WordPress.org
Get WordPress

Plugin Directory

Changeset 546512


Ignore:
Timestamp:
05/20/2012 10:41:52 AM (14 years ago)
Author:
johanee
Message:

Version 1.7.0. Add whitelist filter. Pre-translation.

Location:
limit-login-attempts
Files:
3 edited
1 copied

Legend:

Unmodified
Added
Removed

  • limit-login-attempts/tags/1.6.3/limit-login-attempts.php

    r428626 r546512  
    77  Author URI: http://devel.kostdoktorn.se
    88  Text Domain: limit-login-attempts
    9   Version: 1.6.2
    10 
    11   Copyright 2008 - 2011 Johan Eenfeldt
     9  Version: 1.7.0
     10
     11  Copyright 2008 - 2012 Johan Eenfeldt
    1212
    1313  Thanks to Michael Skerwiderski for reverse proxy handling suggestions.
    … …  
    4444 * Variables
    4545 *
    46  * Assignments are for default value -- change in admin page.
     46 * Assignments are for default value -- change on admin page.
    4747 */
    4848
    … …  
    176176
    177177
     178/*
     179 * Check if IP is whitelisted.
     180 *
     181 * This function allow external ip whitelisting using a filter. Note that it can
     182 * be called multiple times during the login process.
     183 *
     184 * Note that retries and statistics are still counted and notifications
     185 * done as usual for whitelisted ips , but no lockout is done.
     186 *
     187 * Example:
     188 * function my_ip_whitelist($allow, $ip) {
     189 *  return ($ip == 'my-ip') ? true : $allow;
     190 * }
     191 * add_filter('limit_login_whitelist_ip', 'my_ip_whitelist', 10, 2);
     192 */
     193function is_limit_login_ip_whitelisted($ip = null) {
     194    if (is_null($ip)) {
     195        $ip = limit_login_get_address();
     196    }
     197    $whitelisted = apply_filters('limit_login_whitelist_ip', false, $ip);
     198
     199    return ($whitelisted === true);
     200}
     201
     202
    178203/* Check if it is ok to login */
    179204function is_limit_login_ok() {
    180205    $ip = limit_login_get_address();
     206
     207    /* Check external whitelist filter */
     208    if (is_limit_login_ip_whitelisted($ip)) {
     209        return true;
     210    }
    181211
    182212    /* lockout active? */
    … …  
    325355 * Increase nr of retries (if necessary). Reset valid value. Setup
    326356 * lockout if nr of retries are above threshold. And more!
     357 *
     358 * A note on external whitelist: retries and statistics are still counted and
     359 * notifications done as usual, but no lockout is done.
    327360 */
    328361function limit_login_failed($username) {
    … …  
    370403    /* lockout! */
    371404
    372     global $limit_login_just_lockedout;
    373     $limit_login_just_lockedout = true;
    374 
    375     /* setup lockout, reset retries as needed */
     405    $whitelisted = is_limit_login_ip_whitelisted($ip);
     406
    376407    $retries_long = limit_login_option('allowed_retries')
    377         * limit_login_option('allowed_lockouts');
    378     if ($retries[$ip] >= $retries_long) {
    379         /* long lockout */
    380         $lockouts[$ip] = time() + limit_login_option('long_duration');
    381         unset($retries[$ip]);
    382         unset($valid[$ip]);
     408        * limit_login_option('allowed_lockouts');
     409
     410    /*
     411     * Note that retries and statistics are still counted and notifications
     412     * done as usual for whitelisted ips , but no lockout is done.
     413     */
     414    if ($whitelisted) {
     415        if ($retries[$ip] >= $retries_long) {
     416            unset($retries[$ip]);
     417            unset($valid[$ip]);
     418        }
    383419    } else {
    384         /* normal lockout */
    385         $lockouts[$ip] = time() + limit_login_option('lockout_duration');
     420        global $limit_login_just_lockedout;
     421        $limit_login_just_lockedout = true;
     422
     423        /* setup lockout, reset retries as needed */
     424        if ($retries[$ip] >= $retries_long) {
     425            /* long lockout */
     426            $lockouts[$ip] = time() + limit_login_option('long_duration');
     427            unset($retries[$ip]);
     428            unset($valid[$ip]);
     429        } else {
     430            /* normal lockout */
     431            $lockouts[$ip] = time() + limit_login_option('lockout_duration');
     432        }
    386433    }
    387434
    … …  
    395442    $total = get_option('limit_login_lockouts_total');
    396443    if ($total === false || !is_numeric($total)) {
    397         add_option('limit_login_lockouts_total', 1, '', 'no');
     444        add_option('limit_login_lockouts_total', 1, '', 'no');
    398445    } else {
    399         update_option('limit_login_lockouts_total', $total + 1);
     446        update_option('limit_login_lockouts_total', $total + 1);
    400447    }
    401448}
    … …  
    452499function limit_login_notify_email($user) {
    453500    $ip = limit_login_get_address();
     501    $whitelisted = is_limit_login_ip_whitelisted($ip);
    454502
    455503    $retries = get_option('limit_login_retries');
    … …  
    483531    $blogname = is_limit_login_multisite() ? get_site_option('site_name') : get_option('blogname');
    484532
    485     $subject = sprintf(__("[%s] Too many failed login attempts", 'limit-login-attempts')
    486                , $blogname);
     533    if ($whitelisted) {
     534        $subject = sprintf(__("[%s] Failed login attempts from whitelisted IP"
     535                      , 'limit-login-attempts')
     536                   , $blogname);
     537    } else {
     538        $subject = sprintf(__("[%s] Too many failed login attempts"
     539                      , 'limit-login-attempts')
     540                   , $blogname);
     541    }
     542
    487543    $message = sprintf(__("%d failed login attempts (%d lockout(s)) from IP: %s"
    488544                  , 'limit-login-attempts') . "\r\n\r\n"
    … …  
    492548                    . "\r\n\r\n" , $user);
    493549    }
    494     $message .= sprintf(__("IP was blocked for %s", 'limit-login-attempts'), $when);
     550    if ($whitelisted) {
     551        $message .= __("IP was NOT blocked because of external whitelist.", 'limit-login-attempts');
     552    } else {
     553        $message .= sprintf(__("IP was blocked for %s", 'limit-login-attempts'), $when);
     554    }
    495555
    496556    $admin_email = is_limit_login_multisite() ? get_site_option('admin_email') : get_option('admin_email');
    … …  
    601661/* Return current (error) message to show, if any */
    602662function limit_login_get_message() {
     663    /* Check external whitelist */
     664    if (is_limit_login_ip_whitelisted()) {
     665        return '';
     666    }
     667
     668    /* Is lockout in effect? */
    603669    if (!is_limit_login_ok()) {
    604670        return limit_login_error_msg();

  • limit-login-attempts/tags/1.6.3/readme.txt

    r428626 r546512  
    33Tags: login, security, authentication
    44Requires at least: 2.8
    5 Tested up to: 3.2.1
     5Tested up to: 3.3.2
    66Stable tag: 1.6.2
    77
    … …  
    2323* Optional logging, optional email notification
    2424* Handles server behind reverse proxy
     25* It is possible to whitelist IPs using a filter. But you probably shouldn't. :-)
    2526
    2627Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
    … …  
    5253You probably are not or you would know. We show a pretty good guess on the option page. Set the option using this unless you are sure you know better.
    5354
     55= Can I whitelist my IP so I don't get locked out? =
     56
     57First please consider if you really need this. Generally speaking it is not a good idea to have exceptions to your security policies.
     58
     59That said, there is now a filter which allows you to do it: "limit_login_whitelist_ip".
     60
     61Example:
     62function my_ip_whitelist($allow, $ip) {
     63     return ($ip == 'my-ip') ? true : $allow;
     64}
     65add_filter('limit_login_whitelist_ip', 'my_ip_whitelist', 10, 2);
     66
     67Note that we still do notification and logging as usual. This is meant to allow you to be aware of any suspicious activity from whitelisted IPs.
     68
    5469= I locked myself out testing this thing, what do I do? =
    5570
    5671Either wait, or:
     72
     73If you know how to edit / add to PHP files you can use the IP whitelist functionality described above. You should then use the "Restore Lockouts" button on the plugin settings page and remove the whitelist function again.
    5774
    5875If you have ftp / ssh access to the site rename the file "wp-content/plugins/limit-login-attempts/limit-login-attempts.php" to deactivate the plugin.
    … …  
    6784
    6885== Changelog ==
     86
     87= 1.7.0 =
     88* Added filter that allows whitelisting of IPs because of popular demand. Please use with care!!
     89* Update to Spanish translation, thanks to Marcelo Pedra
     90* Tested against WordPress 3.3.2
    6991
    7092= 1.6.2 =

  • limit-login-attempts/trunk/readme.txt

    r448467 r546512  
    119119* Update screenshots
    120120* Update site
    121 
    122 * track registrations
    123 * track last login
    124121
    125122== Change Log ==
Note: See TracChangeset for help on using the changeset viewer.