WordPress.org
Get WordPress

Plugin Directory

Changeset 327790


Ignore:
Timestamp:
01/01/2011 08:32:40 PM (15 years ago)
Author:
johanee
Message:

Version 1.6.0

Location:
limit-login-attempts
Files:
1 deleted
6 edited
1 copied

Legend:

Unmodified
Added
Removed

  • limit-login-attempts/tags/1.6.0/limit-login-attempts.php

    r298432 r327790  
    66  Author: Johan Eenfeldt
    77  Author URI: http://devel.kostdoktorn.se
    8   Version: 1.5.2
    9 
    10   Copyright 2008, 2009, 2010 Johan Eenfeldt
    11 
    12   Thanks to Michael Skerwiderski for reverse proxy handling.
     8  Version: 1.6.0
     9
     10  Copyright 2008 - 2011 Johan Eenfeldt
     11
     12  Thanks to Michael Skerwiderski for reverse proxy handling suggestions.
    1313
    1414  Licenced under the GNU GPL:
    … …  
    6464
    6565          /* Reset failed attempts after this many seconds */
    66           , 'valid_duration' => 86400 // 24 hours
    67 
    68           /* Also limit malformed/forged cookies?
    69            *
    70            * NOTE: Only works in WP 2.7+, as necessary actions were added then.
    71            */
     66          , 'valid_duration' => 43200 // 12 hours
     67
     68          /* Also limit malformed/forged cookies? */
    7269          , 'cookies' => true
    7370
    … …  
    9794/* Get options and setup filters & actions */
    9895function limit_login_setup() {
    99     load_plugin_textdomain('limit-login-attempts'
    100                    , PLUGINDIR.'/'.dirname(plugin_basename(__FILE__)));
     96    load_plugin_textdomain('limit-login-attempts', false
     97                   , dirname(plugin_basename(__FILE__)));
    10198
    10299    limit_login_setup_options();
    … …  
    212209    }
    213210
    214     if (empty($_COOKIE[AUTH_COOKIE]) && empty($_COOKIE[SECURE_AUTH_COOKIE])
    215         && empty($_COOKIE[LOGGED_IN_COOKIE])) {
    216         return;
    217     }
    218 
     211    limit_login_clear_auth_cookie();
     212}
     213
     214
     215/* Action: failed cookie login wrapper for limit_login_failed() */
     216function limit_login_failed_cookie($cookie_elements) {
     217    limit_login_clear_auth_cookie();
     218
     219    limit_login_failed($cookie_elements['username']);
     220}
     221
     222/* Make sure auth cookie really get cleared (for this session too) */
     223function limit_login_clear_auth_cookie() {
    219224    wp_clear_auth_cookie();
    220225
    … …  
    228233        $_COOKIE[LOGGED_IN_COOKIE] = '';
    229234    }
    230 }
    231 
    232 
    233 /* Action: failed cookie login wrapper for limit_login_failed() */
    234 function limit_login_failed_cookie($arg) {
    235     limit_login_failed($arg);
    236     wp_clear_auth_cookie();
    237235}
    238236
    … …  
    243241 * lockout if nr of retries are above threshold. And more!
    244242 */
    245 function limit_login_failed($arg) {
     243function limit_login_failed($username) {
    246244    $ip = limit_login_get_address();
    247245
    … …  
    303301    }
    304302
    305     /* try to find username which failed */
    306     $user = '';
    307     if (is_string($arg)) {
    308         /* action: wp_login_failed */
    309         $user = $arg;
    310     } elseif (is_array($arg) && array_key_exists('username', $arg)) {
    311         /* action: auth_cookie_bad_* */
    312         $user = $arg['username'];
    313     }
    314 
    315303    /* do housecleaning and save values */
    316304    limit_login_cleanup($retries, $lockouts, $valid);
    317305
    318306    /* do any notification */
    319     limit_login_notify($user);
     307    limit_login_notify($username);
    320308
    321309    /* increase statistics */
    … …  
    399387        $lockouts = limit_login_option('allowed_lockouts');
    400388        $time = round(limit_login_option('long_duration') / 3600);
    401         $when = sprintf(__ngettext('%d hour', '%d hours', $time, 'limit-login-attempts'), $time);
     389        $when = sprintf(_n('%d hour', '%d hours', $time, 'limit-login-attempts'), $time);
    402390    } else {
    403391        /* normal lockout */
    … …  
    405393        $lockouts = floor($count / limit_login_option('allowed_retries'));
    406394        $time = round(limit_login_option('lockout_duration') / 60);
    407         $when = sprintf(__ngettext('%d minute', '%d minutes', $time, 'limit-login-attempts'), $time);
     395        $when = sprintf(_n('%d minute', '%d minutes', $time, 'limit-login-attempts'), $time);
    408396    }
    409397
    … …  
    487475    if ($when > 60) {
    488476        $when = ceil($when / 60);
    489         $msg .= sprintf(__ngettext('Please try again in %d hour.', 'Please try again in %d hours.', $when, 'limit-login-attempts'), $when);
     477        $msg .= sprintf(_n('Please try again in %d hour.', 'Please try again in %d hours.', $when, 'limit-login-attempts'), $when);
    490478    } else {
    491         $msg .= sprintf(__ngettext('Please try again in %d minute.', 'Please try again in %d minutes.', $when, 'limit-login-attempts'), $when);
     479        $msg .= sprintf(_n('Please try again in %d minute.', 'Please try again in %d minutes.', $when, 'limit-login-attempts'), $when);
    492480    }
    493481
    … …  
    518506
    519507    $remaining = max((limit_login_option('allowed_retries') - ($retries[$ip] % limit_login_option('allowed_retries'))), 0);
    520     return sprintf(__ngettext("<strong>%d</strong> attempt remaining.", "<strong>%d</strong> attempts remaining.", $remaining, 'limit-login-attempts'), $remaining);
     508    return sprintf(_n("<strong>%d</strong> attempt remaining.", "<strong>%d</strong> attempts remaining.", $remaining, 'limit-login-attempts'), $remaining);
    521509}
    522510
    … …  
    634622 * Admin stuff
    635623 */
    636 
    637 /* Does wordpress version support cookie option? */
    638 function limit_login_support_cookie_option() {
    639     global $wp_version;
    640     return (version_compare($wp_version, '2.7', '>='));
    641 }
    642 
    643624
    644625/* Make a guess if we are behind a proxy or not */
    … …  
    709690    limit_login_sanitize_simple_int('long_duration');
    710691
     692    $limit_login_options['cookies'] = !!limit_login_option('cookies');
     693
    711694    $notify_email_after = max(1, intval(limit_login_option('notify_email_after')));
    712695    $limit_login_options['notify_email_after'] = min(limit_login_option('allowed_lockouts'), $notify_email_after);
    … …  
    722705    $limit_login_options['lockout_notify'] = implode(',', $new_args);
    723706
    724     $cookies = limit_login_option('cookies')
    725         && limit_login_support_cookie_option() ? true : false;
    726 
    727     $limit_login_options['cookies'] = $cookies;
    728 
    729707    if ( limit_login_option('client_type') != LIMIT_LOGIN_DIRECT_ADDR
    730708         && limit_login_option('client_type') != LIMIT_LOGIN_PROXY_ADDR ) {
    … …  
    761739    }
    762740
    763     echo('<tr><th scope="col">' . _c("IP|Internet address", 'limit-login-attempts') . '</th><th scope="col">' . __('Tried to log in as', 'limit-login-attempts') . '</th></tr>');
     741    echo('<tr><th scope="col">' . _x("IP", "Internet address", 'limit-login-attempts') . '</th><th scope="col">' . __('Tried to log in as', 'limit-login-attempts') . '</th></tr>');
    764742    foreach ($log as $ip => $arr) {
    765743        echo('<tr><td class="limit-login-ip">' . $ip . '</td><td class="limit-login-max">');
    766744        $first = true;
    767745        foreach($arr as $user => $count) {
    768             $count_desc = sprintf(__ngettext('%d lockout', '%d lockouts', $count, 'limit-login-attempts'), $count);
     746            $count_desc = sprintf(_n('%d lockout', '%d lockouts', $count, 'limit-login-attempts'), $count);
    769747            if (!$first) {
    770748                echo(', ' . $user . ' (' .  $count_desc . ')');
    … …  
    848826    $lockouts_now = is_array($lockouts) ? count($lockouts) : 0;
    849827
    850     if (!limit_login_support_cookie_option()) {
    851         $cookies_disabled = ' DISABLED ';
    852         $cookies_note = ' <br /> '
    853             . __('<strong>NOTE:</strong> Only works in Wordpress 2.7 or later'
    854                  , 'limit-login-attempts');
    855     } else {
    856         $cookies_disabled = '';
    857         $cookies_note = '';
    858     }
    859828    $cookies_yes = limit_login_option('cookies') ? ' checked ' : '';
    860829    $cookies_no = limit_login_option('cookies') ? '' : ' checked ';
    … …  
    895864              <?php if ($lockouts_total > 0) { ?>
    896865              <input name="reset_total" value="<?php echo __('Reset Counter','limit-login-attempts'); ?>" type="submit" />
    897               <?php echo sprintf(__ngettext('%d lockout since last reset', '%d lockouts since last reset', $lockouts_total, 'limit-login-attempts'), $lockouts_total); ?>
     866              <?php echo sprintf(_n('%d lockout since last reset', '%d lockouts since last reset', $lockouts_total, 'limit-login-attempts'), $lockouts_total); ?>
    898867              <?php } else { echo __('No lockouts yet','limit-login-attempts'); } ?>
    899868            </td>
    … …  
    943912            <th scope="row" valign="top"><?php echo __('Handle cookie login','limit-login-attempts'); ?></th>
    944913            <td>
    945               <label><input type="radio" name="cookies" <?php echo $cookies_disabled . $cookies_yes; ?> value="1" /> <?php echo __('Yes','limit-login-attempts'); ?></label> <label><input type="radio" name="cookies" <?php echo $cookies_disabled . $cookies_no; ?> value="0" /> <?php echo __('No','limit-login-attempts'); ?></label>
    946               <?php echo $cookies_note ?>
     914              <label><input type="radio" name="cookies" <?php echo $cookies_yes; ?> value="1" /> <?php echo __('Yes','limit-login-attempts'); ?></label> <label><input type="radio" name="cookies" <?php echo $cookies_no; ?> value="0" /> <?php echo __('No','limit-login-attempts'); ?></label>
    947915            </td>
    948916          </tr>

  • limit-login-attempts/tags/1.6.0/readme.txt

    r298432 r327790  
    22Contributors: johanee
    33Tags: login, security, authentication
    4 Requires at least: 2.5
    5 Tested up to: 3.0.1
    6 Stable tag: 1.5.2
     4Requires at least: 2.8
     5Tested up to: 3.1-RC1
     6Stable tag: 1.6.0
    77
    88Limit rate of login attempts, including by way of cookies, for each IP.
    … …  
    1010== Description ==
    1111
    12 Limit the number of login attempts possible both through normal login as well as (WordPress 2.7+) using auth cookies.
     12Limit the number of login attempts possible both through normal login as well as using auth cookies.
    1313
    1414By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
    … …  
    1919
    2020* Limit the number of retry attempts when logging in (for each IP). Fully customizable
    21 * (WordPress 2.7+) Limit the number of attempts to log in using auth cookies in same way
     21* Limit the number of attempts to log in using auth cookies in same way
    2222* Informs user about remaining retries or lockout time on login page
    2323* Optional logging, optional email notification
    … …  
    3030== Installation ==
    3131
    32 1. Download and extract plugin files to a folder in your wp-content/plugin directory.
     321. Download and extract plugin files to a wp-content/plugin directory.
    33332. Activate the plugin through the WordPress admin interface.
    34 3. Customize the settings from the options page, if desired. If your server is located behind a reverse proxy make sure to change this setting.
     343. Customize the settings on the options page, if desired. If your server is located behind a reverse proxy make sure to change this setting.
    3535
    3636If you have any questions or problems please make a post here: http://wordpress.org/tags/limit-login-attempts
    3737
    3838== Frequently Asked Questions ==
     39
     40= Why not reset failed attempts on a successful login? =
     41
     42This is very much by design. Otherwise you could brute force the "admin" password by logging in as your own user every 4th attempt.
    3943
    4044= What is this option about site connection and reverse proxy? =
    … …  
    60641. Loginscreen after failed login with retries remaining
    61652. Loginscreen during lockout
    62 3. Administration interface in WordPress 2.7
    63 4. Administration interface in WordPress 2.5
     663. Administration interface in WordPress 3.0.4
    6467
    6568== Changelog ==
     69
     70= 1.6.0 =
     71* Happy New Year
     72* Tested against WordPress 3.1-RC1
     73* Plugin now requires WordPress version 2.8+. Of course you should never ever use anything but the latest version
     74* Fixed deprecation warnings that had been piling up with the old version requirement. Thanks to Johannes Ruthenberg for the report that prompted this
     75* Removed auth cookie admin check for version 2.7.
     76* Make sure relevant values in $_COOKIE get cleared right away on auth cookie validation failure. There are still some problems with cookie auth handling. The lockout can trigger prematurely in rare cases, but fixing it is plugin version 2 stuff unfortunately.
     77* Changed default time for retries to reset from 24 hours to 12 hours. The security impact is very minor and it means the warning will disappear "overnight"
     78* Added question to FAQ ("Why not reset failed attempts on a successful login?")
     79* Updated screenshots
    6680
    6781= 1.5.2 =

  • limit-login-attempts/trunk/limit-login-attempts-registrations.php

    r298432 r327790  
    111111    limit_login_store_array('registrations_valid', $valid);
    112112
    113     /* increase statistics? */
     113    /* registration lockout? increase statistics */
    114114    if ($regs[$ip] >= limit_login_option('register_allowed'))
    115115        limit_login_statistic_inc('reg_lockouts_total');

  • limit-login-attempts/trunk/limit-login-attempts.php

    r298432 r327790  
    196196    wp_clear_auth_cookie();
    197197}
     198
     199/*
     200function limit_login_add_user_cookieinfo($cookie_elements) {
     201    $username = $cookie_elements['username'];
     202
     203    $user = get_userdatabylogin($username);
     204    if (!$user) {
     205        return false;
     206    }
     207
     208    $cookieinfo = array('expiration' => $cookie_elements['expiration']
     209                , 'hmac' => $cookie_elements['hmac']);
     210    update_user_meta($user->ID, 'limit_login_cookieinfo', $cookieinfo);
     211}
     212
     213function limit_login_get_user_cookieinfo($username) {
     214    $user = get_userdatabylogin($username);
     215    if (!$user) {
     216        return false;
     217    }
     218
     219    $meta = get_user_meta(
     220}
     221 */
    198222
    199223/*
    … …  
    442466     * Log format:
    443467     * [ip][0] time of last attempt
    444      * [ip][1][user_name] number of attempts
     468     * [ip][1][user_name] number of lockouts for username
    445469     */
    446470    if (isset($log[$ip])) {
    … …  
    724748    $a = get_option($real_array_name);
    725749
    726     if (!is_array($a)) {
    727         $a = array();
    728         $autoload = limit_login_is_array_autoload($array_name) ? 'yes' : 'no';
    729         add_option($real_array_name, $a, '', $autoload);
    730     }
     750    if (is_array($a))
     751        return $a;
     752
     753    $a = array();
     754    $autoload = limit_login_is_array_autoload($array_name) ? 'yes' : 'no';
     755    add_option($real_array_name, $a, '', $autoload);
    731756
    732757    return $a;

  • limit-login-attempts/trunk/readme.txt

    r298432 r327790  
    44Requires at least: 2.8
    55Tested up to: 3.0.1
    6 Stable tag: 1.5.2
    7 
    8 Limit rate of login attempts for each IP. Also protect new user registration, password resets and more.
     6Stable tag: 1.6.0
     7
     8Limit rate of login attempts for each IP. Additional security for new user registrations, password resets and more.
    99
    1010== Description ==
    1111
    1212THIS IS A BETA VERSION!
     13
     14Additional security features for many parts of user handling: login, signup, password reset and more.
    1315
    1416Limit the number of login attempts possible both through normal login as well as using auth cookies.
    … …  
    2426* Limit the number of retry attempts when logging in (for each IP). Fully customizable
    2527* Optional logging and email notification
    26 * (WordPress 2.7+) Handles attempts to log in using auth cookies
    27 * Helps protect user login names from discovery
    28 * Informs user about remaining retries or lockout time on login page
    29 * (Wordpress 2.6.5+) Optional restrictions on password reset attempts for privileged users
    30 * Optional rate limit on new user registration
     28* Handles attempts to log in using auth cookies
     29* Help protect user login names from discovery
     30* Show remaining retries or lockout time on login page
     31* Optional restrictions of password resets for privileged users
     32* Optional rate limit of new user registration
    3133* Allows modification of privileged users Author URL name ("nicename")
    3234* Handles server behind reverse proxy
    3335
    34 Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, French, Finnish, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
    35 Translations: Bulgarian, Catalan*, Czech*, German*, Norwegian*, Persian*, Romanian*, Russian*, Spanish, Swedish, Turkish*
    36 (* = translation not yet updated to plugin version 2)
     36Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, French, Finnish, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish. (Most translations not yet updated to plugin version 2.)
    3737
    3838Plugin uses standard actions and filters only.
    … …  
    6464If you have ftp / ssh access to the site rename the file `wp-content/plugins/limit-login-attempts/limit-login-attempts.php` to deactivate the plugin.
    6565
    66 If you have access to the database (for example through phpMyAdmin) you can clear the `limit_login_lockouts` option in the wordpress options table. In a default setup this would work: `UPDATE wp_options SET option_value = '' WHERE option_name = 'limit_login_lockouts'`
     66If you have access to the database (for example through phpMyAdmin) you can clear the `limit_login_lockouts` option in the wordpress options table.
     67
     68Don't do this unless you know what you are doing.
     69
     70In a default setup this would work: `UPDATE wp_options SET option_value = '' WHERE option_name = 'limit_login_lockouts'`
    6771
    6872= Why the privileged users list? Why are some names marked? =
    … …  
    7680= I disabled password reset for administrators and forgot my password, what do I do? =
    7781
    78 If you have ftp / ssh access look at the answer regarding being locked out above.
    79 
    80 If you have access to the database (for example through phpMyAdmin) you can clear the `limit_login_reset_min_role` option in the wordpress options table. In a default setup this would work: `UPDATE wp_options SET option_value = '' WHERE option_name = 'limit_login_reset_min_role'`
     82If you have ftp / ssh access look at the answer regarding being locked out above to disable plugin.
     83
     84If you have access to the database (for example through phpMyAdmin) you can remove the plugin options value. This will revert settiongs to defaults which allow password reset using account e-mail (for privileged users).
     85
     86Plugin options are stored in `limit_login_options` option in the wordpress options table. You can remove this in a default setup using: `DELETE FROM wp_options WHERE option_name = 'limit_login_options'`. PLEASE BE CAREFUL OR YOU WILL SCREW UP YOUR WORDPRESS INSTALL!
     87
     88Truly advanced users can edit the 'disable_pwd_reset' entry in the serialized array of course.
    8189
    8290== Screenshots ==
    … …  
    93101
    94102* split admin page?
    95 * improve user rename (clear cache, ...)
     103* remove user name editing, have to think some more on this
     104* escape all translated strings
    96105
    97106* Re-re-check: user login name protection, track nonempty_credentials
    … …  
    100109* make dashboard text better
    101110
     111* show when old translation
     112
    102113* TEST TEST TEST TEST
    103114
    … …  
    109120* Update screenshots
    110121* Update site
     122
     123* track registrations
     124* track last login
    111125
    112126== Change Log ==
    … …  
    119133* Only autoload the necessary option table entries
    120134* Log time of last lockout for each IP in log; keep track of last increase + last clear for statistics
    121 * Forward-merged changes from version 1.5 and 1.5.1
     135* Forward-merged changes from versions 1.5 - 1.5.2
    122136* Move translations to separate directories
    123137* Updated Swedish translation
Note: See TracChangeset for help on using the changeset viewer.