<?php

[0] Fix | Delete

if (!defined('WFWAF_RUN_COMPLETE')) {

[1] Fix | Delete

[2] Fix | Delete

require_once __DIR__ . '/../vendor/wordfence/wf-waf/src/lib/shutdown.php';

[3] Fix | Delete

[4] Fix | Delete

class wfWAFIPBlocksController

[5] Fix | Delete

{

[6] Fix | Delete

const WFWAF_BLOCK_UAREFIPRANGE = 'UA/Referrer/IP Range not allowed';

[7] Fix | Delete

const WFWAF_BLOCK_COUNTRY = 'blocked access via country blocking';

[8] Fix | Delete

const WFWAF_BLOCK_COUNTRY_REDIR = 'blocked access via country blocking and redirected to URL';

[9] Fix | Delete

const WFWAF_BLOCK_COUNTRY_BYPASS_REDIR = 'redirected to bypass URL';

[10] Fix | Delete

const WFWAF_BLOCK_WFSN = 'Blocked by Wordfence Security Network';

[11] Fix | Delete

const WFWAF_BLOCK_BADPOST = 'POST received with blank user-agent and referer';

[12] Fix | Delete

const WFWAF_BLOCK_BANNEDURL = 'Accessed a banned URL.';

[13] Fix | Delete

const WFWAF_BLOCK_FAKEGOOGLE = 'Fake Google crawler automatically blocked';

[14] Fix | Delete

const WFWAF_BLOCK_LOGINSEC = 'Blocked by login security setting.';

[15] Fix | Delete

const WFWAF_BLOCK_LOGINSEC_FORGOTPASSWD = 'Exceeded the maximum number of tries to recover their password'; //substring search

[16] Fix | Delete

const WFWAF_BLOCK_LOGINSEC_FAILURES = 'Exceeded the maximum number of login failures'; //substring search

[17] Fix | Delete

const WFWAF_BLOCK_THROTTLEGLOBAL = 'Exceeded the maximum global requests per minute for crawlers or humans.';

[18] Fix | Delete

const WFWAF_BLOCK_THROTTLESCAN = 'Exceeded the maximum number of 404 requests per minute for a known security vulnerability.';

[19] Fix | Delete

const WFWAF_BLOCK_THROTTLECRAWLER = 'Exceeded the maximum number of requests per minute for crawlers.';

[20] Fix | Delete

const WFWAF_BLOCK_THROTTLECRAWLERNOTFOUND = 'Exceeded the maximum number of page not found errors per minute for a crawler.';

[21] Fix | Delete

const WFWAF_BLOCK_THROTTLEHUMAN = 'Exceeded the maximum number of page requests per minute for humans.';

[22] Fix | Delete

const WFWAF_BLOCK_THROTTLEHUMANNOTFOUND = 'Exceeded the maximum number of page not found errors per minute for humans.';

[23] Fix | Delete

[24] Fix | Delete

protected static $_currentController = null;

[25] Fix | Delete

[26] Fix | Delete

public static function currentController() {

[27] Fix | Delete

if (self::$_currentController === null) {

[28] Fix | Delete

self::$_currentController = new wfWAFIPBlocksController();

[29] Fix | Delete

}

[30] Fix | Delete

return self::$_currentController;

[31] Fix | Delete

}

[32] Fix | Delete

[33] Fix | Delete

public static function setCurrentController($currentController) {

[34] Fix | Delete

self::$_currentController = $currentController;

[35] Fix | Delete

}

[36] Fix | Delete

[37] Fix | Delete

/**

[38] Fix | Delete

* Schedules a config sync to happen at the end of the current process's execution.

[39] Fix | Delete

*/

[40] Fix | Delete

public static function setNeedsSynchronizeConfigSettings() {

[41] Fix | Delete

static $willSynchronize = false;

[42] Fix | Delete

if (!$willSynchronize) {

[43] Fix | Delete

$willSynchronize = true;

[44] Fix | Delete

wfShutdownRegistry::getDefaultInstance()->register('wfWAFIPBlocksController::synchronizeConfigSettings');

[45] Fix | Delete

}

[46] Fix | Delete

}

[47] Fix | Delete

[48] Fix | Delete

public static function synchronizeConfigSettings() {

[49] Fix | Delete

if (!class_exists('wfConfig') || !wfConfig::tableExists() || !wfWAF::getInstance()) { // Ensure this is only called when WordPress and the plugin are fully loaded

[50] Fix | Delete

return;

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

static $isSynchronizing = false;

[54] Fix | Delete

if ($isSynchronizing) {

[55] Fix | Delete

return;

[56] Fix | Delete

}

[57] Fix | Delete

$isSynchronizing = true;

[58] Fix | Delete

[59] Fix | Delete

global $wpdb;

[60] Fix | Delete

$suppressed = $wpdb->suppress_errors(!(defined('WFWAF_DEBUG') && WFWAF_DEBUG));

[61] Fix | Delete

[62] Fix | Delete

// Pattern Blocks

[63] Fix | Delete

$blocks = wfBlock::patternBlocks(true);

[64] Fix | Delete

$patternBlocks = array();

[65] Fix | Delete

foreach ($blocks as $b) {

[66] Fix | Delete

$patternBlocks[] = array('id' => $b->id, 'ipRange' => $b->ipRange, 'hostnamePattern' => $b->hostname, 'uaPattern' => $b->userAgent, 'refPattern' => $b->referrer, 'expiration' => $b->expiration);

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

// Country Blocks

[70] Fix | Delete

$countryBlocks = array();

[71] Fix | Delete

$countryBlockEntries = wfBlock::countryBlocks(true);

[72] Fix | Delete

$countryBlocks['blocks'] = array();

[73] Fix | Delete

foreach ($countryBlockEntries as $b) {

[74] Fix | Delete

$reason = __('Access from your area has been temporarily limited for security reasons', 'wordfence');

[75] Fix | Delete

[76] Fix | Delete

$countryBlocks['blocks'][] = array(

[77] Fix | Delete

'id' => $b->id,

[78] Fix | Delete

'countries' => $b->countries,

[79] Fix | Delete

'blockLogin' => $b->blockLogin,

[80] Fix | Delete

'blockSite' => $b->blockSite,

[81] Fix | Delete

'reason' => $reason,

[82] Fix | Delete

'expiration' => $b->expiration,

[83] Fix | Delete

);

[84] Fix | Delete

}

[85] Fix | Delete

$countryBlocks['action'] = wfConfig::get('cbl_action', false);

[86] Fix | Delete

$countryBlocks['loggedInBlocked'] = wfConfig::get('cbl_loggedInBlocked', false);

[87] Fix | Delete

$countryBlocks['bypassRedirURL'] = wfConfig::get('cbl_bypassRedirURL', '');

[88] Fix | Delete

$countryBlocks['bypassRedirDest'] = wfConfig::get('cbl_bypassRedirDest', '');

[89] Fix | Delete

$countryBlocks['bypassViewURL'] = wfConfig::get('cbl_bypassViewURL', '');

[90] Fix | Delete

$countryBlocks['redirURL'] = wfConfig::get('cbl_redirURL', '');

[91] Fix | Delete

$countryBlocks['cookieVal'] = wfBlock::countryBlockingBypassCookieValue();

[92] Fix | Delete

[93] Fix | Delete

//Other Blocks

[94] Fix | Delete

$otherBlocks = array('blockedTime' => wfConfig::get('blockedTime', 0));

[95] Fix | Delete

$otherBlockEntries = wfBlock::ipBlocks(true);

[96] Fix | Delete

$otherBlocks['blocks'] = array();

[97] Fix | Delete

foreach ($otherBlockEntries as $b) {

[98] Fix | Delete

$reason = $b->reason;

[99] Fix | Delete

if ($b->type == wfBlock::TYPE_IP_MANUAL || $b->type == wfBlock::TYPE_IP_AUTOMATIC_PERMANENT) {

[100] Fix | Delete

$reason = __('Manual block by administrator', 'wordfence');

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

$otherBlocks['blocks'][] = array(

[104] Fix | Delete

'id' => $b->id,

[105] Fix | Delete

'IP' => base64_encode(wfUtils::inet_pton($b->ip)),

[106] Fix | Delete

'reason' => $reason,

[107] Fix | Delete

'expiration' => $b->expiration,

[108] Fix | Delete

);

[109] Fix | Delete

}

[110] Fix | Delete

[111] Fix | Delete

//Lockouts

[112] Fix | Delete

$lockoutEntries = wfBlock::lockouts(true);

[113] Fix | Delete

$lockoutSecs = wfConfig::get('loginSec_lockoutMins') * 60;

[114] Fix | Delete

$lockouts = array('lockedOutTime' => $lockoutSecs, 'lockouts' => array());

[115] Fix | Delete

foreach ($lockoutEntries as $l) {

[116] Fix | Delete

$lockouts['lockouts'][] = array(

[117] Fix | Delete

'id' => $l->id,

[118] Fix | Delete

'IP' => base64_encode(wfUtils::inet_pton($l->ip)),

[119] Fix | Delete

'reason' => $l->reason,

[120] Fix | Delete

'expiration' => $l->expiration,

[121] Fix | Delete

);

[122] Fix | Delete

}

[123] Fix | Delete

[124] Fix | Delete

// Save it

[125] Fix | Delete

try {

[126] Fix | Delete

$patternBlocksJSON = wfWAFUtils::json_encode($patternBlocks);

[127] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('patternBlocks', $patternBlocksJSON, 'synced');

[128] Fix | Delete

$countryBlocksJSON = wfWAFUtils::json_encode($countryBlocks);

[129] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('countryBlocks', $countryBlocksJSON, 'synced');

[130] Fix | Delete

$otherBlocksJSON = wfWAFUtils::json_encode($otherBlocks);

[131] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('otherBlocks', $otherBlocksJSON, 'synced');

[132] Fix | Delete

$lockoutsJSON = wfWAFUtils::json_encode($lockouts);

[133] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('lockouts', $lockoutsJSON, 'synced');

[134] Fix | Delete

[135] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('advancedBlockingEnabled', wfConfig::get('firewallEnabled'), 'synced');

[136] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('disableWAFIPBlocking', wfConfig::get('disableWAFIPBlocking'), 'synced');

[137] Fix | Delete

}

[138] Fix | Delete

catch (Exception $e) {

[139] Fix | Delete

// Do nothing

[140] Fix | Delete

}

[141] Fix | Delete

$isSynchronizing = false;

[142] Fix | Delete

[143] Fix | Delete

$wpdb->suppress_errors($suppressed);

[144] Fix | Delete

}

[145] Fix | Delete

[146] Fix | Delete

/**

[147] Fix | Delete

* @param wfWAFRequest $request

[148] Fix | Delete

* @return bool|string If not blocked, returns false. Otherwise a string of the reason it was blocked or true.

[149] Fix | Delete

*/

[150] Fix | Delete

public function shouldBlockRequest($request) {

[151] Fix | Delete

// Checking the user whitelist is done before reaching this call

[152] Fix | Delete

[153] Fix | Delete

$ip = $request->getIP();

[154] Fix | Delete

[155] Fix | Delete

//Check the system whitelist

[156] Fix | Delete

if ($this->checkForWhitelisted($ip)) {

[157] Fix | Delete

return false;

[158] Fix | Delete

}

[159] Fix | Delete

[160] Fix | Delete

//Let the plugin handle these

[161] Fix | Delete

$wfFunc = $request->getQueryString('_wfsf');

[162] Fix | Delete

if ($wfFunc == 'unlockEmail' || $wfFunc == 'unlockAccess') { // Can't check validity here, let it pass through to plugin level where it can

[163] Fix | Delete

return false;

[164] Fix | Delete

}

[165] Fix | Delete

[166] Fix | Delete

$logHuman = $request->getQueryString('wordfence_lh');

[167] Fix | Delete

if ($logHuman !== null) {

[168] Fix | Delete

return false;

[169] Fix | Delete

}

[170] Fix | Delete

[171] Fix | Delete

//Start block checks

[172] Fix | Delete

$ipNum = wfWAFUtils::inet_pton($ip);

[173] Fix | Delete

$hostname = null;

[174] Fix | Delete

$ua = $request->getHeaders('User-Agent'); if ($ua === null) { $ua = ''; }

[175] Fix | Delete

$referer = $request->getHeaders('Referer'); if ($referer === null) { $referer = ''; }

[176] Fix | Delete

[177] Fix | Delete

$isPaid = false;

[178] Fix | Delete

try {

[179] Fix | Delete

$isPaid = wfWAF::getInstance()->getStorageEngine()->getConfig('isPaid', null, 'synced');

[180] Fix | Delete

$pluginABSPATH = wfWAF::getInstance()->getStorageEngine()->getConfig('pluginABSPATH', null, 'synced');

[181] Fix | Delete

[182] Fix | Delete

$patternBlocksJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('patternBlocks', null, 'synced');

[183] Fix | Delete

$countryBlocksJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('countryBlocks', null, 'synced');

[184] Fix | Delete

$otherBlocksJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('otherBlocks', null, 'synced');

[185] Fix | Delete

$lockoutsJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('lockouts', null, 'synced');

[186] Fix | Delete

}

[187] Fix | Delete

catch (Exception $e) {

[188] Fix | Delete

// Do nothing

[189] Fix | Delete

}

[190] Fix | Delete

[191] Fix | Delete

if (isset($_SERVER['SCRIPT_FILENAME']) && (strpos($_SERVER['SCRIPT_FILENAME'], $pluginABSPATH . "wp-admin/") === 0 || strpos($_SERVER['SCRIPT_FILENAME'], $pluginABSPATH . "wp-content/") === 0 || strpos($_SERVER['SCRIPT_FILENAME'], $pluginABSPATH . "wp-includes/") === 0)) {

[192] Fix | Delete

return false; //Rely on WordPress's own access control and blocking at the plugin level

[193] Fix | Delete

}

[194] Fix | Delete

[195] Fix | Delete

// Pattern Blocks from the Advanced Blocking page (IP Range, UA, Referer)

[196] Fix | Delete

$patternBlocks = @wfWAFUtils::json_decode($patternBlocksJSON, true);

[197] Fix | Delete

if (is_array($patternBlocks)) {

[198] Fix | Delete

// Instead of a long block of if/else statements, using bitshifting to generate an expected value and a found value

[199] Fix | Delete

$ipRangeOffset = 1;

[200] Fix | Delete

$uaPatternOffset = 2;

[201] Fix | Delete

$refPatternOffset = 3;

[202] Fix | Delete

[203] Fix | Delete

foreach ($patternBlocks as $b) {

[204] Fix | Delete

$expectedBits = 0;

[205] Fix | Delete

$foundBits = 0;

[206] Fix | Delete

[207] Fix | Delete

if (isset($b['expiration']) && $b['expiration'] < time() && $b['expiration'] != 0) {

[208] Fix | Delete

continue;

[209] Fix | Delete

}

[210] Fix | Delete

[211] Fix | Delete

if (!empty($b['ipRange'])) {

[212] Fix | Delete

$expectedBits |= (1 << $ipRangeOffset);

[213] Fix | Delete

[214] Fix | Delete

$range = new wfWAFUserIPRange($b['ipRange']);

[215] Fix | Delete

if ($range->isIPInRange($ip)) {

[216] Fix | Delete

$foundBits |= (1 << $ipRangeOffset);

[217] Fix | Delete

}

[218] Fix | Delete

}

[219] Fix | Delete

[220] Fix | Delete

if (!empty($b['hostnamePattern'])) {

[221] Fix | Delete

$expectedBits |= (1 << $ipRangeOffset);

[222] Fix | Delete

if ($hostname === null) {

[223] Fix | Delete

$hostname = wfWAFUtils::reverseLookup($ip);

[224] Fix | Delete

}

[225] Fix | Delete

if (preg_match(wfWAFUtils::patternToRegex($b['hostnamePattern']), $hostname)) {

[226] Fix | Delete

$foundBits |= (1 << $ipRangeOffset);

[227] Fix | Delete

}

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

if (!empty($b['uaPattern'])) {

[231] Fix | Delete

$expectedBits |= (1 << $uaPatternOffset);

[232] Fix | Delete

if (wfWAFUtils::isUABlocked($b['uaPattern'], $ua)) {

[233] Fix | Delete

$foundBits |= (1 << $uaPatternOffset);

[234] Fix | Delete

}

[235] Fix | Delete

}

[236] Fix | Delete

[237] Fix | Delete

if (!empty($b['refPattern'])) {

[238] Fix | Delete

$expectedBits |= (1 << $refPatternOffset);

[239] Fix | Delete

if (wfWAFUtils::isRefererBlocked($b['refPattern'], $referer)) {

[240] Fix | Delete

$foundBits |= (1 << $refPatternOffset);

[241] Fix | Delete

}

[242] Fix | Delete

}

[243] Fix | Delete

[244] Fix | Delete

if ($foundBits === $expectedBits && $expectedBits > 0) {

[245] Fix | Delete

return array('action' => self::WFWAF_BLOCK_UAREFIPRANGE, 'id' => $b['id']);

[246] Fix | Delete

}

[247] Fix | Delete

}

[248] Fix | Delete

}

[249] Fix | Delete

// End Pattern Blocks

[250] Fix | Delete

[251] Fix | Delete

// Country Blocking

[252] Fix | Delete

if ($isPaid) {

[253] Fix | Delete

$countryBlocks = @wfWAFUtils::json_decode($countryBlocksJSON, true);

[254] Fix | Delete

if (is_array($countryBlocks) && isset($countryBlocks['blocks'])) {

[255] Fix | Delete

$blocks = $countryBlocks['blocks'];

[256] Fix | Delete

foreach ($blocks as $b) {

[257] Fix | Delete

$blockedCountries = $b['countries'];

[258] Fix | Delete

$bareRequestURI = wfWAFUtils::extractBareURI($request->getURI());

[259] Fix | Delete

$bareBypassRedirURI = wfWAFUtils::extractBareURI($countryBlocks['bypassRedirURL']);

[260] Fix | Delete

$skipCountryBlocking = false;

[261] Fix | Delete

[262] Fix | Delete

if ($bareBypassRedirURI && $bareRequestURI == $bareBypassRedirURI) { // Run this before country blocking because even if the user isn't blocked we need to set the bypass cookie so they can bypass future blocks.

[263] Fix | Delete

if ($countryBlocks['bypassRedirDest']) {

[264] Fix | Delete

setcookie('wfCBLBypass', $countryBlocks['cookieVal'], time() + (86400 * 365), '/', null, $this->isFullSSL(), true);

[265] Fix | Delete

return array('action' => self::WFWAF_BLOCK_COUNTRY_BYPASS_REDIR, 'id' => $b['id']);

[266] Fix | Delete

}

[267] Fix | Delete

}

[268] Fix | Delete

[269] Fix | Delete

$bareBypassViewURI = wfWAFUtils::extractBareURI($countryBlocks['bypassViewURL']);

[270] Fix | Delete

if ($bareBypassViewURI && $bareBypassViewURI == $bareRequestURI) {

[271] Fix | Delete

setcookie('wfCBLBypass', $countryBlocks['cookieVal'], time() + (86400 * 365), '/', null, $this->isFullSSL(), true);

[272] Fix | Delete

$skipCountryBlocking = true;

[273] Fix | Delete

}

[274] Fix | Delete

[275] Fix | Delete

$bypassCookieSet = false;

[276] Fix | Delete

$bypassCookie = $request->getCookies('wfCBLBypass');

[277] Fix | Delete

if (isset($bypassCookie) && $bypassCookie == $countryBlocks['cookieVal']) {

[278] Fix | Delete

$bypassCookieSet = true;

[279] Fix | Delete

}

[280] Fix | Delete

[281] Fix | Delete

if (!$skipCountryBlocking && $blockedCountries && !$bypassCookieSet) {

[282] Fix | Delete

$isAuthRequest = (strpos($bareRequestURI, '/wp-login.php') !== false);

[283] Fix | Delete

$isXMLRPC = (strpos($bareRequestURI, '/xmlrpc.php') !== false);

[284] Fix | Delete

$isUserLoggedIn = wfWAF::getInstance()->parseAuthCookie() !== false;

[285] Fix | Delete

[286] Fix | Delete

// If everything is checked, make sure this always runs.

[287] Fix | Delete

if ($countryBlocks['loggedInBlocked'] && $b['blockLogin'] && $b['blockSite']) {

[288] Fix | Delete

if ($blocked = $this->checkForBlockedCountry($countryBlocks, $ip, $bareRequestURI)) { $blocked['id'] = $b['id']; return $blocked; }

[289] Fix | Delete

}

[290] Fix | Delete

// Block logged in users.

[291] Fix | Delete

if ($countryBlocks['loggedInBlocked'] && $isUserLoggedIn) {

[292] Fix | Delete

if ($blocked = $this->checkForBlockedCountry($countryBlocks, $ip, $bareRequestURI)) { $blocked['id'] = $b['id']; return $blocked; }

[293] Fix | Delete

}

[294] Fix | Delete

// Block the login form itself and any attempt to authenticate.

[295] Fix | Delete

if ($b['blockLogin'] && $isAuthRequest) {

[296] Fix | Delete

if ($blocked = $this->checkForBlockedCountry($countryBlocks, $ip, $bareRequestURI)) { $blocked['id'] = $b['id']; return $blocked; }

[297] Fix | Delete

}

[298] Fix | Delete

// Block requests that aren't to the login page, xmlrpc.php, or a user already logged in.

[299] Fix | Delete

if ($b['blockSite'] && !$isAuthRequest && !$isXMLRPC && !$isUserLoggedIn) {

[300] Fix | Delete

if ($blocked = $this->checkForBlockedCountry($countryBlocks, $ip, $bareRequestURI)) { $blocked['id'] = $b['id']; return $blocked; }

[301] Fix | Delete

}

[302] Fix | Delete

// XMLRPC is inaccesible when public portion of the site and auth is disabled.

[303] Fix | Delete

if ($b['blockLogin'] && $b['blockSite'] && $isXMLRPC) {

[304] Fix | Delete

if ($blocked = $this->checkForBlockedCountry($countryBlocks, $ip, $bareRequestURI)) { $blocked['id'] = $b['id']; return $blocked; }

[305] Fix | Delete

}

[306] Fix | Delete

[307] Fix | Delete

// Any bypasses and other block possibilities will be checked at the plugin level once WordPress loads

[308] Fix | Delete

}

[309] Fix | Delete

}

[310] Fix | Delete

}

[311] Fix | Delete

}

[312] Fix | Delete

// End Country Blocking

[313] Fix | Delete

[314] Fix | Delete

// Other Blocks

[315] Fix | Delete

$otherBlocks = @wfWAFUtils::json_decode($otherBlocksJSON, true);

[316] Fix | Delete

if (is_array($otherBlocks)) {

[317] Fix | Delete

$blocks = $otherBlocks['blocks'];

[318] Fix | Delete

$bareRequestURI = wfWAFUtils::extractBareURI($request->getURI());

[319] Fix | Delete

$isAuthRequest = (stripos($bareRequestURI, '/wp-login.php') !== false);

[320] Fix | Delete

foreach ($blocks as $b) {

[321] Fix | Delete

if (isset($b['expiration']) && $b['expiration'] < time() && $b['expiration'] != 0) {

[322] Fix | Delete

continue;

[323] Fix | Delete

}

[324] Fix | Delete

[325] Fix | Delete

if (base64_decode($b['IP']) != $ipNum) {

[326] Fix | Delete

continue;

[327] Fix | Delete

}

[328] Fix | Delete

[329] Fix | Delete

if ($isAuthRequest && isset($b['wfsn']) && $b['wfsn']) {

[330] Fix | Delete

return array('action' => self::WFWAF_BLOCK_WFSN, 'id' => $b['id']);

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

return array('action' => (empty($b['reason']) ? '' : $b['reason']), 'id' => $b['id'], 'block' => true);

[334] Fix | Delete

}

[335] Fix | Delete

}

[336] Fix | Delete

// End Other Blocks

[337] Fix | Delete

[338] Fix | Delete

// Lockouts

[339] Fix | Delete

$lockouts = @wfWAFUtils::json_decode($lockoutsJSON, true);

[340] Fix | Delete

if (is_array($lockouts)) {

[341] Fix | Delete

$lockouts = $lockouts['lockouts'];

[342] Fix | Delete

$isAuthRequest = (stripos($bareRequestURI, '/wp-login.php') !== false) || (stripos($bareRequestURI, '/xmlrpc.php') !== false);

[343] Fix | Delete

if ($isAuthRequest) {

[344] Fix | Delete

foreach ($lockouts as $l) {

[345] Fix | Delete

if (isset($l['expiration']) && $l['expiration'] < time()) {

[346] Fix | Delete

continue;

[347] Fix | Delete

}

[348] Fix | Delete

[349] Fix | Delete

if (base64_decode($l['IP']) != $ipNum) {

[350] Fix | Delete

continue;

[351] Fix | Delete

}

[352] Fix | Delete

[353] Fix | Delete

return array('action' => (empty($l['reason']) ? '' : $l['reason']), 'id' => $l['id'], 'lockout' => true);

[354] Fix | Delete

}

[355] Fix | Delete

}

[356] Fix | Delete

}

[357] Fix | Delete

// End Lockouts

[358] Fix | Delete

[359] Fix | Delete

return false;

[360] Fix | Delete

}

[361] Fix | Delete

[362] Fix | Delete

public function countryRedirURL($countryBlocks = null) {

[363] Fix | Delete

if (!isset($countryBlocks)) {

[364] Fix | Delete

try {

[365] Fix | Delete

$countryBlocksJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('countryBlocks', null, 'synced');

[366] Fix | Delete

}

[367] Fix | Delete

catch (Exception $e) {

[368] Fix | Delete

return false;

[369] Fix | Delete

}

[370] Fix | Delete

}

[371] Fix | Delete

[372] Fix | Delete

$countryBlocks = @wfWAFUtils::json_decode($countryBlocksJSON, true);

[373] Fix | Delete

if (is_array($countryBlocks)) {

[374] Fix | Delete

if ($countryBlocks['action'] == 'redir') {

[375] Fix | Delete

return $countryBlocks['redirURL'];

[376] Fix | Delete

}

[377] Fix | Delete

}

[378] Fix | Delete

return false;

[379] Fix | Delete

}

[380] Fix | Delete

[381] Fix | Delete

public function countryBypassRedirURL($countryBlocks = null) {

[382] Fix | Delete

if (!isset($countryBlocks)) {

[383] Fix | Delete

try {

[384] Fix | Delete

$countryBlocksJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('countryBlocks', null, 'synced');

[385] Fix | Delete

}

[386] Fix | Delete

catch (Exception $e) {

[387] Fix | Delete

return false;

[388] Fix | Delete

}

[389] Fix | Delete

}

[390] Fix | Delete

[391] Fix | Delete

$countryBlocks = @wfWAFUtils::json_decode($countryBlocksJSON, true);

[392] Fix | Delete

if (is_array($countryBlocks)) {

[393] Fix | Delete

return $countryBlocks['bypassRedirDest'];

[394] Fix | Delete

}

[395] Fix | Delete

return false;

[396] Fix | Delete

}

[397] Fix | Delete

[398] Fix | Delete

protected function checkForBlockedCountry($countryBlock, $ip, $bareRequestURI) {

[399] Fix | Delete

try {

[400] Fix | Delete

$homeURL = wfWAF::getInstance()->getStorageEngine()->getConfig('homeURL', null, 'synced');

[401] Fix | Delete

}

[402] Fix | Delete

catch (Exception $e) {

[403] Fix | Delete

//Do nothing

[404] Fix | Delete

}

[405] Fix | Delete

[406] Fix | Delete

$bareRequestURI = rtrim($bareRequestURI, '/\\');

[407] Fix | Delete

if ($country = $this->ip2Country($ip)) {

[408] Fix | Delete

$blocks = $countryBlock['blocks'];

[409] Fix | Delete

foreach ($blocks as $b) {

[410] Fix | Delete

foreach ($b['countries'] as $blocked) {

[411] Fix | Delete

if (strtoupper($blocked) == strtoupper($country)) {

[412] Fix | Delete

if ($countryBlock['action'] == 'redir') {

[413] Fix | Delete

$redirURL = $countryBlock['redirURL'];

[414] Fix | Delete

$eRedirHost = wfWAFUtils::extractHostname($redirURL);

[415] Fix | Delete

$isExternalRedir = false;

[416] Fix | Delete

if ($eRedirHost && $homeURL && $eRedirHost != wfWAFUtils::extractHostname($homeURL)) {

[417] Fix | Delete

$isExternalRedir = true;

[418] Fix | Delete

}

[419] Fix | Delete

[420] Fix | Delete

if ((!$isExternalRedir) && rtrim(wfWAFUtils::extractBareURI($redirURL), '/\\') == $bareRequestURI){ //Is this the URI we want to redirect to, then don't block it

[421] Fix | Delete

//Do nothing

[422] Fix | Delete

}

[423] Fix | Delete

else {

[424] Fix | Delete

return array('action' => self::WFWAF_BLOCK_COUNTRY_REDIR);

[425] Fix | Delete

}

[426] Fix | Delete

}

[427] Fix | Delete

else {

[428] Fix | Delete

return array('action' => self::WFWAF_BLOCK_COUNTRY);

[429] Fix | Delete

}

[430] Fix | Delete

}

[431] Fix | Delete

}

[432] Fix | Delete

}

[433] Fix | Delete

}

[434] Fix | Delete

[435] Fix | Delete

return false;

[436] Fix | Delete

}

[437] Fix | Delete

[438] Fix | Delete

protected function checkForWhitelisted($ip) {

[439] Fix | Delete

try {

[440] Fix | Delete

$pluginABSPATH = wfWAF::getInstance()->getStorageEngine()->getConfig('pluginABSPATH', null, 'synced');

[441] Fix | Delete

$serverIPsJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('serverIPs', null, 'synced');

[442] Fix | Delete

$whitelistedServiceIPsJSON = wfWAF::getInstance()->getStorageEngine()->getConfig('whitelistedServiceIPs', null, 'synced');

[443] Fix | Delete

}

[444] Fix | Delete

catch (Exception $e) {

[445] Fix | Delete

// Do nothing

[446] Fix | Delete

}

[447] Fix | Delete

[448] Fix | Delete

$serverIPs = @wfWAFUtils::json_decode($serverIPsJSON, true);

[449] Fix | Delete

if (is_array($serverIPs)) {

[450] Fix | Delete

if (

[451] Fix | Delete

(isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == realpath($pluginABSPATH . DIRECTORY_SEPARATOR . 'wp-cron.php')) || //Safe -- plugin will do a final check to make sure the cron constant is defined

[452] Fix | Delete

(!empty($_GET['wordfence_syncAttackData'])) //Safe but plugin will do a final check to make sure it runs

[453] Fix | Delete

) {

[454] Fix | Delete

foreach ($serverIPs as $testIP) {

[455] Fix | Delete

if (wfWAFUtils::inet_pton($ip) == wfWAFUtils::inet_pton($testIP)) {

[456] Fix | Delete

return true;

[457] Fix | Delete

}

[458] Fix | Delete

}

[459] Fix | Delete

}

[460] Fix | Delete

}

[461] Fix | Delete

[462] Fix | Delete

$whitelistedServiceIPs = @wfWAFUtils::json_decode($whitelistedServiceIPsJSON, true);

[463] Fix | Delete

if (is_array($whitelistedServiceIPs)) {

[464] Fix | Delete

$wfIPWhitelist = $whitelistedServiceIPs;

[465] Fix | Delete

}

[466] Fix | Delete

else {

[467] Fix | Delete

$wordfenceLib = realpath(dirname(__FILE__) . '/../lib');

[468] Fix | Delete

include($wordfenceLib . '/wfIPWhitelist.php'); /** @var array $wfIPWhitelist */

[469] Fix | Delete

}

[470] Fix | Delete

[471] Fix | Delete

foreach ($wfIPWhitelist as $group) {

[472] Fix | Delete

foreach ($group as $subnet) {

[473] Fix | Delete

if ($subnet instanceof wfWAFUserIPRange) { //Not currently reached

[474] Fix | Delete

if ($subnet->isIPInRange($ip)) {

[475] Fix | Delete

return true;

[476] Fix | Delete

}

[477] Fix | Delete

} elseif (wfWAFUtils::subnetContainsIP($subnet, $ip)) {

[478] Fix | Delete

return true;

[479] Fix | Delete

}

[480] Fix | Delete

}

[481] Fix | Delete

}

[482] Fix | Delete

return false;

[483] Fix | Delete

}

[484] Fix | Delete

[485] Fix | Delete

protected function ip2Country($ip) {

[486] Fix | Delete

/**

[487] Fix | Delete

* It's possible this class is already loaded from a different installation of the plugin

[488] Fix | Delete

* by the time this is reached. See wfUtils::requireIpLocator for additional details.

[489] Fix | Delete

*/

[490] Fix | Delete

if (!class_exists('wfIpLocator'))

[491] Fix | Delete

require_once __DIR__ . '/../lib/wfIpLocator.php';

[492] Fix | Delete

return wfIpLocator::getInstance()->getCountryCode($ip);

[493] Fix | Delete

}

[494] Fix | Delete

[495] Fix | Delete

/**

[496] Fix | Delete

* Returns whether or not the site should be treated as if it's full-time SSL.

[497] Fix | Delete

*

[498] Fix | Delete

* @return bool

[499] Fix | Delete