<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WordfenceLS;

[2] Fix | Delete

[3] Fix | Delete

use WordfenceLS\Crypto\Model_JWT;

[4] Fix | Delete

use WordfenceLS\Crypto\Model_Symmetric;

[5] Fix | Delete

[6] Fix | Delete

class Controller_AJAX {

[7] Fix | Delete

[8] Fix | Delete

const MAX_USERS_TO_NOTIFY = 100;

[9] Fix | Delete

[10] Fix | Delete

protected $_actions = null; //Populated on init

[11] Fix | Delete

[12] Fix | Delete

/**

[13] Fix | Delete

* Returns the singleton Controller_AJAX.

[14] Fix | Delete

*

[15] Fix | Delete

* @return Controller_AJAX

[16] Fix | Delete

*/

[17] Fix | Delete

public static function shared() {

[18] Fix | Delete

static $_shared = null;

[19] Fix | Delete

if ($_shared === null) {

[20] Fix | Delete

$_shared = new Controller_AJAX();

[21] Fix | Delete

}

[22] Fix | Delete

return $_shared;

[23] Fix | Delete

}

[24] Fix | Delete

[25] Fix | Delete

public function init() {

[26] Fix | Delete

$this->_actions = array(

[27] Fix | Delete

'authenticate' => array(

[28] Fix | Delete

'handler' => array($this, '_ajax_authenticate_callback'),

[29] Fix | Delete

'nopriv' => true,

[30] Fix | Delete

'nonce' => false,

[31] Fix | Delete

'permissions' => array(), //Format is 'permission' => 'error message'

[32] Fix | Delete

'required_parameters' => array(),

[33] Fix | Delete

),

[34] Fix | Delete

'register_support' => array(

[35] Fix | Delete

'handler' => array($this, '_ajax_register_support_callback'),

[36] Fix | Delete

'nopriv' => true,

[37] Fix | Delete

'nonce' => false,

[38] Fix | Delete

'permissions' => array(),

[39] Fix | Delete

'required_parameters' => array('wfls-message-nonce', 'wfls-message'),

[40] Fix | Delete

),

[41] Fix | Delete

'activate' => array(

[42] Fix | Delete

'handler' => array($this, '_ajax_activate_callback'),

[43] Fix | Delete

'permissions' => array(),

[44] Fix | Delete

'required_parameters' => array('nonce', 'secret', 'recovery', 'code', 'user'),

[45] Fix | Delete

),

[46] Fix | Delete

'deactivate' => array(

[47] Fix | Delete

'handler' => array($this, '_ajax_deactivate_callback'),

[48] Fix | Delete

'permissions' => array(),

[49] Fix | Delete

'required_parameters' => array('nonce', 'user'),

[50] Fix | Delete

),

[51] Fix | Delete

'regenerate' => array(

[52] Fix | Delete

'handler' => array($this, '_ajax_regenerate_callback'),

[53] Fix | Delete

'permissions' => array(),

[54] Fix | Delete

'required_parameters' => array('nonce', 'user'),

[55] Fix | Delete

),

[56] Fix | Delete

'save_options' => array(

[57] Fix | Delete

'handler' => array($this, '_ajax_save_options_callback'),

[58] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to change options.', 'wordfence'); }), //These are deliberately written as closures to be executed later so that WP doesn't load the translations too early, which can cause it not to pick up user-specific language settings

[59] Fix | Delete

'required_parameters' => array('nonce', 'changes'),

[60] Fix | Delete

),

[61] Fix | Delete

'send_grace_period_notification' => array(

[62] Fix | Delete

'handler' => array($this, '_ajax_send_grace_period_notification_callback'),

[63] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to send notifications.', 'wordfence'); }),

[64] Fix | Delete

'required_parameters' => array('nonce', 'role', 'url'),

[65] Fix | Delete

),

[66] Fix | Delete

'update_ip_preview' => array(

[67] Fix | Delete

'handler' => array($this, '_ajax_update_ip_preview_callback'),

[68] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to change options.', 'wordfence'); }),

[69] Fix | Delete

'required_parameters' => array('nonce', 'ip_source', 'ip_source_trusted_proxies'),

[70] Fix | Delete

),

[71] Fix | Delete

'dismiss_notice' => array(

[72] Fix | Delete

'handler' => array($this, '_ajax_dismiss_notice_callback'),

[73] Fix | Delete

'permissions' => array(),

[74] Fix | Delete

'required_parameters' => array('nonce', 'id'),

[75] Fix | Delete

),

[76] Fix | Delete

'reset_recaptcha_stats' => array(

[77] Fix | Delete

'handler' => array($this, '_ajax_reset_recaptcha_stats_callback'),

[78] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset reCAPTCHA statistics.', 'wordfence'); }),

[79] Fix | Delete

'required_parameters' => array('nonce'),

[80] Fix | Delete

),

[81] Fix | Delete

'reset_2fa_grace_period' => array (

[82] Fix | Delete

'handler' => array($this, '_ajax_reset_2fa_grace_period_callback'),

[83] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset the 2FA grace period.', 'wordfence'); }),

[84] Fix | Delete

'required_parameters' => array('nonce', 'user_id')

[85] Fix | Delete

),

[86] Fix | Delete

'revoke_2fa_grace_period' => array (

[87] Fix | Delete

'handler' => array($this, '_ajax_revoke_2fa_grace_period_callback'),

[88] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to revoke the 2FA grace period.', 'wordfence'); }),

[89] Fix | Delete

'required_parameters' => array('nonce', 'user_id')

[90] Fix | Delete

),

[91] Fix | Delete

'reset_ntp_failure_count' => array(

[92] Fix | Delete

'handler' => array($this, '_ajax_reset_ntp_failure_count_callback'),

[93] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to reset the NTP failure count.', 'wordfence'); }),

[94] Fix | Delete

'required_parameters' => array(),

[95] Fix | Delete

),

[96] Fix | Delete

'disable_ntp' => array(

[97] Fix | Delete

'handler' => array($this, '_ajax_disable_ntp_callback'),

[98] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to disable NTP.', 'wordfence'); }),

[99] Fix | Delete

'required_parameters' => array(),

[100] Fix | Delete

),

[101] Fix | Delete

'dismiss_persistent_notice' => array(

[102] Fix | Delete

'handler' => array($this, '_ajax_dismiss_persistent_notice_callback'),

[103] Fix | Delete

'permissions' => array(Controller_Permissions::CAP_MANAGE_SETTINGS => function() { return __('You do not have permission to dismiss this notice.', 'wordfence'); }),

[104] Fix | Delete

'required_parameters' => array('nonce', 'notice_id')

[105] Fix | Delete

)

[106] Fix | Delete

);

[107] Fix | Delete

[108] Fix | Delete

$this->_init_actions();

[109] Fix | Delete

}

[110] Fix | Delete

[111] Fix | Delete

public function _init_actions() {

[112] Fix | Delete

foreach ($this->_actions as $action => $parameters) {

[113] Fix | Delete

if (isset($parameters['nopriv']) && $parameters['nopriv']) {

[114] Fix | Delete

add_action('wp_ajax_nopriv_wordfence_ls_' . $action, array($this, '_ajax_handler'));

[115] Fix | Delete

}

[116] Fix | Delete

add_action('wp_ajax_wordfence_ls_' . $action, array($this, '_ajax_handler'));

[117] Fix | Delete

}

[118] Fix | Delete

}

[119] Fix | Delete

[120] Fix | Delete

/**

[121] Fix | Delete

* This is a convenience function for sending a JSON response and ensuring that execution stops after sending

[122] Fix | Delete

* since wp_die() can be interrupted.

[123] Fix | Delete

*

[124] Fix | Delete

* @param $response

[125] Fix | Delete

* @param int|null $status_code

[126] Fix | Delete

*/

[127] Fix | Delete

public static function send_json($response, $status_code = null) {

[128] Fix | Delete

wp_send_json($response, $status_code);

[129] Fix | Delete

die();

[130] Fix | Delete

}

[131] Fix | Delete

[132] Fix | Delete

public function _ajax_handler() {

[133] Fix | Delete

$action = (isset($_POST['action']) && is_string($_POST['action']) && $_POST['action']) ? $_POST['action'] : $_GET['action'];

[134] Fix | Delete

if (preg_match('~wordfence_ls_([a-zA-Z_0-9]+)$~', $action, $matches)) {

[135] Fix | Delete

$action = $matches[1];

[136] Fix | Delete

if (!isset($this->_actions[$action])) {

[137] Fix | Delete

self::send_json(array('error' => esc_html__('An unknown action was provided.', 'wordfence')));

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

$parameters = $this->_actions[$action];

[141] Fix | Delete

if (!empty($parameters['required_parameters'])) {

[142] Fix | Delete

foreach ($parameters['required_parameters'] as $k) {

[143] Fix | Delete

if (!isset($_POST[$k])) {

[144] Fix | Delete

self::send_json(array('error' => esc_html__('An expected parameter was not provided.', 'wordfence')));

[145] Fix | Delete

}

[146] Fix | Delete

}

[147] Fix | Delete

}

[148] Fix | Delete

[149] Fix | Delete

if (!isset($parameters['nonce']) || $parameters['nonce']) {

[150] Fix | Delete

$nonce = (isset($_POST['nonce']) && is_string($_POST['nonce']) && $_POST['nonce']) ? $_POST['nonce'] : $_GET['nonce'];

[151] Fix | Delete

if (!is_string($nonce) || !wp_verify_nonce($nonce, 'wp-ajax')) {

[152] Fix | Delete

self::send_json(array('error' => esc_html__('Your browser sent an invalid security token. Please try reloading this page.', 'wordfence'), 'tokenInvalid' => 1));

[153] Fix | Delete

}

[154] Fix | Delete

}

[155] Fix | Delete

[156] Fix | Delete

if (!empty($parameters['permissions'])) {

[157] Fix | Delete

$user = wp_get_current_user();

[158] Fix | Delete

foreach ($parameters['permissions'] as $permission => $error) {

[159] Fix | Delete

if (!user_can($user, $permission)) {

[160] Fix | Delete

self::send_json(array('error' => $error()));

[161] Fix | Delete

}

[162] Fix | Delete

}

[163] Fix | Delete

}

[164] Fix | Delete

[165] Fix | Delete

call_user_func($parameters['handler']);

[166] Fix | Delete

}

[167] Fix | Delete

}

[168] Fix | Delete

[169] Fix | Delete

public function _ajax_authenticate_callback() {

[170] Fix | Delete

$credentialKeys = array(

[171] Fix | Delete

'log' => 'pwd',

[172] Fix | Delete

'username' => 'password'

[173] Fix | Delete

);

[174] Fix | Delete

$username = null;

[175] Fix | Delete

$password = null;

[176] Fix | Delete

foreach ($credentialKeys as $usernameKey => $passwordKey) {

[177] Fix | Delete

if (array_key_exists($usernameKey, $_POST) && array_key_exists($passwordKey, $_POST) && is_string($_POST[$usernameKey]) && is_string($_POST[$passwordKey])) {

[178] Fix | Delete

$username = $_POST[$usernameKey];

[179] Fix | Delete

$password = $_POST[$passwordKey];

[180] Fix | Delete

break;

[181] Fix | Delete

}

[182] Fix | Delete

}

[183] Fix | Delete

if (empty($username) || empty($password)) {

[184] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: A username and password must be provided. <a href="%s" title="Password Lost and Found">Lost your password</a>?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())))));

[185] Fix | Delete

}

[186] Fix | Delete

[187] Fix | Delete

$legacy2FAActive = Controller_WordfenceLS::shared()->legacy_2fa_active();

[188] Fix | Delete

if ($legacy2FAActive) { //Legacy 2FA is active, pass it on to the authenticate filter

[189] Fix | Delete

self::send_json(array('login' => 1));

[190] Fix | Delete

}

[191] Fix | Delete

[192] Fix | Delete

do_action_ref_array('wp_authenticate', array(&$username, &$password));

[193] Fix | Delete

[194] Fix | Delete

define('WORDFENCE_LS_AUTHENTICATION_CHECK', true); //Prevents our auth filter from recursing

[195] Fix | Delete

$user = wp_authenticate($username, $password);

[196] Fix | Delete

if (is_object($user) && ($user instanceof \WP_User)) {

[197] Fix | Delete

if (!Controller_Users::shared()->has_2fa_active($user) || Controller_Whitelist::shared()->is_whitelisted(Model_Request::current()->ip()) || Controller_Users::shared()->has_remembered_2fa($user) || defined('WORDFENCE_LS_COMBINED_IS_VALID')) { //Not enabled for this user, is whitelisted, has a valid remembered cookie, or has already provided a 2FA code via the password field pass the credentials on to the normal login flow

[198] Fix | Delete

self::send_json(array('login' => 1));

[199] Fix | Delete

}

[200] Fix | Delete

self::send_json(array('login' => 1, 'two_factor_required' => true));

[201] Fix | Delete

}

[202] Fix | Delete

else if (is_wp_error($user)) {

[203] Fix | Delete

$errors = array();

[204] Fix | Delete

$messages = array();

[205] Fix | Delete

$reset = false;

[206] Fix | Delete

foreach ($user->get_error_codes() as $code) {

[207] Fix | Delete

if ($code == 'invalid_username' || $code == 'invalid_email' || $code == 'incorrect_password' || $code == 'authentication_failed') {

[208] Fix | Delete

$errors[] = wp_kses(sprintf(__('<strong>ERROR</strong>: The username or password you entered is incorrect. <a href="%s" title="Password Lost and Found">Lost your password</a>?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())));

[209] Fix | Delete

}

[210] Fix | Delete

else {

[211] Fix | Delete

if ($code == 'wfls_twofactor_invalid') {

[212] Fix | Delete

$reset = true;

[213] Fix | Delete

}

[214] Fix | Delete

[215] Fix | Delete

$severity = $user->get_error_data($code);

[216] Fix | Delete

foreach ($user->get_error_messages($code) as $error_message) {

[217] Fix | Delete

if ($severity == 'message') {

[218] Fix | Delete

$messages[] = $error_message;

[219] Fix | Delete

}

[220] Fix | Delete

else {

[221] Fix | Delete

$errors[] = $error_message;

[222] Fix | Delete

}

[223] Fix | Delete

}

[224] Fix | Delete

}

[225] Fix | Delete

}

[226] Fix | Delete

[227] Fix | Delete

if (!empty($errors)) {

[228] Fix | Delete

$errors = implode('<br>', $errors);

[229] Fix | Delete

$errors = apply_filters('login_errors', $errors);

[230] Fix | Delete

self::send_json(array('error' => $errors, 'reset' => $reset));

[231] Fix | Delete

}

[232] Fix | Delete

[233] Fix | Delete

if (!empty($messages)) {

[234] Fix | Delete

$messages = implode('<br>', $messages);

[235] Fix | Delete

$messages = apply_filters('login_errors', $messages);

[236] Fix | Delete

self::send_json(array('message' => $messages, 'reset' => $reset));

[237] Fix | Delete

}

[238] Fix | Delete

}

[239] Fix | Delete

[240] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: The username or password you entered is incorrect. <a href="%s" title="Password Lost and Found">Lost your password</a>?', 'wordfence'), wp_lostpassword_url()), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array())))));

[241] Fix | Delete

}

[242] Fix | Delete

[243] Fix | Delete

public function _ajax_register_support_callback() {

[244] Fix | Delete

$email = null;

[245] Fix | Delete

if (array_key_exists('email', $_POST) && is_string($_POST['email'])) {

[246] Fix | Delete

$email = $_POST['email'];

[247] Fix | Delete

}

[248] Fix | Delete

else if (array_key_exists('user_email', $_POST) && is_string($_POST['user_email'])) {

[249] Fix | Delete

$email = $_POST['user_email'];

[250] Fix | Delete

}

[251] Fix | Delete

if (

[252] Fix | Delete

$email === null ||

[253] Fix | Delete

!isset($_POST['wfls-message']) || !is_string($_POST['wfls-message']) ||

[254] Fix | Delete

!isset($_POST['wfls-message-nonce']) || !is_string($_POST['wfls-message-nonce'])) {

[255] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));

[256] Fix | Delete

}

[257] Fix | Delete

[258] Fix | Delete

$email = sanitize_email($email);

[259] Fix | Delete

$login = '';

[260] Fix | Delete

if (array_key_exists('user_login', $_POST) && is_string($_POST['user_login']))

[261] Fix | Delete

$login = sanitize_user($_POST['user_login']);

[262] Fix | Delete

$message = strip_tags($_POST['wfls-message']);

[263] Fix | Delete

$nonce = $_POST['wfls-message-nonce'];

[264] Fix | Delete

[265] Fix | Delete

if ((isset($_POST['user_login']) && empty($login)) || empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL) || empty($message)) {

[266] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));

[267] Fix | Delete

}

[268] Fix | Delete

[269] Fix | Delete

$jwt = Model_JWT::decode_jwt($_POST['wfls-message-nonce']);

[270] Fix | Delete

if ($jwt && isset($jwt->payload['ip']) && isset($jwt->payload['score'])) {

[271] Fix | Delete

$decryptedIP = Model_Symmetric::decrypt($jwt->payload['ip']);

[272] Fix | Delete

$decryptedScore = Model_Symmetric::decrypt($jwt->payload['score']);

[273] Fix | Delete

if ($decryptedIP === false || $decryptedScore === false || Model_IP::inet_pton($decryptedIP) !== Model_IP::inet_pton(Model_Request::current()->ip())) { //JWT IP and the current request's IP don't match, refuse the message

[274] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));

[275] Fix | Delete

}

[276] Fix | Delete

[277] Fix | Delete

$identifier = bin2hex(Model_IP::inet_pton($decryptedIP));

[278] Fix | Delete

$tokenBucket = new Model_TokenBucket('rate:' . $identifier, 2, 1 / (6 * Model_TokenBucket::HOUR)); //Maximum of two requests, refilling at a rate of one per six hours

[279] Fix | Delete

if (!$tokenBucket->consume(1)) {

[280] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: Unable to send message. You have exceeded the maximum number of messages that may be sent at this time. Please try again later.', 'wordfence')), array('strong'=>array()))));

[281] Fix | Delete

}

[282] Fix | Delete

[283] Fix | Delete

$email = array(

[284] Fix | Delete

'to' => get_site_option('admin_email'),

[285] Fix | Delete

'subject' => __('Blocked User Registration Contact Form', 'wordfence'),

[286] Fix | Delete

'body' => sprintf(__("A visitor blocked from registration sent the following message.\n\n----------------------------------------\n\nIP: %s\nUsername: %s\nEmail: %s\nreCAPTCHA Score: %f\n\n----------------------------------------\n\n%s", 'wordfence'), $decryptedIP, $login, $email, $decryptedScore, $message),

[287] Fix | Delete

'headers' => '',

[288] Fix | Delete

);

[289] Fix | Delete

$success = wp_mail($email['to'], $email['subject'], $email['body'], $email['headers']);

[290] Fix | Delete

if ($success) {

[291] Fix | Delete

self::send_json(array('message' => wp_kses(sprintf(__('<strong>MESSAGE SENT</strong>: Your message was sent to the site owner.', 'wordfence')), array('strong'=>array()))));

[292] Fix | Delete

}

[293] Fix | Delete

[294] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: An error occurred while sending the message. Please try again.', 'wordfence')), array('strong'=>array()))));

[295] Fix | Delete

}

[296] Fix | Delete

[297] Fix | Delete

self::send_json(array('error' => wp_kses(sprintf(__('<strong>ERROR</strong>: Unable to send message. Please refresh the page and try again.', 'wordfence')), array('strong'=>array()))));

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

public function _ajax_activate_callback() {

[301] Fix | Delete

$userID = (int) @$_POST['user'];

[302] Fix | Delete

$user = wp_get_current_user();

[303] Fix | Delete

if ($user->ID != $userID) {

[304] Fix | Delete

if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {

[305] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to activate the given user.', 'wordfence')));

[306] Fix | Delete

}

[307] Fix | Delete

else {

[308] Fix | Delete

$user = new \WP_User($userID);

[309] Fix | Delete

if (!$user->exists()) {

[310] Fix | Delete

self::send_json(array('error' => esc_html__('The given user does not exist.', 'wordfence')));

[311] Fix | Delete

}

[312] Fix | Delete

}

[313] Fix | Delete

}

[314] Fix | Delete

else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {

[315] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to activate 2FA.', 'wordfence')));

[316] Fix | Delete

}

[317] Fix | Delete

[318] Fix | Delete

if (Controller_Users::shared()->has_2fa_active($user)) {

[319] Fix | Delete

self::send_json(array('error' => esc_html__('The given user already has two-factor authentication active.', 'wordfence')));

[320] Fix | Delete

}

[321] Fix | Delete

[322] Fix | Delete

$matches = (isset($_POST['secret']) && isset($_POST['code']) && is_string($_POST['secret']) && is_string($_POST['code']) && Controller_TOTP::shared()->check_code($_POST['secret'], $_POST['code']));

[323] Fix | Delete

if ($matches === false) {

[324] Fix | Delete

self::send_json(array('error' => esc_html__('The code provided does not match the expected value. Please verify that the time on your authenticator device is correct and that this server\'s time is correct.', 'wordfence')));

[325] Fix | Delete

}

[326] Fix | Delete

[327] Fix | Delete

Controller_TOTP::shared()->activate_2fa($user, $_POST['secret'], $_POST['recovery'], $matches);

[328] Fix | Delete

Controller_Notices::shared()->remove_notice(false, 'wfls-will-be-required', $user);

[329] Fix | Delete

self::send_json(array('activated' => 1, 'text' => sprintf(count($_POST['recovery']) == 1 ? esc_html__('%d unused recovery code remains. You may generate a new set by clicking below.', 'wordfence') : esc_html__('%d unused recovery codes remain. You may generate a new set by clicking below.', 'wordfence'), count($_POST['recovery']))));

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

public function _ajax_deactivate_callback() {

[333] Fix | Delete

$userID = (int) @$_POST['user'];

[334] Fix | Delete

$user = wp_get_current_user();

[335] Fix | Delete

if ($user->ID != $userID) {

[336] Fix | Delete

if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {

[337] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to deactivate the given user.', 'wordfence')));

[338] Fix | Delete

}

[339] Fix | Delete

else {

[340] Fix | Delete

$user = new \WP_User($userID);

[341] Fix | Delete

if (!$user->exists()) {

[342] Fix | Delete

self::send_json(array('error' => esc_html__('The user does not exist.', 'wordfence')));

[343] Fix | Delete

}

[344] Fix | Delete

}

[345] Fix | Delete

}

[346] Fix | Delete

else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {

[347] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to deactivate 2FA.', 'wordfence')));

[348] Fix | Delete

}

[349] Fix | Delete

[350] Fix | Delete

if (!Controller_Users::shared()->has_2fa_active($user)) {

[351] Fix | Delete

self::send_json(array('error' => esc_html__('The user specified does not have two-factor authentication active.', 'wordfence')));

[352] Fix | Delete

}

[353] Fix | Delete

[354] Fix | Delete

Controller_Users::shared()->deactivate_2fa($user);

[355] Fix | Delete

self::send_json(array('deactivated' => 1));

[356] Fix | Delete

}

[357] Fix | Delete

[358] Fix | Delete

public function _ajax_regenerate_callback() {

[359] Fix | Delete

$userID = (int) @$_POST['user'];

[360] Fix | Delete

$user = wp_get_current_user();

[361] Fix | Delete

if ($user->ID != $userID) {

[362] Fix | Delete

if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_OTHERS)) {

[363] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to generate new recovery codes for the given user.', 'wordfence')));

[364] Fix | Delete

}

[365] Fix | Delete

else {

[366] Fix | Delete

$user = new \WP_User($userID);

[367] Fix | Delete

if (!$user->exists()) {

[368] Fix | Delete

self::send_json(array('error' => esc_html__('The user does not exist.', 'wordfence')));

[369] Fix | Delete

}

[370] Fix | Delete

}

[371] Fix | Delete

}

[372] Fix | Delete

else if (!user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF)) {

[373] Fix | Delete

self::send_json(array('error' => esc_html__('You do not have permission to generate new recovery codes.', 'wordfence')));

[374] Fix | Delete

}

[375] Fix | Delete

[376] Fix | Delete

if (!Controller_Users::shared()->has_2fa_active($user)) {

[377] Fix | Delete

self::send_json(array('error' => esc_html__('The user specified does not have two-factor authentication active.', 'wordfence')));

[378] Fix | Delete

}

[379] Fix | Delete

[380] Fix | Delete

$codes = Controller_Users::shared()->regenerate_recovery_codes($user);

[381] Fix | Delete

self::send_json(array('regenerated' => 1, 'recovery' => array_map(function($r) { return implode(' ', str_split(bin2hex($r), 4)); }, $codes), 'text' => sprintf(count($codes) == 1 ? esc_html__('%d unused recovery code remains. You may generate a new set by clicking below.', 'wordfence') : esc_html__('%d unused recovery codes remain. You may generate a new set by clicking below.', 'wordfence'), count($codes))));

[382] Fix | Delete

}

[383] Fix | Delete

[384] Fix | Delete

public function _ajax_save_options_callback() {

[385] Fix | Delete

if (!empty($_POST['changes']) && is_string($_POST['changes']) && is_array($changes = json_decode(stripslashes($_POST['changes']), true))) {

[386] Fix | Delete

try {

[387] Fix | Delete

$errors = Controller_Settings::shared()->validate_multiple($changes);

[388] Fix | Delete

if ($errors !== true) {

[389] Fix | Delete

if (count($errors) == 1) {

[390] Fix | Delete

$e = array_shift($errors);

[391] Fix | Delete

self::send_json(array('error' => esc_html(sprintf(__('An error occurred while saving the configuration: %s', 'wordfence'), $e))));

[392] Fix | Delete

}

[393] Fix | Delete

else if (count($errors) > 1) {

[394] Fix | Delete

$compoundMessage = array();

[395] Fix | Delete

foreach ($errors as $e) {

[396] Fix | Delete

$compoundMessage[] = esc_html($e);

[397] Fix | Delete

}

[398] Fix | Delete

self::send_json(array(

[399] Fix | Delete

'error' => wp_kses(sprintf(__('Errors occurred while saving the configuration: %s', 'wordfence'), '<ul><li>' . implode('</li><li>', $compoundMessage) . '</li></ul>'), array('ul'=>array(), 'li'=>array())),

[400] Fix | Delete

'html' => true,

[401] Fix | Delete

));

[402] Fix | Delete

}

[403] Fix | Delete

[404] Fix | Delete

self::send_json(array(

[405] Fix | Delete

'error' => esc_html__('Errors occurred while saving the configuration.', 'wordfence'),

[406] Fix | Delete

));

[407] Fix | Delete

}

[408] Fix | Delete

[409] Fix | Delete

Controller_Settings::shared()->set_multiple($changes);

[410] Fix | Delete

[411] Fix | Delete

if (array_key_exists(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_ACCOUNT_INTEGRATION, $changes) || array_key_exists(Controller_Settings::OPTION_ENABLE_WOOCOMMERCE_INTEGRATION, $changes))

[412] Fix | Delete

Controller_WordfenceLS::shared()->refresh_rewrite_rules();

[413] Fix | Delete

[414] Fix | Delete

$response = array('success' => true);

[415] Fix | Delete

return self::send_json($response);

[416] Fix | Delete

}

[417] Fix | Delete

catch (\Exception $e) {

[418] Fix | Delete

self::send_json(array(

[419] Fix | Delete

'error' => $e->getMessage(),

[420] Fix | Delete

));

[421] Fix | Delete

}

[422] Fix | Delete

}

[423] Fix | Delete

[424] Fix | Delete

self::send_json(array(

[425] Fix | Delete

'error' => esc_html__('No configuration changes were provided to save.', 'wordfence'),

[426] Fix | Delete

));

[427] Fix | Delete

}

[428] Fix | Delete

[429] Fix | Delete

public function _ajax_send_grace_period_notification_callback() {

[430] Fix | Delete

$notifyAll = isset($_POST['notify_all']);

[431] Fix | Delete

$users = Controller_Users::shared()->get_users_by_role($_POST['role'], $notifyAll ? null: self::MAX_USERS_TO_NOTIFY + 1);

[432] Fix | Delete

$url = $_POST['url'];

[433] Fix | Delete

if (!empty($url)) {

[434] Fix | Delete

$url = get_site_url(null, $url);

[435] Fix | Delete

if (filter_var($url, FILTER_VALIDATE_URL) === false) {

[436] Fix | Delete

self::send_json(array('error' => esc_html__('The specified URL is invalid.', 'wordfence')));

[437] Fix | Delete

}

[438] Fix | Delete

}

[439] Fix | Delete

$userCount = count($users);

[440] Fix | Delete

if (!$notifyAll && $userCount > self::MAX_USERS_TO_NOTIFY)

[441] Fix | Delete

self::send_json(array('error' => esc_html(sprintf(__('More than %d users exist for the selected role. This notification is not designed to handle large groups of users. In such instances, using a different solution for notifying users of upcoming 2FA requirements is recommended.', 'wordfence'), self::MAX_USERS_TO_NOTIFY)), 'limit_exceeded' => true));

[442] Fix | Delete

$sent = 0;

[443] Fix | Delete

foreach ($users as $user) {

[444] Fix | Delete

Controller_Users::shared()->requires_2fa($user, $inGracePeriod, $requiredAt);

[445] Fix | Delete

if ($inGracePeriod && !Controller_Users::shared()->has_2fa_active($user)) {

[446] Fix | Delete

$subject = sprintf(__('2FA will soon be required on %s', 'wordfence'), home_url());

[447] Fix | Delete

$requiredDate = Controller_Time::format_local_time('F j, Y g:i A', $requiredAt);

[448] Fix | Delete

if (empty($url)) {

[449] Fix | Delete

$userUrl = (is_multisite() && is_super_admin($user->ID)) ? network_admin_url('admin.php?page=WFLS') : admin_url('admin.php?page=WFLS');

[450] Fix | Delete

}

[451] Fix | Delete

else {

[452] Fix | Delete

$userUrl = $url;

[453] Fix | Delete

}

[454] Fix | Delete

[455] Fix | Delete

$message = sprintf(

[456] Fix | Delete

__("<html><body><p>You do not currently have two-factor authentication active on your account, which will be required beginning %s.</p><p><a href=\"%s\">Configure 2FA</a></p></body></html>", 'wordfence'),

[457] Fix | Delete

$requiredDate,

[458] Fix | Delete

htmlentities($userUrl)

[459] Fix | Delete

);

[460] Fix | Delete

[461] Fix | Delete

wp_mail($user->user_email, $subject, $message, array('Content-Type: text/html'));

[462] Fix | Delete

$sent++;

[463] Fix | Delete

}

[464] Fix | Delete

}

[465] Fix | Delete

[466] Fix | Delete

if ($userCount == 0) {

[467] Fix | Delete

self::send_json(array('error' => esc_html__('No users currently exist with the selected role.', 'wordfence')));

[468] Fix | Delete

}

[469] Fix | Delete

else if ($sent == 0) {

[470] Fix | Delete

self::send_json(array('confirmation' => esc_html__('All users with the selected role already have two-factor authentication activated or have been locked out.', 'wordfence')));

[471] Fix | Delete

}

[472] Fix | Delete

else if ($sent == 1) {

[473] Fix | Delete

self::send_json(array('confirmation' => esc_html(sprintf(__('A reminder to activate two-factor authentication was sent to %d user.', 'wordfence'), $sent))));

[474] Fix | Delete

}

[475] Fix | Delete

self::send_json(array('confirmation' => esc_html(sprintf(__('A reminder to activate two-factor authentication was sent to %d users.', 'wordfence'), $sent))));

[476] Fix | Delete

}

[477] Fix | Delete

[478] Fix | Delete

public function _ajax_update_ip_preview_callback() {

[479] Fix | Delete

$source = $_POST['ip_source'];

[480] Fix | Delete

$raw_proxies = $_POST['ip_source_trusted_proxies'];

[481] Fix | Delete

if (!is_string($source) || !is_string($raw_proxies)) {

[482] Fix | Delete

die();

[483] Fix | Delete

}

[484] Fix | Delete

[485] Fix | Delete

$valid = array();

[486] Fix | Delete

$invalid = array();

[487] Fix | Delete

$test = preg_split('/[\r\n,]+/', $raw_proxies);

[488] Fix | Delete

foreach ($test as $value) {

[489] Fix | Delete

if (strlen($value) > 0) {

[490] Fix | Delete

if (Model_IP::is_valid_ip($value) || Model_IP::is_valid_cidr_range($value)) {

[491] Fix | Delete

$valid[] = $value;

[492] Fix | Delete

}

[493] Fix | Delete

else {

[494] Fix | Delete

$invalid[] = $value;

[495] Fix | Delete

}

[496] Fix | Delete

}

[497] Fix | Delete

}

[498] Fix | Delete

$trusted_proxies = $valid;

[499] Fix | Delete