' . $this->_messageHTML . '
' . sprintf(__('Dismiss', 'wordfence'), esc_attr($this->_id)) . '
' . wp_kses(sprintf(__('XML-RPC authentication is disabled. Jetpack is currently active and requires XML-RPC authentication to work correctly. Manage Settings', 'wordfence'), esc_url(network_admin_url('admin.php?page=WFLS#top#settings'))), array('a'=>array('href'=>array()))) . '
' . wp_kses(sprintf(__('reCAPTCHA test mode is enabled. While enabled, login and registration requests will be checked for their score but will not be blocked if the score is below the minimum score. Manage Settings', 'wordfence'), esc_url(network_admin_url('admin.php?page=WFLS#top#settings'))), array('a'=>array('href'=>array()))) . '
|
$user, 'gracePeriod' => $inGracePeriod ))->render() ?> has_revokable_grace_period($user)): ?> $user ))->render() ?> |
`, populating $user from
* that if so.
*/
if (!defined('WORDFENCE_LS_CHECKING_COMBINED') && (!isset($_POST['wfls-token']) || !is_string($_POST['wfls-token'])) && (!is_object($user) || !($user instanceof \WP_User))) {
//Compatibility with WF legacy 2FA
$combinedTOTPRegex = '/((?:[0-9]{3}\s*){2})$/i';
$combinedRecoveryRegex = '/((?:[a-f0-9]{4}\s*){4})$/i';
if ($this->legacy_2fa_active()) {
$combinedTOTPRegex = '/(? strlen($matches[1])) {
$revisedPassword = substr($password, 0, strlen($password) - strlen($matches[1]));
$code = $matches[1];
}
}
else if (preg_match($combinedRecoveryRegex, $password, $matches)) { //Possible recovery code
if (strlen($password) > strlen($matches[1])) {
$revisedPassword = substr($password, 0, strlen($password) - strlen($matches[1]));
$code = $matches[1];
}
}
if (isset($revisedPassword)) {
define('WORDFENCE_LS_CHECKING_COMBINED', true); //Avoid recursing into this block
if (!defined('WORDFENCE_LS_AUTHENTICATION_CHECK')) { define('WORDFENCE_LS_AUTHENTICATION_CHECK', true); }
$revisedUser = wp_authenticate($username, $revisedPassword);
if (is_object($revisedUser) && ($revisedUser instanceof \WP_User) && Controller_TOTP::shared()->validate_2fa($revisedUser, $code, $isLogin)) {
define('WORDFENCE_LS_COMBINED_IS_VALID', true); //This will cause the front-end to skip the 2FA prompt
$user = $revisedUser;
$combinedTwoFactor = true;
}
}
}
/*
* CAPTCHA Check
*
* It will be enforced so long as:
*
* 1. It's enabled and keys are set.
* 2. This is not an XML-RPC request. An XML-RPC request is de facto an automated request, so a CAPTCHA makes
* no sense.
* 3. A filter does not override it. This is to allow plugins with REST endpoints that handle authentication
* themselves to opt out of the requirement.
* 4. The user is not providing a combined credentials + 2FA authentication login request.
* 5. The request is not a WooCommerce login while WC integration is disabled
*/
if (!$combinedTwoFactor && !$isCombinedCheck && !empty($username) && (!$this->_is_woocommerce_login() || Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION))) { //Login attempt, not just a wp-login.php page load
$requireCAPTCHA = Controller_CAPTCHA::shared()->is_captcha_required();
$performVerification = false;
$token = Controller_CAPTCHA::shared()->get_token();
if ($requireCAPTCHA && empty($token) && !Controller_CAPTCHA::shared()->test_mode()) { //No CAPTCHA token means forced additional verification (if neither 2FA nor test mode are active)
$performVerification = true;
}
if (is_object($user) && $user instanceof \WP_User && $this->validate_email_verification_token($user)) { //Skip the CAPTCHA check if the email address was verified
$requireCAPTCHA = false;
$performVerification = false;
//Reset token rate limit
$identifier = sprintf('wfls-captcha-%d', $user->ID);
$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
$tokenBucket->reset();
}
$score = false;
if ($requireCAPTCHA && !$performVerification) {
$expired = false;
if (is_object($user) && $user instanceof \WP_User) {
$score = Controller_Users::shared()->cached_captcha_score($token, $user, $expired);
}
if ($score === false) {
if ($expired) {
return new \WP_Error('wfls_captcha_expired', wp_kses(__('CAPTCHA EXPIRED: The CAPTCHA verification for this login attempt has expired. Please try again.', 'wordfence'), array('strong'=>array())));
}
$score = Controller_CAPTCHA::shared()->score($token);
if ($score !== false && is_object($user) && $user instanceof \WP_User) {
Controller_Users::shared()->cache_captcha_score($token, $score, $user);
Controller_Users::shared()->record_captcha_score($user, $score);
}
}
if ($score === false && !Controller_CAPTCHA::shared()->test_mode()) { //An invalid token will require additional verification (if test mode is not active)
$performVerification = true;
}
}
if ($requireCAPTCHA) {
if ($performVerification || !Controller_CAPTCHA::shared()->is_human($score)) {
if (is_object($user) && $user instanceof \WP_User) {
$identifier = sprintf('wfls-captcha-%d', $user->ID);
$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 3, 1 / (WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES * Model_TokenBucket::MINUTE)); //Maximum of three requests, refilling at a rate of one per token expiration period
if ($tokenBucket->consume(1)) {
if ($this->has_woocommerce() && array_key_exists('woocommerce-login-nonce', $_POST)) {
$loginUrl = get_permalink(get_option('woocommerce_myaccount_page_id'));
}
else {
$loginUrl = wp_login_url();
}
$verificationUrl = add_query_arg(
array(
'wfls-email-verification' => rawurlencode(Controller_Users::shared()->generate_verification_token($user))
),
$loginUrl
);
$view = new Model_View('email/login-verification', array(
'siteName' => get_bloginfo('name', 'raw'),
'verificationURL' => $verificationUrl,
'ip' => Model_Request::current()->ip(),
'canEnable2FA' => Controller_Users::shared()->can_activate_2fa($user),
));
wp_mail($user->user_email, __('Login Verification Required', 'wordfence'), $view->render(), "Content-Type: text/html");
}
}
Utility_Sleep::sleep(Model_Crypto::random_int(0, 2000) / 1000);
return new \WP_Error('wfls_captcha_verify', wp_kses(__('VERIFICATION REQUIRED: Additional verification is required for login. If there is a valid account for the provided login credentials, please check the email address associated with it for a verification link to continue logging in.', 'wordfence'), array('strong' => array())));
}
}
}
if (!$combinedTwoFactor) {
if ($isLogin && $user instanceof \WP_User) {
if (Controller_Users::shared()->has_2fa_active($user)) {
if (Controller_Users::shared()->has_remembered_2fa($user)) {
return $user;
}
elseif (array_key_exists('wfls-token', $_POST)) {
if (is_string($_POST['wfls-token']) && Controller_TOTP::shared()->validate_2fa($user, $_POST['wfls-token'])) {
return $user;
}
else {
return new \WP_Error('wfls_twofactor_failed', wp_kses(__('CODE INVALID: The 2FA code provided is either expired or invalid. Please try again.', 'wordfence'), array('strong'=>array())));
}
}
}
$in2faGracePeriod = false;
$time2faRequired = null;
if (Controller_Users::shared()->has_2fa_active($user)) {
$legacy2FAActive = Controller_WordfenceLS::shared()->legacy_2fa_active();
if ($legacy2FAActive) {
return new \WP_Error('wfls_twofactor_required', wp_kses(__('CODE REQUIRED: Please enter your 2FA code immediately after your password in the same field.', 'wordfence'), array('strong'=>array())));
}
return new \WP_Error('wfls_twofactor_required', wp_kses(__('CODE REQUIRED: Please provide your 2FA code when prompted.', 'wordfence'), array('strong'=>array())));
}
else if (Controller_Users::shared()->requires_2fa($user, $in2faGracePeriod, $time2faRequired)) {
return new \WP_Error('wfls_twofactor_blocked', wp_kses(__('LOGIN BLOCKED: 2FA is required to be active on your account. Please contact the site administrator.', 'wordfence'), array('strong'=>array())));
}
else if ($in2faGracePeriod) {
Controller_Notices::shared()->add_notice(Model_Notice::SEVERITY_CRITICAL, new Model_HTML(wp_kses(sprintf(__('You do not currently have two-factor authentication active on your account, which will be required beginning %s. Configure 2FA', 'wordfence'), Controller_Time::format_local_time('F j, Y g:i A', $time2faRequired), esc_url((is_multisite() && is_super_admin($user->ID)) ? network_admin_url('admin.php?page=WFLS') : admin_url('admin.php?page=WFLS'))), array('a'=>array('href'=>array())))), 'wfls-will-be-required', $user);
}
}
}
return $user;
}
public function _set_logged_in_cookie($logged_in_cookie, $expire, $expiration, $user_id) {
$user = new \WP_User($user_id);
if (Controller_Users::shared()->has_2fa_active($user) && isset($_POST['wfls-remember-device']) && $_POST['wfls-remember-device']) {
Controller_Users::shared()->remember_2fa($user);
}
delete_user_meta($user_id, 'wfls-captcha-nonce');
}
public function _record_login($user_login/*, $user -- we'd like to use the second parameter instead, but too many plugins call this hook and only provide one of the two required parameters*/) {
$user = get_user_by('login', $user_login);
if (is_object($user) && $user instanceof \WP_User && $user->exists()) {
update_user_meta($user->ID, 'wfls-last-login', Controller_Time::time());
}
}
public function _register_post($sanitized_user_login, $user_email, $errors) {
if (!empty($sanitized_user_login)) {
$captchaResult = $this->process_registration_captcha_with_hooks();
if ($captchaResult !== true) {
$errors->add($captchaResult['category'], $captchaResult['message']);
}
}
}
private function validate_email_verification_token($user = null, &$token = null) {
$token = isset($_REQUEST['wfls-email-verification']) ? $_REQUEST['wfls-email-verification'] : null;
if (empty($token))
return null;
return is_string($token) && Controller_Users::shared()->validate_verification_token($token, $user);
}
/**
* @param \WP_Error $errors
* @param string $redirect_to
* @return \WP_Error
*/
public function _wp_login_errors($errors, $redirect_to) {
$has_errors = (method_exists($errors, 'has_errors') ? $errors->has_errors() : !empty($errors->errors)); //has_errors was added in WP 5.1
$emailVerificationTokenValid = $this->validate_email_verification_token();
if (!$has_errors && $emailVerificationTokenValid !== null) {
if ($emailVerificationTokenValid) {
$errors->add('wfls_email_verified', esc_html__('Email verification succeeded. Please continue logging in.', 'wordfence'), 'message');
}
else {
$errors->add('wfls_email_not_verified', esc_html__('Email verification invalid or expired. Please try again.', 'wordfence'), 'message');
}
}
return $errors;
}
public function legacy_2fa_active() {
$wfLegacy2FAActive = false;
if (class_exists('wfConfig') && \wfConfig::get('isPaid')) {
$twoFactorUsers = \wfConfig::get_ser('twoFactorUsers', array());
if (is_array($twoFactorUsers) && count($twoFactorUsers) > 0) {
foreach ($twoFactorUsers as $t) {
if ($t[3] == 'activated') {
$testUser = get_user_by('ID', $t[0]);
if (is_object($testUser) && $testUser instanceof \WP_User && \wfUtils::isAdmin($testUser)) {
$wfLegacy2FAActive = true;
break;
}
}
}
}
if ($wfLegacy2FAActive && class_exists('wfCredentialsController') && method_exists('wfCredentialsController', 'useLegacy2FA') && !\wfCredentialsController::useLegacy2FA()) {
$wfLegacy2FAActive = false;
}
}
return $wfLegacy2FAActive;
}
/**
* Menu
*/
public function _admin_menu() {
$user = wp_get_current_user();
if (Controller_Notices::shared()->has_notice($user)) {
Controller_Users::shared()->requires_2fa($user, $gracePeriod);
if (!$gracePeriod) {
Controller_Notices::shared()->remove_notice(false, 'wfls-will-be-required', $user);
}
}
Controller_Notices::shared()->enqueue_notices();
$useSubmenu = WORDFENCE_LS_FROM_CORE && current_user_can('activate_plugins');
if (is_multisite() && !is_network_admin()) {
$useSubmenu = false;
if (is_super_admin()) {
return;
}
}
if ($useSubmenu) {
add_submenu_page('Wordfence', __('Login Security', 'wordfence'), __('Login Security', 'wordfence'), Controller_Permissions::CAP_ACTIVATE_2FA_SELF, 'WFLS', array($this, '_menu'));
}
else {
add_menu_page(__('Login Security', 'wordfence'), __('Login Security', 'wordfence'), Controller_Permissions::CAP_ACTIVATE_2FA_SELF, 'WFLS', array($this, '_menu'), Model_Asset::img('menu.svg'));
}
}
public function _menu() {
$user = wp_get_current_user();
$administrator = false;
$canEditUsers = false;
if (Controller_Permissions::shared()->can_manage_settings($user)) {
$administrator = true;
}
if (user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {
$canEditUsers = true;
if (isset($_GET['user'])) {
$user = new \WP_User((int) $_GET['user']);
if (!$user->exists()) {
$user = wp_get_current_user();
}
}
}
$sections = array();
if (isset($_GET['role']) && $canEditUsers) {
$roleKey = $_GET['role'];
$roles = new \WP_Roles();
$role = $roles->get_role($roleKey);
$roleTitle = $roleKey === 'super-admin' ? __('Super Administrator', 'wordfence') : $roles->role_names[$roleKey];
$requiredAt = Controller_Settings::shared()->get_required_2fa_role_activation_time($roleKey);
$states = array(
'grace_period' => array(
'title' => __('Grace Period', 'wordfence'),
'gracePeriod' => true
),
'locked_out' => array(
'title' => __('Locked Out', 'wordfence'),
'gracePeriod' => false
)
);
foreach ($states as $key => $state) {
$pageKey = "page_$key";
$page = isset($_GET[$pageKey]) ? max((int) $_GET[$pageKey], 1) : 1;
$title = $state['title'];
$lastPage = true;
if ($requiredAt === false)
$users = array();
else
$users = Controller_Users::shared()->get_inactive_2fa_users($roleKey, $state['gracePeriod'], $page, self::USERS_PER_PAGE, $lastPage);
$sections[] = array(
'tab' => new Model_Tab($key, $key, $title, $title),
'title' => new Model_Title($key, sprintf(__('Users without 2FA active (%s)', 'wordfence'), $title) . ' - ' . $roleTitle),
'content' => new Model_View('page/role', array(
'role' => $role,
'roleTitle' => $roleTitle,
'stateTitle' => $title,
'requiredAt' => $requiredAt,
'state' => $state,
'users' => $users,
'page' => $page,
'lastPage' => $lastPage,
'pageKey' => $pageKey,
'stateKey' => $key
)),
);
}
}
else {
$sections[] = array(
'tab' => new Model_Tab('manage', 'manage', __('Two-Factor Authentication', 'wordfence'), __('Two-Factor Authentication', 'wordfence')),
'title' => new Model_Title('manage', __('Two-Factor Authentication', 'wordfence'), Controller_Support::supportURL(Controller_Support::ITEM_MODULE_LOGIN_SECURITY_2FA), new Model_HTML(wp_kses(__('Learn more about Two-Factor Authentication', 'wordfence'), array('span'=>array('class'=>array()))))),
'content' => new Model_View('page/manage', array(
'user' => $user,
'canEditUsers' => $canEditUsers,
)),
);
if ($administrator) {
$sections[] = array(
'tab' => new Model_Tab('settings', 'settings', __('Settings', 'wordfence'), __('Settings', 'wordfence')),
'title' => new Model_Title('settings', __('Login Security Settings', 'wordfence'), Controller_Support::supportURL(Controller_Support::ITEM_MODULE_LOGIN_SECURITY), new Model_HTML(wp_kses(__('Learn more about Login Security', 'wordfence'), array('span'=>array('class'=>array()))))),
'content' => new Model_View('page/settings', array(
'hasWoocommerce' => $this->has_woocommerce()
)),
);
}
}
$view = new Model_View('page/page', array(
'sections' => $sections,
));
echo $view->render();
}
private function process_registration_captcha() {
if (Controller_Whitelist::shared()->is_whitelisted(Model_Request::current()->ip())) { //Whitelisted, so we're not enforcing 2FA
return true;
}
$captchaController = Controller_CAPTCHA::shared();
$requireCaptcha = $captchaController->is_captcha_required();
$token = $captchaController->get_token();
if ($requireCaptcha) {
if ($token === null && !$captchaController->test_mode()) {
return array(
'message' => wp_kses(__('REGISTRATION ATTEMPT BLOCKED: This site requires a security token created when the page loads for all registration attempts. Please ensure JavaScript is enabled and try again.', 'wordfence'), array('strong'=>array())),
'category' => 'wfls_captcha_required'
);
}
$score = $captchaController->score($token);
if ($score === false && !$captchaController->test_mode()) {
return array(
'message' => wp_kses(__('REGISTRATION ATTEMPT BLOCKED: The security token for the login attempt was invalid or expired. Please reload the page and try again.', 'wordfence'), array('strong'=>array())),
'category' => 'wfls_captcha_required'
);
}
Controller_Users::shared()->record_captcha_score(null, $score);
if (!$captchaController->is_human($score)) {
$encryptedIP = Model_Symmetric::encrypt(Model_Request::current()->ip());
$encryptedScore = Model_Symmetric::encrypt($score);
$result = array(
'category' => 'wfls_registration_blocked'
);
if ($encryptedIP && $encryptedScore && filter_var(get_site_option('admin_email'), FILTER_VALIDATE_EMAIL)) {
$jwt = new Model_JWT(array('ip' => $encryptedIP, 'score' => $encryptedScore), Controller_Time::time() + 600);
$result['message'] = wp_kses(sprintf(__('REGISTRATION BLOCKED: The registration request was blocked because it was flagged as spam. Please try again or contact the site owner for help.', 'wordfence'), esc_attr((string)$jwt)), array('strong'=>array(), 'a'=>array('href'=>array(), 'class'=>array(), 'data-token'=>array())));
}
else {
$result['message'] = wp_kses(__('REGISTRATION BLOCKED: The registration request was blocked because it was flagged as spam. Please try again or contact the site owner for help.', 'wordfence'), array('strong'=>array()));
}
return $result;
}
}
return true;
}
/**
* @param int $endpointType the type of endpoint being processed
* The default value of 1 corresponds to a regular login
* @see wordfence::wfsnEndpointType()
*/
private function process_registration_captcha_with_hooks($endpointType = 1) {
$result = $this->process_registration_captcha();
if ($result !== true) {
if ($result['category'] === 'wfls_registration_blocked') {
/**
* Fires just prior to blocking user registration due to a failed CAPTCHA. After firing this action hook
* the registration attempt is blocked.
*
* @param int $source The source code of the block.
*/
do_action('wfls_registration_blocked', $endpointType);
/**
* Filters the message to show if registration is blocked due to a captcha rejection.
*
* @since 1.0.0
*
* @param string $message The message to display, HTML allowed.
*/
$result['message'] = apply_filters('wfls_registration_blocked_message', $result['message']);
}
}
return $result;
}
private function disable_woocommerce_registration($message) {
if ($this->has_woocommerce()) {
remove_action('wp_loaded', array('WC_Form_Handler', 'process_registration'), 20);
wc_add_notice($message, 'error');
}
}
public function _handle_woocommerce_registration() {
if ($this->has_woocommerce() && isset($_POST['register'], $_POST['email']) && (isset($_POST['_wpnonce']) || isset($_POST['woocommerce-register-nonce']))) {
$captchaResult = $this->process_registration_captcha_with_hooks();
if ($captchaResult !== true) {
$this->disable_woocommerce_registration($captchaResult['message']);
}
}
}
public function _user_new_form() {
if (Controller_Settings::shared()->get_user_2fa_grace_period())
echo Model_View::create('user/grace-period-toggle', array())->render();
}
public function _user_register($newUserId) {
$creator = wp_get_current_user();
if (!Controller_Permissions::shared()->can_manage_settings($creator) || $creator->ID == $newUserId)
return;
if (isset($_POST['wfls-grace-period-toggle']))
Controller_Users::shared()->allow_grace_period($newUserId);
}
public function _woocommerce_account_menu_items($items) {
if ($this->can_user_activate_2fa_self()) {
$endpointId = self::WOOCOMMERCE_ENDPOINT;
$label = __('Wordfence 2FA', 'wordfence');
if (!Utility_Array::insertAfter($items, 'edit-account', $endpointId, $label)) {
$items[$endpointId] = $label;
}
}
return $items;
}
public function _woocommerce_get_query_vars($query_vars) {
$query_vars[self::WOOCOMMERCE_ENDPOINT] = self::WOOCOMMERCE_ENDPOINT;
return $query_vars;
}
private function can_user_activate_2fa_self($user = null) {
if ($user === null)
$user = wp_get_current_user();
return user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF);
}
private function render_embedded_user_2fa_management_interface($stacked = null) {
$user = wp_get_current_user();
$stacked = $stacked === null ? Controller_Settings::shared()->should_stack_ui_columns() : $stacked;
if ($this->can_user_activate_2fa_self($user)) {
$assets = $this->management_assets_enqueued ? array() : $this->get_2fa_management_assets(true);
$scriptData = $this->management_assets_enqueued ? array() : $this->get_2fa_management_script_data();
return Model_View::create(
'page/manage-embedded',
array(
'user' => $user,
'stacked' => $stacked,
'assets' => $assets,
'scriptData' => $scriptData
)
)->render();
}
else {
return Model_View::create('page/permission-denied')->render();
}
}
public function _woocommerce_account_menu_content() {
echo $this->render_embedded_user_2fa_management_interface();
}
private function does_current_page_include_shortcode($shortcode) {
global $post;
return $post instanceof \WP_Post && has_shortcode($post->post_content, $shortcode);
}
public function _woocommerce_account_enqueue_assets() {
if (!$this->has_woocommerce())
return;
if ($this->does_current_page_include_shortcode('woocommerce_my_account')) {
wp_enqueue_style('wordfence-ls-woocommerce-account-styles', Model_Asset::css('woocommerce-account.css'), array(), WORDFENCE_LS_VERSION);
$this->enqueue_2fa_management_assets(true);
}
}
public function _handle_user_2fa_management_shortcode($attributes, $content = null, $shortcode = null) {
$shortcode = $shortcode === null ? self::SHORTCODE_2FA_MANAGEMENT : $shortcode;
$attributes = shortcode_atts(
array(
'stacked' => Controller_Settings::shared()->should_stack_ui_columns() ? 'true' : 'false'
),
$attributes,
$shortcode
);
$stacked = filter_var($attributes['stacked'], FILTER_VALIDATE_BOOLEAN);
return $this->render_embedded_user_2fa_management_interface($stacked);
}
public function _handle_shortcode_prerequisites() {
if ($this->does_current_page_include_shortcode(self::SHORTCODE_2FA_MANAGEMENT)) {
if (!is_user_logged_in())
auth_redirect();
$this->enqueue_2fa_management_assets(true);
}
}
}PK ! TRf f * login-security/classes/controller/ajax.phpnu [ _actions = array(
'authenticate' => array(
'handler' => array($this, '_ajax_authenticate_callback'),
'nopriv' => true,
'nonce' => false,
'permissions' => array(), //Format is 'permission' => 'error message'
'required_parameters' => array(),
),
'register_support' => array(
'handler' => array($this, '_ajax_register_support_callback'),
'nopriv' => true,
'nonce' => false,
'permissions' => array(),
'required_parameters' => array('wfls-message-nonce', 'wfls-message'),
),
'activate' => array(
'handler' => array($this, '_ajax_activate_callback'),
'permissions' => array(),
'required_parameters' => array('nonce', 'secret', 'recovery', 'code', 'user'),
),
'deactivate' => array(
'handler' => array($this, '_ajax_deactivate_callback'),
'permissions' => array(),
'required_parameters' => array('nonce', 'user'),
),
'regenerate' => array(
'handler' => array($this, '_ajax_regenerate_callback'),
'permissions' => array(),
'required_parameters' => array('nonce', 'user'),
),
'save_options' => array(
'handler' => array($this, '_ajax_save_options_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to change options.', 'wordfence'); }), //These are deliberately written as closures to be executed later so that WP doesn't load the translations too early, which can cause it not to pick up user-specific language settings
'required_parameters' => array('nonce', 'changes'),
),
'send_grace_period_notification' => array(
'handler' => array($this, '_ajax_send_grace_period_notification_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to send notifications.', 'wordfence'); }),
'required_parameters' => array('nonce', 'role', 'url'),
),
'update_ip_preview' => array(
'handler' => array($this, '_ajax_update_ip_preview_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to change options.', 'wordfence'); }),
'required_parameters' => array('nonce', 'ip_source', 'ip_source_trusted_proxies'),
),
'dismiss_notice' => array(
'handler' => array($this, '_ajax_dismiss_notice_callback'),
'permissions' => array(),
'required_parameters' => array('nonce', 'id'),
),
'reset_recaptcha_stats' => array(
'handler' => array($this, '_ajax_reset_recaptcha_stats_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset reCAPTCHA statistics.', 'wordfence'); }),
'required_parameters' => array('nonce'),
),
'reset_2fa_grace_period' => array (
'handler' => array($this, '_ajax_reset_2fa_grace_period_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset the 2FA grace period.', 'wordfence'); }),
'required_parameters' => array('nonce', 'user_id')
),
'revoke_2fa_grace_period' => array (
'handler' => array($this, '_ajax_revoke_2fa_grace_period_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to revoke the 2FA grace period.', 'wordfence'); }),
'required_parameters' => array('nonce', 'user_id')
),
'reset_ntp_failure_count' => array(
'handler' => array($this, '_ajax_reset_ntp_failure_count_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset the NTP failure count.', 'wordfence'); }),
'required_parameters' => array(),
),
'disable_ntp' => array(
'handler' => array($this, '_ajax_disable_ntp_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to disable NTP.', 'wordfence'); }),
'required_parameters' => array(),
),
'dismiss_persistent_notice' => array(
'handler' => array($this, '_ajax_dismiss_persistent_notice_callback'),
'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to dismiss this notice.', 'wordfence'); }),
'required_parameters' => array('nonce', 'notice_id')
)
);
$this->_init_actions();
}
public function _init_actions() {
foreach ($this->_actions as $action => $parameters) {
if (isset($parameters['nopriv']) && $parameters['nopriv']) {
add_action('wp_ajax_nopriv_wordfence_ls_' . $action, array($this, '_ajax_handler'));
}
add_action('wp_ajax_wordfence_ls_' . $action, array($this, '_ajax_handler'));
}
}
/**
* This is a convenience function for sending a JSON response and ensuring that execution stops after sending
* since wp_die() can be interrupted.
*
* @param $response
* @param int|null $status_code
*/
public static function send_json($response, $status_code = null) {
wp_send_json($response, $status_code);
die();
}
public function _ajax_handler() {
$action = (isset($_POST['action']) && is_string($_POST['action']) && $_POST['action']) ? $_POST['action'] : $_GET['action'];
if (preg_match('~wordfence_ls_([a-zA-Z_0-9]+)$~', $action, $matches)) {
$action = $matches[1];
if (!isset($this->_actions[$action])) {
self::send_json(array('error' => esc_html__('An unknown action was provided.', 'wordfence')));
}
$parameters = $this->_actions[$action];
if (!empty($parameters['required_parameters'])) {
foreach ($parameters['required_parameters'] as $k) {
if (!isset($_POST[$k])) {
self::send_json(array('error' => esc_html__('An expected parameter was not provided.', 'wordfence')));
}
}
}
if (!isset($parameters['nonce']) || $parameters['nonce']) {
$nonce = (isset($_POST['nonce']) && is_string($_POST['nonce']) && $_POST['nonce']) ? $_POST['nonce'] : $_GET['nonce'];
if (!is_string($nonce) || !wp_verify_nonce($nonce, 'wp-ajax')) {
self::send_json(array('error' => esc_html__('Your browser sent an invalid security token. Please try reloading this page.', 'wordfence'), 'tokenInvalid' => 1));
}
}
if (!empty($parameters['permissions'])) {
$user = wp_get_current_user();
foreach ($parameters['permissions'] as $permission => $error) {
if (!user_can($user, $permission)) {
self::send_json(array('error' => $error()));
}
}
}
call_user_func($parameters['handler']);
}
}
public function _ajax_authenticate_callback() {
$credentialKeys = array(
'log' => 'pwd',
'username' => 'password'
);
$username = null;
$password = null;
foreach ($credentialKeys as $usernameKey => $passwordKey) {
if (array_key_exists($usernameKey, $_POST) && array_key_exists($passwordKey, $_POST) && is_string($_POST[$usernameKey]) && is_string($_POST[$passwordKey])) {
$username = $_POST[$usernameKey];
$password = $_POST[$passwordKey];
break;
}
}
if (empty($username) || empty($password)) {
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: A username and password must be provided. Lost your password?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())))));
}
$legacy2FAActive = Controller_WordfenceLS::shared()->legacy_2fa_active();
if ($legacy2FAActive) { //Legacy 2FA is active, pass it on to the authenticate filter
self::send_json(array('login' => 1));
}
do_action_ref_array('wp_authenticate', array(&$username, &$password));
define('WORDFENCE_LS_AUTHENTICATION_CHECK', true); //Prevents our auth filter from recursing
$user = wp_authenticate($username, $password);
if (is_object($user) && ($user instanceof \WP_User)) {
if (!Controller_Users::shared()->has_2fa_active($user) || Controller_Whitelist::shared()->is_whitelisted(Model_Request::current()->ip()) || Controller_Users::shared()->has_remembered_2fa($user) || defined('WORDFENCE_LS_COMBINED_IS_VALID')) { //Not enabled for this user, is whitelisted, has a valid remembered cookie, or has already provided a 2FA code via the password field pass the credentials on to the normal login flow
self::send_json(array('login' => 1));
}
self::send_json(array('login' => 1, 'two_factor_required' => true));
}
else if (is_wp_error($user)) {
$errors = array();
$messages = array();
$reset = false;
foreach ($user->get_error_codes() as $code) {
if ($code == 'invalid_username' || $code == 'invalid_email' || $code == 'incorrect_password' || $code == 'authentication_failed') {
$errors[] = wp_kses(sprintf(__('ERROR: The username or password you entered is incorrect. Lost your password?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())));
}
else {
if ($code == 'wfls_twofactor_invalid') {
$reset = true;
}
$severity = $user->get_error_data($code);
foreach ($user->get_error_messages($code) as $error_message) {
if ($severity == 'message') {
$messages[] = $error_message;
}
else {
$errors[] = $error_message;
}
}
}
}
if (!empty($errors)) {
$errors = implode('
', $errors);
$errors = apply_filters('login_errors', $errors);
self::send_json(array('error' => $errors, 'reset' => $reset));
}
if (!empty($messages)) {
$messages = implode('
', $messages);
$messages = apply_filters('login_errors', $messages);
self::send_json(array('message' => $messages, 'reset' => $reset));
}
}
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: The username or password you entered is incorrect. Lost your password?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())))));
}
public function _ajax_register_support_callback() {
$email = null;
if (array_key_exists('email', $_POST) && is_string($_POST['email'])) {
$email = $_POST['email'];
}
else if (array_key_exists('user_email', $_POST) && is_string($_POST['user_email'])) {
$email = $_POST['user_email'];
}
if (
$email === null ||
!isset($_POST['wfls-message']) || !is_string($_POST['wfls-message']) ||
!isset($_POST['wfls-message-nonce']) || !is_string($_POST['wfls-message-nonce'])) {
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));
}
$email = sanitize_email($email);
$login = '';
if (array_key_exists('user_login', $_POST) && is_string($_POST['user_login']))
$login = sanitize_user($_POST['user_login']);
$message = strip_tags($_POST['wfls-message']);
$nonce = $_POST['wfls-message-nonce'];
if ((isset($_POST['user_login']) && empty($login)) || empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL) || empty($message)) {
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));
}
$jwt = Model_JWT::decode_jwt($_POST['wfls-message-nonce']);
if ($jwt && isset($jwt->payload['ip']) && isset($jwt->payload['score'])) {
$decryptedIP = Model_Symmetric::decrypt($jwt->payload['ip']);
$decryptedScore = Model_Symmetric::decrypt($jwt->payload['score']);
if ($decryptedIP === false || $decryptedScore === false || Model_IP::inet_pton($decryptedIP) !== Model_IP::inet_pton(Model_Request::current()->ip())) { //JWT IP and the current request's IP don't match, refuse the message
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));
}
$identifier = bin2hex(Model_IP::inet_pton($decryptedIP));
$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 2, 1 / (6 * Model_TokenBucket::HOUR)); //Maximum of two requests, refilling at a rate of one per six hours
if (!$tokenBucket->consume(1)) {
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: Unable to send message. You have exceeded the maximum number of messages that may be sent at this time. Please try again later.', 'wordfence')), array('strong'=>array()))));
}
$email = array(
'to' => get_site_option('admin_email'),
'subject' => __('Blocked User Registration Contact Form', 'wordfence'),
'body' => sprintf(__("A visitor blocked from registration sent the following message.\n\n----------------------------------------\n\nIP: %s\nUsername: %s\nEmail: %s\nreCAPTCHA Score: %f\n\n----------------------------------------\n\n%s", 'wordfence'), $decryptedIP, $login, $email, $decryptedScore, $message),
'headers' => '',
);
$success = wp_mail($email['to'], $email['subject'], $email['body'], $email['headers']);
if ($success) {
self::send_json(array('message' => wp_kses(sprintf(__('MESSAGE SENT: Your message was sent to the site owner.', 'wordfence')), array('strong'=>array()))));
}
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: An error occurred while sending the message. Please try again.', 'wordfence')), array('strong'=>array()))));
}
self::send_json(array('error' => wp_kses(sprintf(__('ERROR: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));
}
public function _ajax_activate_callback() {
$userID = (int) @$_POST['user'];
$user = wp_get_current_user();
if ($user->ID != $userID) {
if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {
self::send_json(array('error' => esc_html__('You do not have permission to activate the given user.', 'wordfence')));
}
else {
$user = new \WP_User($userID);
if (!$user->exists()) {
self::send_json(array('error' => esc_html__('The given user does not exist.', 'wordfence')));
}
}
}
else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {
self::send_json(array('error' => esc_html__('You do not have permission to activate 2FA.', 'wordfence')));
}
if (Controller_Users::shared()->has_2fa_active($user)) {
self::send_json(array('error' => esc_html__('The given user already has two-factor authentication active.', 'wordfence')));
}
$matches = (isset($_POST['secret']) && isset($_POST['code']) && is_string($_POST['secret']) && is_string($_POST['code']) && Controller_TOTP::shared()->check_code($_POST['secret'], $_POST['code']));
if ($matches === false) {
self::send_json(array('error' => esc_html__('The code provided does not match the expected value. Please verify that the time on your authenticator device is correct and that this server\'s time is correct.', 'wordfence')));
}
Controller_TOTP::shared()->activate_2fa($user, $_POST['secret'], $_POST['recovery'], $matches);
Controller_Notices::shared()->remove_notice(false, 'wfls-will-be-required', $user);
self::send_json(array('activated' => 1, 'text' => sprintf(count($_POST['recovery']) == 1 ? esc_html__('%d unused recovery code remains. You may generate a new set by clicking below.', 'wordfence') : esc_html__('%d unused recovery codes remain. You may generate a new set by clicking below.', 'wordfence'), count($_POST['recovery']))));
}
public function _ajax_deactivate_callback() {
$userID = (int) @$_POST['user'];
$user = wp_get_current_user();
if ($user->ID != $userID) {
if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {
self::send_json(array('error' => esc_html__('You do not have permission to deactivate the given user.', 'wordfence')));
}
else {
$user = new \WP_User($userID);
if (!$user->exists()) {
self::send_json(array('error' => esc_html__('The user does not exist.', 'wordfence')));
}
}
}
else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {
self::send_json(array('error' => esc_html__('You do not have permission to deactivate 2FA.', 'wordfence')));
}
if (!Controller_Users::shared()->has_2fa_active($user)) {
self::send_json(array('error' => esc_html__('The user specified does not have two-factor authentication active.', 'wordfence')));
}
Controller_Users::shared()->deactivate_2fa($user);
self::send_json(array('deactivated' => 1));
}
public function _ajax_regenerate_callback() {
$userID = (int) @$_POST['user'];
$user = wp_get_current_user();
if ($user->ID != $userID) {
if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {
self::send_json(array('error' => esc_html__('You do not have permission to generate new recovery codes for the given user.', 'wordfence')));
}
else {
$user = new \WP_User($userID);
if (!$user->exists()) {
self::send_json(array('error' => esc_html__('The user does not exist.', 'wordfence')));
}
}
}
else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {
self::send_json(array('error' => esc_html__('You do not have permission to generate new recovery codes.', 'wordfence')));
}
if (!Controller_Users::shared()->has_2fa_active($user)) {
self::send_json(array('error' => esc_html__('The user specified does not have two-factor authentication active.', 'wordfence')));
}
$codes = Controller_Users::shared()->regenerate_recovery_codes($user);
self::send_json(array('regenerated' => 1, 'recovery' => array_map(function($r) { return implode(' ', str_split(bin2hex($r), 4)); }, $codes), 'text' => sprintf(count($codes) == 1 ? esc_html__('%d unused recovery code remains. You may generate a new set by clicking below.', 'wordfence') : esc_html__('%d unused recovery codes remain. You may generate a new set by clicking below.', 'wordfence'), count($codes))));
}
public function _ajax_save_options_callback() {
if (!empty($_POST['changes']) && is_string($_POST['changes']) && is_array($changes = json_decode(stripslashes($_POST['changes']), true))) {
try {
$errors = Controller_Settings::shared()->validate_multiple($changes);
if ($errors !== true) {
if (count($errors) == 1) {
$e = array_shift($errors);
self::send_json(array('error' => esc_html(sprintf(__('An error occurred while saving the configuration: %s', 'wordfence'), $e))));
}
else if (count($errors) > 1) {
$compoundMessage = array();
foreach ($errors as $e) {
$compoundMessage[] = esc_html($e);
}
self::send_json(array(
'error' => wp_kses(sprintf(__('Errors occurred while saving the configuration: %s', 'wordfence'), '- ' . implode('
- ', $compoundMessage) . '
'), array('ul'=>array(), 'li'=>array())),
'html' => true,
));
}
self::send_json(array(
'error' => esc_html__('Errors occurred while saving the configuration.', 'wordfence'),
));
}
Controller_Settings::shared()->set_multiple($changes);
if (array_key_exists(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION, $changes) || array_key_exists(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION, $changes))
Controller_WordfenceLS::shared()->refresh_rewrite_rules();
$response = array('success' => true);
return self::send_json($response);
}
catch (\Exception $e) {
self::send_json(array(
'error' => $e->getMessage(),
));
}
}
self::send_json(array(
'error' => esc_html__('No configuration changes were provided to save.', 'wordfence'),
));
}
public function _ajax_send_grace_period_notification_callback() {
$notifyAll = isset($_POST['notify_all']);
$users = Controller_Users::shared()->get_users_by_role($_POST['role'], $notifyAll ? null: self::MAX_USERS_TO_NOTIFY + 1);
$url = $_POST['url'];
if (!empty($url)) {
$url = get_site_url(null, $url);
if (filter_var($url, FILTER_VALIDATE_URL) === false) {
self::send_json(array('error' => esc_html__('The specified URL is invalid.', 'wordfence')));
}
}
$userCount = count($users);
if (!$notifyAll && $userCount > self::MAX_USERS_TO_NOTIFY)
self::send_json(array('error' => esc_html(sprintf(__('More than %d users exist for the selected role. This notification is not designed to handle large groups of users. In such instances, using a different solution for notifying users of upcoming 2FA requirements is recommended.', 'wordfence'), self::MAX_USERS_TO_NOTIFY)), 'limit_exceeded' => true));
$sent = 0;
foreach ($users as $user) {
Controller_Users::shared()->requires_2fa($user, $inGracePeriod, $requiredAt);
if ($inGracePeriod && !Controller_Users::shared()->has_2fa_active($user)) {
$subject = sprintf(__('2FA will soon be required on %s', 'wordfence'), home_url());
$requiredDate = Controller_Time::format_local_time('F j, Y g:i A', $requiredAt);
if (empty($url)) {
$userUrl = (is_multisite() && is_super_admin($user->ID)) ? network_admin_url('admin.php?page=WFLS') : admin_url('admin.php?page=WFLS');
}
else {
$userUrl = $url;
}
$message = sprintf(
__("You do not currently have two-factor authentication active on your account, which will be required beginning %s.
", 'wordfence'),
$requiredDate,
htmlentities($userUrl)
);
wp_mail($user->user_email, $subject, $message, array('Content-Type: text/html'));
$sent++;
}
}
if ($userCount == 0) {
self::send_json(array('error' => esc_html__('No users currently exist with the selected role.', 'wordfence')));
}
else if ($sent == 0) {
self::send_json(array('confirmation' => esc_html__('All users with the selected role already have two-factor authentication activated or have been locked out.', 'wordfence')));
}
else if ($sent == 1) {
self::send_json(array('confirmation' => esc_html(sprintf(__('A reminder to activate two-factor authentication was sent to %d user.', 'wordfence'), $sent))));
}
self::send_json(array('confirmation' => esc_html(sprintf(__('A reminder to activate two-factor authentication was sent to %d users.', 'wordfence'), $sent))));
}
public function _ajax_update_ip_preview_callback() {
$source = $_POST['ip_source'];
$raw_proxies = $_POST['ip_source_trusted_proxies'];
if (!is_string($source) || !is_string($raw_proxies)) {
die();
}
$valid = array();
$invalid = array();
$test = preg_split('/[\r\n,]+/', $raw_proxies);
foreach ($test as $value) {
if (strlen($value) > 0) {
if (Model_IP::is_valid_ip($value) || Model_IP::is_valid_cidr_range($value)) {
$valid[] = $value;
}
else {
$invalid[] = $value;
}
}
}
$trusted_proxies = $valid;
$preview = Model_Request::current()->detected_ip_preview($source, $trusted_proxies);
$ip = Model_Request::current()->ip_for_field($source, $trusted_proxies);
self::send_json(array('ip' => $ip[0], 'preview' => $preview));
}
public function _ajax_dismiss_notice_callback() {
Controller_Notices::shared()->remove_notice($_POST['id'], false, wp_get_current_user());
}
public function _ajax_reset_recaptcha_stats_callback() {
Controller_Settings::shared()->set_array(Controller_Settings::OPTION_CAPTCHA_STATS, array('counts' => array(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0), 'avg' => 0));
$response = array('success' => true);
self::send_json($response);
}
public function _ajax_reset_2fa_grace_period_callback() {
$userId = (int) $_POST['user_id'];
$gracePeriodOverride = array_key_exists('grace_period_override', $_POST) ? (int) $_POST['grace_period_override'] : null;
$user = get_userdata($userId);
if ($user === false)
self::send_json(array('error' => esc_html__('Invalid user specified', 'wordfence')));
if ($gracePeriodOverride < 0 || $gracePeriodOverride > Controller_Settings::MAX_REQUIRE_2FA_USER_GRACE_PERIOD)
self::send_json(array('error' => esc_html__('Invalid grace period override', 'wordfence')));
$gracePeriodAllowed = Controller_Users::shared()->get_grace_period_allowed_flag($userId);
if (!$gracePeriodAllowed)
Controller_Users::shared()->allow_grace_period($userId);
if (!Controller_Users::shared()->reset_2fa_grace_period($user, $gracePeriodOverride))
self::send_json(array('error' => esc_html__('Failed to reset grace period', 'wordfence')));
self::send_json(array('success' => true));
}
public function _ajax_revoke_2fa_grace_period_callback() {
$user = get_userdata((int) $_POST['user_id']);
if ($user === false)
self::send_json(array('error' => esc_html__('Invalid user specified', 'wordfence')));
Controller_Users::shared()->revoke_grace_period($user);
self::send_json(array('success' => true));
}
public function _ajax_reset_ntp_failure_count_callback() {
Controller_Settings::shared()->reset_ntp_failure_count();
}
public function _ajax_disable_ntp_callback() {
Controller_Settings::shared()->disable_ntp_cron();
}
public function _ajax_dismiss_persistent_notice_callback() {
$userId = get_current_user_id();
$noticeId = $_POST['notice_id'];
if ($userId !== 0 && Controller_Notices::shared()->dismiss_persistent_notice($userId, $noticeId))
self::send_json(array('success' => true));
self::send_json(array(
'error' => esc_html__('Unable to dismiss notice', 'wordfence')
));
}
}PK ! HJI2 2 - login-security/classes/controller/notices.phpnu [ _notices($user);
foreach ($notices as $id => $n) {
if ($category !== false && isset($n['category']) && $n['category'] == $category) { //Same category overwrites previous entry
unset($notices[$id]);
}
}
$id = Model_Crypto::uuid();
$notices[$id] = array(
'severity' => $severity,
'messageHTML' => Model_HTML::esc_html($message),
);
if ($category !== false) {
$notices[$id]['category'] = $category;
}
$this->_save_notices($notices, $user);
}
/**
* Removes a notice using one of two possible search methods:
*
* 1. If $id matches. $category is ignored but only notices for $user are checked.
* 2. If $category matches. Only notices for $user are checked.
*
* @param bool|int $id
* @param bool|string $category
* @param bool|\WP_User $user
*/
public function remove_notice($id = false, $category = false, $user = false) {
if ($id === false && $category === false) {
return;
}
else if ($id !== false) {
$category = false;
}
$notices = $this->_notices($user);
foreach ($notices as $nid => $n) {
if ($id == $nid) { //ID match
unset($notices[$nid]);
break;
}
else if ($id !== false) {
continue;
}
if ($category !== false && isset($n['category']) && $category == $n['category']) { //Category match
unset($notices[$nid]);
}
}
$this->_save_notices($notices, $user);
}
/**
* Returns whether or not a notice exists for the given user.
*
* @param bool|\WP_User $user
* @return bool
*/
public function has_notice($user) {
$notices = $this->_notices($user);
return !!count($notices) || $this->has_persistent_notices();
}
/**
* Enqueues a user's notices. For administrators this also includes global notices.
*
* @return bool Whether any notices were enqueued.
*/
public function enqueue_notices() {
$user = wp_get_current_user();
if ($user->ID == 0) {
return false;
}
$added = false;
$notices = array();
if (Controller_Permissions::shared()->can_manage_settings($user)) {
$globalNotices = $this->_notices(false);
$notices = array_merge($notices, $globalNotices);
}
$userNotices = $this->_notices($user);
$notices = array_merge($notices, $userNotices);
foreach ($notices as $nid => $n) {
$notice = new Model_Notice($nid, $n['severity'], $n['messageHTML'], $n['category']);
if (is_multisite()) {
add_action('network_admin_notices', array($notice, 'display_notice'));
}
else {
add_action('admin_notices', array($notice, 'display_notice'));
}
$added = true;
}
return $added;
}
/**
* Utility
*/
/**
* Returns the notices for a user if provided, otherwise the global notices.
*
* @param bool|\WP_User $user
* @return array
*/
protected function _notices($user) {
if ($user instanceof \WP_User) {
$notices = get_user_meta($user->ID, self::USER_META_KEY, true);
return array_filter((array) $notices);
}
return Controller_Settings::shared()->get_array(Controller_Settings::OPTION_GLOBAL_NOTICES);
}
/**
* Saves the notices.
*
* @param array $notices
* @param bool|\WP_User $user
*/
protected function _save_notices($notices, $user) {
if ($user instanceof \WP_User) {
update_user_meta($user->ID, self::USER_META_KEY, $notices);
return;
}
Controller_Settings::shared()->set_array(Controller_Settings::OPTION_GLOBAL_NOTICES, $notices, true);
}
public function get_persistent_notice_ids() {
return array(
self::PERSISTENT_NOTICE_WOOCOMMERCE_INTEGRATION
);
}
private static function get_persistent_notice_dismiss_key($noticeId) {
return self::PERSISTENT_NOTICE_DISMISS_PREFIX . $noticeId;
}
public function register_persistent_notice($noticeId) {
$this->persistentNotices[] = $noticeId;
}
public function has_persistent_notices() {
return count($this->persistentNotices) > 0;
}
public function dismiss_persistent_notice($userId, $noticeId) {
if (!in_array($noticeId, $this->get_persistent_notice_ids(), true))
return false;
update_user_option($userId, self::get_persistent_notice_dismiss_key($noticeId), true, true);
return true;
}
public function is_persistent_notice_dismissed($userId, $noticeId) {
return (bool) get_user_option(self::get_persistent_notice_dismiss_key($noticeId), $userId);
}
}PK ! aHOc Oc . login-security/classes/controller/settings.phpnu [ _settingsStorage = $settingsStorage;
$this->_migrate_admin_2fa_requirements_to_roles();
}
public function set_defaults() {
$this->_settingsStorage->set_multiple(array(
self::OPTION_XMLRPC_ENABLED => array('value' => true, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_2FA_WHITELISTED => array('value' => '', 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_IP_SOURCE => array('value' => Model_Request::IP_SOURCE_AUTOMATIC, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_IP_TRUSTED_PROXIES => array('value' => '', 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_REQUIRE_2FA_ADMIN => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_REQUIRE_2FA_GRACE_PERIOD_ENABLED => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_REQUIRE_2FA_USER_GRACE_PERIOD => array('value' => self::DEFAULT_REQUIRE_2FA_USER_GRACE_PERIOD, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_GLOBAL_NOTICES => array('value' => '[]', 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_REMEMBER_DEVICE_ENABLED => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_REMEMBER_DEVICE_DURATION => array('value' => (30 * 86400), 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ALLOW_XML_RPC => array('value' => true, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ENABLE_AUTH_CAPTCHA => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_CAPTCHA_STATS => array('value' => '{"counts":[0,0,0,0,0,0,0,0,0,0,0],"avg":0}', 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_RECAPTCHA_THRESHOLD => array('value' => 0.5, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_LAST_SECRET_REFRESH => array('value' => 0, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_DELETE_ON_DEACTIVATION => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ENABLE_SHORTCODE => array('value' => false, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_ENABLE_LOGIN_HISTORY_COLUMNS => array('value' => true, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_STACK_UI_COLUMNS => array('value' => true, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_SCHEMA_VERSION => array('value' => 0, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_USER_COUNT_QUERY_STATE => array('value' => 0, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false),
self::OPTION_DISABLE_TEMPORARY_TABLES => array('value' => 0, 'autoload' => Model_Settings::AUTOLOAD_YES, 'allowOverwrite' => false)
));
}
public function set($key, $value, $already_validated = false) {
return $this->set_multiple(array($key => $value), $already_validated);
}
public function set_array($key, $value, $already_validated = false) {
return $this->set_multiple(array($key => json_encode($value)), $already_validated);
}
public function set_multiple($changes, $already_validated = false) {
if (!$already_validated && $this->validate_multiple($changes) !== true) {
return false;
}
$changes = $this->clean_multiple($changes);
$changes = $this->preprocess_multiple($changes);
$this->_settingsStorage->set_multiple($changes);
return true;
}
public function get($key, $default = false) {
return $this->_settingsStorage->get($key, $default);
}
public function get_bool($key, $default = false) {
return $this->_truthy_to_bool($this->get($key, $default));
}
public function get_int($key, $default = 0) {
return intval($this->get($key, $default));
}
public function get_float($key, $default = 0.0) {
return (float) $this->get($key, $default);
}
public function get_array($key, $default = array()) {
$value = $this->get($key, null);
if (is_string($value)) {
$value = @json_decode($value, true);
}
else {
$value = null;
}
return is_array($value) ? $value : $default;
}
public function remove($key) {
$this->_settingsStorage->remove($key);
}
/**
* Validates whether a user-entered setting value is acceptable. Returns true if valid or an error message if not.
*
* @param string $key
* @param mixed $value
* @return bool|string
*/
public function validate($key, $value) {
switch ($key) {
//Boolean
case self::OPTION_XMLRPC_ENABLED:
case self::OPTION_REQUIRE_2FA_ADMIN:
case self::OPTION_REQUIRE_2FA_GRACE_PERIOD_ENABLED:
case self::OPTION_REMEMBER_DEVICE_ENABLED:
case self::OPTION_ALLOW_XML_RPC:
case self::OPTION_ENABLE_AUTH_CAPTCHA:
case self::OPTION_CAPTCHA_TEST_MODE:
case self::OPTION_DISMISSED_FRESH_INSTALL_MODAL:
case self::OPTION_DELETE_ON_DEACTIVATION:
case self::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION:
case self::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION:
case self::OPTION_ENABLE_SHORTCODE:
case self::OPTION_ENABLE_LOGIN_HISTORY_COLUMNS:
case self::OPTION_STACK_UI_COLUMNS:
case self::OPTION_USER_COUNT_QUERY_STATE:
case self::OPTION_DISABLE_TEMPORARY_TABLES:
return true;
//Int
case self::OPTION_LAST_SECRET_REFRESH:
return is_numeric($value); //Left using is_numeric to prevent issues with existing values
case self::OPTION_SCHEMA_VERSION:
return Utility_Number::isInteger($value, 0);
//Array
case self::OPTION_GLOBAL_NOTICES:
case self::OPTION_CAPTCHA_STATS:
return preg_match('/^\[.*\]$/', $value) || preg_match('/^\{.*\}$/', $value); //Only a rough JSON validation
//Special
case self::OPTION_IP_TRUSTED_PROXIES:
case self::OPTION_2FA_WHITELISTED:
$parsed = array_filter(array_map(function($s) { return trim($s); }, preg_split('/[\r\n]/', $value)));
foreach ($parsed as $entry) {
if (!Controller_Whitelist::shared()->is_valid_range($entry)) {
return sprintf(__('The IP/range %s is invalid.', 'wordfence'), esc_html($entry));
}
}
return true;
case self::OPTION_IP_SOURCE:
if (!in_array($value, array(Model_Request::IP_SOURCE_AUTOMATIC, Model_Request::IP_SOURCE_REMOTE_ADDR, Model_Request::IP_SOURCE_X_FORWARDED_FOR, Model_Request::IP_SOURCE_X_REAL_IP))) {
return __('An invalid IP source was provided.', 'wordfence');
}
return true;
case self::OPTION_REQUIRE_2FA_GRACE_PERIOD:
$gracePeriodEnd = strtotime($value);
if ($gracePeriodEnd <= \WordfenceLS\Controller_Time::time()) {
return __('The grace period end time must be in the future.', 'wordfence');
}
return true;
case self::OPTION_REMEMBER_DEVICE_DURATION:
return is_numeric($value) && $value > 0;
case self::OPTION_RECAPTCHA_THRESHOLD:
return is_numeric($value) && $value > 0 && $value <= 1;
case self::OPTION_RECAPTCHA_SITE_KEY:
if (empty($value)) {
return true;
}
$response = wp_remote_get('https://www.google.com/recaptcha/api.js?render=' . urlencode($value));
if (!is_wp_error($response)) {
$status = wp_remote_retrieve_response_code($response);
if ($status == 200) {
return true;
}
$data = wp_remote_retrieve_body($response);
if (strpos($data, 'grecaptcha') === false) {
return __('Unable to validate the reCAPTCHA site key. Please check the key and try again.', 'wordfence');
}
return true;
}
return sprintf(__('An error was encountered while validating the reCAPTCHA site key: %s', 'wordfence'), $response->get_error_message());
case self::OPTION_REQUIRE_2FA_USER_GRACE_PERIOD:
return is_numeric($value) && $value >= 0 && $value <= self::MAX_REQUIRE_2FA_USER_GRACE_PERIOD;
}
return true;
}
public function validate_multiple($values) {
$errors = array();
foreach ($values as $key => $value) {
$status = $this->validate($key, $value);
if ($status !== true) {
$errors[$key] = $status;
}
}
if (!empty($errors)) {
return $errors;
}
return true;
}
/**
* Cleans and normalizes a setting value for use in saving.
*
* @param string $key
* @param mixed $value
* @return mixed
*/
public function clean($key, $value) {
switch ($key) {
//Boolean
case self::OPTION_XMLRPC_ENABLED:
case self::OPTION_REQUIRE_2FA_ADMIN:
case self::OPTION_REQUIRE_2FA_GRACE_PERIOD_ENABLED:
case self::OPTION_REMEMBER_DEVICE_ENABLED:
case self::OPTION_ALLOW_XML_RPC:
case self::OPTION_ENABLE_AUTH_CAPTCHA:
case self::OPTION_CAPTCHA_TEST_MODE:
case self::OPTION_DISMISSED_FRESH_INSTALL_MODAL:
case self::OPTION_DELETE_ON_DEACTIVATION:
case self::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION:
case self::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION:
case self::OPTION_ENABLE_SHORTCODE;
case self::OPTION_ENABLE_LOGIN_HISTORY_COLUMNS:
case self::OPTION_STACK_UI_COLUMNS:
case self::OPTION_USER_COUNT_QUERY_STATE:
case self::OPTION_DISABLE_TEMPORARY_TABLES:
return $this->_truthy_to_bool($value);
//Int
case self::OPTION_REMEMBER_DEVICE_DURATION:
case self::OPTION_LAST_SECRET_REFRESH:
case self::OPTION_REQUIRE_2FA_USER_GRACE_PERIOD:
case self::OPTION_SCHEMA_VERSION:
return (int) $value;
//Float
case self::OPTION_RECAPTCHA_THRESHOLD:
return (float) $value;
//Special
case self::OPTION_IP_TRUSTED_PROXIES:
case self::OPTION_2FA_WHITELISTED:
$parsed = array_filter(array_map(function($s) { return trim($s); }, preg_split('/[\r\n]/', $value)));
$cleaned = array();
foreach ($parsed as $item) {
$cleaned[] = $this->_sanitize_ip_range($item);
}
return implode("\n", $cleaned);
case self::OPTION_REQUIRE_2FA_GRACE_PERIOD:
$dt = $this->_parse_local_time($value);
return $dt->format('U');
case self::OPTION_RECAPTCHA_SITE_KEY:
case self::OPTION_RECAPTCHA_SECRET:
return trim($value);
}
return $value;
}
public function clean_multiple($changes) {
$cleaned = array();
foreach ($changes as $key => $value) {
$cleaned[$key] = $this->clean($key, $value);
}
return $cleaned;
}
private function get_required_2fa_role_key($role) {
return implode('.', array(self::OPTION_PREFIX_REQUIRED_2FA_ROLE, $role));
}
public function get_required_2fa_role_activation_time($role) {
$time = $this->get_int($this->get_required_2fa_role_key($role), -1);
if ($time < 0)
return false;
return $time;
}
public function get_user_2fa_grace_period() {
return $this->get_int(self::OPTION_REQUIRE_2FA_USER_GRACE_PERIOD, self::DEFAULT_REQUIRE_2FA_USER_GRACE_PERIOD);
}
/**
* Preprocesses the value, returning true if it was saved here (e.g., saved 2fa enabled by assigning a role
* capability) or false if it is to be saved by the backing storage.
*
* @param string $key
* @param mixed $value
* @param array &$settings the array of settings to process, this function may append additional values from preprocessing
* @return bool
*/
public function preprocess($key, $value, &$settings) {
if (preg_match('/^enabled-roles\.(.+)$/', $key, $matches)) { //Enabled roles are stored as capabilities rather than in the settings storage
$role = $matches[1];
if ($role === 'super-admin') {
$roleValid = true;
}
else if (in_array($value, array(self::STATE_2FA_OPTIONAL, self::STATE_2FA_REQUIRED))) {
$roleValid = Controller_Permissions::shared()->allow_2fa_self($role);
}
else {
$roleValid = Controller_Permissions::shared()->disallow_2fa_self($role);
}
if (!in_array($value, array(self::STATE_2FA_OPTIONAL, self::STATE_2FA_REQUIRED))) {
$value = self::STATE_2FA_DISABLED;
}
if ($roleValid) {
$settings[$this->get_required_2fa_role_key($role)] = ($value === self::STATE_2FA_REQUIRED ? time() : -1);
}
/**
* Fires when 2FA availability/required on a role changes.
*
* @since 1.1.13
*
* @param string $role The name of the role.
* @param string $state The state of 2FA on the role.
*/
do_action('wordfence_ls_changed_2fa_required', $role, $value);
return true;
}
//Settings that will dispatch actions
switch ($key) {
case self::OPTION_XMLRPC_ENABLED:
$before = $this->get($key);
$after = $value;
/**
* Fires when the XML-RPC 2FA requirement changes.
*
* @since 1.1.13
*
* @param bool $before The previous value.
* @param bool $after The new value.
*/
do_action('wordfence_ls_xml_rpc_2fa_toggled', $before, $after);
break;
case self::OPTION_2FA_WHITELISTED:
$before = $this->whitelisted_ips();
$after = explode("\n", $value); //Already cleaned here so just re-split
/**
* Fires when the whitelist changes.
*
* @since 1.1.13
*
* @param string[] $before The previous value.
* @param string[] $after The new value.
*/
do_action('wordfence_ls_updated_allowed_ips', $before, $after);
break;
case self::OPTION_IP_SOURCE:
$before = $this->get($key);
$after = $value;
/**
* Fires when the IP source changes.
*
* @since 1.1.13
*
* @param string $before The previous value.
* @param string $after The new value.
*/
do_action('wordfence_ls_changed_ip_source', $before, $after);
break;
case self::OPTION_IP_TRUSTED_PROXIES:
$before = $this->trusted_proxies();
$after = explode("\n", $value); //Already cleaned here so just re-split
/**
* Fires when the trusted proxy list changes.
*
* @since 1.1.13
*
* @param string[] $before The previous value.
* @param string[] $after The new value.
*/
do_action('wordfence_ls_updated_trusted_proxies', $before, $after);
break;
case self::OPTION_REQUIRE_2FA_USER_GRACE_PERIOD:
$before = $this->get($key);
$after = $value;
/**
* Fires when the grace period changes.
*
* @since 1.1.13
*
* @param int $before The previous value.
* @param int $after The new value.
*/
do_action('wordfence_ls_changed_grace_period', $before, $after);
break;
case self::OPTION_ALLOW_XML_RPC:
$before = $this->get($key);
$after = $value;
/**
* Fires when the XML-RPC is enabled/disabled.
*
* @since 1.1.13
*
* @param bool $before The previous value.
* @param bool $after The new value.
*/
do_action('wordfence_ls_xml_rpc_enabled_toggled', $before, $after);
break;
case self::OPTION_ENABLE_AUTH_CAPTCHA:
$before = $this->get($key);
$after = $value;
/**
* Fires when the login captcha is enabled/disabled.
*
* @since 1.1.13
*
* @param bool $before The previous value.
* @param bool $after The new value.
*/
do_action('wordfence_ls_captcha_enabled_toggled', $before, $after);
break;
case self::OPTION_RECAPTCHA_THRESHOLD:
$before = $this->get($key);
$after = $value;
/**
* Fires when the reCAPTCHA threshold changes.
*
* @since 1.1.13
*
* @param float $before The previous value.
* @param float $after The new value.
*/
do_action('wordfence_ls_captcha_threshold_changed', $before, $after);
break;
case self::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION:
$before = $this->get($key);
$after = $value;
/**
* Fires when WooCommerce integration is enabled/disabled.
*
* @since 1.1.13
*
* @param bool $before The previous value.
* @param bool $after The new value.
*/
do_action('wordfence_ls_woocommerce_enabled_toggled', $before, $after);
break;
case self::OPTION_CAPTCHA_TEST_MODE:
$before = $this->get($key);
$after = $value;
/**
* Fires when captcha test mode is enabled/disabled.
*
* @since 1.1.13
*
* @param bool $before The previous value.
* @param bool $after The new value.
*/
do_action('wordfence_ls_captcha_test_mode_toggled', $before, $after);
break;
}
return false;
}
public function preprocess_multiple($changes) {
$remaining = array();
foreach ($changes as $key => $value) {
if (!$this->preprocess($key, $value, $remaining)) {
$remaining[$key] = $value;
}
}
return $remaining;
}
/**
* Convenience
*/
/**
* Returns a cleaned array containing the whitelist entries.
*
* @return array
*/
public function whitelisted_ips() {
return array_filter(array_map(function($s) { return trim($s); }, preg_split('/[\r\n]/', $this->get(self::OPTION_2FA_WHITELISTED, ''))));
}
/**
* Returns a cleaned array containing the trusted proxy entries.
*
* @return array
*/
public function trusted_proxies() {
return array_filter(array_map(function($s) { return trim($s); }, preg_split('/[\r\n]/', $this->get(self::OPTION_IP_TRUSTED_PROXIES, ''))));
}
public function get_ntp_failure_count() {
return $this->get_int(self::OPTION_NTP_FAILURE_COUNT, 0);
}
public function reset_ntp_failure_count() {
$this->set(self::OPTION_NTP_FAILURE_COUNT, 0);
}
public function increment_ntp_failure_count() {
$count = $this->get_ntp_failure_count();
if ($count < 0)
return false;
$count++;
$this->set(self::OPTION_NTP_FAILURE_COUNT, $count);
return $count;
}
public function is_ntp_disabled_via_constant() {
return defined('WORDFENCE_LS_DISABLE_NTP') && WORDFENCE_LS_DISABLE_NTP;
}
public function is_ntp_enabled($requireOffset = true) {
if ($this->is_ntp_cron_disabled())
return false;
if ($this->get_bool(self::OPTION_USE_NTP, true)) {
if ($requireOffset) {
$offset = $this->get(self::OPTION_NTP_OFFSET, null);
return $offset !== null && abs((int)$offset) <= Controller_TOTP::TIME_WINDOW_LENGTH;
}
else {
return true;
}
}
return false;
}
public function is_ntp_cron_disabled(&$failureCount = null) {
if ($this->is_ntp_disabled_via_constant())
return true;
$failureCount = $this->get_ntp_failure_count();
if ($failureCount >= Controller_Time::FAILURE_LIMIT) {
return true;
}
else if ($failureCount < 0) {
$failureCount = 0;
return true;
}
return false;
}
public function disable_ntp_cron() {
$this->set(self::OPTION_NTP_FAILURE_COUNT, -1);
}
public function are_login_history_columns_enabled() {
return Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_LOGIN_HISTORY_COLUMNS, true);
}
public function should_stack_ui_columns() {
return self::shared()->get_bool(Controller_Settings::OPTION_STACK_UI_COLUMNS, true);
}
/**
* Utility
*/
/**
* Translates a value to a boolean, correctly interpreting various textual representations.
*
* @param $value
* @return bool
*/
protected function _truthy_to_bool($value) {
if ($value === true || $value === false) {
return $value;
}
if (is_numeric($value)) {
return !!$value;
}
if (preg_match('/^(?:f(?:alse)?|no?|off)$/i', $value)) {
return false;
}
else if (preg_match('/^(?:t(?:rue)?|y(?:es)?|on)$/i', $value)) {
return true;
}
return !empty($value);
}
/**
* Parses the given time string and returns its DateTime with the server's configured time zone.
*
* @param string $timestring
* @return \DateTime
*/
protected function _parse_local_time($timestring) {
$utc = new \DateTimeZone('UTC');
$tz = get_option('timezone_string');
if (!empty($tz)) {
$tz = new \DateTimeZone($tz);
return new \DateTime($timestring, $tz);
}
else {
$gmt = get_option('gmt_offset');
if (!empty($gmt)) {
if (PHP_VERSION_ID < 50510) {
$timestamp = strtotime($timestring);
$dtStr = gmdate("c", (int) ($timestamp + $gmt * 3600)); //Have to do it this way because of < PHP 5.5.10
return new \DateTime($dtStr, $utc);
}
else {
$direction = ($gmt > 0 ? '+' : '-');
$gmt = abs($gmt);
$h = (int) $gmt;
$m = ($gmt - $h) * 60;
$tz = new \DateTimeZone($direction . str_pad($h, 2, '0', STR_PAD_LEFT) . str_pad($m, 2, '0', STR_PAD_LEFT));
return new \DateTime($timestring, $tz);
}
}
}
return new \DateTime($timestring);
}
/**
* Cleans a user-entered IP range of unnecessary characters and normalizes some glyphs.
*
* @param string $range
* @return string
*/
protected function _sanitize_ip_range($range) {
$range = preg_replace('/\s/', '', $range); //Strip whitespace
$range = preg_replace('/[\\x{2013}-\\x{2015}]/u', '-', $range); //Non-hyphen dashes to hyphen
$range = strtolower($range);
if (preg_match('/^\d+-\d+$/', $range)) { //v5 32 bit int style format
list($start, $end) = explode('-', $range);
$start = long2ip($start);
$end = long2ip($end);
$range = "{$start}-{$end}";
}
return $range;
}
private function _migrate_admin_2fa_requirements_to_roles() {
if (!$this->get_bool(self::OPTION_REQUIRE_2FA_ADMIN))
return;
$time = time();
if (is_multisite()) {
$this->set($this->get_required_2fa_role_key('super-admin'), $time, true);
}
else {
$roles = new \WP_Roles();
foreach ($roles->roles as $key => $data) {
$role = $roles->get_role($key);
if (Controller_Permissions::shared()->can_role_manage_settings($role) && Controller_Permissions::shared()->allow_2fa_self($role->name)) {
$this->set($this->get_required_2fa_role_key($role->name), $time, true);
}
}
}
$this->remove(self::OPTION_REQUIRE_2FA_ADMIN);
$this->remove(self::OPTION_REQUIRE_2FA_GRACE_PERIOD);
$this->remove(self::OPTION_REQUIRE_2FA_GRACE_PERIOD_ENABLED);
}
public function reset_ntp_disabled_flag() {
$this->remove(self::OPTION_USE_NTP);
$this->remove(self::OPTION_NTP_OFFSET);
$this->remove(self::OPTION_NTP_FAILURE_COUNT);
}
}PK ! vR R - login-security/classes/controller/captcha.phpnu [ site_key();
$secret = $this->_secret();
return Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_AUTH_CAPTCHA) && !empty($key) && !empty($secret);
}
/**
* Returns the public reCAPTCHA key if set.
*
* @return string|bool
*/
public function site_key() {
return Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SITE_KEY);
}
/**
* Returns the private reCAPTCHA secret if set.
*
* @return string|bool
*/
protected function _secret() {
return Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SECRET);
}
/**
* Returns the bot/human threshold for comparing the score against, defaulting to 0.5.
*
* @return float
*/
public function threshold() {
return max(0.1, Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5));
}
/**
* Determine whether or not test mode for reCAPTCHA is enabled
*
* @return bool
*/
public function test_mode() {
return Controller_Settings::shared()->get_bool(\WordfenceLS\Controller_Settings::OPTION_CAPTCHA_TEST_MODE);
}
/**
* Queries the reCAPTCHA endpoint with the given token, verifies the action matches, and returns the corresponding
* score. If validation fails, false is returned. Any other failure (e.g., mangled response or connection dropped) returns 0.0.
*
* @param string $token
* @param string $action
* @param int $timeout
* @return float|false
*/
public function score($token, $action = 'login', $timeout = 10) {
try {
$payload = array(
'secret' => $this->_secret(),
'response' => $token,
'remoteip' => Model_Request::current()->ip(),
);
$response = wp_remote_post(self::RECAPTCHA_ENDPOINT,
array(
'body' => $payload,
'headers' => array(
'Referer' => false,
),
'timeout' => $timeout,
'blocking' => true,
));
if (!is_wp_error($response)) {
$jsonResponse = wp_remote_retrieve_body($response);
$decoded = @json_decode($jsonResponse, true);
if (is_array($decoded) && isset($decoded['success'])) {
if ($decoded['success']) {
if (isset($decoded['score']) && isset($decoded['action']) && $decoded['action'] == $action) {
return (float) $decoded['score'];
}
}
return false;
}
}
}
catch (\Exception $e) {
//Fall through
}
return 0.0;
}
/**
* Returns true if the score is >= the threshold to be considered a human request.
*
* @param float $score
* @return bool
*/
public function is_human($score) {
if ($this->test_mode()) {
return true;
}
$threshold = $this->threshold();
return ($score >= $threshold || abs($score - $threshold) < 0.0001);
}
/**
* Check if the current request is an XML RPC request
* @return bool
*/
private static function is_xml_rpc() {
return defined('XMLRPC_REQUEST') && XMLRPC_REQUEST;
}
/**
* Check if captcha is required for the current request
* @return bool
*/
public function is_captcha_required() {
$required = $this->enabled() && !self::is_xml_rpc();
return apply_filters('wordfence_ls_require_captcha', $required);
}
/**
* Get the captcha token provided with the current request
* @param string $key if specified, override the default token parameter
* @return string|null the captcha token, if present, null otherwise
*/
public function get_token($key = 'wfls-captcha-token') {
return (isset($_POST[$key]) && is_string($_POST[$key]) && !empty($_POST[$key]) ? $_POST[$key] : null);
}
}PK ! :g g ( login-security/classes/controller/db.phpnu [ base_prefix;
}
/**
* Returns the table with the site (single site installations) or network (multisite) prefix added.
*
* @param string $table
* @return string
*/
public static function network_table($table) {
return self::network_prefix() . $table;
}
public function __get($key) {
switch ($key) {
case 'secrets':
return self::network_table(self::TABLE_2FA_SECRETS);
case 'settings':
return self::network_table(self::TABLE_SETTINGS);
case 'role_counts':
return self::network_table(self::TABLE_ROLE_COUNTS);
case 'role_counts_temporary':
return self::network_table(self::TABLE_ROLE_COUNTS_TEMPORARY);
}
throw new \OutOfBoundsException('Unknown key: ' . $key);
}
public function install() {
$this->_create_schema();
global $wpdb;
$table = $this->secrets;
$wpdb->query($wpdb->prepare("UPDATE `{$table}` SET `vtime` = LEAST(`vtime`, %d)", Controller_Time::time()));
}
public function uninstall() {
$tables = array(self::TABLE_2FA_SECRETS, self::TABLE_SETTINGS, self::TABLE_ROLE_COUNTS);
foreach ($tables as $table) {
global $wpdb;
$wpdb->query('DROP TABLE IF EXISTS `' . self::network_table($table) . '`');
}
}
private function create_table($name, $definition, $temporary = false) {
global $wpdb;
if (is_array($definition)) {
foreach ($definition as $attempt) {
if ($this->create_table($name, $attempt, $temporary))
return true;
}
return false;
}
else {
return $wpdb->query('CREATE ' . ($temporary ? 'TEMPORARY ' : '') . 'TABLE IF NOT EXISTS `' . self::network_table($name) . '` ' . $definition);
}
}
private function create_temporary_table($name, $definition) {
if (Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_DISABLE_TEMPORARY_TABLES))
return false;
if ($this->create_table($name, $definition, true))
return true;
Controller_Settings::shared()->set(Controller_Settings::OPTION_DISABLE_TEMPORARY_TABLES, true);
return false;
}
private function get_role_counts_table_definition($engine = null) {
$engineClause = $engine === null ? '' : "ENGINE={$engine}";
return <<get_role_counts_table_definition('MEMORY'),
$this->get_role_counts_table_definition('MyISAM'),
$this->get_role_counts_table_definition()
);
}
protected function _create_schema() {
$tables = array(
self::TABLE_2FA_SECRETS => '(
`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
`user_id` bigint(20) unsigned NOT NULL,
`secret` tinyblob NOT NULL,
`recovery` blob NOT NULL,
`ctime` int(10) unsigned NOT NULL,
`vtime` int(10) unsigned NOT NULL,
`mode` enum(\'authenticator\') NOT NULL DEFAULT \'authenticator\',
PRIMARY KEY (`id`),
KEY `user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;',
self::TABLE_SETTINGS => '(
`name` varchar(191) NOT NULL DEFAULT \'\',
`value` longblob,
`autoload` enum(\'no\',\'yes\') NOT NULL DEFAULT \'yes\',
PRIMARY KEY (`name`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;',
self::TABLE_ROLE_COUNTS => $this->get_role_counts_table_definition_options()
);
foreach ($tables as $table => $def) {
$this->create_table($table, $def);
}
Controller_Settings::shared()->set(Controller_Settings::OPTION_SCHEMA_VERSION, self::SCHEMA_VERSION);
}
public function require_schema_version($version) {
$current = Controller_Settings::shared()->get_int(Controller_Settings::OPTION_SCHEMA_VERSION);
if ($current < $version) {
$this->install();
}
}
public function query($query) {
global $wpdb;
if ($wpdb->query($query) === false)
throw new RuntimeException("Failed to execute query: {$query}");
}
public function get_wpdb() {
global $wpdb;
return $wpdb;
}
public function create_temporary_role_counts_table() {
return $this->create_temporary_table(self::TABLE_ROLE_COUNTS_TEMPORARY, $this->get_role_counts_table_definition_options());
}
}PK ! ^Nצ$ $ / login-security/classes/controller/whitelist.phpnu [ _cachedStatus[$ipHash])) {
return $this->_cachedStatus[$ipHash];
}
$whitelist = Controller_Settings::shared()->whitelisted_ips();
foreach ($whitelist as $entry) {
if ($this->ip_in_range($ip, $entry)) {
$this->_cachedStatus[$ipHash] = true;
return true;
}
}
$this->_cachedStatus[$ipHash] = false;
return false;
}
/**
* Check if the supplied IP address is within the user supplied range.
*
* @param string $ip
* @return bool
*/
public function ip_in_range($ip, $range) {
if (strpos($range, '/') !== false) { //CIDR range -- 127.0.0.1/24
return $this->_cidr_contains_ip($range, $ip);
}
else if (strpos($range, '[') !== false) { //Bracketed range -- 127.0.0.[1-100]
// IPv4 range
if (strpos($range, '.') !== false && strpos($ip, '.') !== false) {
// IPv4-mapped-IPv6
if (preg_match('/:ffff:([^:]+)$/i', $range, $matches)) {
$range = $matches[1];
}
if (preg_match('/:ffff:([^:]+)$/i', $ip, $matches)) {
$ip = $matches[1];
}
// Range check
if (preg_match('/\[\d+\-\d+\]/', $range)) {
$ipParts = explode('.', $ip);
$whiteParts = explode('.', $range);
$mismatch = false;
if (count($whiteParts) != 4 || count($ipParts) != 4) {
return false;
}
for ($i = 0; $i <= 3; $i++) {
if (preg_match('/^\[(\d+)\-(\d+)\]$/', $whiteParts[$i], $m)) {
if ($ipParts[$i] < $m[1] || $ipParts[$i] > $m[2]) {
$mismatch = true;
}
}
else if ($whiteParts[$i] != $ipParts[$i]) {
$mismatch = true;
}
}
if ($mismatch === false) {
return true; // Is whitelisted because we did not get a mismatch
}
}
else if ($range == $ip) {
return true;
}
// IPv6 range
}
else if (strpos($range, ':') !== false && strpos($ip, ':') !== false) {
$ip = strtolower(Model_IP::expand_ipv6_address($ip));
$range = strtolower($this->_expand_ipv6_range($range));
if (preg_match('/\[[a-f0-9]+\-[a-f0-9]+\]/i', $range)) {
$IPparts = explode(':', $ip);
$whiteParts = explode(':', $range);
$mismatch = false;
if (count($whiteParts) != 8 || count($IPparts) != 8) {
return false;
}
for ($i = 0; $i <= 7; $i++) {
if (preg_match('/^\[([a-f0-9]+)\-([a-f0-9]+)\]$/i', $whiteParts[$i], $m)) {
$ip_group = hexdec($IPparts[$i]);
$range_group_from = hexdec($m[1]);
$range_group_to = hexdec($m[2]);
if ($ip_group < $range_group_from || $ip_group > $range_group_to) {
$mismatch = true;
break;
}
}
else if ($whiteParts[$i] != $IPparts[$i]) {
$mismatch = true;
break;
}
}
if ($mismatch === false) {
return true; // Is whitelisted because we did not get a mismatch
}
}
else if ($range == $ip) {
return true;
}
}
}
else if (strpos($range, '-') !== false) { //Linear range -- 127.0.0.1 - 127.0.1.100
list($ip1, $ip2) = explode('-', $range);
$ip1N = Model_IP::inet_pton($ip1);
$ip2N = Model_IP::inet_pton($ip2);
$ipN = Model_IP::inet_pton($ip);
return (strcmp($ip1N, $ipN) <= 0 && strcmp($ip2N, $ipN) >= 0);
}
else { //Treat as a literal IP
$ip1 = Model_IP::inet_pton($range);
$ip2 = Model_IP::inet_pton($ip);
if ($ip1 !== false && $ip1 === $ip2) {
return true;
}
}
return false;
}
/**
* Utility
*/
/**
* Returns whether or not the CIDR-formatted subnet contains $ip.
*
* @param string $subnet
* @param string $ip A human-readable IP.
* @return bool
*/
protected function _cidr_contains_ip($subnet, $ip) {
list($network, $prefix) = array_pad(explode('/', $subnet, 2), 2, null);
if (filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
// If no prefix was supplied, 32 is implied for IPv4
if ($prefix === null) {
$prefix = 32;
}
// Validate the IPv4 network prefix
if ($prefix < 0 || $prefix > 32) {
return false;
}
// Increase the IPv4 network prefix to work in the IPv6 address space
$prefix += 96;
}
else {
// If no prefix was supplied, 128 is implied for IPv6
if ($prefix === null) {
$prefix = 128;
}
// Validate the IPv6 network prefix
if ($prefix < 1 || $prefix > 128) {
return false;
}
}
$bin_network = Model_Crypto::substr(Model_IP::inet_pton($network), 0, ceil($prefix / 8));
$bin_ip = Model_Crypto::substr(Model_IP::inet_pton($ip), 0, ceil($prefix / 8));
if ($prefix % 8 != 0) { //Adjust the last relevant character to fit the mask length since the character's bits are split over it
$pos = intval($prefix / 8);
$adjustment = chr(((0xff << (8 - ($prefix % 8))) & 0xff));
$bin_network[$pos] = ($bin_network[$pos] & $adjustment);
$bin_ip[$pos] = ($bin_ip[$pos] & $adjustment);
}
return ($bin_network === $bin_ip);
}
/**
* Expands a compressed printable range representation of an IPv6 address.
*
* @param string $range
* @return string
*/
protected function _expand_ipv6_range($range) {
$colon_count = substr_count($range, ':');
$dbl_colon_count = substr_count($range, '::');
if ($dbl_colon_count > 1) {
return false;
}
$dbl_colon_pos = strpos($range, '::');
if ($dbl_colon_pos !== false) {
$range = str_replace('::', str_repeat(':0000', (($dbl_colon_pos === 0 || $dbl_colon_pos === strlen($range) - 2) ? 9 : 8) - $colon_count) . ':', $range);
$range = trim($range, ':');
}
$colon_count = substr_count($range, ':');
if ($colon_count != 7) {
return false;
}
$groups = explode(':', $range);
$expanded = '';
foreach ($groups as $group) {
if (preg_match('/\[([a-f0-9]{1,4})\-([a-f0-9]{1,4})\]/i', $group, $matches)) {
$expanded .= sprintf('[%s-%s]', str_pad(strtolower($matches[1]), 4, '0', STR_PAD_LEFT), str_pad(strtolower($matches[2]), 4, '0', STR_PAD_LEFT)) . ':';
}
else if (preg_match('/[a-f0-9]{1,4}/i', $group)) {
$expanded .= str_pad(strtolower($group), 4, '0', STR_PAD_LEFT) . ':';
}
else {
return false;
}
}
return trim($expanded, ':');
}
/**
* @return bool
*/
public function is_valid_range($range) {
return $this->_is_valid_cidr_range($range) || $this->_is_valid_bracketed_range($range) || $this->_is_valid_linear_range($range) || Model_IP::is_valid_ip($range);
}
protected function _is_valid_cidr_range($range) { //e.g., 192.0.2.1/24
if (preg_match('/[^0-9a-f:\/\.]/i', $range)) { return false; }
$components = explode('/', $range);
if (count($components) != 2) { return false; }
list($ip, $prefix) = $components;
if (!Model_IP::is_valid_ip($ip)) { return false; }
if (!preg_match('/^\d+$/', $prefix)) { return false; }
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
if ($prefix < 0 || $prefix > 32) { return false; }
}
else {
if ($prefix < 1 || $prefix > 128) { return false; }
}
return true;
}
protected function _is_valid_bracketed_range($range) { //e.g., 192.0.2.[1-10]
if (preg_match('/[^0-9a-f:\.\[\]\-]/i', $range)) { return false; }
if (strpos($range, '.') !== false) { //IPv4
if (preg_match_all('/(\d+)/', $range, $matches) > 0) {
foreach ($matches[1] as $match) {
$group = (int) $match;
if ($group > 255 || $group < 0) {
return false;
}
}
}
$group_regex = '([0-9]{1,3}|\[[0-9]{1,3}\-[0-9]{1,3}\])';
return preg_match('/^' . str_repeat("{$group_regex}\\.", 3) . $group_regex . '$/i', $range) > 0;
}
//IPv6
if (strpos($range, '::') !== false) {
$range = $this->_expand_ipv6_range($range);
}
if (!$range) {
return false;
}
$group_regex = '([a-f0-9]{1,4}|\[[a-f0-9]{1,4}\-[a-f0-9]{1,4}\])';
return preg_match('/^' . str_repeat($group_regex . ':', 7) . $group_regex . '$/i', $range) > 0;
}
protected function _is_valid_linear_range($range) { //e.g., 192.0.2.1-192.0.2.100
if (preg_match('/[^0-9a-f:\.\-]/i', $range)) { return false; }
list($ip1, $ip2) = explode("-", $range);
$ip1N = Model_IP::inet_pton($ip1);
$ip2N = Model_IP::inet_pton($ip2);
if ($ip1N === false || !Model_IP::is_valid_ip($ip1) || $ip2N === false || !Model_IP::is_valid_ip($ip2)) {
return false;
}
return strcmp($ip1N, $ip2N) <= 0;
}
protected function _is_mixed_range($range) { //e.g., 192.0.2.1-2001:db8::ffff
if (preg_match('/[^0-9a-f:\.\-]/i', $range)) { return false; }
list($ip1, $ip2) = explode("-", $range);
$ipv4Count = 0;
$ipv4Count += filter_var($ip1, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false ? 1 : 0;
$ipv4Count += filter_var($ip2, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false ? 1 : 0;
$ipv6Count = 0;
$ipv6Count += filter_var($ip1, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false ? 1 : 0;
$ipv6Count += filter_var($ip2, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false ? 1 : 0;
if ($ipv4Count != 2 && $ipv6Count != 2) {
return true;
}
return false;
}
}PK ! * login-security/classes/controller/cron.phpnu [ secrets;
$wpdb->query($wpdb->prepare("INSERT INTO `{$table}` (`user_id`, `secret`, `recovery`, `ctime`, `vtime`, `mode`) VALUES (%d, %s, %s, UNIX_TIMESTAMP(), %d, 'authenticator')", $user->ID, Model_Compat::hex2bin($secret), implode('', array_map(function($r) { return Model_Compat::hex2bin($r); }, $recovery)), $vtime));
/**
* Fires when 2FA is enabled for a user.
*
* @since 1.1.13
*
* @param \WP_User $user The user.
*/
do_action('wordfence_ls_2fa_activated', $user);
}
/**
* Validates the 2FA (or recovery) code for the given user. This will return `null` if the user does not have 2FA
* enabled. This check will mark the code as used, preventing its use again.
*
* @param \WP_User $user
* @param string $code
* @return bool|null Returns null if the user does not have 2FA enabled, false if the code is invalid, and true if valid.
*/
public function validate_2fa($user, $code, $update = true) {
global $wpdb;
$table = Controller_DB::shared()->secrets;
$record = $wpdb->get_row($wpdb->prepare("SELECT * FROM `{$table}` WHERE `user_id` = %d FOR UPDATE", $user->ID), ARRAY_A);
if (!$record) {
return null;
}
if (preg_match('/^(?:[a-f0-9]{4}\s*){4}$/i', $code)) { //Recovery code
$code = strtolower(preg_replace('/\s/i', '', $code));
$recoveryCodes = str_split(strtolower(bin2hex($record['recovery'])), 16);
$index = array_search($code, $recoveryCodes);
if ($index !== false) {
if ($update) {
unset($recoveryCodes[$index]);
$updatedRecoveryCodes = implode('', $recoveryCodes);
$wpdb->query($wpdb->prepare("UPDATE `{$table}` SET `recovery` = X%s WHERE `id` = %d", $updatedRecoveryCodes, $record['id']));
}
$wpdb->query('COMMIT');
return true;
}
}
else if (preg_match('/^(?:[0-9]{3}\s*){2}$/i', $code)) { //TOTP code
$code = preg_replace('/\s/i', '', $code);
$secret = bin2hex($record['secret']);
$matches = $this->check_code($secret, $code, floor($record['vtime'] / self::TIME_WINDOW_LENGTH));
if ($matches !== false) {
if ($update) {
$wpdb->query($wpdb->prepare("UPDATE `{$table}` SET `vtime` = %d WHERE `id` = %d", $matches, $record['id']));
}
$wpdb->query('COMMIT');
return true;
}
}
$wpdb->query('ROLLBACK');
return false;
}
/**
* Checks whether or not the code is valid for the given secret. If it is, it returns the time window (as a timestamp)
* that matched. If no time windows are provided, it checks the current and one on each side.
*
* @param string $secret The secret as a hex string.
* @param string $code The code.
* @param null|int The last-used time window (as a timestamp).
* @param null|array $windows An array of time windows or null to use the default.
* @return bool|int The time window if matches, otherwise false.
*/
public function check_code($secret, $code, $previous = null, $windows = null) {
$timeCode = floor(Controller_Time::time() / self::TIME_WINDOW_LENGTH);
if ($windows === null) {
$windows = array();
$validRange = array(-1, 1); //90 second range for authenticator
$lowRange = $validRange[0];
$highRange = $validRange[1];
for ($i = 0; $i >= $lowRange; $i--) {
$windows[] = $timeCode + $i;
}
for ($i = 1; $i <= $highRange; $i++) {
$windows[] = $timeCode + $i;
}
}
foreach ($windows as $w) {
if ($previous !== null && $previous >= $w) {
continue;
}
$expectedCode = $this->_generate_totp($secret, dechex($w));
if (hash_equals($expectedCode, $code)) {
return $w * self::TIME_WINDOW_LENGTH;
}
}
return false;
}
/**
* Generates a TOTP value using the provided parameters.
*
* @param $key The key in hex.
* @param $time The desired time code in hex.
* @param int $digits The number of digits.
* @return string The TOTP value.
*/
private function _generate_totp($key, $time, $digits = 6)
{
$time = Model_Compat::hex2bin(str_pad($time, 16, '0', STR_PAD_LEFT));
$key = Model_Compat::hex2bin($key);
$hash = hash_hmac('sha1', $time, $key);
$offset = hexdec(substr($hash, -2)) & 0xf;
$intermediate = ( ((hexdec(substr($hash, $offset * 2, 2)) & 0x7f) << 24) |
((hexdec(substr($hash, ($offset + 1) * 2, 2)) & 0xff) << 16) |
((hexdec(substr($hash, ($offset + 2) * 2, 2)) & 0xff) << 8) |
((hexdec(substr($hash, ($offset + 3) * 2, 2)) & 0xff))
);
$otp = $intermediate % pow(10, $digits);
return str_pad("{$otp}", $digits, '0', STR_PAD_LEFT);
}
}PK ! i i * login-security/classes/controller/time.phpnu [ reset_ntp_disabled_flag();
}
public function uninstall() {
wp_clear_scheduled_hook('wordfence_ls_ntp_cron');
Controller_Settings::shared()->reset_ntp_disabled_flag();
}
public function init() {
$this->_init_actions();
}
public function _init_actions() {
add_action('wordfence_ls_ntp_cron', array($this, '_wordfence_ls_ntp_cron'));
}
public function _wordfence_ls_ntp_cron() {
if (Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ALLOW_DISABLING_NTP) && Controller_Settings::shared()->is_ntp_cron_disabled())
return;
$ntp = self::ntp_time();
$time = time();
if ($ntp === false) {
$failureCount = Controller_Settings::shared()->increment_ntp_failure_count();
if ($failureCount >= self::FAILURE_LIMIT) {
Controller_Settings::shared()->set(Controller_Settings::OPTION_USE_NTP, false);
Controller_Settings::shared()->set(Controller_Settings::OPTION_NTP_OFFSET, 0);
}
}
else {
Controller_Settings::shared()->reset_ntp_failure_count();
Controller_Settings::shared()->set(Controller_Settings::OPTION_USE_NTP, true);
Controller_Settings::shared()->set(Controller_Settings::OPTION_NTP_OFFSET, $ntp - $time);
}
Controller_Settings::shared()->set(Controller_Settings::OPTION_ALLOW_DISABLING_NTP, true);
}
/**
* Returns the current UTC timestamp, offset as needed to reflect the time retrieved from an NTP request or (if
* running in the complete plugin) offset as needed from the Wordfence server's true time.
*
* @param bool|int $time The timestamp to apply any offset to. If `false`, it will use the current timestamp.
* @return int
*/
public static function time($time = false) {
if ($time === false) {
$time = time();
}
$offset = 0;
if (Controller_Settings::shared()->is_ntp_enabled()) {
$offset = Controller_Settings::shared()->get_int(Controller_Settings::OPTION_NTP_OFFSET);
}
else if (WORDFENCE_LS_FROM_CORE) {
$offset = \wfUtils::normalizedTime($time) - $time;
}
return $time + $offset;
}
/**
* Returns the current timestamp from ntp.org using the NTP protocol. If unable to (e.g., UDP connections are blocked),
* it will return false.
*
* @return bool|float
*/
public static function ntp_time() {
$servers = array('0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org');
//Header - RFC 5905, page 18
$header = '00'; //LI (leap indicator) - 2 bits: 00 for "no warning"
$header .= sprintf('%03d', decbin(self::NTP_VERSION)); //VN (version number) - 3 bits: 011 for version 3
$header .= '011'; //Mode (association mode) - 3 bit: 011 for "client"
$packet = chr(bindec($header));
$packet .= str_repeat("\x0", 39);
foreach ($servers as $s) {
$socket = @fsockopen('udp://' . $s, 123, $err_no, $err_str, 1);
if ($socket) {
stream_set_timeout($socket, 1);
$remote_originate = microtime(true);
$secondsNTP = ((int) $remote_originate) + self::NTP_EPOCH_CONVERT;
$fractional = sprintf('%010d', round(($remote_originate - ((int) $remote_originate)) * 0x100000000));
$packed = pack('N', $secondsNTP) . pack('N', $fractional);
if (@fwrite($socket, $packet . $packed)) {
$response = fread($socket, 48);
$local_transmitted = microtime(true);
}
@fclose($socket);
if (isset($response) && Model_Crypto::strlen($response) == 48) {
break;
}
}
}
if (isset($response) && Model_Crypto::strlen($response) == 48) {
$longs = unpack("N12", $response);
$remote_originate_seconds = sprintf('%u', $longs[7]) - self::NTP_EPOCH_CONVERT;
$remote_received_seconds = sprintf('%u', $longs[9]) - self::NTP_EPOCH_CONVERT;
$remote_transmitted_seconds = sprintf('%u', $longs[11]) - self::NTP_EPOCH_CONVERT;
$remote_originate_fraction = sprintf('%u', $longs[8]) / 0x100000000;
$remote_received_fraction = sprintf('%u', $longs[10]) / 0x100000000;
$remote_transmitted_fraction = sprintf('%u', $longs[12]) / 0x100000000;
$remote_originate = $remote_originate_seconds + $remote_originate_fraction;
$remote_received = $remote_received_seconds + $remote_received_fraction;
$remote_transmitted = $remote_transmitted_seconds + $remote_transmitted_fraction;
$delay = (($local_transmitted - $remote_originate) / 2) - ($remote_transmitted - $remote_received);
$ntp_time = $remote_transmitted - $delay;
return $ntp_time;
}
return false;
}
/**
* Formats and returns the given timestamp using the time zone set for the WordPress installation.
*
* @param string $format See the PHP docs on DateTime for the format options.
* @param int|bool $timestamp Assumed to be in UTC. If false, defaults to the current timestamp.
* @return string
*/
public static function format_local_time($format, $timestamp = false) {
if ($timestamp === false) {
$timestamp = self::time();
}
$utc = new \DateTimeZone('UTC');
if (!function_exists('date_timestamp_set')) {
$dtStr = gmdate("c", (int) $timestamp); //Have to do it this way because of PHP 5.2
$dt = new \DateTime($dtStr, $utc);
}
else {
$dt = new \DateTime('now', $utc);
$dt->setTimestamp($timestamp);
}
$tz = get_option('timezone_string');
if (!empty($tz)) {
$dt->setTimezone(new \DateTimeZone($tz));
}
else {
$gmt = get_option('gmt_offset');
if (!empty($gmt)) {
if (PHP_VERSION_ID < 50510) {
$dtStr = gmdate("c", (int) ($timestamp + $gmt * 3600)); //Have to do it this way because of < PHP 5.5.10
$dt = new \DateTime($dtStr, $utc);
}
else {
$direction = ($gmt > 0 ? '+' : '-');
$gmt = abs($gmt);
$h = (int) $gmt;
$m = ($gmt - $h) * 60;
$dt->setTimezone(new \DateTimeZone($direction . str_pad($h, 2, '0', STR_PAD_LEFT) . str_pad($m, 2, '0', STR_PAD_LEFT)));
}
}
}
return $dt->format($format);
}
}PK ! ;
Ku - login-security/classes/controller/support.phpnu [
RewriteEngine On
RewriteCond %{REQUEST_URI} \.php$
RewriteRule .* - [F,L,NC]
Require all denied
Order deny,allow
Deny from all
PK ! mJ ) login-security/img/loading_background.pngnu [ PNG
IHDR ( ( m dIDATXٱ
0 A#{CEA u$ PcpymrS[rs (P@
(P@
(U`/Ɍz IENDB`PK ! _+ login-security/img/loading.gifnu [ GIF89a ర莎Ȝبvvvhhh !Created with ajaxload.info ! ! NETSCAPE2.0 , $ AeZ
<䠒ÌQ46<A
ßH a :ID0Fa\xG3! O:-RjTJ*
t
~" ds]
)t-" i;H>nQg]_*
R3 GI?
˴v$ýj3! ! , $0eZy 0q PУW )";qX^D50 Ո%`rJ{
1$ʈ! ! , $@e6$Ơ` 3*=
P\"F`P-d5V"2|?n"!(
)e4xyc?
3
#wyJ l%
o^[b_0 V T[0m
$4 >'VZ
c 3$X%! ! , $`e:D3
H0, 'j0Qs L(2HMj#ȉB \Oi`u=YEVL=I
>
suI WJm| \"_b0 BcV"d]*K1" H|@B?I4# S$-||! ! , $4ea:D hI /K$W- 0(`3 F=pf@ tQ
{f~*yS*mg) enu E^Z^ g@ kw(b& -w#" xW "t
##%U$`to! ! , $4ea:* 1v/Kdzk# F Y" % E
Cb
AI4$ (z :2
mI Ll##
F##>F! !
, $4ea:* 1v/KdVtKG22 7D"$)Qqp8 y
l
|~6zw2j# F
" %
VC
]6a$
Q :2 \ EF I&x "͓F4$]#x! ! , $4eZi䠒J16e E,C\3
^3[
S|?! ; PK ! KP P . login-security/img/ui-icons_444444_256x240.pngnu [ PNG
IHDR Er@ bKGD D< pHYs H H Fk> mIDATx{leG}?gK$U!>TRu &H`oE*U.B
RE*%B$EFdE)݈>lB^PRU %9g^{}{=y~9Mn<.` cAb/@[VD03AX90N_ B &>~>
c;abDߎEQ z 'kMayԉ 6!:u ::@RŤ ByDD'L-f]Sq ! f
S Q&S7MCr==3dJ{fZS0Ms:0K٦gʿ&HU=mc4i?U ĔGU4hcQb ]!hLW/
@pxh8~|AQf?ێ 1f¸ =uQGJHpPϠIw״m췥ԧ>2"WÓP&{n T:sfqH@.cI ~ Ss+^|Bn29 dH]v-ˌ-meh> q&تg 9x#c n~!pxh8 4 ^ /
o # Z@S^4 KZKPd9C@F[,a+]8vKqHlw9ק 84KBץ|&#[\C `R!:F
zC6)AT1wU.Iҗ!4ig3wE:q7n0uAmPy
TK(5ͬlNæbTrwDV]te47
L[C0P&0++
@pxh8 4 Y`OEZj,*-E)e{U,
\uoV:
`omKet_WOdW3Z
Քrv|~^g`j ycp*fb] M59.LNq+%ۯ0vccJE M5kk#I<x_ I#0Dw4xh8 4 ^ /
^c
drDM{wQte{^`br./M: 0գ*z`]|SB(e)h͎/Vܮ"aO!o
,u^Љ^=zt`WeCCM Qϱo0q%Uo?<@6HG/ uAQ-_u|| ִ*2lٍuG@ j
!Br qL!* )h .V{3 -!w$dP*/P[ t1l3hlyp0bgL} 3$%\/.)TwQ"uK7d+2! @pxh8 4 ' aY$mf6lB'.D
Рx7SxtIe We}d0RW^ݢ0](UTx|T|@v^DfLb(2H0n8;_QO}D&3{YW w5*e˗?̖G
:H iZӖ)/MP(:!/|B[i:Gf
L`~:z$aa ^ʭ|P- kbݞ<ەL&xJAABȼHv ᑢ[ySəwNJuy %pw 0_a"z x 3i1| = @%JWAm\
l>arV-PSוjA^&v&^WcqM z-&| ϜCʥxx}\ZW 4Ig8YL1 aROQ.PU(>K&c.mO-M\8SY.'|5*܊B@֘A%Mo2:c[K93-tnNjBo2`*]9aZAq?Wկó)%0"_ϮqpyV!/hI.($]!rW+p P;
44E*0r"77` \*!s<@Zbn0͏me
HEH]XSM~#a1&|VbYQE}e%ͦ@~NN>8o7*GBMR-U= - ³K E+x
p
c\UWs5W la?L sf;2vy +o*m m- t8
W<,o ̰8f=CH`⾿h)_}(%m'&
;(ݚ!{:^R@N ү"*<V敡5oh~q+`6IiI <%Z=^JE\`0]1DA^ a0f(c %[Gxh8 4 ^ / Ordh9 M7L)-ӂ-?K(stբh-?:_XڧCr]8YB3|C|
leXW_x!V8Ɗb8bQ7N4J l!=
D ?'a`^ aq8:-YPx[o֝XQ "GִW}
1>cÚbYV
6=*ۿŻ)8hs/8'Ϳ ,lEb\Ye.M6܈d9uJZĽj-l &8:s\Кty'hs[Gmh-mk2^SJe%u\j5 n |; δa[;Хˎp?|yRaC$_a/)NUNƍ Ȅ p~Ú/kn|J)/9Q:,K xR! B%]lq+|w ս_\GW)"3]aCJ%>|' _ƅDP*07³= VZEgV-L'@}2ƪ[ P' rEm["vO#
5g$$?mƟ'zJ^SxHjg4D=4@F7#
ъ~z'o To㩋b ̓ddcBU%T9ҊD@ .! +Nwuer>n-U$U`Iv%AQEd
;Ә:+a&XĎ y% k Gс "4 pxh8 4 ^ @d6((Ԕ{C::[>H,
ɴNVNhr.~NZb3+Q|,%t %n!作*7fg(m!f y"kI6Y/eZٳ+zg6W8ɦbQ%y8Ï2ŕ#b-tY͕8 ynO{]!ټ*\ (p2.Hٙd.>Z(N &l2&k U&ף~.ו 658A7}P: BlkU[8)j1$W !s\ QFn(qRK:'X@=$ x#|5:@] 2Si.&W
$`
8t 3 =&[#ߥU3Wҳq .H{➇Z,ȣ "AH#珁W( +̱1Ɏ;8/<EE
C+nU:|a ɔM|?LW1$ ~}W ,o V R l{ 7 ^;<,t[T"3SU9l˾H [yV&a@E&I?U7xG4c *i'xƨ"
I3c1e\ӎe ($ztnꅧH v.|mO9QFL&y
Πg)5ޜlWv' 6zK,`]ǫ2@}Ϟ9=>4=O5͍sp
'UX{J FalrF}c@`fQȎчxm܃ #< @pd`.6 Ip۞]A+"y Pns3oz7hzeDp'm&MwMh<Ǧ(I'G>W%QWVoHtMtjDU͕l n IwoO_5~YXw(R m)'Dɸ5=@+~jy^`O`$!_ U#! GB |V :ĵ>de=Ay<Շ*^_b
T)}7
bPo hhh~7rM/dFHGI >&Ql/L^b:גTDM9Q<*y
=2~/?Ｊ, +%qqޗS ?ܑ
^ e]GSVpu ^ س~oBo
l8 4 ^ /
@!/O NGۮ2t]С8cݮ5z=7 ˮg@/aE[y#3# z7L.|
(cRcSmQ$6ץ{ Da{T_j8 4 ^ /
@ñ`/ _g "d`ɾ 0
{
Cj_9jDՋa~? dc[0*a , &
0&+ OB4!1~Ix >8c&G)jI =@5@v&J?Q lÇ@Q?x^y 3 %tEXtdate:create 2015-03-11T14:59:12+00:000i %tEXtdate:modify 2015-03-11T14:59:12+00:00A tEXtSoftware Adobe ImageReadyqe< IENDB`PK ! T . login-security/img/ui-icons_cc0000_256x240.pngnu [ PNG
IHDR IJ PLTE r YtRNS 3P/"Uq@f`2
!<BHK Z#'1S,4j8E | )Q$
bJmߜGc?oh@^ bKGD H pHYs H H Fk> dIDATx] c۶H阒]Kd%٫뺮lmw]|pXm-}X:+iĆQV 9\e'AtOS:72YsxMہB&z>nC@r@* aӝ% MFDDDDDDTߖH,ERUn
ب\f:}4ᦋ{)n[
̰E
K Y Dۇ- +Kl=ӃL`љ|%n a N#5 (4?EDDDD\oWFfq;\E_,W!%zE!F¶. (USHQ0dw)T 8#p,xBK *xXEe
K솎%mKX~sFE~tdc aI1Af4dHcGSB`0wev`"{ .GDDDD,dO6k"qkMefS_UKŌ&g~>n H}) LF%8()r![4统qQk0m[Le_70@>1 X0AZVcEV Ltk3E J44ZﮊN`rt>`˥
AHBLH@c Uq= jcM2s JCLiR NQ0= Yi-|4V ]]B^ޞ_H$<$
a=d@ (ZAp_}~s:N {DC>m^S&, ;N&B} <_AB]H uN(B 0{h1IK Ds j' M8.ӫ1h3df}mq nU{ Lo z \=?@ ((e |=ơ麄Ci 1r<|OO;
`HpQyzԈuZVƲ!)5m C2Lyg;֑RjWa@@VL&Wru=Z
̥=U5} 7;b(nP&sk48ͥ01U Wvk18dqTՌE]qH8 GF K 'rOrŗ 6"fp T^3c" n Mم-/W=tJ,X){ P
Rm|K>mX8v 5h<_{ꘀYF|&_G;&>^W⁃&K(81EB@F&;"L'wfwE- 6o&/̫'Xe,>~ee| A=) dQ`}P[KN˂/~)O[dO=3El5'Y$?7m Tzզ.\.` WE """""v)V #]L;zqJr²[\-tҽ5
@ͷϟnT@+; cQhC*TڙAVr?f ?
Q1T`} Hk,{VZˋTϛ?I̯uQKLMe͆~qym09 S;j5 i Q]7k0Uޭ GkX 3#lY_Цxj9`#
M [z KuO_z˿Dܭ*kOJ(7n\e
I Tƨl /U߶uw.~;#r.8
o# 5Lh>1i pVM ?/u70 X@L+M+{Fkt{ŧ890`. ĀCR+\/t R;
TӲ]aL|efđ >ۣG|P`P8C1K՛A̍<2ۂKrl@L
L 8@E>`n PNԍ,p EƆ ZF lÎ; F7Ȯ;
swSz)g7{rsSgȋ(߄~AWytX$NVR_<6p.O8O[OdDk>_ OO}JSdmV?W(_m j~=H IԁF>T/{*] IGJ@iqamNF|Q50+ ES8:v`p~vj:Bp96oys%
|@H]+@t]Wk}}7FʮrAB\m-_2PY8xՎN.h~@+7z5t_//?0S>)zi0n/B`{DW#`Bo[,gFVЁpP߾C]Bz ,XXfԃ A:H k7dZ9oc}o]0vd:R]0ve]刈jу|
? +(OǍ+ #ysߍ npFru<.HȺotM3h}߆P}˗vP}mǀ?WZ@}@@FD l %tEXtdate:create 2015-03-11T14:59:12+00:000i %tEXtdate:modify 2015-03-11T14:59:12+00:00A tEXtSoftware Adobe ImageReadyqe< IENDB`PK ! login-security/img/menu.svgnu [
PK ! |%C ( login-security/img/lightbox-controls.pngnu [ PNG
IHDR 2 *j tEXtSoftware Adobe ImageReadyqe< @IDATx\kpU$3$L qwA,TPB@"D
Ft-u]ZGŔDuԬ#@ < bLOgfNusw۸ X g`±\ñ[ ~R eLXlH81`%Wd^E*^Ef*ɚ"
*r]
'~"Jx|//[UJJm}v9},/!h~a^xr.{Fdʭk
bݰ~C=ldҕI xSP>+_(_sYgY a\vW,VKE\|\Aμ0 0,le1gJ%$&cbc0e7&$l웒BvuuaZѹîޠ_m&
z͛O| Z @[[=ڇi %xur|(ByK CYP\U5?
եΝ;ۀic0:Ng_ #5R0y#G y5d6]|/dB].gkڷo k :u*m6grrH:vJ!p }NeB*ĉOAb37 ݡCkkkՆujqp/!G>f͚Ib_&mf,F4kꫯ6ЏedeΝ;p8>RRUcc$RWz, A %Pha;iҤ#Q <^m7,B fErfժUob0 (| y' ] {^. 1&sr =00
G)wzJI94tvv".^˗UXXXrF] hZ߆P
j+V
.:y"h9A'ΊʠgF)_t7o[w~P{?ňu]vM2jEͰ-U6mCh-o|}FS
be : ǯD, *c#
^P\m uV;~&f h<4R5`E
p=~Q?mXCL b/A"(UD7=E*d4@I Q$yv%%^<
\͇ؾƙ' Ԍ(/ V p4XbQ?|@ 8F)xaSE =6 Vayu!T_6 DY|ydK3}H Ap\4w{{ ;X|\{fx G43*M & ,_.=riHx99Dn62mp^?U<>zS^l6Y+8Ӝ|qRzvtB9&$$h)
Ʈ#fZ)rhoğ0oɠ]3Z-qQo8i` [rͼ!SCC u vv{ nEy~ 7yו դO-\Iz)j4 Cah qIxI9jjrx9jR=VEɆ
V 9qWu 67I!Wϥ#ɑq=lOOK2,o\]2
BET
̙sEnjzqa9;^dI+$I+LmYi
ض 0!hK[=(9EuXZy_otƘct2WI"%;Jfz׃{ЧD}ɬY;SN[qO >em`)YYrLjkXdvfXG@_\p s͕i6DPMHq5ԌO`uggXFV 䇭Mc_4kii!gΜy#$V+gϞ8*kTv̘1̙3PX6 ^W [֬OQ|[B
=cPe0y^㥴(F\ .`III5 3 bTߘ1cڋjF }Nj;Ə \{![noV^fvYYYpFF|:da"'6XpGkr#Rr#{GY !LjUTTpj3//0h4o!9l2{4/k[PP >"mRk:{d`Got;ߝf*cc_IR@ӷ<~uzklڴ~^kjjcXWWױ4q[ |(E&N| ޟU^ S5T1hS5rf{wr٭꺏>
G566~f۳g EMdF+pm,2hw,Z|@ lrG E
lSݸqcڴi@6h_!'hQN %r>y"N$h ПB:{$(Jd 8
zt v^8,|+
`!E8 'N$l1}ƞb IDATx]]%uzfV^;lY03 &)]P ' M@+ȋa k` J!&~H2ք F?!0_&`>u?U_3sSu|U]:!D@t 8"t@M;ljH =&Omk3FB8F;@* cOy=kWڅە 3ANI*vP-ast $Hp As2 1E,ځ
ԪGE'ihe]iSǼjvqP r
/ Y e-ڦt R5wgf I;&ImJmqkۦw4BsȠWM &_
/1n;z_$ 8H` # pDH 8| 3h2 oF)e> }Hl>LBV-}uҾo|ڵ/l| "o]}HSwǗAs!803 @j~yӇ
4h > @")J _9]L;nj q (pDH 8"G$@ 'MqXi}"0 3]AS(~ @@-$M6
W3'79+OqOh\O<
`xTOHp/dg4
"GlՈ f+)CO'u*c'TMKh^< uWhzH ʇڸq풁| vAM1|B2 t3XbhW rsnZLwpO~8 pđ 8"G$@ # pCR~O
xDsM* |{oWC;]Հl5)^^ # šN v97>
tm
aϿ_
k{bW%p@ݖC>۩`ͤqǽ;~>iCZX^[HfalsX'0M _I~9'}~{.@6 2,hPU@U)UCH
_\f.*@/gN*C-{g7 H 4ɼkor ?_59]bU/_kp)m/qToLZ8D8 8"G$@ #`ܘ*s> ʧ轎I{`> @1%,` 35 "G
# pDH1{Hg[0 ˖\6%Hqx,Oaflxt!
b[WX7wN yZ .ZuCTk qh_|kj~Q@ n2=A6-kϺ"-RgZPv \8f/-Kp[:%,AL&S&D'Ms>A' FUf` Jv Q8]6" ?_C$n \Ba#¬#,5D 3fq # p,'?' :0+n֚^vx] f 45b {=6v=NWxG8£K3kt͒] -F⛛./復 Ou{ ~#qRyB+xۂJP1
!%3 /` >\^dG/N-^ZvP# Y"h o \[LugHz~] ()`+8PS~3OY(( My~;H Ļ} x 9 2SwG
9M\f/A 1n~p
SN< p-@o.-t>0-[\_g@6 nYNa .B|9> .N&hD[/3 oL59G0>*Z;"x} . QٟJ| L QG5c̍ >Iէ-}{s=5} _<Գ {ɂ WZgԔ5~ c|- 8"G$@X,WE Zm}p -oCCmȹA'[69 ~
ӎP#0*)uQDvi) FF4dAntÐ˞lO6;R ,:ElPǔ K:Dۄt).kL9AOqrџWԧlJߢ \&;߈2AK9DiZyQ#5۬|{MHD#JD \8)ju 9|1~=O=\Vn~'/PX(,u'0M PŃmq | J~yL 1ާ{ W/? o ]} u ܙ F&*S\=u3~Nz ߤYq6DR_/MwElJCǯq!Lw]*ԐjΛ
O]DCBɡB&@_fd]zva{!_nm SQnoMkn[qP3.)#{>oCz!U&6~ ߃JeتI]Ӻe9Qa.%sj=;x {DŽ y: 8"G$@ sɠ|6zCm79V ^Vzk}4*HAɿ6ZtF..2>Ot-fV;W_ٞ,O >Z|ya~萻B ki#@u"ڥ!
*7!
f3Dck TɰC k.sPש;C<} Ra0L;7Lw5@6JCDV#N XFa곮8y>B %:dH Ar'@+2oH:͢ Ӻ]r8C`W;E rV۸ruEP;3*'JcIz k Rl `OW*}Cc |NY+UOr1\LSZ5):aPlNw"Cهf9K`>3Jghe|7Iq N[ʥ^c7Mq=M*3+1qKʯ3! Kf6|#y >_&lʶ&1 _ TjW`iHCڥټ ,Z 7֟Ԫl;w*QwyFϜhc14R6i6h~ P6S]*r3pC۴NB ;G~gj!|h ϔ}vQ{z,pQGD{~9 )ߛzn&@T>5 1
偠0 I˫\!\rrh3> ]Y7PtӴDO[5nA ] alT2A_&\An4'':aOHc 0 w{Gg3/R1T 0+ޔ 0Rm柅 `o*~ _g uF jǟ=sxpE)VU9vuZO=j<_>o5@HPGx#;I
0Q #zG$@ # pDZK*6Aa\n6v[K( Ѯ0zLI/jnЮ|y.4q E
صẄ́xj q
{Y >.]!a[!i .d&~RJ4`&@Sۥ sy7wphq= lefy
y_Eŵ ^ըwX Q"
tloޡs9eSR~ڥ|;i6\/$ʗʿ x8_t+xp+ި$@'q_Ǔ.t-o\} ]m&-t-o}d C>rFO|Ӗw8KCH7V'J M֝`\ W #|{ B ̪$y4, }F>nk-PWEAtH=jiY'W;S'QOQL7DO=@w=KFR? ЛΕN8#(p̯/ b,?Pw %tEXtdate:create 2015-03-11T14:59:12+00:000i %tEXtdate:modify 2015-03-11T14:59:12+00:00A tEXtSoftware Adobe ImageReadyqe< IENDB`PK ! ;rL L . login-security/img/ui-icons_555555_256x240.pngnu [ PNG
IHDR Er@ bKGD UI pHYs H H Fk> iIDATxleGu?wKֻI -T i};T[-e$boE*Uh]@JD6_$)(j7 »QP zBTlU}n6ku}w+{}Μ;gL<=.` cAb;@zD03FX9:0N_ B &>~>
c;abD߈E. BH!6
Cu8tuI?!B *Oz.[aͲlB
>h >M,4Ro 1zzf^ 4"S j߱`沛u`M( ,7M
{
ƞi;~:) 7qqF6g]$ױ t pxh8 4 ^ /
@ی2v،1c 쩳 nʾ~ 7 |wM~[O}f7@q?@# e.L3noF|
Tel8iu{t`neӋOhmP& L v5zވe]lMԧ7qX ]
Wqw(BPpxh8 4 ^ /
G8gJo}iA ) s 5~ aJYTV1pTVP%تrO ?ph *sKM,G f
-։Ckuu@FkmS0 (b\/Chjgb)(; z-tVn
R71%ݪ-`.i۠@/8PjY%Mźh[2
R h 7Yo8j~10*Xt0Ua 2^Ma%WW/
@pxh8ápihxѮB& =wwn-`r5YJǖ0V\)P>YD@k}Z@XxXY
l]l;ul3e4ұp!bPdmgQO c:(); WA }(HWY\URP7Y,]` ߬(' u LdT˿s f) &)0( T}sLU4!V;K js Q:7ػ^{VJ {Ϸ_a*Ǫ j .,TGy6
#v1f1i Dx4
^ /
@9l0٫\>Vo/]`Y `K,vL{|<< 3Xߔ-ҮsS ݂۹]=Rn֟ 6>0 Mf{U*o0q%U dP" PX" ]`C@f˫v: SE|Bd ZӪȰg7UABTM/V k* )h .V{3(lkl{IB%bj5pPAc*Lt5K|w
5Paļ~@mP @IK^[]REnWe@փ @pxh8O ZòH ͖m2لNT]my A9wnI :Jm^NzuRtT}v/Ri&~Su " {=\2= ٿˬ#տɨl:yGA>7Cb ȚfJ_} t2ר/-_d3[FEWA" IӊRןm9|%\OC%lP=2kdz#[/\# /Wn2om+Lє Uy?>#E *3͔8>K>ap06D9@ 4 Ag6cl
/
@ñ`"]iK{ s
D0 7ӕSzb!䬴[,'XI(cOmlm k#K#m~Pa&. )bmuLI fnQ! Lü #鷭mcȱDuBV VD`2GPkpAWNTPU(iJ ş6 ȗ e\ Նg=Nj6g
t ޟ?[d>^Kߤ,An"hf
h6T x Xֵ$C
a"D0jHMoTBfx^""#rl,ip7u, XFcDJM$"Ĺ }江Wo*B5V-U= - ³
E+x `Z%y=s=a 3 ksN4lTBƸhf!NjHa?6B|^,/0rDF[5 !m`
'$J~1ofDx;k 6(jPx)_4?Ko q&[T:E9/J0D `RWg^V
$Y|&yeᯈ9BR* ׄ/j&RE
21{ a `7<* @px](Al=\ntÄҢ>)زoӄҿ tZtG@ KtTn FKYfM~-L+K @a,*,OY` NKrw&}9$ߋFݑ[ @{z& f ͿӢ 49 q6ahx1ie^ bdM+@;z7m0:Oa<n-U8/U`^v%p wGJlyTAasS>ge?L^D_i\Sx u5 _<tO0 PA @p4O "qGA餦 vGbQ
przEss]
6&K _)ČZ/y !wr'!x!}E~7C~?Cn 1]C'I_2 ,J͞D\\Ig, 1*Q ǹx] ~) LOk <"mkvsxb*
Pa BF+ߐQ!Fj4LqbSqfX ֘e
A5YkOد2 ?զ)[lSPҟ0K(J HAt&sUmo
T&@oaqABf9bI7ge/ P *
uN0.p_{Hs|e:@- 2Qi.&W
$`8t f& mSz
sߪ{t+ٸ9 u _~qC~LWy\$;W)W]q0 `9!ٱb x=/p&z,jMZq-ѩ c
O lsa=/NfxHrW XG5y
9,=yDn g6-6yi(De3^o*DgrX}?'xN&b@iE < !i&[Ny`nen3Tgms[Il_D/IoYS4@os Ѷ
_f `?Xqy.sYVm,G
g3TG$ɨ(<#5ЌT?ljڦ1_PO
^Ԥ !Nzڱ^!4 tS/4=Ke͍3,rg
'U߫J Faq{i1
0
w ڸG <:Fx~?@m
@v @]]<ҟPj74" } u67s~WF$
Z.h~oxl⛈ tIDATx{leG}?g l^CKd*M &6JRm붔MފRUd'Ѻ5@TʣB$EF"nDaWiSRI6Dyq^3s|s̙o~3g~3 >Go. 4 ^ dL21L$ `l[ ~&+&щ@G`Vag'alNXb0t( P5RH&<ą-`r2 2)Kz,$[RpR
su8r ]aj#zTMS$\Oό3!ZPYo)D N#Yʦ2: )P}_US2L]a?szՙ/lljٛ<2ݎ:+g/
@pxh8z|aQf=ۊ 1f¸ ;{ã)!) fB=&5]ӶߖfO}Ϭ(0oY03(Kdl1U+թLMz {D@ >]D-om u ]ZV,ˌMmyhUzfi=@]S؊tTo6g%SB _qw)DPpxh8 4 ^ /
_G8Ĺ{Ja bR(xh i@IzJҼy
tsY@e eC뱅rjm܍C&[LM%m{ e^3JM3@ӰX7mkA ".v2MuZfPy
-!LUis_hxvv+3
@pxh8 4 Y`>HԀEZn5{Dn{DY l]ysx-[LqmЭq
`_XA*fLOtL17:0k SYB>
/SA ]CgݳX:p:L*YQN T\}="dLM 5-l} 0( T T|sLE4!;K~pm
{˷ aʜǢ. Jm.718(I : sdbSҞ^:S)!" @pxh8 4gW@~=
&{K'jڻ ,#Vvh=L*}yLʼ=Ƌc6m^P?,LD1DV2S$_`U3 UfaQvFX"&!k֘D`:G㊐(qAOVPU
j(iJ lWqK li3 x T!sXD@s 9+y8u\mY"r7v֗u- v!H
4 <@ (B$"PdVZƜ w ߠs0 kB5h$]dp Ϫ_@0+4@"hOtck Qi c% }TC 5|jfJda?L sf9[2Vq7; y6mNi
b-"?[ fXhE !MLqRTDW*ZIhD$w{mÊ:
~fE㳔&GESdJ4ye ]U/Vx06ȃ"XW Nj OFS
gc>$ C^xT @)>U., -z)E}Zeg ttG@sKtTk$ZKyO~-Lk+@=2GXVX`3"SMlri ߍR{wn''8SjoOI ; tXa.0N7N. (O< ;vɤVyY5(aU_}h?Gx8XgMOz!V.qįi| LHL_F y Uғ_ J`B]L"tYeM܈d:uJZĵjmlC &8sךt﹅m6T469K)
%HZߒ:.՚nz
w >
c^68#ͦ1mX֡C ][5 : a2S-II\q#` pPe^b|~.?=-5OK?09Lx%8qI T
d=\&' =n)X[8SDf<|'O!) 63Uag}osk;'Z9Z ]HQ33 uBn6BMf E-l2=)Hx
V `Vj,&Jr0YeT]GxL뼪 ])is9NG^WiH6Ͻ
`7"Hʬ)\ 1Rsv6Xe=Nc `
Td=az8M?UU^Wҟ<0WKH HAth֪q*SdI&FB8YbI7g=^D=;@qA,U`b]=oO˷1 J1 VR; @x2Ht!6ɽ\8\' S367tkl
SPVأ~\N-(; mjk sOfj c A=@9C'*B| eXBdR
j
oMs!F=z o*ikkf 7빞끛Y^#i[.. e""ҿ~A~/#]@ R* X śsTG$ɨ(<#5ЌT?͉ym<[=(xZ}W#N
awpQM L`KqSFMRdSijg|۹I͡
Z}+c^ԄhE^UxG4c *IO&'5) 1?sHf5[CP 2c+ j]3eYg t,@+g-OJ`eLa1CYZn]3*~:g("褿[12n2kYL_|.My/y/
({F$i=|KA ,%}[қdFYg1 iFUOQD>go]\zWbT=) .xY" IUf8˂ Z
,CHX|iz6)X0Ovث;J FalpF}b@`fQ={Ɂi < 5Pŏ._px[@pxh82P~;GM tM-v @]ܠ.߰ > K9 4}6. /n:&"O'"'G> P%RWV~1KtMt1jDUlP%U
|^ӿ]C `
_i/{җVQ dz16zfudO?P {f_?Azf_? o#j3URm Uqmfh7sIb_.` 8G.篘B5nJM47sIb 4@4FXb)&PqFHGI >.Ql/LVb% ) .(?Vr
飸UUzX!e|Ul_6~yUY: )5WJ / ?GpG~/_17lz
D Xǭpu}^ kسAo Bo
l8 4 ^ /
@!O MG۶2t]ȡcݶ5z-o;3`c6FzAmǸm ` cH dIDATx] c۶H阒]Kd%٫뺮lmw]|pXm-}X:+iĆQV 9\e'AtOS:72YsxMہB&z>nC@r@* aӝ% MFDDDDDDTߖH,ERUn
ب\f:}4ᦋ{)n[
̰E
K Y Dۇ- +Kl=ӃL`љ|%n a N#5 (4?EDDDD\oWFfq;\E_,W!%zE!F¶. (USHQ0dw)T 8#p,xBK *xXEe
K솎%mKX~sFE~tdc aI1Af4dHcGSB`0wev`"{ .GDDDD,dO6k"qkMefS_UKŌ&g~>n H}) LF%8()r![4统qQk0m[Le_70@>1 X0AZVcEV Ltk3E J44ZﮊN`rt>`˥
AHBLH@c Uq= jcM2s JCLiR NQ0= Yi-|4V ]]B^ޞ_H$<$
a=d@ (ZAp_}~s:N {DC>m^S&, ;N&B} <_AB]H uN(B 0{h1IK Ds j' M8.ӫ1h3df}mq nU{ Lo z \=?@ ((e |=ơ麄Ci 1r<|OO;
`HpQyzԈuZVƲ!)5m C2Lyg;֑RjWa@@VL&Wru=Z
̥=U5} 7;b(nP&sk48ͥ01U Wvk18dqTՌE]qH8 GF K 'rOrŗ 6"fp T^3c" n Mم-/W=tJ,X){ P
Rm|K>mX8v 5h<_{ꘀYF|&_G;&>^W⁃&K(81EB@F&;"L'wfwE- 6o&/̫'Xe,>~ee| A=) dQ`}P[KN˂/~)O[dO=3El5'Y$?7m Tzզ.\.` WE """""v)V #]L;zqJr²[\-tҽ5
@ͷϟnT@+; cQhC*TڙAVr?f ?
Q1T`} Hk,{VZˋTϛ?I̯uQKLMe͆~qym09 S;j5 i Q]7k0Uޭ GkX 3#lY_Цxj9`#
M [z KuO_z˿Dܭ*kOJ(7n\e
I Tƨl /U߶uw.~;#r.8
o# 5Lh>1i pVM ?/u70 X@L+M+{Fkt{ŧ890`. ĀCR+\/t R;
TӲ]aL|efđ >ۣG|P`P8C1K՛A̍<2ۂKrl@L
L 8@E>`n PNԍ,p EƆ ZF lÎ; F7Ȯ;
swSz)g7{rsSgȋ(߄~AWytX$NVR_<6p.O8O[OdDk>_ OO}JSdmV?W(_m j~=H IԁF>T/{*] IGJ@iqamNF|Q50+ ES8:v`p~vj:Bp96oys%
|@H]+@t]Wk}}7FʮrAB\m-_2PY8xՎN.h~@+7z5t_//?0S>)zi0n/B`{DW#`Bo[,gFVЁpP߾C]Bz ,XXfԃ A:H k7dZ9oc}o]0vd:R]0ve]刈jу|
? +(OǍ+ #ysߍ npFru<.HȺotM3h}߆P}˗vP}mǀ?WZ@}@@FD l %tEXtdate:create 2015-03-11T14:59:12+00:000i %tEXtdate:modify 2015-03-11T14:59:12+00:00A tEXtSoftware Adobe ImageReadyqe< IENDB`PK ! login-security/img/header.svgnu [
PK ! %0 5 login-security/views/onboarding/standalone-header.phpnu [
full Wordfence plugin includes all of the features in this plugin as well as a full-featured WordPress firewall, a security scanner, live traffic, and more. The standard installation includes a robust set of free features that can be upgraded via a Premium license key.', 'wordfence'), 'https://wordpress.org/plugins/wordfence/'); ?>
PK ! f 1 login-security/views/user/grace-period-toggle.phpnu [
PK ! (G| | 3 login-security/views/common/revoke-grace-period.phpnu [
PK ! v
, login-security/views/common/modal-prompt.phpnu [ , 'label' => from the time it was sent. If you did not attempt this login, please change your password immediately.', 'wordfence'), array('b'=>array())); ?>
Verify and Log In', 'wordfence'), esc_url($verificationURL)), array('a' => array('href' => array()), 'strong' => array())); ?>PK ! " login-security/views/page/page.phpnu [ Model_Tab instance, 'title' => Title instance, 'content' => HTML content). Required.
*/
?>
can_manage_settings() && !\WordfenceLS\Controller_Settings::shared()->get_bool(\WordfenceLS\Controller_Settings::OPTION_DISMISSED_FRESH_INSTALL_MODAL) && !WORDFENCE_LS_FROM_CORE) {
echo \WordfenceLS\Model_View::create('onboarding/standalone-header')->render();
}
?>
$tabs,
))->render();
?>
$s['title'],
))->render();
echo $s['content'];
?>
PK ! { t8 8 $ login-security/views/page/manage.phpnu [ ID == $user->ID) {
$ownAccount = true;
}
$enabled = \WordfenceLS\Controller_Users::shared()->has_2fa_active($user);
$requires2fa = \WordfenceLS\Controller_Users::shared()->requires_2fa($user, $inGracePeriod, $requiredAt);
$lockedOut = $requires2fa && !$enabled;
?>
click here.', 'wordfence'), \WordfenceLS\Controller_Support::esc_supportURL(\WordfenceLS\Controller_Support::ITEM_MODULE_LOGIN_SECURITY_2FA)), array('a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()))); ?>
%s', 'wordfence'), get_avatar($user->ID, 16, '', $user->user_login), \WordfenceLS\Text\Model_HTML::esc_html($user->user_login) . ($ownAccount ? ' ' . __('(you)', 'wordfence') : '')), array('span'=>array('class'=>array()))); ?>
= 0 ? '+' . $offset : $offset);
}
?>
can_manage_settings()): ?>
UTC ()
is_ntp_enabled()) {
echo esc_html__('Corrected Time (NTP):', 'wordfence') . ' ' . date('Y-m-d H:i:s', $correctedTime) . ' UTC (' . \WordfenceLS\Controller_Time::format_local_time('Y-m-d H:i:s', $correctedTime) . ' ' . $tz . ')
';
}
else if (WORDFENCE_LS_FROM_CORE && $correctedTime != $time) {
echo esc_html__('Corrected Time (WF):', 'wordfence') . ' ' . date('Y-m-d H:i:s', $correctedTime) . ' UTC (' . \WordfenceLS\Controller_Time::format_local_time('Y-m-d H:i:s', $correctedTime) . ' ' . $tz . ')
';
}
?>
ip()); if (\WordfenceLS\Controller_Whitelist::shared()->is_whitelisted(\WordfenceLS\Model_Request::current()->ip())) { echo ' (' . esc_html__('allowlisted', 'wordfence') . ')'; } ?>
PK ! md / login-security/views/page/permission-denied.phpnu [
PK ! Y & login-security/views/page/settings.phpnu [
\WordfenceLS\Controller_Users::shared()->get_detailed_user_counts_if_enabled(),
))->render();
?>
$hasWoocommerce
))->render();
?>
PK ! 0A A - login-security/views/page/manage-embedded.phpnu [ has_2fa_active($user);
$requires2fa = \WordfenceLS\Controller_Users::shared()->requires_2fa($user, $inGracePeriod, $requiredAt);
$lockedOut = $requires2fa && !$enabled;
$containerClasses = 'wfls-flex-row ' . ($stacked ? 'wfls-flex-row-wrapped' : 'wfls-flex-row-wrappable wfls-flex-row-equal-heights');
$columnClasses = 'wfls-flex-row wfls-flex-item-xs-100 ' . ($stacked ? '' : 'wfls-flex-row-equal-heights');
?>
renderInlineIfNotEnqueued(); ?>
class="stacked" >
click here.', 'wordfence'), \WordfenceLS\Controller_Support::esc_supportURL(\WordfenceLS\Controller_Support::ITEM_MODULE_LOGIN_SECURITY_2FA)), array('a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()))); ?>
PK ! Z _# # + login-security/views/page/section-title.phpnu [
title); ?>
helpURL !== null && $title->helpLink !== null): ?>
helpLink); ?>
PK ! E $ login-security/views/page/tabbar.phpnu [
a;
if (!preg_match('/^https?:\/\//i', $a)) {
$a = '#top#' . urlencode($a);
}
?>
- tabTitle); ?>
PK ! _l " login-security/views/page/role.phpnu [
()
PK ! 퓶 ( login-security/views/manage/activate.phpnu [ get_user();
$recovery = $initializationData->get_recovery_codes();
?>
user_login) . "\r\n";
$recoveryCodeFileContents .= "\r\n" . sprintf(__('Each line of %d letters and numbers is a single recovery code, with optional spaces for readability. To use a recovery code, after entering your username and password, enter the code like "1234 5678 90AB CDEF" at the 2FA prompt. If your site has a custom login prompt and does not show a 2FA prompt, you can use the single-step method by entering your password and the code together in the Password field, like "mypassword1234 5678 90AB CDEF". Your recovery codes are:', 'wordfence'), \WordfenceLS\Model_Crypto::strlen($recovery[0]) * 2) . "\r\n\r\n";
foreach ($recovery as $c) {
$hex = bin2hex($c);
$blocks = str_split($hex, 4);
echo '- ' . implode(' ', $blocks) . '
';
$recoveryCodeFileContents .= implode(' ', $blocks) . "\r\n";
}
?>
PK ! ZU * login-security/views/manage/regenerate.phpnu [
PK ! >T߷ , login-security/views/manage/grace-period.phpnu [ ID == $user->ID) {
$ownAccount = true;
}
$defaultGracePeriod = \WordfenceLS\Controller_Settings::shared()->get_user_2fa_grace_period();
$hasGracePeriod = $defaultGracePeriod > 0;
?>
%s', 'wordfence'), array('strong'=>array())), $requiredDateFormatted) :
sprintf(wp_kses(__('Two-factor authentication will be required for user %s beginning %s.', 'wordfence'), array('strong'=>array())), esc_html($user->user_login), $requiredDateFormatted)
?>
has_revokable_grace_period($user)): ?>
$user
))->render() ?>
$user,
'gracePeriod' => $gracePeriod,
'defaultGracePeriod' => $defaultGracePeriod
))->render() ?>
PK ! yJM5 5 * login-security/views/manage/deactivate.phpnu [ ID == $user->ID) {
$ownAccount = true;
}
?>
PK ! eiӈ $ login-security/views/manage/code.phpnu [
PK ! i
i
8 login-security/views/options/option-toggled-multiple.phpnu [ string