Edit File by line

$retries[$ip]--;

[3000] Fix | Delete

}

[3001] Fix | Delete

else {

[3002] Fix | Delete

$retries[$ip] = 0;

[3003] Fix | Delete

}

[3004] Fix | Delete

update_option('limit_login_retries', $retries);

[3005] Fix | Delete

}

[3006] Fix | Delete

[3007] Fix | Delete

$allowSeparatePrompt = ini_get('output_buffering') > 0;

[3008] Fix | Delete

if (wfConfig::get('loginSec_enableSeparateTwoFactor') && $allowSeparatePrompt) {

[3009] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3010] Fix | Delete

self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Enter it below to sign in.', 'wordfence'), array('strong'=>array())) . '');

[3011] Fix | Delete

return self::$authError;

[3012] Fix | Delete

}

[3013] Fix | Delete

else {

[3014] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3015] Fix | Delete

self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Please sign in again and add a space, the letters <code>wf</code>, and the code to the end of your password (e.g., <code>wf123456</code>).', 'wordfence'), array('strong'=>array(), 'code'=>array())));

[3016] Fix | Delete

return self::$authError;

[3017] Fix | Delete

}

[3018] Fix | Delete

}

[3019] Fix | Delete

else { //oops, our API returned an error.

[3020] Fix | Delete

$requireAdminTwoFactor = false;

[3021] Fix | Delete

//Let them sign in without two factor because the API is broken and we don't want to lock users out of their own systems.

[3022] Fix | Delete

}

[3023] Fix | Delete

}

[3024] Fix | Delete

}

[3025] Fix | Delete

catch (Exception $e) {

[3026] Fix | Delete

if (self::isDebugOn()) {

[3027] Fix | Delete

error_log('TOTP SMS error: ' . $e->getMessage());

[3028] Fix | Delete

}

[3029] Fix | Delete

$requireAdminTwoFactor = false;

[3030] Fix | Delete

// Couldn't connect to noc1, let them sign in since the password was correct.

[3031] Fix | Delete

}

[3032] Fix | Delete

}

[3033] Fix | Delete

}

[3034] Fix | Delete

else { //Old method phone authentication

[3035] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[3036] Fix | Delete

try {

[3037] Fix | Delete

$codeResult = $api->call('twoFactor_verification', array(), array('phone' => $twoFactorRecord[1]));

[3038] Fix | Delete

if (isset($codeResult['notPaid']) && $codeResult['notPaid']) {

[3039] Fix | Delete

$requireAdminTwoFactor = false;

[3040] Fix | Delete

//Let them sign in without two factor if their API key has expired or they're not paid and for some reason they have this set up.

[3041] Fix | Delete

}

[3042] Fix | Delete

else {

[3043] Fix | Delete

if (isset($codeResult['ok']) && $codeResult['ok']) {

[3044] Fix | Delete

$twoFactorRecord[2] = $codeResult['code'];

[3045] Fix | Delete

$twoFactorRecord[4] = time() + 1800; //30 minutes until code expires

[3046] Fix | Delete

wfConfig::set_ser('twoFactorUsers', $twoFactorUsers); //save the code the user needs to enter and return an error.

[3047] Fix | Delete

[3048] Fix | Delete

if (self::hasGDLimitLoginsMUPlugin() && function_exists('limit_login_get_address')) {

[3049] Fix | Delete

$retries = get_option('limit_login_retries', array());

[3050] Fix | Delete

$ip = limit_login_get_address();

[3051] Fix | Delete

[3052] Fix | Delete

if (!is_array($retries)) {

[3053] Fix | Delete

$retries = array();

[3054] Fix | Delete

}

[3055] Fix | Delete

if (isset($retries[$ip]) && is_int($retries[$ip])) {

[3056] Fix | Delete

$retries[$ip]--;

[3057] Fix | Delete

}

[3058] Fix | Delete

else {

[3059] Fix | Delete

$retries[$ip] = 0;

[3060] Fix | Delete

}

[3061] Fix | Delete

update_option('limit_login_retries', $retries);

[3062] Fix | Delete

}

[3063] Fix | Delete

[3064] Fix | Delete

$allowSeparatePrompt = ini_get('output_buffering') > 0;

[3065] Fix | Delete

if (wfConfig::get('loginSec_enableSeparateTwoFactor') && $allowSeparatePrompt) {

[3066] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3067] Fix | Delete

[3068] Fix | Delete

return self::$authError;

[3069] Fix | Delete

}

[3070] Fix | Delete

else {

[3071] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3072] Fix | Delete

self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Please sign in again and add a space and the code to the end of your password (e.g., <code>wfABCD</code>).', 'wordfence'), array('strong'=>array(), 'code'=>array())));

[3073] Fix | Delete

return self::$authError;

[3074] Fix | Delete

}

[3075] Fix | Delete

}

[3076] Fix | Delete

else { //oops, our API returned an error.

[3077] Fix | Delete

$requireAdminTwoFactor = false;

[3078] Fix | Delete

//Let them sign in without two factor because the API is broken and we don't want to lock users out of their own systems.

[3079] Fix | Delete

}

[3080] Fix | Delete

}

[3081] Fix | Delete

}

[3082] Fix | Delete

catch (Exception $e) {

[3083] Fix | Delete

$requireAdminTwoFactor = false;

[3084] Fix | Delete

// Couldn't connect to noc1, let them sign in since the password was correct.

[3085] Fix | Delete

}

[3086] Fix | Delete

} //end: Old method phone authentication

[3087] Fix | Delete

}

[3088] Fix | Delete

}

[3089] Fix | Delete

}

[3090] Fix | Delete

else if ($usingBreachedPassword) {

[3091] Fix | Delete

if (wfCredentialsController::hasPreviousLoginFromIP($authUser, wfUtils::getIP())) {

[3092] Fix | Delete

wfAdminNoticeQueue::removeAdminNotice(false, '2faBreachPassword', array($authUser->ID));

[3093] Fix | Delete

wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, sprintf(__('WARNING: Your login has been allowed because you have previously logged in from the same IP, but you will be blocked if your IP changes. The password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please <a href="%1$s">change your password</a>. <a href="%2$s" target="_blank" rel="noopener noreferrer">Learn More (' . esc_html__('opens in new tab', 'wordfence') . ')</a>', 'wordfence'), self_admin_url('profile.php'), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)), 'previousIPBreachPassword', array($authUser->ID));

[3094] Fix | Delete

}

[3095] Fix | Delete

else {

[3096] Fix | Delete

$username = $authUser->user_login;

[3097] Fix | Delete

self::getLog()->logLogin('loginFailValidUsername', 1, $username);

[3098] Fix | Delete

$alertCallback = array(new wfBreachLoginAlert($username, wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD), wfUtils::getIP()), 'send');

[3099] Fix | Delete

[3100] Fix | Delete

do_action('wordfence_security_event', 'breachLogin', array(

[3101] Fix | Delete

'username' => $username,

[3102] Fix | Delete

'resetPasswordURL' => wp_lostpassword_url(),

[3103] Fix | Delete

'supportURL' => wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD),

[3104] Fix | Delete

'ip' => wfUtils::getIP(),

[3105] Fix | Delete

), $alertCallback);

[3106] Fix | Delete

[3107] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3108] Fix | Delete

self::$authError = new WP_Error('breached_password', sprintf(

[3109] Fix | Delete

/* translators: 1. Reset password URL. 2. Support URL. */

[3110] Fix | Delete

wp_kses(__('INSECURE PASSWORD: Your login attempt has been blocked because the password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please <a href="%1$s">reset your password</a> to reactivate your account. <a href="%2$s" target="_blank" rel="noopener noreferrer">Learn More (opens in new tab)</a>', 'wordfence'), array('strong'=>array(), 'a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()), 'span'=>array('style'=>array()))), wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)));

[3111] Fix | Delete

return self::$authError;

[3112] Fix | Delete

}

[3113] Fix | Delete

}

[3114] Fix | Delete

[3115] Fix | Delete

if ($requireAdminTwoFactor && wfUtils::isAdmin($authUser)) {

[3116] Fix | Delete

$username = $authUser->user_login;

[3117] Fix | Delete

self::getLog()->logLogin('loginFailValidUsername', 1, $username);

[3118] Fix | Delete

wordfence::alert(__("Admin Login Blocked", 'wordfence'), sprintf(/* translators: WordPress username. */__("A user with username \"%s\" who has administrator access tried to sign in to your WordPress site. Access was denied because all administrator accounts are required to have Cellphone Sign-in enabled but this account does not.", 'wordfence'), $username), wfUtils::getIP());

[3119] Fix | Delete

self::$authError = new WP_Error('twofactor_disabled_required', wp_kses(__('Cellphone Sign-in Required: Cellphone Sign-in is required for all administrator accounts. Please contact the site administrator to enable it for your account.', 'wordfence'), array('strong'=>array())));

[3120] Fix | Delete

return self::$authError;

[3121] Fix | Delete

}

[3122] Fix | Delete

[3123] Fix | Delete

//User is not configured for two factor. Sign in without two factor.

[3124] Fix | Delete

}

[3125] Fix | Delete

} //End: if ($checkTwoFactor)

[3126] Fix | Delete

else if ($usingBreachedPassword) {

[3127] Fix | Delete

if (wfCredentialsController::hasPreviousLoginFromIP($authUser, wfUtils::getIP())) {

[3128] Fix | Delete

wfAdminNoticeQueue::removeAdminNotice(false, '2faBreachPassword', array($authUser->ID));

[3129] Fix | Delete

wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, sprintf(/* translators: 1. Reset password URL. 2. Support URL. */ __('WARNING: Your login has been allowed because you have previously logged in from the same IP, but you will be blocked if your IP changes. The password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please <a href="%1$s">change your password</a>. <a href="%2$s" target="_blank" rel="noopener noreferrer">Learn More (' . esc_html__('opens in new tab', 'wordfence') . ')</a>', 'wordfence'), self_admin_url('profile.php'), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)), 'previousIPBreachPassword', array($authUser->ID));

[3130] Fix | Delete

}

[3131] Fix | Delete

else {

[3132] Fix | Delete

$username = $authUser->user_login;

[3133] Fix | Delete

self::getLog()->logLogin('loginFailValidUsername', 1, $username);

[3134] Fix | Delete

$alertCallback = array(new wfBreachLoginAlert($username, wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD), wfUtils::getIP()), 'send');

[3135] Fix | Delete

[3136] Fix | Delete

do_action('wordfence_security_event', 'breachLogin', array(

[3137] Fix | Delete

'username' => $username,

[3138] Fix | Delete

'resetPasswordURL' => wp_lostpassword_url(),

[3139] Fix | Delete

'supportURL' => wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD),

[3140] Fix | Delete

'ip' => wfUtils::getIP(),

[3141] Fix | Delete

), $alertCallback);

[3142] Fix | Delete

[3143] Fix | Delete

remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages

[3144] Fix | Delete

self::$authError = new WP_Error('breached_password', sprintf(

[3145] Fix | Delete

/* translators: 1. Reset password URL. 2. Support URL. */

[3146] Fix | Delete

[3147] Fix | Delete

return self::$authError;

[3148] Fix | Delete

}

[3149] Fix | Delete

}

[3150] Fix | Delete

[3151] Fix | Delete

return self::processBruteForceAttempt($authUser, $username, $passwd);

[3152] Fix | Delete

}

[3153] Fix | Delete

[3154] Fix | Delete

public static function checkSecurityNetwork($endpointType = null) {

[3155] Fix | Delete

if (wfConfig::get('other_WFNet')) {

[3156] Fix | Delete

$IP = wfUtils::getIP();

[3157] Fix | Delete

if ($maxBlockTime = self::wfsnIsBlocked($IP, 'brute', $endpointType)) {

[3158] Fix | Delete

$secsToGo = ($maxBlockTime ? $maxBlockTime : wfBlock::blockDuration());

[3159] Fix | Delete

$reason = __('Blocked by Wordfence Security Network', 'wordfence');

[3160] Fix | Delete

wfBlock::createWFSN($reason, $IP, $secsToGo, time(), time(), 1);

[3161] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'brute');

[3162] Fix | Delete

self::getLog()->tagRequestForBlock($reason, true);

[3163] Fix | Delete

self::getLog()->getCurrentRequest()->action = 'blocked:wfsn';

[3164] Fix | Delete

self::getLog()->do503($secsToGo, $reason); //exits

[3165] Fix | Delete

}

[3166] Fix | Delete

}

[3167] Fix | Delete

}

[3168] Fix | Delete

[3169] Fix | Delete

public static function processBruteForceAttempt($authUser, $username, $passwd) {

[3170] Fix | Delete

$IP = wfUtils::getIP();

[3171] Fix | Delete

$secEnabled = wfConfig::get('loginSecurityEnabled');

[3172] Fix | Delete

[3173] Fix | Delete

if (wfBlock::isWhitelisted($IP)) {

[3174] Fix | Delete

return $authUser;

[3175] Fix | Delete

}

[3176] Fix | Delete

[3177] Fix | Delete

$failureErrorCodes = array('invalid_username', 'invalid_email', 'incorrect_password', 'twofactor_invalid', 'authentication_failed', 'wfls_twofactor_invalid', 'wfls_twofactor_failed', 'wfls_twofactor_blocked');

[3178] Fix | Delete

if (is_wp_error($authUser) && in_array($authUser->get_error_code(), $failureErrorCodes)) {

[3179] Fix | Delete

self::checkSecurityNetwork(); //May exit

[3180] Fix | Delete

}

[3181] Fix | Delete

[3182] Fix | Delete

if($secEnabled){

[3183] Fix | Delete

if(is_wp_error($authUser) && ($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email')){

[3184] Fix | Delete

if($blacklist = wfConfig::get('loginSec_userBlacklist')){

[3185] Fix | Delete

$users = explode("\n", wfUtils::cleanupOneEntryPerLine($blacklist));

[3186] Fix | Delete

foreach($users as $user){

[3187] Fix | Delete

if(strtolower($username) == strtolower($user)){

[3188] Fix | Delete

$secsToGo = wfBlock::blockDuration();

[3189] Fix | Delete

$reason = __('Blocked by login security setting', 'wordfence');

[3190] Fix | Delete

wfBlock::createIP($reason, $IP, $secsToGo, time(), time(), 1, wfBlock::TYPE_IP_AUTOMATIC_TEMPORARY);

[3191] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'brute');

[3192] Fix | Delete

self::getLog()->tagRequestForBlock($reason);

[3193] Fix | Delete

self::getLog()->do503($secsToGo, $reason); //exits

[3194] Fix | Delete

}

[3195] Fix | Delete

}

[3196] Fix | Delete

}

[3197] Fix | Delete

if(wfConfig::get('loginSec_lockInvalidUsers')){

[3198] Fix | Delete

if(strlen($username) > 0 && preg_match('/[^\r\s\n\t]+/', $username)){

[3199] Fix | Delete

self::lockOutIP($IP, sprintf(/* translators: WordPress username. */ __("Used an invalid username '%s' to try to sign in", 'wordfence'), $username));

[3200] Fix | Delete

self::getLog()->logLogin('loginFailInvalidUsername', true, $username);

[3201] Fix | Delete

}

[3202] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[3203] Fix | Delete

require(dirname(__FILE__) . '/wfLockedOut.php');

[3204] Fix | Delete

}

[3205] Fix | Delete

}

[3206] Fix | Delete

$tKey = self::getLoginFailureCountTransient($IP);

[3207] Fix | Delete

if(is_wp_error($authUser) && in_array($authUser->get_error_code(), $failureErrorCodes)) {

[3208] Fix | Delete

$tries = get_transient($tKey);

[3209] Fix | Delete

if($tries){

[3210] Fix | Delete

$tries++;

[3211] Fix | Delete

} else {

[3212] Fix | Delete

$tries = 1;

[3213] Fix | Delete

}

[3214] Fix | Delete

if($tries >= wfConfig::get('loginSec_maxFailures')){

[3215] Fix | Delete

self::lockOutIP($IP,

[3216] Fix | Delete

sprintf(

[3217] Fix | Delete

/* translators: 1. Login attempt limit. 2. WordPress username. */

[3218] Fix | Delete

__('Exceeded the maximum number of login failures which is: %1$s. The last username they tried to sign in with was: \'%2$s\'', 'wordfence'),

[3219] Fix | Delete

wfConfig::get('loginSec_maxFailures'),

[3220] Fix | Delete

$username

[3221] Fix | Delete

)

[3222] Fix | Delete

);

[3223] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[3224] Fix | Delete

require(dirname(__FILE__) . '/wfLockedOut.php');

[3225] Fix | Delete

}

[3226] Fix | Delete

set_transient($tKey, $tries, wfConfig::get('loginSec_countFailMins') * 60);

[3227] Fix | Delete

}

[3228] Fix | Delete

}

[3229] Fix | Delete

if(is_wp_error($authUser)){

[3230] Fix | Delete

if($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email'){

[3231] Fix | Delete

self::getLog()->logLogin('loginFailInvalidUsername', 1, $username);

[3232] Fix | Delete

} else {

[3233] Fix | Delete

self::getLog()->logLogin('loginFailValidUsername', 1, $username);

[3234] Fix | Delete

}

[3235] Fix | Delete

}

[3236] Fix | Delete

[3237] Fix | Delete

if(is_wp_error($authUser) && ($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email' || $authUser->get_error_code() == 'incorrect_password') && wfConfig::get('loginSec_maskLoginErrors')){

[3238] Fix | Delete

return new WP_Error( 'incorrect_password', sprintf(

[3239] Fix | Delete

/* translators: 1. WordPress username. 2. Reset password URL. */

[3240] Fix | Delete

wp_kses(__( 'ERROR: The username or password you entered is incorrect. <a href="%2$s" title="Password Lost and Found">Lost your password</a>?', 'wordfence' ), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array()))), $username, wp_lostpassword_url() ) );

[3241] Fix | Delete

}

[3242] Fix | Delete

[3243] Fix | Delete

return $authUser;

[3244] Fix | Delete

}

[3245] Fix | Delete

public static function wfsnBatchReportBlockedAttempts() {

[3246] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3247] Fix | Delete

$threshold = wfConfig::get('lastBruteForceDataSendTime', 0);;

[3248] Fix | Delete

[3249] Fix | Delete

$wfdb = new wfDB();

[3250] Fix | Delete

$table_wfHits = wfDB::networkTable('wfHits');

[3251] Fix | Delete

$rawBlocks = $wfdb->querySelect("SELECT IP, ctime, actionData FROM {$table_wfHits} WHERE ctime > %f AND action = 'blocked:wfsnrepeat' ORDER BY ctime ASC LIMIT 100", sprintf('%.6f', $threshold));

[3252] Fix | Delete

$totalRows = $wfdb->querySingle("SELECT COUNT(*) FROM {$table_wfHits} WHERE ctime > %f AND action = 'blocked:wfsnrepeat'", sprintf('%.6f', $threshold));

[3253] Fix | Delete

$ipCounts = array();

[3254] Fix | Delete

$maxctime = 0;

[3255] Fix | Delete

foreach ($rawBlocks as $record) {

[3256] Fix | Delete

$maxctime = max($maxctime, $record['ctime']);

[3257] Fix | Delete

$endpointType = 0;

[3258] Fix | Delete

if (!empty($record['actionData'])) {

[3259] Fix | Delete

$actionData = wfRequestModel::unserializeActionData($record['actionData']);

[3260] Fix | Delete

if (isset($actionData['type'])) {

[3261] Fix | Delete

$endpointType = $actionData['type'];

[3262] Fix | Delete

}

[3263] Fix | Delete

}

[3264] Fix | Delete

if (isset($ipCounts[$record['IP']])) {

[3265] Fix | Delete

$ipCounts[$record['IP']] = array();

[3266] Fix | Delete

}

[3267] Fix | Delete

[3268] Fix | Delete

if (isset($ipCounts[$record['IP']][$endpointType])) {

[3269] Fix | Delete

$ipCounts[$record['IP']][$endpointType]++;

[3270] Fix | Delete

}

[3271] Fix | Delete

else {

[3272] Fix | Delete

$ipCounts[$record['IP']][$endpointType] = 1;

[3273] Fix | Delete

}

[3274] Fix | Delete

}

[3275] Fix | Delete

[3276] Fix | Delete

$toSend = array();

[3277] Fix | Delete

foreach ($ipCounts as $IP => $endpoints) {

[3278] Fix | Delete

foreach ($endpoints as $endpointType => $count) {

[3279] Fix | Delete

$toSend[] = array('IP' => base64_encode($IP), 'count' => $count, 'blocked' => 1, 'type' => $endpointType);

[3280] Fix | Delete

}

[3281] Fix | Delete

}

[3282] Fix | Delete

[3283] Fix | Delete

try {

[3284] Fix | Delete

$response = wp_remote_post(WORDFENCE_HACKATTEMPT_URL_SEC . 'multipleHackAttempts/?k=' . rawurlencode(wfConfig::get('apiKey')) . '&t=brute', array(

[3285] Fix | Delete

'timeout' => 2,

[3286] Fix | Delete

'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),

[3287] Fix | Delete

'body' => 'IPs=' . rawurlencode(json_encode($toSend)),

[3288] Fix | Delete

'headers' => array('Referer' => false),

[3289] Fix | Delete

));

[3290] Fix | Delete

[3291] Fix | Delete

if (!is_wp_error($response)) {

[3292] Fix | Delete

if ($totalRows > 100) {

[3293] Fix | Delete

self::wfsnScheduleBatchReportBlockedAttempts();

[3294] Fix | Delete

}

[3295] Fix | Delete

[3296] Fix | Delete

wfConfig::set('lastBruteForceDataSendTime', $maxctime);

[3297] Fix | Delete

}

[3298] Fix | Delete

else {

[3299] Fix | Delete

self::wfsnScheduleBatchReportBlockedAttempts();

[3300] Fix | Delete

}

[3301] Fix | Delete

}

[3302] Fix | Delete

catch (Exception $err) {

[3303] Fix | Delete

//Do nothing

[3304] Fix | Delete

}

[3305] Fix | Delete

}

[3306] Fix | Delete

private static function wfsnScheduleBatchReportBlockedAttempts($timeToSend = null) {

[3307] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3308] Fix | Delete

if ($timeToSend === null) {

[3309] Fix | Delete

$timeToSend = time() + 30;

[3310] Fix | Delete

}

[3311] Fix | Delete

$notMainSite = is_multisite() && !is_main_site();

[3312] Fix | Delete

if ($notMainSite) {

[3313] Fix | Delete

global $current_site;

[3314] Fix | Delete

switch_to_blog($current_site->blog_id);

[3315] Fix | Delete

}

[3316] Fix | Delete

if (!wp_next_scheduled('wordfence_batchReportBlockedAttempts')) {

[3317] Fix | Delete

wp_schedule_single_event($timeToSend, 'wordfence_batchReportBlockedAttempts');

[3318] Fix | Delete

}

[3319] Fix | Delete

if ($notMainSite) {

[3320] Fix | Delete

restore_current_blog();

[3321] Fix | Delete

}

[3322] Fix | Delete

}

[3323] Fix | Delete

public static function wfsnReportBlockedAttempt($IP, $type){

[3324] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3325] Fix | Delete

self::wfsnScheduleBatchReportBlockedAttempts();

[3326] Fix | Delete

$endpointType = self::wfsnEndpointType();

[3327] Fix | Delete

self::getLog()->getCurrentRequest()->actionData = wfRequestModel::serializeActionData(array('type' => $endpointType));

[3328] Fix | Delete

}

[3329] Fix | Delete

public static function wfsnBatchReportFailedAttempts() {

[3330] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3331] Fix | Delete

$threshold = time();

[3332] Fix | Delete

[3333] Fix | Delete

$wfdb = new wfDB();

[3334] Fix | Delete

$table_wfSNIPCache = wfDB::networkTable('wfSNIPCache');

[3335] Fix | Delete

$rawRecords = $wfdb->querySelect("SELECT id, IP, type, count, 1 AS failed FROM {$table_wfSNIPCache} WHERE count > 0 AND expiration < FROM_UNIXTIME(%d) LIMIT 100", $threshold);

[3336] Fix | Delete

$toSend = array();

[3337] Fix | Delete

$toDelete = array();

[3338] Fix | Delete

if (count($rawRecords)) {

[3339] Fix | Delete

foreach ($rawRecords as $record) {

[3340] Fix | Delete

$toDelete[] = $record['id'];

[3341] Fix | Delete

unset($record['id']);

[3342] Fix | Delete

$record['IP'] = base64_encode(filter_var($record['IP'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? wfUtils::inet_aton($record['IP']) : wfUtils::inet_pton($record['IP']));

[3343] Fix | Delete

[3344] Fix | Delete

$key = $record['IP'] . $record['type']; //Aggregate multiple records if for some reason there are multiple for an IP/type combination

[3345] Fix | Delete

if (!isset($toSend[$key])) {

[3346] Fix | Delete

$toSend[$key] = $record;

[3347] Fix | Delete

}

[3348] Fix | Delete

else {

[3349] Fix | Delete

$toSend[$key]['count'] += $record['count'];

[3350] Fix | Delete

}

[3351] Fix | Delete

}

[3352] Fix | Delete

[3353] Fix | Delete

$toSend = array_values($toSend);

[3354] Fix | Delete

[3355] Fix | Delete

try {

[3356] Fix | Delete

$response = wp_remote_post(WORDFENCE_HACKATTEMPT_URL_SEC . 'multipleHackAttempts/?k=' . rawurlencode(wfConfig::get('apiKey')) . '&t=brute', array(

[3357] Fix | Delete

'timeout' => 2,

[3358] Fix | Delete

'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),

[3359] Fix | Delete

'body' => 'IPs=' . rawurlencode(json_encode($toSend)),

[3360] Fix | Delete

'headers' => array('Referer' => false),

[3361] Fix | Delete

));

[3362] Fix | Delete

[3363] Fix | Delete

if (is_wp_error($response)) {

[3364] Fix | Delete

self::wfsnScheduleBatchReportFailedAttempts();

[3365] Fix | Delete

return;

[3366] Fix | Delete

}

[3367] Fix | Delete

}

[3368] Fix | Delete

catch (Exception $err) {

[3369] Fix | Delete

//Do nothing

[3370] Fix | Delete

}

[3371] Fix | Delete

}

[3372] Fix | Delete

array_unshift($toDelete, $threshold);

[3373] Fix | Delete

$wfdb->queryWriteIgnoreError("DELETE FROM {$table_wfSNIPCache} WHERE (expiration < FROM_UNIXTIME(%d) AND count = 0)" . (count($toDelete) > 1 ? " OR id IN (" . rtrim(str_repeat('%d, ', count($toDelete) - 1), ', ') . ")" : ""), $toDelete);

[3374] Fix | Delete

[3375] Fix | Delete

$remainingRows = $wfdb->querySingle("SELECT COUNT(*) FROM {$table_wfSNIPCache}");

[3376] Fix | Delete

if ($remainingRows > 0) {

[3377] Fix | Delete

self::wfsnScheduleBatchReportFailedAttempts();

[3378] Fix | Delete

}

[3379] Fix | Delete

}

[3380] Fix | Delete

private static function wfsnScheduleBatchReportFailedAttempts($timeToSend = null) {

[3381] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3382] Fix | Delete

if ($timeToSend === null) {

[3383] Fix | Delete

$timeToSend = time() + 30;

[3384] Fix | Delete

}

[3385] Fix | Delete

$notMainSite = is_multisite() && !is_main_site();

[3386] Fix | Delete

if ($notMainSite) {

[3387] Fix | Delete

global $current_site;

[3388] Fix | Delete

switch_to_blog($current_site->blog_id);

[3389] Fix | Delete

}

[3390] Fix | Delete

if (!wp_next_scheduled('wordfence_batchReportFailedAttempts')) {

[3391] Fix | Delete

wp_schedule_single_event($timeToSend, 'wordfence_batchReportFailedAttempts');

[3392] Fix | Delete

}

[3393] Fix | Delete

if ($notMainSite) {

[3394] Fix | Delete

restore_current_blog();

[3395] Fix | Delete

}

[3396] Fix | Delete

}

[3397] Fix | Delete

public static function wfsnIsBlocked($IP, $hitType, $endpointType = null) {

[3398] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[3399] Fix | Delete

$wfdb = new wfDB();

[3400] Fix | Delete

if ($endpointType === null) { $endpointType = self::wfsnEndpointType(); }

[3401] Fix | Delete

$table_wfSNIPCache = wfDB::networkTable('wfSNIPCache');

[3402] Fix | Delete

$cachedRecord = $wfdb->querySingleRec("SELECT id, body FROM {$table_wfSNIPCache} WHERE IP = '%s' AND type = %d AND expiration > NOW()", $IP, $endpointType);

[3403] Fix | Delete

if (isset($cachedRecord)) {

[3404] Fix | Delete

$wfdb->queryWriteIgnoreError("UPDATE {$table_wfSNIPCache} SET count = count + 1 WHERE id = %d", $cachedRecord['id']);

[3405] Fix | Delete

if (preg_match('/BLOCKED:(\d+)/', $cachedRecord['body'], $matches) && (!wfBlock::isWhitelisted($IP))) {

[3406] Fix | Delete

return $matches[1];

[3407] Fix | Delete

}

[3408] Fix | Delete

return false;

[3409] Fix | Delete

}

[3410] Fix | Delete

[3411] Fix | Delete

$backoff = get_transient('wfsn_backoff');

[3412] Fix | Delete

if ($backoff) {

[3413] Fix | Delete

return false;

[3414] Fix | Delete

}

[3415] Fix | Delete

[3416] Fix | Delete

try {

[3417] Fix | Delete

$result = wp_remote_get(WORDFENCE_HACKATTEMPT_URL_SEC . 'hackAttempt/?k=' . rawurlencode(wfConfig::get('apiKey')) .

[3418] Fix | Delete

'&IP=' . rawurlencode(filter_var($IP, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? wfUtils::inet_aton($IP) : wfUtils::inet_pton($IP)) .

[3419] Fix | Delete

'&t=' . rawurlencode($hitType) .

[3420] Fix | Delete

'&type=' . $endpointType,

[3421] Fix | Delete

array(

[3422] Fix | Delete

'timeout' => 3,

[3423] Fix | Delete

'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),

[3424] Fix | Delete

'headers' => array('Referer' => false),

[3425] Fix | Delete

));

[3426] Fix | Delete

if (is_wp_error($result)) {

[3427] Fix | Delete

set_transient('wfsn_backoff', 1, WORDFENCE_NOC3_FAILED_BACKOFF_TIME);

[3428] Fix | Delete

return false;

[3429] Fix | Delete

}

[3430] Fix | Delete

$wfdb->queryWriteIgnoreError("INSERT INTO {$table_wfSNIPCache} (IP, type, expiration, body) VALUES ('%s', %d, DATE_ADD(NOW(), INTERVAL %d SECOND), '%s')", $IP, $endpointType, 30, $result['body']);

[3431] Fix | Delete

self::wfsnScheduleBatchReportFailedAttempts();

[3432] Fix | Delete

if (preg_match('/BLOCKED:(\d+)/', $result['body'], $matches) && (!wfBlock::isWhitelisted($IP))) {

[3433] Fix | Delete

return $matches[1];

[3434] Fix | Delete

}

[3435] Fix | Delete

return false;

[3436] Fix | Delete

} catch (Exception $err) {

[3437] Fix | Delete

set_transient('wfsn_backoff', 1, WORDFENCE_NOC3_FAILED_BACKOFF_TIME);

[3438] Fix | Delete

return false;

[3439] Fix | Delete

}

[3440] Fix | Delete

}

[3441] Fix | Delete

public static function wfsnEndpointType() {

[3442] Fix | Delete

$type = 0; //Unknown

[3443] Fix | Delete

if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {

[3444] Fix | Delete

$type = 2;

[3445] Fix | Delete

}

[3446] Fix | Delete

else if (defined('DOING_AJAX') && DOING_AJAX) {

[3447] Fix | Delete

$type = 3;

[3448] Fix | Delete

if (isset($_REQUEST['action']) && ($_REQUEST['action'] == 'wordfence_ls_authenticate' || $_REQUEST['action'] == 'nopriv_wordfence_ls_authenticate')) {

[3449] Fix | Delete

$type = 301;

[3450] Fix | Delete

}

[3451] Fix | Delete

}

[3452] Fix | Delete

else if (strpos($_SERVER['REQUEST_URI'], '/wp-login.php') !== false) {

[3453] Fix | Delete

$type = 1;

[3454] Fix | Delete

}

[3455] Fix | Delete

return $type;

[3456] Fix | Delete

}

[3457] Fix | Delete

public static function logoutAction(){

[3458] Fix | Delete

$userID = self::getLog()->getCurrentRequest()->userID;

[3459] Fix | Delete

$userDat = get_user_by('id', $userID);

[3460] Fix | Delete

if(is_object($userDat)){

[3461] Fix | Delete

self::getLog()->logLogin('logout', 0, $userDat->user_login);

[3462] Fix | Delete

}

[3463] Fix | Delete

// Unset the roadblock cookie

[3464] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL) {

[3465] Fix | Delete

wfUtils::setcookie(wfWAF::getInstance()->getAuthCookieName(), ' ', time() - (86400 * 365), '/', null, wfUtils::isFullSSL(), true);

[3466] Fix | Delete

}

[3467] Fix | Delete

}

[3468] Fix | Delete

public static function loginInitAction() {

[3469] Fix | Delete

$lockout = wfBlock::lockoutForIP(wfUtils::getIP());

[3470] Fix | Delete

if ($lockout !== false) {

[3471] Fix | Delete

$lockout->recordBlock();

[3472] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[3473] Fix | Delete

require(dirname(__FILE__) . '/wfLockedOut.php');

[3474] Fix | Delete

}

[3475] Fix | Delete

[3476] Fix | Delete

self::doEarlyAccessLogging(); //Rate limiting

[3477] Fix | Delete

}

[3478] Fix | Delete

public static function authAction(&$username, &$passwd){

[3479] Fix | Delete

$lockout = wfBlock::lockoutForIP(wfUtils::getIP());

[3480] Fix | Delete

if ($lockout !== false) {

[3481] Fix | Delete

$lockout->recordBlock();

[3482] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[3483] Fix | Delete

require(dirname(__FILE__) . '/wfLockedOut.php');

[3484] Fix | Delete

}

[3485] Fix | Delete

[3486] Fix | Delete

if (isset($_POST['wordfence_twoFactorUser'])) { //Final stage of login -- get and verify 2fa code, make sure we load the appropriate user

[3487] Fix | Delete

$userID = intval($_POST['wordfence_twoFactorUser']);

[3488] Fix | Delete

$twoFactorNonce = preg_replace('/[^a-f0-9]/i', '', $_POST['wordfence_twoFactorNonce']);

[3489] Fix | Delete

if (self::verifyTwoFactorIntermediateValues($userID, $twoFactorNonce)) {

[3490] Fix | Delete

$user = get_user_by('ID', $userID);

[3491] Fix | Delete

$username = $user->user_login;

[3492] Fix | Delete

$passwd = $twoFactorNonce;

[3493] Fix | Delete

self::$userDat = $user;

[3494] Fix | Delete

return;

[3495] Fix | Delete

}

[3496] Fix | Delete

}

[3497] Fix | Delete

[3498] Fix | Delete

if (is_array($username) || is_array($passwd)) { return; }

[3499] Fix | Delete

1 ...5 678 9 ...21