From 8064b2e417c9bfb9db3f040c38fcc895bc8c11ba Mon Sep 17 00:00:00 2001 From: Richy Date: Tue, 22 Aug 2017 14:40:56 +0200 Subject: [PATCH] LoginLockdown --- .../plugins/login-lockdown/license.txt | 280 +++++++++ .../plugins/login-lockdown/loginlockdown.php | 569 ++++++++++++++++++ .../plugins/login-lockdown/readme.txt | 77 +++ .../plugins/login-lockdown/version.txt | 1 + 4 files changed, 927 insertions(+) create mode 100644 pole-sbv-content/plugins/login-lockdown/license.txt create mode 100644 pole-sbv-content/plugins/login-lockdown/loginlockdown.php create mode 100644 pole-sbv-content/plugins/login-lockdown/readme.txt create mode 100644 pole-sbv-content/plugins/login-lockdown/version.txt diff --git a/pole-sbv-content/plugins/login-lockdown/license.txt b/pole-sbv-content/plugins/login-lockdown/license.txt new file mode 100644 index 00000000..b5fcfa6e --- /dev/null +++ b/pole-sbv-content/plugins/login-lockdown/license.txt @@ -0,0 +1,280 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc. + 675 Mass Ave, Cambridge, MA 02139, USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Library General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + diff --git a/pole-sbv-content/plugins/login-lockdown/loginlockdown.php b/pole-sbv-content/plugins/login-lockdown/loginlockdown.php new file mode 100644 index 00000000..5fda07ca --- /dev/null +++ b/pole-sbv-content/plugins/login-lockdown/loginlockdown.php @@ -0,0 +1,569 @@ +Bad Neighborhood. +*/ + +/* +== Change Log == +* +* ver. 1.7.1 13-Sep-2016 +* - fixed bug causing all ipv6 addresses to get locked out if 1 was +* - added in WordPress MultiSite functionality +* - fixed bug where subnets could be overly matched, causing more IPs to be blocked than intended +* - moved the report for locked out IP addresses to its own tab +* +* ver. 1.6.1 8-Mar-2014 +* - fixed html glitch preventing options from being saved +* +* ver. 1.6 7-Mar-2014 +* - cleaned up deprecated functions +* - fixed bug with invalid property on a non-object when locking out invalid usernames +* - fixed utilization of $wpdb->prepare +* - added more descriptive help text to each of the options +* - added the ability to remove the "Login form protected by Login LockDown." message from within the dashboard +* +* ver. 1.5 17-Sep-2009 +* - implemented wp_nonce security in the options and lockdown release forms in the admin screen +* - fixed a security hole with an improperly escaped SQL query +* - encoded certain outputs in the admin panel using esc_attr() to prevent XSS attacks +* - fixed an issue with the 'Lockout Invalid Usernames' option not functioning as intended +* +* ver. 1.4 29-Aug-2009 +* - removed erroneous error affecting WP 2.8+ +* - fixed activation error caused by customizing the location of the wp-content folder +* - added in the option to mask which specific login error (invalid username or invalid password) was generated +* - added in the option to lock out failed login attempts even if the username doesn't exist +* +* ver. 1.3 23-Feb-2009 +* - adjusted positioning of plugin byline +* - allowed for dynamic location of plugin files +* +* ver. 1.2 15-Jun-2008 +* - now compatible with WordPress 2.5 and up only +* +* ver. 1.1 01-Sep-2007 +* - revised time query to MySQL 4.0 compatability +* +* ver. 1.0 29-Aug-2007 +* - released +*/ + +/* +== Installation == + +1. Extract the zip file into your plugins directory into its own folder. +2. Activate the plugin in the Plugin options. +3. Customize the settings from the Options panel, if desired. + +*/ + +/* +/--------------------------------------------------------------------\ +| | +| License: GPL | +| | +| Login LockDown - added security measures to WordPress intended to | +| inhibit or reduce brute force password discovery. | +| Copyright (C) 2007 - 2014, Michael VanDeMar, | +| http://www.bad-neighborhood.com | +| All rights reserved. | +| | +| This program is free software; you can redistribute it and/or | +| modify it under the terms of the GNU General Public License | +| as published by the Free Software Foundation; either version 2 | +| of the License, or (at your option) any later version. | +| | +| This program is distributed in the hope that it will be useful, | +| but WITHOUT ANY WARRANTY; without even the implied warranty of | +| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | +| GNU General Public License for more details. | +| | +| You should have received a copy of the GNU General Public License | +| along with this program; if not, write to the | +| Free Software Foundation, Inc. | +| 51 Franklin Street, Fifth Floor | +| Boston, MA 02110-1301, USA | +| | +\--------------------------------------------------------------------/ +*/ + +$loginlockdown_db_version = "1.0"; +$loginlockdownOptions = get_loginlockdownOptions(); + +function loginLockdown_install() { + global $wpdb; + global $loginlockdown_db_version; + $table_name = $wpdb->prefix . "login_fails"; + + if( $wpdb->get_var("SHOW TABLES LIKE '$table_name'") != $table_name ) { + $sql = "CREATE TABLE " . $table_name . " ( + `login_attempt_ID` bigint(20) NOT NULL AUTO_INCREMENT, + `user_id` bigint(20) NOT NULL, + `login_attempt_date` datetime NOT NULL default '0000-00-00 00:00:00', + `login_attempt_IP` varchar(100) NOT NULL default '', + PRIMARY KEY (`login_attempt_ID`) + );"; + + require_once(ABSPATH . 'wp-admin/includes/upgrade.php'); + dbDelta($sql); + } + + $table_name = $wpdb->prefix . "lockdowns"; + + if( $wpdb->get_var("SHOW TABLES LIKE '$table_name'") != $table_name ) { + $sql = "CREATE TABLE " . $table_name . " ( + `lockdown_ID` bigint(20) NOT NULL AUTO_INCREMENT, + `user_id` bigint(20) NOT NULL, + `lockdown_date` datetime NOT NULL default '0000-00-00 00:00:00', + `release_date` datetime NOT NULL default '0000-00-00 00:00:00', + `lockdown_IP` varchar(100) NOT NULL default '', + PRIMARY KEY (`lockdown_ID`) + );"; + + require_once(ABSPATH . 'wp-admin/includes/upgrade.php'); + dbDelta($sql); + } + add_option("loginlockdown_db_version", "1.0", "", "no"); + // added in 1.6, cleanup from previously improperly set db versions + delete_option( "loginlockdown_db1_version" ); + delete_option( "loginlockdown_db2_version" ); +} + +function countFails($username = "") { + global $wpdb; + global $loginlockdownOptions; + $table_name = $wpdb->prefix . "login_fails"; + $subnet = calc_subnet($_SERVER['REMOTE_ADDR']); + + $numFailsquery = "SELECT COUNT(login_attempt_ID) FROM $table_name " . + "WHERE login_attempt_date + INTERVAL " . + $loginlockdownOptions['retries_within'] . " MINUTE > now() AND " . + "login_attempt_IP LIKE '%s'"; + $numFailsquery = $wpdb->prepare( $numFailsquery, $subnet[1] . "%"); + + $numFails = $wpdb->get_var($numFailsquery); + return $numFails; +} + +function incrementFails($username = "") { + global $wpdb; + global $loginlockdownOptions; + $table_name = $wpdb->prefix . "login_fails"; + $subnet = calc_subnet($_SERVER['REMOTE_ADDR']); + + $username = sanitize_user($username); + $user = get_user_by('login',$username); + if ( $user || "yes" == $loginlockdownOptions['lockout_invalid_usernames'] ) { + if ( $user === false ) { + $user_id = -1; + } else { + $user_id = $user->ID; + } + $insert = "INSERT INTO " . $table_name . " (user_id, login_attempt_date, login_attempt_IP) " . + "VALUES ('" . $user_id . "', now(), '%s')"; + $insert = $wpdb->prepare( $insert, $subnet[0] ); + $results = $wpdb->query($insert); + } +} + +function lockDown($username = "") { + global $wpdb; + global $loginlockdownOptions; + $table_name = $wpdb->prefix . "lockdowns"; + $subnet = calc_subnet($_SERVER['REMOTE_ADDR']); + + $username = sanitize_user($username); + $user = get_user_by('login',$username); + if ( $user || "yes" == $loginlockdownOptions['lockout_invalid_usernames'] ) { + if ( $user === false ) { + $user_id = -1; + } else { + $user_id = $user->ID; + } + $insert = "INSERT INTO " . $table_name . " (user_id, lockdown_date, release_date, lockdown_IP) " . + "VALUES ('" . $user_id . "', now(), date_add(now(), INTERVAL " . + $loginlockdownOptions['lockout_length'] . " MINUTE), '%s')"; + $insert = $wpdb->prepare( $insert, $subnet[0] ); + $results = $wpdb->query($insert); + } +} + +function isLockedDown() { + global $wpdb; + $table_name = $wpdb->prefix . "lockdowns"; + $subnet = calc_subnet($_SERVER['REMOTE_ADDR']); + + $stillLockedquery = "SELECT user_id FROM $table_name " . + "WHERE release_date > now() AND " . + "lockdown_IP LIKE %s"; + $stillLockedquery = $wpdb->prepare($stillLockedquery,$subnet[1] . "%"); + + $stillLocked = $wpdb->get_var($stillLockedquery); + + return $stillLocked; +} + +function listLockedDown() { + global $wpdb; + $table_name = $wpdb->prefix . "lockdowns"; + + $listLocked = $wpdb->get_results("SELECT lockdown_ID, floor((UNIX_TIMESTAMP(release_date)-UNIX_TIMESTAMP(now()))/60) AS minutes_left, ". + "lockdown_IP FROM $table_name WHERE release_date > now()", ARRAY_A); + + return $listLocked; +} + +function get_loginlockdownOptions() { + $loginlockdownAdminOptions = array( + 'max_login_retries' => 3, + 'retries_within' => 5, + 'lockout_length' => 60, + 'lockout_invalid_usernames' => 'no', + 'mask_login_errors' => 'no', + 'show_credit_link' => 'yes' + ); + $loginlockdownOptions = get_option("loginlockdownAdminOptions"); + if ( !empty($loginlockdownOptions) ) { + foreach ( $loginlockdownOptions as $key => $option ) { + $loginlockdownAdminOptions[$key] = $option; + } + } + update_option("loginlockdownAdminOptions", $loginlockdownAdminOptions); + return $loginlockdownAdminOptions; +} + +function calc_subnet($ip) { + $subnet[0] = $ip; + if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false) { + $ip = expandipv6($ip); + preg_match("/^([0-9abcdef]{1,4}:){4}/", $ip, $matches); + $subnet[0] = $ip; + $subnet[1] = $matches[0]; + } else { + $subnet[1] = substr ($ip, 0 , strrpos ( $ip, "." ) + 1); + } + return $subnet; +} + +function expandipv6($ip){ + $hex = unpack("H*hex", inet_pton($ip)); + $ip = substr(preg_replace("/([A-f0-9]{4})/", "$1:", $hex['hex']), 0, -1); + + return $ip; +} + + +function print_loginlockdownAdminPage() { + global $wpdb; + $table_name = $wpdb->prefix . "lockdowns"; + $loginlockdownAdminOptions = get_loginlockdownOptions(); + + if (isset($_POST['update_loginlockdownSettings'])) { + + //wp_nonce check + check_admin_referer('login-lockdown_update-options'); + + if (isset($_POST['ll_max_login_retries'])) { + $loginlockdownAdminOptions['max_login_retries'] = $_POST['ll_max_login_retries']; + } + if (isset($_POST['ll_retries_within'])) { + $loginlockdownAdminOptions['retries_within'] = $_POST['ll_retries_within']; + } + if (isset($_POST['ll_lockout_length'])) { + $loginlockdownAdminOptions['lockout_length'] = $_POST['ll_lockout_length']; + } + if (isset($_POST['ll_lockout_invalid_usernames'])) { + $loginlockdownAdminOptions['lockout_invalid_usernames'] = $_POST['ll_lockout_invalid_usernames']; + } + if (isset($_POST['ll_mask_login_errors'])) { + $loginlockdownAdminOptions['mask_login_errors'] = $_POST['ll_mask_login_errors']; + } + if (isset($_POST['ll_show_credit_link'])) { + $loginlockdownAdminOptions['show_credit_link'] = $_POST['ll_show_credit_link']; + } + update_option("loginlockdownAdminOptions", $loginlockdownAdminOptions); + ?> +

+ prepare($releasequery,$release_id); + $results = $wpdb->query($releasequery); + } + } + update_option("loginlockdownAdminOptions", $loginlockdownAdminOptions); + ?> +

+ +
+ +

+ +

+ Settings + Activity () +

+ +
"> + + +

+

Number of failed login attempts within the "Retry Time Period Restriction" (defined below) needed to trigger a LockDown.

+

+

+

Amount of time that determines the rate at which failed login attempts are allowed before a LockDown occurs.

+

+

+

How long a particular IP block will be locked out for once a LockDown has been triggered.

+

+

+

By default Login LockDown will not trigger if an attempt is made to log in using a username that does not exist. You can override this behavior here.

+

> Yes   > No

+

+

WordPress will normally display distinct messages to the user depending on whether they try and log in with an invalid username, or with a +valid username but the incorrect password. Toggling this option will hide why the login failed.

+

> Yes   > No

+

+

By default, Login LockDown will display the following message on the login form:
+

Login form protected by Login LockDown.
+This helps others know about the plugin so they can protect their blogs as well if they like. However, you can disable this message if you prefer.

+> Yes, display the credit link.
+> Display the credit link, but add "rel='nofollow'" (ie. do not pass any link juice).
+> No, do not display the credit link.
+
+
+
+ +
"> + +

+ +No IP blocks currently locked out.

"; + } else { + foreach ( $dalist as $key => $option ) { + ?> +
  • ( minutes left)
    • + +
    +
    +
    + +
    +Login form protected by Login LockDown.


    "; + } +} + +//Actions and Filters +if ( isset($loginlockdown_db_version) ) { + //Actions + add_action('admin_menu', 'loginlockdown_ap'); + if(!defined('WP_PLUGIN_DIR')){ + define('WP_PLUGIN_DIR', ABSPATH . 'wp-content/plugins'); + } + $activatestr = str_replace(WP_PLUGIN_DIR . "/", "activate_", __FILE__); + add_action($activatestr, 'loginLockdown_install'); + add_action('login_form', 'll_credit_link'); + + remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3); + add_filter('authenticate', 'll_wp_authenticate_username_password', 20, 3); + //Filters + //Functions + function ll_wp_authenticate_username_password($user, $username, $password) { + if ( is_a($user, 'WP_User') ) { return $user; } + + if ( empty($username) || empty($password) ) { + $error = new WP_Error(); + + if ( empty($username) ) + $error->add('empty_username', __('ERROR: The username field is empty.')); + + if ( empty($password) ) + $error->add('empty_password', __('ERROR: The password field is empty.')); + + return $error; + } + + $userdata = get_user_by('login',$username); + + if ( !$userdata ) { + return new WP_Error('invalid_username', sprintf(__('ERROR: Invalid username. Lost your password?'), site_url('wp-login.php?action=lostpassword', 'login'))); + } + + $userdata = apply_filters('wp_authenticate_user', $userdata, $password); + if ( is_wp_error($userdata) ) { + return $userdata; + } + + if ( !wp_check_password($password, $userdata->user_pass, $userdata->ID) ) { + return new WP_Error('incorrect_password', sprintf(__('ERROR: Incorrect password. Lost your password?'), site_url('wp-login.php?action=lostpassword', 'login'))); + } + + $user = new WP_User($userdata->ID); + return $user; + } + + + if ( !function_exists('wp_authenticate') ) : + function wp_authenticate($username, $password) { + global $wpdb, $error; + global $loginlockdownOptions; + + $username = sanitize_user($username); + $password = trim($password); + + if ( "" != isLockedDown() ) { + return new WP_Error('incorrect_password', "ERROR: We're sorry, but this IP range has been blocked due to too many recent " . + "failed login attempts.

    Please try again later."); + } + + $user = apply_filters('authenticate', null, $username, $password); + + if ( $user == null ) { + // TODO what should the error message be? (Or would these even happen?) + // Only needed if all authentication handlers fail to return anything. + $user = new WP_Error('authentication_failed', __('ERROR: Invalid username or incorrect password.')); + } + + $ignore_codes = array('empty_username', 'empty_password'); + + if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) { + incrementFails($username); + if ( $loginlockdownOptions['max_login_retries'] <= countFails($username) ) { + lockDown($username); + return new WP_Error('incorrect_password', __("ERROR: We're sorry, but this IP range has been blocked due to too many recent " . + "failed login attempts.

    Please try again later.")); + } + if ( 'yes' == $loginlockdownOptions['mask_login_errors'] ) { + return new WP_Error('authentication_failed', sprintf(__('ERROR: Invalid username or incorrect password. Lost your password?'), site_url('wp-login.php?action=lostpassword', 'login'))); + } else { + do_action('wp_login_failed', $username); + } + } + + return $user; + } + endif; + // multisite network-wide activation + register_activation_hook( __FILE__, 'loginlockdown_multisite_activate' ); + function loginlockdown_multisite_activate($networkwide) { + global $wpdb; + + if (function_exists('is_multisite') && is_multisite()) { + // check if it is a network activation - if so, run the activation function for each blog id + if ($networkwide) { + $old_blog = $wpdb->blogid; + // Get all blog ids + $blogids = $wpdb->get_col("SELECT blog_id FROM $wpdb->blogs"); + foreach ($blogids as $blog_id) { + switch_to_blog($blog_id); + loginLockdown_install(); + } + switch_to_blog($old_blog); + return; + } + } + } + + // multisite new site activation + add_action( 'wpmu_new_blog', 'loginlockdown_multisite_newsite', 10, 6); + function loginlockdown_multisite_newsite($blog_id, $user_id, $domain, $path, $site_id, $meta ) { + global $wpdb; + + if (is_plugin_active_for_network('loginlockdown/loginlockdown.php')) { + $old_blog = $wpdb->blogid; + switch_to_blog($blog_id); + loginLockdown_install(); + switch_to_blog($old_blog); + } + } + + // multisite old sites check + + add_action('admin_init','loginlockdown_multisite_legacy'); + function loginlockdown_multisite_legacy() { + $loginlockdownMSRunOnce = get_option("loginlockdownmsrunonce"); + if ( empty($loginlockdownMSRunOnce) ) { + global $wpdb; + + if (function_exists('is_multisite') && is_multisite()) { + + $old_blog = $wpdb->blogid; + + // Get all blog ids + $blogids = $wpdb->get_col("SELECT blog_id FROM $wpdb->blogs"); + foreach ($blogids as $blog_id) { + + // check if already exists + $bed_check = $wpdb->query("SHOW TABLES LIKE '{$wpdb->base_prefix}{$blog_id}_login_fails'"); + if (!$bed_check) { + + switch_to_blog($blog_id); + loginLockdown_install(); + + } + } + switch_to_blog($old_blog); + } + add_option("loginlockdownmsrunonce", "done", "", "no"); + return; + } + } +} + diff --git a/pole-sbv-content/plugins/login-lockdown/readme.txt b/pole-sbv-content/plugins/login-lockdown/readme.txt new file mode 100644 index 00000000..561b059b --- /dev/null +++ b/pole-sbv-content/plugins/login-lockdown/readme.txt @@ -0,0 +1,77 @@ +=== Login LockDown === +Developer: Michael VanDeMar (michael@endlesspoetry.com) +Tags: security, login +Requires at least: 3.6 +Tested up to: 4.6.1 +Stable Tag: 1.7.1 + +Limits the number of login attempts from a given IP range within a certain time period. + +== Description == + +Login LockDown records the IP address and timestamp of every failed login attempt. If more than a +certain number of attempts are detected within a short period of time from the same +IP range, then the login function is disabled for all requests from that range. +This helps to prevent brute force password discovery. Currently the plugin defaults +to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes. This can be modified +via the Options panel. Administrators can release locked out IP ranges manually from the panel. + +== Installation == + +1. Extract the zip file into your plugins directory into its own folder. +2. Activate the plugin in the Plugin options. +3. Customize the settings from the Options panel, if desired. + +Enjoy. + +== Change Log == + + ver. 1.7.1 13-Sep-2016 + + - fixed bug causing all ipv6 addresses to get locked out if 1 was + - added in WordPress MultiSite functionality + - fixed bug where subnets could be overly matched, causing more IPs to be blocked than intended + - moved the report for locked out IP addresses to its own tab + + ver. 1.6.1 8-Mar-2014 + + - fixed html glitch preventing options from being saved + + ver. 1.6 7-Mar-2014 + + - cleaned up deprecated functions + - fixed bug with invalid property on a non-object when locking out invalid usernames + - fixed utilization of $wpdb->prepare + - added more descriptive help text to each of the options + - added the ability to remove the "Login form protected by Login LockDown." message from within the dashboard + + ver. 1.5 17-Sep-2009 + + - implemented wp_nonce security in the options and lockdown release forms in the admin screen + - fixed a security hole with an improperly escaped SQL query + - encoded certain outputs in the admin panel using esc_attr() to prevent XSS attacks + - fixed an issue with the 'Lockout Invalid Usernames' option not functioning as intended + + ver. 1.4 29-Aug-2009 + + - removed erroneous error affecting WP 2.8+ + - fixed activation error caused by customizing the location of the wp-content folder + - added in the option to mask which specific login error (invalid username or invalid password) was generated + - added in the option to lock out failed login attempts even if the username doesn't exist + + ver. 1.3 23-Feb-2009 + - adjusted positioning of plugin byline + - allowed for dynamic location of plugin files + + ver. 1.2 15-Jun-2008 + + - now compatible with WordPress 2.5 and up only + + ver. 1.1 01-Sep-2007 + + - revised time query to MySQL 4.0 compatability + + ver. 1.0 29-Aug-2007 + + - released + diff --git a/pole-sbv-content/plugins/login-lockdown/version.txt b/pole-sbv-content/plugins/login-lockdown/version.txt new file mode 100644 index 00000000..943f9cbc --- /dev/null +++ b/pole-sbv-content/plugins/login-lockdown/version.txt @@ -0,0 +1 @@ +1.7.1