<?php

[0] Fix | Delete

[1] Fix | Delete

/**

[2] Fix | Delete

* Represents an individual block definition.

[3] Fix | Delete

*

[4] Fix | Delete

* @property int $id

[5] Fix | Delete

* @property int $type One of the TYPE_* constants.

[6] Fix | Delete

* @property string $ip The human-readable version of the IP if applicable for the block type.

[7] Fix | Delete

* @property int $blockedTime The timestamp the block was created.

[8] Fix | Delete

* @property string $reason Description of the block.

[9] Fix | Delete

* @property int $lastAttempt Timestamp of the last request blocked. If never, this will be 0.

[10] Fix | Delete

* @property int $blockedHits Count of the number of hits blocked.

[11] Fix | Delete

* @property int $expiration Timestamp when the block will expire. If never, this will be 0.

[12] Fix | Delete

* @property mixed $parameters Variable parameters defining the block (e.g., the matchers for a pattern block).

[13] Fix | Delete

*

[14] Fix | Delete

* @property bool $blockLogin For wfBlock::TYPE_COUNTRY only, this is whether or not to block hits to the login page.

[15] Fix | Delete

* @property bool $blockSite For wfBlock::TYPE_COUNTRY only, this is whether or not to block hits to the rest of the site.

[16] Fix | Delete

* @property array $countries For wfBlock::TYPE_COUNTRY only, this is the list of countries to block.

[17] Fix | Delete

*

[18] Fix | Delete

* @property mixed $ipRange For wfBlock::TYPE_PATTERN only, this is the matching IP range if set.

[19] Fix | Delete

* @property mixed $hostname For wfBlock::TYPE_PATTERN only, this is the hostname pattern if set.

[20] Fix | Delete

* @property mixed $userAgent For wfBlock::TYPE_PATTERN only, this is the user agent pattern if set.

[21] Fix | Delete

* @property mixed $referrer For wfBlock::TYPE_PATTERN only, this is the HTTP referrer pattern if set.

[22] Fix | Delete

*/

[23] Fix | Delete

class wfBlock {

[24] Fix | Delete

//Constants for block record types

[25] Fix | Delete

const TYPE_IP_MANUAL = 1; //Same behavior as TYPE_IP_AUTOMATIC_PERMANENT - the reason will be overridden for public display

[26] Fix | Delete

const TYPE_WFSN_TEMPORARY = 2;

[27] Fix | Delete

const TYPE_COUNTRY = 3;

[28] Fix | Delete

const TYPE_PATTERN = 4;

[29] Fix | Delete

const TYPE_RATE_BLOCK = 5;

[30] Fix | Delete

const TYPE_RATE_THROTTLE = 6;

[31] Fix | Delete

const TYPE_LOCKOUT = 7; //Blocks login-related actions only

[32] Fix | Delete

const TYPE_IP_AUTOMATIC_TEMPORARY = 8; //Automatic block, still temporary

[33] Fix | Delete

const TYPE_IP_AUTOMATIC_PERMANENT = 9; //Automatic block, started as temporary but now permanent as a result of admin action

[34] Fix | Delete

[35] Fix | Delete

//Constants to identify the match type of a block record

[36] Fix | Delete

const MATCH_NONE = 0;

[37] Fix | Delete

const MATCH_IP = 1;

[38] Fix | Delete

const MATCH_COUNTRY_BLOCK = 2;

[39] Fix | Delete

const MATCH_COUNTRY_REDIR = 3;

[40] Fix | Delete

const MATCH_COUNTRY_REDIR_BYPASS = 4;

[41] Fix | Delete

const MATCH_PATTERN = 5;

[42] Fix | Delete

[43] Fix | Delete

//Duration constants

[44] Fix | Delete

const DURATION_FOREVER = 0;

[45] Fix | Delete

[46] Fix | Delete

//Constants defining the placeholder IPs for non-IP block records

[47] Fix | Delete

const MARKER_COUNTRY = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xc0\x00\x02\x01";// 192.0.2.1 TEST-NET-1

[48] Fix | Delete

const MARKER_PATTERN = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xc0\x00\x02\x02";// 192.0.2.2 TEST-NET-1

[49] Fix | Delete

[50] Fix | Delete

private $_id;

[51] Fix | Delete

private $_type = false;

[52] Fix | Delete

private $_ip = false;

[53] Fix | Delete

private $_blockedTime = false;

[54] Fix | Delete

private $_reason = false;

[55] Fix | Delete

private $_lastAttempt = false;

[56] Fix | Delete

private $_blockedHits = false;

[57] Fix | Delete

private $_expiration = false;

[58] Fix | Delete

private $_parameters = false;

[59] Fix | Delete

[60] Fix | Delete

/**

[61] Fix | Delete

* Returns the name of the storage table for the blocks.

[62] Fix | Delete

*

[63] Fix | Delete

* @return string

[64] Fix | Delete

*/

[65] Fix | Delete

public static function blocksTable() {

[66] Fix | Delete

return wfDB::networkTable('wfBlocks7');

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

/**

[70] Fix | Delete

* Returns a user-displayable name for the corresponding type constant.

[71] Fix | Delete

*

[72] Fix | Delete

* @param int $type

[73] Fix | Delete

* @return string

[74] Fix | Delete

*/

[75] Fix | Delete

public static function nameForType($type) {

[76] Fix | Delete

switch ($type) {

[77] Fix | Delete

case self::TYPE_IP_MANUAL:

[78] Fix | Delete

case self::TYPE_IP_AUTOMATIC_TEMPORARY:

[79] Fix | Delete

case self::TYPE_IP_AUTOMATIC_PERMANENT:

[80] Fix | Delete

case self::TYPE_WFSN_TEMPORARY:

[81] Fix | Delete

case self::TYPE_RATE_BLOCK:

[82] Fix | Delete

return __('IP Block', 'wordfence');

[83] Fix | Delete

case self::TYPE_RATE_THROTTLE:

[84] Fix | Delete

return __('IP Throttled', 'wordfence');

[85] Fix | Delete

case self::TYPE_LOCKOUT:

[86] Fix | Delete

return __('Lockout', 'wordfence');

[87] Fix | Delete

case self::TYPE_COUNTRY:

[88] Fix | Delete

return __('Country Block', 'wordfence');

[89] Fix | Delete

case self::TYPE_PATTERN:

[90] Fix | Delete

return __('Advanced Block', 'wordfence');

[91] Fix | Delete

}

[92] Fix | Delete

[93] Fix | Delete

return __('Unknown', 'wordfence');

[94] Fix | Delete

}

[95] Fix | Delete

[96] Fix | Delete

/**

[97] Fix | Delete

* Returns the number of seconds for a temporary block to last by default.

[98] Fix | Delete

*

[99] Fix | Delete

* @return int

[100] Fix | Delete

*/

[101] Fix | Delete

public static function blockDuration() {

[102] Fix | Delete

return (int) wfConfig::get('blockedTime');

[103] Fix | Delete

}

[104] Fix | Delete

[105] Fix | Delete

/**

[106] Fix | Delete

* Returns the number of seconds for a rate limit throttle to last by default.

[107] Fix | Delete

*

[108] Fix | Delete

* @return int

[109] Fix | Delete

*/

[110] Fix | Delete

public static function rateLimitThrottleDuration() {

[111] Fix | Delete

return 60;

[112] Fix | Delete

}

[113] Fix | Delete

[114] Fix | Delete

/**

[115] Fix | Delete

* Returns the number of seconds for a lockout to last by default.

[116] Fix | Delete

*

[117] Fix | Delete

* @return int

[118] Fix | Delete

*/

[119] Fix | Delete

public static function lockoutDuration() {

[120] Fix | Delete

return (int) wfConfig::get('loginSec_lockoutMins') * 60;

[121] Fix | Delete

}

[122] Fix | Delete

[123] Fix | Delete

/**

[124] Fix | Delete

* @param string $IP Should be in dot or colon notation (127.0.0.1 or ::1)

[125] Fix | Delete

* @param bool $forcedWhitelistEntry If provided, returns whether or not the IP is on a forced whitelist (i.e., it's not one the user can delete).

[126] Fix | Delete

* @return bool

[127] Fix | Delete

*/

[128] Fix | Delete

public static function isWhitelisted($IP, &$forcedWhitelistEntry = null) {

[129] Fix | Delete

if ($forcedWhitelistEntry !== null) {

[130] Fix | Delete

$forcedWhitelistEntry = false;

[131] Fix | Delete

}

[132] Fix | Delete

[133] Fix | Delete

if (

[134] Fix | Delete

(defined('DOING_CRON') && DOING_CRON) || //Safe

[135] Fix | Delete

(defined('WORDFENCE_SYNCING_ATTACK_DATA') && WORDFENCE_SYNCING_ATTACK_DATA) //Safe as long as it will actually run since it then exits

[136] Fix | Delete

) {

[137] Fix | Delete

$serverIPs = wfUtils::serverIPs();

[138] Fix | Delete

foreach ($serverIPs as $testIP) {

[139] Fix | Delete

if (wfUtils::inet_pton($IP) == wfUtils::inet_pton($testIP)) {

[140] Fix | Delete

if ($forcedWhitelistEntry !== null) {

[141] Fix | Delete

$forcedWhitelistEntry = true;

[142] Fix | Delete

}

[143] Fix | Delete

[144] Fix | Delete

return true;

[145] Fix | Delete

}

[146] Fix | Delete

}

[147] Fix | Delete

}

[148] Fix | Delete

[149] Fix | Delete

foreach (wfUtils::getIPWhitelist() as $subnet) {

[150] Fix | Delete

if ($subnet instanceof wfUserIPRange) {

[151] Fix | Delete

if ($subnet->isIPInRange($IP)) {

[152] Fix | Delete

return true;

[153] Fix | Delete

}

[154] Fix | Delete

} elseif (wfUtils::subnetContainsIP($subnet, $IP)) {

[155] Fix | Delete

if ($forcedWhitelistEntry !== null) {

[156] Fix | Delete

$forcedWhitelistEntry = true;

[157] Fix | Delete

}

[158] Fix | Delete

return true;

[159] Fix | Delete

}

[160] Fix | Delete

}

[161] Fix | Delete

[162] Fix | Delete

return false;

[163] Fix | Delete

}

[164] Fix | Delete

[165] Fix | Delete

/**

[166] Fix | Delete

* Validates the payload for block creation. Returns true if valid, otherwise it'll return the first error found.

[167] Fix | Delete

*

[168] Fix | Delete

* @param $payload

[169] Fix | Delete

* @return bool|string

[170] Fix | Delete

*/

[171] Fix | Delete

public static function validate($payload) {

[172] Fix | Delete

if (!isset($payload['type']) || array_search($payload['type'], array('ip-address', 'country', 'custom-pattern')) === false) { return __('Invalid block type.', 'wordfence'); }

[173] Fix | Delete

if (!isset($payload['duration']) || intval($payload['duration']) < 0) { return __('Invalid block duration.', 'wordfence'); }

[174] Fix | Delete

if (!isset($payload['reason']) || empty($payload['reason'])) { return __('A block reason must be provided.', 'wordfence'); }

[175] Fix | Delete

[176] Fix | Delete

if ($payload['type'] == 'ip-address') {

[177] Fix | Delete

if (!isset($payload['ip']) || !filter_var(trim($payload['ip']), FILTER_VALIDATE_IP) || @wfUtils::inet_pton(trim($payload['ip'])) === false) { return __('Invalid IP address.', 'wordfence'); }

[178] Fix | Delete

if (self::isWhitelisted(trim($payload['ip']))) { return wp_kses(sprintf(/* translators: Support URL */ __('This IP address is in a range of addresses that Wordfence does not block. The IP range may be internal or belong to a service that is always allowed. Allowlisting of external services can be disabled. <a href="%s" target="_blank" rel="noopener noreferrer">Learn More<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_WHITELISTED_SERVICES)), array('a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()), 'span'=>array('class'=>array()))); }

[179] Fix | Delete

}

[180] Fix | Delete

else if ($payload['type'] == 'country') {

[181] Fix | Delete

if (!isset($payload['blockLogin']) || !isset($payload['blockSite'])) { return __('Nothing selected to block.', 'wordfence'); }

[182] Fix | Delete

if (!$payload['blockLogin'] && !$payload['blockSite']) { return __('Nothing selected to block.', 'wordfence'); }

[183] Fix | Delete

if (!isset($payload['countries']) || empty($payload['countries']) || !is_array($payload['countries'])) { return __('No countries selected.', 'wordfence'); }

[184] Fix | Delete

[185] Fix | Delete

require(WORDFENCE_PATH . 'lib/wfBulkCountries.php'); /** @var array $wfBulkCountries */

[186] Fix | Delete

foreach ($payload['countries'] as $code) {

[187] Fix | Delete

if (!isset($wfBulkCountries[$code])) {

[188] Fix | Delete

return __('An invalid country was selected.', 'wordfence');

[189] Fix | Delete

}

[190] Fix | Delete

}

[191] Fix | Delete

}

[192] Fix | Delete

else if ($payload['type'] == 'custom-pattern') {

[193] Fix | Delete

$hasOne = false;

[194] Fix | Delete

if (isset($payload['ipRange']) && !empty($payload['ipRange'])) {

[195] Fix | Delete

$ipRange = new wfUserIPRange($payload['ipRange']);

[196] Fix | Delete

if ($ipRange->isValidRange()) {

[197] Fix | Delete

if ($ipRange->isMixedRange()) {

[198] Fix | Delete

return __('Ranges mixing IPv4 and IPv6 addresses are not supported.', 'wordfence');

[199] Fix | Delete

}

[200] Fix | Delete

[201] Fix | Delete

$hasOne = true;

[202] Fix | Delete

}

[203] Fix | Delete

else {

[204] Fix | Delete

return __('Invalid IP range.', 'wordfence');

[205] Fix | Delete

}

[206] Fix | Delete

}

[207] Fix | Delete

if (isset($payload['hostname']) && !empty($payload['hostname'])) {

[208] Fix | Delete

if (preg_match('/^[a-z0-9\.\*\-]+$/i', $payload['hostname'])) {

[209] Fix | Delete

$hasOne = true;

[210] Fix | Delete

}

[211] Fix | Delete

else {

[212] Fix | Delete

return __('Invalid hostname.', 'wordfence');

[213] Fix | Delete

}

[214] Fix | Delete

}

[215] Fix | Delete

if (isset($payload['userAgent']) && !empty($payload['userAgent'])) { $hasOne = true; }

[216] Fix | Delete

if (isset($payload['referrer']) && !empty($payload['referrer'])) { $hasOne = true; }

[217] Fix | Delete

if (!$hasOne) { return __('No block parameters provided.', 'wordfence'); }

[218] Fix | Delete

}

[219] Fix | Delete

[220] Fix | Delete

return true;

[221] Fix | Delete

}

[222] Fix | Delete

[223] Fix | Delete

/**

[224] Fix | Delete

* Creates the block. The $payload value is expected to have been validated prior to calling this.

[225] Fix | Delete

*

[226] Fix | Delete

* @param $payload

[227] Fix | Delete

*/

[228] Fix | Delete

public static function create($payload) {

[229] Fix | Delete

$type = $payload['type'];

[230] Fix | Delete

$duration = max((int) $payload['duration'], 0);

[231] Fix | Delete

$reason = $payload['reason'];

[232] Fix | Delete

[233] Fix | Delete

if ($type == 'ip-address') {

[234] Fix | Delete

$ip = trim($payload['ip']);

[235] Fix | Delete

wfBlock::createIP($reason, $ip, $duration);

[236] Fix | Delete

}

[237] Fix | Delete

else if ($type == 'country') {

[238] Fix | Delete

$blockLogin = !!$payload['blockLogin'];

[239] Fix | Delete

$blockSite = !!$payload['blockSite'];

[240] Fix | Delete

$countries = array_unique($payload['countries']);

[241] Fix | Delete

wfBlock::createCountry($reason, $blockLogin, $blockSite, $countries, $duration);

[242] Fix | Delete

}

[243] Fix | Delete

else if ($type == 'custom-pattern') {

[244] Fix | Delete

$ipRange = '';

[245] Fix | Delete

if (isset($payload['ipRange']) && !empty($payload['ipRange'])) {

[246] Fix | Delete

$ipRange = new wfUserIPRange($payload['ipRange']);

[247] Fix | Delete

$ipRange = $ipRange->getIPString();

[248] Fix | Delete

}

[249] Fix | Delete

$hostname = (isset($payload['hostname']) && !empty($payload['hostname'])) ? $payload['hostname'] : '';

[250] Fix | Delete

$userAgent = (isset($payload['userAgent']) && !empty($payload['userAgent'])) ? $payload['userAgent'] : '';

[251] Fix | Delete

$referrer = (isset($payload['referrer']) && !empty($payload['referrer'])) ? $payload['referrer'] : '';

[252] Fix | Delete

wfBlock::createPattern($reason, $ipRange, $hostname, $userAgent, $referrer, $duration);

[253] Fix | Delete

}

[254] Fix | Delete

}

[255] Fix | Delete

[256] Fix | Delete

/**

[257] Fix | Delete

* Creates an IP block if one doesn't already exist for the given IP. The parameters are expected to have been validated and sanitized prior to calling this.

[258] Fix | Delete

*

[259] Fix | Delete

* @param string $reason

[260] Fix | Delete

* @param string $ip

[261] Fix | Delete

* @param int $duration Optional. Defaults to forever. This is the number of seconds for the block to last.

[262] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[263] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[264] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[265] Fix | Delete

*/

[266] Fix | Delete

public static function createIP($reason, $ip, $duration = self::DURATION_FOREVER, $blockedTime = false, $lastAttempt = false, $blockedHits = false, $type = self::TYPE_IP_MANUAL) {

[267] Fix | Delete

global $wpdb;

[268] Fix | Delete

[269] Fix | Delete

if (self::isWhitelisted($ip)) { return; }

[270] Fix | Delete

[271] Fix | Delete

if ($blockedTime === false) {

[272] Fix | Delete

$blockedTime = time();

[273] Fix | Delete

}

[274] Fix | Delete

[275] Fix | Delete

$ipHex = wfDB::binaryValueToSQLHex(wfUtils::inet_pton($ip));

[276] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[277] Fix | Delete

$hasExisting = $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `expiration` = %d WHERE `expiration` > UNIX_TIMESTAMP() AND `type` = %d AND `IP` = {$ipHex}", $reason, ($duration ? $blockedTime + $duration : $duration), $type));

[278] Fix | Delete

if (!$hasExisting) {

[279] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, {$ipHex}, %d, %s, %d, %d, %d, NULL)", $type, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration)));

[280] Fix | Delete

[281] Fix | Delete

wfConfig::inc('totalIPsBlocked');

[282] Fix | Delete

}

[283] Fix | Delete

[284] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[285] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[286] Fix | Delete

}

[287] Fix | Delete

}

[288] Fix | Delete

[289] Fix | Delete

/**

[290] Fix | Delete

* Creates an IP block for a WFSN response if one doesn't already exist for the given IP. The parameters are expected to have been validated and sanitized prior to calling this.

[291] Fix | Delete

*

[292] Fix | Delete

* @param string $reason

[293] Fix | Delete

* @param string $ip

[294] Fix | Delete

* @param int $duration This is the number of seconds for the block to last.

[295] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[296] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[297] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[298] Fix | Delete

*/

[299] Fix | Delete

public static function createWFSN($reason, $ip, $duration, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[300] Fix | Delete

global $wpdb;

[301] Fix | Delete

[302] Fix | Delete

if (self::isWhitelisted($ip)) { return; }

[303] Fix | Delete

[304] Fix | Delete

if ($blockedTime === false) {

[305] Fix | Delete

$blockedTime = time();

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

$ipHex = wfDB::binaryValueToSQLHex(wfUtils::inet_pton($ip));

[309] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[310] Fix | Delete

$hasExisting = $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `expiration` = %d WHERE `expiration` > UNIX_TIMESTAMP() AND `type` = %d AND `IP` = {$ipHex}", $reason, ($duration ? $blockedTime + $duration : $duration), self::TYPE_WFSN_TEMPORARY));

[311] Fix | Delete

if (!$hasExisting) {

[312] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, {$ipHex}, %d, %s, %d, %d, %d, NULL)", self::TYPE_WFSN_TEMPORARY, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration)));

[313] Fix | Delete

[314] Fix | Delete

wfConfig::inc('totalIPsBlocked');

[315] Fix | Delete

}

[316] Fix | Delete

[317] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[318] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[319] Fix | Delete

}

[320] Fix | Delete

}

[321] Fix | Delete

[322] Fix | Delete

/**

[323] Fix | Delete

* Creates an IP block for a rate limit if one doesn't already exist for the given IP. The parameters are expected to have been validated and sanitized prior to calling this.

[324] Fix | Delete

*

[325] Fix | Delete

* @param string $reason

[326] Fix | Delete

* @param string $ip

[327] Fix | Delete

* @param int $duration This is the number of seconds for the block to last.

[328] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[329] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[330] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[331] Fix | Delete

*/

[332] Fix | Delete

public static function createRateBlock($reason, $ip, $duration, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[333] Fix | Delete

global $wpdb;

[334] Fix | Delete

[335] Fix | Delete

if (self::isWhitelisted($ip)) { return; }

[336] Fix | Delete

[337] Fix | Delete

if ($blockedTime === false) {

[338] Fix | Delete

$blockedTime = time();

[339] Fix | Delete

}

[340] Fix | Delete

[341] Fix | Delete

$ipHex = wfDB::binaryValueToSQLHex(wfUtils::inet_pton($ip));

[342] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[343] Fix | Delete

$hasExisting = $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `expiration` = %d WHERE `expiration` > UNIX_TIMESTAMP() AND `type` = %d AND `IP` = {$ipHex}", $reason, ($duration ? $blockedTime + $duration : $duration), self::TYPE_RATE_BLOCK));

[344] Fix | Delete

if (!$hasExisting) {

[345] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, {$ipHex}, %d, %s, %d, %d, %d, NULL)", self::TYPE_RATE_BLOCK, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration)));

[346] Fix | Delete

[347] Fix | Delete

wfConfig::inc('totalIPsBlocked');

[348] Fix | Delete

}

[349] Fix | Delete

[350] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[351] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[352] Fix | Delete

}

[353] Fix | Delete

}

[354] Fix | Delete

[355] Fix | Delete

/**

[356] Fix | Delete

* Creates an IP throttle for a rate limit if one doesn't already exist for the given IP. The parameters are expected to have been validated and sanitized prior to calling this.

[357] Fix | Delete

*

[358] Fix | Delete

* @param string $reason

[359] Fix | Delete

* @param string $ip

[360] Fix | Delete

* @param int $duration This is the number of seconds for the block to last.

[361] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[362] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[363] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[364] Fix | Delete

*/

[365] Fix | Delete

public static function createRateThrottle($reason, $ip, $duration, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[366] Fix | Delete

global $wpdb;

[367] Fix | Delete

[368] Fix | Delete

if (self::isWhitelisted($ip)) { return; }

[369] Fix | Delete

[370] Fix | Delete

if ($blockedTime === false) {

[371] Fix | Delete

$blockedTime = time();

[372] Fix | Delete

}

[373] Fix | Delete

[374] Fix | Delete

$ipHex = wfDB::binaryValueToSQLHex(wfUtils::inet_pton($ip));

[375] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[376] Fix | Delete

$hasExisting = $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `expiration` = %d WHERE `expiration` > UNIX_TIMESTAMP() AND `type` = %d AND `IP` = {$ipHex}", $reason, ($duration ? $blockedTime + $duration : $duration), self::TYPE_RATE_THROTTLE));

[377] Fix | Delete

if (!$hasExisting) {

[378] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, {$ipHex}, %d, %s, %d, %d, %d, NULL)", self::TYPE_RATE_THROTTLE, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration)));

[379] Fix | Delete

[380] Fix | Delete

wfConfig::inc('totalIPsBlocked');

[381] Fix | Delete

}

[382] Fix | Delete

[383] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[384] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[385] Fix | Delete

}

[386] Fix | Delete

}

[387] Fix | Delete

[388] Fix | Delete

/**

[389] Fix | Delete

* Creates a lockout if one doesn't already exist for the given IP. The parameters are expected to have been validated and sanitized prior to calling this.

[390] Fix | Delete

*

[391] Fix | Delete

* @param string $reason

[392] Fix | Delete

* @param string $ip

[393] Fix | Delete

* @param int $duration This is the number of seconds for the block to last.

[394] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[395] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[396] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[397] Fix | Delete

*/

[398] Fix | Delete

public static function createLockout($reason, $ip, $duration, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[399] Fix | Delete

global $wpdb;

[400] Fix | Delete

[401] Fix | Delete

if (self::isWhitelisted($ip)) { return; }

[402] Fix | Delete

[403] Fix | Delete

if ($blockedTime === false) {

[404] Fix | Delete

$blockedTime = time();

[405] Fix | Delete

}

[406] Fix | Delete

[407] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[408] Fix | Delete

$ipHex = wfDB::binaryValueToSQLHex(wfUtils::inet_pton($ip));

[409] Fix | Delete

$hasExisting = $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `expiration` = %d WHERE `expiration` > UNIX_TIMESTAMP() AND `type` = %d AND `IP` = {$ipHex}", $reason, ($duration ? $blockedTime + $duration : $duration), self::TYPE_LOCKOUT));

[410] Fix | Delete

if (!$hasExisting) {

[411] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, {$ipHex}, %d, %s, %d, %d, %d, NULL)", self::TYPE_LOCKOUT, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration)));

[412] Fix | Delete

[413] Fix | Delete

wfConfig::inc('totalIPsLocked');

[414] Fix | Delete

}

[415] Fix | Delete

[416] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[417] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[418] Fix | Delete

}

[419] Fix | Delete

}

[420] Fix | Delete

[421] Fix | Delete

/**

[422] Fix | Delete

* Creates a country block. The parameters are expected to have been validated and sanitized prior to calling this.

[423] Fix | Delete

*

[424] Fix | Delete

* @param string $reason

[425] Fix | Delete

* @param string $blockLogin

[426] Fix | Delete

* @param string $blockSite

[427] Fix | Delete

* @param string $countries

[428] Fix | Delete

* @param int $duration Optional. Defaults to forever. This is the number of seconds for the block to last.

[429] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[430] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[431] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[432] Fix | Delete

*/

[433] Fix | Delete

public static function createCountry($reason, $blockLogin, $blockSite, $countries, $duration = self::DURATION_FOREVER, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[434] Fix | Delete

global $wpdb;

[435] Fix | Delete

[436] Fix | Delete

if ($blockedTime === false) {

[437] Fix | Delete

$blockedTime = time();

[438] Fix | Delete

}

[439] Fix | Delete

[440] Fix | Delete

$parameters = array(

[441] Fix | Delete

'blockLogin' => $blockLogin ? 1 : 0,

[442] Fix | Delete

'blockSite' => $blockSite ? 1 : 0,

[443] Fix | Delete

'countries' => $countries,

[444] Fix | Delete

);

[445] Fix | Delete

[446] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[447] Fix | Delete

$existing = $wpdb->get_var($wpdb->prepare("SELECT `id` FROM `{$blocksTable}` WHERE `type` = %d LIMIT 1", self::TYPE_COUNTRY));

[448] Fix | Delete

if ($existing) {

[449] Fix | Delete

$wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `reason` = %s, `parameters` = %s WHERE `id` = %d", $reason, json_encode($parameters), $existing));

[450] Fix | Delete

}

[451] Fix | Delete

else {

[452] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, %s, %d, %s, %d, %d, %d, %s)", self::TYPE_COUNTRY, self::MARKER_COUNTRY, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration), json_encode($parameters)));

[453] Fix | Delete

}

[454] Fix | Delete

[455] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[456] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[457] Fix | Delete

}

[458] Fix | Delete

}

[459] Fix | Delete

[460] Fix | Delete

/**

[461] Fix | Delete

* Creates a pattern block. The parameters are expected to have been validated and sanitized prior to calling this.

[462] Fix | Delete

*

[463] Fix | Delete

* @param string $reason

[464] Fix | Delete

* @param string $ipRange

[465] Fix | Delete

* @param string $hostname

[466] Fix | Delete

* @param string $userAgent

[467] Fix | Delete

* @param string $referrer

[468] Fix | Delete

* @param int $duration Optional. Defaults to forever. This is the number of seconds for the block to last.

[469] Fix | Delete

* @param bool|int $blockedTime Optional. Defaults to the current timestamp.

[470] Fix | Delete

* @param bool|int $lastAttempt Optional. Defaults to 0, which means never.

[471] Fix | Delete

* @param bool|int $blockedHits Optional. Defaults to 0.

[472] Fix | Delete

*/

[473] Fix | Delete

public static function createPattern($reason, $ipRange, $hostname, $userAgent, $referrer, $duration = self::DURATION_FOREVER, $blockedTime = false, $lastAttempt = false, $blockedHits = false) {

[474] Fix | Delete

global $wpdb;

[475] Fix | Delete

[476] Fix | Delete

if ($blockedTime === false) {

[477] Fix | Delete

$blockedTime = time();

[478] Fix | Delete

}

[479] Fix | Delete

[480] Fix | Delete

$parameters = array(

[481] Fix | Delete

'ipRange' => $ipRange,

[482] Fix | Delete

'hostname' => $hostname,

[483] Fix | Delete

'userAgent' => $userAgent,

[484] Fix | Delete

'referrer' => $referrer,

[485] Fix | Delete

);

[486] Fix | Delete

[487] Fix | Delete

$blocksTable = wfBlock::blocksTable();

[488] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$blocksTable}` (`type`, `IP`, `blockedTime`, `reason`, `lastAttempt`, `blockedHits`, `expiration`, `parameters`) VALUES (%d, %s, %d, %s, %d, %d, %d, %s)", self::TYPE_PATTERN, self::MARKER_PATTERN, $blockedTime, $reason, (int) $lastAttempt, (int) $blockedHits, ($duration ? $blockedTime + $duration : $duration), json_encode($parameters)));

[489] Fix | Delete

[490] Fix | Delete

if (!WFWAF_SUBDIRECTORY_INSTALL && class_exists('wfWAFIPBlocksController')) {

[491] Fix | Delete

wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings();

[492] Fix | Delete

}

[493] Fix | Delete

}

[494] Fix | Delete

[495] Fix | Delete

/**

[496] Fix | Delete

* Removes all expired blocks.

[497] Fix | Delete

*/

[498] Fix | Delete

public static function vacuum() {

[499] Fix | Delete