin page + * + * @return Boolean True if the current page is the AIOS settings admin page, otherwise false. + */ + private function is_brute_force_admin_page() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return ('admin.php' == $GLOBALS['pagenow'] && isset($_GET['page']) && AIOWPSEC_BRUTE_FORCE_MENU_SLUG == $_GET['page']); + } + + /** + * Whether the current tab is the advanced settings tab. + * + * @return Boolean True if the current tab is the advanced settings tab, otherwise false. + */ + private function is_login_whitelist_tab() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce to check. + return (isset($_GET['tab']) && 'login-whitelist' == $_GET['tab']); + } + + /** + * Call this method to setup the notices + */ + public function notices_init() { + if ($this->initialized) return; + $this->initialized = true; + $this->notices_content = $this->populate_notices_content(); + + $enqueue_version = (defined('WP_DEBUG') && WP_DEBUG) ? AIO_WP_SECURITY_VERSION.'.'.time() : AIO_WP_SECURITY_VERSION; + wp_enqueue_style('aiowpsec-admin-notices-css', AIO_WP_SECURITY_URL.'/css/wp-security-notices.css', array(), $enqueue_version); + } + + /** + * Get AIOS Plugin installation timestamp. + * + * @return integer AIOS Plugin installation timestamp. + */ + public function get_aiowps_plugin_installed_timestamp() { + $installed_at = @filemtime(AIO_WP_SECURITY_PATH.'/index.html'); // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged -- ignore warning as we handle it below + if (false === $installed_at) { + global $aio_wp_security; + $installed_at = (int) $aio_wp_security->configs->get_value('installed-at'); + } + $installed_at = apply_filters('aiowps_plugin_installed_timestamp', $installed_at); + return $installed_at; + } + + /** + * This function will check if we should display the rate notice or not + * + * @return boolean - to indicate if we should show the notice or not + */ + protected function show_rate_notice() { + $installed_at = $this->get_aiowps_plugin_installed_timestamp(); + $time_now = $this->get_time_now(); + $installed_for = $time_now - $installed_at; + + if ($installed_at && $installed_for > 28*86400) { + return true; + } + + return false; + } + + /** + * Checks if UpdraftPlus is installed(returns false) or not(returns true). + * + * @return Boolean + */ + protected function updraftplus_not_installed() { + if (!function_exists('get_plugins')) include_once(ABSPATH.'wp-admin/includes/plugin.php'); + $plugins = get_plugins(); + + foreach ($plugins as $value) { + if ('updraftplus' == $value['TextDomain']) { + return false; + } + } + return true; + } + + /** + * Checks if WP-Optimize is installed(returns false) or not(returns true). + * + * @return Boolean + */ + protected function wp_optimize_not_installed() { + if (!function_exists('get_plugins')) include_once(ABSPATH.'wp-admin/includes/plugin.php'); + $plugins = get_plugins(); + + foreach ($plugins as $value) { + if ('wp-optimize' == $value['TextDomain']) { + return false; + } + } + return true; + } + + /** + * Determines whether to prepare a seasonal notice(returns true) or not(returns false). + * + * @param Array $notice_data - all data for the notice + * + * @return Boolean + */ + protected function skip_seasonal_notices($notice_data) { + $time_now = $this->get_time_now(); + $valid_from = strtotime($notice_data['valid_from']); + $valid_to = strtotime($notice_data['valid_to']); + $dismiss = $this->check_notice_dismissed($notice_data['dismiss_time']); + if (($time_now >= $valid_from && $time_now <= $valid_to) && !$dismiss) { + // return true so that we return this notice to be displayed + return true; + } + + return false; + } + + /** + * Get timestamp that is considered as current timestamp for notice. + * + * @return integer timestamp that should be consider as a current time. + */ + public function get_time_now() { + $time_now = defined('AIOWPSECURITY_NOTICES_FORCE_TIME') ? AIOWPSECURITY_NOTICES_FORCE_TIME : time(); + return $time_now; + } + + /** + * Checks whether a notice is dismissed(returns true) or not(returns false). + * + * @param String $dismiss_time - dismiss time id for the notice + * + * @return boolean + */ + protected function check_notice_dismissed($dismiss_time) { + $time_now = $this->get_time_now(); + + global $aio_wp_security; + $dismiss = ($time_now < (int) $aio_wp_security->configs->get_value($dismiss_time)); + + return $dismiss; + } + + /** + * Renders or returns a notice. + * + * @param Boolean|String $advert_information - all data for the notice + * @param Boolean $return_instead_of_echo - whether to return the notice(true) or render it to the page(false) + * @param String $position - notice position + * + * @return Void|String + */ + protected function render_specified_notice($advert_information, $return_instead_of_echo = false, $position = 'top') { + + if ('bottom' == $position) { + $template_file = 'bottom-notice.php'; + } elseif ('report' == $position) { + $template_file = 'report.php'; + } elseif ('report-plain' == $position) { + $template_file = 'report-plain.php'; + } elseif (in_array($position, AIOS_Abstracted_Ids::custom_admin_notice_ids())) { + $template_file = 'custom-notice.php'; + } elseif (in_array($position, AIOS_Abstracted_Ids::htaccess_to_php_feature_notice_ids())) { + $template_file = 'htaccess-to-php-feature-notice.php'; + } else { + $template_file = 'horizontal-notice.php'; + } + + global $aio_wp_security; + return $aio_wp_security->include_template('notices/'.$template_file, $return_instead_of_echo, $advert_information); + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-process-renamed-login-page.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-process-renamed-login-page.php new file mode 100755 index 00000000..5a28ef4e --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-process-renamed-login-page.php @@ -0,0 +1,293 @@ +aiowps_filter_wp_login_file($url); + } + + public function aiowps_wp_redirect($location) { + return $this->aiowps_filter_wp_login_file($location); + } + + /** + * Filter register link on the login page + * + * @param string $registration_url + * @return string + */ + public function register_link($registration_url) { + return $this->aiowps_filter_wp_login_file($registration_url); + } + + /** + * Filter confirm link so we hide the secret login slug in the export_personal_data email + * + * @param string $email_text + * @param string $email_data + * @return string + */ + public function aiowps_user_request_email_content($email_text, $email_data) { + global $aio_wp_security; + if (isset($email_data['request']) && isset($email_data['request']->action_name)) { + if ('export_personal_data' == $email_data['request']->action_name) { + $confirm_url = $email_data['confirm_url']; + $login_slug = $aio_wp_security->configs->get_value('aiowps_login_page_slug'); + if (get_option('permalink_structure')) { + $new_confirm_url = str_replace($login_slug, 'wp-login.php', $confirm_url); + } else { + $search_pattern = '?'.$login_slug.'&action'; + $new_confirm_url = str_replace($search_pattern, '/wp-login.php/?action', $confirm_url); + } + + $email_text_modified = str_replace('###CONFIRM_URL###', esc_url_raw($new_confirm_url), $email_text); + return $email_text_modified; + } + } + return $email_text; + } + + /** + * Filter all login url strings on the login page + * + * @param string $url + * @return string + */ + public function aiowps_filter_wp_login_file($url) { + if (strpos($url, 'wp-login.php') !== false) { + $args = explode('?', $url); + if (isset($args[1])) { + if (strpos($args[1], 'action=postpass') !== false) { + return $url; //Don't reveal the secret URL in the post password action url + } + parse_str($args[1], $args); + $url = esc_url(add_query_arg($args, AIOWPSecurity_Process_Renamed_Login_Page::new_login_url())); + $url = html_entity_decode($url); + } elseif (isset($_SERVER['REQUEST_URI']) && stripos(urldecode(sanitize_url(wp_unslash($_SERVER['REQUEST_URI']))), 'wp-admin/install.php')) { + return $url; + } else { + $url = AIOWPSecurity_Process_Renamed_Login_Page::new_login_url(); + } + } + return $url; + } + + /** + * Login page renamed related tasks, do not allow access if not logged with rename login page. + * + * @return void + */ + public static function renamed_login_init_tasks() { + // Bail if the host cron job is running by running the command "php wp-cron.php" + // The $_SERVER['REQUEST_URI'] is undefined when running a PHP file from the command line. + // for `wp plugin list` it will be empty so showing Not available instead plugin list. + if (empty($_SERVER['REQUEST_URI']) || defined('WP_CLI') || 'cli' == PHP_SAPI || wp_doing_cron() || wp_doing_ajax()) { + return; + } + + global $aio_wp_security; + + //The following will process the native wordpress post password protection form + //Normally this is done by wp-login.php file but we cannot use that since the login page has been renamed + + // Bots with URLs like: /index.php?action[]=aaaa will return an array here. It needs to be a string. + $action = (isset($_GET['action']) && is_string($_GET['action'])) ? sanitize_text_field(wp_unslash($_GET['action'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce available. + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- No nonce available. + if (isset($_POST['post_password']) && 'postpass' == $action) { + + // Check if the captcha is enabled for the password protected pages and process validation if the login page was renamed + if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_password_protected_captcha')) { + $aio_wp_security->captcha_obj->validate_password_protected_password_form_with_captcha(); + } + + require_once ABSPATH . 'wp-includes/class-phpass.php'; + $hasher = new PasswordHash(8, true); + + /** + * Filter the life span of the post password cookie. + * + * By default, the cookie expires 10 days from creation. To turn this + * into a session cookie, return 0. + * + * @since 3.7.0 + * + * @param int $expires The expiry time, as passed to setcookie(). + */ + $expire = apply_filters('post_password_expires', time() + 10 * DAY_IN_SECONDS); + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- No nonce available, not recommended to sanitize passwords. + setcookie('wp-postpass_' . COOKIEHASH, $hasher->HashPassword(wp_unslash($_POST['post_password'])), $expire, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); + + wp_safe_redirect(wp_get_referer()); + exit(); + } + + //case where someone attempting to reach wp-admin + if (is_admin() && !is_user_logged_in() && (isset($_SERVER["SCRIPT_FILENAME"]) ? basename(sanitize_text_field(wp_unslash($_SERVER["SCRIPT_FILENAME"]))) : '') !== 'admin-post.php') { + //Fix to prevent fatal error caused by some themes and Yoast SEO + do_action('aiowps_before_wp_die_renamed_login'); + wp_die(esc_html__('You do not have permission to access this page.', 'all-in-one-wp-security-and-firewall') . ' ' . esc_html__('Please log in and try again.', 'all-in-one-wp-security-and-firewall'), 403); + } + + //case where someone attempting to reach wp-login + if (isset($_SERVER['REQUEST_URI']) && stripos(urldecode(sanitize_url(wp_unslash($_SERVER['REQUEST_URI']))), 'wp-login.php') && !is_user_logged_in()) { + + // Handle export personal data request for rename login case + if (isset($_GET['request_id'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $request_id = (int) sanitize_text_field(wp_unslash($_GET['request_id'])); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $result = ''; + if (isset($_GET['confirm_key'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $key = sanitize_text_field(wp_unslash($_GET['confirm_key'])); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $result = wp_validate_user_request_key($request_id, $key); + } else { + $result = new WP_Error('invalid_key', esc_html__('Invalid key', 'all-in-one-wp-security-and-firewall')); + } + + if (is_wp_error($result)) { + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP error. $result is WPError object with sanitized strings. + wp_die($result); + } elseif (!empty($result)) { + _wp_privacy_account_request_confirmed($request_id); + $message = _wp_privacy_account_request_confirmed_message($request_id); + login_header(__('User action confirmed.', 'all-in-one-wp-security-and-firewall'), $message); + login_footer(); + exit; + } + } + + //Check if the maintenance (lockout) mode is active - if so prevent access to site by not displaying 404 page! + if ($aio_wp_security->configs->get_value('aiowps_site_lockout') == '1') { + AIOWPSecurity_WP_Loaded_Tasks::site_lockout_tasks(); + } else { + AIOWPSecurity_Process_Renamed_Login_Page::aiowps_set_404(); + } + } + + //case where someone attempting to reach the standard register or signup pages + $request_uri = urldecode(sanitize_url(wp_unslash($_SERVER['REQUEST_URI']))); + if ('' !== $request_uri && stripos($request_uri, 'wp-register.php') || '' !== $request_uri && stripos($request_uri, 'wp-signup.php')) { + //Check if the maintenance (lockout) mode is active - if so prevent access to site by not displaying 404 page! + if ('1' == $aio_wp_security->configs->get_value('aiowps_site_lockout')) { + AIOWPSecurity_WP_Loaded_Tasks::site_lockout_tasks(); + } else { + AIOWPSecurity_Process_Renamed_Login_Page::aiowps_set_404(); + } + } + + $login_slug = $aio_wp_security->configs->get_value('aiowps_login_page_slug'); + + if (self::is_renamed_login_page_requested($login_slug)) { + if (empty($action) && is_user_logged_in()) { + //if user is already logged in but tries to access the renamed login page, send them to the dashboard + // or to requested redirect-page, filtered in 'login_redirect'. + if (isset($_REQUEST['redirect_to'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $redirect_to = wp_sanitize_redirect(wp_unslash($_REQUEST['redirect_to'])); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + $redirect_to = wp_validate_redirect($redirect_to, apply_filters('wp_safe_redirect_fallback', admin_url(), 302)); + $requested_redirect_to = $redirect_to; + } else { + $redirect_to = admin_url(); + $requested_redirect_to = ''; + } + $redirect_to = apply_filters('login_redirect', $redirect_to, $requested_redirect_to, wp_get_current_user()); + AIOWPSecurity_Utility::redirect_to_url($redirect_to); + } else { + global $wp_version; + do_action('aiowps_rename_login_load'); + // logout action called by WooCommerce does not apply the login whitelist which shows a 403 error for the customer + if (!(isset($_GET['action']) && 'logout' == $_GET['action'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + AIOWPSecurity_Utility_IP::check_login_whitelist_and_forbid(); + } + + status_header(200); + if (version_compare($wp_version, '6.6', '>=')) { + require_once(AIO_WP_SECURITY_PATH . '/other-includes/wp-security-rename-login-feature.php'); + } elseif (version_compare($wp_version, '5.7', '>=')) { + require_once(AIO_WP_SECURITY_PATH . '/other-includes/wp-security-rename-login-feature-pre-6-6.php'); + } elseif (version_compare($wp_version, '5.2', '>=')) { + require_once(AIO_WP_SECURITY_PATH . '/other-includes/wp-security-rename-login-feature-pre-5-7.php'); + } else { + require_once(AIO_WP_SECURITY_PATH . '/other-includes/wp-security-rename-login-feature-pre-5-2.php'); + } + + die; + } + } + } + + public static function new_login_url() { + global $aio_wp_security; + $login_slug = $aio_wp_security->configs->get_value('aiowps_login_page_slug'); + if (get_option('permalink_structure')) { + return trailingslashit(trailingslashit(home_url()) . $login_slug); + } else { + return trailingslashit(site_url()) . '?' . $login_slug; + } + } + + public static function aiowps_set_404() { + global $wp_query; + do_action('aiowps_before_set_404'); // This hook is for themes which produce a fatal error when the rename login feature is enabled and someone visits "wp-admin" slug directly + + status_header(404); + $wp_query->set_404(); + do_action('template_redirect'); // Trigger 'template_redirect' to allow third-party plugins to intercept and inject custom logic before rendering the fallback template. + + $template = get_404_template(); + if (empty($template)) $template = get_index_template(); + $template = apply_filters('template_include', $template); + if ($template) include($template); + die; + } + + /** + * Check renamed login page is requested + * + * @param string $login_slug Renamed loginpage slug + * + * @return boolean + */ + public static function is_renamed_login_page_requested($login_slug) { + + if (empty($_SERVER['REQUEST_URI'])) return false; + + $parsed_url_path = isset($_SERVER['REQUEST_URI']) ? wp_parse_url(sanitize_url(wp_unslash($_SERVER['REQUEST_URI'])), PHP_URL_PATH) : ''; + $home_url_with_slug = home_url($login_slug, 'relative'); + + /* + * Compatibility fix for WPML, TranslatePress plugin + */ + if (function_exists('wpml_object_id') || function_exists('trp_enable_translatepress')) { + $home_url_with_slug = home_url($login_slug); + $parsed_home_url_with_slug = wp_parse_url($home_url_with_slug); + $home_url_with_slug = $parsed_home_url_with_slug['path']; //this will return just the path minus the protocol and host + } + + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce available. + if (untrailingslashit($parsed_url_path) === $home_url_with_slug || (!get_option('permalink_structure') && isset($_GET[$login_slug]))) { + return true; + } + + return false; + } + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-reporting.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-reporting.php new file mode 100755 index 00000000..b5bf996d --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-reporting.php @@ -0,0 +1,60 @@ + $value) { + $sanitized_key = esc_html($key); + $sanitized_value = esc_html($value); + $sanitized_section_content[$sanitized_key] = $sanitized_value; + } + + if ('text' === $output_format) { + $data .= "\n --- $section_title --- \n\n"; + $data .= self::output_section_data($sanitized_section_content); + $data .= "\n===================================\n"; + } elseif ('table' === $output_format) { + $data .= '';
+ $data .= '';
+ $data .= '
';
+ }
+
+ $data = apply_filters('aiowp_security_generate_report_section_below', $data);
+
+ return $data;
+ }
+
+ /**
+ * Output the section data
+ *
+ * @param array $section_data Section data to output
+ *
+ * @return string Section data
+ */
+ private static function output_section_data($section_data = array()) {
+ $output = '';
+ foreach ($section_data as $key => $value) {
+ $output .= "$key - $value\n";
+ }
+ return $output;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-sender-service.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-sender-service.php
new file mode 100755
index 00000000..794a7600
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-sender-service.php
@@ -0,0 +1,29 @@
+configs->set_value('aiowps_enable_basic_firewall', '1', true);
+
+ //Now let's write the applicable rules to the .htaccess file
+ if (AIOWPSecurity_Utility::allow_to_write_to_htaccess()) {
+ $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess();
+ } else {
+ $res = true;
+ }
+
+ if ($res) {
+ $msg['updated'] = __('Settings were successfully saved.', 'all-in-one-wp-security-and-firewall');
+ } else {
+ /* translators: %s: .htaccess path */
+ $msg['error'] = sprintf(__('Could not write to the %s file.', 'all-in-one-wp-security-and-firewall'), AIOWPSecurity_Utility_File::get_home_path().'.htaccess') . ' ' . __('Please check the file permissions.', 'all-in-one-wp-security-and-firewall');
+ }
+ return $msg;
+ }
+
+ /**
+ * Disable all security features.
+ *
+ * @return array messages
+ */
+ public static function disable_all_security_features() {
+ $msg = array();
+ AIOWPSecurity_Configure_Settings::turn_off_all_security_features();
+
+ //Now let's clear the applicable rules from the .htaccess file
+ if (AIOWPSecurity_Utility::allow_to_write_to_htaccess()) {
+ $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess();
+ } else {
+ $res = true;
+ }
+
+ //Now let's revert the disable editing setting in the wp-config.php file if necessary
+ $res2 = AIOWPSecurity_Utility::enable_file_edits();
+
+ if ($res) {
+ $msg['updated'] = __('All the security features have been disabled successfully.', 'all-in-one-wp-security-and-firewall');
+ } else {
+ /* translators: %s: .htaccess path */
+ $msg['error'][] = sprintf(__('Could not write to the %s file.', 'all-in-one-wp-security-and-firewall'), AIOWPSecurity_Utility_File::get_home_path().'.htaccess') . ' ' . sprintf(__('Please restore it manually using the restore functionality in the "%s" tab.', 'all-in-one-wp-security-and-firewall'), '.htaccess ' . __('file', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ if (!$res2) {
+ /* translators: %s: wp-config.php path */
+ $msg['error'][] = sprintf(__('Could not write to the %s file.', 'all-in-one-wp-security-and-firewall'), AIOWPSecurity_Utility_File::get_home_path().'wp-config.php') . ' ' . sprintf(__('Please restore it manually using the restore functionality in the "%s" tab.', 'all-in-one-wp-security-and-firewall'), 'wp-config.php ' . __('file', 'all-in-one-wp-security-and-firewall'));
+ }
+ return $msg;
+ }
+
+ /**
+ * Disable all firewall rules.
+ *
+ * @return array messages
+ */
+ public static function disable_all_firewall_rules() {
+ $msg = array();
+ AIOWPSecurity_Configure_Settings::turn_off_firewall_configs();
+
+ //Now let's clear the applicable rules from the .htaccess file
+ if (AIOWPSecurity_Utility::allow_to_write_to_htaccess()) {
+ $res = AIOWPSecurity_Utility_Htaccess::write_to_htaccess();
+ } else {
+ $res = true;
+ }
+
+ if ($res) {
+ $msg['updated'] = __('All firewall rules have been disabled successfully.', 'all-in-one-wp-security-and-firewall');
+ } else {
+ /* translators: %s: .htaccess path, %s file tab name. */
+ $msg['error'] = sprintf(__('Could not write to the %s file.', 'all-in-one-wp-security-and-firewall'), AIOWPSecurity_Utility_File::get_home_path().'.htaccess') . ' ' . sprintf(__('Please restore it manually using the restore functionality in the "%s" tab.', 'all-in-one-wp-security-and-firewall'), '.htaccess ' . __('file', 'all-in-one-wp-security-and-firewall'));
+ }
+ return $msg;
+ }
+
+ /**
+ * Reset all settings.
+ *
+ * @return array messages
+ */
+ public static function reset_all_settings() {
+ $msg = array();
+ if (!class_exists('AIOWPSecurity_Reset_Settings')) {
+ include(AIO_WP_SECURITY_PATH . '/admin/wp-security-reset-settings.php');
+ }
+ $reset_option_res = AIOWPSecurity_Reset_Settings::reset_options();
+ if (AIOWPSecurity_Utility::allow_to_write_to_htaccess()) {
+ $delete_htaccess = AIOWPSecurity_Reset_Settings::delete_htaccess();
+ } else {
+ $delete_htaccess = true;
+ }
+ AIOWPSecurity_Reset_Settings::reset_db_tables();
+ // AIOS premium and other plugin related config settings are reset by adding below action.
+ do_action('aios_reset_all_settings');
+
+ if (false === $reset_option_res && false === $delete_htaccess) {
+ $msg['error'] = __('Deletion of aio_wp_security_configs option and .htaccess directives failed.', 'all-in-one-wp-security-and-firewall');
+ } elseif (false === $reset_option_res) {
+ $msg['error'] = __('Reset of aio_wp_security_configs option failed.', 'all-in-one-wp-security-and-firewall');
+ } elseif (false === $delete_htaccess) {
+ $msg['error'] = __('Deletion of .htaccess directives failed.', 'all-in-one-wp-security-and-firewall');
+ } else {
+ $msg['updated'] = __('All settings have been successfully reset.', 'all-in-one-wp-security-and-firewall');
+ }
+ return $msg;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-two-factor-login.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-two-factor-login.php
new file mode 100755
index 00000000..91729b0b
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-two-factor-login.php
@@ -0,0 +1,201 @@
+is_incompatible_plugin_active()) return;
+
+ if (!function_exists('mcrypt_get_iv_size') && !function_exists('openssl_cipher_iv_length')) {
+ add_action('all_admin_notices', array($this, 'admin_notice_missing_mcrypt_and_openssl'));
+ return;
+ }
+
+ $this->is_tfa_integrated = true;
+
+ // Run at a priority ensuring that this will be after AIOS has registered its translation domain
+ add_action('init', array($this, 'plugin_text_domain_loaded'), 11);
+
+ add_action('admin_menu', array($this, 'menu_entry_for_user'), 30);
+ $this->version = AIO_WP_SECURITY_VERSION;
+ $this->set_user_settings_page_slug(AIOWPSEC_TWO_FACTOR_AUTH_MENU_SLUG);
+
+ $this->set_plugin_translate_url('https://translate.wordpress.org/projects/wp-plugins/all-in-one-wp-security-and-firewall/');
+ $this->set_site_wide_administration_url(admin_url('admin.php?page=aiowpsec_settings&tab=two-factor-authentication'));
+ $this->set_premium_version_url('https://teamupdraft.com/all-in-one-security/pricing/?utm_source=aios-plugin&utm_medium=referral&utm_campaign=paac&utm_content=emergency-codes-feature&utm_creative_format=text');
+ $this->set_faq_url('https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#faq');
+ parent::__construct();
+ }
+
+ /**
+ * Runs upon the WP action init (once the text domain has been loaded)
+ */
+ public function plugin_text_domain_loaded() {
+ $this->set_settings_page_heading(__('Two factor authentication - Admin settings', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ /**
+ * Detect plugins that cause us to self-deactivate
+ *
+ * @return Boolean|String
+ */
+ private function is_incompatible_plugin_active() {
+
+ if (defined('WORDFENCE_LS_VERSION')) return 'Wordfence Login Security';
+
+ $active_plugins = $this->get_active_plugins();
+ foreach ($active_plugins as $plugin_file_rel_to_plugins_dir) {
+ $temp_plugin_file_name = substr($plugin_file_rel_to_plugins_dir, strpos($plugin_file_rel_to_plugins_dir, '/') + 1);
+ if ('wordfence-login-security.php' == $temp_plugin_file_name) {
+ return 'Wordfence Login Security';
+ }
+ if ('wordfence.php' == $temp_plugin_file_name) {
+ return 'Wordfence';
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Gets an array of plugins active on either the current site, or site-wide
+ *
+ * @return Array - a list of plugin paths (relative to the plugin directory)
+ */
+ private function get_active_plugins() {
+
+ // Gets all active plugins on the current site
+ $active_plugins = get_option('active_plugins');
+
+ if (is_multisite()) {
+ $network_active_plugins = get_site_option('active_sitewide_plugins');
+ if (!empty($network_active_plugins)) {
+ $network_active_plugins = array_keys($network_active_plugins);
+ $active_plugins = array_merge($active_plugins, $network_active_plugins);
+ }
+ }
+
+ return $active_plugins;
+ }
+
+ /**
+ * Runs upon the WP actions admin_menu and network_admin_menu
+ */
+ public function menu_entry_for_user() {
+
+ global $current_user;
+ if ($this->is_activated_for_user($current_user->ID)) {
+ if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) {
+ $menu_icon_url = AIO_WP_SECURITY_URL . '/images/aios-plugin-icon.svg';
+ add_menu_page(__('AIOS', 'all-in-one-wp-security-and-firewall'), __('AIOS', 'all-in-one-wp-security-and-firewall'), apply_filters('aios_management_permission', 'manage_options'), AIOWPSEC_MAIN_MENU_SLUG, '', $menu_icon_url);
+ }
+ add_submenu_page(AIOWPSEC_MAIN_MENU_SLUG, __('Two Factor Auth', 'all-in-one-wp-security-and-firewall'), __('Two Factor Auth', 'all-in-one-wp-security-and-firewall'), 'read', AIOWPSEC_TWO_FACTOR_AUTH_MENU_SLUG, array($this, 'show_dashboard_user_settings_page'));
+ }
+ }
+
+ /**
+ * AIOS settings based user IP address
+ *
+ * @return string IP address
+ */
+ public function aios_set_user_ip_address() {
+ return AIOS_Helper::get_user_ip_address();
+ }
+
+ /**
+ * Builds Two Factor Authentication tab
+ *
+ * @param array $tabs array that contain tab name and call back function
+ * @return array Returns all tabs with callback function name
+ */
+ public function add_two_factor_setting_tab($tabs = array()) {
+ if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) return;
+
+ $tabs['two-factor-authentication'] = array(
+ 'title' => __('Two factor authentication', 'all-in-one-wp-security-and-firewall'),
+ 'render_callback' => array($this, 'render_two_factor_authentication'),
+ 'display_condition_callback' => 'is_main_site',
+ );
+ return $tabs;
+ }
+
+ /**
+ * Display the Two Factor Authentication tab & handle the operations
+ */
+ public function render_two_factor_authentication() {
+ $plugin = $this->is_incompatible_plugin_active();
+ if (false !== $plugin) {
+ global $aio_wp_security;
+ $aio_wp_security->include_template('admin/incompatible-plugin.php', false, array(
+ 'incompatible_plugin' => $plugin,
+ ));
+ return;
+ }
+
+ $this->show_admin_settings_page();
+ }
+
+ /**
+ * Include the admin settings page code.
+ */
+ public function show_admin_settings_page() {
+
+ if (!is_admin() || !AIOWPSecurity_Utility_Permissions::has_manage_cap()) return;
+
+ // Check if there are any settings errors and display them (this is needed because the forms from this template submit to the TFA options page not AIOS, so we need to grab them and output them manually).
+ $settings_errors = get_settings_errors();
+ foreach ($settings_errors as $error) {
+ $type = 'success' == $error['type'] ? 'updated' : 'error';
+ $this->show_admin_warning($error['message'], $type);
+ }
+
+ // The value for totp_controller is already set by versions of the TFA plugin after 3 Oct 2022
+ $this->include_template('admin-settings.php', array(
+ 'totp_controller' => $this->get_controller('totp'),
+ 'settings_page_heading' => $this->get_settings_page_heading(),
+ 'admin_settings_links' => array(),
+ ));
+ }
+
+ /**
+ * Runs conditionally on the WP action all_admin_notices.
+ */
+ public function admin_notice_missing_mcrypt_and_openssl() {
+ $this->show_admin_warning(''.__('PHP OpenSSL or mcrypt module required', 'all-in-one-wp-security-and-firewall').'';
+ $data .= apply_filters('aiowp_security_report_section_content', AIOWPSecurity_Utility_UI::format_data_as_table($sanitized_section_content));
+ $data .= '
';
+ $data .= ''.__('The All-In-One Security plugin\'s Two Factor Authentication module requires either the PHP openssl (preferred) or mcrypt module to be installed.', 'all-in-one-wp-security-and-firewall') . ' ' . __('Please ask your web hosting company to install one of them.', 'all-in-one-wp-security-and-firewall'), 'error'); + } +} + +if (false === AIOWPSecurity_Utility::is_incompatible_tfa_premium_version_active() && false === AIOWPSecurity_Utility::is_tfa_or_self_plugin_activating()) { + $GLOBALS['simba_two_factor_authentication'] = new AIO_WP_Security_Simba_Two_Factor_Authentication_Plugin(); +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-uninstallation-tasks.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-uninstallation-tasks.php new file mode 100755 index 00000000..8c70157b --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-uninstallation-tasks.php @@ -0,0 +1,83 @@ +prefix.'aiowps_login_lockdown', + $wpdb->prefix.'aiowps_failed_logins', + $wpdb->prefix.'aiowps_login_activity', + $wpdb->prefix.'aiowps_global_meta', + $wpdb->prefix.'aiowps_events', + $wpdb->prefix.'aiowps_permanent_block', + $wpdb->prefix.'aiowps_debug_log', + $wpdb->prefix.'aiowps_audit_log', + $wpdb->prefix.'aiowps_logged_in_users', + $wpdb->prefix.'aiowps_message_store', + ); + + $aio_wp_security->configs->load_config(); + + // check and drop database tables + if ('1' == $aio_wp_security->configs->get_value('aiowps_on_uninstall_delete_db_tables')) { + foreach ($database_tables as $table_name) { + // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore. + $wpdb->query("DROP TABLE IF EXISTS `$table_name`"); + } + } + + // check and delete configurations + if ('1' == $aio_wp_security->configs->get_value('aiowps_on_uninstall_delete_configs')) { + if (is_main_site()) { + $firewall_rules_path = AIOWPSecurity_Utility_Firewall::get_firewall_rules_path(); + AIOWPSecurity_Utility_File::remove_local_directory($firewall_rules_path); + + delete_metadata('user', '0', 'aiowps_account_status', '', true); + delete_metadata('user', '0', 'aiowps_registrant_ip', '', true); + } + + delete_option('aio_wp_security_configs'); + delete_option('aiowpsec_db_version'); + delete_option('aiowpsec_firewall_version'); + delete_option('aios_antibot_key_map_info'); + } + } +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php new file mode 100755 index 00000000..a809416d --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php @@ -0,0 +1,1022 @@ +key_login_msg = 'aiowps_login_msg_id'; + // As a first authentication step, check if user's IP is locked. + add_filter('authenticate', array($this, 'block_ip_if_locked'), 1, 1); + // Check whether user needs to be manually approved after default WordPress authenticate hooks (with priority 20). + add_filter('authenticate', array($this, 'check_manual_registration_approval'), 30, 1); + // Check login CAPTCHA + if ($aio_wp_security->configs->get_value('aiowps_enable_login_captcha')) { + add_filter('authenticate', array($this, 'check_captcha'), 20, 1); + } + // As a last authentication step, perform post authentication steps + add_filter('authenticate', array($this, 'post_authenticate'), 100, 3); + add_action('aiowps_force_logout_check', array($this, 'aiowps_force_logout_action_handler')); + add_action('wp_logout', array($this, 'wp_logout_action_handler'), 10, 1); + add_filter('login_message', array($this, 'aiowps_login_message')); //WP filter to add or modify messages on the login page + + // Display disable lockdown message + if (is_admin() && AIOWPSecurity_Utility_Permissions::has_manage_cap() && $aio_wp_security->is_login_lockdown_by_const() && $this->is_admin_page_to_display_disable_login_lockdown_by_const_notice()) { + add_action('all_admin_notices', array($this, 'disable_login_lockdown_by_const_notice')); + } + + add_action('set_auth_cookie', array($this, 'handle_logged_in_user'), 10, 4); + + //cron job to remove expired users from logged_in table + add_action('delete_expired_logged_in_users_event', array($this, 'delete_expired_logged_in_users')); + + add_filter('retrieve_password_message', array($this, 'aiowps_retrieve_password_message'), 10, 1); + } + + /** + * Check whether the admin page is to display disable login lockdown by const notice. + * + * @return boolean True if the notice will be displayed, Otherwise false. + */ + private function is_admin_page_to_display_disable_login_lockdown_by_const_notice() { + global $pagenow; + if (in_array($pagenow, array('index.php', 'plugins.php'))) { + return true; + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. Ignore. + } elseif (('admin.php' == $pagenow && isset($_GET['page']) && false !== strpos(sanitize_title(wp_unslash($_GET['page'])), AIOWPSEC_MENU_SLUG_PREFIX)) && !$this->is_locked_ip_addresses_tab_admin_page()) { + return true; + } + return false; + } + + /** + * Check whether the admin page is Locked IP Addresses Tab page. + * + * @return boolean True if is Locked IP Addresses Tab page, Otherwise false. + */ + private function is_locked_ip_addresses_tab_admin_page() { + global $pagenow; + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce. + return ('admin.php' == $pagenow && isset($_GET['page']) && 'aiowpsec' == $_GET['page'] && isset($_GET['tab']) && 'locked-ip' == $_GET['tab']); + } + + /** + * Displays admin to disable lockdown message. + * + * @return Void + */ + public function disable_login_lockdown_by_const_notice() { + + if (!AIOWPSecurity_Utility_Permissions::has_manage_cap()) { + return; + } + + echo '
+
';
+ }
+
+ /**
+ * Terminate the execution via wp_die with 503 status code, if current
+ * user's IP is currently locked.
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @param WP_Error|WP_User $user
+ * @return WP_User
+ */
+ public function block_ip_if_locked($user) {
+ global $aio_wp_security;
+
+ // Allow users to login when disable AIOWPS_DISABLE_LOCK_DOWN defined true
+ if ($aio_wp_security->is_login_lockdown_by_const()) {
+ return $user;
+ }
+
+ $user_locked = $this->check_locked_user();
+ if (null != $user_locked) {
+ $aio_wp_security->debug_logger->log_debug("Login attempt from blocked IP range - ".$user_locked['failed_login_ip'], 2);
+ // Allow the error message to be filtered.
+ /* translators: %s: Error notification with strong HTML tag. */
+ $error_msg = apply_filters('aiowps_ip_blocked_error_msg', sprintf(__('%s: Access from your IP address has been blocked for security reasons.', 'all-in-one-wp-security-and-firewall'), '' . __('ERROR', 'all-in-one-wp-security-and-firewall') . '') . ' ' . __('Please contact the administrator.', 'all-in-one-wp-security-and-firewall'));
+ // If unlock requests are allowed, add the "Request Unlock" button to the message.
+ $unlock_form = '';
+ if ($aio_wp_security->configs->get_value('aiowps_allow_unlock_requests') == '1') {
+ $unlock_form = $this->get_unlock_request_form();
+ $error_msg .= $unlock_form;
+ }
+ $error_msg = apply_filters('aiowps_ip_blocked_output_page', $error_msg, $unlock_form); //filter the complete output of the locked page
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Can not escape form html inside $error_msg.
+ wp_die($error_msg, esc_html__('Service temporarily unavailable', 'all-in-one-wp-security-and-firewall'), 503);
+ } else {
+ return $user;
+ }
+ }
+
+ /**
+ * Check login CAPTCHA (if enabled).
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @param WP_Error|WP_User $user
+ * @return WP_Error|WP_User
+ */
+ public function check_captcha($user) {
+ global $aio_wp_security;
+ if (is_wp_error($user) || $aio_wp_security->is_login_lockdown_by_const()) {
+ // Authentication has failed already at some earlier step.
+ return $user;
+ }
+
+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. No nonce.
+ if (! (isset($_POST['log']) && isset($_POST['pwd']))) {
+ // XML-RPC authentication (not via wp-login.php), nothing to do here.
+ return $user;
+ }
+
+ if ($aio_wp_security->configs->get_value('aiowps_enable_login_captcha') != '1') {
+ // CAPTCHA not enabled, nothing to do here.
+ return $user;
+ }
+
+ /* translators: %s: Error notification with strong HTML tag. */
+ $captcha_error = new WP_Error('authentication_failed', sprintf(__('%s: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'), '' . __('ERROR', 'all-in-one-wp-security-and-firewall') . ''));
+ $verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
+ if (false === $verify_captcha) {
+ return $captcha_error;
+ }
+ return $user;
+ }
+
+ /**
+ * Check, whether $user needs to be manually approved by site admin yet.
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @param WP_Error|WP_User $user
+ * @return WP_Error|WP_User
+ */
+ public function check_manual_registration_approval($user) {
+ global $aio_wp_security;
+ if (!($user instanceof WP_User)) {
+ // Not a WP_User - nothing to do here.
+ return $user;
+ }
+ //Check if auto pending new account status feature is enabled
+ if ($aio_wp_security->configs->get_value('aiowps_enable_manual_registration_approval') == '1') {
+ $aiowps_account_status = get_user_meta($user->ID, 'aiowps_account_status', true);
+ if ('pending' == $aiowps_account_status) {
+ // Account needs to be activated yet
+ /* translators: %s: Notification with strong HTML tag. */
+ return new WP_Error('account_pending', sprintf(__('%s: Your account is currently not active.', 'all-in-one-wp-security-and-firewall'), '' . __('ACCOUNT PENDING', 'all-in-one-wp-security-and-firewall') . '') . ' '. __('An administrator needs to activate your account before you can login.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+ return $user;
+ }
+
+ /**
+ * Handle post authentication steps (in case of failed login):
+ * - increment number of failed logins for $username
+ * - (optionally) lock the user
+ * - (optionally) display a generic error message
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @param WP_Error|WP_User $user
+ * @param string $username
+ * @param string $password
+ * @return WP_Error|WP_User
+ */
+ public function post_authenticate($user, $username, $password) {
+ global $aio_wp_security;
+ if (!is_wp_error($user)) {
+ // Authentication has been successful, there's nothing to do here.
+ return $user;
+ }
+ if (empty($username) || empty($password)) {
+ // Neither log nor block login attempts with empty username or password.
+ return $user;
+ }
+ if ($user->get_error_code() === 'account_pending') {
+ // Neither log nor block users attempting to log in before their registration is approved.
+ return $user;
+ }
+ // Login failed for non-trivial reason
+ AIOWPSecurity_Audit_Events::event_failed_login($username);
+ if ($aio_wp_security->configs->get_value('aiowps_enable_login_lockdown') == '1') {
+ $is_whitelisted = false;
+ //check if lockout whitelist enabled
+ if ($aio_wp_security->configs->get_value('aiowps_lockdown_enable_whitelisting') == '1') {
+ $whitelisted_ips = $aio_wp_security->configs->get_value('aiowps_lockdown_allowed_ip_addresses');
+ $is_whitelisted = AIOWPSecurity_Utility_IP::is_userip_whitelisted($whitelisted_ips);
+ }
+
+ if (false === $is_whitelisted) {
+ // Too many failed logins from user's IP?
+ $login_attempts_permitted = absint($aio_wp_security->configs->get_value('aiowps_max_login_attempts'));
+ $too_many_failed_logins = $login_attempts_permitted <= $this->get_login_fail_count();
+
+ // Is an invalid username or email the reason for login error?
+ $invalid_username = ($user->get_error_code() === 'invalid_username' || $user->get_error_code() == 'invalid_email');
+ // Should an invalid username be immediately locked?
+ $invalid_username_lockdown = $aio_wp_security->configs->get_value('aiowps_enable_invalid_username_lockdown') == '1';
+ $lock_invalid_username = $invalid_username && $invalid_username_lockdown;
+
+ // Should an invalid username be blocked as per blacklist?
+ $instant_lockout_users_list = $aio_wp_security->configs->get_value('aiowps_instantly_lockout_specific_usernames');
+ if (!is_array($instant_lockout_users_list)) {
+ $instant_lockout_users_list = array();
+ }
+ $username_blacklisted = $invalid_username && in_array($username, $instant_lockout_users_list);
+
+ $lock_reasons = array();
+ if ($too_many_failed_logins) {
+ $lock_reasons[] = 'too_many_failed_logins';
+ }
+ if ($lock_invalid_username) {
+ $lock_reasons[] = 'invalid_username';
+ }
+ if ($username_blacklisted) {
+ $lock_reasons[] = 'username_blacklisted';
+ }
+ if ($lock_reasons) {
+ $this->lock_the_user($username, implode(',', $lock_reasons));
+ }
+ }
+ }
+
+ if ($aio_wp_security->configs->get_value('aiowps_set_generic_login_msg') == '1') {
+ // Return generic error message if configured
+ return new WP_Error('authentication_failed', __('ERROR: Invalid login credentials.', 'all-in-one-wp-security-and-firewall'));
+ }
+ return $user;
+ }
+ /**
+ * This function queries the aiowps_login_lockdown table.
+ * If the release_date has not expired AND the current visitor IP addr matches
+ * it will return a record
+ */
+ public function check_locked_user() {
+ global $wpdb;
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ $ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); //Get the IP address of user
+ if (empty($ip)) return false;
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $locked_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $login_lockdown_table WHERE `released` > UNIX_TIMESTAMP() AND `failed_login_ip` = %s", $ip), ARRAY_A);
+ return $locked_user;
+ }
+ /**
+ * This function queries the aiowps_audit_log table and returns the number of failures for current IP range within allowed failure period
+ */
+ public function get_login_fail_count() {
+
+ global $wpdb, $aio_wp_security;
+
+ $audit_log_table = AIOWPSEC_TBL_AUDIT_LOG;
+ $login_retry_interval = $aio_wp_security->configs->get_value('aiowps_retry_time_period') * 60;
+ $now = time();
+ $ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); // Get the users IP address
+
+ if (empty($ip)) return false;
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $login_failures = $wpdb->get_var("SELECT COUNT(ID) FROM $audit_log_table " . "WHERE created + " . esc_sql($login_retry_interval) . " > '" . esc_sql($now) . "' AND " . "ip = '" . esc_sql($ip) . "' AND event_type = 'failed_login'");
+ return $login_failures;
+ }
+
+ /**
+ * Get lockout time dynamically multiplied with default lockout time
+ *
+ * @return Integer get lockout time length.
+ */
+ public function get_dynamic_lockout_time_length() {
+ global $aio_wp_security;
+
+ $login_fail_count = $this->get_login_fail_count();
+ $lockout_time_default = $aio_wp_security->configs->get_value('aiowps_lockout_time_length');
+ if (!is_numeric($lockout_time_default)) {
+ $lockout_time_default = 5;
+ }
+ $lockout_time_max = $aio_wp_security->configs->get_value('aiowps_max_lockout_time_length');
+ if (!is_numeric($lockout_time_max)) {
+ $lockout_time_max = 60;
+ }
+ $lockout_time_length = (int) ($login_fail_count > 0 ? (3 * $lockout_time_default * ($login_fail_count + 1)) : $lockout_time_default);
+
+ return $lockout_time_length >= $lockout_time_max ? $lockout_time_max : $lockout_time_length;
+ }
+
+ /**
+ * Adds an entry to the `aiowps_login_lockdown` table.
+ *
+ * @param string $username User's username or email
+ * @param string $lock_reason
+ * @param bool $is_lockout_email_sent flag for lockout email send
+ */
+ public function lock_the_user($username, $lock_reason = 'login_fail', $is_lockout_email_sent = 0) {
+ global $aio_wp_security;
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ $lock_minutes = $this->get_dynamic_lockout_time_length();
+ $ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); //Get the IP address of user
+ if (empty($ip)) return;
+ $ip_range = AIOWPSecurity_Utility_IP::get_sanitized_ip_range($ip); //Get the IP range of the current user
+ $user = is_email($username) ? get_user_by('email', $username) : get_user_by('login', $username); //Returns WP_User object if exists
+ $ip_range = apply_filters('aiowps_before_lockdown', $ip_range);
+ if ($user) {
+ //If the login attempt was made using a valid user set variables for DB storage later on
+ $user_id = $user->ID;
+ } else {
+ //If the login attempt was made using a non-existent user then let's set user_id to blank and record the attempted user login name for DB storage later on
+ $user_id = 0;
+ }
+
+ $lock_time = current_time('mysql', true);
+ $date = new DateTime($lock_time);
+ $add_interval = 'PT'.absint($lock_minutes).'M';
+ $date->add(new DateInterval($add_interval));
+ $release_time = $date->format('Y-m-d H:i:s');
+ $backtrace_log = '';
+ if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_php_backtrace_in_email')) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace, PHPCompatibility.FunctionUse.ArgumentFunctionsReportCurrentValue.NeedsInspection -- PCP and compatibility warnings. Safe to ignore.
+ $backtrace_log = AIOWPSecurity_Utility::normalise_call_stack_args(debug_backtrace());
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r -- PCP warning. Ignore.
+ $backtrace_log = print_r($backtrace_log, true);
+ }
+ $is_lockout_email_sent = (1 == $aio_wp_security->configs->get_value('aiowps_enable_email_notify') ? 0 : -1);
+ $ip_lookup_result = AIOS_Helper::get_ip_reverse_lookup($ip);
+ $ip_lookup_result = wp_json_encode($ip_lookup_result);
+ if (false === $ip_lookup_result) $ip_lookup_result = null;
+
+ $lock_seconds = $lock_minutes * MINUTE_IN_SECONDS;
+
+ $data = array(
+ 'user_id' => $user_id,
+ 'user_login' => $username,
+ 'lockdown_date' => $lock_time,
+ 'release_date' => $release_time,
+ 'failed_login_IP' => $ip,
+ 'lock_reason' => $lock_reason,
+ 'is_lockout_email_sent' => $is_lockout_email_sent,
+ 'backtrace_log' => $backtrace_log,
+ 'ip_lookup_result' => $ip_lookup_result,
+ 'lock_seconds' => $lock_seconds
+ );
+
+ $result = AIOWPSecurity_Utility::add_lockout($data);
+
+ if (false === $result) {
+ $aio_wp_security->debug_logger->log_debug("Error inserting record into ".$login_lockdown_table, 4);
+ } else {
+ do_action('aiowps_lockdown_event', $ip_range, $username);
+ $aio_wp_security->debug_logger->log_debug("The following IP address range has been locked out for exceeding the maximum login attempts: ".$ip_range, 2);
+ }
+ }
+
+ /**
+ * Send IP Lock notification.
+ *
+ * @param Array $lockout_ips_list have username, ip_range, ip
+ * @param String $backtrace_filepath
+ *
+ * @return Boolean True if mail sent otherwise false.
+ */
+ private function send_ip_lock_notification_email($lockout_ips_list = array(), $backtrace_filepath = '') {
+ global $aio_wp_security;
+ $send_mail = false;
+ if (0 != count($lockout_ips_list)) {
+ $email_notification_enabled = $aio_wp_security->configs->get_value('aiowps_enable_email_notify');
+ if (1 == $email_notification_enabled) {
+ $to_email_address = AIOWPSecurity_Utility::get_array_from_textarea_val($aio_wp_security->configs->get_value('aiowps_email_address'));
+ if (empty($to_email_address)) {
+ $to_email_address = array(get_site_option('admin_email'));
+ }
+ $subject = '['.get_option('home').'] '. __('Site Lockout Notification', 'all-in-one-wp-security-and-firewall');
+ $email_msg = __('User login lockout events had occurred due to too many failed login attempts or invalid username:', 'all-in-one-wp-security-and-firewall')."\n\n";
+
+ foreach ($lockout_ips_list as $lockout_ip) {
+ /* translators: %s: User name. */
+ $email_msg .= sprintf(__('Username: %s', 'all-in-one-wp-security-and-firewall'), $lockout_ip['username']) . "\n";
+
+ /* translators: %s: IP Address. */
+ $email_msg .= sprintf(__('IP address: %s', 'all-in-one-wp-security-and-firewall'), $lockout_ip['ip']) . "\n";
+ if ('' != $lockout_ip['ip_range']) {
+ /* translators: %s: IP Range. */
+ $email_msg .= sprintf(__('IP range: %s', 'all-in-one-wp-security-and-firewall'), $lockout_ip['ip_range']) . '.*' . "\n";
+ }
+ if (!empty($lockout_ip['ip_lookup_result'])) {
+ $ip_lookup_result = json_decode($lockout_ip['ip_lookup_result'], true);
+
+ $org = empty($ip_lookup_result['org']) ? __('Not Found', 'all-in-one-wp-security-and-firewall') : $ip_lookup_result['org'];
+ $as = empty($ip_lookup_result['as']) ? __('Not Found', 'all-in-one-wp-security-and-firewall') : $ip_lookup_result['as'];
+
+ /* translators: %s: Org. */
+ $email_msg .= sprintf(__('Org: %s', 'all-in-one-wp-security-and-firewall'), $org) . "\n";
+ /* translators: %s: AS. */
+ $email_msg .= sprintf(__('AS: %s', 'all-in-one-wp-security-and-firewall'), $as) . "\n";
+
+ $email_msg = apply_filters('aiowps_login_lockdown_email_message', $email_msg, $ip_lookup_result);
+ }
+ $email_msg .= "\n";
+ }
+
+ $email_msg .= __("Log into your site WordPress administration panel to see the duration of the lockout or to unlock the user.", 'all-in-one-wp-security-and-firewall') . "\n";
+
+ $email_header = '';
+ $send_mail = wp_mail($to_email_address, $subject, $email_msg, $email_header, $backtrace_filepath);
+
+ if (false === $send_mail) {
+ $ips_list = implode(', ', wp_list_pluck($lockout_ips_list, 'ip'));
+ $aio_wp_security->debug_logger->log_debug("Lockout notification email failed to send to " . implode(', ', $to_email_address) . " for IPs ".$ips_list, 4);
+ }
+ }
+ }
+ return $send_mail;
+ }
+
+ /**
+ * Generates and returns an unlock request link which will be used to send to the user.
+ *
+ * @global type $wpdb
+ * @global AIO_WP_Security $aio_wp_security
+ * @param type $ip_range
+ * @return string or false on failure
+ */
+ public static function generate_unlock_request_link($ip_range) {
+ //Get the locked user row from locout table
+ global $wpdb, $aio_wp_security;
+ $unlock_link = '';
+ $lockout_table_name = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ $secret_rand_key = (md5(uniqid(wp_rand(), true)));
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP wanting. Ignore.
+ $res = $wpdb->query($wpdb->prepare("UPDATE $lockout_table_name SET unlock_key = %s WHERE released > UNIX_TIMESTAMP() AND failed_login_ip LIKE %s", $secret_rand_key, "%" . esc_sql($ip_range) . "%"));
+ if (null == $res) {
+ $aio_wp_security->debug_logger->log_debug("No locked user found with IP range ".$ip_range, 4);
+ return false;
+ } else {
+ // Check if unlock request or submitted from a WooCommerce account login page
+ if (isset($_POST['aiowps-woo-login'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- PCP warning. No nonce.
+ $date_time = current_time('mysql');
+ $data = array('date_time' => $date_time, 'meta_key1' => 'woo_unlock_request_key', 'meta_value1' => $secret_rand_key);
+ $aiowps_global_meta_tbl_name = AIOWPSEC_TBL_GLOBAL_META_DATA;
+ // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder, WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare("INSERT INTO ".$aiowps_global_meta_tbl_name." (date_time, meta_key1, meta_value1, created) VALUES ('%s', '%s', '%s', UNIX_TIMESTAMP())", $data['date_time'], $data['meta_key1'], $data['meta_value1']);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Prepared above.
+ $result = $wpdb->query($sql);
+ if (false === $result) {
+ $aio_wp_security->debug_logger->log_debug("generate_unlock_request_link() - Error inserting woo_unlock_request_key to AIOWPSEC_TBL_GLOBAL_META_DATA table for secret key ".$secret_rand_key, 4);
+ }
+ }
+ $query_param = array('aiowps_auth_key' => $secret_rand_key);
+ $wp_site_url = AIOWPSEC_WP_URL;
+ $unlock_link = esc_url(add_query_arg($query_param, $wp_site_url));
+ }
+ return $unlock_link;
+ }
+
+ /**
+ * This function will process an unlock request when someone clicks on the special URL
+ * It will check if the special random code matches that in lockdown table for the relevant user
+ * If so, it will unlock the user
+ *
+ * @param string $unlock_key
+ * @return void
+ */
+ public static function process_unlock_request($unlock_key) {
+ global $wpdb, $aio_wp_security;
+ $lockout_table_name = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $unlock_command = $wpdb->prepare("UPDATE ".$lockout_table_name." SET released = UNIX_TIMESTAMP() WHERE unlock_key = %s", $unlock_key);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Prepared above.
+ $result = $wpdb->query($unlock_command);
+ if (false === $result) {
+ $aio_wp_security->debug_logger->log_debug("Error unlocking user with unlock_key ".$unlock_key, 4);
+ } else {
+ // Now check if this unlock operation is for a WooCommerce login
+ $aiowps_global_meta_tbl_name = AIOWPSEC_TBL_GLOBAL_META_DATA;
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare("SELECT * FROM $aiowps_global_meta_tbl_name WHERE meta_key1=%s AND meta_value1=%s", 'woo_unlock_request_key', $unlock_key);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Prepared above.
+ $woo_result = $wpdb->get_row($sql, OBJECT);
+ if (empty($woo_result)) {
+ $woo_unlock = false;
+ } else {
+ $woo_unlock = true;
+ }
+ if ($aio_wp_security->configs->get_value('aiowps_enable_rename_login_page')=='1') {
+ if (get_option('permalink_structure')) {
+ $home_url = trailingslashit(home_url());
+ } else {
+ $home_url = trailingslashit(home_url()) . '?';
+ }
+ if ($woo_unlock) {
+ $login_url = wc_get_page_permalink('myaccount'); //redirect to woo login page if applicable
+ //Now let's cleanup after ourselves and delete the woo-related row in the AIOWPSEC_TBL_GLOBAL_META_DATA table
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore
+ $delete = $wpdb->delete($aiowps_global_meta_tbl_name, array('meta_key1' => 'woo_unlock_request_key', 'meta_value1' => $unlock_key));
+ if (false === $delete) {
+ $aio_wp_security->debug_logger->log_debug("process_unlock_request(): Error deleting row from AIOWPSEC_TBL_GLOBAL_META_DATA for meta_key1=woo_unlock_request_key and meta_value1=".$unlock_key, 4);
+ }
+ } else {
+ $login_url = $home_url.$aio_wp_security->configs->get_value('aiowps_login_page_slug');
+ }
+
+ AIOWPSecurity_Utility::redirect_to_url($login_url);
+ } else {
+ AIOWPSecurity_Utility::redirect_to_url(wp_login_url());
+ }
+ }
+ }
+
+ /**
+ * This function sends an unlock request email to a locked out user
+ *
+ * @param string $email
+ * @param string $unlock_link
+ * @return void
+ */
+ public static function send_unlock_request_email($email, $unlock_link) {
+ global $aio_wp_security;
+ $subject = '['.network_site_url().'] '. __('Unlock request notification', 'all-in-one-wp-security-and-firewall');
+ /* translators: 1: Email 2: Link */
+ $email_msg = sprintf(__('You have requested for the account with email address %s to be unlocked.', 'all-in-one-wp-security-and-firewall') . ' ' . __('Please press the link below to unlock your account:', 'all-in-one-wp-security-and-firewall'), $email) . "\n" . sprintf(__('Unlock link: %s', 'all-in-one-wp-security-and-firewall'), $unlock_link) . "\n\n" . __('After pressing the above link you will be able to login to the WordPress administration panel.', 'all-in-one-wp-security-and-firewall') . "\n";
+
+ $sendMail = wp_mail($email, $subject, $email_msg);
+ if (false === $sendMail) {
+ $aio_wp_security->debug_logger->log_debug("Unlock Request Notification email failed to send to " . $email, 4);
+ }
+ }
+
+ /**
+ * Check the settings and log the user after the configured time period
+ *
+ * @param bool $return_url Optional. If true, the function returns the logout URL with a nonce.
+ * Otherwise, it redirects to the logout URL. Default is false.
+ *
+ * @return void|string
+ */
+ public function aiowps_force_logout_action_handler($return_url = false) {
+ global $aio_wp_security;
+ //$aio_wp_security->debug_logger->log_debug("Force Logout - Checking if any user need to be logged out...");
+ //if this feature is enabled then do something
+ if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_forced_logout')) {
+ if (is_user_logged_in()) {
+ $current_user = wp_get_current_user();
+ $user_id = $current_user->ID;
+ $current_time = current_time('mysql', true);
+ $login_time = $this->get_wp_user_aiowps_last_login_time($user_id);
+ if (empty($login_time)) {
+ return;
+ }
+ $diff = strtotime($current_time) - strtotime($login_time);
+ $logout_time_interval_value = $aio_wp_security->configs->get_value('aiowps_logout_time_period');
+ $logout_time_interval_val_seconds = $logout_time_interval_value * 60;
+ if ($diff > $logout_time_interval_val_seconds) {
+ $aio_wp_security->debug_logger->log_debug("Force Logout - This user logged in more than (".$logout_time_interval_value.") minutes ago. Doing a force log out for the user with username: ".$current_user->user_login);
+ $this->wp_logout_action_handler($user_id); //this will register the logout time/date in the logout_date column
+
+
+ $curr_page_url = AIOWPSecurity_Utility::get_current_page_url();
+ $after_logout_payload = array('redirect_to' => $curr_page_url, 'msg' => $this->key_login_msg.'=session_expired');
+ //Save some of the logout redirect data to a transient
+ is_multisite() ? set_site_transient('aiowps_logout_payload', $after_logout_payload, 30 * 60) : set_transient('aiowps_logout_payload', $after_logout_payload, 30 * 60);
+ $logout_url = AIOWPSEC_WP_URL.'?aiowpsec_do_log_out=1';
+ $logout_url = AIOWPSecurity_Utility::add_query_data_to_url($logout_url, 'al_additional_data', '1');
+ $logout_url_with_nonce = html_entity_decode(wp_nonce_url($logout_url, 'aio_logout'));
+ if ($return_url) {
+ return $logout_url_with_nonce;
+ }
+ AIOWPSecurity_Utility::redirect_to_url($logout_url_with_nonce);
+ }
+ }
+ }
+ }
+
+ /**
+ * Get last logged in time of given user id.
+ *
+ * @param integer $user_id
+ * @return mixed Last login time. False for an invalid $user_id (non-numeric, zero, or negative value). An empty string if a valid but non-existing user ID is passed.
+ */
+ public function get_wp_user_aiowps_last_login_time($user_id) {
+ $last_login = apply_filters('aiowps_get_last_login_time', get_user_meta($user_id, 'aiowps_last_login_time', true), $user_id);
+ return $last_login;
+ }
+
+ /**
+ * Updates the last login time in user meta, the login activity table.
+ *
+ * @global wpdb $wpdb
+ * @global AIO_WP_Security $aio_wp_security
+ *
+ * @param string $user_login
+ * @param WP_User $user
+ *
+ * @return void
+ */
+ private static function update_login_activity($user_login, $user) {
+ AIOWPSecurity_Audit_Events::event_successful_login($user_login);
+ $login_date_time = current_time('mysql', true);
+
+ update_user_meta($user->ID, 'aiowps_last_login_time', $login_date_time); //store last login time in meta table
+ }
+
+ /**
+ * Remove the last login time for all users from meta table on deactivation.
+ *
+ * @return void
+ */
+ public static function remove_login_activity() {
+ delete_metadata('user', '0', 'aiowps_last_login_time', '', true); //remove from meta table for all users last login time
+ }
+
+ public static function wp_login_action_handler($user_login, $user = '') {
+ global $aio_wp_security;
+
+ if ('' == $user) {
+ //Try and get user object
+ $user = get_user_by('login', $user_login); //This should return WP_User obj
+ if (!$user) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_User_Login::wp_login_action_handler: Unable to get WP_User object for login ".$user_login, 4);
+ return;
+ }
+ }
+
+ if (is_super_admin($user->ID)) {
+ $logging_into_correct_site = true;
+ } else {
+ $user_sites = get_blogs_of_user($user->ID);
+
+ $current_site_id = get_current_blog_id();
+
+ $logging_into_correct_site = false;
+
+ foreach ($user_sites as $site) {
+ if ($site->userblog_id == $current_site_id) {
+ $logging_into_correct_site = true;
+ break;
+ }
+ }
+ }
+
+ if ($logging_into_correct_site) {
+ self::update_login_activity($user_login, $user);
+ } else {
+ $user_primary_site = get_active_blog_for_user($user->ID);
+ switch_to_blog($user_primary_site->blog_id);
+ self::update_login_activity($user_login, $user);
+
+ restore_current_blog();
+ }
+ }
+
+ /**
+ * Handles logout events and modifies the login activity record for the current user.
+ *
+ * @param int $user_id - ID of user logging out
+ * @param boolean $force_logout - if user is force logged out
+ *
+ * @return void
+ */
+ public function wp_logout_action_handler($user_id, $force_logout = false) {
+ global $aio_wp_security;
+ $user = get_userdata($user_id);
+
+ if (false === $user) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_User_Login::wp_logout_action_handler: Unable to get WP_User object", 4);
+ return;
+ }
+
+ $this->delete_logged_in_user($user->ID);
+
+ if (is_super_admin($user->ID)) {
+ $logging_out_of_correct_site = true;
+ } else {
+ $user_sites = get_blogs_of_user($user->ID);
+
+ $current_site_id = get_current_blog_id();
+
+ $logging_out_of_correct_site = false;
+
+ foreach ($user_sites as $site) {
+ if ($site->userblog_id == $current_site_id) {
+ $logging_out_of_correct_site = true;
+ break;
+ }
+ }
+ }
+
+ if ($logging_out_of_correct_site) {
+ AIOWPSecurity_Audit_Events::event_successful_logout($user->user_login, $force_logout);
+ } else {
+ $user_primary_site = get_active_blog_for_user($user->ID);
+ switch_to_blog($user_primary_site->blog_id);
+ AIOWPSecurity_Audit_Events::event_successful_logout($user->user_login, $force_logout);
+
+ restore_current_blog();
+ }
+ }
+
+ /**
+ * The handler for the WP "login_message" filter
+ * Adds custom messages to the other messages that appear above the login form.
+ *
+ * NOTE: This method is automatically called by WordPress for displaying
+ * text above the login form.
+ *
+ * @param string $message the output from earlier login_message filters
+ * @return string
+ */
+ public function aiowps_login_message($message = '') {
+ global $aio_wp_security;
+ $msg = '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce.
+ if (isset($_GET[$this->key_login_msg]) && !empty($_GET[$this->key_login_msg])) {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce.
+ $logout_msg = wp_strip_all_tags(sanitize_title(wp_unslash($_GET[$this->key_login_msg])));
+ }
+ if (!empty($logout_msg)) {
+ switch ($logout_msg) {
+ case 'session_expired':
+ /* translators: %s: Minute count */
+ $msg = sprintf(__('Your session has expired because it has been over %d minutes since your last login.', 'all-in-one-wp-security-and-firewall'), $aio_wp_security->configs->get_value('aiowps_logout_time_period'));
+ $msg .= ' ' . __('Please log back in to continue.', 'all-in-one-wp-security-and-firewall');
+ break;
+ case 'admin_user_changed':
+ $msg = __('You were logged out because you just changed the "admin" username.', 'all-in-one-wp-security-and-firewall');
+ $msg .= ' ' . __('Please log back in to continue.', 'all-in-one-wp-security-and-firewall');
+ break;
+ default:
+ }
+ }
+ if (!empty($msg)) {
+ $msg = htmlspecialchars($msg, ENT_QUOTES, 'UTF-8');
+ $message .= '';
+ }
+ return $message;
+ }
+ /**
+ * This function will generate an unlock request form to be inserted inside
+ * error message when user gets locked out.
+ *
+ * @return string
+ */
+ public function get_unlock_request_form() {
+ global $aio_wp_security;
+ $unlock_request_form = '';
+ //Let's encode some hidden data and make a form
+ $unlock_secret_string = $aio_wp_security->configs->get_value('aiowps_unlock_request_secret_key');
+ $current_time = time();
+ $enc_result = base64_encode($current_time.$unlock_secret_string);
+ $unlock_request_form .= '';
+ return $unlock_request_form;
+ }
+
+ /**
+ * Returns all logged in users for specific subsite of multisite installation.
+ *
+ * @param bool $sitewide - checks if logged in users should be fetched sitewide
+ *
+ * @return array
+ */
+ public static function get_logged_in_users($sitewide = true) {
+ global $wpdb;
+
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+ if ($sitewide) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $users_online = $wpdb->get_results("SELECT * FROM `{$logged_in_users_table}`", 'ARRAY_A');
+ } else {
+ $current_blog_id = get_current_blog_id();
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $users_online = $wpdb->get_results($wpdb->prepare("SELECT * FROM `{$logged_in_users_table}` WHERE site_id = %d", $current_blog_id), 'ARRAY_A');
+ }
+
+ if (empty($users_online)) return array();
+
+ return $users_online;
+ }
+
+ /**
+ * Send email notification to an user that has flag is_lockout_email_sent is 0.
+ *
+ * @return Void
+ */
+ public function send_login_lockout_emails() {
+ global $wpdb, $aio_wp_security;
+ // if user enabled notification email then only have to send
+ $email_notification_enabled = $aio_wp_security->configs->get_value('aiowps_enable_email_notify');
+ if (0 == $email_notification_enabled) {
+ return;
+ }
+ // get recent lockout records on top to notify
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required.
+ $sql = $wpdb->prepare('SELECT id, user_login, failed_login_ip, backtrace_log, ip_lookup_result FROM ' .AIOWPSEC_TBL_LOGIN_LOCKOUT. ' WHERE is_lockout_email_sent = %d ORDER BY id DESC', 0);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Prepared above.
+ $result = $wpdb->get_results($sql);
+ if (empty($result)) {
+ return;
+ }
+ $login_lockout_ids_send_emails = array();
+ $lockout_ips_backtrace_log = array();
+ $lockout_ips_list = array();
+ $backtrace_filepath = '';
+ foreach ($result as $row) {
+ $ip_range = AIOWPSecurity_Utility_IP::get_sanitized_ip_range($row->failed_login_ip);
+ $lockout_ips_list[] = array('username' => $row->user_login, 'ip' => $row->failed_login_ip, 'ip_range' => $ip_range, 'ip_lookup_result' => $row->ip_lookup_result);
+ $login_lockout_ids_send_emails[] = $row->id;
+ if ('1' == $aio_wp_security->configs->get_value('aiowps_enable_php_backtrace_in_email') && '' != $row->backtrace_log) {
+ $lockout_ips_backtrace_log[] = array('backtrace_log' => $row->backtrace_log);
+ }
+ }
+
+ if (0 != count($lockout_ips_backtrace_log)) {
+ $backtrace_filepath = AIOWPSecurity_Utility::login_lockdown_email_backtrace_log_file($lockout_ips_backtrace_log);
+ }
+
+ $this->send_ip_lock_notification_email($lockout_ips_list, $backtrace_filepath);
+
+ if ('' != $backtrace_filepath) {
+ wp_delete_file($backtrace_filepath);
+ }
+
+ if (!empty($login_lockout_ids_send_emails)) {
+ $aio_wp_security->debug_logger->log_debug(sprintf('The IP lock notification emails of login lockout ids [%s] are sent.', implode(', ', $login_lockout_ids_send_emails)), 4);
+ // update all email to as sent.
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare('UPDATE '.AIOWPSEC_TBL_LOGIN_LOCKOUT.' SET is_lockout_email_sent = %d WHERE is_lockout_email_sent = %d', 1, 0);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Prepared above.
+ $update_result = $wpdb->query($sql);
+ if (false === $update_result) {
+ $error_msg = empty($wpdb->last_error) ? 'Could not receive the reason for the failure' : $wpdb->last_error;
+ $aio_wp_security->debug_logger->log_debug_cron("Lockout email flag is not updated in database due to error: {$error_msg}", 4);
+ }
+ }
+ }
+
+ /**
+ * Stores logged-in user in the logged_in_user table
+ *
+ * @param int $user_id - id of user logging in
+ * @param int $expiration - expiration timestamp of cookie
+ *
+ * @return void
+ */
+ public function store_logged_in_user($user_id, $expiration) {
+ global $wpdb, $aio_wp_security;
+
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+ $ip_address = AIOWPSecurity_Utility_IP::get_user_ip_address();
+ $userdata = get_userdata($user_id);
+ $username = $userdata->user_login;
+ $login_time = time();
+
+ // Check if a record with the given user_id already exists
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $existing_record = $wpdb->get_row($wpdb->prepare("SELECT * FROM " . $logged_in_users_table . " WHERE user_id = %d", $user_id));
+
+ if ($existing_record) {
+ // Update the existing record
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $result = $wpdb->update(
+ $logged_in_users_table,
+ array(
+ 'ip_address' => $ip_address,
+ 'site_id' => get_current_blog_id(),
+ 'username' => $username,
+ 'expires' => $expiration
+ ),
+ array('user_id' => $user_id)
+ );
+ } else {
+ // Create a new record
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $result = $wpdb->insert(
+ $logged_in_users_table,
+ array(
+ 'user_id' => $user_id,
+ 'ip_address' => $ip_address,
+ 'expires' => $expiration,
+ 'site_id' => get_current_blog_id(),
+ 'username' => $username,
+ 'created' => $login_time
+ )
+ );
+ }
+
+ if (false === $result) {
+ $generic_error_message = $existing_record ? "Error updating record in " . $logged_in_users_table : "Error inserting record into ".$logged_in_users_table;
+ $error_message = empty($wpdb->last_error) ? $generic_error_message : $wpdb->last_error;
+ $aio_wp_security->debug_logger->log_debug($error_message, 4);
+ }
+ }
+
+ /**
+ * Handles the data coming from the 'set_auth_cookie' hook
+ *
+ * @param string $auth_cookie - the generated auth_cookie
+ * @param int $expire - expiration timestamp of cookie if remember is marked
+ * @param int $expiration - expiration timestamp of cookie
+ * @param int $user_id - id of user logging in
+ *
+ * @return void
+ */
+ public function handle_logged_in_user($auth_cookie, $expire, $expiration, $user_id) {
+
+ if (empty($auth_cookie)) return; //check if auth cookie is empty, meaning login was not successful
+ $expiration = $expire > 0 ? $expire : $expiration;
+
+ if (is_multisite() && !is_super_admin()) {
+ $user_blog = get_active_blog_for_user($user_id);
+ switch_to_blog($user_blog->blog_id); // switch to user blog incase they try to log in from wrong subsite
+
+ $this->store_logged_in_user($user_id, $expiration);
+ restore_current_blog();
+ } else {
+ $this->store_logged_in_user($user_id, $expiration);
+ }
+ }
+
+ /**
+ * Deletes logged-in user from the logged_in_user table
+ *
+ * @param int $user_id
+ * @return bool
+ */
+ public function delete_logged_in_user($user_id) {
+ global $wpdb, $aio_wp_security;
+
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+
+ if (empty($user_id)) return true;
+
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $result = $wpdb->delete(
+ $logged_in_users_table,
+ array('user_id' => $user_id)
+ );
+
+
+ if (false === $result) {
+ $error_message = empty($wpdb->last_error) ? "Error deleting record from " . $logged_in_users_table : $wpdb->last_error;
+ $aio_wp_security->debug_logger->log_debug($error_message, 4);
+ }
+
+ return $result;
+ }
+
+ /**
+ * Cron job function for removing data with expired session from the logged-in user table
+ *
+ * @return void
+ */
+ public function delete_expired_logged_in_users() {
+ global $wpdb, $aio_wp_security;
+ $logged_in_users_table = AIOWPSEC_TBL_LOGGED_IN_USERS;
+
+ // Delete data with expired cookie
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Direct query required,
+ $result = $wpdb->query(
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $wpdb->prepare("DELETE FROM " . $logged_in_users_table . " WHERE expires < %d", time())
+ );
+
+ if (false === $result) {
+ $error_message = empty($wpdb->last_error) ? "Error deleting records from ".$logged_in_users_table : $wpdb->last_error;
+ $aio_wp_security->debug_logger->log_debug($error_message, 4);
+ }
+ }
+
+ /**
+ * This function rewrites the password reset message
+ *
+ * @param string $message - The password reset email message to be edited
+ *
+ * @return string - Email message to be sent for password reset
+ */
+ public function aiowps_retrieve_password_message($message) {
+ $ip = AIOWPSecurity_Utility_IP::get_user_ip_address(); //Get the IP address of user
+
+ // Find the position of the IP Address string in the message
+ $ip_string = isset($_SERVER['REMOTE_ADDR']) ? rest_is_ip_address(wp_unslash($_SERVER['REMOTE_ADDR'])) : '';
+ $ip_pos = strpos($message, $ip_string);
+
+ // If the IP Address string is found in the message and not the same as AIOWPS ip, replace it with the replacement string
+ if (false !== $ip_pos && $ip !== $ip_string) {
+ $replacement = "$ip.\r\n\r\n";
+ $message = substr_replace($message, $replacement, $ip_pos);
+ }
+
+ return $message;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-registration.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-registration.php
new file mode 100755
index 00000000..879b2dfe
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-registration.php
@@ -0,0 +1,100 @@
+configs->get_value('aiowps_enable_manual_registration_approval') == '1') {
+ add_filter("woocommerce_registration_auth_new_customer", array($this, 'aios_registration_auth_new_customer'));
+ }
+
+ if ($aio_wp_security->configs->get_value('aiowps_enable_registration_page_captcha') == '1') {
+ add_filter('registration_errors', array($this, 'aiowps_validate_registration_with_captcha'), 10, 3);
+ }
+ }
+
+ /**
+ * This public function will add a special meta string in the users table
+ * Meta field name: 'aiowps_account_status'
+ * Meta field value: 'pending'
+ *
+ * @param int $user_id
+ * @return void
+ */
+ public function aiowps_user_registration_action_handler($user_id) {
+ global $aio_wp_security;
+ //Check if auto pending new account status feature is enabled
+ if ($aio_wp_security->configs->get_value('aiowps_enable_manual_registration_approval') == '1') {
+ if (AIOWPSecurity_Utility_Permissions::has_manage_cap() || (defined('WP_CLI') && WP_CLI)) {
+ AIOWPSecurity_Audit_Events::event_user_registration($user_id, 'admin');
+ return; //if the user has been added from admin side don't put in pending state
+ }
+ $res = add_user_meta($user_id, 'aiowps_account_status', 'pending');
+ if (!$res) {
+ $aio_wp_security->debug_logger->log_debug("aiowps_user_registration_action_handler: Error adding user meta data: aiowps_account_status", 4);
+ }
+ $user_ip_address = AIOWPSecurity_Utility_IP::get_user_ip_address();
+ $res = add_user_meta($user_id, 'aiowps_registrant_ip', $user_ip_address);
+ if (!$res) {
+ $aio_wp_security->debug_logger->log_debug("aiowps_user_registration_action_handler: Error adding user meta data: aiowps_registrant_ip", 4);
+ }
+ AIOWPSecurity_Audit_Events::event_user_registration($user_id, 'pending');
+ } else {
+ if (AIOWPSecurity_Utility_Permissions::has_manage_cap()) {
+ AIOWPSecurity_Audit_Events::event_user_registration($user_id, 'admin');
+ } else {
+ AIOWPSecurity_Audit_Events::event_user_registration($user_id, 'registered');
+ }
+ }
+ }
+
+ /**
+ * This public function will set the special meta string in the usermeta table so that the account becomes active
+ * Meta field name: 'aiowps_account_status'
+ * Meta field values: 'active', 'pending', etc
+ *
+ * @param int $user_id
+ * @param string $status
+ * @return void
+ */
+ public function aiowps_set_user_account_status($user_id, $status) {
+ global $aio_wp_security;
+ $res = update_user_meta($user_id, 'aiowps_account_status', $status);
+ if (!$res) {
+ $aio_wp_security->debug_logger->log_debug("aiowps_set_user_account_status: Error updating user meta data: aiowps_account_status", 4);
+ }
+ }
+
+ public function aiowps_validate_registration_with_captcha($errors) {
+ global $aio_wp_security;
+
+ $locked = $aio_wp_security->user_login_obj->check_locked_user();
+ if (null == $locked) {
+ //user is not locked continue
+ } else {
+ $errors->add('authentication_failed', __('ERROR: You are not allowed to register because your IP address is currently locked!', 'all-in-one-wp-security-and-firewall'));
+ return $errors;
+ }
+ $verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
+ if (false === $verify_captcha) {
+ // wrong answer was entered
+ $errors->add('authentication_failed', __('ERROR: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'));
+ return $errors;
+ }
+ return $errors;
+ }
+
+ /**
+ * This function serves the purpose of preventing login in certain plugins that enable user registration, such as WooCommerce and others.
+ *
+ * @return bool Returns false means do not authenticate on registration
+ */
+ public function aios_registration_auth_new_customer() {
+ return false;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-api.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-api.php
new file mode 100755
index 00000000..02860efa
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-api.php
@@ -0,0 +1,121 @@
+debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() - Invalid request method. Only GET and POST are supported.", 4);
+ return new WP_Error('aios_api_invalid_method', 'Invalid request method. Only GET and POST are supported.');
+ }
+
+ // Validate the URL
+ if ('' !== $url && !filter_var($url, FILTER_VALIDATE_URL)) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() - Invalid or missing request URL.", 4);
+ return new WP_Error('aios_api_invalid_url', 'Invalid or missing request URL.');
+ }
+
+ // Set up default arguments
+ $default_args = array(
+ 'headers' => array(),
+ 'body' => array(),
+ 'timeout' => 10,
+ );
+
+ // Merge default arguments with provided arguments
+ $request_args = wp_parse_args($args, $default_args);
+
+ // Make the request
+ if ('POST' === $method) {
+ $response = wp_remote_post($url, $request_args);
+ } else {
+ $response = wp_remote_get($url, $request_args);
+ }
+
+ // Check for errors
+ if (is_wp_error($response)) {
+ // Get error code and message
+ $error_code = $response->get_error_code();
+ $error_message = $response->get_error_message();
+ $error_data = $response->get_error_data(); // Optional additional error data
+
+ // Log the error details
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() | Response error - Code: {$error_code}, Message: {$error_message}", 4);
+
+ // Log any additional error data (could be useful for debugging)
+ if ($error_data) {
+ if (is_array($error_data) || is_object($error_data)) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() | Response error - Additional Error Data: " . json_encode($error_data), 4);
+ } else {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() | Response error - Additional Error Data: {$error_data}", 4);
+ }
+ }
+
+ return $response;
+ }
+
+ // Get the response body
+ $response_body = wp_remote_retrieve_body($response);
+
+ // Check for JSON response
+ $content_type = wp_remote_retrieve_header($response, 'content-type');
+ if (false !== strpos($content_type, 'application/json')) {
+
+ // Decode the response body if it's JSON
+ $decoded_body = json_decode($response_body, true);
+
+ // Log JSON decoding error if any
+ if (JSON_ERROR_NONE !== json_last_error()) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility_API::make_api_request() - JSON decode error: " . json_last_error_msg(), 4);
+ return new WP_Error('aios_api_json_decode_error', json_last_error_msg());
+ }
+
+ // Return the decoded JSON response body
+ return $decoded_body;
+ }
+
+ // Return raw response body if it's not JSON
+ return $response_body;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-file.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-file.php
new file mode 100755
index 00000000..07d1b6a7
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-utility-file.php
@@ -0,0 +1,522 @@
+ 'root directory', 'path' => ABSPATH, 'permissions' => '0755'),
+ array('name' => 'wp-includes/', 'path' => ABSPATH."wp-includes", 'permissions' => '0755'),
+ array('name' => '.htaccess', 'path' => $home_path.".htaccess", 'permissions' => '0644'),
+ array('name' => 'wp-admin/index.php', 'path' => ABSPATH."wp-admin/index.php", 'permissions' => '0644'),
+ array('name' => 'wp-admin/js/', 'path' => ABSPATH."wp-admin/js/", 'permissions' => '0755'),
+ array('name' => 'wp-content/themes/', 'path' => WP_CONTENT_DIR."/themes", 'permissions' => '0755'),
+ array('name' => 'wp-content/plugins/', 'path' => WP_PLUGIN_DIR, 'permissions' => '0755'),
+ array('name' => 'wp-admin/', 'path' => ABSPATH."wp-admin", 'permissions' => '0755'),
+ array('name' => 'wp-content/', 'path' => WP_CONTENT_DIR, 'permissions' => '0755'),
+ array('name' => 'wp-config.php', 'path' => $wp_config_path, 'permissions' => '0640'),
+ //Add as many files or dirs as needed by following the convention above
+ );
+
+ return apply_filters('aiowpsecurity_file_permission_list', $file_list);
+ }
+
+ /**
+ * Returns full path to mu-plugin directory
+ *
+ * @return string
+ */
+ public static function get_mu_plugin_dir() {
+ return WPMU_PLUGIN_DIR;
+ }
+
+ /**
+ * Returns path to wp-config
+ *
+ * @return string
+ */
+ public static function get_wp_config_file_path() {
+ $wp_config_file = ABSPATH . 'wp-config.php';
+ if (file_exists($wp_config_file)) {
+ return $wp_config_file;
+ } elseif (file_exists(dirname(ABSPATH) . '/wp-config.php')) {
+ return dirname(ABSPATH) . '/wp-config.php';
+ }
+ return $wp_config_file;
+ }
+
+ public static function write_content_to_file($file_path, $new_contents) {
+ // Get the file permissions so we can revert back to it when we are done
+ $permissions = octdec(substr(sprintf('%o', fileperms($file_path)), -4));
+ @chmod($file_path, 0777);
+ if (is_writeable($file_path)) {
+ $handle = fopen($file_path, 'w');
+ foreach ($new_contents as $line) {
+ fwrite($handle, $line);
+ }
+ fclose($handle);
+ @chmod($file_path, $permissions); //Let's change the file back to it's original permission setting
+ return true;
+ } else {
+ return false;
+ }
+ }
+
+ public static function backup_and_rename_wp_config($src_file_path, $prefix = 'backup') {
+ global $aio_wp_security;
+
+ //Check to see if the main "backups" directory exists - create it otherwise
+ $aiowps_backup_dir = WP_CONTENT_DIR.'/'.AIO_WP_SECURITY_BACKUPS_DIR_NAME;
+ if (!AIOWPSecurity_Utility_File::create_dir($aiowps_backup_dir)) {
+ $aio_wp_security->debug_logger->log_debug("backup_and_rename_wp_config - Creation of backup directory failed!", 4);
+ return false;
+ }
+
+ $src_parts = pathinfo($src_file_path);
+ $backup_file_name = $prefix . '.' . $src_parts['basename'];
+
+ $backup_file_path = $aiowps_backup_dir . '/' . $backup_file_name;
+ if (!copy($src_file_path, $backup_file_path)) {
+ //Failed to make a backup copy
+ return false;
+ }
+ return true;
+ }
+
+ /**
+ * Backs up and renames the .htaccess file.
+ *
+ * This function creates a backup of the specified .htaccess file by copying it
+ * to a designated backup directory with a randomly generated filename.
+ *
+ * @param string $src_file_path The path to the source .htaccess file to be backed up.
+ *
+ * @return string|false The name of the backup file on success, or false on failure.
+ */
+ public static function backup_and_rename_htaccess($src_file_path) {
+ global $aio_wp_security;
+
+ // Define the backup directory path
+ $aiowps_backup_dir = WP_CONTENT_DIR . '/' . AIO_WP_SECURITY_BACKUPS_DIR_NAME;
+
+ // Ensure the backup directory exists or create it
+ if (!AIOWPSecurity_Utility_File::create_dir($aiowps_backup_dir)) {
+ $aio_wp_security->debug_logger->log_debug("backup_and_rename_htaccess - Creation of backup directory failed!", 4);
+ return false;
+ }
+
+ // Generate a random prefix for the backup file name
+ $random_prefix = AIOWPSecurity_Utility::generate_alpha_numeric_random_string(10);
+ $backup_file_name = $random_prefix . '_htaccess_backup';
+
+ // Define the backup file path
+ $backup_file_path = $aiowps_backup_dir . '/' . $backup_file_name .'.txt';
+
+ // Copy the source file to the backup location
+ if (!copy($src_file_path, $backup_file_path)) {
+ // Failed to make a backup copy
+ return false;
+ }
+
+ // Return the backup file name on success
+ return $backup_file_name;
+ }
+
+ /**
+ * This function will perform a recursive search for files in the path that match the passed in pattern
+ *
+ * @param string $pattern - the file pattern to search for
+ * @param integer $flags - flags to apply on the search
+ * @param string $path - the path we want to search
+ *
+ * @return boolean|array - an array of files matching the pattern or false if there was an error (directory traversal in path) or none found
+ */
+ public static function recursive_file_search($pattern = '*', $flags = 0, $path = '') {
+ $paths = glob($path.'*', GLOB_MARK|GLOB_ONLYDIR|GLOB_NOSORT);
+ if (false === $paths) {
+ return false;
+ }
+ $files = glob($path.$pattern, $flags);
+ if (false === $files) {
+ return false;
+ }
+ foreach ($paths as $path) {
+ $files = array_merge($files, AIOWPSecurity_Utility_File::recursive_file_search($pattern, $flags, $path));
+ }
+ return $files;
+ }
+
+ /**
+ * Useful when wanting to echo file contents to screen with '. + esc_html__('You have disabled login lockout by defining the AIOS_DISABLE_LOGIN_LOCKOUT constant value as true, and the login lockout setting has enabled it.', 'all-in-one-wp-security-and-firewall') . ' ' . + /* translators: 1: Locked IP Addresses admin page link */ + sprintf(esc_html__('Delete your login lockout IP from %s and define the AIOS_DISABLE_LOGIN_LOCKOUT constant value as false.', 'all-in-one-wp-security-and-firewall'), + '' . esc_html__('Locked IP addresses', 'all-in-one-wp-security-and-firewall') . '' + ). + '
+tags + * + * @param string $src_file + * @return string + */ + public static function get_file_contents_with_br($src_file) { + $file_contents = file_get_contents($src_file); + return nl2br($file_contents); + } + + /** + * Useful when wanting to echo file contents inside textarea + * + * @param string $src_file + * @return string + */ + public static function get_file_contents($src_file) { + $file_contents = file_get_contents($src_file); + return $file_contents; + } + + /** + * Returns the file's permission value eg, "0755" + * + * @param string $filepath + * @return string + */ + public static function get_file_permission($filepath) { + if (!function_exists('fileperms')) { + $perms = '-1'; + } else { + clearstatcache(); + $perms = substr(sprintf("%o", @fileperms($filepath)), -4); + } + return $perms; + } + + /** + * Checks if a write operation is possible for the file in question + * + * @param string $filepath + * @return boolean + */ + public static function is_file_writable($filepath) { + $test_string = ""; //We will attempt to append an empty string at the end of the file for the test + $write_result = @file_put_contents($filepath, $test_string, FILE_APPEND | LOCK_EX); + if (false === $write_result) { + return false; + } else { + return true; + } + } + + /** + * This function will compare the current permission value for a file or dir with the recommended value. + * It will compare the individual "execute", "write" and "read" bits for the "public", "group" and "owner" permissions. + * If the permissions for an actual bit value are greater than the recommended value it returns '0' (=less secure) + * Otherwise it returns '1' which means it is secure + * Accepts permission value parameters in octal, ie, "0777" or "777" + * + * @param string $recommended + * @param string $actual + * @return boolean + */ + public static function is_file_permission_secure($recommended, $actual) { + $result = 1; //initialize return result + + //Check "public" permissions + $public_value_actual = substr($actual, -1, 1); //get dec value for actual public permission + $public_value_rec = substr($recommended, -1, 1); //get dec value for recommended public permission + + $pva_bin = sprintf('%04b', $public_value_actual); //Convert value to binary + $pvr_bin = sprintf('%04b', $public_value_rec); //Convert value to binary + //Compare the "executable" bit values for the public actual versus the recommended + if (substr($pva_bin, -1, 1)<=substr($pvr_bin, -1, 1)) { + //The "execute" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "execute" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "write" bit values for the public actual versus the recommended + if (substr($pva_bin, -2, 1)<=substr($pvr_bin, -2, 1)) { + //The "write" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "write" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "read" bit values for the public actual versus the recommended + if (substr($pva_bin, -3, 1)<=substr($pvr_bin, -3, 1)) { + //The "read" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "read" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Check "group" permissions + $group_value_actual = substr($actual, -2, 1); + $group_value_rec = substr($recommended, -2, 1); + $gva_bin = sprintf('%04b', $group_value_actual); //Convert value to binary + $gvr_bin = sprintf('%04b', $group_value_rec); //Convert value to binary + + //Compare the "executable" bit values for the group actual versus the recommended + if (substr($gva_bin, -1, 1)<=substr($gvr_bin, -1, 1)) { + //The "execute" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "execute" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "write" bit values for the public actual versus the recommended + if (substr($gva_bin, -2, 1)<=substr($gvr_bin, -2, 1)) { + //The "write" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "write" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "read" bit values for the public actual versus the recommended + if (substr($gva_bin, -3, 1)<=substr($gvr_bin, -3, 1)) { + //The "read" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "read" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Check "owner" permissions + $owner_value_actual = substr($actual, -3, 1); + $owner_value_rec = substr($recommended, -3, 1); + $ova_bin = sprintf('%04b', $owner_value_actual); //Convert value to binary + $ovr_bin = sprintf('%04b', $owner_value_rec); //Convert value to binary + + //Compare the "executable" bit values for the group actual versus the recommended + if (substr($ova_bin, -1, 1)<=substr($ovr_bin, -1, 1)) { + //The "execute" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "execute" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "write" bit values for the public actual versus the recommended + if (substr($ova_bin, -2, 1)<=substr($ovr_bin, -2, 1)) { + //The "write" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "write" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + //Compare the "read" bit values for the public actual versus the recommended + if (substr($ova_bin, -3, 1)<=substr($ovr_bin, -3, 1)) { + //The "read" bit is the same or less as the recommended value + $result = 1*$result; + } else { + //The "read" bit is switched on for the actual value - meaning it is less secure + $result = 0*$result; + } + + return $result; + } + + /** + * Checks if a directory exists and creates one if it does not + * + * @param string $dirpath + * @return boolean + */ + public static function create_dir($dirpath = '') { + $res = true; + if ('' != $dirpath) { + //TODO - maybe add some checks to make sure someone is not passing a path with a filename, ie, something which has ".
+ + include_template('info/ip-address-ip-range-info.php'); ?> +
';
+ echo '
';
+ }
+
+ /**
+ * Modifies the wp-config.php file to disable PHP file editing from the admin panel
+ * This function will add the following code:
+ * define('DISALLOW_FILE_EDIT', false);
+ *
+ * NOTE: This function will firstly check if the above code already exists
+ * and it will modify the bool value, otherwise it will insert the code mentioned above
+ *
+ * @global type $aio_wp_security
+ * @return boolean
+ */
+ public static function disable_file_edits() {
+ global $aio_wp_security;
+ $edit_file_config_entry_exists = false;
+
+ //Config file path
+ $config_file = AIOWPSecurity_Utility_File::get_wp_config_file_path();
+
+ //Get wp-config.php file contents so we can check if the "DISALLOW_FILE_EDIT" variable already exists
+ $config_contents = file($config_file);
+
+ foreach ($config_contents as $line_num => $line) {
+ if (strpos($line, "'DISALLOW_FILE_EDIT', false")) {
+ $config_contents[$line_num] = str_replace('false', 'true', $line);
+ $edit_file_config_entry_exists = true;
+ //$this->show_msg_updated(__('Settings Saved - The ability to edit PHP files via the admin the panel has been DISABLED.', 'all-in-one-wp-security-and-firewall'));
+ } elseif (strpos($line, "'DISALLOW_FILE_EDIT', true")) {
+ $edit_file_config_entry_exists = true;
+ //$this->show_msg_updated(__('Your system config file is already configured to disallow PHP file editing.', 'all-in-one-wp-security-and-firewall'));
+ return true;
+
+ }
+
+ //For wp-config.php files originating from early WP versions we will remove the closing php tag
+ if (strpos($line, "?>") !== false) {
+ $config_contents[$line_num] = str_replace("?>", "", $line);
+ }
+ }
+
+ if (!$edit_file_config_entry_exists) {
+ //Construct the config code which we will insert into wp-config.php
+ $new_snippet = '//Disable File Edits' . PHP_EOL;
+ $new_snippet .= 'if (!defined(\'DISALLOW_FILE_EDIT\')) { define(\'DISALLOW_FILE_EDIT\', true); }';
+ $config_contents[] = $new_snippet; //Append the new snippet to the end of the array
+ }
+
+ //Make a backup of the config file
+ if (!AIOWPSecurity_Utility_File::backup_and_rename_wp_config($config_file)) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st(__('Failed to make a backup of the wp-config.php file.', 'all-in-one-wp-security-and-firewall') . ' ' . __('This operation will not go ahead.', 'all-in-one-wp-security-and-firewall'));
+ //$aio_wp_security->debug_logger->log_debug("Disable PHP File Edit - Failed to make a backup of the wp-config.php file.",4);
+ return false;
+ } else {
+ //$this->show_msg_updated(__('A backup copy of your wp-config.php file was created successfully....', 'all-in-one-wp-security-and-firewall'));
+ }
+
+ //Now let's modify the wp-config.php file
+ if (AIOWPSecurity_Utility_File::write_content_to_file($config_file, $config_contents)) {
+ //$this->show_msg_updated(__('Settings Saved - Your system is now configured to not allow PHP file editing.', 'all-in-one-wp-security-and-firewall'));
+ return true;
+ } else {
+ //$this->show_msg_error(__('Operation failed! Unable to modify wp-config.php file!', 'all-in-one-wp-security-and-firewall'));
+ $aio_wp_security->debug_logger->log_debug("Disable PHP File Edit - Unable to modify wp-config.php", 4);
+ return false;
+ }
+ }
+
+ /**
+ * Modifies the wp-config.php file to allow PHP file editing from the admin panel
+ * This func will modify the following code by replacing "true" with "false":
+ * define('DISALLOW_FILE_EDIT', true);
+ *
+ * @global type $aio_wp_security
+ * @return boolean
+ */
+ public static function enable_file_edits() {
+ $edit_file_config_entry_exists = false;
+
+ //Config file path
+ $config_file = AIOWPSecurity_Utility_File::get_wp_config_file_path();
+
+ //Get wp-config.php file contents
+ $config_contents = file($config_file);
+ foreach ($config_contents as $line_num => $line) {
+ if (strpos($line, "'DISALLOW_FILE_EDIT', true")) {
+ $config_contents[$line_num] = str_replace('true', 'false', $line);
+ $edit_file_config_entry_exists = true;
+ } elseif (strpos($line, "'DISALLOW_FILE_EDIT', false")) {
+ $edit_file_config_entry_exists = true;
+ //$this->show_msg_updated(__('Your system config file is already configured to allow PHP file editing.', 'all-in-one-wp-security-and-firewall'));
+ return true;
+ }
+ }
+
+ if (!$edit_file_config_entry_exists) {
+ //if the DISALLOW_FILE_EDIT settings don't exist in wp-config.php then we don't need to do anything
+ //$this->show_msg_updated(__('Your system config file is already configured to allow PHP file editing.', 'all-in-one-wp-security-and-firewall'));
+ return true;
+ } else {
+ //Now let's modify the wp-config.php file
+ if (AIOWPSecurity_Utility_File::write_content_to_file($config_file, $config_contents)) {
+ //$this->show_msg_updated(__('Settings Saved - Your system is now configured to allow PHP file editing.', 'all-in-one-wp-security-and-firewall'));
+ return true;
+ } else {
+ //$this->show_msg_error(__('Operation failed! Unable to modify wp-config.php file!', 'all-in-one-wp-security-and-firewall'));
+ //$aio_wp_security->debug_logger->log_debug("Disable PHP File Edit - Unable to modify wp-config.php",4);
+ return false;
+ }
+ }
+ }
+
+
+ /**
+ * Inserts event logs to the database
+ * For now we are using for 404 events but in future will expand for other events
+ * Event types: 404 (...add more as we expand this)
+ *
+ * @param string $event_type :Event type, eg, 404 (see below for list of event types)
+ * @param string $username (optional): username
+ * @return bool
+ */
+ public static function event_logger($event_type, $username = '') {
+ global $wpdb, $aio_wp_security;
+
+ //Some initialising
+ $url = '';
+ $referer_info = '';
+
+ $events_table_name = AIOWPSEC_TBL_EVENTS;
+
+ $ip_or_host = AIOWPSecurity_Utility_IP::get_user_ip_address(); //Get the IP address of user
+ $username = sanitize_user($username);
+ $user = get_user_by('login', $username); //Returns WP_User object if exists
+ if ($user) {
+ //If valid user set variables for DB storage later on
+ $user_id = (absint($user->ID) > 0) ? $user->ID : 0;
+ } else {
+ //If the login attempt was made using a non-existent user then let's set user_id to blank and record the attempted user login name for DB storage later on
+ $user_id = 0;
+ }
+
+ if ('404' == $event_type || 'spam_discard' == $event_type) {
+ //if 404 event get some relevant data
+ $url = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
+ $referer_info = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
+ }
+
+ $current_time = current_time('mysql', true);
+ $data = array(
+ 'event_type' => $event_type,
+ 'username' => $username,
+ 'user_id' => $user_id,
+ 'event_date' => $current_time,
+ 'ip_or_host' => $ip_or_host,
+ 'referer_info' => $referer_info,
+ 'url' => $url,
+ 'event_data' => '',
+ );
+
+ $data = apply_filters('aiowps_filter_event_logger_data', $data);
+ //log to database
+ $country_code = isset($data['country_code']) ? $data['country_code'] : '';
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. irect query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare("INSERT INTO ".$events_table_name." (event_type, username, user_id, event_date, ip_or_host, referer_info, url, event_data, country_code, created) VALUES (%s, %s, %d, %s, %s, %s, %s, %s, %s, UNIX_TIMESTAMP())", $data['event_type'], $data['username'], $data['user_id'], $data['event_date'], $data['ip_or_host'], $data['referer_info'], $data['url'], $data['event_data'], $country_code);
+
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- PCP warning. Query prepared above.
+ $result = $wpdb->query($sql);
+ if (false === $result) {
+ $aio_wp_security->debug_logger->log_debug("event_logger: Error inserting record into " . $events_table_name, 4);//Log the highly unlikely event of DB error
+ return false;
+ }
+ return true;
+ }
+
+ /**
+ * Checks if an IP address is locked.
+ *
+ * @param string $ip The IP address to be checked.
+ * @param string $lock_reason Optional. Defaults to any lockout reason if not provided.
+ *
+ * @return bool True if locked, false otherwise.
+ **/
+ public static function check_locked_ip($ip, $lock_reason = null) {
+ global $wpdb;
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+
+ if (null === $lock_reason) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $locked_ip = $wpdb->get_row($wpdb->prepare("SELECT * FROM `$login_lockdown_table` WHERE released > UNIX_TIMESTAMP() AND failed_login_ip = %s", $ip), ARRAY_A);
+ } else {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $locked_ip = $wpdb->get_row($wpdb->prepare("SELECT * FROM `$login_lockdown_table` WHERE released > UNIX_TIMESTAMP() AND failed_login_ip = %s AND lock_reason = %s", $ip, $lock_reason), ARRAY_A);
+ }
+
+ return null != $locked_ip;
+ }
+
+ /**
+ * Check if an IP address is blacklisted.
+ *
+ * @param string $ip The IP address to check.
+ * @return bool True if the IP address is blacklisted, false otherwise.
+ */
+ public static function check_blacklist_ip($ip) {
+ global $aio_wp_security;
+ $blacklisted_ips = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses');
+ $blacklisted_ips_array = explode("\n", $blacklisted_ips);
+ if (in_array($ip, $blacklisted_ips_array)) {
+ return true;
+ } else {
+ return false;
+ }
+ }
+
+ /**
+ * Returns list of IP addresses locked out
+ *
+ * @global type $wpdb
+ * @return array of addresses found or false otherwise
+ */
+ public static function get_locked_ips() {
+ global $wpdb;
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $locked_ips = $wpdb->get_results("SELECT * FROM $login_lockdown_table WHERE released > UNIX_TIMESTAMP()", ARRAY_A);
+ if (empty($locked_ips)) {
+ return false;
+ } else {
+ return $locked_ips;
+ }
+ }
+
+
+ /**
+ * Locks an IP address - Adds an entry to the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @global wpdb $wpdb
+ * @global AIO_WP_Security $aio_wp_security
+ *
+ * @param String $ip
+ * @param String $lock_reason
+ * @param String $username
+ *
+ * @return Void
+ */
+ public static function lock_ip($ip, $lock_reason, $username = '') {
+ global $wpdb, $aio_wp_security;
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+
+ if ('404' == $lock_reason) {
+
+ // Query for existing lockouts record with that ip and 404 reason.
+ $existing_lock_query = $wpdb->prepare(
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- PCP warning. Direct query required. Table name cannot be prepared pre WP 6.2.
+ "SELECT * FROM {$login_lockdown_table} WHERE failed_login_IP = %s AND lock_reason = %s AND released > UNIX_TIMESTAMP() LIMIT 1",
+ $ip,
+ $lock_reason
+ );
+
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- PCP warning. Prepared above.
+ $existing_lock_count = $wpdb->get_var($existing_lock_query);
+
+ if ($existing_lock_count) return; // IP is already blocked for '404', return.
+
+ $lock_minutes = $aio_wp_security->configs->get_value('aiowps_404_lockout_time_length');
+ } elseif ('audit-log' == $lock_reason) {
+ $lock_minutes = 24 * 60;
+ } else {
+ $lock_minutes = $aio_wp_security->user_login_obj->get_dynamic_lockout_time_length();
+ }
+
+ $username = sanitize_user($username);
+ $user = get_user_by('login', $username); //Returns WP_User object if exists
+
+ if (false == $user) {
+ // Not logged in.
+ $username = '';
+ $user_id = 0;
+ } else {
+ // Logged in.
+ $username = sanitize_user($user->user_login);
+ $user_id = $user->ID;
+ }
+
+ $ip = esc_sql($ip);
+
+ $lock_seconds = $lock_minutes * MINUTE_IN_SECONDS;
+ $lock_time = current_time('mysql', true);
+ $ip_lookup_result = AIOS_Helper::get_ip_reverse_lookup($ip);
+ $ip_lookup_result = wp_json_encode($ip_lookup_result);
+ if (false === $ip_lookup_result) $ip_lookup_result = null;
+
+ $release_time = gmdate('Y-m-d H:i:s', time() + ($lock_seconds));
+ $data = array(
+ 'user_id' => $user_id,
+ 'user_login' => $username,
+ 'lockdown_date' => $lock_time,
+ 'release_date' => $release_time,
+ 'failed_login_IP' => $ip,
+ 'lock_reason' => $lock_reason,
+ 'lock_seconds' => $lock_seconds,
+ 'ip_lookup_result' => $ip_lookup_result
+ );
+
+ $result = AIOWPSecurity_Utility::add_lockout($data);
+
+ if (false === $result) {
+ $error_msg = empty($wpdb->last_error) ? "lock_ip: Error inserting record into " . $login_lockdown_table : $wpdb->last_error;
+ $aio_wp_security->debug_logger->log_debug($error_msg, 4);//Log the highly unlikely event of DB error
+ }
+ }
+
+ /**
+ * Adds an entry to the AIOWPSEC_TBL_LOGIN_LOCKOUT table.
+ *
+ * @global wpdb $wpdb
+ *
+ * @param Array $data
+ *
+ * @return Boolean
+ */
+ public static function add_lockout($data) {
+ global $wpdb;
+ if (!isset($data['is_lockout_email_sent'])) $data['is_lockout_email_sent'] = 0;
+ if (!isset($data['backtrace_log'])) $data['backtrace_log'] = '';
+ if (!isset($data['ip_lookup_result'])) $data['ip_lookup_result'] = '';
+ $login_lockdown_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+ // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder, WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare("INSERT INTO ".$login_lockdown_table." (user_id, user_login, lockdown_date, created, release_date, released, failed_login_IP, lock_reason, is_lockout_email_sent, backtrace_log, ip_lookup_result) VALUES ('%d', '%s', '%s', UNIX_TIMESTAMP(), '%s', UNIX_TIMESTAMP()+%d, '%s', '%s', '%d', '%s', '%s')", $data['user_id'], $data['user_login'], $data['lockdown_date'], $data['release_date'], $data['lock_seconds'], $data['failed_login_IP'], $data['lock_reason'], $data['is_lockout_email_sent'], $data['backtrace_log'], $data['ip_lookup_result']);
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- PCP warning. Prepared above.
+ $result = $wpdb->query($sql);
+ return $result;
+ }
+
+ /**
+ * Returns an array of blog_ids for a multisite install
+ *
+ * @global type $wpdb
+ * @global type $wpdb
+ * @return array or empty array if not multisite
+ */
+ public static function get_blog_ids() {
+ global $wpdb;
+ if (is_multisite()) {
+ global $wpdb;
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- PCP warning. Direct query required.
+ $blog_ids = $wpdb->get_col("SELECT blog_id FROM " . $wpdb->prefix . "blogs");
+ } else {
+ $blog_ids = array();
+ }
+ return $blog_ids;
+ }
+
+ /**
+ * Purges old records of table
+ *
+ * @global type $wpdb WP Database object
+ * @global type $aio_wp_security AIO WP Security object
+ * @param type $table_name Table name
+ * @param type $purge_records_after_days Records after days to be deleted
+ * @param type $date_field Date field of table
+ * @return void
+ */
+ public static function purge_table_records($table_name, $purge_records_after_days, $date_field) {
+ global $wpdb, $aio_wp_security;
+
+ $older_than_date_time = strtotime('-' . $purge_records_after_days . ' days', time());
+ if ('created' != $date_field) $older_than_date_time = gmdate('Y-m-d H:i:s', $older_than_date_time);
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- PCP error. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $sql = $wpdb->prepare('DELETE FROM ' . $table_name . ' WHERE '.$date_field.' < %s', $older_than_date_time);
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- PCP warning. Prepared above.
+ $ret_deleted = $wpdb->query($sql);
+ if (false === $ret_deleted) {
+ $err_db = !empty($wpdb->last_error) ? ' ('.$wpdb->last_error.' - '.$wpdb->last_query.')' : '';
+ // Status level 4 indicates failure status.
+ $aio_wp_security->debug_logger->log_debug_cron('Purge records error - failed to purge older records for ' . $table_name . '.' . $err_db, 4);
+ } else {
+ $aio_wp_security->debug_logger->log_debug_cron(sprintf('Purge records - %d records were deleted for ' . $table_name . '.', $ret_deleted));
+ }
+ }
+
+ /**
+ * This function will delete the oldest rows from a table which are over the max amount of rows specified
+ *
+ * @global type $wpdb WP Database object
+ * @global type $aio_wp_security AIO WP Security object
+ * @param type $table_name Table name
+ * @param type $max_rows More than max to be deleted
+ * @param type $id_field Primary field of table
+ * @return bool
+ */
+ public static function cleanup_table($table_name, $max_rows = '10000', $id_field = 'id') {
+ global $wpdb, $aio_wp_security;
+
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $num_rows = $wpdb->get_var("select count(*) from $table_name");
+ $result = true;
+ if ($num_rows > $max_rows) {
+ //if the table has more than max entries delete oldest rows
+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- PCP error. Direct query necessary. Table name cannot be prepared pre WP 6.2.
+ $del_sql = $wpdb->prepare("DELETE FROM $table_name WHERE ".$id_field." <= (SELECT ".$id_field." FROM (SELECT ".$id_field." FROM $table_name ORDER BY ".$id_field." DESC LIMIT 1 OFFSET $max_rows) foo_tmp)");
+
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery -- PCP warning. Prepared above.
+ $result = $wpdb->query($del_sql);
+ if (false === $result) {
+ $aio_wp_security->debug_logger->log_debug("AIOWPSecurity_Utility::cleanup_table failed for table name: " . $table_name, 4);
+ }
+ }
+ return (false === $result) ? false : true;
+ }
+
+ /**
+ * Add backquotes to tables and db-names in SQL queries. Taken from phpMyAdmin.
+ *
+ * @param string $a_name - the table name
+ * @return string - the quoted table name
+ */
+ public static function backquote($a_name) {
+ if (!empty($a_name) && '*' != $a_name) {
+ if (is_array($a_name)) {
+ $result = array();
+ foreach ($a_name as $key => $val) {
+ $result[$key] = '`'.$val.'`';
+ }
+ return $result;
+ } else {
+ return '`'.$a_name.'`';
+ }
+ } else {
+ return $a_name;
+ }
+ }
+
+ /**
+ * Replace the first, and only the first, instance within a string
+ *
+ * @param String $needle - the search term
+ * @param String $replace - the replacement term
+ * @param String $haystack - the string to replace within
+ *
+ * @return String - the filtered string
+ */
+ public static function str_replace_once($needle, $replace, $haystack) {
+ $pos = strpos($haystack, $needle);
+ return (false !== $pos) ? substr_replace($haystack, $replace, $pos, strlen($needle)) : $haystack;
+ }
+
+ /**
+ * Delete expired CAPTCHA info option
+ *
+ * Note: A unique instance these option is created everytime the login page is loaded with CAPTCHA enabled
+ * This function will help prune the options table of old expired entries.
+ *
+ * @global wpdb $wpdb
+ */
+ public static function delete_expired_captcha_options() {
+ global $wpdb;
+ $current_unix_time = current_time('timestamp', true);
+ $previous_hour = $current_unix_time - 3600;
+ $tbl = is_multisite() ? $wpdb->sitemeta : $wpdb->prefix . 'options';
+ $key_name = is_multisite() ? 'meta_key' : 'option_name';
+ $key_val = is_multisite() ? 'meta_value' : 'option_value';
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery -- PCP warning. Direct query required. Table name cannot be prepared pre WP 6.2.
+ $query = $wpdb->prepare("SELECT * FROM {$tbl} WHERE {$key_name} LIKE 'aiowps_captcha_string_info_time_%' AND {$key_val} < %s", $previous_hour);
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- PCP warning. Prepared above.
+ $res = $wpdb->get_results($query, ARRAY_A);
+ if (!empty($res)) {
+ foreach ($res as $item) {
+ $option_name = $item[$key_name];
+ if (is_multisite()) {
+ delete_site_option($option_name);
+ delete_site_option(str_replace('time_', '', $option_name));
+ } else {
+ delete_option($option_name);
+ delete_option(str_replace('time_', '', $option_name));
+ }
+ }
+ }
+ }
+
+ /**
+ * Get server type.
+ *
+ * @return string|integer Server type or -1 if server is not supported
+ */
+ public static function get_server_type() {
+ if (!isset($_SERVER['SERVER_SOFTWARE'])) {
+ return apply_filters('aios_server_type', -1);
+ }
+
+ // Figure out what server they're using.
+ $server_software = strtolower(sanitize_text_field(wp_unslash(($_SERVER['SERVER_SOFTWARE']))));
+
+ if (strstr($server_software, 'apache')) {
+ $server_type = 'apache';
+ } elseif (strstr($server_software, 'nginx')) {
+ $server_type = 'nginx';
+ } elseif (strstr($server_software, 'litespeed')) {
+ $server_type = 'litespeed';
+ } elseif (strstr($server_software, 'iis')) {
+ $server_type = 'iis';
+ } elseif (strstr($server_software, 'lighttpd')) {
+ $server_type = 'lighttpd';
+ } else { // Unsupported server
+ $server_type = -1;
+ }
+
+ return apply_filters('aios_server_type', $server_type);
+ }
+
+ /**
+ * Checks if the string exists in the array key value of the provided array.
+ * If it doesn't exist, it returns the first key element from the valid values.
+ *
+ * @param type $to_check
+ * @param type $valid_values
+ * @return type
+ */
+ public static function sanitize_value_by_array($to_check, $valid_values) {
+ $keys = array_keys($valid_values);
+ $keys = array_map('strtolower', $keys);
+ if (in_array(strtolower($to_check), $keys)) {
+ return $to_check;
+ }
+ return reset($keys); //Return the first element from the valid values
+ }
+
+ /**
+ * Get textarea string from array or string.
+ *
+ * @param String|Array $vals value to render as textarea val
+ * @return String value to render in textarea.
+ */
+ public static function get_textarea_str_val($vals) {
+ if (empty($vals)) {
+ return '';
+ }
+
+ if (is_array($vals)) {
+ return implode("\n", array_filter(array_map('trim', $vals)));
+ }
+
+ return $vals;
+ }
+
+ /**
+ * Get array from textarea val.
+ *
+ * @param String|Array $vals value from textarea val
+ * @return Array value to from textarea value.
+ */
+ public static function get_array_from_textarea_val($vals) {
+ if (empty($vals)) {
+ return array();
+ }
+
+ if (is_array($vals)) {
+ return $vals;
+ }
+
+ return array_filter(array_map('trim', explode("\n", $vals)));
+ }
+
+ /**
+ * Partially or fully masks a string using '*' to replace original characters
+ *
+ * @param type string $str
+ * @param type int $chars_unmasked
+ * @return type string
+ */
+ public static function mask_string($str, $chars_unmasked = 0) {
+ $str_length = strlen($str);
+ $chars_unmasked = absint($chars_unmasked);
+
+ if (0 == $chars_unmasked) {
+ if (8 < $str_length) {
+ // mask all but last 4 characters
+ return preg_replace("/(.{4}$)(*SKIP)(*F)|(.)/u", "*", $str);
+ } elseif (3 < $str_length) {
+ // mask all but last 2 characters
+ return preg_replace("/(.{2}$)(*SKIP)(*F)|(.)/u", "*", $str);
+ } else {
+ // return whole string masked
+ return str_pad("", $str_length, "*", STR_PAD_LEFT);
+ }
+ }
+ if ($chars_unmasked >= $str_length) return $str;
+ return preg_replace("/(.{".$chars_unmasked."}$)(*SKIP)(*F)|(.)/u", "*", $str);
+ }
+
+ /**
+ * Create a php backtrace log file for login lockdown email
+ *
+ * @param Array $logs
+ * @global AIO_WP_Security $aio_wp_security
+ * @return string
+ */
+ public static function login_lockdown_email_backtrace_log_file($logs = array()) {
+ global $aio_wp_security;
+
+ $temp_dir = get_temp_dir();
+ $backtrace_filename = wp_unique_filename($temp_dir, 'log_backtrace_' . time() . '.txt');
+ $backtrace_filepath = $temp_dir.$backtrace_filename;
+ if (count($logs) > 0) {
+ $dbg = "";
+ foreach ($logs as $log) {
+ $dbg.= "############ BACKTRACE STARTS ########\n";
+ $dbg.= $log['backtrace_log'];
+ $dbg.= "############ BACKTRACE ENDS ########\n\n";
+ }
+ } else {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace, PHPCompatibility.FunctionUse.ArgumentFunctionsReportCurrentValue.NeedsInspection -- PCP and compatibility warnings. Safe to ignore.
+ $dbg = debug_backtrace();
+ }
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r -- PCP warning. Ignore
+ $is_log_file_written = file_put_contents($backtrace_filepath, print_r($dbg, true));
+ if ($is_log_file_written) {
+ return $backtrace_filepath;
+ } else {
+ $aio_wp_security->debug_logger->log_debug("Error in writing php backtrace file " . $backtrace_filepath . " to attach in email.", 4);
+ return '';
+ }
+ }
+
+ /**
+ * Normalise call stacks by clearing out unnecessary objects from their arguments list, leaving only the first arguments as a string. The call stacks should be one that is generated by debug_backtrace() function.
+ *
+ * @param array $backtrace The output of the debug_backtrace() function
+ * @return array An array of associative arrays after being normalised
+ */
+ public static function normalise_call_stack_args($backtrace) {
+ foreach ($backtrace as $index => $element) {
+ if (!isset($element['args']) || !is_array($element['args']) || !isset($element['args'][0])) $backtrace[$index]['args'] = array('');
+ foreach ($backtrace[$index]['args'] as $key => $arg) {
+ if (is_object($arg)) {
+ $backtrace[$index]['args'][$key] = array(get_class($backtrace[$index]['args'][$key]));
+ } elseif (!is_string($arg)) {
+ $backtrace[$index]['args'][$key] = array('');
+ }
+ }
+
+ if ('apply_filters' == $backtrace[$index]['function'] && 'authenticate' == $backtrace[$index]['args'][0]) {
+ $backtrace[$index]['args'] = array('authenticate');
+ }
+
+ if ('do_action' == $backtrace[$index]['function'] && 'password_reset' == $backtrace[$index]['args'][0]) {
+ $backtrace[$index]['args'] = array('password_reset');
+ }
+
+ $keys_to_filter = array('wp_create_user', 'wpmu_create_user', 'wp_authenticate', 'post_authenticate', 'reset_password');
+ if (in_array($backtrace[$index]['function'], $keys_to_filter)) {
+ $backtrace[$index]['args'] = array();
+ }
+ }
+ return $backtrace;
+ }
+
+ /**
+ * Check whether the WooCommerce plugin is active.
+ *
+ * @return Boolean True if the WooCommerce plugin is active, otherwise false.
+ */
+ public static function is_woocommerce_plugin_active() {
+ return is_plugin_active('woocommerce/woocommerce.php');
+ }
+
+ /**
+ * Check whether incompatible TFA premium plugin version active.
+ *
+ * @return boolean True if the incompatible TFA premium plugin version active, otherwise false.
+ */
+ public static function is_incompatible_tfa_premium_version_active() {
+ if (!function_exists('get_plugin_data')) {
+ require_once(ABSPATH . '/wp-admin/includes/plugin.php');
+ }
+
+ $active_plugins = wp_get_active_and_valid_plugins();
+
+ foreach ($active_plugins as $plugin_file) {
+ if ('two-factor-login.php' == basename($plugin_file) && is_dir(dirname($plugin_file) . '/simba-tfa/premium') && version_compare(get_plugin_data($plugin_file, false, false)['Version'], AIOS_TFA_PREMIUM_LATEST_INCOMPATIBLE_VERSION, '<=')) {
+ return true;
+ }
+ }
+
+ return false;
+ }
+
+ /**
+ * Check whether TFA plugin activating.
+ *
+ * @return boolean True if the TFA plugin activating, otherwise false.
+ */
+ public static function is_tfa_or_self_plugin_activating() {
+ // The $GLOBALS['pagenow'] doesn't set in the network admin plugins page and it throws the warning "Notice: Undefined index: pagenow in ..." so we can't use it.
+ // https://core.trac.wordpress.org/ticket/42656
+ return is_admin() &&
+ isset($_SERVER['PHP_SELF']) && preg_match('#/wp-admin/plugins.php$#i', sanitize_text_field(wp_unslash($_SERVER['PHP_SELF']))) && isset($_GET['plugin']) && (preg_match("/\/two-factor-login.php/", sanitize_text_field(wp_unslash($_GET['plugin']))) || preg_match("/all-in-one-wp-security-and-firewall/", sanitize_text_field(wp_unslash($_GET['plugin'])))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. Ignore.
+ }
+
+ /**
+ * Check whether the site is running on localhost or not.
+ *
+ * @return Boolean True if the site is on localhost, otherwise false.
+ */
+ public static function is_localhost() {
+ if (defined('AIOS_IS_LOCALHOST')) {
+ return AIOS_IS_LOCALHOST;
+ }
+
+ if (empty($_SERVER['REMOTE_ADDR'])) {
+ return false;
+ }
+ return in_array($_SERVER['REMOTE_ADDR'], array('127.0.0.1', '::1')) ? true : false;
+ }
+
+ /**
+ * Get server software.
+ *
+ * @return string Server software or empty.
+ */
+ public static function get_server_software() {
+ static $server_software;
+ if (!isset($server_software)) {
+ $server_software = (isset($_SERVER['SERVER_SOFTWARE']) ? sanitize_text_field(wp_unslash($_SERVER['SERVER_SOFTWARE'])) : '');
+ }
+ return $server_software;
+ }
+
+ /**
+ * Check whether the server is apache or not.
+ *
+ * @return Boolean True the server is apache, otherwise false.
+ */
+ public static function is_apache_server() {
+ return (false !== strpos(self::get_server_software(), 'Apache'));
+ }
+
+ /**
+ * Change salt postfixes.
+ *
+ * @return boolean True if the salt postfixes are changed otherwise false.
+ */
+ public static function change_salt_postfixes() {
+ global $aio_wp_security;
+
+ $salt_postfixes_scheme = array('auth', 'secure_auth', 'logged_in', 'nonce', 'wpcf7_submission');
+ $salt_postfixes_scheme = apply_filters('aios_salt_postfixes_scheme', $salt_postfixes_scheme);
+ $salt_postfixes = array();
+ foreach ($salt_postfixes_scheme as $scheme) {
+ $salt_postfixes[$scheme] = wp_generate_password(64, true, true);
+ }
+ return $aio_wp_security->configs->set_value('aiowps_salt_postfixes', $salt_postfixes, true);
+ }
+
+ /**
+ * This function checks to see if there is a display condition for the item and if so runs it otherwise it returns true to display the item
+ *
+ * @param array $item_info - the item information array
+ *
+ * @return boolean - true if the item should be displayed or false to hide it
+ */
+ public static function should_display_item($item_info) {
+ if (!empty($item_info['display_condition_callback']) && is_callable($item_info['display_condition_callback'])) {
+ return call_user_func($item_info['display_condition_callback']);
+ } elseif (!empty($item_info['display_condition_callback']) && !is_callable($item_info['display_condition_callback'])) {
+ $item = isset($item_info['page_title']) ? $item_info['page_title'] : '';
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- PCP warning. Ignore.
+ error_log("Callback function set but not callable (coding error). Item: " . $item);
+ return false;
+ }
+ return true;
+ }
+
+ /**
+ * Verify the username is valid based on logged_in cookie information
+ *
+ * @see https://developer.wordpress.org/reference/functions/wp_validate_auth_cookie/
+ * @param string $info - Cookie info
+ * @param int $grace - A grace period for the expiration in seconds
+ * @return string - Username if valid; blank string otherwise
+ */
+ public static function verify_username($info, $grace = 3600) {
+
+ if (!is_string($info)) return '';
+
+ $elements = wp_parse_auth_cookie($info, 'logged_in');
+
+ if (empty($elements)) return '';
+
+ $username = $elements['username'];
+ $expiration = $elements['expiration'];
+ $token = $elements['token'];
+ $hmac = $elements['hmac'];
+ $scheme = $elements['scheme'];
+
+ // Add a grace period to the expiration check since there may be a delay in processing the user data
+ if (!empty($grace) && ($expiration + absint($grace)) < time()) return '';
+
+ $user = get_user_by('login', $username);
+
+ if (false === $user) return '';
+
+ $pass_frag = substr($user->user_pass, 8, 4);
+
+ $key = wp_hash($username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme);
+
+ // Use sha1, if sha256 is not available
+ $algo = function_exists('hash') ? 'sha256' : 'sha1';
+ $hash = hash_hmac($algo, $username . '|' . $expiration . '|' . $token, $key);
+
+ if (hash_equals($hash, $hmac)) {
+ return $username;
+ }
+
+ return '';
+ }
+
+ /**
+ * Get the blog ID from the provided request
+ *
+ * @param array $request
+ * @return int - returns the blog_id or 0 if it cannot be found
+ */
+ public static function get_blog_id_from_request($request) {
+
+ if (!is_multisite()) return get_current_blog_id();
+
+ $can_get_blog_id = isset($request['REQUEST_SCHEME']) && isset($request['HTTP_HOST']) && isset($request['REQUEST_URI']);
+ if (!$can_get_blog_id) return 0;
+
+ $site_url = $request['REQUEST_SCHEME'].'://'.$request['HTTP_HOST'].$request['REQUEST_URI'];
+ $components = wp_parse_url(trailingslashit($site_url));
+
+ $can_get_blog_id = isset($components['host']) && isset($components['path']);
+ if (!$can_get_blog_id) return 0;
+
+ $default_path = defined('PATH_CURRENT_SITE') ? constant('PATH_CURRENT_SITE') : '/';
+
+ $domain = $components['host'];
+ $path = SUBDOMAIN_INSTALL ? $default_path : ($default_path === $components['path'] ? $components['path'] : '/'.explode('/', $components['path'])[1].'/');
+
+ $blog_id = get_blog_id_from_url($domain, $path);
+
+ // On a subdirectory installation, if the blog_id cannot be found for the subdirectory given, we assume it's a path belonging to the main site
+ // So use the main site's blog_id.
+ if (0 === $blog_id && !SUBDOMAIN_INSTALL) $blog_id = get_blog_id_from_url($domain, $default_path);
+
+ return $blog_id;
+ }
+
+ /**
+ * Checks if the bbPress plugin is active.
+ *
+ * @return Boolean True if the bbPress plugin is active, otherwise false.
+ */
+ public static function is_bbpress_plugin_active() {
+ return is_plugin_active('bbpress/bbpress.php');
+ }
+
+ /**
+ * Checks if the Buddypress plugin is active.
+ *
+ * @return Boolean True if the Buddypress plugin is active, otherwise false.
+ */
+ public static function is_buddypress_plugin_active() {
+ return is_plugin_active('buddypress/bp-loader.php');
+ }
+
+ /**
+ * Checks if the Contact Form 7 plugin is active.
+ *
+ * @return Boolean - True if the Contact Form 7 plugin is active, otherwise false.
+ */
+ public static function is_contact_form_7_plugin_active() {
+ return is_plugin_active('contact-form-7/wp-contact-form-7.php');
+ }
+
+ /**
+ * Checks if the Memberpress plugin is active.
+ *
+ * @return Boolean - True if the Memberpress plugin is active, otherwise false.
+ */
+ public static function is_memberpress_plugin_active() {
+ return is_plugin_active('memberpress/memberpress.php');
+ }
+
+ /**
+ * Retrieves and returns current WP general settings date time format.
+ *
+ * @return string
+ */
+ public static function get_wp_datetime_format() {
+ return get_option('date_format') . ' ' . get_option('time_format');
+ }
+
+ /**
+ * This function gets the timezone of the site as a DateTimeZone object
+ *
+ * @see https://developer.wordpress.org/reference/functions/wp_timezone/
+ *
+ * @return DateTimeZone - the timezone of the site as a DateTimeZone object
+ */
+ public static function get_wp_timezone() {
+ return new DateTimeZone(self::get_wp_timezone_string());
+ }
+
+ /**
+ * This function gets the timezone of the site as a string
+ *
+ * @see https://developer.wordpress.org/reference/functions/wp_timezone_string/
+ *
+ * @return string - PHP timezone name or a ±HH:MM offset
+ */
+ public static function get_wp_timezone_string() {
+ $timezone_string = get_option('timezone_string');
+
+ if ($timezone_string) return $timezone_string;
+
+ $offset = (float) get_option('gmt_offset');
+ $hours = (int) $offset;
+ $minutes = ($offset - $hours);
+ $sign = ($offset < 0) ? '-' : '+';
+ $abs_hour = abs($hours);
+ $abs_mins = abs($minutes * 60);
+ $tz_offset = sprintf('%s%02d:%02d', $sign, $abs_hour, $abs_mins);
+
+ return $tz_offset;
+ }
+
+ /**
+ * Converts a Unix timestamp to WP general settings timezone and format. It will also translate with wp_date if available.
+ *
+ * @param string $timestamp Optional. Will default to time() if not provided.
+ * @param string $format Optional. Will default to WP general settings format if not provided.
+ *
+ * @return string
+ */
+ public static function convert_timestamp($timestamp = null, $format = null) {
+
+ if (!$format) $format = self::get_wp_datetime_format();
+
+ if (!$timestamp) $timestamp = time();
+
+ return function_exists('wp_date') ? wp_date($format, $timestamp) : get_date_from_gmt(gmdate('Y-m-d H:i:s', $timestamp), $format);
+ }
+
+ /**
+ * Deletes unneeded default WP files.
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ *
+ * @param bool $echo_results
+ *
+ * @return array
+ */
+ public static function delete_unneeded_default_files($echo_results = false) {
+ global $aio_wp_security;
+
+ $files = array('readme.html', 'wp-config-sample.php', 'license.txt');
+ $info = array();
+ $error = array();
+ foreach ($files as $file_name) {
+ $file_path = ABSPATH . $file_name;
+
+ if (file_exists($file_path)) {
+ if (@wp_delete_file($file_path)) {
+ /* translators: %s: File name */
+ $success_message = sprintf(__('Successfully deleted the %s file.', 'all-in-one-wp-security-and-firewall'), $file_name);
+ $aio_wp_security->debug_logger->log_debug($success_message, 0);
+
+ if ($echo_results) {
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st($success_message);
+ }
+ } else {
+ /* translators: %s: File name */
+ $failure_message = sprintf(__('Failed to delete the %s file.', 'all-in-one-wp-security-and-firewall'), $file_name) . ' ' . sprintf(__('Check the file/directory permissions at: %s', 'all-in-one-wp-security-and-firewall'), $file_path);
+ $error[] = $file_name;
+ $aio_wp_security->debug_logger->log_debug($failure_message, 4);
+
+ if ($echo_results) {
+ AIOWPSecurity_Admin_Menu::show_msg_error_st($failure_message);
+ }
+ }
+ } else {
+ /* translators: %s: File name */
+ $message = sprintf(__('The %s file has already been deleted.', 'all-in-one-wp-security-and-firewall'), $file_name);
+ $info[] = $message;
+ $aio_wp_security->debug_logger->log_debug($message, 0);
+
+ if ($echo_results) {
+ AIOWPSecurity_Admin_Menu::show_msg_updated_st($message);
+ }
+ }
+ }
+
+
+ return array(
+ 'info' => $info,
+ 'error' => empty($error) ? '' : implode(', ', $error)
+ );
+ }
+
+ /**
+ * Convert a number of bytes into a suitable textual string
+ *
+ * @param Integer $size - the number of bytes
+ *
+ * @return String - the resulting textual string
+ */
+ public static function convert_numeric_size_to_text($size) {
+ if ($size > 1073741824) {
+ return round($size / 1073741824, 1).' GB';
+ } elseif ($size > 1048576) {
+ return round($size / 1048576, 1).' MB';
+ } elseif ($size > 1024) {
+ return round($size / 1024, 1).' KB';
+ } else {
+ return round($size, 1).' B';
+ }
+ }
+
+ /**
+ * Updates the Googlebot IP ranges config.
+ *
+ * @return array|WP_Error
+ */
+ public static function get_googlebot_ip_ranges() {
+ $response = wp_safe_remote_get('https://developers.google.com/static/search/apis/ipranges/googlebot.json');
+
+ $body = wp_remote_retrieve_body($response);
+ $json_array = json_decode($body, true);
+
+ $ip_list_array = array();
+
+ foreach ($json_array['prefixes'] as $prefix) {
+ $ip_list_array[] = array_key_exists('ipv4Prefix', $prefix) ? $prefix['ipv4Prefix'] : $prefix['ipv6Prefix'];
+ }
+
+ return AIOWPSecurity_Utility_IP::validate_ip_list($ip_list_array, 'whitelist');
+ }
+
+ /**
+ * This function creates and outputs the csv file for download
+ *
+ * @param array $items - the content
+ * @param array $export_keys - the keys for the content
+ * @param string $filename - the filename
+ *
+ * @return void
+ */
+ public static function output_csv($items, $export_keys, $filename = 'data.csv') {
+ header("Content-Type: text/csv; charset=utf-8");
+ header("Content-Disposition: attachment; filename=".$filename);
+ header("Pragma: no-cache");
+ header("Expires: 0");
+ $output = fopen('php://output', 'w'); //open output stream
+
+ fputcsv($output, $export_keys, ',', '"', '\\'); // let's put column names first
+
+ foreach ($items as $item) {
+ $csv_line = array();
+
+ foreach ($export_keys as $key => $value) {
+ if (isset($item[$key])) {
+ $csv_line[] = ('created' == $key) ? AIOWPSecurity_Utility::convert_timestamp($item[$key]) : $item[$key];
+ }
+ }
+ fputcsv($output, $csv_line, ',', '"', '\\');
+ }
+ }
+
+ /**
+ * Check if a user is a member of the current blog ID in a multisite environment.
+ *
+ * @param int $user_id - User Id to check.
+ *
+ * @return bool Whether the user is a member of the current blog ID.
+ */
+ public static function is_user_member_of_blog($user_id) {
+ $current_user_id = get_current_user_id();
+
+ if (is_multisite() && !is_super_admin($current_user_id)) {
+ $blog_id = get_current_blog_id();
+ return is_user_member_of_blog($user_id, $blog_id);
+ }
+
+ // Non-multisite or super admin, consider the user a member
+ return true;
+ }
+
+ /**
+ * Blacklists an IP address.
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @global AIOWPS\Firewall\Config $aiowps_firewall_config
+ *
+ * @param string $ip The IP address to be blacklisted.
+ *
+ * @return void|WP_Error
+ */
+ public static function blacklist_ip($ip) {
+ global $aio_wp_security;
+ $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG);
+
+ $blacklisted_ip_addresses = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses');
+
+ $ip_list_array = AIOWPSecurity_Utility_IP::create_ip_list_array_from_string_with_newline($blacklisted_ip_addresses);
+ $ip_list_array[] = $ip;
+
+ $validated_ip_list_array = AIOWPSecurity_Utility_IP::validate_ip_list($ip_list_array, 'blacklist');
+
+ if (is_wp_error($validated_ip_list_array)) {
+ return $validated_ip_list_array;
+ } else {
+ $banned_ip_data = implode("\n", $validated_ip_list_array);
+
+ $aio_wp_security->configs->set_value('aiowps_enable_blacklisting', '1'); // Force blacklist feature to be enabled.
+ $aio_wp_security->configs->set_value('aiowps_banned_ip_addresses', $banned_ip_data);
+ $aio_wp_security->configs->save_config();
+
+ $aiowps_firewall_config->set_value('aiowps_blacklist_ips', $validated_ip_list_array);
+ }
+ }
+
+ /**
+ * Unlocks an IP address.
+ *
+ * @global wpdb $wpdb
+ *
+ * @param string $ip The IP address to be blacklisted.
+ *
+ * @return boolean
+ */
+ public static function unlock_ip($ip) {
+ global $wpdb;
+
+ $lockout_table = AIOWPSEC_TBL_LOGIN_LOCKOUT;
+
+ // Unlock single record.
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery -- PCP warning. Ignore.
+ $result = $wpdb->query($wpdb->prepare("UPDATE $lockout_table SET `released` = UNIX_TIMESTAMP() WHERE `failed_login_ip` = %s", $ip));
+
+ return null != $result;
+ }
+
+ /**
+ * Unblacklists an IP address.
+ *
+ * @global AIO_WP_Security $aio_wp_security
+ * @global AIOWPS\Firewall\Config $aiowps_firewall_config
+ *
+ * @param string $ip The IP address to be unblacklisted.
+ *
+ * @return boolean
+ */
+ public static function unblacklist_ip($ip) {
+ global $aio_wp_security;
+ $aiowps_firewall_config = AIOS_Firewall_Resource::request(AIOS_Firewall_Resource::CONFIG);
+
+ $blacklisted_ip_addresses = $aio_wp_security->configs->get_value('aiowps_banned_ip_addresses');
+
+ $ip_list_array = AIOWPSecurity_Utility_IP::create_ip_list_array_from_string_with_newline($blacklisted_ip_addresses);
+
+ if (!in_array($ip, $ip_list_array)) {
+ return false;
+ }
+
+ $ip_list_array = array_diff($ip_list_array, array($ip));
+
+ $banned_ip_data = implode("\n", $ip_list_array);
+
+ $aio_wp_security->configs->set_value('aiowps_banned_ip_addresses', $banned_ip_data);
+ $aio_wp_security->configs->save_config();
+
+ $aiowps_firewall_config->set_value('aiowps_blacklist_ips', $ip_list_array);
+
+ return true;
+ }
+
+ /**
+ * Determines if the .htaccess file can be written to.
+ *
+ * This function checks if the current user has the necessary permissions
+ * (is the main site and super admin) and whether the server type is supported
+ * for writing to the .htaccess file. It prevents modifications on unsupported
+ * server types such as Nginx and IIS.
+ *
+ * @return bool True if .htaccess can be written to, false otherwise.
+ */
+ public static function allow_to_write_to_htaccess() {
+ if (!AIOWPSecurity_Utility_Permissions::is_main_site_and_super_admin()) return false;
+ $serverType = self::get_server_type();
+
+ return !in_array($serverType, array('-1', 'nginx', 'iis'));
+ }
+
+ /**
+ * Render the 5G Legacy Tab.
+ *
+ * This function checks if the current site is the main site and if the user is a super admin.
+ * If these conditions are met, it checks whether the 5G firewall is enabled or not.
+ *
+ * @global object $aio_wp_security The global instance of the All-In-One WP Security & Firewall plugin.
+ *
+ * @return bool returns true if the 5G firewall is enabled, false otherwise.
+ */
+ public static function render_5g_legacy_tab() {
+ global $aio_wp_security;
+ if (!AIOWPSecurity_Utility_Permissions::is_main_site_and_super_admin()) return false;
+
+ return '1' == $aio_wp_security->configs->get_value('aiowps_enable_5g_firewall');
+ }
+
+ /**
+ * Filters an array item based on a specified callback key.
+ *
+ * This function checks if a specified callback is present and callable within the array item.
+ * If the callback is callable, it executes the callback and returns the result.
+ * If the callback is set but not callable, it logs an error and returns false.
+ * If no callback is set, the function returns true.
+ *
+ * @param array $item The array item to filter.
+ * @param string $callback_key The key in the array to check for a callable function.
+ *
+ * @return bool|mixed Returns the result of the callback if callable, false if the callback is not callable,
+ * or true if no callback is set.
+ */
+ public static function apply_callback_filter($item, $callback_key) {
+ if (isset($item[$callback_key])) {
+ if (is_callable($item[$callback_key])) {
+ return call_user_func($item[$callback_key]);
+ } else {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- PCP warning. Required for AIOS error reporting.
+ error_log("Callback function set but not callable (coding error)");
+ return false;
+ }
+ } else {
+ return true;
+ }
+ }
+
+ /**
+ * Checks if other specific form-related plugins are active.
+ *
+ * @return bool Returns `true` if any of the specified plugins (bbPress, BuddyPress,
+ * or Contact Form 7) are active, or `false` if none of them are active.
+ */
+ public static function is_other_form_plugins_active() {
+ return self::is_bbpress_plugin_active() || self::is_buddypress_plugin_active() || self::is_contact_form_7_plugin_active();
+ }
+
+ /**
+ * Unserialize data while maintaining compatibility across PHP versions due to different number of arguments required by PHP's "unserialize" function
+ *
+ * @param string $serialized_data Data to be unserialized, should be one that is already serialized
+ * @param boolean|array $allowed_classes Either an array of class names which should be accepted, false to accept no classes, or true to accept all classes
+ * @param integer $max_depth The maximum depth of structures permitted during unserialization, and is intended to prevent stack overflows
+ *
+ * @return mixed Unserialized data can be any of types (integer, float, boolean, string, array or object)
+ */
+ public static function unserialize($serialized_data, $allowed_classes = false, $max_depth = 0) {
+ if (version_compare(PHP_VERSION, '7.0', '<')) {
+ $result = unserialize($serialized_data);
+ } else {
+ $result = unserialize($serialized_data, array('allowed_classes' => $allowed_classes, 'max_depth' => $max_depth)); // phpcs:ignore PHPCompatibility.FunctionUse.NewFunctionParameters.unserialize_optionsFound -- This is the method used to unserialize data instead of the default unserialize method
+ }
+ return $result;
+ }
+
+ /**
+ * Gets the rest route starting with namespace from the REST API endpoint
+ * It excludes rest url prefix 'wp-json' and multisite folder from the endpoint
+ * For example 'wc/store/v1/cart', 'contact-form-7/v1/contact-forms/45/feedback'
+ *
+ * @return string rest route starting with namespace
+ */
+ public static function get_rest_route() {
+ $rest_route = !empty($_GET['rest_route']) ? sanitize_text_field(stripslashes($_GET['rest_route'])) : '';
+ // If route is not found in query parameter, extract from REQUEST_URI
+ if (empty($rest_route)) {
+ $request_uri = !empty($_SERVER['REQUEST_URI']) ? urldecode($_SERVER['REQUEST_URI']) : '';
+ $parsed_url = parse_url(trim($request_uri, '/'));
+ $path = isset($parsed_url['path']) ? $parsed_url['path'] : '';
+ if (false !== strpos($path, rest_get_url_prefix())) {
+ $path = preg_replace('/index\.php\//', '', $path); // index.php from path removed.
+ $rest_route = preg_replace('/(.*)\/?'.rest_get_url_prefix().'\/?/', '', $path); // wp-json rest prefix and multisite folder excluded
+ $rest_route = trim($rest_route, '/');
+ if (empty($rest_route)) $rest_route = '/'; // "wp-json" rest request without name space called.
+ } else {
+ $rest_route = '';
+ }
+ }
+ return $rest_route;
+ }
+
+ /**
+ * Get the registered namespace for REST routes end points 'wc', 'contact-form-7'
+ *
+ * @return array namespace.
+ */
+ public static function get_rest_namespaces() {
+ $rest_server = rest_get_server();
+ $namespaces = $rest_server->get_namespaces();
+ $rest_route_namespaces = array();
+ foreach ($namespaces as $namesapce) {
+ $rest_route_namespaces[] = explode('/', $namesapce)[0]; // Namespace 'wc' only to consider instead 'wc/v1', 'wc/v2', 'wc/v3', 'wc/store'
+ }
+ $route_namespaces = array_unique($rest_route_namespaces);
+ sort($route_namespaces);
+ return $route_namespaces;
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-wp-footer-content.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-wp-footer-content.php
new file mode 100755
index 00000000..97bf1dde
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-wp-footer-content.php
@@ -0,0 +1,57 @@
+configs->get_value('aiowps_enable_woo_login_captcha') || '1' == $aio_wp_security->configs->get_value('aiowps_enable_woo_register_captcha') || '1' == $aio_wp_security->configs->get_value('aiowps_enable_woo_checkout_captcha') || '1' == $aio_wp_security->configs->get_value('aiowps_enable_woo_lostpassword_captcha')) {
+ $aio_wp_security->captcha_obj->print_captcha_api_woo();
+ }
+ }
+
+ // Activate the copy protection feature for non-admin users
+ $copy_protection_active = $aio_wp_security->configs->get_value('aiowps_copy_protection') == '1';
+ if ($copy_protection_active && !AIOWPSecurity_Utility_Permissions::has_manage_cap()) {
+ $this->output_copy_protection_code();
+ }
+
+ //TODO - add other footer output content here
+ }
+
+ public function output_copy_protection_code() {
+ ?>
+
+
+ configs->get_value('aiowps_enable_rename_login_page') == '1') {
+ include_once(AIO_WP_SECURITY_PATH . '/classes/wp-security-process-renamed-login-page.php');
+ new AIOWPSecurity_Process_Renamed_Login_Page();
+ AIOWPSecurity_Process_Renamed_Login_Page::renamed_login_init_tasks();
+ } else {
+ add_action('login_init', array($this, 'aiowps_login_init'));
+ }
+
+ $this->do_lockout_tasks();
+
+ do_action('aiowps_wp_loaded_tasks_end', $this);
+
+ }
+
+ /**
+ * Perform lockout task if it is applicable.
+ *
+ * @return void
+ */
+ private function do_lockout_tasks() {
+ global $aio_wp_security;
+
+ if (1 != $aio_wp_security->configs->get_value('aiowps_site_lockout')) {
+ return;
+ }
+
+ if ('admin-ajax.php' == $GLOBALS['pagenow']) {
+ return;
+ }
+
+ // Show login screen to all non-logged in users.
+ if ('wp-login.php' == $GLOBALS['pagenow']) {
+ return;
+ }
+
+ // WP CLI and cronjob do not required site lockout.
+ if ((defined('DOING_CRON') && DOING_CRON) || 'cli' == PHP_SAPI) {
+ return;
+ }
+
+ // The lockout message should not be displayed to an administrator user.
+ if (is_user_logged_in() && current_user_can('manage_options')) {
+ return;
+ }
+
+ // Non administrator users to lockout accessing admin area.
+ if (is_user_logged_in() && !current_user_can('manage_options') && is_admin()) {
+ wp_redirect(home_url());
+ }
+
+ // Non-logged in users try access admin area, redirect to login page.
+ if (is_admin()) {
+ return;
+ }
+
+ self::site_lockout_tasks();
+ }
+
+ /**
+ * Render lockout output.
+ *
+ * @return void
+ */
+ public static function site_lockout_tasks() {
+ $lockout_output = apply_filters('aiowps_site_lockout_output', '');
+ if (empty($lockout_output)) {
+ nocache_headers();
+ header("HTTP/1.0 503 Service Unavailable");
+ remove_action('wp_head', 'head_addons', 7);
+ $template = apply_filters('aiowps_site_lockout_template_include', AIO_WP_SECURITY_PATH . '/other-includes/wp-security-visitor-lockout-page.php');
+ include_once($template);
+ } else {
+ echo wp_kses_post($lockout_output);
+ }
+
+ exit();
+ }
+
+ public static function aiowps_login_init() {
+ //if user is logged in and tries to access login page - redirect them to wp-admin
+ //this will prevent issues such as the following:
+ //https://wordpress.org/support/topic/already-logged-in-no-captcha
+ if (is_user_logged_in()) {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ $redirect_to = (isset($_REQUEST['redirect_to'])) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : admin_url();
+ wp_safe_redirect($redirect_to);
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- PCP warning. No nonce.
+ } elseif (!(isset($_GET['action']) && 'postpass' == $_GET['action'])) {
+ AIOWPSecurity_Utility_IP::check_login_whitelist_and_forbid();
+ }
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/css/index.html b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/index.html
new file mode 100755
index 00000000..e69de29b
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-admin-styles.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-admin-styles.css
new file mode 100755
index 00000000..4ffeaaa6
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-admin-styles.css
@@ -0,0 +1,1211 @@
+.aio_bold {
+ font-weight: bold;
+}
+
+.aio_half_width {
+ width: 50%;
+}
+
+.aio_one_third_width {
+ width: 33%;
+}
+
+.aio_width_80 {
+ width: 80%;
+}
+
+.aio_max_500 {
+ max-width: 500px;
+}
+
+.aio_spacer_15 {
+ margin-top: 15px;
+}
+
+.aio_spacer_10_tb {
+ margin: 10px 0;
+}
+
+.aio_spacer_10_tblr {
+ margin: 10px;
+}
+
+.aio_clear_float {
+ clear: both;
+}
+
+.aio_float_left {
+ float: left;
+}
+
+.aio_padding_10 {
+ padding: 10px !important;
+}
+
+.aio_section_separator_1 {
+ border-bottom: 1px solid #DEDEDE;
+ height: 10px;
+}
+
+.aiowps_admin_ul_grp1 {
+ list-style: circle;
+ padding: 0 0 0 30px;
+}
+
+.aio_grey_box {
+ margin: 10px 0 15px 0;
+ background-color: #ECECEC;
+ border: 1px solid #CFCFCF;
+ padding: 0 0 0 1em;
+}
+
+.aio_yellow_box {
+ margin: 10px 0 15px 0;
+ background-color: #FFFFE0;
+ border-color: #E6DB55;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 0 0 1em;
+}
+
+.aio_blue_box {
+ margin: 10px 0 15px 0;
+ background-color: #F0F9FF;
+ border-color: #16B;
+ color: #16B;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 0 0 1em;
+ line-height: 20px;
+ overflow-wrap: break-word;
+}
+
+.aio_green_box {
+ margin: 10px 0 15px 0;
+ background-color: #CCF4D6;
+ border-color: #059B53;
+ color: #043B14;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 1em;
+}
+
+.aio_red_box {
+ margin: 10px 0 15px 0;
+ background-color: #FFEBE8;
+ border-color: #C00;
+ color: #333;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 1em;
+}
+
+.aio_orange_box {
+ margin: 10px 0 15px 0;
+ background-color: #FFB900;
+ border-color: #D64500;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 1em;
+}
+
+.aio_success_with_icon {
+ background-image: url("../images/success.png");
+ background-repeat: no-repeat;
+ color: #529901;
+ padding-left: 20px;
+ font-size: 14px;
+}
+
+.aio_error_with_icon {
+ color: #F00;
+ background-image: url("../images/error.png");
+ background-repeat: no-repeat;
+ padding-left: 20px;
+ font-size: 14px;
+}
+
+.aio_info_with_icon {
+ background-image: url("../images/info-icon.png");
+ background-repeat: no-repeat;
+ color: #16B;
+ padding-left: 20px;
+ font-size: 14px;
+}
+
+.file_permission_table {
+ margin: 20px 0;
+}
+
+.file_permission_table thead tr th {
+ background: #CCC;
+}
+
+.file_permission_table td {
+ padding: 7px;
+ font-family: "Courier 10 Pitch",courier,monospace;
+ color: #262626;
+ border-bottom: 1px solid #F2F2F2;
+ border-top: none;
+}
+
+.aio_table_row_red {
+ background-color: #FD6D73;
+}
+
+.aio_table_row_yellow {
+ background-color: #F5E679;
+}
+
+.aio_table_row_green {
+ background-color: #C8F18B;
+}
+
+.aiowps_loading_1 {
+ margin: 0 5px;
+}
+
+.aio_text_area_file_output {
+ background: none repeat scroll 0 0 #F9F9F9;
+ font-family: consolas,monaco,monospace;
+ font-size: 12px;
+ outline: 0 none;
+}
+
+.aiowps_more_info_anchor {
+ display: inline-block;
+ background-color: #D9D9D9;
+ color: #21759B;
+ font: 0.9em/1.455em "Lucida Grande","Lucida Sans Unicode",tahoma,verdana,sans-serif;
+ text-decoration: none;
+ padding: 3px 5px;
+}
+
+.aiowps_more_info_anchor:hover {
+ color: #333;
+ cursor: pointer;
+}
+
+.aiowps_more_info_toggle_char {
+ display: inline-block;
+ margin-right: 3px;
+ padding: 0 3px;
+ text-align: center;
+ background-color: #EDEDED;
+ width: 10px;
+}
+
+.aiowps_more_info_body {
+ margin: 10px 0 15px 0;
+ background-color: #FFFFE0;
+ border-color: #E6DB55;
+ border-radius: 3px;
+ border-style: solid;
+ border-width: 1px;
+ padding: 0 0 0 1em;
+}
+
+.aiowps_dashboard_box_small {
+ float: left;
+ max-width: 350px;
+ margin-right: 15px;
+}
+
+#canvas-holder {
+ width: 300px;
+ margin: auto;
+ padding-top: 20px;
+}
+
+#website-strength-text {
+ text-align: center !important;
+ font-size: 1.5em !important;
+ padding-bottom: 20px !important;
+}
+
+#security_strength_chart_div table {
+ margin-right: auto !important;
+ margin-left: auto !important;
+}
+
+.aiowps_dashboard_widget_footer {
+ background-color: #E6E6E6;
+ padding: 10px;
+}
+
+.aiowps_feature_status_bar {
+ display: block;
+ float: left;
+ width: 120px;
+ height: 26px;
+ position: relative;
+ background: rgba(0, 0, 0, 0.25);
+ border-radius: 3px;
+ -webkit-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.3), 0 1px rgba(255, 255, 255, 0.1); /* phpcs:ignore Squiz.CSS.ForbiddenStyles.FoundWithAlternative -- This is a fallback for older browsers */
+ box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.3), 0 1px rgba(255, 255, 255, 0.1);
+}
+
+.aiowps_feature_status_name {
+ width: 50%;
+ font-weight: bold;
+ float: left;
+ padding: 5px 10px 5px 0;
+}
+
+.aiowps_feature_status_label {
+ display: block;
+ float: left;
+ padding: 4px;
+ text-align: center;
+ width: 52px;
+ color: #F7F7F7;
+ font-weight: bold;
+ text-transform: uppercase;
+}
+
+.aiowps_feature_status_on {
+ color: #043B14;
+ background: #65BD63;
+ border-radius: 3px;
+ background-image: -webkit-linear-gradient(top, #9DD993, #65BD63); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Safari and Chrome */
+ background-image: -moz-linear-gradient(top, #9DD993, #65BD63); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ background-image: -o-linear-gradient(top, #9DD993, #65BD63); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Opera */
+ background-image: linear-gradient(top bottom, #9DD993, #65BD63); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- Previous definitions are for outdated browsers */
+ -webkit-box-shadow: inset 0 1px rgba(255, 255, 255, 0.5), 0 0 2px rgba(0, 0, 0, 0.2); /* phpcs:ignore Squiz.CSS.ForbiddenStyles.FoundWithAlternative -- This is a fallback for older browsers */
+ box-shadow: inset 0 1px rgba(255, 255, 255, 0.5), 0 0 2px rgba(0, 0, 0, 0.2);
+}
+
+.aiowps_feature_status_off {
+ color: #4D0000;
+ background: #BD6363;
+ border-radius: 3px;
+ background-image: -webkit-linear-gradient(top, #D99393, #BD6363); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Safari and Chrome */
+ background-image: -moz-linear-gradient(top, #D99393, #BD6363); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ background-image: -o-linear-gradient(top, #D99393, #BD6363); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Opera */
+ background-image: linear-gradient(top bottom, #D99393, #BD6363); /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- Previous definitions are for outdated browsers */
+ -webkit-box-shadow: inset 0 1px rgba(255, 255, 255, 0.5), 0 0 2px rgba(0, 0, 0, 0.2); /* phpcs:ignore Squiz.CSS.ForbiddenStyles.FoundWithAlternative -- This is a fallback for older browsers */
+ box-shadow: inset 0 1px rgba(255, 255, 255, 0.5), 0 0 2px rgba(0, 0, 0, 0.2);
+}
+
+.aiowps_features_grid {
+ display: grid;
+ grid-template-columns: repeat(auto-fill, minmax(250px, 1fr));
+ grid-gap: 0 10px;
+ margin: 10px 0;
+}
+
+.aiowps_critical_feature_link,
+.aiowps_critical_feature_link:hover {
+ text-decoration: none;
+ color: inherit;
+}
+
+.aiowps_critical_feature_status_container {
+ display: flex;
+ align-items: center;
+ padding: 5px 8px;
+ min-height: 30px;
+ transition: all 0.2s ease;
+}
+
+.aiowps_critical_feature_status_name {
+ flex: 1.5;
+ font-weight: bold;
+ margin-right: 8px;
+}
+
+.aiowps_feature_status_circle {
+ width: 24px;
+ height: 24px;
+ display: flex;
+ justify-content: center;
+ align-items: center;
+ flex: 1;
+}
+
+.aiowps_feature_status_circle_on,
+.aiowps_feature_status_circle_off {
+ width: 16px;
+ height: 16px;
+ border-radius: 50%;
+ transition: transform 0.2s ease;
+}
+
+.aiowps_feature_status_circle_on {
+ background-color: #4CD964;
+}
+
+.aiowps_feature_status_circle_off {
+ background-color: #E4584F;
+}
+
+.aiowps_critical_feature_status_container:hover .aiowps_feature_status_circle_on,
+.aiowps_critical_feature_status_container:hover .aiowps_feature_status_circle_off {
+ transform: scale(1.1);
+}
+
+@media (max-width: 768px) {
+
+ .aiowps_features_grid {
+ grid-template-columns: 1fr;
+ }
+
+}
+
+.aiowps_feature_details_badge {
+ width: 100%;
+ font-size: 14px;
+}
+
+.aiowps_feature_details_badge_difficulty, .aiowps_feature_details_badge_points {
+ display: inline-block;
+ padding: 7px;
+}
+
+.aiowps_feature_details_badge_difficulty {
+ border-top-left-radius: 4px;
+ border-bottom-left-radius: 4px;
+ margin-right: 0;
+ text-shadow: 0 1px 2px rgba(0, 0, 0, 0.4);
+}
+
+.aiowps_feature_details_badge_points {
+ background: #F1F1F1;
+ border-top-right-radius: 4px;
+ border-bottom-right-radius: 4px;
+ margin-left: -3px;
+}
+
+.aiowps_feature_protection_none {
+ background: #6D797A;
+ color: #FFF;
+}
+
+.aiowps_feature_protection_full {
+ background: #5C3682;
+ color: #FFF;
+}
+
+#aiowps_pw_tool_main {
+ padding-top: 10px;
+}
+
+.aiowps_password_tool_field {
+ padding: 20px 0;
+}
+
+#aiowps_password_crack_info_text, #aiowps_password_hibp_info_text {
+ display: none;
+ line-height: 1.16667em;
+ max-width: 40%;
+}
+
+#aiowps_password_crack_time_calculation {
+ line-height: 1.16667em;
+ color: darkorange;
+}
+
+/* bootstrap type labels */
+.aiowps_dashboard_table {
+ table-layout: fixed;
+}
+
+.aiowps-label-danger {
+ background-color: #D9534F;
+}
+
+.aiowps-label-warning {
+ background-color: #F0AD4E;
+}
+
+.aiowps-label-primary {
+ background-color: #337AB7;
+}
+
+.aiowps-label-success {
+ background-color: #5CB85C;
+}
+
+.aiowps-label {
+ border-radius: 0.25em;
+ color: #FFF;
+ display: inline;
+ font-size: 75%;
+ font-weight: 700;
+ line-height: 1;
+ padding: 0.2em 0.6em 0.3em;
+ text-align: center;
+ vertical-align: baseline;
+ white-space: nowrap;
+}
+
+/* Fix for wp list table nav buttons style messed up in 5.1 */
+.tablenav .tablenav-pages .pagination-links a {
+ display: inline-block;
+ padding: 4px 5px 6px 5px;
+ font-size: 16px;
+ line-height: 1;
+ text-align: center;
+ text-decoration: none;
+ min-width: 17px;
+ border: 1px solid #CCC;
+ background: #F7F7F7;
+}
+
+svg > g > g.google-visualization-tooltip {
+ pointer-events: none;
+}
+
+.wp-security_page_aiowpsec_settings h2, .wp-security_page_aiowpsec_settings #poststuff h2 {
+ padding-left: 0;
+}
+
+.aio_hidden {
+ display: none;
+}
+
+/* Fix for WordPress thickbox not respecting the set width and height */
+/* Open issue for 8 years : https://core.trac.wordpress.org/ticket/27473 */
+#TB_ajaxContent {
+ width: 95% !important;
+ height: 95% !important;
+}
+
+.aiowps_switch {
+ position: relative;
+ display: inline-block;
+ width: 38px;
+ height: 18px;
+ margin-right: 6px;
+ box-sizing: border-box;
+}
+
+.aiowps_switch input {
+ opacity: 0;
+ width: 0;
+ height: 0;
+}
+
+.aiowps_switch .aiowps_slider {
+ position: absolute;
+ cursor: pointer;
+ top: 0;
+ left: 0;
+ right: 0;
+ bottom: 0;
+ background-color: #F2F4F5;
+ transition: 0.2s;
+ /* Rounded sliders */
+}
+
+.aiowps_switch .aiowps_slider::before {
+ position: absolute;
+ content: "";
+ height: 8px;
+ width: 8px;
+ left: 2px;
+ bottom: 2px;
+ background-color: #555D66;
+ border: 1px solid #555D66;
+ transition: all 0.2s;
+}
+
+.aiowps_switch .aiowps_slider::after {
+ content: "";
+ display: block;
+ position: absolute;
+ height: 4px;
+ width: 3px;
+ right: 4px;
+ top: 4px;
+ border-radius: 50%;
+ border: 1px solid #72777C;
+ box-sizing: content-box;
+}
+
+.aiowps_switch .aiowps_slider.round {
+ border-radius: 23px;
+ border: 2px solid #555D66;
+}
+
+.aiowps_switch .aiowps_slider.round::before {
+ border-radius: 50%;
+}
+
+.aiowps_switch input:checked + .aiowps_slider {
+ background: #5C3682;
+ border-color: #6F30C9;
+}
+
+.aiowps_switch input:checked + .aiowps_slider::before {
+ background: #FFF;
+ border-color: #FFF;
+ transform: translatex(20px);
+}
+
+.aiowps_switch input:checked + .aiowps_slider::after {
+ content: "";
+ display: block;
+ position: absolute;
+ height: 6px;
+ width: 2px;
+ left: 7px;
+ top: 4px;
+ background: #FFF;
+ border: none;
+}
+
+.aiowps_switch input:disabled + .aiowps_slider,
+.aiowps_switch input:disabled:checked + .aiowps_slider {
+ background: rgba(85, 93, 102, 0.5);
+ border-color: #555D66;
+ opacity: 0.3;
+}
+
+.aiowps_switch input:focus + .aiowps_slider {
+ box-shadow: 0 0 0 2px #F2F4F5, 0 0 0 3px #555D66;
+}
+
+.aiowps_switch input:disabled {
+ display: none;
+ /* Hide default HTML checkbox when it's disabled*/
+}
+
+.aiowps_next_scheduled_scan_wrapper {
+ display: flex;
+ background: #FFF;
+ justify-items: center;
+ flex-wrap: wrap;
+}
+
+.aiowps_next_scheduled_scan_wrapper > div {
+ width: 50%;
+ background: #FFF;
+ height: auto;
+ padding: 33px;
+ box-sizing: border-box;
+}
+
+.aiowps_next_scheduled_entity {
+ width: 50%;
+ display: inline-block;
+ float: left;
+}
+
+.aiowps_next_scheduled_entity .dashicons {
+ color: #CCC;
+ font-size: 20px;
+}
+
+.aiowps_next_scheduled_entity strong {
+ font-size: 20px;
+}
+
+.aiowps_next_scheduled_heading {
+ margin-bottom: 10px;
+}
+
+.aiowps_time_now_wrapper {
+ margin-top: 68px;
+ width: 100%;
+}
+
+.aiowps_time_now_label, .aiowps_time_now {
+ display: inline-block;
+ padding: 7px;
+}
+
+.aiowps_time_now_label {
+ background: #6D797A;
+ border-top-left-radius: 4px;
+ border-bottom-left-radius: 4px;
+ color: #FFF;
+ margin-right: 0;
+ text-shadow: 0 1px 2px rgba(0, 0, 0, 0.4);
+}
+
+.aiowps_time_now {
+ background: #F1F1F1;
+ color: #3C434A;
+ border-top-right-radius: 4px;
+ border-bottom-right-radius: 4px;
+ margin-left: -3px;
+}
+
+.aiowps_scan_btn_wrapper {
+ text-align: center;
+ border-left: 1px solid #F1F1F1;
+ justify-content: center;
+ align-items: center;
+}
+
+.aiowps_scan_btn_wrapper .button-large {
+ font-size: 1.3em !important;
+}
+
+.aiowps_next_scheduled_date_time {
+ color: #46A84B;
+}
+
+#aiowps_activejobs_table {
+ overflow: hidden;
+ width: 100%;
+ background: #FAFAFA;
+ padding: 0;
+}
+
+#aiowps_activejobs_table p {
+ text-align: center;
+}
+
+#aiowps_previous_scan_wrapper {
+ overflow: hidden;
+ width: 100%;
+ background: #FAFAFA;
+ padding: 0;
+}
+
+.aiowps_table_container {
+ max-height: 300px;
+ overflow-y: scroll;
+ margin-top: 20px;
+ border: 1px solid #C3C4C7;
+}
+
+.aiowps_scan_result_table {
+ width: 100%;
+ border: none !important;
+}
+
+.aiowps_scan_result_table_header {
+ position: sticky;
+ top: 0;
+ background-color: #FFF;
+ z-index: 1;
+}
+
+.aiowps_spinner.spinner {
+ padding-left: 25px;
+ float: none;
+}
+
+.aiowps_spinner.spinner.visible {
+ visibility: visible;
+ width: auto;
+}
+
+.button-link.aios-toggle-advanced-options {
+ text-decoration: none;
+}
+
+.button-link.aios-toggle-advanced-options:hover {
+ background-color: #FFF;
+}
+
+.button-link.aios-toggle-advanced-options:focus {
+ background-color: #FFF;
+}
+
+button.button-link.aios-toggle-advanced-options.advanced-options-disabled, button.button-link.aios-toggle-advanced-options.advanced-options-disabled span.dashicons-arrow-down-alt2:before {
+ color: #A7AAAD!important;
+ box-shadow: none!important;
+ cursor: default;
+ transform: none!important;
+}
+
+.aios-toggle-advanced-options {
+ display: block;
+ width: 100%;
+ margin-left: -20px;
+ margin-right: -20px;
+ padding-left: 20px;
+ padding-right: 20px;
+ position: relative;
+ text-decoration: none;
+}
+
+.aios-toggle-advanced-options span.text {
+ background: #FFF;
+ z-index: 1;
+ position: relative;
+ padding-right: 5px;
+}
+
+.aios-toggle-advanced-options span.dashicons {
+ text-decoration: none;
+ font-size: 16px;
+ height: 16px;
+ vertical-align: middle;
+ transition: .2s all;
+ color: #444;
+}
+
+.aios-toggle-advanced-options.opened::before {
+ content: '';
+ border-top: 1px solid #CCC;
+ width: calc(100% + 13px);
+ position: absolute;
+ top: 16px;
+ left: -5px;
+}
+
+.aios-toggle-advanced-options.opened span.dashicons {
+ transform: rotate(180deg);
+}
+
+.aios-toggle-advanced-options.opened .aios-toggle-advanced-options__text-hide {
+ display: inline-block;
+}
+
+.aios-toggle-advanced-options.opened .aios-toggle-advanced-options__text-show {
+ display: none;
+}
+
+.aios-toggle-advanced-options .aios-toggle-advanced-options__text-show {
+ display: inline-block;
+}
+
+.aios-toggle-advanced-options .aios-toggle-advanced-options__text-hide {
+ display: none;
+}
+
+.aios-advanced-options-panel {
+ display: none;
+}
+
+.aios-toggle-advanced-options.opened + div.aios-advanced-options-panel {
+ display: block;
+}
+
+.aios-advanced-options-panel h3 {
+ font-size: 14px;
+ display: inline-block;
+}
+
+.aios-advanced-options-panel span.dashicons.dashicons-editor-help {
+ vertical-align: middle;
+ margin-bottom: 10px;
+}
+
+[data-tooltip] {
+ cursor: pointer;
+ position: relative;
+}
+
+[data-tooltip]:hover[data-tooltip]::before, [data-tooltip]:hover[data-tooltip]::after {
+ visibility: visible;
+ filter: opacity(100);
+ opacity: 1;
+ pointer-events: all;
+}
+
+[data-tooltip]::before, [data-tooltip]::after {
+ visibility: hidden;
+ filter: opacity(0);
+ opacity: 0;
+ pointer-events: none;
+}
+
+[data-tooltip]::before {
+ position: absolute;
+ bottom: 150%;
+ left: 50%;
+ margin-bottom: 5px;
+ margin-left: -110px;
+ padding: 12px;
+ width: 275px;
+ z-index: 9999;
+ border-radius: 3px;
+ background-color: hsla(0,0%,20%,0.95);
+ color: #FFF;
+ content: attr(data-tooltip);
+ text-align: center;
+ font-size: .85rem;
+ font-weight: 400;
+ line-height: 1.4;
+}
+
+[data-tooltip]::after {
+ position: absolute;
+ bottom: 150%;
+ left: 50%;
+ margin-left: -5px;
+ width: 0;
+ border-top: 5px solid hsla(0,0%,20%,0.9);
+ border-right: 5px solid transparent;
+ border-left: 5px solid transparent;
+ content: " ";
+ font-size: 0;
+ line-height: 0;
+}
+
+.dep-warning {
+ background-color: #EED202;
+ padding: 1.2em;
+ margin-right: 20px;
+ margin-left: 20px;
+ margin-top: 10px;
+ line-height: 1.2em;
+ color: #111E2A;
+}
+
+.dep-warning span {
+ vertical-align: middle;
+}
+
+@media only screen and (max-width: 782px) {
+
+ .aiowps_next_scheduled_scan_wrapper > .aiowps_scan_btn_wrapper {
+ padding-top: 0;
+ }
+
+ .aiowps_next_scheduled_scan_wrapper {
+ flex-direction: column;
+ }
+
+ .aiowps_next_scheduled_scan_wrapper > div {
+ width: 100%;
+ }
+
+ #aiowps_manual_fcd_scan {
+ margin: 0;
+ display: block;
+ width: 100%;
+ }
+
+}
+
+@media screen and (max-width: 600px) {
+
+ .aiowps_next_scheduled_entity {
+ float: none;
+ width: 100%;
+ margin-bottom: 2em;
+ }
+
+ .aiowps_time_now_wrapper {
+ margin-top: 0;
+ }
+
+}
+
+.details.column-details {
+ max-height: 100px;
+ overflow-y: auto;
+ overflow-x: hidden;
+ display: block;
+ word-wrap: break-word;
+}
+
+.blockUI.blockOverlay.ui-widget-overlay {
+ background: #000;
+}
+
+.aios_success_popup {
+ text-align: center;
+ padding-bottom: 30px;
+}
+
+.aios_success_popup > .dashicons {
+ font-size: 100px;
+ width: 100px;
+ height: 100px;
+ line-height: 100px;
+ padding: 0;
+ border-radius: 50%;
+ margin-top: 30px;
+ display: block;
+ margin-left: auto;
+ margin-right: auto;
+ background: #E2E6E5;
+}
+
+.aios_success_popup > .dashicons.dashicons-yes {
+ text-indent: -5px;
+}
+
+.aios_success_popup.success > .dashicons {
+ color: #008000;
+}
+
+.aios_success_popup.warning > .dashicons {
+ color: #888;
+}
+
+.aios_success_popup--message {
+ padding: 20px;
+}
+
+.button.aios-close-overlay .dashicons {
+ text-decoration: none;
+ font-size: 20px;
+ margin-left: -5px;
+ padding: 0;
+ transform: translatey(5px);
+}
+
+.aios_saving_popup img {
+ animation-name: aios_blink;
+ animation-duration: 610ms;
+ animation-iteration-count: infinite;
+ animation-direction: alternate;
+ animation-timing-function: ease-out;
+}
+
+.aios-modal-info {
+ text-align: justify;
+ display: inline-block;
+}
+
+@keyframes aios_blink {
+
+ from {
+ opacity: 1;
+ transform: scale(1);
+ }
+
+ to {
+ opacity: 0.4;
+ transform: scale(0.85);
+ }
+
+}
+
+#aios_ajax_moreoptions {
+ max-height: 150px; /* Set the maximum height */
+ overflow-y: auto;
+ overflow-x: hidden;
+ padding: 6px 10px;
+ margin: 4px 16px 6px 16px;
+}
+
+.aios_password_meter {
+ width: 100%;
+}
+
+.aios_meter_bar {
+ width: 40%;
+ background-color: #EEE;
+ border-radius: 10px;
+ overflow: hidden;
+ height: 10px;
+ margin: 10px 10px 0 0;
+}
+
+#aios_meter_fill {
+ height: 100%;
+ width: 0;
+ background-color: #F00;
+ border-radius: 5px;
+ transition: width 0.5s ease-in-out;
+}
+
+#aiowps_password_test {
+ width: 40%;
+}
+
+.simbaotp_qr_container img {
+ border-collapse: collapse;
+ max-width: 150px;
+ width: 100%;
+ max-height: 150px;
+}
+
+.aiowps-postbox-container {
+ display: flex;
+ background: #FFF;
+ border: 1px solid #D3D3D3;
+ padding: 5px;
+}
+
+.aiowps-postbox-container .postbox {
+ border: none;
+ box-shadow: none;
+}
+
+.aiowps-postbox-container h4 {
+ margin: 1em 0;
+ padding: 5px;
+}
+
+.aiowps-postbox-container .aiowps_switch_container .aiowps_more_info_anchor {
+ margin: 10px 0px;
+ display: block;
+ position: relative;
+ width: fit-content;
+}
+
+.aiowps-rule-list {
+ list-style: none;
+ max-height: 450px;
+ overflow-y: auto;
+ padding: 5px;
+ border-top: 0.5px solid #D3D3D3;
+ margin-bottom: 0;
+}
+
+.aiowps-rule-list li {
+ padding: 5px 0px;
+ display: flex;
+ justify-content: space-between;
+ margin-bottom: unset;
+}
+
+.aiowps-rule-list li .aiowps-rule-title {
+ cursor: pointer;
+ padding: 10px 5px;
+ border-radius: 3px;
+ width: 100%;
+}
+
+.aiowps-rule-list li:not(:last-child) {
+ border-bottom: 0.5px solid #D3D3D3;
+}
+
+.aiowps-rule-list li .aiowps-rule-title:hover {
+ background: #F8F9FA;
+}
+
+.aiowps-active .aiowps-rule-title {
+ font-weight: bold;
+ background: #5C3682 !important;
+ color: #FFF !important;
+}
+
+.aiowps-rules {
+ margin-right: 5px;
+ width: 20%;
+ border-right: 1px solid #D3D3D3;
+}
+
+.aiowps-settings {
+ width: 80%;
+}
+
+#aiowps-rule-search {
+ position: relative;
+ display: flex;
+ align-items: center;
+}
+
+#aiowps-rule-search .aiowps-search {
+ flex: 1;
+ background-image: none;
+ position: relative;
+ padding-right: 25px;
+ padding-left: 25px;
+ display: inline-flex;
+ align-items: center;
+ align-items: -moz-center; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ -webkit-align-items: center;
+ width: fill-available;
+ width: -webkit-fill-available; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Safari & Chrome */
+ width: -moz-available; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ max-width: fill-available;
+ max-width: -webkit-fill-available; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Safari & Chrome */
+ max-width: -moz-available; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ margin-right: 5px;
+}
+
+#aiowps-rule-search .dashicons-search {
+ font-family: dashicons;
+ font-size: 18px;
+ line-height: 1;
+ font-weight: 400;
+ font-style: normal;
+ display: inline-block;
+ text-transform: none;
+ text-rendering: auto;
+ -webkit-font-smoothing: antialiased;
+ -moz-osx-font-smoothing: grayscale;
+ position: absolute;
+ vertical-align: middle;
+ margin-right: 5px;
+ top: 50%;
+ left: 5px;
+ z-index: 999;
+ transform: translatey(-50%);
+}
+
+#aiowps-rule-search .clear-search {
+ position: absolute;
+ right: 10px;
+ top: 50%;
+ transform: translatey(-50%);
+ cursor: pointer;
+}
+
+#aiowps-rule-search .clear-search:hover {
+ color: #000;
+}
+
+.aiowps-actions {
+ background: #FFF;
+ min-height: 60px;
+ margin-top: 0px;
+ border: 1px solid #D3D3D3;
+ border-top: none;
+ align-content: center;
+ padding-right: 15px;
+ text-align: right;
+ text-align: -webkit-right; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Safari & Chrome */
+ text-align: -moz-right; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- For Mozilla */
+ justify-content: end;
+ align-items: center;
+ display: flex;
+}
+
+@media only screen and (max-width: 768px) {
+
+ .aiowps-postbox-container {
+ flex-direction: column;
+ }
+
+ .aiowps-settings {
+ width: 100%;
+ }
+
+ .aiowps-rules {
+ width: 100%;
+ margin-bottom: 10px;
+ border-right: none;
+ border-bottom: 1px solid #D3D3D3;
+ }
+
+ .aiowps-rule-list {
+ max-height: 390px;
+ }
+
+}
+
+#simba-tfa-admin-wrapper form {
+ padding: 10px;
+ position: relative;
+ min-width: 255px;
+ border: 1px solid #C3C4C7;
+ box-shadow: 0 1px 1px rgba(0, 0, 0, .04);
+ background: #FFF;
+}
+
+.aios-data-table {
+ border-collapse: collapse;
+ width: 100%;
+}
+
+.aios-data-table td, .aios-data-table th {
+ border: 1px solid #DDD;
+ padding: 8px;
+}
+
+.aios-data-table tr:nth-child(even) {
+ background-color: #F2F2F2;
+}
+
+.aios-data-table tr:hover {
+ background-color: #DDD;
+}
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-notices.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-notices.css
new file mode 100755
index 00000000..88a6e74d
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-notices.css
@@ -0,0 +1,121 @@
+/* CSS for adverts */
+
+.aiowps_notice_container {
+ height: auto;
+ overflow: hidden;
+}
+
+.aiowps_review_notice_container {
+ padding: 12px;
+ display: flex;
+}
+
+.aiowps_advert_button_container {
+ margin-bottom: 10px;
+ display: flex;
+ align-items: center;
+}
+
+.aiowps_advert_button_container .dashicons {
+ margin-left: 10px;
+}
+
+.aiowps_advert_content_left {
+ float: none;
+ width: 65px;
+ padding-top: 9px;
+ margin-right: 9px;
+}
+
+.aiowps_advert_content_left_extra {
+ float: none;
+ width: 100px;
+ padding-right: 15px;
+ display: flex;
+ align-items: center;
+}
+
+.updraft_advert_content_left img {
+ min-height: 72px;
+ min-width: 72px;
+}
+
+.aiowps_advert_content_right {
+ float: none;
+ width: auto;
+ overflow: hidden;
+ font-size: 16px;
+}
+
+.updraft_advert_content_right p {
+ font-size: 16px !important;
+}
+
+.aiowps_advert_bottom {
+ margin: 10px 0;
+ padding: 10px;
+ font-size: 140%;
+ background-color: rgb(255, 255, 255);
+ border-color: #E6DB55;
+ border: 1px solid;
+ border-radius: 4px;
+}
+
+.aiowps_advert_dismiss {
+ float: right;
+ font-size: 13px;
+ font-weight: normal;
+}
+
+h3.aiowps_advert_heading {
+ margin-top: 5px !important;
+ margin-bottom: 5px !important;
+}
+
+h4.aiowps_advert_heading {
+ margin-top: 2px !important;
+ margin-bottom: 3px !important;
+}
+
+.aiowps_center_content {
+ text-align: center;
+ margin-bottom: 5px;
+}
+
+.aiowps_text_center {
+ text-align: center;
+}
+
+#aiowps-dashnotice #aiowps-dashnotice_wrapper ul {
+ list-style: disc inside;
+ text-indent: -18px;
+ margin-left: 18px;
+}
+
+@media screen and (min-width: 560px) {
+
+ .aiowps_advert_content_left, .aiowps_advert_content_left_extra {
+ float: left;
+ }
+
+}
+
+#aiowps-notice-logo {
+ border: 0;
+ float: right;
+ width: 150px;
+ height: auto;
+ margin-right: 10px;
+ margin-top: 10px;
+}
+
+@media (min-width: 768px) {
+
+ #aiowps-notice-logo {
+ width: 250px;
+ height: auto;
+ margin-right: 40px;
+ margin-top: 40px;
+ }
+
+}
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-premium-upgrade.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-premium-upgrade.css
new file mode 100755
index 00000000..afc9b5d8
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-premium-upgrade.css
@@ -0,0 +1,241 @@
+.aiowps_col {
+ display: block;
+ float: left;
+ margin: 1% 0 1% 1%;
+}
+
+.aiowps_col:first-child {
+ margin-left: 0;
+}
+
+.aiowps_half_width {
+ width: 48%;
+}
+
+@media screen and (max-width: 768px) {
+
+ .aiowps_col {
+ margin: 1% 0;
+ }
+
+ .aiowps_half_width {
+ width: 100%;
+ }
+
+}
+
+img.addons {
+ display: block;
+ margin-left: auto;
+ margin-right: auto;
+ margin-bottom: 20px;
+ max-width: 40%;
+ max-height: 100%;
+}
+
+.postbox.aiowps-tab-postbox {
+ padding: 25px;
+}
+
+.aiowps-plugin-family__plugins {
+ display: -ms-flexbox;
+ display: flex; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- first definition is for IE */
+ -ms-flex-wrap: wrap;
+ flex-wrap: wrap;
+ padding-left: 1px;
+ padding-bottom: 1px;
+}
+
+.aiowps-plugin-family__plugin {
+ -ms-flex: auto;
+ flex: auto;
+ width: 100%;
+ padding: 30px;
+ box-sizing: border-box;
+ border: 1px solid #E3E4E7;
+ margin-left: -1px;
+ margin-bottom: -1px;
+}
+
+@media (min-width: 782px) {
+
+ .aiowps-plugin-family__plugin {
+ width: 50%;
+ }
+
+ .aiowps-plugin-family__free .aiowps-plugin-family__plugin {
+ width: 100%;
+ }
+
+}
+
+@media (max-width: 1300px) {
+
+ .aiowps-plugin-family__free .aiowps-plugin-family__plugin {
+ width: 50%;
+ }
+
+}
+
+@media (max-width: 782px) {
+
+ .aiowps-plugin-family__free .aiowps-plugin-family__plugin {
+ width: 100%;
+ }
+
+}
+
+.aiowps_feature_cont {
+ width: 64.5%;
+}
+
+.aiowps_plugin_family_cont {
+ width: 34.5%;
+}
+
+@media (max-width: 1300px) {
+
+ .aiowps_feature_cont,
+ .aiowps_plugin_family_cont {
+ width: 100%;
+ float: none;
+ margin: 0;
+ }
+
+}
+
+.aiowps_feature_cont header,
+.aiowps_plugin_family_cont header {
+ padding: 20px;
+}
+
+@media (max-width: 1300px) {
+
+ .aiowps_feature_cont header,
+ .aiowps_plugin_family_cont header {
+ padding: 40px;
+ }
+
+}
+
+.aiowps_feature_cont header p,
+.aiowps_plugin_family_cont header p {
+ margin-bottom: 0;
+}
+
+.aiowps_feat_table,
+.aiowps_feat_table td {
+ border: 0;
+ border-collapse: collapse;
+ background-color: #FFF;
+ font-size: 120%;
+ text-align: center;
+}
+
+.aiowps_feat_table td {
+ border: 1px solid #F1F1F1;
+ border-bottom-width: 4px;
+ padding: 15px;
+}
+
+.aiowps_feat_table td:nth-child(2),
+.aiowps_feat_table td:nth-child(3) {
+ background: rgba(241, 241, 241, 0.38);
+}
+
+.aiowps_feat_table p {
+ padding: 0 10px;
+ margin: 5px 0;
+ font-size: 13px;
+}
+
+.aiowps_feat_table h4 {
+ padding-left: 10px;
+ margin: 5px 0;
+}
+
+.aiowps_feat_table .dashicons {
+ width: 25px;
+ height: 25px;
+ font-size: 25px;
+ line-height: 1;
+}
+
+.aiowps_feat_table .dashicons-yes {
+ color: #008000;
+}
+
+.aiowps_feat_table .dashicons-no-alt {
+ color: #FD0000;
+}
+
+.aiowps_feat_table tr td.aiowps-feature-text {
+ text-align: left;
+}
+
+.aiowps_feat_table tr.aiowps-main-feature-row td {
+ background: #F1F1F1;
+ border-bottom-color: #FAFAFA;
+}
+
+.aiowps-premium-image {
+ display: none;
+}
+
+@media screen and (min-width: 720px) {
+
+ .aiowps-premium-image {
+ display: block;
+ float: left;
+ padding: 16px 18px;
+ width: 64px;
+ height: auto;
+ }
+
+}
+
+@media screen and (min-width: 1220px) {
+
+ .aiowps_feat_table td:nth-child(2),
+ .aiowps_feat_table td:nth-child(3) {
+ width: 110px;
+ }
+
+}
+
+.other-plugin-title {
+ text-decoration: none;
+}
+
+@media screen and (max-width: 782px) {
+
+ table.aiowps_feat_table {
+ display: block;
+ }
+
+ table.aiowps_feat_table tr {
+ display: -ms-flexbox;
+ display: flex; /* phpcs:ignore Squiz.CSS.DuplicateStyleDefinition.Found -- first definition is for IE */
+ -ms-flex-wrap: wrap;
+ flex-wrap: wrap;
+ }
+
+ table.aiowps_feat_table td {
+ display: block;
+ }
+
+ table.aiowps_feat_table td:first-child {
+ width: 100%;
+ border-bottom: 0;
+ }
+
+ table.aiowps_feat_table td:not(:first-child) {
+ width: 50%;
+ box-sizing: border-box;
+ }
+
+ table.aiowps_feat_table td:first-child:empty {
+ display: none;
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-site-lockout-page.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-site-lockout-page.css
new file mode 100755
index 00000000..05c07768
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/css/wp-security-site-lockout-page.css
@@ -0,0 +1,20 @@
+body {
+ background-color: #404040 !important;
+}
+
+.aiowps-site-lockout-box {
+ margin-right: auto;
+ margin-left: auto;
+ max-width: 800px;
+ margin-top: 100px;
+ padding: 30px;
+ border: 2px solid #FFE20A;
+}
+
+.aiowps-site-lockout-msg {
+ color: #FFE20A;
+ font-size: 48px;
+ font-weight: bold;
+ text-align: center;
+}
+
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/aios-plugin-icon.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/aios-plugin-icon.svg
new file mode 100755
index 00000000..b10e4032
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/aios-plugin-icon.svg
@@ -0,0 +1,8 @@
+
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/error.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/error.png
new file mode 100755
index 00000000..cf4526e8
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/error.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/index.html b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/index.html
new file mode 100755
index 00000000..e69de29b
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/info-icon.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/info-icon.png
new file mode 100755
index 00000000..40d49cdb
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/info-icon.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/loading.gif b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/loading.gif
new file mode 100755
index 00000000..5b33f7e5
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/loading.gif differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/black_friday.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/black_friday.png
new file mode 100755
index 00000000..96beec18
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/black_friday.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/new_year.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/new_year.png
new file mode 100755
index 00000000..88c14921
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/new_year.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_20.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_20.png
new file mode 100755
index 00000000..8c30ddc8
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_20.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_blackfriday.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_blackfriday.png
new file mode 100755
index 00000000..36915c17
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_blackfriday.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_collection.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_collection.png
new file mode 100755
index 00000000..d89d0f88
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_collection.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_newyear.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_newyear.png
new file mode 100755
index 00000000..30abfbc5
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_newyear.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_spring.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_spring.png
new file mode 100755
index 00000000..aadb99c9
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_spring.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_summer.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_summer.png
new file mode 100755
index 00000000..aaf73f29
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/sale_summer.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/spring.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/spring.png
new file mode 100755
index 00000000..59f50d7c
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/spring.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/summer.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/summer.png
new file mode 100755
index 00000000..b66dfb78
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/notices/summer.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon.png
new file mode 100755
index 00000000..932f1299
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon2.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon2.png
new file mode 100755
index 00000000..f3bec023
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-icon2.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-icon.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-icon.png
new file mode 100755
index 00000000..dd698a64
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-icon.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-logo.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-logo.png
new file mode 100755
index 00000000..56faf020
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-logo.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-premium.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-premium.png
new file mode 100755
index 00000000..1dcc19c4
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios-premium.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios_logo_wide.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios_logo_wide.svg
new file mode 100755
index 00000000..124f34c4
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/aios_logo_wide.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.png
new file mode 100755
index 00000000..198079d0
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.svg
new file mode 100755
index 00000000..a54510aa
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/easy-updates-manager-logo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/icon-aios-rgb.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/icon-aios-rgb.svg
new file mode 100755
index 00000000..ba055857
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/icon-aios-rgb.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.png
new file mode 100755
index 00000000..255cce64
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.svg
new file mode 100755
index 00000000..bde039fc
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/internal-link-juicer-logo-sm.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft-central.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft-central.png
new file mode 100755
index 00000000..6925087c
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft-central.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft_logo.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft_logo.png
new file mode 100755
index 00000000..da85de5c
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraft_logo.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftcentral-logo.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftcentral-logo.svg
new file mode 100755
index 00000000..09039972
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftcentral-logo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus-icon.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus-icon.png
new file mode 100755
index 00000000..068071df
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus-icon.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.png
new file mode 100755
index 00000000..f4b4ceae
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.svg
new file mode 100755
index 00000000..d7f9e00a
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/updraftplus_logo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize-icon.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize-icon.png
new file mode 100755
index 00000000..d3bbb85c
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize-icon.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.png
new file mode 100755
index 00000000..5f2ee981
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.svg b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.svg
new file mode 100755
index 00000000..4f23a1a1
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-optimize.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-overnight-sm.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-overnight-sm.png
new file mode 100755
index 00000000..55151984
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wp-overnight-sm.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wpgetapi-sm.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wpgetapi-sm.png
new file mode 100755
index 00000000..75bbee3c
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/plugin-logos/wpgetapi-sm.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-info-icon-36.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-info-icon-36.png
new file mode 100755
index 00000000..cb2fc9a0
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-info-icon-36.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-security-icon-36.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-security-icon-36.png
new file mode 100755
index 00000000..1b81dc21
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/shield-security-icon-36.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/success.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/success.png
new file mode 100755
index 00000000..6bd8724f
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/success.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/images/ud_smile.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/ud_smile.png
new file mode 100755
index 00000000..894ee002
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/images/ud_smile.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/blockui/jquery.blockUI.js b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/blockui/jquery.blockUI.js
new file mode 100755
index 00000000..475d1370
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/blockui/jquery.blockUI.js
@@ -0,0 +1,620 @@
+/*!
+ * jQuery blockUI plugin
+ * Version 2.70.0-2014.11.23
+ * Requires jQuery v1.7 or later
+ *
+ * Examples at: http://malsup.com/jquery/block/
+ * Copyright (c) 2007-2013 M. Alsup
+ * Dual licensed under the MIT and GPL licenses:
+ * http://www.opensource.org/licenses/mit-license.php
+ * http://www.gnu.org/licenses/gpl.html
+ *
+ * Thanks to Amir-Hossein Sobhi for some excellent contributions!
+ */
+
+;(function() {
+/*jshint eqeqeq:false curly:false latedef:false */
+"use strict";
+
+ function setup($) {
+ $.fn._fadeIn = $.fn.fadeIn;
+
+ var noOp = $.noop || function() {};
+
+ // this bit is to ensure we don't call setExpression when we shouldn't (with extra muscle to handle
+ // confusing userAgent strings on Vista)
+ var msie = /MSIE/.test(navigator.userAgent);
+ var ie6 = /MSIE 6.0/.test(navigator.userAgent) && ! /MSIE 8.0/.test(navigator.userAgent);
+ var mode = document.documentMode || 0;
+ var setExpr = $.isFunction( document.createElement('div').style.setExpression );
+
+ // global $ methods for blocking/unblocking the entire page
+ $.blockUI = function(opts) { install(window, opts); };
+ $.unblockUI = function(opts) { remove(window, opts); };
+
+ // convenience method for quick growl-like notifications (http://www.google.com/search?q=growl)
+ $.growlUI = function(title, message, timeout, onClose) {
+ var $m = $('');
+ if (title) $m.append('' . esc_html__('The plugin has detected that you are using a Multi-Site WordPress installation.', 'all-in-one-wp-security-and-firewall') . '
+' . esc_html__('Some features on this page can only be configured by the "superadmin".', 'all-in-one-wp-security-and-firewall') . '
'; + echo ''+title+'
'); + if (message) $m.append(''+message+'
'); + if (timeout === undefined) timeout = 3000; + + // Added by konapun: Set timeout to 30 seconds if this growl is moused over, like normal toast notifications + var callBlock = function(opts) { + opts = opts || {}; + + $.blockUI({ + message: $m, + fadeIn : typeof opts.fadeIn !== 'undefined' ? opts.fadeIn : 700, + fadeOut: typeof opts.fadeOut !== 'undefined' ? opts.fadeOut : 1000, + timeout: typeof opts.timeout !== 'undefined' ? opts.timeout : timeout, + centerY: false, + showOverlay: false, + onUnblock: onClose, + css: $.blockUI.defaults.growlCSS + }); + }; + + callBlock(); + var nonmousedOpacity = $m.css('opacity'); + $m.mouseover(function() { + callBlock({ + fadeIn: 0, + timeout: 30000 + }); + + var displayBlock = $('.blockMsg'); + displayBlock.stop(); // cancel fadeout if it has started + displayBlock.fadeTo(300, 1); // make it easier to read the message by removing transparency + }).mouseout(function() { + $('.blockMsg').fadeOut(1000); + }); + // End konapun additions + }; + + // plugin method for blocking element content + $.fn.block = function(opts) { + if ( this[0] === window ) { + $.blockUI( opts ); + return this; + } + var fullOpts = $.extend({}, $.blockUI.defaults, opts || {}); + this.each(function() { + var $el = $(this); + if (fullOpts.ignoreIfBlocked && $el.data('blockUI.isBlocked')) + return; + $el.unblock({ fadeOut: 0 }); + }); + + return this.each(function() { + if ($.css(this,'position') == 'static') { + this.style.position = 'relative'; + $(this).data('blockUI.static', true); + } + this.style.zoom = 1; // force 'hasLayout' in ie + install(this, opts); + }); + }; + + // plugin method for unblocking element content + $.fn.unblock = function(opts) { + if ( this[0] === window ) { + $.unblockUI( opts ); + return this; + } + return this.each(function() { + remove(this, opts); + }); + }; + + $.blockUI.version = 2.70; // 2nd generation blocking at no extra cost! + + // override these in your code to change the default behavior and style + $.blockUI.defaults = { + // message displayed when blocking (use null for no message) + message: 'Please wait...
', + + title: null, // title string; only used when theme == true + draggable: true, // only used when theme == true (requires jquery-ui.js to be loaded) + + theme: false, // set to true to use with jQuery UI themes + + // styles for the message when blocking; if you wish to disable + // these and use an external stylesheet then do this in your code: + // $.blockUI.defaults.css = {}; + css: { + padding: 0, + margin: 0, + width: '30%', + top: '40%', + left: '35%', + textAlign: 'center', + color: '#000', + border: '3px solid #aaa', + backgroundColor:'#fff', + cursor: 'wait' + }, + + // minimal style set used when themes are used + themedCSS: { + width: '30%', + top: '40%', + left: '35%' + }, + + // styles for the overlay + overlayCSS: { + backgroundColor: '#000', + opacity: 0.6, + cursor: 'wait' + }, + + // style to replace wait cursor before unblocking to correct issue + // of lingering wait cursor + cursorReset: 'default', + + // styles applied when using $.growlUI + growlCSS: { + width: '350px', + top: '10px', + left: '', + right: '10px', + border: 'none', + padding: '5px', + opacity: 0.6, + cursor: 'default', + color: '#fff', + backgroundColor: '#000', + '-webkit-border-radius':'10px', + '-moz-border-radius': '10px', + 'border-radius': '10px' + }, + + // IE issues: 'about:blank' fails on HTTPS and javascript:false is s-l-o-w + // (hat tip to Jorge H. N. de Vasconcelos) + /*jshint scripturl:true */ + iframeSrc: /^https/i.test(window.location.href || '') ? 'javascript:false' : 'about:blank', + + // force usage of iframe in non-IE browsers (handy for blocking applets) + forceIframe: false, + + // z-index for the blocking overlay + baseZ: 1000, + + // set these to true to have the message automatically centered + centerX: true, // <-- only effects element blocking (page block controlled via css above) + centerY: true, + + // allow body element to be stetched in ie6; this makes blocking look better + // on "short" pages. disable if you wish to prevent changes to the body height + allowBodyStretch: true, + + // enable if you want key and mouse events to be disabled for content that is blocked + bindEvents: true, + + // be default blockUI will supress tab navigation from leaving blocking content + // (if bindEvents is true) + constrainTabKey: true, + + // fadeIn time in millis; set to 0 to disable fadeIn on block + fadeIn: 200, + + // fadeOut time in millis; set to 0 to disable fadeOut on unblock + fadeOut: 400, + + // time in millis to wait before auto-unblocking; set to 0 to disable auto-unblock + timeout: 0, + + // disable if you don't want to show the overlay + showOverlay: true, + + // if true, focus will be placed in the first available input field when + // page blocking + focusInput: true, + + // elements that can receive focus + focusableElements: ':input:enabled:visible', + + // suppresses the use of overlay styles on FF/Linux (due to performance issues with opacity) + // no longer needed in 2012 + // applyPlatformOpacityRules: true, + + // callback method invoked when fadeIn has completed and blocking message is visible + onBlock: null, + + // callback method invoked when unblocking has completed; the callback is + // passed the element that has been unblocked (which is the window object for page + // blocks) and the options that were passed to the unblock call: + // onUnblock(element, options) + onUnblock: null, + + // callback method invoked when the overlay area is clicked. + // setting this will turn the cursor to a pointer, otherwise cursor defined in overlayCss will be used. + onOverlayClick: null, + + // don't ask; if you really must know: http://groups.google.com/group/jquery-en/browse_thread/thread/36640a8730503595/2f6a79a77a78e493#2f6a79a77a78e493 + quirksmodeOffsetHack: 4, + + // class name of the message block + blockMsgClass: 'blockMsg', + + // if it is already blocked, then ignore it (don't unblock and reblock) + ignoreIfBlocked: false + }; + + // private data and functions follow... + + var pageBlock = null; + var pageBlockEls = []; + + function install(el, opts) { + var css, themedCSS; + var full = (el == window); + var msg = (opts && opts.message !== undefined ? opts.message : undefined); + opts = $.extend({}, $.blockUI.defaults, opts || {}); + + if (opts.ignoreIfBlocked && $(el).data('blockUI.isBlocked')) + return; + + opts.overlayCSS = $.extend({}, $.blockUI.defaults.overlayCSS, opts.overlayCSS || {}); + css = $.extend({}, $.blockUI.defaults.css, opts.css || {}); + if (opts.onOverlayClick) + opts.overlayCSS.cursor = 'pointer'; + + themedCSS = $.extend({}, $.blockUI.defaults.themedCSS, opts.themedCSS || {}); + msg = msg === undefined ? opts.message : msg; + + // remove the current block (if there is one) + if (full && pageBlock) + remove(window, {fadeOut:0}); + + // if an existing element is being used as the blocking content then we capture + // its current place in the DOM (and current display style) so we can restore + // it when we unblock + if (msg && typeof msg != 'string' && (msg.parentNode || msg.jquery)) { + var node = msg.jquery ? msg[0] : msg; + var data = {}; + $(el).data('blockUI.history', data); + data.el = node; + data.parent = node.parentNode; + data.display = node.style.display; + data.position = node.style.position; + if (data.parent) + data.parent.removeChild(node); + } + + $(el).data('blockUI.onUnblock', opts.onUnblock); + var z = opts.baseZ; + + // blockUI uses 3 layers for blocking, for simplicity they are all used on every platform; + // layer1 is the iframe layer which is used to supress bleed through of underlying content + // layer2 is the overlay layer which has opacity and a wait cursor (by default) + // layer3 is the message content that is displayed while blocking + var lyr1, lyr2, lyr3, s; + if (msie || opts.forceIframe) + lyr1 = $(''); + else + lyr1 = $(''); + + if (opts.theme) + lyr2 = $(''); + else + lyr2 = $(''); + + if (opts.theme && full) { + s = ''; + } + else if (opts.theme) { + s = ''; + } + else if (full) { + s = ''; + } + else { + s = ''; + } + lyr3 = $(s); + + // if we have a message, style it + if (msg) { + if (opts.theme) { + lyr3.css(themedCSS); + lyr3.addClass('ui-widget-content'); + } + else + lyr3.css(css); + } + + // style the overlay + if (!opts.theme /*&& (!opts.applyPlatformOpacityRules)*/) + lyr2.css(opts.overlayCSS); + lyr2.css('position', full ? 'fixed' : 'absolute'); + + // make iframe layer transparent in IE + if (msie || opts.forceIframe) + lyr1.css('opacity',0.0); + + //$([lyr1[0],lyr2[0],lyr3[0]]).appendTo(full ? 'body' : el); + var layers = [lyr1,lyr2,lyr3], $par = full ? $('body') : $(el); + $.each(layers, function() { + this.appendTo($par); + }); + + if (opts.theme && opts.draggable && $.fn.draggable) { + lyr3.draggable({ + handle: '.ui-dialog-titlebar', + cancel: 'li' + }); + } + + // ie7 must use absolute positioning in quirks mode and to account for activex issues (when scrolling) + var expr = setExpr && (!$.support.boxModel || $('object,embed', full ? null : el).length > 0); + if (ie6 || expr) { + // give body 100% height + if (full && opts.allowBodyStretch && $.support.boxModel) + $('html,body').css('height','100%'); + + // fix ie6 issue when blocked element has a border width + if ((ie6 || !$.support.boxModel) && !full) { + var t = sz(el,'borderTopWidth'), l = sz(el,'borderLeftWidth'); + var fixT = t ? '(0 - '+t+')' : 0; + var fixL = l ? '(0 - '+l+')' : 0; + } + + // simulate fixed position + $.each(layers, function(i,o) { + var s = o[0].style; + s.position = 'absolute'; + if (i < 2) { + if (full) + s.setExpression('height','Math.max(document.body.scrollHeight, document.body.offsetHeight) - (jQuery.support.boxModel?0:'+opts.quirksmodeOffsetHack+') + "px"'); + else + s.setExpression('height','this.parentNode.offsetHeight + "px"'); + if (full) + s.setExpression('width','jQuery.support.boxModel && document.documentElement.clientWidth || document.body.clientWidth + "px"'); + else + s.setExpression('width','this.parentNode.offsetWidth + "px"'); + if (fixL) s.setExpression('left', fixL); + if (fixT) s.setExpression('top', fixT); + } + else if (opts.centerY) { + if (full) s.setExpression('top','(document.documentElement.clientHeight || document.body.clientHeight) / 2 - (this.offsetHeight / 2) + (blah = document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + "px"'); + s.marginTop = 0; + } + else if (!opts.centerY && full) { + var top = (opts.css && opts.css.top) ? parseInt(opts.css.top, 10) : 0; + var expression = '((document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + '+top+') + "px"'; + s.setExpression('top',expression); + } + }); + } + + // show the message + if (msg) { + if (opts.theme) + lyr3.find('.ui-widget-content').append(msg); + else + lyr3.append(msg); + if (msg.jquery || msg.nodeType) + $(msg).show(); + } + + if ((msie || opts.forceIframe) && opts.showOverlay) + lyr1.show(); // opacity is zero + if (opts.fadeIn) { + var cb = opts.onBlock ? opts.onBlock : noOp; + var cb1 = (opts.showOverlay && !msg) ? cb : noOp; + var cb2 = msg ? cb : noOp; + if (opts.showOverlay) + lyr2._fadeIn(opts.fadeIn, cb1); + if (msg) + lyr3._fadeIn(opts.fadeIn, cb2); + } + else { + if (opts.showOverlay) + lyr2.show(); + if (msg) + lyr3.show(); + if (opts.onBlock) + opts.onBlock.bind(lyr3)(); + } + + // bind key and mouse events + bind(1, el, opts); + + if (full) { + pageBlock = lyr3[0]; + pageBlockEls = $(opts.focusableElements,pageBlock); + if (opts.focusInput) + setTimeout(focus, 20); + } + else + center(lyr3[0], opts.centerX, opts.centerY); + + if (opts.timeout) { + // auto-unblock + var to = setTimeout(function() { + if (full) + $.unblockUI(opts); + else + $(el).unblock(opts); + }, opts.timeout); + $(el).data('blockUI.timeout', to); + } + } + + // remove the block + function remove(el, opts) { + var count; + var full = (el == window); + var $el = $(el); + var data = $el.data('blockUI.history'); + var to = $el.data('blockUI.timeout'); + if (to) { + clearTimeout(to); + $el.removeData('blockUI.timeout'); + } + opts = $.extend({}, $.blockUI.defaults, opts || {}); + bind(0, el, opts); // unbind events + + if (opts.onUnblock === null) { + opts.onUnblock = $el.data('blockUI.onUnblock'); + $el.removeData('blockUI.onUnblock'); + } + + var els; + if (full) // crazy selector to handle odd field errors in ie6/7 + els = $('body').children().filter('.blockUI').add('body > .blockUI'); + else + els = $el.find('>.blockUI'); + + // fix cursor issue + if ( opts.cursorReset ) { + if ( els.length > 1 ) + els[1].style.cursor = opts.cursorReset; + if ( els.length > 2 ) + els[2].style.cursor = opts.cursorReset; + } + + if (full) + pageBlock = pageBlockEls = null; + + if (opts.fadeOut) { + count = els.length; + els.stop().fadeOut(opts.fadeOut, function() { + if ( --count === 0) + reset(els,data,opts,el); + }); + } + else + reset(els, data, opts, el); + } + + // move blocking element back into the DOM where it started + function reset(els,data,opts,el) { + var $el = $(el); + if ( $el.data('blockUI.isBlocked') ) + return; + + els.each(function(i,o) { + // remove via DOM calls so we don't lose event handlers + if (this.parentNode) + this.parentNode.removeChild(this); + }); + + if (data && data.el) { + data.el.style.display = data.display; + data.el.style.position = data.position; + data.el.style.cursor = 'default'; // #59 + if (data.parent) + data.parent.appendChild(data.el); + $el.removeData('blockUI.history'); + } + + if ($el.data('blockUI.static')) { + $el.css('position', 'static'); // #22 + } + + if (typeof opts.onUnblock == 'function') + opts.onUnblock(el,opts); + + // fix issue in Safari 6 where block artifacts remain until reflow + var body = $(document.body), w = body.width(), cssW = body[0].style.width; + body.width(w-1).width(w); + body[0].style.width = cssW; + } + + // bind/unbind the handler + function bind(b, el, opts) { + var full = el == window, $el = $(el); + + // don't bother unbinding if there is nothing to unbind + if (!b && (full && !pageBlock || !full && !$el.data('blockUI.isBlocked'))) + return; + + $el.data('blockUI.isBlocked', b); + + // don't bind events when overlay is not in use or if bindEvents is false + if (!full || !opts.bindEvents || (b && !opts.showOverlay)) + return; + + // bind anchors and inputs for mouse and key events + var events = 'mousedown mouseup keydown keypress keyup touchstart touchend touchmove'; + if (b) + $(document).bind(events, opts, handler); + else + $(document).unbind(events, handler); + + // former impl... + // var $e = $('a,:input'); + // b ? $e.bind(events, opts, handler) : $e.unbind(events, handler); + } + + // event handler to suppress keyboard/mouse events when blocking + function handler(e) { + // allow tab navigation (conditionally) + if (e.type === 'keydown' && e.keyCode && e.keyCode == 9) { + if (pageBlock && e.data.constrainTabKey) { + var els = pageBlockEls; + var fwd = !e.shiftKey && e.target === els[els.length-1]; + var back = e.shiftKey && e.target === els[0]; + if (fwd || back) { + setTimeout(function(){focus(back);},10); + return false; + } + } + } + var opts = e.data; + var target = $(e.target); + if (target.hasClass('blockOverlay') && opts.onOverlayClick) + opts.onOverlayClick(e); + + // allow events within the message content + if (target.parents('div.' + opts.blockMsgClass).length > 0) + return true; + + // allow events for content that is not being blocked + return target.parents().children().filter('div.blockUI').length === 0; + } + + function focus(back) { + if (!pageBlockEls) + return; + var e = pageBlockEls[back===true ? pageBlockEls.length-1 : 0]; + if (e) + e.focus(); + } + + function center(el, x, y) { + var p = el.parentNode, s = el.style; + var l = ((p.offsetWidth - el.offsetWidth)/2) - sz(p,'borderLeftWidth'); + var t = ((p.offsetHeight - el.offsetHeight)/2) - sz(p,'borderTopWidth'); + if (x) s.left = l > 0 ? (l+'px') : '0'; + if (y) s.top = t > 0 ? (t+'px') : '0'; + } + + function sz(el, p) { + return parseInt($.css(el,p),10)||0; + } + + } + + + /*global define:true */ + if (typeof define === 'function' && define.amd && define.amd.jQuery) { + define(['jquery'], setup); + } else { + setup(jQuery); + } + +})(); diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/chartjs/Chart.bundle.min.js b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/chartjs/Chart.bundle.min.js new file mode 100755 index 00000000..7134d267 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/chartjs/Chart.bundle.min.js @@ -0,0 +1,7 @@ +/*! + * Chart.js v2.9.4 + * https://www.chartjs.org + * (c) 2020 Chart.js Contributors + * Released under the MIT License + */ +!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t=t||self).Chart=e()}(this,(function(){"use strict";"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self&&self;function t(){throw new Error("Dynamic requires are not currently supported by rollup-plugin-commonjs")}function e(t,e){return t(e={exports:{}},e.exports),e.exports}var n={aliceblue:[240,248,255],antiquewhite:[250,235,215],aqua:[0,255,255],aquamarine:[127,255,212],azure:[240,255,255],beige:[245,245,220],bisque:[255,228,196],black:[0,0,0],blanchedalmond:[255,235,205],blue:[0,0,255],blueviolet:[138,43,226],brown:[165,42,42],burlywood:[222,184,135],cadetblue:[95,158,160],chartreuse:[127,255,0],chocolate:[210,105,30],coral:[255,127,80],cornflowerblue:[100,149,237],cornsilk:[255,248,220],crimson:[220,20,60],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgoldenrod:[184,134,11],darkgray:[169,169,169],darkgreen:[0,100,0],darkgrey:[169,169,169],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkseagreen:[143,188,143],darkslateblue:[72,61,139],darkslategray:[47,79,79],darkslategrey:[47,79,79],darkturquoise:[0,206,209],darkviolet:[148,0,211],deeppink:[255,20,147],deepskyblue:[0,191,255],dimgray:[105,105,105],dimgrey:[105,105,105],dodgerblue:[30,144,255],firebrick:[178,34,34],floralwhite:[255,250,240],forestgreen:[34,139,34],fuchsia:[255,0,255],gainsboro:[220,220,220],ghostwhite:[248,248,255],gold:[255,215,0],goldenrod:[218,165,32],gray:[128,128,128],green:[0,128,0],greenyellow:[173,255,47],grey:[128,128,128],honeydew:[240,255,240],hotpink:[255,105,180],indianred:[205,92,92],indigo:[75,0,130],ivory:[255,255,240],khaki:[240,230,140],lavender:[230,230,250],lavenderblush:[255,240,245],lawngreen:[124,252,0],lemonchiffon:[255,250,205],lightblue:[173,216,230],lightcoral:[240,128,128],lightcyan:[224,255,255],lightgoldenrodyellow:[250,250,210],lightgray:[211,211,211],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightsalmon:[255,160,122],lightseagreen:[32,178,170],lightskyblue:[135,206,250],lightslategray:[119,136,153],lightslategrey:[119,136,153],lightsteelblue:[176,196,222],lightyellow:[255,255,224],lime:[0,255,0],limegreen:[50,205,50],linen:[250,240,230],magenta:[255,0,255],maroon:[128,0,0],mediumaquamarine:[102,205,170],mediumblue:[0,0,205],mediumorchid:[186,85,211],mediumpurple:[147,112,219],mediumseagreen:[60,179,113],mediumslateblue:[123,104,238],mediumspringgreen:[0,250,154],mediumturquoise:[72,209,204],mediumvioletred:[199,21,133],midnightblue:[25,25,112],mintcream:[245,255,250],mistyrose:[255,228,225],moccasin:[255,228,181],navajowhite:[255,222,173],navy:[0,0,128],oldlace:[253,245,230],olive:[128,128,0],olivedrab:[107,142,35],orange:[255,165,0],orangered:[255,69,0],orchid:[218,112,214],palegoldenrod:[238,232,170],palegreen:[152,251,152],paleturquoise:[175,238,238],palevioletred:[219,112,147],papayawhip:[255,239,213],peachpuff:[255,218,185],peru:[205,133,63],pink:[255,192,203],plum:[221,160,221],powderblue:[176,224,230],purple:[128,0,128],rebeccapurple:[102,51,153],red:[255,0,0],rosybrown:[188,143,143],royalblue:[65,105,225],saddlebrown:[139,69,19],salmon:[250,128,114],sandybrown:[244,164,96],seagreen:[46,139,87],seashell:[255,245,238],sienna:[160,82,45],silver:[192,192,192],skyblue:[135,206,235],slateblue:[106,90,205],slategray:[112,128,144],slategrey:[112,128,144],snow:[255,250,250],springgreen:[0,255,127],steelblue:[70,130,180],tan:[210,180,140],teal:[0,128,128],thistle:[216,191,216],tomato:[255,99,71],turquoise:[64,224,208],violet:[238,130,238],wheat:[245,222,179],white:[255,255,255],whitesmoke:[245,245,245],yellow:[255,255,0],yellowgreen:[154,205,50]},i=e((function(t){var e={};for(var i in n)n.hasOwnProperty(i)&&(e[n[i]]=i);var a=t.exports={rgb:{channels:3,labels:"rgb"},hsl:{channels:3,labels:"hsl"},hsv:{channels:3,labels:"hsv"},hwb:{channels:3,labels:"hwb"},cmyk:{channels:4,labels:"cmyk"},xyz:{channels:3,labels:"xyz"},lab:{channels:3,labels:"lab"},lch:{channels:3,labels:"lch"},hex:{channels:1,labels:["hex"]},keyword:{channels:1,labels:["keyword"]},ansi16:{channels:1,labels:["ansi16"]},ansi256:{channels:1,labels:["ansi256"]},hcg:{channels:3,labels:["h","c","g"]},apple:{channels:3,labels:["r16","g16","b16"]},gray:{channels:1,labels:["gray"]}};for(var r in a)if(a.hasOwnProperty(r)){if(!("channels"in a[r]))throw new Error("missing channels property: "+r);if(!("labels"in a[r]))throw new Error("missing channel labels property: "+r);if(a[r].labels.length!==a[r].channels)throw new Error("channel and label counts mismatch: "+r);var o=a[r].channels,s=a[r].labels;delete a[r].channels,delete a[r].labels,Object.defineProperty(a[r],"channels",{value:o}),Object.defineProperty(a[r],"labels",{value:s})}a.rgb.hsl=function(t){var e,n,i=t[0]/255,a=t[1]/255,r=t[2]/255,o=Math.min(i,a,r),s=Math.max(i,a,r),l=s-o;return s===o?e=0:i===s?e=(a-r)/l:a===s?e=2+(r-i)/l:r===s&&(e=4+(i-a)/l),(e=Math.min(60*e,360))<0&&(e+=360),n=(o+s)/2,[e,100*(s===o?0:n<=.5?l/(s+o):l/(2-s-o)),100*n]},a.rgb.hsv=function(t){var e,n,i,a,r,o=t[0]/255,s=t[1]/255,l=t[2]/255,u=Math.max(o,s,l),d=u-Math.min(o,s,l),h=function(t){return(u-t)/6/d+.5};return 0===d?a=r=0:(r=d/u,e=h(o),n=h(s),i=h(l),o===u?a=i-n:s===u?a=1/3+e-i:l===u&&(a=2/3+n-e),a<0?a+=1:a>1&&(a-=1)),[360*a,100*r,100*u]},a.rgb.hwb=function(t){var e=t[0],n=t[1],i=t[2];return[a.rgb.hsl(t)[0],100*(1/255*Math.min(e,Math.min(n,i))),100*(i=1-1/255*Math.max(e,Math.max(n,i)))]},a.rgb.cmyk=function(t){var e,n=t[0]/255,i=t[1]/255,a=t[2]/255;return[100*((1-n-(e=Math.min(1-n,1-i,1-a)))/(1-e)||0),100*((1-i-e)/(1-e)||0),100*((1-a-e)/(1-e)||0),100*e]},a.rgb.keyword=function(t){var i=e[t];if(i)return i;var a,r,o,s=1/0;for(var l in n)if(n.hasOwnProperty(l)){var u=n[l],d=(r=t,o=u,Math.pow(r[0]-o[0],2)+Math.pow(r[1]-o[1],2)+Math.pow(r[2]-o[2],2));d| '; + } + + qrHtml += ' |
'+title+'
'); + if (message) $m.append(''+message+'
'); + if (timeout === undefined) timeout = 3000; + + // Added by konapun: Set timeout to 30 seconds if this growl is moused over, like normal toast notifications + var callBlock = function(opts) { + opts = opts || {}; + + $.blockUI({ + message: $m, + fadeIn : typeof opts.fadeIn !== 'undefined' ? opts.fadeIn : 700, + fadeOut: typeof opts.fadeOut !== 'undefined' ? opts.fadeOut : 1000, + timeout: typeof opts.timeout !== 'undefined' ? opts.timeout : timeout, + centerY: false, + showOverlay: false, + onUnblock: onClose, + css: $.blockUI.defaults.growlCSS + }); + }; + + callBlock(); + var nonmousedOpacity = $m.css('opacity'); + $m.mouseover(function() { + callBlock({ + fadeIn: 0, + timeout: 30000 + }); + + var displayBlock = $('.blockMsg'); + displayBlock.stop(); // cancel fadeout if it has started + displayBlock.fadeTo(300, 1); // make it easier to read the message by removing transparency + }).mouseout(function() { + $('.blockMsg').fadeOut(1000); + }); + // End konapun additions + }; + + // plugin method for blocking element content + $.fn.block = function(opts) { + if ( this[0] === window ) { + $.blockUI( opts ); + return this; + } + var fullOpts = $.extend({}, $.blockUI.defaults, opts || {}); + this.each(function() { + var $el = $(this); + if (fullOpts.ignoreIfBlocked && $el.data('blockUI.isBlocked')) + return; + $el.unblock({ fadeOut: 0 }); + }); + + return this.each(function() { + if ($.css(this,'position') == 'static') { + this.style.position = 'relative'; + $(this).data('blockUI.static', true); + } + this.style.zoom = 1; // force 'hasLayout' in ie + install(this, opts); + }); + }; + + // plugin method for unblocking element content + $.fn.unblock = function(opts) { + if ( this[0] === window ) { + $.unblockUI( opts ); + return this; + } + return this.each(function() { + remove(this, opts); + }); + }; + + $.blockUI.version = 2.70; // 2nd generation blocking at no extra cost! + + // override these in your code to change the default behavior and style + $.blockUI.defaults = { + // message displayed when blocking (use null for no message) + message: 'Please wait...
', + + title: null, // title string; only used when theme == true + draggable: true, // only used when theme == true (requires jquery-ui.js to be loaded) + + theme: false, // set to true to use with jQuery UI themes + + // styles for the message when blocking; if you wish to disable + // these and use an external stylesheet then do this in your code: + // $.blockUI.defaults.css = {}; + css: { + padding: 0, + margin: 0, + width: '30%', + top: '40%', + left: '35%', + textAlign: 'center', + color: '#000', + border: '3px solid #aaa', + backgroundColor:'#fff', + cursor: 'wait' + }, + + // minimal style set used when themes are used + themedCSS: { + width: '30%', + top: '40%', + left: '35%' + }, + + // styles for the overlay + overlayCSS: { + backgroundColor: '#000', + opacity: 0.6, + cursor: 'wait' + }, + + // style to replace wait cursor before unblocking to correct issue + // of lingering wait cursor + cursorReset: 'default', + + // styles applied when using $.growlUI + growlCSS: { + width: '350px', + top: '10px', + left: '', + right: '10px', + border: 'none', + padding: '5px', + opacity: 0.6, + cursor: 'default', + color: '#fff', + backgroundColor: '#000', + '-webkit-border-radius':'10px', + '-moz-border-radius': '10px', + 'border-radius': '10px' + }, + + // IE issues: 'about:blank' fails on HTTPS and javascript:false is s-l-o-w + // (hat tip to Jorge H. N. de Vasconcelos) + /*jshint scripturl:true */ + iframeSrc: /^https/i.test(window.location.href || '') ? 'javascript:false' : 'about:blank', + + // force usage of iframe in non-IE browsers (handy for blocking applets) + forceIframe: false, + + // z-index for the blocking overlay + baseZ: 1000, + + // set these to true to have the message automatically centered + centerX: true, // <-- only effects element blocking (page block controlled via css above) + centerY: true, + + // allow body element to be stetched in ie6; this makes blocking look better + // on "short" pages. disable if you wish to prevent changes to the body height + allowBodyStretch: true, + + // enable if you want key and mouse events to be disabled for content that is blocked + bindEvents: true, + + // be default blockUI will suppress tab navigation from leaving blocking content + // (if bindEvents is true) + constrainTabKey: true, + + // fadeIn time in millis; set to 0 to disable fadeIn on block + fadeIn: 200, + + // fadeOut time in millis; set to 0 to disable fadeOut on unblock + fadeOut: 400, + + // time in millis to wait before auto-unblocking; set to 0 to disable auto-unblock + timeout: 0, + + // disable if you don't want to show the overlay + showOverlay: true, + + // if true, focus will be placed in the first available input field when + // page blocking + focusInput: true, + + // elements that can receive focus + focusableElements: ':input:enabled:visible', + + // suppresses the use of overlay styles on FF/Linux (due to performance issues with opacity) + // no longer needed in 2012 + // applyPlatformOpacityRules: true, + + // callback method invoked when fadeIn has completed and blocking message is visible + onBlock: null, + + // callback method invoked when unblocking has completed; the callback is + // passed the element that has been unblocked (which is the window object for page + // blocks) and the options that were passed to the unblock call: + // onUnblock(element, options) + onUnblock: null, + + // callback method invoked when the overlay area is clicked. + // setting this will turn the cursor to a pointer, otherwise cursor defined in overlayCss will be used. + onOverlayClick: null, + + // don't ask; if you really must know: http://groups.google.com/group/jquery-en/browse_thread/thread/36640a8730503595/2f6a79a77a78e493#2f6a79a77a78e493 + quirksmodeOffsetHack: 4, + + // class name of the message block + blockMsgClass: 'blockMsg', + + // if it is already blocked, then ignore it (don't unblock and reblock) + ignoreIfBlocked: false + }; + + // private data and functions follow... + + var pageBlock = null; + var pageBlockEls = []; + + function install(el, opts) { + var css, themedCSS; + var full = (el == window); + var msg = (opts && opts.message !== undefined ? opts.message : undefined); + opts = $.extend({}, $.blockUI.defaults, opts || {}); + + if (opts.ignoreIfBlocked && $(el).data('blockUI.isBlocked')) + return; + + opts.overlayCSS = $.extend({}, $.blockUI.defaults.overlayCSS, opts.overlayCSS || {}); + css = $.extend({}, $.blockUI.defaults.css, opts.css || {}); + if (opts.onOverlayClick) + opts.overlayCSS.cursor = 'pointer'; + + themedCSS = $.extend({}, $.blockUI.defaults.themedCSS, opts.themedCSS || {}); + msg = msg === undefined ? opts.message : msg; + + // remove the current block (if there is one) + if (full && pageBlock) + remove(window, {fadeOut:0}); + + // if an existing element is being used as the blocking content then we capture + // its current place in the DOM (and current display style) so we can restore + // it when we unblock + if (msg && typeof msg != 'string' && (msg.parentNode || msg.jquery)) { + var node = msg.jquery ? msg[0] : msg; + var data = {}; + $(el).data('blockUI.history', data); + data.el = node; + data.parent = node.parentNode; + data.display = node.style.display; + data.position = node.style.position; + if (data.parent) + data.parent.removeChild(node); + } + + $(el).data('blockUI.onUnblock', opts.onUnblock); + var z = opts.baseZ; + + // blockUI uses 3 layers for blocking, for simplicity they are all used on every platform; + // layer1 is the iframe layer which is used to suppress bleed through of underlying content + // layer2 is the overlay layer which has opacity and a wait cursor (by default) + // layer3 is the message content that is displayed while blocking + var lyr1, lyr2, lyr3, s; + if (msie || opts.forceIframe) + lyr1 = $(''); + else + lyr1 = $(''); + + if (opts.theme) + lyr2 = $(''); + else + lyr2 = $(''); + + if (opts.theme && full) { + s = ''; + } + else if (opts.theme) { + s = ''; + } + else if (full) { + s = ''; + } + else { + s = ''; + } + lyr3 = $(s); + + // if we have a message, style it + if (msg) { + if (opts.theme) { + lyr3.css(themedCSS); + lyr3.addClass('ui-widget-content'); + } + else + lyr3.css(css); + } + + // style the overlay + if (!opts.theme /*&& (!opts.applyPlatformOpacityRules)*/) + lyr2.css(opts.overlayCSS); + lyr2.css('position', full ? 'fixed' : 'absolute'); + + // make iframe layer transparent in IE + if (msie || opts.forceIframe) + lyr1.css('opacity',0.0); + + //$([lyr1[0],lyr2[0],lyr3[0]]).appendTo(full ? 'body' : el); + var layers = [lyr1,lyr2,lyr3], $par = full ? $('body') : $(el); + $.each(layers, function() { + this.appendTo($par); + }); + + if (opts.theme && opts.draggable && $.fn.draggable) { + lyr3.draggable({ + handle: '.ui-dialog-titlebar', + cancel: 'li' + }); + } + + // ie7 must use absolute positioning in quirks mode and to account for activex issues (when scrolling) + var expr = setExpr && (!$.support.boxModel || $('object,embed', full ? null : el).length > 0); + if (ie6 || expr) { + // give body 100% height + if (full && opts.allowBodyStretch && $.support.boxModel) + $('html,body').css('height','100%'); + + // fix ie6 issue when blocked element has a border width + if ((ie6 || !$.support.boxModel) && !full) { + var t = sz(el,'borderTopWidth'), l = sz(el,'borderLeftWidth'); + var fixT = t ? '(0 - '+t+')' : 0; + var fixL = l ? '(0 - '+l+')' : 0; + } + + // simulate fixed position + $.each(layers, function(i,o) { + var s = o[0].style; + s.position = 'absolute'; + if (i < 2) { + if (full) + s.setExpression('height','Math.max(document.body.scrollHeight, document.body.offsetHeight) - (jQuery.support.boxModel?0:'+opts.quirksmodeOffsetHack+') + "px"'); + else + s.setExpression('height','this.parentNode.offsetHeight + "px"'); + if (full) + s.setExpression('width','jQuery.support.boxModel && document.documentElement.clientWidth || document.body.clientWidth + "px"'); + else + s.setExpression('width','this.parentNode.offsetWidth + "px"'); + if (fixL) s.setExpression('left', fixL); + if (fixT) s.setExpression('top', fixT); + } + else if (opts.centerY) { + if (full) s.setExpression('top','(document.documentElement.clientHeight || document.body.clientHeight) / 2 - (this.offsetHeight / 2) + (blah = document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + "px"'); + s.marginTop = 0; + } + else if (!opts.centerY && full) { + var top = (opts.css && opts.css.top) ? parseInt(opts.css.top, 10) : 0; + var expression = '((document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + '+top+') + "px"'; + s.setExpression('top',expression); + } + }); + } + + // show the message + if (msg) { + if (opts.theme) + lyr3.find('.ui-widget-content').append(msg); + else + lyr3.append(msg); + if (msg.jquery || msg.nodeType) + $(msg).show(); + } + + if ((msie || opts.forceIframe) && opts.showOverlay) + lyr1.show(); // opacity is zero + if (opts.fadeIn) { + var cb = opts.onBlock ? opts.onBlock : noOp; + var cb1 = (opts.showOverlay && !msg) ? cb : noOp; + var cb2 = msg ? cb : noOp; + if (opts.showOverlay) + lyr2._fadeIn(opts.fadeIn, cb1); + if (msg) + lyr3._fadeIn(opts.fadeIn, cb2); + } + else { + if (opts.showOverlay) + lyr2.show(); + if (msg) + lyr3.show(); + if (opts.onBlock) + opts.onBlock.bind(lyr3)(); + } + + // bind key and mouse events + bind(1, el, opts); + + if (full) { + pageBlock = lyr3[0]; + pageBlockEls = $(opts.focusableElements,pageBlock); + if (opts.focusInput) + setTimeout(focus, 20); + } + else + center(lyr3[0], opts.centerX, opts.centerY); + + if (opts.timeout) { + // auto-unblock + var to = setTimeout(function() { + if (full) + $.unblockUI(opts); + else + $(el).unblock(opts); + }, opts.timeout); + $(el).data('blockUI.timeout', to); + } + } + + // remove the block + function remove(el, opts) { + var count; + var full = (el == window); + var $el = $(el); + var data = $el.data('blockUI.history'); + var to = $el.data('blockUI.timeout'); + if (to) { + clearTimeout(to); + $el.removeData('blockUI.timeout'); + } + opts = $.extend({}, $.blockUI.defaults, opts || {}); + bind(0, el, opts); // unbind events + + if (opts.onUnblock === null) { + opts.onUnblock = $el.data('blockUI.onUnblock'); + $el.removeData('blockUI.onUnblock'); + } + + var els; + if (full) // crazy selector to handle odd field errors in ie6/7 + els = $('body').children().filter('.blockUI').add('body > .blockUI'); + else + els = $el.find('>.blockUI'); + + // fix cursor issue + if ( opts.cursorReset ) { + if ( els.length > 1 ) + els[1].style.cursor = opts.cursorReset; + if ( els.length > 2 ) + els[2].style.cursor = opts.cursorReset; + } + + if (full) + pageBlock = pageBlockEls = null; + + if (opts.fadeOut) { + count = els.length; + els.stop().fadeOut(opts.fadeOut, function() { + if ( --count === 0) + reset(els,data,opts,el); + }); + } + else + reset(els, data, opts, el); + } + + // move blocking element back into the DOM where it started + function reset(els,data,opts,el) { + var $el = $(el); + if ( $el.data('blockUI.isBlocked') ) + return; + + els.each(function(i,o) { + // remove via DOM calls so we don't lose event handlers + if (this.parentNode) + this.parentNode.removeChild(this); + }); + + if (data && data.el) { + data.el.style.display = data.display; + data.el.style.position = data.position; + data.el.style.cursor = 'default'; // #59 + if (data.parent) + data.parent.appendChild(data.el); + $el.removeData('blockUI.history'); + } + + if ($el.data('blockUI.static')) { + $el.css('position', 'static'); // #22 + } + + if (typeof opts.onUnblock == 'function') + opts.onUnblock(el,opts); + + // fix issue in Safari 6 where block artifacts remain until reflow + var body = $(document.body), w = body.width(), cssW = body[0].style.width; + body.width(w-1).width(w); + body[0].style.width = cssW; + } + + // bind/unbind the handler + function bind(b, el, opts) { + var full = el == window, $el = $(el); + + // don't bother unbinding if there is nothing to unbind + if (!b && (full && !pageBlock || !full && !$el.data('blockUI.isBlocked'))) + return; + + $el.data('blockUI.isBlocked', b); + + // don't bind events when overlay is not in use or if bindEvents is false + if (!full || !opts.bindEvents || (b && !opts.showOverlay)) + return; + + // bind anchors and inputs for mouse and key events + var events = 'mousedown mouseup keydown keypress keyup touchstart touchend touchmove'; + if (b) + $(document).bind(events, opts, handler); + else + $(document).unbind(events, handler); + + // former impl... + // var $e = $('a,:input'); + // b ? $e.bind(events, opts, handler) : $e.unbind(events, handler); + } + + // event handler to suppress keyboard/mouse events when blocking + function handler(e) { + // allow tab navigation (conditionally) + if (e.type === 'keydown' && e.keyCode && e.keyCode == 9) { + if (pageBlock && e.data.constrainTabKey) { + var els = pageBlockEls; + var fwd = !e.shiftKey && e.target === els[els.length-1]; + var back = e.shiftKey && e.target === els[0]; + if (fwd || back) { + setTimeout(function(){focus(back);},10); + return false; + } + } + } + var opts = e.data; + var target = $(e.target); + if (target.hasClass('blockOverlay') && opts.onOverlayClick) + opts.onOverlayClick(e); + + // allow events within the message content + if (target.parents('div.' + opts.blockMsgClass).length > 0) + return true; + + // allow events for content that is not being blocked + return target.parents().children().filter('div.blockUI').length === 0; + } + + function focus(back) { + if (!pageBlockEls) + return; + var e = pageBlockEls[back===true ? pageBlockEls.length-1 : 0]; + if (e) + e.focus(); + } + + function center(el, x, y) { + var p = el.parentNode, s = el.style; + var l = ((p.offsetWidth - el.offsetWidth)/2) - sz(p,'borderLeftWidth'); + var t = ((p.offsetHeight - el.offsetHeight)/2) - sz(p,'borderTopWidth'); + if (x) s.left = l > 0 ? (l+'px') : '0'; + if (y) s.top = t > 0 ? (t+'px') : '0'; + } + + function sz(el, p) { + return parseInt($.css(el,p),10)||0; + } + + } + + + /*global define:true */ + if (typeof define === 'function' && define.amd && define.amd.jQuery) { + define(['jquery'], setup); + } else { + setup(jQuery); + } + +})(); \ No newline at end of file diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/jquery.blockUI.min.js b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/jquery.blockUI.min.js new file mode 100755 index 00000000..47fb9744 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/jquery.blockUI.min.js @@ -0,0 +1,14 @@ +/*! + * jQuery blockUI plugin + * Version 2.70.0-2014.11.23 + * Requires jQuery v1.7 or later + * + * Examples at: http://malsup.com/jquery/block/ + * Copyright (c) 2007-2013 M. Alsup + * Dual licensed under the MIT and GPL licenses: + * http://www.opensource.org/licenses/mit-license.php + * http://www.gnu.org/licenses/gpl.html + * + * Thanks to Amir-Hossein Sobhi for some excellent contributions! + */ +!function(){"use strict";function a(a){function b(b,d){var f,p,q=b==window,r=d&&void 0!==d.message?d.message:void 0;if(d=a.extend({},a.blockUI.defaults,d||{}),!d.ignoreIfBlocked||!a(b).data("blockUI.isBlocked")){if(d.overlayCSS=a.extend({},a.blockUI.defaults.overlayCSS,d.overlayCSS||{}),f=a.extend({},a.blockUI.defaults.css,d.css||{}),d.onOverlayClick&&(d.overlayCSS.cursor="pointer"),p=a.extend({},a.blockUI.defaults.themedCSS,d.themedCSS||{}),r=void 0===r?d.message:r,q&&n&&c(window,{fadeOut:0}),r&&"string"!=typeof r&&(r.parentNode||r.jquery)){var s=r.jquery?r[0]:r,t={};a(b).data("blockUI.history",t),t.el=s,t.parent=s.parentNode,t.display=s.style.display,t.position=s.style.position,t.parent&&t.parent.removeChild(s)}a(b).data("blockUI.onUnblock",d.onUnblock);var u,v,w,x,y=d.baseZ;u=a(k||d.forceIframe?'':''),v=a(d.theme?'':''),d.theme&&q?(x='"):d.theme?(x='"):x=q?'':'',w=a(x),r&&(d.theme?(w.css(p),w.addClass("ui-widget-content")):w.css(f)),d.theme||v.css(d.overlayCSS),v.css("position",q?"fixed":"absolute"),(k||d.forceIframe)&&u.css("opacity",0);var z=[u,v,w],A=a(q?"body":b);a.each(z,function(){this.appendTo(A)}),d.theme&&d.draggable&&a.fn.draggable&&w.draggable({handle:".ui-dialog-titlebar",cancel:"li"});var B=m&&(!a.support.boxModel||a("object,embed",q?null:b).length>0);if(l||B){if(q&&d.allowBodyStretch&&a.support.boxModel&&a("html,body").css("height","100%"),(l||!a.support.boxModel)&&!q)var C=i(b,"borderTopWidth"),D=i(b,"borderLeftWidth"),E=C?"(0 - "+C+")":0,F=D?"(0 - "+D+")":0;a.each(z,function(a,b){var c=b[0].style;if(c.position="absolute",2>a)q?c.setExpression("height","Math.max(document.body.scrollHeight, document.body.offsetHeight) - (jQuery.support.boxModel?0:"+d.quirksmodeOffsetHack+') + "px"'):c.setExpression("height",'this.parentNode.offsetHeight + "px"'),q?c.setExpression("width",'jQuery.support.boxModel && document.documentElement.clientWidth || document.body.clientWidth + "px"'):c.setExpression("width",'this.parentNode.offsetWidth + "px"'),F&&c.setExpression("left",F),E&&c.setExpression("top",E);else if(d.centerY)q&&c.setExpression("top",'(document.documentElement.clientHeight || document.body.clientHeight) / 2 - (this.offsetHeight / 2) + (blah = document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + "px"'),c.marginTop=0;else if(!d.centerY&&q){var e=d.css&&d.css.top?parseInt(d.css.top,10):0,f="((document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop) + "+e+') + "px"';c.setExpression("top",f)}})}if(r&&(d.theme?w.find(".ui-widget-content").append(r):w.append(r),(r.jquery||r.nodeType)&&a(r).show()),(k||d.forceIframe)&&d.showOverlay&&u.show(),d.fadeIn){var G=d.onBlock?d.onBlock:j,H=d.showOverlay&&!r?G:j,I=r?G:j;d.showOverlay&&v._fadeIn(d.fadeIn,H),r&&w._fadeIn(d.fadeIn,I)}else d.showOverlay&&v.show(),r&&w.show(),d.onBlock&&d.onBlock.bind(w)();if(e(1,b,d),q?(n=w[0],o=a(d.focusableElements,n),d.focusInput&&setTimeout(g,20)):h(w[0],d.centerX,d.centerY),d.timeout){var J=setTimeout(function(){q?a.unblockUI(d):a(b).unblock(d)},d.timeout);a(b).data("blockUI.timeout",J)}}}function c(b,c){var f,g=b==window,h=a(b),i=h.data("blockUI.history"),j=h.data("blockUI.timeout");j&&(clearTimeout(j),h.removeData("blockUI.timeout")),c=a.extend({},a.blockUI.defaults,c||{}),e(0,b,c),null===c.onUnblock&&(c.onUnblock=h.data("blockUI.onUnblock"),h.removeData("blockUI.onUnblock"));var k;k=g?a("body").children().filter(".blockUI").add("body > .blockUI"):h.find(">.blockUI"),c.cursorReset&&(k.length>1&&(k[1].style.cursor=c.cursorReset),k.length>2&&(k[2].style.cursor=c.cursorReset)),g&&(n=o=null),c.fadeOut?(f=k.length,k.stop().fadeOut(c.fadeOut,function(){0===--f&&d(k,i,c,b)})):d(k,i,c,b)}function d(b,c,d,e){var f=a(e);if(!f.data("blockUI.isBlocked")){b.each(function(){this.parentNode&&this.parentNode.removeChild(this)}),c&&c.el&&(c.el.style.display=c.display,c.el.style.position=c.position,c.el.style.cursor="default",c.parent&&c.parent.appendChild(c.el),f.removeData("blockUI.history")),f.data("blockUI.static")&&f.css("position","static"),"function"==typeof d.onUnblock&&d.onUnblock(e,d);var g=a(document.body),h=g.width(),i=g[0].style.width;g.width(h-1).width(h),g[0].style.width=i}}function e(b,c,d){var e=c==window,g=a(c);if((b||(!e||n)&&(e||g.data("blockUI.isBlocked")))&&(g.data("blockUI.isBlocked",b),e&&d.bindEvents&&(!b||d.showOverlay))){var h="mousedown mouseup keydown keypress keyup touchstart touchend touchmove";b?a(document).bind(h,d,f):a(document).unbind(h,f)}}function f(b){if("keydown"===b.type&&b.keyCode&&9==b.keyCode&&n&&b.data.constrainTabKey){var c=o,d=!b.shiftKey&&b.target===c[c.length-1],e=b.shiftKey&&b.target===c[0];if(d||e)return setTimeout(function(){g(e)},10),!1}var f=b.data,h=a(b.target);return h.hasClass("blockOverlay")&&f.onOverlayClick&&f.onOverlayClick(b),h.parents("div."+f.blockMsgClass).length>0?!0:0===h.parents().children().filter("div.blockUI").length}function g(a){if(o){var b=o[a===!0?o.length-1:0];b&&b.focus()}}function h(a,b,c){var d=a.parentNode,e=a.style,f=(d.offsetWidth-a.offsetWidth)/2-i(d,"borderLeftWidth"),g=(d.offsetHeight-a.offsetHeight)/2-i(d,"borderTopWidth");b&&(e.left=f>0?f+"px":"0"),c&&(e.top=g>0?g+"px":"0")}function i(b,c){return parseInt(a.css(b,c),10)||0}a.fn._fadeIn=a.fn.fadeIn;var j=a.noop||function(){},k=/MSIE/.test(navigator.userAgent),l=/MSIE 6.0/.test(navigator.userAgent)&&!/MSIE 8.0/.test(navigator.userAgent),m=(document.documentMode||0,a.isFunction(document.createElement("div").style.setExpression));a.blockUI=function(a){b(window,a)},a.unblockUI=function(a){c(window,a)},a.growlUI=function(b,c,d,e){var f=a('');b&&f.append(""+b+"
"),c&&f.append(""+c+"
"),void 0===d&&(d=3e3);var g=function(b){b=b||{},a.blockUI({message:f,fadeIn:"undefined"!=typeof b.fadeIn?b.fadeIn:700,fadeOut:"undefined"!=typeof b.fadeOut?b.fadeOut:1e3,timeout:"undefined"!=typeof b.timeout?b.timeout:d,centerY:!1,showOverlay:!1,onUnblock:e,css:a.blockUI.defaults.growlCSS})};g();f.css("opacity");f.mouseover(function(){g({fadeIn:0,timeout:3e4});var b=a(".blockMsg");b.stop(),b.fadeTo(300,1)}).mouseout(function(){a(".blockMsg").fadeOut(1e3)})},a.fn.block=function(c){if(this[0]===window)return a.blockUI(c),this;var d=a.extend({},a.blockUI.defaults,c||{});return this.each(function(){var b=a(this);d.ignoreIfBlocked&&b.data("blockUI.isBlocked")||b.unblock({fadeOut:0})}),this.each(function(){"static"==a.css(this,"position")&&(this.style.position="relative",a(this).data("blockUI.static",!0)),this.style.zoom=1,b(this,c)})},a.fn.unblock=function(b){return this[0]===window?(a.unblockUI(b),this):this.each(function(){c(this,b)})},a.blockUI.version=2.7,a.blockUI.defaults={message:"Please wait...
",title:null,draggable:!0,theme:!1,css:{padding:0,margin:0,width:"30%",top:"40%",left:"35%",textAlign:"center",color:"#000",border:"3px solid #aaa",backgroundColor:"#fff",cursor:"wait"},themedCSS:{width:"30%",top:"40%",left:"35%"},overlayCSS:{backgroundColor:"#000",opacity:.6,cursor:"wait"},cursorReset:"default",growlCSS:{width:"350px",top:"10px",left:"",right:"10px",border:"none",padding:"5px",opacity:.6,cursor:"default",color:"#fff",backgroundColor:"#000","-webkit-border-radius":"10px","-moz-border-radius":"10px","border-radius":"10px"},iframeSrc:/^https/i.test(window.location.href||"")?"javascript:false":"about:blank",forceIframe:!1,baseZ:1e3,centerX:!0,centerY:!0,allowBodyStretch:!0,bindEvents:!0,constrainTabKey:!0,fadeIn:200,fadeOut:400,timeout:0,showOverlay:!0,focusInput:!0,focusableElements:":input:enabled:visible",onBlock:null,onUnblock:null,onOverlayClick:null,quirksmodeOffsetHack:4,blockMsgClass:"blockMsg",ignoreIfBlocked:!1};var n=null,o=[]}"function"==typeof define&&define.amd&&define.amd.jQuery?define(["jquery"],a):a(jQuery)}(); \ No newline at end of file diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/login-form-integrations.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/login-form-integrations.php new file mode 100755 index 00000000..931560a9 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/login-form-integrations.php @@ -0,0 +1,146 @@ +tfa = $tfa; + + $enqueue_upon_actions = array( + // This is needed for the login form on the dedicated payment page (e.g. /checkout/order-pay/123456/?pay_for_order=true&key=wc_order_blahblahblah) + 'woocommerce_login_form_start', + 'woocommerce_before_customer_login_form', + // The login form on the checkout doesn't call the woocommerce_before_customer_login_form action + 'woocommerce_before_checkout_form', + 'affwp_login_fields_before', + ); + + foreach ($enqueue_upon_actions as $action) { + add_action($action, array($this->tfa, 'login_enqueue_scripts')); + } + + if (!defined('TWO_FACTOR_DISABLE') || !TWO_FACTOR_DISABLE) { + add_action('affwp_process_login_form', array($this, 'affwp_process_login_form')); + } + + add_filter('tml_display', array($this, 'tml_display')); + add_filter('wppb_login_form_bottom', array($this, 'pb_login_form')); + + // We want to run first if possible, so that we're not aborted by JavaScript exceptions in other components (our code is critical to the login process for TFA users) + // Unfortunately, though, people start enqueuing from init onwards (before that is buggy - https://core.trac.wordpress.org/ticket/11526), so, we try to detect the login page and go earlier there. + if (isset($GLOBALS['pagenow']) && 'wp-login.php' === $GLOBALS['pagenow']) { + add_action('init', array($this->tfa, 'login_enqueue_scripts'), -99999999999); + } else { + add_action('login_enqueue_scripts', array($this->tfa, 'login_enqueue_scripts'), -99999999999); + } + + add_filter('do_shortcode_tag', array($this, 'do_shortcode_tag'), 10, 2); + + add_filter('simba_tfa_login_enqueue_localize', array($this, 'simba_tfa_login_enqueue_localize'), 9); + + } + + /** + * Catch TML login widgets (other TML login forms already trigger) + * + * @param Mixed $whatever + * + * @return Mixed + */ + public function tml_display($whatever) { + $this->tfa->login_enqueue_scripts(); + return $whatever; + } + + /** + * Catch Profile Builder login form + * + * @param Mixed $whatever + * + * @return Mixed + */ + public function pb_login_form($whatever) { + $this->tfa->login_enqueue_scripts(); + return $whatever; + } + + /** + * Runs upon the WP filter simba_tfa_login_enqueue_localize. + * + * @param Array $localize + * + * @return Array + */ + public function simba_tfa_login_enqueue_localize($localize) { + // WP login form is #loginform + // Ultimate Membership Pro - April 2018 + // Theme My Login 6.x - .tml-login form[name="loginform"] + // Theme My Login 7.x - .tml-login form[name="login"] (July 2018) + // WP Members - March 2018 + // bbPress - June 2021 + // WooCommerce - ported over from the separate wooextend.js code, June 2021 + // Affiliates WP - ported over from the separate wooextend.js code, June 2021 + $localize['login_form_selectors'] .= '.tml-login form[name="loginform"], .tml-login form[name="login"], #loginform, #wpmem_login form, form#ihc_login_form, .bbp-login-form, .woocommerce form.login, #affwp-login-form, #wppb-loginform'; + $localize['login_form_off_selectors'] .= '#ihc_login_form'; + return $localize; + } + + /** + * Runs upon the WP action affwp_process_login_form + */ + public function affwp_process_login_form() { + + if (!function_exists('affiliate_wp')) return; + + $affiliate_wp = affiliate_wp(); + $login = $affiliate_wp->login; + + $params = array( + // phpcs:ignore WordPress.Security.NonceVerification -- No nonce. + 'log' => isset($_POST['affwp_user_login']) ? sanitize_user(wp_unslash($_POST['affwp_user_login'])): '', + + $request_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '', + 'caller'=> isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : $request_uri, + // phpcs:ignore WordPress.Security.NonceVerification -- No nonce. + 'two_factor_code' => isset($_POST['two_factor_code']) ? sanitize_text_field(wp_unslash((string) $_POST['two_factor_code'])) : '', + ); + $code_ok = $this->tfa->authorise_user_from_login($params, true); + + $code_ok = apply_filters('simbatfa_affwp_process_login_form_auth_result', $code_ok, $params); + + if (is_wp_error($code_ok)) { + $login->add_error($code_ok->get_error_code(), $code_ok->get_error_message()); + } elseif (!$code_ok) { + $login->add_error('authentication_failed', __('Error:', 'all-in-one-wp-security-and-firewall').' '.apply_filters('simba_tfa_message_code_incorrect', __('The one-time password (TFA code) you entered was incorrect.', 'all-in-one-wp-security-and-firewall'))); + } + + } + + /** + * Ultimate Membership Pro support + * + * @param String $output + * @param String $tag + * + * @return String + */ + public function do_shortcode_tag($output, $tag) { + if ('ihc-login-form' == $tag) $this->tfa->login_enqueue_scripts(); + return $output; + } + +} diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.css new file mode 100755 index 00000000..750b3207 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.css @@ -0,0 +1,481 @@ +.select2-container { + box-sizing: border-box; + display: inline-block; + margin: 0; + position: relative; + vertical-align: middle; } + .select2-container .select2-selection--single { + box-sizing: border-box; + cursor: pointer; + display: block; + height: 28px; + user-select: none; + -webkit-user-select: none; } + .select2-container .select2-selection--single .select2-selection__rendered { + display: block; + padding-left: 8px; + padding-right: 20px; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; } + .select2-container .select2-selection--single .select2-selection__clear { + position: relative; } + .select2-container[dir="rtl"] .select2-selection--single .select2-selection__rendered { + padding-right: 8px; + padding-left: 20px; } + .select2-container .select2-selection--multiple { + box-sizing: border-box; + cursor: pointer; + display: block; + min-height: 32px; + user-select: none; + -webkit-user-select: none; } + .select2-container .select2-selection--multiple .select2-selection__rendered { + display: inline-block; + overflow: hidden; + padding-left: 8px; + text-overflow: ellipsis; + white-space: nowrap; } + .select2-container .select2-search--inline { + float: left; } + .select2-container .select2-search--inline .select2-search__field { + box-sizing: border-box; + border: none; + font-size: 100%; + margin-top: 5px; + padding: 0; } + .select2-container .select2-search--inline .select2-search__field::-webkit-search-cancel-button { + -webkit-appearance: none; } + +.select2-dropdown { + background-color: white; + border: 1px solid #aaa; + border-radius: 4px; + box-sizing: border-box; + display: block; + position: absolute; + left: -100000px; + width: 100%; + z-index: 1051; } + +.select2-results { + display: block; } + +.select2-results__options { + list-style: none; + margin: 0; + padding: 0; } + +.select2-results__option { + padding: 6px; + user-select: none; + -webkit-user-select: none; } + .select2-results__option[aria-selected] { + cursor: pointer; } + +.select2-container--open .select2-dropdown { + left: 0; } + +.select2-container--open .select2-dropdown--above { + border-bottom: none; + border-bottom-left-radius: 0; + border-bottom-right-radius: 0; } + +.select2-container--open .select2-dropdown--below { + border-top: none; + border-top-left-radius: 0; + border-top-right-radius: 0; } + +.select2-search--dropdown { + display: block; + padding: 4px; } + .select2-search--dropdown .select2-search__field { + padding: 4px; + width: 100%; + box-sizing: border-box; } + .select2-search--dropdown .select2-search__field::-webkit-search-cancel-button { + -webkit-appearance: none; } + .select2-search--dropdown.select2-search--hide { + display: none; } + +.select2-close-mask { + border: 0; + margin: 0; + padding: 0; + display: block; + position: fixed; + left: 0; + top: 0; + min-height: 100%; + min-width: 100%; + height: auto; + width: auto; + opacity: 0; + z-index: 99; + background-color: #fff; + filter: alpha(opacity=0); } + +.select2-hidden-accessible { + border: 0 !important; + clip: rect(0 0 0 0) !important; + -webkit-clip-path: inset(50%) !important; + clip-path: inset(50%) !important; + height: 1px !important; + overflow: hidden !important; + padding: 0 !important; + position: absolute !important; + width: 1px !important; + white-space: nowrap !important; } + +.select2-container--default .select2-selection--single { + background-color: #fff; + border: 1px solid #aaa; + border-radius: 4px; } + .select2-container--default .select2-selection--single .select2-selection__rendered { + color: #444; + line-height: 28px; } + .select2-container--default .select2-selection--single .select2-selection__clear { + cursor: pointer; + float: right; + font-weight: bold; } + .select2-container--default .select2-selection--single .select2-selection__placeholder { + color: #999; } + .select2-container--default .select2-selection--single .select2-selection__arrow { + height: 26px; + position: absolute; + top: 1px; + right: 1px; + width: 20px; } + .select2-container--default .select2-selection--single .select2-selection__arrow b { + border-color: #888 transparent transparent transparent; + border-style: solid; + border-width: 5px 4px 0 4px; + height: 0; + left: 50%; + margin-left: -4px; + margin-top: -2px; + position: absolute; + top: 50%; + width: 0; } + +.select2-container--default[dir="rtl"] .select2-selection--single .select2-selection__clear { + float: left; } + +.select2-container--default[dir="rtl"] .select2-selection--single .select2-selection__arrow { + left: 1px; + right: auto; } + +.select2-container--default.select2-container--disabled .select2-selection--single { + background-color: #eee; + cursor: default; } + .select2-container--default.select2-container--disabled .select2-selection--single .select2-selection__clear { + display: none; } + +.select2-container--default.select2-container--open .select2-selection--single .select2-selection__arrow b { + border-color: transparent transparent #888 transparent; + border-width: 0 4px 5px 4px; } + +.select2-container--default .select2-selection--multiple { + background-color: white; + border: 1px solid #aaa; + border-radius: 4px; + cursor: text; } + .select2-container--default .select2-selection--multiple .select2-selection__rendered { + box-sizing: border-box; + list-style: none; + margin: 0; + padding: 0 5px; + width: 100%; } + .select2-container--default .select2-selection--multiple .select2-selection__rendered li { + list-style: none; } + .select2-container--default .select2-selection--multiple .select2-selection__clear { + cursor: pointer; + float: right; + font-weight: bold; + margin-top: 5px; + margin-right: 10px; + padding: 1px; } + .select2-container--default .select2-selection--multiple .select2-selection__choice { + background-color: #e4e4e4; + border: 1px solid #aaa; + border-radius: 4px; + cursor: default; + float: left; + margin-right: 5px; + margin-top: 5px; + padding: 0 5px; } + .select2-container--default .select2-selection--multiple .select2-selection__choice__remove { + color: #999; + cursor: pointer; + display: inline-block; + font-weight: bold; + margin-right: 2px; } + .select2-container--default .select2-selection--multiple .select2-selection__choice__remove:hover { + color: #333; } + +.select2-container--default[dir="rtl"] .select2-selection--multiple .select2-selection__choice, .select2-container--default[dir="rtl"] .select2-selection--multiple .select2-search--inline { + float: right; } + +.select2-container--default[dir="rtl"] .select2-selection--multiple .select2-selection__choice { + margin-left: 5px; + margin-right: auto; } + +.select2-container--default[dir="rtl"] .select2-selection--multiple .select2-selection__choice__remove { + margin-left: 2px; + margin-right: auto; } + +.select2-container--default.select2-container--focus .select2-selection--multiple { + border: solid black 1px; + outline: 0; } + +.select2-container--default.select2-container--disabled .select2-selection--multiple { + background-color: #eee; + cursor: default; } + +.select2-container--default.select2-container--disabled .select2-selection__choice__remove { + display: none; } + +.select2-container--default.select2-container--open.select2-container--above .select2-selection--single, .select2-container--default.select2-container--open.select2-container--above .select2-selection--multiple { + border-top-left-radius: 0; + border-top-right-radius: 0; } + +.select2-container--default.select2-container--open.select2-container--below .select2-selection--single, .select2-container--default.select2-container--open.select2-container--below .select2-selection--multiple { + border-bottom-left-radius: 0; + border-bottom-right-radius: 0; } + +.select2-container--default .select2-search--dropdown .select2-search__field { + border: 1px solid #aaa; } + +.select2-container--default .select2-search--inline .select2-search__field { + background: transparent; + border: none; + outline: 0; + box-shadow: none; + -webkit-appearance: textfield; } + +.select2-container--default .select2-results > .select2-results__options { + max-height: 200px; + overflow-y: auto; } + +.select2-container--default .select2-results__option[role=group] { + padding: 0; } + +.select2-container--default .select2-results__option[aria-disabled=true] { + color: #999; } + +.select2-container--default .select2-results__option[aria-selected=true] { + background-color: #ddd; } + +.select2-container--default .select2-results__option .select2-results__option { + padding-left: 1em; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__group { + padding-left: 0; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__option { + margin-left: -1em; + padding-left: 2em; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__option .select2-results__option { + margin-left: -2em; + padding-left: 3em; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option { + margin-left: -3em; + padding-left: 4em; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option { + margin-left: -4em; + padding-left: 5em; } + .select2-container--default .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option .select2-results__option { + margin-left: -5em; + padding-left: 6em; } + +.select2-container--default .select2-results__option--highlighted[aria-selected] { + background-color: #5897fb; + color: white; } + +.select2-container--default .select2-results__group { + cursor: default; + display: block; + padding: 6px; } + +.select2-container--classic .select2-selection--single { + background-color: #f7f7f7; + border: 1px solid #aaa; + border-radius: 4px; + outline: 0; + background-image: -webkit-linear-gradient(top, white 50%, #eeeeee 100%); + background-image: -o-linear-gradient(top, white 50%, #eeeeee 100%); + background-image: linear-gradient(to bottom, white 50%, #eeeeee 100%); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFFFFFFF', endColorstr='#FFEEEEEE', GradientType=0); } + .select2-container--classic .select2-selection--single:focus { + border: 1px solid #5897fb; } + .select2-container--classic .select2-selection--single .select2-selection__rendered { + color: #444; + line-height: 28px; } + .select2-container--classic .select2-selection--single .select2-selection__clear { + cursor: pointer; + float: right; + font-weight: bold; + margin-right: 10px; } + .select2-container--classic .select2-selection--single .select2-selection__placeholder { + color: #999; } + .select2-container--classic .select2-selection--single .select2-selection__arrow { + background-color: #ddd; + border: none; + border-left: 1px solid #aaa; + border-top-right-radius: 4px; + border-bottom-right-radius: 4px; + height: 26px; + position: absolute; + top: 1px; + right: 1px; + width: 20px; + background-image: -webkit-linear-gradient(top, #eeeeee 50%, #cccccc 100%); + background-image: -o-linear-gradient(top, #eeeeee 50%, #cccccc 100%); + background-image: linear-gradient(to bottom, #eeeeee 50%, #cccccc 100%); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFEEEEEE', endColorstr='#FFCCCCCC', GradientType=0); } + .select2-container--classic .select2-selection--single .select2-selection__arrow b { + border-color: #888 transparent transparent transparent; + border-style: solid; + border-width: 5px 4px 0 4px; + height: 0; + left: 50%; + margin-left: -4px; + margin-top: -2px; + position: absolute; + top: 50%; + width: 0; } + +.select2-container--classic[dir="rtl"] .select2-selection--single .select2-selection__clear { + float: left; } + +.select2-container--classic[dir="rtl"] .select2-selection--single .select2-selection__arrow { + border: none; + border-right: 1px solid #aaa; + border-radius: 0; + border-top-left-radius: 4px; + border-bottom-left-radius: 4px; + left: 1px; + right: auto; } + +.select2-container--classic.select2-container--open .select2-selection--single { + border: 1px solid #5897fb; } + .select2-container--classic.select2-container--open .select2-selection--single .select2-selection__arrow { + background: transparent; + border: none; } + .select2-container--classic.select2-container--open .select2-selection--single .select2-selection__arrow b { + border-color: transparent transparent #888 transparent; + border-width: 0 4px 5px 4px; } + +.select2-container--classic.select2-container--open.select2-container--above .select2-selection--single { + border-top: none; + border-top-left-radius: 0; + border-top-right-radius: 0; + background-image: -webkit-linear-gradient(top, white 0%, #eeeeee 50%); + background-image: -o-linear-gradient(top, white 0%, #eeeeee 50%); + background-image: linear-gradient(to bottom, white 0%, #eeeeee 50%); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFFFFFFF', endColorstr='#FFEEEEEE', GradientType=0); } + +.select2-container--classic.select2-container--open.select2-container--below .select2-selection--single { + border-bottom: none; + border-bottom-left-radius: 0; + border-bottom-right-radius: 0; + background-image: -webkit-linear-gradient(top, #eeeeee 50%, white 100%); + background-image: -o-linear-gradient(top, #eeeeee 50%, white 100%); + background-image: linear-gradient(to bottom, #eeeeee 50%, white 100%); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFEEEEEE', endColorstr='#FFFFFFFF', GradientType=0); } + +.select2-container--classic .select2-selection--multiple { + background-color: white; + border: 1px solid #aaa; + border-radius: 4px; + cursor: text; + outline: 0; } + .select2-container--classic .select2-selection--multiple:focus { + border: 1px solid #5897fb; } + .select2-container--classic .select2-selection--multiple .select2-selection__rendered { + list-style: none; + margin: 0; + padding: 0 5px; } + .select2-container--classic .select2-selection--multiple .select2-selection__clear { + display: none; } + .select2-container--classic .select2-selection--multiple .select2-selection__choice { + background-color: #e4e4e4; + border: 1px solid #aaa; + border-radius: 4px; + cursor: default; + float: left; + margin-right: 5px; + margin-top: 5px; + padding: 0 5px; } + .select2-container--classic .select2-selection--multiple .select2-selection__choice__remove { + color: #888; + cursor: pointer; + display: inline-block; + font-weight: bold; + margin-right: 2px; } + .select2-container--classic .select2-selection--multiple .select2-selection__choice__remove:hover { + color: #555; } + +.select2-container--classic[dir="rtl"] .select2-selection--multiple .select2-selection__choice { + float: right; + margin-left: 5px; + margin-right: auto; } + +.select2-container--classic[dir="rtl"] .select2-selection--multiple .select2-selection__choice__remove { + margin-left: 2px; + margin-right: auto; } + +.select2-container--classic.select2-container--open .select2-selection--multiple { + border: 1px solid #5897fb; } + +.select2-container--classic.select2-container--open.select2-container--above .select2-selection--multiple { + border-top: none; + border-top-left-radius: 0; + border-top-right-radius: 0; } + +.select2-container--classic.select2-container--open.select2-container--below .select2-selection--multiple { + border-bottom: none; + border-bottom-left-radius: 0; + border-bottom-right-radius: 0; } + +.select2-container--classic .select2-search--dropdown .select2-search__field { + border: 1px solid #aaa; + outline: 0; } + +.select2-container--classic .select2-search--inline .select2-search__field { + outline: 0; + box-shadow: none; } + +.select2-container--classic .select2-dropdown { + background-color: white; + border: 1px solid transparent; } + +.select2-container--classic .select2-dropdown--above { + border-bottom: none; } + +.select2-container--classic .select2-dropdown--below { + border-top: none; } + +.select2-container--classic .select2-results > .select2-results__options { + max-height: 200px; + overflow-y: auto; } + +.select2-container--classic .select2-results__option[role=group] { + padding: 0; } + +.select2-container--classic .select2-results__option[aria-disabled=true] { + color: grey; } + +.select2-container--classic .select2-results__option--highlighted[aria-selected] { + background-color: #3875d7; + color: white; } + +.select2-container--classic .select2-results__group { + cursor: default; + display: block; + padding: 6px; } + +.select2-container--classic.select2-container--open .select2-dropdown { + border-color: #5897fb; } diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.js b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.js new file mode 100755 index 00000000..fcfb5ab4 --- /dev/null +++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/select2.js @@ -0,0 +1,6108 @@ +/*! + * Select2 4.0.13 + * https://select2.github.io + * + * Released under the MIT license + * https://github.com/select2/select2/blob/master/LICENSE.md + */ +;(function (factory) { + if (typeof define === 'function' && define.amd) { + // AMD. Register as an anonymous module. + define(['jquery'], factory); + } else if (typeof module === 'object' && module.exports) { + // Node/CommonJS + module.exports = function (root, jQuery) { + if (jQuery === undefined) { + // require('jQuery') returns a factory that requires window to + // build a jQuery instance, we normalize how we use modules + // that require this pattern but the window provided is a noop + // if it's defined (how jquery works) + if (typeof window !== 'undefined') { + jQuery = require('jquery'); + } + else { + jQuery = require('jquery')(root); + } + } + factory(jQuery); + return jQuery; + }; + } else { + // Browser globals + factory(jQuery); + } +} (function (jQuery) { + // This is needed so we can catch the AMD loader configuration and use it + // The inner file should be wrapped (by `banner.start.js`) in a function that + // returns the AMD loader references. + var S2 =(function () { + // Restore the Select2 AMD loader so it can be used + // Needed mostly in the language files, where the loader is not inserted + if (jQuery && jQuery.fn && jQuery.fn.select2 && jQuery.fn.select2.amd) { + var S2 = jQuery.fn.select2.amd; + } +var S2;(function () { if (!S2 || !S2.requirejs) { +if (!S2) { S2 = {}; } else { require = S2; } +/** + * @license almond 0.3.3 Copyright jQuery Foundation and other contributors. + * Released under MIT license, http://github.com/requirejs/almond/LICENSE + */ +//Going sloppy to avoid 'use strict' string cost, but strict practices should +//be followed. +/*global setTimeout: false */ + +var requirejs, require, define; +(function (undef) { + var main, req, makeMap, handlers, + defined = {}, + waiting = {}, + config = {}, + defining = {}, + hasOwn = Object.prototype.hasOwnProperty, + aps = [].slice, + jsSuffixRegExp = /\.js$/; + + function hasProp(obj, prop) { + return hasOwn.call(obj, prop); + } + + /** + * Given a relative module name, like ./something, normalize it to + * a real name that can be mapped to a path. + * @param {String} name the relative name + * @param {String} baseName a real name that the name arg is relative + * to. + * @returns {String} normalized name + */ + function normalize(name, baseName) { + var nameParts, nameSegment, mapValue, foundMap, lastIndex, + foundI, foundStarMap, starI, i, j, part, normalizedBaseParts, + baseParts = baseName && baseName.split("/"), + map = config.map, + starMap = (map && map['*']) || {}; + + //Adjust any relative paths. + if (name) { + name = name.split('/'); + lastIndex = name.length - 1; + + // If wanting node ID compatibility, strip .js from end + // of IDs. Have to do this here, and not in nameToUrl + // because node allows either .js or non .js to map + // to same file. + if (config.nodeIdCompat && jsSuffixRegExp.test(name[lastIndex])) { + name[lastIndex] = name[lastIndex].replace(jsSuffixRegExp, ''); + } + + // Starts with a '.' so need the baseName + if (name[0].charAt(0) === '.' && baseParts) { + //Convert baseName to array, and lop off the last part, + //so that . matches that 'directory' and not name of the baseName's + //module. For instance, baseName of 'one/two/three', maps to + //'one/two/three.js', but we want the directory, 'one/two' for + //this normalization. + normalizedBaseParts = baseParts.slice(0, baseParts.length - 1); + name = normalizedBaseParts.concat(name); + } + + //start trimDots + for (i = 0; i < name.length; i++) { + part = name[i]; + if (part === '.') { + name.splice(i, 1); + i -= 1; + } else if (part === '..') { + // If at the start, or previous value is still .., + // keep them so that when converted to a path it may + // still work when converted to a path, even though + // as an ID it is less than ideal. In larger point + // releases, may be better to just kick out an error. + if (i === 0 || (i === 1 && name[2] === '..') || name[i - 1] === '..') { + continue; + } else if (i > 0) { + name.splice(i - 1, 2); + i -= 2; + } + } + } + //end trimDots + + name = name.join('/'); + } + + //Apply map config if available. + if ((baseParts || starMap) && map) { + nameParts = name.split('/'); + + for (i = nameParts.length; i > 0; i -= 1) { + nameSegment = nameParts.slice(0, i).join("/"); + + if (baseParts) { + //Find the longest baseName segment match in the config. + //So, do joins on the biggest to smallest lengths of baseParts. + for (j = baseParts.length; j > 0; j -= 1) { + mapValue = map[baseParts.slice(0, j).join('/')]; + + //baseName segment has config, find if it has one for + //this name. + if (mapValue) { + mapValue = mapValue[nameSegment]; + if (mapValue) { + //Match, update name to the new value. + foundMap = mapValue; + foundI = i; + break; + } + } + } + } + + if (foundMap) { + break; + } + + //Check for a star map match, but just hold on to it, + //if there is a shorter segment match later in a matching + //config, then favor over this star map. + if (!foundStarMap && starMap && starMap[nameSegment]) { + foundStarMap = starMap[nameSegment]; + starI = i; + } + } + + if (!foundMap && foundStarMap) { + foundMap = foundStarMap; + foundI = starI; + } + + if (foundMap) { + nameParts.splice(0, foundI, foundMap); + name = nameParts.join('/'); + } + } + + return name; + } + + function makeRequire(relName, forceSync) { + return function () { + //A version of a require function that passes a moduleName + //value for items that may need to + //look up paths relative to the moduleName + var args = aps.call(arguments, 0); + + //If first arg is not require('string'), and there is only + //one arg, it is the array form without a callback. Insert + //a null so that the following concat is correct. + if (typeof args[0] !== 'string' && args.length === 1) { + args.push(null); + } + return req.apply(undef, args.concat([relName, forceSync])); + }; + } + + function makeNormalize(relName) { + return function (name) { + return normalize(name, relName); + }; + } + + function makeLoad(depName) { + return function (value) { + defined[depName] = value; + }; + } + + function callDep(name) { + if (hasProp(waiting, name)) { + var args = waiting[name]; + delete waiting[name]; + defining[name] = true; + main.apply(undef, args); + } + + if (!hasProp(defined, name) && !hasProp(defining, name)) { + throw new Error('No ' + name); + } + return defined[name]; + } + + //Turns a plugin!resource to [plugin, resource] + //with the plugin being undefined if the name + //did not have a plugin prefix. + function splitPrefix(name) { + var prefix, + index = name ? name.indexOf('!') : -1; + if (index > -1) { + prefix = name.substring(0, index); + name = name.substring(index + 1, name.length); + } + return [prefix, name]; + } + + //Creates a parts array for a relName where first part is plugin ID, + //second part is resource ID. Assumes relName has already been normalized. + function makeRelParts(relName) { + return relName ? splitPrefix(relName) : []; + } + + /** + * Makes a name map, normalizing the name, and using a plugin + * for normalization if necessary. Grabs a ref to plugin + * too, as an optimization. + */ + makeMap = function (name, relParts) { + var plugin, + parts = splitPrefix(name), + prefix = parts[0], + relResourceName = relParts[1]; + + name = parts[1]; + + if (prefix) { + prefix = normalize(prefix, relResourceName); + plugin = callDep(prefix); + } + + //Normalize according + if (prefix) { + if (plugin && plugin.normalize) { + name = plugin.normalize(name, makeNormalize(relResourceName)); + } else { + name = normalize(name, relResourceName); + } + } else { + name = normalize(name, relResourceName); + parts = splitPrefix(name); + prefix = parts[0]; + name = parts[1]; + if (prefix) { + plugin = callDep(prefix); + } + } + + //Using ridiculous property names for space reasons + return { + f: prefix ? prefix + '!' + name : name, //fullName + n: name, + pr: prefix, + p: plugin + }; + }; + + function makeConfig(name) { + return function () { + return (config && config.config && config.config[name]) || {}; + }; + } + + handlers = { + require: function (name) { + return makeRequire(name); + }, + exports: function (name) { + var e = defined[name]; + if (typeof e !== 'undefined') { + return e; + } else { + return (defined[name] = {}); + } + }, + module: function (name) { + return { + id: name, + uri: '', + exports: defined[name], + config: makeConfig(name) + }; + } + }; + + main = function (name, deps, callback, relName) { + var cjsModule, depName, ret, map, i, relParts, + args = [], + callbackType = typeof callback, + usingExports; + + //Use name if no relName + relName = relName || name; + relParts = makeRelParts(relName); + + //Call the callback to define the module, if necessary. + if (callbackType === 'undefined' || callbackType === 'function') { + //Pull out the defined dependencies and pass the ordered + //values to the callback. + //Default to [require, exports, module] if no deps + deps = !deps.length && callback.length ? ['require', 'exports', 'module'] : deps; + for (i = 0; i < deps.length; i += 1) { + map = makeMap(deps[i], relParts); + depName = map.f; + + //Fast path CommonJS standard dependencies. + if (depName === "require") { + args[i] = handlers.require(name); + } else if (depName === "exports") { + //CommonJS module spec 1.1 + args[i] = handlers.exports(name); + usingExports = true; + } else if (depName === "module") { + //CommonJS module spec 1.1 + cjsModule = args[i] = handlers.module(name); + } else if (hasProp(defined, depName) || + hasProp(waiting, depName) || + hasProp(defining, depName)) { + args[i] = callDep(depName); + } else if (map.p) { + map.p.load(map.n, makeRequire(relName, true), makeLoad(depName), {}); + args[i] = defined[depName]; + } else { + throw new Error(name + ' missing ' + depName); + } + } + + ret = callback ? callback.apply(defined[name], args) : undefined; + + if (name) { + //If setting exports via "module" is in play, + //favor that over return value and exports. After that, + //favor a non-undefined return value over exports use. + if (cjsModule && cjsModule.exports !== undef && + cjsModule.exports !== defined[name]) { + defined[name] = cjsModule.exports; + } else if (ret !== undef || !usingExports) { + //Use the return value from the function. + defined[name] = ret; + } + } + } else if (name) { + //May just be an object definition for the module. Only + //worry about defining if have a module name. + defined[name] = callback; + } + }; + + requirejs = require = req = function (deps, callback, relName, forceSync, alt) { + if (typeof deps === "string") { + if (handlers[deps]) { + //callback in this case is really relName + return handlers[deps](callback); + } + //Just return the module wanted. In this scenario, the + //deps arg is the module name, and second arg (if passed) + //is just the relName. + //Normalize module name, if it contains . or .. + return callDep(makeMap(deps, makeRelParts(callback)).f); + } else if (!deps.splice) { + //deps is a config object, not an array. + config = deps; + if (config.deps) { + req(config.deps, config.callback); + } + if (!callback) { + return; + } + + if (callback.splice) { + //callback is an array, which means it is a dependency list. + //Adjust args if there are dependencies + deps = callback; + callback = relName; + relName = null; + } else { + deps = undef; + } + } + + //Support require(['a']) + callback = callback || function () {}; + + //If relName is a function, it is an errback handler, + //so remove it. + if (typeof relName === 'function') { + relName = forceSync; + forceSync = alt; + } + + //Simulate async callback; + if (forceSync) { + main(undef, deps, callback, relName); + } else { + //Using a non-zero value because of concern for what old browsers + //do, and latest browsers "upgrade" to 4 if lower value is used: + //http://www.whatwg.org/specs/web-apps/current-work/multipage/timers.html#dom-windowtimers-settimeout: + //If want a value immediately, use require('id') instead -- something + //that works in almond on the global level, but not guaranteed and + //unlikely to work in other AMD implementations. + setTimeout(function () { + main(undef, deps, callback, relName); + }, 4); + } + + return req; + }; + + /** + * Just drops the config on the floor, but returns req in case + * the config return value is used. + */ + req.config = function (cfg) { + return req(cfg); + }; + + /** + * Expose module registry for debugging and tooling + */ + requirejs._defined = defined; + + define = function (name, deps, callback) { + if (typeof name !== 'string') { + throw new Error('See almond README: incorrect module build, no module name'); + } + + //This module may not have dependencies + if (!deps.splice) { + //deps is not an array, so probably means + //an object literal or factory function for + //the value. Adjust args. + callback = deps; + deps = []; + } + + if (!hasProp(defined, name) && !hasProp(waiting, name)) { + waiting[name] = [name, deps, callback]; + } + }; + + define.amd = { + jQuery: true + }; +}()); + +S2.requirejs = requirejs;S2.require = require;S2.define = define; +} +}()); +S2.define("almond", function(){}); + +/* global jQuery:false, $:false */ +S2.define('jquery',[],function () { + var _$ = jQuery || $; + + if (_$ == null && console && console.error) { + console.error( + 'Select2: An instance of jQuery or a jQuery-compatible library was not ' + + 'found. Make sure that you are including jQuery before Select2 on your ' + + 'web page.' + ); + } + + return _$; +}); + +S2.define('select2/utils',[ + 'jquery' +], function ($) { + var Utils = {}; + + Utils.Extend = function (ChildClass, SuperClass) { + var __hasProp = {}.hasOwnProperty; + + function BaseConstructor () { + this.constructor = ChildClass; + } + + for (var key in SuperClass) { + if (__hasProp.call(SuperClass, key)) { + ChildClass[key] = SuperClass[key]; + } + } + + BaseConstructor.prototype = SuperClass.prototype; + ChildClass.prototype = new BaseConstructor(); + ChildClass.__super__ = SuperClass.prototype; + + return ChildClass; + }; + + function getMethods (theClass) { + var proto = theClass.prototype; + + var methods = []; + + for (var methodName in proto) { + var m = proto[methodName]; + + if (typeof m !== 'function') { + continue; + } + + if (methodName === 'constructor') { + continue; + } + + methods.push(methodName); + } + + return methods; + } + + Utils.Decorate = function (SuperClass, DecoratorClass) { + var decoratedMethods = getMethods(DecoratorClass); + var superMethods = getMethods(SuperClass); + + function DecoratedClass () { + var unshift = Array.prototype.unshift; + + var argCount = DecoratorClass.prototype.constructor.length; + + var calledConstructor = SuperClass.prototype.constructor; + + if (argCount > 0) { + unshift.call(arguments, SuperClass.prototype.constructor); + + calledConstructor = DecoratorClass.prototype.constructor; + } + + calledConstructor.apply(this, arguments); + } + + DecoratorClass.displayName = SuperClass.displayName; + + function ctr () { + this.constructor = DecoratedClass; + } + + DecoratedClass.prototype = new ctr(); + + for (var m = 0; m < superMethods.length; m++) { + var superMethod = superMethods[m]; + + DecoratedClass.prototype[superMethod] = + SuperClass.prototype[superMethod]; + } + + var calledMethod = function (methodName) { + // Stub out the original method if it's not decorating an actual method + var originalMethod = function () {}; + + if (methodName in DecoratedClass.prototype) { + originalMethod = DecoratedClass.prototype[methodName]; + } + + var decoratedMethod = DecoratorClass.prototype[methodName]; + + return function () { + var unshift = Array.prototype.unshift; + + unshift.call(arguments, originalMethod); + + return decoratedMethod.apply(this, arguments); + }; + }; + + for (var d = 0; d < decoratedMethods.length; d++) { + var decoratedMethod = decoratedMethods[d]; + + DecoratedClass.prototype[decoratedMethod] = calledMethod(decoratedMethod); + } + + return DecoratedClass; + }; + + var Observable = function () { + this.listeners = {}; + }; + + Observable.prototype.on = function (event, callback) { + this.listeners = this.listeners || {}; + + if (event in this.listeners) { + this.listeners[event].push(callback); + } else { + this.listeners[event] = [callback]; + } + }; + + Observable.prototype.trigger = function (event) { + var slice = Array.prototype.slice; + var params = slice.call(arguments, 1); + + this.listeners = this.listeners || {}; + + // Params should always come in as an array + if (params == null) { + params = []; + } + + // If there are no arguments to the event, use a temporary object + if (params.length === 0) { + params.push({}); + } + + // Set the `_type` of the first object to the event + params[0]._type = event; + + if (event in this.listeners) { + this.invoke(this.listeners[event], slice.call(arguments, 1)); + } + + if ('*' in this.listeners) { + this.invoke(this.listeners['*'], arguments); + } + }; + + Observable.prototype.invoke = function (listeners, params) { + for (var i = 0, len = listeners.length; i < len; i++) { + listeners[i].apply(this, params); + } + }; + + Utils.Observable = Observable; + + Utils.generateChars = function (length) { + var chars = ''; + + for (var i = 0; i < length; i++) { + var randomChar = Math.floor(Math.random() * 36); + chars += randomChar.toString(36); + } + + return chars; + }; + + Utils.bind = function (func, context) { + return function () { + func.apply(context, arguments); + }; + }; + + Utils._convertData = function (data) { + for (var originalKey in data) { + var keys = originalKey.split('-'); + + var dataLevel = data; + + if (keys.length === 1) { + continue; + } + + for (var k = 0; k < keys.length; k++) { + var key = keys[k]; + + // Lowercase the first letter + // By default, dash-separated becomes camelCase + key = key.substring(0, 1).toLowerCase() + key.substring(1); + + if (!(key in dataLevel)) { + dataLevel[key] = {}; + } + + if (k == keys.length - 1) { + dataLevel[key] = data[originalKey]; + } + + dataLevel = dataLevel[key]; + } + + delete data[originalKey]; + } + + return data; + }; + + Utils.hasScroll = function (index, el) { + // Adapted from the function created by @ShadowScripter + // and adapted by @BillBarry on the Stack Exchange Code Review website. + // The original code can be found at + // http://codereview.stackexchange.com/q/13338 + // and was designed to be used with the Sizzle selector engine. + + var $el = $(el); + var overflowX = el.style.overflowX; + var overflowY = el.style.overflowY; + + //Check both x and y declarations + if (overflowX === overflowY && + (overflowY === 'hidden' || overflowY === 'visible')) { + return false; + } + + if (overflowX === 'scroll' || overflowY === 'scroll') { + return true; + } + + return ($el.innerHeight() < el.scrollHeight || + $el.innerWidth() < el.scrollWidth); + }; + + Utils.escapeMarkup = function (markup) { + var replaceMap = { + '\\': '\', + '&': '&', + '<': '<', + '>': '>', + '"': '"', + '\'': ''', + '/': '/' + }; + + // Do not try to escape the markup if it's not a string + if (typeof markup !== 'string') { + return markup; + } + + return String(markup).replace(/[&<>"'\/\\]/g, function (match) { + return replaceMap[match]; + }); + }; + + // Append an array of jQuery nodes to a given element. + Utils.appendMany = function ($element, $nodes) { + // jQuery 1.7.x does not support $.fn.append() with an array + // Fall back to a jQuery object collection using $.fn.add() + if ($.fn.jquery.substr(0, 3) === '1.7') { + var $jqNodes = $(); + + $.map($nodes, function (node) { + $jqNodes = $jqNodes.add(node); + }); + + $nodes = $jqNodes; + } + + $element.append($nodes); + }; + + // Cache objects in Utils.__cache instead of $.data (see #4346) + Utils.__cache = {}; + + var id = 0; + Utils.GetUniqueElementId = function (element) { + // Get a unique element Id. If element has no id, + // creates a new unique number, stores it in the id + // attribute and returns the new id. + // If an id already exists, it simply returns it. + + var select2Id = element.getAttribute('data-select2-id'); + if (select2Id == null) { + // If element has id, use it. + if (element.id) { + select2Id = element.id; + element.setAttribute('data-select2-id', select2Id); + } else { + element.setAttribute('data-select2-id', ++id); + select2Id = id.toString(); + } + } + return select2Id; + }; + + Utils.StoreData = function (element, name, value) { + // Stores an item in the cache for a specified element. + // name is the cache key. + var id = Utils.GetUniqueElementId(element); + if (!Utils.__cache[id]) { + Utils.__cache[id] = {}; + } + + Utils.__cache[id][name] = value; + }; + + Utils.GetData = function (element, name) { + // Retrieves a value from the cache by its key (name) + // name is optional. If no name specified, return + // all cache items for the specified element. + // and for a specified element. + var id = Utils.GetUniqueElementId(element); + if (name) { + if (Utils.__cache[id]) { + if (Utils.__cache[id][name] != null) { + return Utils.__cache[id][name]; + } + return $(element).data(name); // Fallback to HTML5 data attribs. + } + return $(element).data(name); // Fallback to HTML5 data attribs. + } else { + return Utils.__cache[id]; + } + }; + + Utils.RemoveData = function (element) { + // Removes all cached items for a specified element. + var id = Utils.GetUniqueElementId(element); + if (Utils.__cache[id] != null) { + delete Utils.__cache[id]; + } + + element.removeAttribute('data-select2-id'); + }; + + return Utils; +}); + +S2.define('select2/results',[ + 'jquery', + './utils' +], function ($, Utils) { + function Results ($element, options, dataAdapter) { + this.$element = $element; + this.data = dataAdapter; + this.options = options; + + Results.__super__.constructor.call(this); + } + + Utils.Extend(Results, Utils.Observable); + + Results.prototype.render = function () { + var $results = $( + '' + ); + + if (this.options.get('multiple')) { + $results.attr('aria-multiselectable', 'true'); + } + + this.$results = $results; + + return $results; + }; + + Results.prototype.clear = function () { + this.$results.empty(); + }; + + Results.prototype.displayMessage = function (params) { + var escapeMarkup = this.options.get('escapeMarkup'); + + this.clear(); + this.hideLoading(); + + var $message = $( + '' + ); + + var message = this.options.get('translations').get(params.message); + + $message.append( + escapeMarkup( + message(params.args) + ) + ); + + $message[0].className += ' select2-results__message'; + + this.$results.append($message); + }; + + Results.prototype.hideMessages = function () { + this.$results.find('.select2-results__message').remove(); + }; + + Results.prototype.append = function (data) { + this.hideLoading(); + + var $options = []; + + if (data.results == null || data.results.length === 0) { + if (this.$results.children().length === 0) { + this.trigger('results:message', { + message: 'noResults' + }); + } + + return; + } + + data.results = this.sort(data.results); + + for (var d = 0; d < data.results.length; d++) { + var item = data.results[d]; + + var $option = this.option(item); + + $options.push($option); + } + + this.$results.append($options); + }; + + Results.prototype.position = function ($results, $dropdown) { + var $resultsContainer = $dropdown.find('.select2-results'); + $resultsContainer.append($results); + }; + + Results.prototype.sort = function (data) { + var sorter = this.options.get('sorter'); + + return sorter(data); + }; + + Results.prototype.highlightFirstItem = function () { + var $options = this.$results + .find('.select2-results__option[aria-selected]'); + + var $selected = $options.filter('[aria-selected=true]'); + + // Check if there are any selected options + if ($selected.length > 0) { + // If there are selected options, highlight the first + $selected.first().trigger('mouseenter'); + } else { + // If there are no selected options, highlight the first option + // in the dropdown + $options.first().trigger('mouseenter'); + } + + this.ensureHighlightVisible(); + }; + + Results.prototype.setClasses = function () { + var self = this; + + this.data.current(function (selected) { + var selectedIds = $.map(selected, function (s) { + return s.id.toString(); + }); + + var $options = self.$results + .find('.select2-results__option[aria-selected]'); + + $options.each(function () { + var $option = $(this); + + var item = Utils.GetData(this, 'data'); + + // id needs to be converted to a string when comparing + var id = '' + item.id; + + if ((item.element != null && item.element.selected) || + (item.element == null && $.inArray(id, selectedIds) > -1)) { + $option.attr('aria-selected', 'true'); + } else { + $option.attr('aria-selected', 'false'); + } + }); + + }); + }; + + Results.prototype.showLoading = function (params) { + this.hideLoading(); + + var loadingMore = this.options.get('translations').get('searching'); + + var loading = { + disabled: true, + loading: true, + text: loadingMore(params) + }; + var $loading = this.option(loading); + $loading.className += ' loading-results'; + + this.$results.prepend($loading); + }; + + Results.prototype.hideLoading = function () { + this.$results.find('.loading-results').remove(); + }; + + Results.prototype.option = function (data) { + var option = document.createElement('li'); + option.className = 'select2-results__option'; + + var attrs = { + 'role': 'option', + 'aria-selected': 'false' + }; + + var matches = window.Element.prototype.matches || + window.Element.prototype.msMatchesSelector || + window.Element.prototype.webkitMatchesSelector; + + if ((data.element != null && matches.call(data.element, ':disabled')) || + (data.element == null && data.disabled)) { + delete attrs['aria-selected']; + attrs['aria-disabled'] = 'true'; + } + + if (data.id == null) { + delete attrs['aria-selected']; + } + + if (data._resultId != null) { + option.id = data._resultId; + } + + if (data.title) { + option.title = data.title; + } + + if (data.children) { + attrs.role = 'group'; + attrs['aria-label'] = data.text; + delete attrs['aria-selected']; + } + + for (var attr in attrs) { + var val = attrs[attr]; + + option.setAttribute(attr, val); + } + + if (data.children) { + var $option = $(option); + + var label = document.createElement('strong'); + label.className = 'select2-results__group'; + + var $label = $(label); + this.template(data, label); + + var $children = []; + + for (var c = 0; c < data.children.length; c++) { + var child = data.children[c]; + + var $child = this.option(child); + + $children.push($child); + } + + var $childrenContainer = $('" . sprintf(__('Add the following code to the file %s', 'all-in-one-wp-security-and-firewall'), $this->get_file_path()) . "\n" . '
' . nl2br(esc_html($this->get_contents())) . '' . __('Once you have added the above code then press the button to turn on encryption again', 'all-in-one-wp-security-and-firewall'), + $info['dirname'] + ); + } + + return true; + } + + /** + * This function creates the contents for the mu-plugin + * + * @return string - the contents of the mu-plugin + */ + public function get_contents() { + $encryption_key = base64_encode($this->simba_tfa->random_bytes(16)); + $code = "0) { + styling = 'margin-left: 4px; position: relative; top: 4px; width: 20px; height: 20px; border:0px; box-shadow:none;'; + } + $submit_button.after('
'+simba_tfasettings.error+'
'); + } + } + }); + return true; + } + + // Parameters: see check_and_possibly_show_otp_field + function show_otp_field(form, user_can_trust, user_already_trusted) { + + var $submit_button; + + user_can_trust = ('undefined' == typeof user_can_trust) ? false : user_can_trust; + user_already_trusted = ('undefined' == typeof user_already_trusted) ? false : user_already_trusted; + + if ('https:' != window.location.protocol && 'localhost' !== location.hostname && '127.0.0.1' !== location.hostname && /^\.localdomain$/.test(location.hostname)) { + user_can_trust = false; + } + + if (!user_can_trust) { user_already_trusted = false; } + + var form_is_gravity_forms = ('object' == typeof window['gform_gravityforms'] && 'undefined' !== typeof $(form).attr('id') && 'gform_' === $(form).attr('id').substring(0, 6)); + + // This is used just for applying similar styling (via adding structure/CSS classes) + var form_is_ultimate_member = ($(form).find('.um-row').length > 0) ? true : false; + + // This is used just for applying styling if .js-login-form class exists inside form + var form_is_login_form = ($(form).find('.js-login-form').length > 0) ? true : false; + + // Gravity Forms won't submit if the elements are hidden + var form_retain_existing_elements = form_is_gravity_forms ? true : false; + + // name="Submit" is WP-Members. 'submit' is Theme My Login starting from 7.x + $submit_button = $(form).find('input[name="wp-submit"], input[name="Submit"], input[name="submit"]'); + // This hasn't been needed for anything yet (Jul 2018), but is a decent back-stop that would have prevented some breakage in the past that needed manual attention: + if (0 == $submit_button.length) { + $submit_button = $(form).find('input[type="submit"], button[type="submit"]').first(); + } + + if (!form_retain_existing_elements) { + // Hide all elements in a browser-safe way + // .user-pass-wrap is the wrapper used (instead of a paragraph) on wp-login.php from WP 5.3 + // .um-row : Ultimate Member + // .rmrow : RegistrationMagic + $submit_button.parents('form').first().find('p, .impu-form-line-fr, .tml-field-wrap, .user-pass-wrap, .elementor-field-type-text, .elementor-field-type-submit, .elementor-remember-me, .bbp-username, .bbp-password, .bbp-submit-wrapper, .gform_body, .um-row, .um-button, .js-login-form, .rmrow').each(function(i) { + $(this).css('visibility', 'hidden').css('position', 'absolute'); + // On the WooCommerce form, the 'required' asterisk in the child still shows without this + $(this).find('span').css('visibility', 'hidden').css('position', 'absolute'); + }); + + // WP-Members + $submit_button.parents('#wpmem_login').find('fieldset').css('visibility', 'hidden').css('position', 'absolute'); + + } + + // Add new field and controls + var html = ''; + + if (form_is_ultimate_member) { + html += '';
+ }
+
+ if (user_already_trusted) {
+
+ html += '
'+simba_tfasettings.is_trusted+''; + + } else { + + if (form_is_ultimate_member) { html += ' BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/README.markdown b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/README.markdown
new file mode 100755
index 00000000..59b2b416
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/README.markdown
@@ -0,0 +1,27 @@
+HOTP - PHP Based HMAC One Time Passwords
+========================================
+
+**What is HOTP**:
+HOTP is a class that simplifies One Time Password systems for PHP Authentication. The HOTP/TOTP Algorithms have been around for a bit, so this is a straightforward class to meet the test vector requirements.
+
+**What works with HOTP/TOTP**:
+It's been tested to the test vectors, and I've verified the time-sync hashes against the following:
+
+* Android: Mobile-OTP
+* iPhone: OATH Token
+
+**Why would I use this**:
+Who wouldn't love a simple drop-in class for HMAC Based One Time Passwords? It's a great extra layer of security (creating two-factor auth) and it's pretty darn zippy.
+
+**Okay you sold me. Give me some docs**:
+
+* $result = HOTP::generateByCounter($key, $counter); // event based
+* $result = HOTP::generateByTime($key, $window); // time based within a "window" of time
+* $result = HOTP::generateByTimeWindow($key, $window, $min, $max); // same as generateByTime, but for $min windows before and $max windows after
+
+with $result, you can do all sorts of neat things...
+
+* $result->toString();
+* $result->toHex();
+* $result->doDec();
+* $result->toHotp($length); // how many digits in your OTP?
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/example.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/example.php
new file mode 100755
index 00000000..44c05753
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/example.php
@@ -0,0 +1,160 @@
+ array(
+ 0 => array(
+ 'HMAC' => 'cc93cf18508d94934c64b65d8ba7667fb7cde4b0',
+ 'hex' => '4c93cf18',
+ 'dec' => '1284755224',
+ 'hotp' => '755224',
+ ),
+ 1 => array(
+ 'HMAC' => '75a48a19d4cbe100644e8ac1397eea747a2d33ab',
+ 'hex' => '41397eea',
+ 'dec' => '1094287082',
+ 'hotp' => '287082',
+ ),
+ 2 => array(
+ 'HMAC' => '0bacb7fa082fef30782211938bc1c5e70416ff44',
+ 'hex' => '82fef30',
+ 'dec' => '137359152',
+ 'hotp' => '359152',
+ ),
+ 3 => array(
+ 'HMAC' => '66c28227d03a2d5529262ff016a1e6ef76557ece',
+ 'hex' => '66ef7655',
+ 'dec' => '1726969429',
+ 'hotp' => '969429',
+ ),
+ 4 => array(
+ 'HMAC' => 'a904c900a64b35909874b33e61c5938a8e15ed1c',
+ 'hex' => '61c5938a',
+ 'dec' => '1640338314',
+ 'hotp' => '338314',
+ ),
+ 5 => array(
+ 'HMAC' => 'a37e783d7b7233c083d4f62926c7a25f238d0316',
+ 'hex' => '33c083d4',
+ 'dec' => '868254676',
+ 'hotp' => '254676',
+ ),
+ 6 => array(
+ 'HMAC' => 'bc9cd28561042c83f219324d3c607256c03272ae',
+ 'hex' => '7256c032',
+ 'dec' => '1918287922',
+ 'hotp' => '287922',
+ ),
+ 7 => array(
+ 'HMAC' => 'a4fb960c0bc06e1eabb804e5b397cdc4b45596fa',
+ 'hex' => '4e5b397',
+ 'dec' => '82162583',
+ 'hotp' => '162583',
+ ),
+ 8 => array(
+ 'HMAC' => '1b3c89f65e6c9e883012052823443f048b4332db',
+ 'hex' => '2823443f',
+ 'dec' => '673399871',
+ 'hotp' => '399871',
+ ),
+ 9 => array(
+ 'HMAC' => '1637409809a679dc698207310c8c7fc07290d9e5',
+ 'hex' => '2679dc69',
+ 'dec' => '645520489',
+ 'hotp' => '520489',
+ ),
+ ),
+ 'TOTP' => array(
+ '59' => array(
+ 'totp' => '94287082',
+ ),
+ '1111111109' => array(
+ 'totp' => '07081804',
+ ),
+ '1111111111' => array(
+ 'totp' => '14050471',
+ ),
+ '1234567890' => array(
+ 'totp' => '89005924',
+ ),
+ '2000000000' => array(
+ 'totp' => '69279037',
+ ),
+ ),
+ );
+
+echo <<
\n"; + } + } + + /** + * Print out the advanced settings box - choice of algorithm + * + * @param Boolean|Callable $submit_button_callback - if not a callback, then
+
+
+
+
+
+
+
+
+
+
+
+
+
+add('empty_username', __('ERROR: Enter a username or email address.'));
+ } elseif (strpos(sanitize_email(wp_unslash($_POST['user_login'])), '@')) {
+ $user_data = get_user_by('email', trim(sanitize_email(wp_unslash($_POST['user_login']))));
+ if (empty($user_data))
+ $errors->add('invalid_email', __('ERROR: There is no account with that username or email address.'));
+ } else {
+ $login = trim(sanitize_email(wp_unslash($_POST['user_login'])));
+ $user_data = get_user_by('login', $login);
+ }
+ // phpcs:enable WordPress.Security.NonceVerification.Missing -- No nonce available.
+
+ /**
+ * Fires before errors are returned from a password reset request.
+ *
+ * @since 2.1.0
+ * @since 4.4.0 Added the `$errors` parameter.
+ *
+ * @param WP_Error $errors A WP_Error object containing any errors generated
+ * by using invalid credentials.
+ */
+ do_action('lostpassword_post', $errors);
+
+ if ($errors->get_error_code())
+ return $errors;
+
+ if (!$user_data) {
+ $errors->add('invalidcombo', __('ERROR: There is no account with that username or email address.'));
+ return $errors;
+ }
+
+ // Redefining user_login ensures we return the right case in the email.
+ $user_login = $user_data->user_login;
+ $user_email = $user_data->user_email;
+ $key = get_password_reset_key($user_data);
+
+ if (is_wp_error($key)) {
+ return $key;
+ }
+
+ if (is_multisite()) {
+ $site_name = get_network()->site_name;
+ } else {
+ /*
+ * The blogname option is escaped with esc_html on the way into the database
+ * in sanitize_option we want to reverse this for the plain text arena of emails.
+ */
+ $site_name = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
+ }
+
+ $message = __('Someone has requested a password reset for the following account:') . "\r\n\r\n";
+ /* translators: %s: site name */
+ $message .= sprintf(__('Site Name: %s'), $site_name) . "\r\n\r\n";
+ /* translators: %s: user login */
+ $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
+ $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n";
+ $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
+ $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";
+
+ // translators: Password reset email subject. %s: Site name
+ $title = sprintf(__('[%s] Password Reset'), $site_name);
+
+ /**
+ * Filters the subject of the password reset email.
+ *
+ * @since 2.8.0
+ * @since 4.4.0 Added the `$user_login` and `$user_data` parameters.
+ *
+ * @param string $title Default email title.
+ * @param string $user_login The username for the user.
+ * @param WP_User $user_data WP_User object.
+ */
+ $title = apply_filters('retrieve_password_title', $title, $user_login, $user_data);
+
+ /**
+ * Filter the message body of the password reset mail.
+ *
+ * If the filtered message is empty, the password reset email will not be sent.
+ *
+ * @since 2.8.0
+ * @since 4.1.0 Added `$user_login` and `$user_data` parameters.
+ *
+ * @param string $message Default mail message.
+ * @param string $key The activation key.
+ * @param string $user_login The username for the user.
+ * @param WP_User $user_data WP_User object.
+ */
+ $message = apply_filters('retrieve_password_message', $message, $key, $user_login, $user_data);
+
+ if ($message && !wp_mail($user_email, wp_specialchars_decode($title), $message))
+ wp_die(esc_html__('The email could not be sent.') . "
\n" . esc_html__('Possible reason: your host may have disabled the mail() function.')); + + return true; +} + +// +// Main +// +// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce available. +$action = isset($_REQUEST['action']) ? sanitize_text_field(wp_unslash($_REQUEST['action'])) : 'login'; +$errors = new WP_Error(); + +if (isset($_GET['key'])) + $action = 'resetpass'; + +// validate action so as to default to the login screen +if (!in_array($action, array('postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction'), true) && false === has_filter('login_form_' . $action)) + $action = 'login'; + +nocache_headers(); + +header('Content-Type: '.get_bloginfo('html_type').'; charset='.get_bloginfo('charset')); + +if (defined('RELOCATE') && RELOCATE) { // Move flag is set + $path_info = isset($_SERVER['PATH_INFO']) ? sanitize_text_field(wp_unslash($_SERVER['PATH_INFO'])) : ''; + $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : ''; + + if ('' !== $path_info && ($path_info != $php_self)) + $_SERVER['PHP_SELF'] = str_replace($path_info, '', $php_self); + + $url = dirname(set_url_scheme('http://' . isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '' . $php_self)); + if (get_option('siteurl') != $url) + update_option('siteurl', $url); +} + +setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); +if (SITECOOKIEPATH != COOKIEPATH) + setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); + +$lang = ! empty($_GET['wp_lang']) ? sanitize_text_field(wp_unslash($_GET['wp_lang'])) : ''; +$switched_locale = false; + +if (function_exists('switch_to_locale')) { + $switched_locale = switch_to_locale($lang); +} + +/** + * Fires when the login form is initialized. + * + * @since 3.2.0 + */ +do_action('login_init'); + +/** + * Fires before a specified login form action. + * + * The dynamic portion of the hook name, `$action`, refers to the action + * that brought the visitor to the login form. Actions include 'postpass', + * 'logout', 'lostpassword', etc. + * + * @since 2.8.0 + */ +do_action("login_form_{$action}"); + +$http_post = ('POST' == isset($_SERVER['REQUEST_METHOD']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD'])) : ''); +$interim_login = isset($_REQUEST['interim-login']); + +/** + * Filters the separator used between login form navigation links. + * + * @since 4.9.0 + * + * @param string $login_link_separator The separator used between login form navigation links. + */ +$login_link_separator = apply_filters('login_link_separator', ' | '); + +switch ($action) { + + case 'postpass': + if (! array_key_exists('post_password', $_POST)) { + wp_safe_redirect(wp_get_referer()); + exit(); + } + + require_once ABSPATH . WPINC . '/class-phpass.php'; + $hasher = new PasswordHash(8, true); + + /** + * Filter the life span of the post password cookie. + * + * By default, the cookie expires 10 days from creation. To turn this + * into a session cookie, return 0. + * + * @since 3.7.0 + * + * @param int $expires The expiry time, as passed to setcookie(). + */ + $expire = apply_filters('post_password_expires', time() + 10 * DAY_IN_SECONDS); + + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitizing password not recommended. It's going to be hashed anyway. + setcookie('wp-postpass_' . COOKIEHASH, $hasher->HashPassword(wp_unslash($_POST['post_password'])), $expire, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); + + if ($switched_locale) { + restore_previous_locale(); + } + + wp_safe_redirect(wp_get_referer()); + exit(); + case 'logout': + check_admin_referer('log-out'); + + $user = wp_get_current_user(); + + wp_logout(); + + if (! empty($_REQUEST['redirect_to'])) { + $redirect_to = $requested_redirect_to = sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])); + } else { + $redirect_to = 'wp-login.php?loggedout=true'; + $requested_redirect_to = ''; + } + + if ($switched_locale) { + restore_previous_locale(); + } + + /** + * Filter the log out redirect URL. + * + * @since 4.2.0 + * + * @param string $redirect_to The redirect destination URL. + * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter. + * @param WP_User $user The WP_User object for the user that's logging out. + */ + $redirect_to = apply_filters('logout_redirect', $redirect_to, $requested_redirect_to, $user); + + wp_safe_redirect($redirect_to); + exit(); + + case 'lostpassword': + case 'retrievepassword': + if ($http_post) { + $errors = retrieve_password(); + if (!is_wp_error($errors)) { + $redirect_to = !empty($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : 'wp-login.php?checkemail=confirm'; + wp_safe_redirect($redirect_to); + exit(); + } + } + + if (isset($_GET['error'])) { + if ('invalidkey' == $_GET['error']) { + $errors->add('invalidkey', __('Your password reset link appears to be invalid. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } elseif ('expiredkey' == $_GET['error']) { + $errors->add('expiredkey', __('Your password reset link has expired. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } + } + + $lostpassword_redirect = ! empty($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : ''; + /** + * Filter the URL redirected to after submitting the lostpassword/retrievepassword form. + * + * @since 3.0.0 + * + * @param string $lostpassword_redirect The redirect destination URL. + */ + $redirect_to = apply_filters('lostpassword_redirect', $lostpassword_redirect); + + /** + * Fires before the lost password form. + * + * @since 1.5.1 + */ + do_action('lost_password'); + + login_header(__('Lost Password'), '', $errors); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + + $user_login = ''; + + if (isset($_POST['user_login']) && is_string($_POST['user_login'])) { + $user_login = sanitize_text_field(wp_unslash($_POST['user_login'])); + } + + ?> + + + + + + get_error_code() === 'expired_key') { + wp_redirect(site_url('wp-login.php?action=lostpassword&error=expiredkey')); + } else { + wp_redirect(site_url('wp-login.php?action=lostpassword&error=invalidkey')); + } + exit; + } + + $errors = new WP_Error(); + + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- PCP warning. Not recommended to sanitize password. + if (isset($_POST['pass1']) && wp_unslash($_POST['pass1']) != isset($_POST['pass2']) ? wp_unslash($_POST['pass2']) : '') + $errors->add('password_reset_mismatch', __('The passwords do not match.')); + + /** + * Fires before the password reset procedure is validated. + * + * @since 3.5.0 + * + * @param object $errors WP Error object. + * @param WP_User|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise. + */ + do_action('validate_password_reset', $errors, $user); + + if ((! $errors->get_error_code()) && isset($_POST['pass1']) && !empty($_POST['pass1'])) { + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- PCP warning. Not recommended to sanitize password. + reset_password($user, wp_unslash($_POST['pass1'])); + setcookie($rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true); + login_header(__('Password Reset'), ''); + login_footer(); + exit; + } + + wp_enqueue_script('utils'); + wp_enqueue_script('user-profile'); + + login_header(__('Reset Password'), '', $errors); + ?> + + + + + ' . __('Register For This Site') . '', $errors); + ?> + + + + + + ID)) { + $secure_cookie = true; + force_ssl_admin(true); + } + } + } + + if (isset($_REQUEST['redirect_to'])) { + $redirect_to = sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])); + // Redirect to https if user wants ssl + if ($secure_cookie && false !== strpos($redirect_to, 'wp-admin')) + $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to); + } else { + $redirect_to = admin_url(); + } + + $reauth = empty($_REQUEST['reauth']) ? false : true; + + $user = wp_signon(array(), $secure_cookie); + + if (empty($_COOKIE[LOGGED_IN_COOKIE])) { + if (headers_sent()) { + // translators: 1: Browser cookie documentation URL, 2: Support forums URL + $user = new WP_Error('test_cookie', sprintf(__('ERROR: Cookies are blocked due to unexpected output. For help, please see this documentation or try the support forums.'), esc_url(__('https://codex.wordpress.org/Cookies')), esc_url(__('https://wordpress.org/support/')))); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } elseif (isset($_POST['testcookie']) && empty($_COOKIE[TEST_COOKIE])) { + // If cookies are disabled we can't log in even with a valid user+pass + // translators: 1: Browser cookie documentation URL + $user = new WP_Error('test_cookie', sprintf(__('ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.'), esc_url(__('https://codex.wordpress.org/Cookies')))); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } + } + + $requested_redirect_to = isset($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : ''; + /** + * Filter the login redirect URL. + * + * @since 3.0.0 + * + * @param string $redirect_to The redirect destination URL. + * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter. + * @param WP_User|WP_Error $user WP_User object if login was successful, WP_Error object otherwise. + */ + $redirect_to = apply_filters('login_redirect', $redirect_to, $requested_redirect_to, $user); + + if (!is_wp_error($user) && !$reauth) { + if ($interim_login) { + $message = ''; + $interim_login = 'success'; + login_header('', $message); ?> +
+
+
+
+
+
+ ID) && !is_super_admin($user->ID))
+ $redirect_to = user_admin_url();
+ elseif (is_multisite() && !$user->has_cap('read'))
+ $redirect_to = get_dashboard_url($user->ID);
+ elseif (!$user->has_cap('edit_posts'))
+ $redirect_to = $user->has_cap('read') ? admin_url('profile.php') : home_url();
+
+ wp_redirect($redirect_to);
+ exit();
+ }
+ wp_safe_redirect($redirect_to);
+ exit();
+ }
+
+ $errors = $user;
+ // Clear errors if loggedout is set.
+ if (!empty($_GET['loggedout']) || $reauth)
+ $errors = new WP_Error();
+
+ if ($interim_login) {
+ if (! $errors->get_error_code())
+ $errors->add('expired', __('Your session has expired. Please log in to continue where you left off.'), 'message'); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ } else {
+ // Some parts of this script use the main login form to display a message
+ if (isset($_GET['loggedout']) && true == $_GET['loggedout'])
+ $errors->add('loggedout', __('You are now logged out.'), 'message');
+ elseif (isset($_GET['registration']) && 'disabled' == $_GET['registration'])
+ $errors->add('registerdisabled', __('User registration is currently not allowed.'));
+ elseif (isset($_GET['checkemail']) && 'confirm' == $_GET['checkemail'])
+ $errors->add('confirm', __('Check your email for the confirmation link.'), 'message');
+ elseif (isset($_GET['checkemail']) && 'newpass' == $_GET['checkemail'])
+ $errors->add('newpass', __('Check your email for your new password.'), 'message');
+ elseif (isset($_GET['checkemail']) && 'registered' == $_GET['checkemail'])
+ $errors->add('registered', __('Registration complete. Please check your email.'), 'message'); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ elseif (strpos($redirect_to, 'about.php?updated'))
+ $errors->add('updated', __('You have successfully updated WordPress! Please log back in to see what’s new.'), 'message');
+ }
+
+ /**
+ * Filter the login page errors.
+ *
+ * @since 3.6.0
+ *
+ * @param object $errors WP Error object.
+ * @param string $redirect_to Redirect destination URL.
+ */
+ $errors = apply_filters('wp_login_errors', $errors, $redirect_to);
+
+ // Clear any stale cookies.
+ if ($reauth)
+ wp_clear_auth_cookie();
+
+ login_header(__('Log In'), '', $errors);
+
+ if (isset($_POST['log']))
+ $user_login = ('incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code()) ? esc_attr(sanitize_text_field(wp_unslash($_POST['log']))) : '';
+ $rememberme = ! empty($_POST['rememberme']);
+
+ if (! empty($errors->errors)) {
+ $aria_describedby_error = ' aria-describedby="login_error"';
+ } else {
+ $aria_describedby_error = '';
+ }
+
+ //aiowps - this check is necessary because otherwise if variables are undefined we get a warning!
+ if (empty($user_login)) {
+ $user_login = '';
+ }
+
+ if (empty($error)) {
+ $error = '';
+ }
+?>
+
+
+
+
+
+
+
+
+
+` element.
+ * Default 'Log In'.
+ * @param string $message Optional. Message to display in header. Default empty.
+ * @param WP_Error $wp_error Optional. The error to pass. Default is a WP_Error instance.
+ */
+function login_header($title = 'Log In', $message = '', $wp_error = null) {
+ global $error, $interim_login, $action;
+
+ // Don't index any of these forms.
+ add_action('login_head', 'wp_sensitive_page_meta');
+
+ add_action('login_head', 'wp_login_viewport_meta');
+
+ if (! is_wp_error($wp_error)) {
+ $wp_error = new WP_Error();
+ }
+
+ // Shake it!
+ $shake_error_codes = array('empty_password', 'empty_email', 'invalid_email', 'invalidcombo', 'empty_username', 'invalid_username', 'incorrect_password', 'retrieve_password_email_failure');
+ /**
+ * Filters the error codes array for shaking the login form.
+ *
+ * @since 3.0.0
+ *
+ * @param array $shake_error_codes Error codes that shake the login form.
+ */
+ $shake_error_codes = apply_filters('shake_error_codes', $shake_error_codes);
+
+ if ($shake_error_codes && $wp_error->has_errors() && in_array($wp_error->get_error_code(), $shake_error_codes, true)) {
+ add_action('login_footer', 'wp_shake_js', 12);
+ }
+
+ $login_title = get_bloginfo('name', 'display');
+
+ /* translators: Login screen title. 1: Login screen name, 2: Network or site name. */
+ $login_title = sprintf(__('%1$s ‹ %2$s — WordPress'), $title, $login_title);
+
+ if (wp_is_recovery_mode()) {
+ /* translators: %s: Login screen title. */
+ $login_title = sprintf(__('Recovery Mode — %s'), $login_title);
+ }
+
+ /**
+ * Filters the title tag content for login page.
+ *
+ * @since 4.9.0
+ *
+ * @param string $login_title The page title, with extra context added.
+ * @param string $title The original page title.
+ */
+ $login_title = apply_filters('login_title', $login_title, $title);
+
+ ?>
+ >
+
+
+ '+simba_tfasettings.is_trusted+''; + + } else { + + if (form_is_ultimate_member) { html += '
'; }
+
+ html += '
';
+ }
+
+ if (user_can_trust) {
+
+ html += '';
+
+ }
+ }
+
+ html += '';
+
+ var submit_button_text;
+ var submit_button_name;
+
+ // Gravity forms doesn't like its button being disabled
+ if (!form_is_gravity_forms) {
+
+ if ('button' == $submit_button.prop('nodeName').toLowerCase()) {
+ submit_button_text = $submit_button.text().trim();
+ submit_button_name = $submit_button.attr('name');
+ } else {
+ submit_button_text = $submit_button.val();
+ submit_button_name = $submit_button.attr('name');
+ }
+
+ html += '';
+
+ $submit_button.prop('disabled', true).hide();
+
+ }
+
+ if (form_retain_existing_elements && form_is_gravity_forms) {
+ // $submit_button.parents('form').first().append(html);
+ //$(''+html+'
').insertBefore($submit_button);
+ $(form).find('#gform_fields_login').append(html);
+ } else {
+ $submit_button.parents('form').first().prepend(html);
+ }
+
+ $('#login_error').hide();
+
+ if (user_already_trusted) {
+ if (form_retain_existing_elements) {
+ $submit_button.trigger('click');
+ } else {
+ $('#tfa_login_btn').trigger('click');
+ }
+ } else {
+
+ $('#simba_two_factor_auth').trigger('focus');
+
+ // Hide extra boxes of third party plugins
+ jQuery('.hide-when-displaying-tfa-input').hide();
+ }
+
+ }
+
+ /**
+ * This function gets attached to a form submission handler and decides whether to add an OTP field or not.
+ *
+ * @param Object e - submission event
+ *
+ * @return Boolean - whether to proceed with the submission or not
+ */
+ var form_submit_handler = function(e) {
+
+ console.log('Simba TFA: form submit request');
+
+ var form = e.target;
+
+ var form_is_gravity_forms = ('object' == typeof window['gform_gravityforms'] && 'undefined' !== typeof $(form).attr('id') && 'gform_' === $(form).attr('id').substring(0, 6));
+
+ // Turn off everything
+ $(form).off();
+
+ if (0 == $(form).find('#simba_two_factor_auth').length && check_and_possibly_show_otp_field(form)) {
+
+ if (form_is_gravity_forms) {
+ var form_id = $(form).attr('id').substring(6);
+ // Gravity Forms won't allow the form to submit if this is already true
+ window['gf_submitting_'+form_id] = false;
+ }
+
+ e.preventDefault();
+ return false;
+
+ }
+
+ return true;
+
+ };
+
+ if (simba_tfasettings.login_form_off_selectors) {
+ $(simba_tfasettings.login_form_off_selectors).off('submit');
+ }
+
+ $(simba_tfasettings.login_form_selectors).on('submit', form_submit_handler);
+
+ $(simba_tfasettings.login_form_selectors).find(get_username_identifiers()).on('blur', function() {
+ var $form = $(this).parents('form').first();
+ check_and_possibly_show_otp_field($form, true);
+ });
+
+});
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_16x16.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_16x16.png
new file mode 100755
index 00000000..7605cc44
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_16x16.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_32x32.png b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_32x32.png
new file mode 100755
index 00000000..5e6b2633
Binary files /dev/null and b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_admin_icon_32x32.png differ
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_frontend.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_frontend.php
new file mode 100755
index 00000000..1dac8c32
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/tfa_frontend.php
@@ -0,0 +1,216 @@
+mother = $mother;
+ add_action('wp_ajax_tfa_frontend', array($this, 'ajax'));
+ add_shortcode('twofactor_user_settings', array($this, 'tfa_user_settings_front'));
+
+ if (!WP_Block_Type_Registry::get_instance()->is_registered('twofactor/user-settings')) {
+ register_block_type('twofactor/user-settings', array(
+ 'editor_script' => 'twofactor-gutenberg-blocks',
+ 'render_callback' => array($this, 'tfa_user_settings_front'),
+ ));
+ }
+ }
+
+ /**
+ * Runs upon the WP action wp_ajax_tfa_frontend
+ *
+ * @uses die()
+ */
+ public function ajax() {
+ $totp_controller = $this->mother->get_controller('totp');
+ global $current_user;
+
+ $return_array = array();
+
+ if (empty($_POST) || empty($_POST['subaction']) || !isset($_POST['nonce']) || !is_user_logged_in() || !wp_verify_nonce($_POST['nonce'], 'tfa_frontend_nonce')) die('Security check');
+
+ if ('savesettings' == $_POST['subaction']) {
+ if (empty($_POST['settings']) || !is_string($_POST['settings'])) die;
+
+ parse_str(stripslashes($_POST['settings']), $posted_settings);
+
+ if (isset($posted_settings['tfa_algorithm_type'])) {
+ $old_algorithm = $totp_controller->get_user_otp_algorithm($current_user->ID);
+
+ if ($old_algorithm != $posted_settings['tfa_algorithm_type'])
+ $totp_controller->changeUserAlgorithmTo($current_user->ID, $posted_settings['tfa_algorithm_type']);
+
+ //Re-fetch the algorithm type, url and private string
+ $variables = $this->tfa_fetch_assort_vars();
+
+ $return_array['qr'] = $totp_controller->tfa_qr_code_url($variables['algorithm_type'], $variables['url'], $variables['tfa_priv_key']);
+ $return_array['al_type_disp'] = $this->tfa_algorithm_info($variables['algorithm_type']);
+ }
+
+ if (isset($posted_settings['tfa_enable_tfa'])) {
+
+ $allow_enable_or_disable = false;
+
+ if (empty($posted_settings['require_current']) || !$posted_settings['tfa_enable_tfa']) {
+ $allow_enable_or_disable = true;
+ } else {
+
+ if (!isset($posted_settings['tfa_enable_current']) || '' == $posted_settings['tfa_enable_current']) {
+ $return_array['message'] = __('To enable TFA, you must enter the current code.', 'all-in-one-wp-security-and-firewall');
+ $return_array['error'] = 'code_absent';
+ } else {
+ // Third parameter: don't allow emergency codes
+ if ($totp_controller->check_code_for_user($current_user->ID, $posted_settings['tfa_enable_current'], false)) {
+ $allow_enable_or_disable = true;
+ } else {
+ $return_array['error'] = 'code_wrong';
+ $return_array['message'] = apply_filters('simba_tfa_message_code_incorrect', __('The TFA code you entered was incorrect.', 'all-in-one-wp-security-and-firewall'));
+ }
+ }
+
+ }
+
+ if ($allow_enable_or_disable) $this->mother->change_tfa_enabled_status($current_user->ID, $posted_settings['tfa_enable_tfa']);
+ }
+
+ $return_array['result'] = 'saved';
+
+ echo json_encode($return_array);
+ }
+
+ die;
+ }
+
+ /**
+ * Make the algorithm information string easier to update
+ *
+ * @param String $algorithm_type - totp|hotp
+ */
+ public function tfa_algorithm_info($algorithm_type) {
+ $al_type_disp = strtoupper($algorithm_type);
+ $al_type_desc = ($algorithm_type == 'totp' ? __('a time based', 'all-in-one-wp-security-and-firewall') : __('an event based', 'all-in-one-wp-security-and-firewall'));
+
+ return array('disp' => $al_type_disp, 'desc' => $al_type_desc);
+ }
+
+ /**
+ * Make the assorted required variables more accessible for ajax
+ *
+ * Returns: Site URL, private key, emergency codes, algorithm type
+ *
+ * @return Array
+ */
+ public function tfa_fetch_assort_vars() {
+ global $current_user;
+ $totp_controller = $this->mother->get_controller('totp');
+
+ $url = preg_replace('/^https?:\/\//i', '', site_url());
+
+ $tfa_priv_key_64 = get_user_meta($current_user->ID, 'tfa_priv_key_64', true);
+
+ if (!$tfa_priv_key_64) $tfa_priv_key_64 = $totp_controller->addPrivateKey($current_user->ID);
+
+ $tfa_priv_key = trim($totp_controller->getPrivateKeyPlain($tfa_priv_key_64, $current_user->ID));
+
+ $algorithm_type = $totp_controller->get_user_otp_algorithm($current_user->ID);
+
+ return apply_filters('simba_tfa_fetch_assort_vars', array(
+ 'url' => $url,
+ 'tfa_priv_key_64' => $tfa_priv_key_64,
+ 'tfa_priv_key' => $tfa_priv_key,
+ 'emergency_str' => ''.__('No emergency codes left. Sorry.', 'all-in-one-wp-security-and-firewall').'',
+ 'algorithm_type' => $algorithm_type
+ ), $totp_controller, $current_user);
+ }
+
+ /**
+ * Paints out the 'save settings' button
+ */
+ public function save_settings_button() {
+ echo '';
+ }
+
+ /**
+ * Paint output for the TFA on/off radio
+ *
+ * @param String $style - valid values are 'show_current' and 'require_current'
+ */
+ public function settings_enable_or_disable_output($style = 'show_current') {
+ $this->save_settings_javascript_output();
+ global $current_user;
+ ?>
+
+
+ mother->includes_url().'/jquery.blockUI' . $suffix . '.js', array('jquery'), '2.60');
+
+ $script_ver = (defined('WP_DEBUG') && WP_DEBUG) ? time() : filemtime($this->mother->includes_dir().'/frontend-settings.js');
+
+ wp_enqueue_script('simba-tfa-frontend-settings', $this->mother->includes_url().'/frontend-settings.js', array('jquery-blockui'), $script_ver);
+
+ $ajax_url = admin_url('admin-ajax.php');
+ // It's possible that FORCE_ADMIN_SSL will make that SSL, whilst the user is on the front-end having logged in over non-SSL - and as a result, their login cookies won't get sent, and they're not registered as logged in.
+ if (!is_admin() && substr(strtolower($ajax_url), 0, 6) == 'https:' && !is_ssl()) {
+ $also_try = 'http:'.substr($ajax_url, 6);
+ } else {
+ $also_try = '';
+ }
+
+ $localize = array(
+ 'ask' => __('You have unsaved settings.', 'all-in-one-wp-security-and-firewall'),
+ 'saving' => __('Saving...', 'all-in-one-wp-security-and-firewall'),
+ 'ajax_url' => $ajax_url,
+ 'also_try' => $also_try,
+ 'nonce' => wp_create_nonce('tfa_frontend_nonce'),
+ 'response' => __('Response:', 'all-in-one-wp-security-and-firewall'),
+ );
+
+ wp_localize_script('simba-tfa-frontend-settings', 'simba_tfa_frontend', $localize);
+
+ }
+
+ /**
+ * Shortcode function for twofactor_user_settings
+ *
+ * @param Array $atts - shortcode attributes
+ *
+ * @return String
+ */
+ public function tfa_user_settings_front($atts = array()) {
+
+ if (!is_user_logged_in()) return '';
+
+ $atts = array_change_key_case((array)$atts, CASE_LOWER);
+
+ $atts = shortcode_atts(array('show_algorithm_selector' => 'no'), $atts);
+
+ $show_algorithm_selector = ('yes' === $atts['show_algorithm_selector']);
+
+ global $current_user;
+
+ return $this->mother->include_template('shortcode-tfa-user-settings.php', array('is_activated_for_user' => $current_user->ID, 'tfa_frontend' => $this, 'show_algorithm_selector' => $show_algorithm_selector), true);
+
+ }
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/totp.js b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/totp.js
new file mode 100755
index 00000000..98bb4171
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/totp.js
@@ -0,0 +1,101 @@
+jQuery(function($) {
+
+ // Render any QR codes on the page
+ $('.simbaotp_qr_container').qrcode({
+ 'render': 'image',
+ 'text': $('.simbaotp_qr_container:first').data('qrcode'),
+ });
+
+ function update_otp_code() {
+
+ $('.simba_current_otp').html(''+simbatfa_totp.updating+'');
+
+ var got_code = '';
+
+ $.post(simbatfa_totp.ajax_url, {
+ action: 'simbatfa_shared_ajax',
+ subaction: 'refreshotp',
+ nonce: simbatfa_totp.tfa_shared_nonce
+ }, function(response) {
+
+ try {
+ var resp = JSON.parse(response);
+ got_code = resp.code;
+ } catch(err) {
+ if ('' !== simbatfa_totp.also_try) {
+ alert(simbatfa_totp.response+" "+response);
+ }
+ console.log(response);
+ console.log(err);
+ }
+
+ if ('' === got_code && '' !== simbatfa_totp.also_try) {
+ $.post(simbatfa_totp.also_try, {
+ action: 'simbatfa_shared_ajax',
+ subaction: 'refreshotp',
+ nonce: simbatfa_totp.tfa_shared_nonce
+ }, function(response) {
+ try {
+ var resp = JSON.parse(response);
+ if (resp.code) {
+ $('.simba_current_otp').html(resp.code);
+ } else {
+ console.log(response);
+ console.log("TFA: no code found");
+ }
+ } catch(err) {
+ alert(simbatfa_totp.response+" "+response);
+ console.log(response);
+ console.log(err);
+ }
+ });
+ } else if ('' != got_code) {
+ $('.simba_current_otp').html(got_code);
+ } else {
+ console.log("TFA: no code found");
+ }
+ });
+ }
+
+ var min_refresh_after = 30;
+
+ if (0 == $('body.settings_page_two-factor-auth').length) {
+ $('.simba_current_otp').each(function(ind, obj) {
+ var refresh_after = $(obj).data('refresh_after');
+ if (refresh_after > 0 && refresh_after < min_refresh_after) {
+ min_refresh_after = refresh_after;
+ }
+ });
+
+ // Update after the given seconds, and then every 30 seconds
+ setTimeout(function() {
+ setInterval(update_otp_code, 30000)
+ update_otp_code();
+ }, min_refresh_after * 1000);
+ }
+
+ // Handle clicks on the 'refresh' link
+ $('.simbaotp_refresh').on('click', function(e) {
+ e.preventDefault();
+ update_otp_code();
+ });
+
+ $('#tfa_trusted_devices_box').on('click', '.simbatfa-trust-remove', function(e) {
+ e.preventDefault();
+ var device_id = $(this).data('trusted-device-id');
+ $(this).parents('.simbatfa_trusted_device').css('opacity', '0.5');
+ if ('undefined' !== typeof device_id) {
+ $.post(simbatfa_totp.ajax_url, {
+ action: 'simbatfa_shared_ajax',
+ subaction: 'untrust_device',
+ nonce: simbatfa_totp.tfa_shared_nonce,
+ device_id: device_id
+ }, function(response) {
+ var resp = JSON.parse(response);
+ if (resp.hasOwnProperty('trusted_list')) {
+ $('#tfa_trusted_devices_box_inner').html(resp.trusted_list);
+ }
+ });
+ }
+ });
+});
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/users.css b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/users.css
new file mode 100755
index 00000000..ca7d3f04
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/includes/users.css
@@ -0,0 +1,13 @@
+/* TFA users list column */
+th.column-tfa-status,
+td.column-tfa-status {
+ text-align: center;
+}
+
+td.column-tfa-status span.dashicons-no {
+ color: red;
+}
+
+td.column-tfa-status span.dashicons-yes {
+ color: green;
+}
\ No newline at end of file
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/Base32/Base32.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/Base32/Base32.php
new file mode 100755
index 00000000..02a3d533
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/Base32/Base32.php
@@ -0,0 +1,225 @@
+
+ * @link http://christianriesen.com
+ * @license MIT License see LICENSE file
+ */
+class Base32
+{
+ /**
+ * Table for encoding base32
+ *
+ * @var array
+ */
+ private static $encode = array(
+ 0 => 'A',
+ 1 => 'B',
+ 2 => 'C',
+ 3 => 'D',
+ 4 => 'E',
+ 5 => 'F',
+ 6 => 'G',
+ 7 => 'H',
+ 8 => 'I',
+ 9 => 'J',
+ 10 => 'K',
+ 11 => 'L',
+ 12 => 'M',
+ 13 => 'N',
+ 14 => 'O',
+ 15 => 'P',
+ 16 => 'Q',
+ 17 => 'R',
+ 18 => 'S',
+ 19 => 'T',
+ 20 => 'U',
+ 21 => 'V',
+ 22 => 'W',
+ 23 => 'X',
+ 24 => 'Y',
+ 25 => 'Z',
+ 26 => 2,
+ 27 => 3,
+ 28 => 4,
+ 29 => 5,
+ 30 => 6,
+ 31 => 7,
+ 32 => '=',
+ );
+
+ /**
+ * Table for decoding base32
+ *
+ * @var array
+ */
+ private static $decode = array(
+ 'A' => 0,
+ 'B' => 1,
+ 'C' => 2,
+ 'D' => 3,
+ 'E' => 4,
+ 'F' => 5,
+ 'G' => 6,
+ 'H' => 7,
+ 'I' => 8,
+ 'J' => 9,
+ 'K' => 10,
+ 'L' => 11,
+ 'M' => 12,
+ 'N' => 13,
+ 'O' => 14,
+ 'P' => 15,
+ 'Q' => 16,
+ 'R' => 17,
+ 'S' => 18,
+ 'T' => 19,
+ 'U' => 20,
+ 'V' => 21,
+ 'W' => 22,
+ 'X' => 23,
+ 'Y' => 24,
+ 'Z' => 25,
+ 2 => 26,
+ 3 => 27,
+ 4 => 28,
+ 5 => 29,
+ 6 => 30,
+ 7 => 31,
+ '=' => 32,
+ );
+
+ /**
+ * Creates an array from a binary string into a given chunk size
+ *
+ * @param string $binaryString String to chunk
+ * @param integer $bits Number of bits per chunk
+ * @return array
+ */
+ private static function chunk($binaryString, $bits)
+ {
+ $binaryString = chunk_split($binaryString, $bits, ' ');
+
+ if (substr($binaryString, (strlen($binaryString)) - 1) == ' ') {
+ $binaryString = substr($binaryString, 0, strlen($binaryString)-1);
+ }
+
+ return explode(' ', $binaryString);
+ }
+
+ /**
+ * Encodes into base32
+ *
+ * @param string $string Clear text string
+ * @return string Base32 encoded string
+ */
+ public static function encode($string)
+ {
+ if (strlen($string) == 0) {
+ // Gives an empty string
+ return '';
+ }
+
+ // Convert string to binary
+ $binaryString = '';
+
+ foreach (str_split($string) as $s) {
+ // Return each character as an 8-bit binary string
+ $s = decbin(ord($s));
+ $binaryString .= str_pad($s, 8, 0, STR_PAD_LEFT);
+ }
+
+ // Break into 5-bit chunks, then break that into an array
+ $binaryArray = self::chunk($binaryString, 5);
+
+ // Pad array to be divisible by 8
+ while (count($binaryArray) % 8 !== 0) {
+ $binaryArray[] = null;
+ }
+
+ $base32String = '';
+
+ // Encode in base32
+ foreach ($binaryArray as $bin) {
+ $char = 32;
+
+ if (!is_null($bin)) {
+ // Pad the binary strings
+ $bin = str_pad($bin, 5, 0, STR_PAD_RIGHT);
+ $char = bindec($bin);
+ }
+
+ // Base32 character
+ $base32String .= self::$encode[$char];
+ }
+
+ return $base32String;
+ }
+
+ /**
+ * Decodes base32
+ *
+ * @param string $base32String Base32 encoded string
+ * @return string Clear text string
+ */
+ public static function decode($base32String)
+ {
+ if (strlen($base32String) == 0) {
+ // Gives an empty string
+ return '';
+ }
+
+ // Only work in upper cases
+ $base32String = strtoupper($base32String);
+
+ // Remove anything that is not base32 alphabet
+ $pattern = '/[^A-Z2-7]/';
+ $replacement = '';
+
+ $base32String = preg_replace($pattern, '', $base32String);
+
+ $base32Array = str_split($base32String);
+
+ $binaryArray = array();
+ $string = '';
+
+ foreach ($base32Array as $str) {
+ $char = self::$decode[$str];
+
+ // Ignore the padding character
+ if ($char !== 32) {
+ $char = decbin($char);
+ $string .= str_pad($char, 5, 0, STR_PAD_LEFT);
+ }
+ }
+
+ while (strlen($string) %8 !== 0) {
+ $string = substr($string, 0, strlen($string)-1);
+ }
+
+ $binaryArray = self::chunk($string, 8);
+
+ $realString = '';
+
+ foreach ($binaryArray as $bin) {
+ // Pad each value to 8 bits
+ $bin = str_pad($bin, 8, 0, STR_PAD_RIGHT);
+ // Convert binary strings to ascii
+ $realString .= chr(bindec($bin));
+ }
+
+ return $realString;
+ }
+}
+
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/LICENSE b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/LICENSE
new file mode 100755
index 00000000..0b10fd2e
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/LICENSE
@@ -0,0 +1,24 @@
+Copyright (c) 2008, Jakob Heuser
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ * Neither the name of HOTP-PHP nor the
+ names of its contributors may be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY Jakob Heuser ''AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL mother->paint_enable_tfa_radios($current_user->ID, true, $style); ?>
+ +
+http://www.ietf.org/rfc/rfc4226.txt
+http://tools.ietf.org/html/draft-mraihi-totp-timebased-06
+
+TEST VECTOR VERIFICATION
+
+HOTP Tests:
+
+DOCBLOCK;
+
+echo "Count Method Value Pass/Fail\n";
+echo "----------------------------------------------------------------------\n";
+
+// loop over all HOTP table results, and calculate the matching value
+foreach ($table['HOTP'] as $seed => $results) {
+ $hotp = HOTP::generateByCounter($key, $seed);
+ $first = true;
+ foreach ($results as $type => $calc) {
+ if ($first) {
+ echo str_pad($seed, 4, ' ', STR_PAD_LEFT);
+ $first = false;
+ }
+ else {
+ echo ' ';
+ }
+ echo ' ';
+ echo str_pad($type, 5, ' ', STR_PAD_RIGHT);
+ echo ' ';
+ echo str_pad($calc, 47, ' ', STR_PAD_RIGHT);
+ echo ' ';
+ $method = 'to'.(ucfirst(str_replace('HMAC', 'string', $type)));
+ echo str_pad(($calc == $hotp->$method(6)) ? '[OK]' : '[FAIL]', 9, ' ', STR_PAD_LEFT);
+ echo "\n";
+ }
+}
+
+echo << $results) {
+ $totp = HOTP::generateByTime($key, 30, $seed);
+ $first = true;
+ foreach ($results as $type => $calc) {
+ if ($first) {
+ echo str_pad($seed, 10, ' ', STR_PAD_LEFT);
+ $first = false;
+ }
+ else {
+ echo ' ';
+ }
+ echo ' ';
+ echo str_pad($calc, 47, ' ', STR_PAD_RIGHT);
+ echo ' ';
+ $method = 'to'.(ucfirst(str_replace('totp', 'hotp', $type)));
+ echo str_pad(($calc == $totp->$method(8)) ? '[OK]' : '[FAIL]', 9, ' ', STR_PAD_LEFT);
+ echo "\n";
+ }
+}
+
+echo ' ';
+
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/hotp.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/hotp.php
new file mode 100755
index 00000000..090e7599
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/hotp-php-master/hotp.php
@@ -0,0 +1,174 @@
+= 0; $i--) {
+ $cur_counter[$i] = pack ('C*', $counter);
+ $counter = $counter >> 8;
+ }
+
+ $bin_counter = implode($cur_counter);
+
+ // Pad to 8 chars
+ if (strlen($bin_counter) < 8) {
+ $bin_counter = str_repeat (chr(0), 8 - strlen ($bin_counter)) . $bin_counter;
+ }
+
+ // HMAC
+ $hash = hash_hmac('sha1', $bin_counter, $key);
+
+ return new HOTPResult($hash);
+ }
+
+ /**
+ * Generate a HOTP key based on a timestamp and window size
+ * @param string $key the key to use for hashing
+ * @param int $window the size of the window a key is valid for in seconds
+ * @param int $timestamp a timestamp to calculate for, defaults to time()
+ * @return HOTPResult a HOTP Result which can be truncated or output
+ */
+ public static function generateByTime($key, $window, $timestamp = false) {
+ if (!$timestamp && $timestamp !== 0) {
+ $timestamp = HOTP::getTime();
+ }
+
+ $counter = intval($timestamp / $window);
+
+ return HOTP::generateByCounter($key, $counter);
+ }
+
+ /**
+ * Generate a HOTP key collection based on a timestamp and window size
+ * all keys that could exist between a start and end time will be included
+ * in the returned array
+ * @param string $key the key to use for hashing
+ * @param int $window the size of the window a key is valid for in seconds
+ * @param int $min the minimum window to accept before $timestamp
+ * @param int $max the maximum window to accept after $timestamp
+ * @param int $timestamp a timestamp to calculate for, defaults to time()
+ * @return array of HOTPResult
+ */
+ public static function generateByTimeWindow($key, $window, $min = -1, $max = 1, $timestamp = false) {
+ if (!$timestamp && $timestamp !== 0) {
+ $timestamp = HOTP::getTime();
+ }
+
+ $counter = intval($timestamp / $window);
+ $window = range($min, $max);
+
+ $out = array();
+ for ($i = 0; $i < count($window); $i++) {
+ $shift_counter = $window[$i];
+ $out[$shift_counter] = HOTP::generateByCounter($key, $counter + $shift_counter);
+ }
+
+ return $out;
+ }
+
+ /**
+ * Gets the current time
+ * Ensures we are operating in UTC for the entire framework
+ * Restores the timezone on exit.
+ * @return int the current time
+ */
+ public static function getTime() {
+ return time(); // PHP's time is always UTC
+ }
+}
+
+/**
+ * The HOTPResult Class converts an HOTP item to various forms
+ * Supported formats include hex, decimal, string, and HOTP
+ * @author Jakob Heuser (firstname)@felocity.com
+ */
+class HOTPResult {
+ protected $hash;
+ protected $binary;
+ protected $decimal;
+
+ /**
+ * Build an HOTP Result
+ * @param string $value the value to construct with
+ */
+ public function __construct($value) {
+ // store raw
+ $this->hash = $value;
+ }
+
+ /**
+ * Returns the string version of the HOTP
+ * @return string
+ */
+ public function toString() {
+ return $this->hash;
+ }
+
+ /**
+ * Returns the hex version of the HOTP
+ * @return string
+ */
+ public function toHex() {
+ if( !$this->hex )
+ {
+ $this->hex = dechex($this->toDec());
+ }
+ return $this->hex;
+ }
+
+ /**
+ * Returns the decimal version of the HOTP
+ * @return int
+ */
+ public function toDec() {
+ if( !$this->decimal )
+ {
+ // store calculate decimal
+ $hmac_result = array();
+
+ // Convert to decimal
+ foreach(str_split($this->hash,2) as $hex)
+ {
+ $hmac_result[] = hexdec($hex);
+ }
+
+ $offset = $hmac_result[19] & 0xf;
+
+ $this->decimal = (
+ (($hmac_result[$offset+0] & 0x7f) << 24 ) |
+ (($hmac_result[$offset+1] & 0xff) << 16 ) |
+ (($hmac_result[$offset+2] & 0xff) << 8 ) |
+ ($hmac_result[$offset+3] & 0xff)
+ );
+ }
+ return $this->decimal;
+ }
+
+ /**
+ * Returns the truncated decimal form of the HOTP
+ * @param int $length the length of the HOTP to return
+ * @return string
+ */
+ public function toHOTP($length) {
+ $str = str_pad($this->toDec(), $length, "0", STR_PAD_LEFT);
+ $str = substr($str, (-1 * $length));
+ return $str;
+ }
+
+}
diff --git a/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/loader.php b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/loader.php
new file mode 100755
index 00000000..b322ec6f
--- /dev/null
+++ b/wp-content/plugins/all-in-one-wp-security-and-firewall/includes/simba-tfa/providers/totp/loader.php
@@ -0,0 +1,1034 @@
+tfa = $tfa;
+
+ $this->otp_helper = new HOTP();
+
+ add_action('plugins_loaded', array($this, 'plugins_loaded'));
+
+ add_action('admin_init', array($this, 'admin_init'));
+
+ if (!is_admin()) {
+ add_action('init', array($this, 'check_possible_reset'));
+ }
+
+ // Potentially show off-sync message for hotp
+ add_action('admin_notices', array($this, 'tfa_show_hotp_off_sync_message'));
+ }
+
+ /**
+ * Return whether or not this class detected and saved new settings
+ *
+ * @return Boolean
+ */
+ public function were_settings_saved() {
+ return $this->settings_saved;
+ }
+
+ /**
+ * Runs upon the WP action admin_init
+ */
+ public function admin_init() {
+
+ $this->check_possible_reset();
+
+ global $current_user;
+
+ if (!empty($_REQUEST['_tfa_activate_nonce']) && !empty($_POST['tfa_enable_tfa']) && wp_verify_nonce($_REQUEST['_tfa_activate_nonce'], 'tfa_activate') && !empty($_GET['settings-updated'])) {
+ $this->tfa->change_tfa_enabled_status($current_user->ID, $_POST['tfa_enable_tfa']);
+ $this->settings_saved = true;
+ }
+
+ if (!empty($_REQUEST['_tfa_algorithm_nonce']) && !empty($_POST['tfa_algorithm_type']) && !empty($_GET['settings-updated']) && wp_verify_nonce($_REQUEST['_tfa_algorithm_nonce'], 'tfa_algorithm')) {
+
+ $old_algorithm = $this->get_user_otp_algorithm($current_user->ID);
+
+ if ($old_algorithm != $_POST['tfa_algorithm_type']) {
+ $this->changeUserAlgorithmTo($current_user->ID, $_POST['tfa_algorithm_type']);
+ }
+
+ $this->settings_saved = true;
+ }
+
+ if (!empty($_GET['warning_button_clicked']) && !empty($_REQUEST['resyncnonce']) && wp_verify_nonce($_REQUEST['resyncnonce'], 'tfaresync')) {
+ delete_user_meta($current_user->ID, 'tfa_hotp_off_sync');
+ }
+
+ }
+
+ /**
+ * Enqueue adding of JavaScript for footer
+ */
+ public function add_footer() {
+
+ static $added_footer = false;
+ if ($added_footer) return;
+ $added_footer = true;
+
+ $qr_script_file = (defined('SCRIPT_DEBUG') && SCRIPT_DEBUG) ? 'jquery-qrcode.js' : 'jquery-qrcode.min.js';
+
+ $qr_script_ver = (defined('WP_DEBUG') && WP_DEBUG) ? time() : filemtime($this->tfa->includes_dir()."/jquery-qrcode/$qr_script_file");
+
+ wp_register_script('jquery-qrcode', $this->tfa->includes_url()."/jquery-qrcode/$qr_script_file", array('jquery'), $qr_script_ver);
+
+ $script_ver = (defined('WP_DEBUG') && WP_DEBUG) ? time() : filemtime($this->tfa->includes_dir()."/totp.js");
+
+ // Adds the necessary JavaScript for rendering and updating QR codes, and handling trusted devices removal in the admin area
+ wp_enqueue_script('simba-tfa-totp', $this->tfa->includes_url()."/totp.js", array('jquery-qrcode'), $script_ver);
+
+ wp_localize_script('simba-tfa-totp', 'simbatfa_totp', $this->translation_strings());
+
+ }
+
+ /**
+ * Get textual strings used from JavaScript
+ *
+ * @return Array
+ */
+ private function translation_strings() {
+
+ // It's possible that FORCE_ADMIN_SSL will make that SSL, whilst the user is on the front-end having logged in over non-SSL - and as a result, their login cookies won't get sent, and they're not registered as logged in.
+ $ajax_url = admin_url('admin-ajax.php');
+ $also_try = '';
+ if (!is_admin() && substr(strtolower($ajax_url), 0, 6) == 'https:' && !is_ssl()) {
+ $also_try = 'http:'.substr($ajax_url, 6);
+ }
+
+ return apply_filters('simba_tfa_totp_translation_strings', array(
+ 'ajax_url' => $ajax_url,
+ 'updating' => __('Updating...', 'all-in-one-wp-security-and-firewall'),
+ 'tfa_shared_nonce' => wp_create_nonce('tfa_shared_nonce'),
+ 'also_try' => $also_try,
+ 'response' => __('Response:', 'all-in-one-wp-security-and-firewall'),
+ ));
+ }
+
+ /**
+ * Return a link to refresh the current OTP code
+ *
+ * @return String
+ */
+ public function refresh_current_otp_link() {
+ return ''.__('(update)', 'all-in-one-wp-security-and-firewall').'';
+ }
+
+ /**
+ * Echo the radio buttons for changing between TOTP/HOTP
+ *
+ * TODO: Hide this choice on new installs (TOTP only)
+ *
+ * @param Integer $user_id
+ */
+ protected function print_algorithm_choice_radios($user_id) {
+ if (!$user_id) return;
+
+ $types = array(
+ 'totp' => __('TOTP (time based - most common algorithm; used by Google Authenticator)', 'all-in-one-wp-security-and-firewall'),
+ 'hotp' => __('HOTP (event based)', 'all-in-one-wp-security-and-firewall')
+ );
+
+ $setting = $this->get_user_otp_algorithm($user_id);
+
+ foreach ($types as $id => $name) {
+ print ' \n"; + } + } + + /** + * Print out the advanced settings box - choice of algorithm + * + * @param Boolean|Callable $submit_button_callback - if not a callback, then
\n" . esc_html__('Possible reason: your host may have disabled the mail() function.')); + + return true; +} + +// +// Main +// +// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- No nonce available. +$action = isset($_REQUEST['action']) ? sanitize_text_field(wp_unslash($_REQUEST['action'])) : 'login'; +$errors = new WP_Error(); + +if (isset($_GET['key'])) + $action = 'resetpass'; + +// validate action so as to default to the login screen +if (!in_array($action, array('postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction'), true) && false === has_filter('login_form_' . $action)) + $action = 'login'; + +nocache_headers(); + +header('Content-Type: '.get_bloginfo('html_type').'; charset='.get_bloginfo('charset')); + +if (defined('RELOCATE') && RELOCATE) { // Move flag is set + $path_info = isset($_SERVER['PATH_INFO']) ? sanitize_text_field(wp_unslash($_SERVER['PATH_INFO'])) : ''; + $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : ''; + + if ('' !== $path_info && ($path_info != $php_self)) + $_SERVER['PHP_SELF'] = str_replace($path_info, '', $php_self); + + $url = dirname(set_url_scheme('http://' . isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '' . $php_self)); + if (get_option('siteurl') != $url) + update_option('siteurl', $url); +} + +setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); +if (SITECOOKIEPATH != COOKIEPATH) + setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); + +$lang = ! empty($_GET['wp_lang']) ? sanitize_text_field(wp_unslash($_GET['wp_lang'])) : ''; +$switched_locale = false; + +if (function_exists('switch_to_locale')) { + $switched_locale = switch_to_locale($lang); +} + +/** + * Fires when the login form is initialized. + * + * @since 3.2.0 + */ +do_action('login_init'); + +/** + * Fires before a specified login form action. + * + * The dynamic portion of the hook name, `$action`, refers to the action + * that brought the visitor to the login form. Actions include 'postpass', + * 'logout', 'lostpassword', etc. + * + * @since 2.8.0 + */ +do_action("login_form_{$action}"); + +$http_post = ('POST' == isset($_SERVER['REQUEST_METHOD']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD'])) : ''); +$interim_login = isset($_REQUEST['interim-login']); + +/** + * Filters the separator used between login form navigation links. + * + * @since 4.9.0 + * + * @param string $login_link_separator The separator used between login form navigation links. + */ +$login_link_separator = apply_filters('login_link_separator', ' | '); + +switch ($action) { + + case 'postpass': + if (! array_key_exists('post_password', $_POST)) { + wp_safe_redirect(wp_get_referer()); + exit(); + } + + require_once ABSPATH . WPINC . '/class-phpass.php'; + $hasher = new PasswordHash(8, true); + + /** + * Filter the life span of the post password cookie. + * + * By default, the cookie expires 10 days from creation. To turn this + * into a session cookie, return 0. + * + * @since 3.7.0 + * + * @param int $expires The expiry time, as passed to setcookie(). + */ + $expire = apply_filters('post_password_expires', time() + 10 * DAY_IN_SECONDS); + + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitizing password not recommended. It's going to be hashed anyway. + setcookie('wp-postpass_' . COOKIEHASH, $hasher->HashPassword(wp_unslash($_POST['post_password'])), $expire, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true); + + if ($switched_locale) { + restore_previous_locale(); + } + + wp_safe_redirect(wp_get_referer()); + exit(); + case 'logout': + check_admin_referer('log-out'); + + $user = wp_get_current_user(); + + wp_logout(); + + if (! empty($_REQUEST['redirect_to'])) { + $redirect_to = $requested_redirect_to = sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])); + } else { + $redirect_to = 'wp-login.php?loggedout=true'; + $requested_redirect_to = ''; + } + + if ($switched_locale) { + restore_previous_locale(); + } + + /** + * Filter the log out redirect URL. + * + * @since 4.2.0 + * + * @param string $redirect_to The redirect destination URL. + * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter. + * @param WP_User $user The WP_User object for the user that's logging out. + */ + $redirect_to = apply_filters('logout_redirect', $redirect_to, $requested_redirect_to, $user); + + wp_safe_redirect($redirect_to); + exit(); + + case 'lostpassword': + case 'retrievepassword': + if ($http_post) { + $errors = retrieve_password(); + if (!is_wp_error($errors)) { + $redirect_to = !empty($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : 'wp-login.php?checkemail=confirm'; + wp_safe_redirect($redirect_to); + exit(); + } + } + + if (isset($_GET['error'])) { + if ('invalidkey' == $_GET['error']) { + $errors->add('invalidkey', __('Your password reset link appears to be invalid. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } elseif ('expiredkey' == $_GET['error']) { + $errors->add('expiredkey', __('Your password reset link has expired. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } + } + + $lostpassword_redirect = ! empty($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : ''; + /** + * Filter the URL redirected to after submitting the lostpassword/retrievepassword form. + * + * @since 3.0.0 + * + * @param string $lostpassword_redirect The redirect destination URL. + */ + $redirect_to = apply_filters('lostpassword_redirect', $lostpassword_redirect); + + /** + * Fires before the lost password form. + * + * @since 1.5.1 + */ + do_action('lost_password'); + + login_header(__('Lost Password'), '', $errors); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + + $user_login = ''; + + if (isset($_POST['user_login']) && is_string($_POST['user_login'])) { + $user_login = sanitize_text_field(wp_unslash($_POST['user_login'])); + } + + ?> + + + + + + get_error_code() === 'expired_key') { + wp_redirect(site_url('wp-login.php?action=lostpassword&error=expiredkey')); + } else { + wp_redirect(site_url('wp-login.php?action=lostpassword&error=invalidkey')); + } + exit; + } + + $errors = new WP_Error(); + + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- PCP warning. Not recommended to sanitize password. + if (isset($_POST['pass1']) && wp_unslash($_POST['pass1']) != isset($_POST['pass2']) ? wp_unslash($_POST['pass2']) : '') + $errors->add('password_reset_mismatch', __('The passwords do not match.')); + + /** + * Fires before the password reset procedure is validated. + * + * @since 3.5.0 + * + * @param object $errors WP Error object. + * @param WP_User|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise. + */ + do_action('validate_password_reset', $errors, $user); + + if ((! $errors->get_error_code()) && isset($_POST['pass1']) && !empty($_POST['pass1'])) { + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- PCP warning. Not recommended to sanitize password. + reset_password($user, wp_unslash($_POST['pass1'])); + setcookie($rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true); + login_header(__('Password Reset'), ''); + login_footer(); + exit; + } + + wp_enqueue_script('utils'); + wp_enqueue_script('user-profile'); + + login_header(__('Reset Password'), '', $errors); + ?> + + + + + ' . __('Register For This Site') . '', $errors); + ?> + + + + + + ID)) { + $secure_cookie = true; + force_ssl_admin(true); + } + } + } + + if (isset($_REQUEST['redirect_to'])) { + $redirect_to = sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])); + // Redirect to https if user wants ssl + if ($secure_cookie && false !== strpos($redirect_to, 'wp-admin')) + $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to); + } else { + $redirect_to = admin_url(); + } + + $reauth = empty($_REQUEST['reauth']) ? false : true; + + $user = wp_signon(array(), $secure_cookie); + + if (empty($_COOKIE[LOGGED_IN_COOKIE])) { + if (headers_sent()) { + // translators: 1: Browser cookie documentation URL, 2: Support forums URL + $user = new WP_Error('test_cookie', sprintf(__('ERROR: Cookies are blocked due to unexpected output. For help, please see this documentation or try the support forums.'), esc_url(__('https://codex.wordpress.org/Cookies')), esc_url(__('https://wordpress.org/support/')))); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } elseif (isset($_POST['testcookie']) && empty($_COOKIE[TEST_COOKIE])) { + // If cookies are disabled we can't log in even with a valid user+pass + // translators: 1: Browser cookie documentation URL + $user = new WP_Error('test_cookie', sprintf(__('ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.'), esc_url(__('https://codex.wordpress.org/Cookies')))); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation. + } + } + + $requested_redirect_to = isset($_REQUEST['redirect_to']) ? sanitize_text_field(wp_unslash($_REQUEST['redirect_to'])) : ''; + /** + * Filter the login redirect URL. + * + * @since 3.0.0 + * + * @param string $redirect_to The redirect destination URL. + * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter. + * @param WP_User|WP_Error $user WP_User object if login was successful, WP_Error object otherwise. + */ + $redirect_to = apply_filters('login_redirect', $redirect_to, $requested_redirect_to, $user); + + if (!is_wp_error($user) && !$reauth) { + if ($interim_login) { + $message = ''; + $interim_login = 'success'; + login_header('', $message); ?> +
+
\n"; + } else { + $errors .= ' ' . $error_message . "
\n"; + } + } + } + + if (! empty($errors)) { + /** + * Filters the error messages displayed above the login form. + * + * @since 2.1.0 + * + * @param string $errors Login error message. + */ + echo '
');
+ }
+
+ ?>
+ . ?>
+
+
+
+
+
+
+
+
+
+
+
+ add('empty_username', __('Error: Please enter a username or email address.'));
+ } elseif (strpos($_POST['user_login'], '@')) {
+ $user_data = get_user_by('email', trim(wp_unslash($_POST['user_login'])));
+ if (empty($user_data)) {
+ $errors->add('invalid_email', __('Error: There is no account with that username or email address.'));
+ }
+ } else {
+ $login = trim(wp_unslash($_POST['user_login']));
+ $user_data = get_user_by('login', $login);
+ }
+
+ /**
+ * Fires before errors are returned from a password reset request.
+ *
+ * @since 2.1.0
+ * @since 4.4.0 Added the `$errors` parameter.
+ * @since 5.4.0 Added the `$user_data` parameter.
+ *
+ * @param WP_Error $errors A WP_Error object containing any errors generated
+ * by using invalid credentials.
+ * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.
+ */
+ do_action('lostpassword_post', $errors, $user_data);
+
+ /**
+ * Filters the errors encountered on a password reset request.
+ *
+ * The filtered WP_Error object may, for example, contain errors for an invalid
+ * username or email address. A WP_Error object should always be returned,
+ * but may or may not contain errors.
+ *
+ * If any errors are present in $errors, this will abort the password reset request.
+ *
+ * @since 5.5.0
+ *
+ * @param WP_Error $errors A WP_Error object containing any errors generated
+ * by using invalid credentials.
+ * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.
+ */
+ $errors = apply_filters('lostpassword_errors', $errors, $user_data);
+
+ if ($errors->has_errors()) {
+ return $errors;
+ }
+
+ if (! $user_data) {
+ $errors->add('invalidcombo', __('Error: There is no account with that username or email address.'));
+ return $errors;
+ }
+
+ // Redefining user_login ensures we return the right case in the email.
+ $user_login = $user_data->user_login;
+ $user_email = $user_data->user_email;
+ $key = get_password_reset_key($user_data);
+
+ if (is_wp_error($key)) {
+ return $key;
+ }
+
+ if (is_multisite()) {
+ $site_name = get_network()->site_name;
+ } else {
+ /*
+ * The blogname option is escaped with esc_html on the way into the database
+ * in sanitize_option. We want to reverse this for the plain text arena of emails.
+ */
+ $site_name = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
+ }
+
+ $message = __('Someone has requested a password reset for the following account:') . "\r\n\r\n";
+ /* translators: %s: Site name. */
+ $message .= sprintf(__('Site Name: %s'), $site_name) . "\r\n\r\n";
+ /* translators: %s: User login. */
+ $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
+ $message .= __('If this was a mistake, ignore this email and nothing will happen.') . "\r\n\r\n";
+ $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
+ $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n\r\n";
+
+ $requester_ip = $_SERVER['REMOTE_ADDR'];
+ if ($requester_ip) {
+ $message .= sprintf(
+ /* translators: %s: IP address of password reset requester. */
+ __('This password reset request originated from the IP address %s.'),
+ $requester_ip
+ ) . "\r\n";
+ }
+
+ /* translators: Password reset notification email subject. %s: Site title. */
+ $title = sprintf(__('[%s] Password Reset'), $site_name);
+
+ /**
+ * Filters the subject of the password reset email.
+ *
+ * @since 2.8.0
+ * @since 4.4.0 Added the `$user_login` and `$user_data` parameters.
+ *
+ * @param string $title Email subject.
+ * @param string $user_login The username for the user.
+ * @param WP_User $user_data WP_User object.
+ */
+ $title = apply_filters('retrieve_password_title', $title, $user_login, $user_data);
+
+ /**
+ * Filters the message body of the password reset mail.
+ *
+ * If the filtered message is empty, the password reset email will not be sent.
+ *
+ * @since 2.8.0
+ * @since 4.1.0 Added `$user_login` and `$user_data` parameters.
+ *
+ * @param string $message Email message.
+ * @param string $key The activation key.
+ * @param string $user_login The username for the user.
+ * @param WP_User $user_data WP_User object.
+ */
+ $message = apply_filters('retrieve_password_message', $message, $key, $user_login, $user_data);
+
+ if ($message && ! wp_mail($user_email, wp_specialchars_decode($title), $message)) {
+ $errors->add(
+ 'retrieve_password_email_failure',
+ sprintf(
+ /* translators: %s: Documentation URL. */
+ __('Error: The email could not be sent. Your site may not be correctly configured to send emails. Get support for resetting your password.'), // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ esc_url(__('https://wordpress.org/support/article/resetting-your-password/'))
+ )
+ );
+ return $errors;
+ }
+
+ return true;
+}
+
+//
+// Main.
+//
+
+$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
+$errors = new WP_Error();
+
+if (isset($_GET['key'])) {
+ $action = 'resetpass';
+}
+
+if (isset($_GET['checkemail'])) {
+ $action = 'checkemail';
+}
+
+$default_actions = array(
+ 'confirm_admin_email',
+ 'postpass',
+ 'logout',
+ 'lostpassword',
+ 'retrievepassword',
+ 'resetpass',
+ 'rp',
+ 'register',
+ 'checkemail',
+ 'confirmaction',
+ 'login',
+ WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED,
+);
+
+// Validate action so as to default to the login screen.
+if (! in_array($action, $default_actions, true) && false === has_filter('login_form_' . $action)) {
+ $action = 'login';
+}
+
+nocache_headers();
+
+header('Content-Type: ' . get_bloginfo('html_type') . '; charset=' . get_bloginfo('charset'));
+
+if (defined('RELOCATE') && RELOCATE) { // Move flag is set.
+ if (isset($_SERVER['PATH_INFO']) && ($_SERVER['PATH_INFO'] !== $_SERVER['PHP_SELF'])) {
+ $_SERVER['PHP_SELF'] = str_replace($_SERVER['PATH_INFO'], '', $_SERVER['PHP_SELF']);
+ }
+
+ $url = dirname(set_url_scheme('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF']));
+
+ if (get_option('siteurl') !== $url) {
+ update_option('siteurl', $url);
+ }
+}
+
+setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true);
+
+if (SITECOOKIEPATH !== COOKIEPATH) {
+ setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, is_ssl(), true);
+}
+
+/**
+ * Fires when the login form is initialized.
+ *
+ * @since 3.2.0
+ */
+do_action('login_init');
+
+/**
+ * Fires before a specified login form action.
+ *
+ * The dynamic portion of the hook name, `$action`, refers to the action
+ * that brought the visitor to the login form. Actions include 'postpass',
+ * 'logout', 'lostpassword', etc.
+ *
+ * @since 2.8.0
+ */
+do_action("login_form_{$action}");
+
+$http_post = ('POST' === $_SERVER['REQUEST_METHOD']);
+$interim_login = isset($_REQUEST['interim-login']);
+
+/**
+ * Filters the separator used between login form navigation links.
+ *
+ * @since 4.9.0
+ *
+ * @param string $login_link_separator The separator used between login form navigation links.
+ */
+$login_link_separator = apply_filters('login_link_separator', ' | ');
+
+switch ($action) {
+
+ case 'confirm_admin_email':
+ /*
+ * Note that `is_user_logged_in()` will return false immediately after logging in
+ * as the current user is not set, see wp-includes/pluggable.php.
+ * However this action runs on a redirect after logging in.
+ */
+ if (! is_user_logged_in()) {
+ wp_safe_redirect(wp_login_url());
+ exit;
+ }
+
+ if (! empty($_REQUEST['redirect_to'])) {
+ $redirect_to = $_REQUEST['redirect_to'];
+ } else {
+ $redirect_to = admin_url();
+ }
+
+ if (current_user_can('manage_options')) {
+ $admin_email = get_option('admin_email');
+ } else {
+ wp_safe_redirect($redirect_to);
+ exit;
+ }
+
+ /**
+ * Filters the interval for dismissing the admin email confirmation screen.
+ *
+ * If `0` (zero) is returned, the "Remind me later" link will not be displayed.
+ *
+ * @since 5.3.1
+ *
+ * @param int $interval Interval time (in seconds). Default is 3 days.
+ */
+ $remind_interval = (int) apply_filters('admin_email_remind_interval', 3 * DAY_IN_SECONDS);
+
+ if (! empty($_GET['remind_me_later'])) {
+ if (! wp_verify_nonce($_GET['remind_me_later'], 'remind_me_later_nonce')) {
+ wp_safe_redirect(wp_login_url());
+ exit;
+ }
+
+ if ($remind_interval > 0) {
+ update_option('admin_email_lifespan', time() + $remind_interval);
+ }
+
+ $redirect_to = add_query_arg('admin_email_remind_later', 1, $redirect_to);
+ wp_safe_redirect($redirect_to);
+ exit;
+ }
+
+ if (! empty($_POST['correct-admin-email'])) {
+ if (! check_admin_referer('confirm_admin_email', 'confirm_admin_email_nonce')) {
+ wp_safe_redirect(wp_login_url());
+ exit;
+ }
+
+ /**
+ * Filters the interval for redirecting the user to the admin email confirmation screen.
+ *
+ * If `0` (zero) is returned, the user will not be redirected.
+ *
+ * @since 5.3.0
+ *
+ * @param int $interval Interval time (in seconds). Default is 6 months.
+ */
+ $admin_email_check_interval = (int) apply_filters('admin_email_check_interval', 6 * MONTH_IN_SECONDS);
+
+ if ($admin_email_check_interval > 0) {
+ update_option('admin_email_lifespan', time() + $admin_email_check_interval);
+ }
+
+ wp_safe_redirect($redirect_to);
+ exit;
+ }
+
+ login_header(__('Confirm your administration email'), '', $errors);
+
+ /**
+ * Fires before the admin email confirm form.
+ *
+ * @since 5.3.0
+ *
+ * @param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
+ * credentials. Note that the error object may not contain any errors.
+ */
+ do_action('admin_email_confirm', $errors);
+ ?>
+
+ ', __('(opens in a new tab)'));
+
+ printf(
+ '%s%s',
+ esc_url($admin_email_help_url),
+ esc_html__('Why is this important?'),
+ wp_kses_post($accessibility_text)
+ );
+ ?>
+
+ + add('error', $error); + unset($error); + } + + if ($wp_error->has_errors()) { + $errors = ''; + $messages = ''; + + foreach ($wp_error->get_error_codes() as $code) { + $severity = $wp_error->get_error_data($code); + foreach ($wp_error->get_error_messages($code) as $error_message) { + if ('message' === $severity) { + $messages .= ' ' . $error_message . "
\n"; + } else { + $errors .= ' ' . $error_message . "
\n"; + } + } + } + + if (! empty($errors)) { + /** + * Filters the error messages displayed above the login form. + * + * @since 2.1.0 + * + * @param string $errors Login error message. + */ + echo '
' . wp_kses_post(apply_filters('login_errors', $errors)) . "
\n";
+ }
+
+ if (! empty($messages)) {
+ /**
+ * Filters instructional messages displayed above the login form.
+ *
+ * @since 2.5.0
+ *
+ * @param string $messages Login messages.
+ */
+ echo '\n";
+ }
+ }
+} // End of login_header().
+
+/**
+ * Outputs the footer for the login page.
+ *
+ * @since 3.1.0
+ *
+ * @global bool|string $interim_login Whether interim login modal is being displayed. String 'success'
+ * upon successful login.
+ *
+ * @param string $input_id Which input to auto-focus.
+ */
+function login_footer($input_id = '') {
+ global $interim_login;
+
+ // Don't allow interim logins to navigate away from the page.
+ if (! $interim_login) {
+ ?>
+
+ ', '+ ' . esc_html($admin_email) . '' + ); + ?> +
++ +
+ +
+
+ 0) : ?>
+
+
+
+
+
+ HashPassword(wp_unslash($_POST['post_password'])), $expire, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true);
+
+ wp_safe_redirect(wp_get_referer());
+ exit;
+
+ case 'logout':
+ check_admin_referer('log-out');
+
+ $user = wp_get_current_user();
+
+ wp_logout();
+
+ if (! empty($_REQUEST['redirect_to'])) {
+ $redirect_to = $_REQUEST['redirect_to'];
+ $requested_redirect_to = $redirect_to;
+ } else {
+ $redirect_to = add_query_arg(
+ array(
+ 'loggedout' => 'true',
+ 'wp_lang' => get_user_locale($user),
+ ),
+ wp_login_url()
+ );
+
+ $requested_redirect_to = '';
+ }
+
+ /**
+ * Filters the log out redirect URL.
+ *
+ * @since 4.2.0
+ *
+ * @param string $redirect_to The redirect destination URL.
+ * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
+ * @param WP_User $user The WP_User object for the user that's logging out.
+ */
+ $redirect_to = apply_filters('logout_redirect', $redirect_to, $requested_redirect_to, $user);
+
+ wp_safe_redirect($redirect_to);
+ exit;
+
+ case 'lostpassword':
+ case 'retrievepassword':
+ if ($http_post) {
+ $errors = retrieve_password();
+
+ if (! is_wp_error($errors)) {
+ $redirect_to = ! empty($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';
+ wp_safe_redirect($redirect_to);
+ exit;
+ }
+ }
+
+ if (isset($_GET['error'])) {
+ if ('invalidkey' === $_GET['error']) {
+ $errors->add('invalidkey', __('Your password reset link appears to be invalid. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ } elseif ('expiredkey' === $_GET['error']) {
+ $errors->add('expiredkey', __('Your password reset link has expired. Please request a new link below.')); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ }
+ }
+
+ $lostpassword_redirect = ! empty($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : '';
+ /**
+ * Filters the URL redirected to after submitting the lostpassword/retrievepassword form.
+ *
+ * @since 3.0.0
+ *
+ * @param string $lostpassword_redirect The redirect destination URL.
+ */
+ $redirect_to = apply_filters('lostpassword_redirect', $lostpassword_redirect);
+
+ /**
+ * Fires before the lost password form.
+ *
+ * @since 1.5.1
+ * @since 5.1.0 Added the `$errors` parameter.
+ *
+ * @param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
+ * credentials. Note that the error object may not contain any errors.
+ */
+ do_action('lost_password', $errors);
+
+ login_header(__('Lost Password'), '', $errors); // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+
+ $user_login = '';
+
+ if (isset($_POST['user_login']) && is_string($_POST['user_login'])) {
+ $user_login = wp_unslash($_POST['user_login']);
+ }
+
+ ?>
+
+
+
+
+ get_error_code() === 'expired_key') {
+ wp_redirect(site_url('wp-login.php?action=lostpassword&error=expiredkey'));
+ } else {
+ wp_redirect(site_url('wp-login.php?action=lostpassword&error=invalidkey'));
+ }
+
+ exit;
+ }
+
+ $errors = new WP_Error();
+
+ if (isset($_POST['pass1']) && $_POST['pass1'] !== $_POST['pass2']) {
+ $errors->add('password_reset_mismatch', __('The passwords do not match.'));
+ }
+
+ /**
+ * Fires before the password reset procedure is validated.
+ *
+ * @since 3.5.0
+ *
+ * @param WP_Error $errors WP Error object.
+ * @param WP_User|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise.
+ */
+ do_action('validate_password_reset', $errors, $user);
+
+ if ((! $errors->has_errors()) && isset($_POST['pass1']) && ! empty($_POST['pass1'])) {
+ reset_password($user, $_POST['pass1']);
+ setcookie($rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true);
+ login_header(__('Password Reset'), '');
+ login_footer();
+ exit;
+ }
+
+ wp_enqueue_script('utils');
+ wp_enqueue_script('user-profile');
+
+ login_header(__('Reset Password'), '', $errors);
+ ?>
+
+
+
+ ' . __('Register For This Site') . '', $errors);
+ ?>
+
+
+
+ add(
+ 'confirm',
+ sprintf(
+ /* translators: %s: Link to the login page. */
+ __('Check your email for the confirmation link, then visit the login page.'),
+ wp_login_url()
+ ),
+ 'message'
+ );
+ } elseif ('registered' === $_GET['checkemail']) {
+ $errors->add(
+ 'registered',
+ sprintf(
+ /* translators: %s: Link to the login page. */
+ __('Registration complete. Please check your email, then visit the login page.'), // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ wp_login_url()
+ ),
+ 'message'
+ );
+ }
+
+ // This action is documented in wp-login.php
+ $errors = apply_filters('wp_login_errors', $errors, $redirect_to);
+
+ login_header(__('Check your email'), '', $errors);
+ login_footer();
+ break;
+
+ case 'confirmaction':
+ if (! isset($_GET['request_id'])) {
+ wp_die(esc_html__('Missing request ID.'));
+ }
+
+ if (! isset($_GET['confirm_key'])) {
+ wp_die(esc_html__('Missing confirm key.'));
+ }
+
+ $request_id = (int) $_GET['request_id'];
+ $key = sanitize_text_field(wp_unslash($_GET['confirm_key']));
+ $result = wp_validate_user_request_key($request_id, $key);
+
+ if (is_wp_error($result)) {
+ wp_die($result);
+ }
+
+ /**
+ * Fires an action hook when the account action has been confirmed by the user.
+ *
+ * Using this you can assume the user has agreed to perform the action by
+ * clicking on the link in the confirmation email.
+ *
+ * After firing this action hook the page will redirect to wp-login a callback
+ * redirects or exits first.
+ *
+ * @since 4.9.6
+ *
+ * @param int $request_id Request ID.
+ */
+ do_action('user_request_action_confirmed', $request_id);
+
+ $message = _wp_privacy_account_request_confirmed_message($request_id);
+
+ login_header(__('User action confirmed.'), $message);
+ login_footer();
+ exit;
+
+ case 'login':
+ default:
+ $secure_cookie = '';
+ $customize_login = isset($_REQUEST['customize-login']);
+
+ if ($customize_login) {
+ wp_enqueue_script('customize-base');
+ }
+
+ // If the user wants SSL but the session is not SSL, force a secure cookie.
+ if (! empty($_POST['log']) && ! force_ssl_admin()) {
+ $user_name = sanitize_user(wp_unslash($_POST['log']));
+ $user = get_user_by('login', $user_name);
+
+ if (! $user && strpos($user_name, '@')) {
+ $user = get_user_by('email', $user_name);
+ }
+
+ if ($user) {
+ if (get_user_option('use_ssl', $user->ID)) {
+ $secure_cookie = true;
+ force_ssl_admin(true);
+ }
+ }
+ }
+
+ if (isset($_REQUEST['redirect_to'])) {
+ $redirect_to = $_REQUEST['redirect_to'];
+ // Redirect to HTTPS if user wants SSL.
+ if ($secure_cookie && false !== strpos($redirect_to, 'wp-admin')) {
+ $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to);
+ }
+ } else {
+ $redirect_to = admin_url();
+ }
+
+ $reauth = empty($_REQUEST['reauth']) ? false : true;
+
+ $user = wp_signon(array(), $secure_cookie);
+
+ if (empty($_COOKIE[LOGGED_IN_COOKIE])) {
+ if (headers_sent()) {
+ $user = new WP_Error(
+ 'test_cookie',
+ sprintf(
+ /* translators: 1: Browser cookie documentation URL, 2: Support forums URL. */
+ __('Error: Cookies are blocked due to unexpected output. For help, please see this documentation or try the support forums.'), // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ esc_url(__('https://wordpress.org/support/article/cookies/')),
+ esc_url(__('https://wordpress.org/support/forums/'))
+ )
+ );
+ } elseif (isset($_POST['testcookie']) && empty($_COOKIE[TEST_COOKIE])) {
+ // If cookies are disabled, we can't log in even with a valid user and password.
+ $user = new WP_Error(
+ 'test_cookie',
+ sprintf(
+ /* translators: %s: Browser cookie documentation URL. */
+ __('Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.'), // phpcs:ignore UpdraftPlus.Translation.MultipleSentence.MultipleSentenceInsideTranslationFunction -- This is a WordPress translation.
+ esc_url(__('https://wordpress.org/support/article/cookies/#enable-cookies-in-your-browser'))
+ )
+ );
+ }
+ }
+
+ $requested_redirect_to = isset($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : '';
+ /**
+ * Filters the login redirect URL.
+ *
+ * @since 3.0.0
+ *
+ * @param string $redirect_to The redirect destination URL.
+ * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
+ * @param WP_User|WP_Error $user WP_User object if login was successful, WP_Error object otherwise.
+ */
+ $redirect_to = apply_filters('login_redirect', $redirect_to, $requested_redirect_to, $user);
+
+ if (! is_wp_error($user) && ! $reauth) {
+ if ($interim_login) {
+ $message = '';
+ $interim_login = 'success';
+ login_header('', $message);
+ ?>
+
+
+
+
+