Jetpack_Protect_Module

The Jetpack by WordPress.com Jetpack Protect Module class.

Defined (1)

The class is defined in the following location(s).

/modules/protect.php  
  1. class Jetpack_Protect_Module { 
  2.  
  3. private static $__instance = null; 
  4. public $api_key; 
  5. public $api_key_error; 
  6. public $whitelist; 
  7. public $whitelist_error; 
  8. public $whitelist_saved; 
  9. private $user_ip; 
  10. private $local_host; 
  11. private $api_endpoint; 
  12. public $last_request; 
  13. public $last_response_raw; 
  14. public $last_response; 
  15. private $block_login_with_math; 
  16.  
  17. /** 
  18. * Singleton implementation 
  19. * @return object 
  20. */ 
  21. public static function instance() { 
  22. if ( ! is_a( self::$__instance, 'Jetpack_Protect_Module' ) ) { 
  23. self::$__instance = new Jetpack_Protect_Module(); 
  24.  
  25. return self::$__instance; 
  26.  
  27. /** 
  28. * Registers actions 
  29. */ 
  30. private function __construct() { 
  31. add_action( 'jetpack_activate_module_protect', array ( $this, 'on_activation' ) ); 
  32. add_action( 'jetpack_deactivate_module_protect', array ( $this, 'on_deactivation' ) ); 
  33. add_action( 'init', array ( $this, 'maybe_get_protect_key' ) ); 
  34. add_action( 'jetpack_modules_loaded', array ( $this, 'modules_loaded' ) ); 
  35. add_action( 'login_head', array ( $this, 'check_use_math' ) ); 
  36. add_filter( 'authenticate', array ( $this, 'check_preauth' ), 10, 3 ); 
  37. add_action( 'wp_login', array ( $this, 'log_successful_login' ), 10, 2 ); 
  38. add_action( 'wp_login_failed', array ( $this, 'log_failed_attempt' ) ); 
  39. add_action( 'admin_init', array ( $this, 'maybe_update_headers' ) ); 
  40. add_action( 'admin_init', array ( $this, 'maybe_display_security_warning' ) ); 
  41.  
  42. // This is a backup in case $pagenow fails for some reason 
  43. add_action( 'login_head', array ( $this, 'check_login_ability' ) ); 
  44.  
  45. // Runs a script every day to clean up expired transients so they don't 
  46. // clog up our users' databases 
  47. require_once( JETPACK__PLUGIN_DIR . '/modules/protect/transient-cleanup.php' ); 
  48.  
  49. //this should move into on_activation in 3.8, but, for now, we want to make sure all sites get this option set 
  50. if ( is_multisite() && is_main_site() ) { 
  51. update_site_option( 'jetpack_protect_active', 1 ); 
  52.  
  53.  
  54.  
  55. /** 
  56. * On module activation, try to get an api key 
  57. */ 
  58. public function on_activation() { 
  59. update_site_option( 'jetpack_protect_activating', 'activating' ); 
  60.  
  61. // Get BruteProtect's counter number 
  62. Jetpack_Protect_Module::protect_call( 'check_key' ); 
  63.  
  64. /** 
  65. * On module deactivation, unset protect_active 
  66. */ 
  67. public function on_deactivation() { 
  68. if ( is_multisite() && is_main_site() ) { 
  69. update_site_option( 'jetpack_protect_active', 0 ); 
  70.  
  71. public function maybe_get_protect_key() { 
  72. if ( get_site_option( 'jetpack_protect_activating', false ) && ! get_site_option( 'jetpack_protect_key', false ) ) { 
  73. $this->get_protect_key(); 
  74. delete_site_option( 'jetpack_protect_activating' ); 
  75.  
  76. /** 
  77. * Sends a "check_key" API call once a day. This call allows us to track IP-related 
  78. * headers for this server via the Protect API, in order to better identify the source 
  79. * IP for login attempts 
  80. */ 
  81. public function maybe_update_headers( $force = false ) { 
  82. $updated_recently = $this->get_transient( 'jpp_headers_updated_recently' ); 
  83.  
  84. if ( ! $force ) { 
  85. if ( isset( $_GET['protect_update_headers'] ) ) { 
  86. $force = true; 
  87.  
  88. // check that current user is admin so we prevent a lower level user from adding 
  89. // a trusted header, allowing them to brute force an admin account 
  90. if ( ( $updated_recently && ! $force ) || ! current_user_can( 'update_plugins' ) ) { 
  91. return; 
  92.  
  93. $response = Jetpack_Protect_Module::protect_call( 'check_key' ); 
  94. $this->set_transient( 'jpp_headers_updated_recently', 1, DAY_IN_SECONDS ); 
  95.  
  96. if ( isset( $response['msg'] ) && $response['msg'] ) { 
  97. update_site_option( 'trusted_ip_header', json_decode( $response['msg'] ) ); 
  98.  
  99.  
  100. public function maybe_display_security_warning() { 
  101. if ( is_multisite() && current_user_can( 'manage_network' ) ) { 
  102. if ( ! function_exists( 'is_plugin_active_for_network' ) ) { 
  103. require_once( ABSPATH . '/wp-admin/includes/plugin.php' ); 
  104.  
  105. if ( ! is_plugin_active_for_network( 'jetpack/jetpack.php' ) ) { 
  106. add_action( 'load-index.php', array ( $this, 'prepare_jetpack_protect_multisite_notice' ) ); 
  107.  
  108. public function prepare_jetpack_protect_multisite_notice() { 
  109. add_action( 'admin_print_styles', array ( $this, 'admin_banner_styles' ) ); 
  110. add_action( 'admin_notices', array ( $this, 'admin_jetpack_manage_notice' ) ); 
  111.  
  112. public function admin_banner_styles() { 
  113. global $wp_styles; 
  114.  
  115. $min = ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) ? '' : '.min'; 
  116.  
  117. wp_enqueue_style( 'jetpack', plugins_url( "css/jetpack-banners{$min}.css", JETPACK__PLUGIN_FILE ), false, JETPACK__VERSION ); 
  118. $wp_styles->add_data( 'jetpack', 'rtl', true ); 
  119.  
  120. public function admin_jetpack_manage_notice() { 
  121.  
  122. $dismissed = get_site_option( 'jetpack_dismissed_protect_multisite_banner' ); 
  123.  
  124. if ( $dismissed ) { 
  125. return; 
  126.  
  127. $referer = '&_wp_http_referer=' . add_query_arg( '_wp_http_referer', null ); 
  128. $opt_out_url = wp_nonce_url( Jetpack::admin_url( 'jetpack-notice=jetpack-protect-multisite-opt-out' . $referer ), 'jetpack_protect_multisite_banner_opt_out' ); 
  129.  
  130. ?> 
  131. <div id="message" class="updated jetpack-message jp-banner is-opt-in protect-error" 
  132. style="display:block !important;"> 
  133. <a class="jp-banner__dismiss" href="<?php echo esc_url( $opt_out_url ); ?>" 
  134. title="<?php esc_attr_e( 'Dismiss this notice.', 'jetpack' ); ?>"></a> 
  135.  
  136. <div class="jp-banner__content"> 
  137. <h4><?php esc_html_e( 'Protect cannot keep your site secure.', 'jetpack' ); ?></h4> 
  138.  
  139. <p><?php printf( __( 'Thanks for activating Protect! To start protecting your site, please network activate Jetpack on your Multisite installation and activate Protect on your primary site. Due to the way logins are handled on WordPress Multisite, Jetpack must be network-enabled in order for Protect to work properly. <a href="%s" target="_blank">Learn More</a>', 'jetpack' ), 'http://jetpack.me/support/multisite-protect' ); ?></p> 
  140. </div> 
  141. <div class="jp-banner__action-container is-opt-in"> 
  142. <a href="<?php echo network_admin_url( 'plugins.php' ); ?>" class="jp-banner__button" 
  143. id="wpcom-connect"><?php _e( 'View Network Admin', 'jetpack' ); ?></a> 
  144. </div> 
  145. </div> 
  146. <?php 
  147.  
  148. /** 
  149. * Request an api key from wordpress.com 
  150. * @return bool | string 
  151. */ 
  152. public function get_protect_key() { 
  153.  
  154. $protect_blog_id = Jetpack_Protect_Module::get_main_blog_jetpack_id(); 
  155.  
  156. // If we can't find the the blog id, that means we are on multisite, and the main site never connected 
  157. // the protect api key is linked to the main blog id - instruct the user to connect their main blog 
  158. if ( ! $protect_blog_id ) { 
  159. $this->api_key_error = __( 'Your main blog is not connected to WordPress.com. Please connect to get an API key.', 'jetpack' ); 
  160.  
  161. return false; 
  162.  
  163. $request = array ( 
  164. 'jetpack_blog_id' => $protect_blog_id,  
  165. 'bruteprotect_api_key' => get_site_option( 'bruteprotect_api_key' ),  
  166. 'multisite' => '0',  
  167. ); 
  168.  
  169. // Send the number of blogs on the network if we are on multisite 
  170. if ( is_multisite() ) { 
  171. $request['multisite'] = get_blog_count(); 
  172. if ( ! $request['multisite'] ) { 
  173. global $wpdb; 
  174. $request['multisite'] = $wpdb->get_var( "SELECT COUNT(blog_id) as c FROM $wpdb->blogs WHERE spam = '0' AND deleted = '0' and archived = '0'" ); 
  175.  
  176. // Request the key 
  177. Jetpack::load_xml_rpc_client(); 
  178. $xml = new Jetpack_IXR_Client( array ( 
  179. 'user_id' => get_current_user_id() 
  180. ) ); 
  181. $xml->query( 'jetpack.protect.requestKey', $request ); 
  182.  
  183. // Hmm, can't talk to wordpress.com 
  184. if ( $xml->isError() ) { 
  185. $code = $xml->getErrorCode(); 
  186. $message = $xml->getErrorMessage(); 
  187. $this->api_key_error = sprintf( __( 'Error connecting to WordPress.com. Code: %1$s, %2$s', 'jetpack' ), $code, $message ); 
  188.  
  189. return false; 
  190.  
  191. $response = $xml->getResponse(); 
  192.  
  193. // Hmm. Can't talk to the protect servers ( api.bruteprotect.com ) 
  194. if ( ! isset( $response['data'] ) ) { 
  195. $this->api_key_error = __( 'No reply from Jetpack servers', 'jetpack' ); 
  196.  
  197. return false; 
  198.  
  199. // There was an issue generating the key 
  200. if ( empty( $response['success'] ) ) { 
  201. $this->api_key_error = $response['data']; 
  202.  
  203. return false; 
  204.  
  205. // Key generation successful! 
  206. $active_plugins = Jetpack::get_active_plugins(); 
  207.  
  208. // We only want to deactivate BruteProtect if we successfully get a key 
  209. if ( in_array( 'bruteprotect/bruteprotect.php', $active_plugins ) ) { 
  210. Jetpack_Client_Server::deactivate_plugin( 'bruteprotect/bruteprotect.php', 'BruteProtect' ); 
  211.  
  212. $key = $response['data']; 
  213. update_site_option( 'jetpack_protect_key', $key ); 
  214.  
  215. return $key; 
  216.  
  217. /** 
  218. * Called via WP action wp_login_failed to log failed attempt with the api 
  219. * Fires custom, plugable action jpp_log_failed_attempt with the IP 
  220. * @return void 
  221. */ 
  222. function log_failed_attempt() { 
  223. /** 
  224. * Fires before every failed login attempt. 
  225. * @module protect 
  226. * @since 3.4.0 
  227. * @param string jetpack_protect_get_ip IP stored by Protect. 
  228. */ 
  229. do_action( 'jpp_log_failed_attempt', jetpack_protect_get_ip() ); 
  230.  
  231. if ( isset( $_COOKIE['jpp_math_pass'] ) ) { 
  232.  
  233. $transient = $this->get_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); 
  234. $transient--; 
  235.  
  236. if ( ! $transient || $transient < 1 ) { 
  237. $this->delete_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); 
  238. setcookie( 'jpp_math_pass', 0, time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false ); 
  239. } else { 
  240. $this->set_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'], $transient, DAY_IN_SECONDS ); 
  241.  
  242. $this->protect_call( 'failed_attempt' ); 
  243.  
  244. /** 
  245. * Set up the Protect configuration page 
  246. */ 
  247. public function modules_loaded() { 
  248. Jetpack::enable_module_configurable( __FILE__ ); 
  249. Jetpack::module_configuration_load( __FILE__, array ( $this, 'configuration_load' ) ); 
  250. Jetpack::module_configuration_head( __FILE__, array ( $this, 'configuration_head' ) ); 
  251. Jetpack::module_configuration_screen( __FILE__, array ( $this, 'configuration_screen' ) ); 
  252.  
  253. /** 
  254. * Logs a successful login back to our servers, this allows us to make sure we're not blocking 
  255. * a busy IP that has a lot of good logins along with some forgotten passwords. Also saves current user's ip 
  256. * to the ip address whitelist 
  257. */ 
  258. public function log_successful_login( $user_login, $user ) { 
  259. $this->protect_call( 'successful_login', array ( 'roles' => $user->roles ) ); 
  260.  
  261.  
  262. /** 
  263. * Checks for loginability BEFORE authentication so that bots don't get to go around the log in form. 
  264. * If we are using our math fallback, authenticate via math-fallback.php 
  265. * @param string $user 
  266. * @param string $username 
  267. * @param string $password 
  268. * @return string $user 
  269. */ 
  270. function check_preauth( $user = 'Not Used By Protect', $username = 'Not Used By Protect', $password = 'Not Used By Protect' ) { 
  271. $allow_login = $this->check_login_ability( true ); 
  272. $use_math = $this->get_transient( 'brute_use_math' ); 
  273.  
  274. if ( ! $allow_login ) { 
  275. $this->block_with_math(); 
  276.  
  277. if ( ( 1 == $use_math || 1 == $this->block_login_with_math ) && isset( $_POST['log'] ) ) { 
  278. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  279. Jetpack_Protect_Math_Authenticate::math_authenticate(); 
  280.  
  281. return $user; 
  282.  
  283. /** 
  284. * Get all IP headers so that we can process on our server... 
  285. * @return string 
  286. */ 
  287. function get_headers() { 
  288. $ip_related_headers = array ( 
  289. 'GD_PHP_HANDLER',  
  290. 'HTTP_AKAMAI_ORIGIN_HOP',  
  291. 'HTTP_CF_CONNECTING_IP',  
  292. 'HTTP_CLIENT_IP',  
  293. 'HTTP_FASTLY_CLIENT_IP',  
  294. 'HTTP_FORWARDED',  
  295. 'HTTP_FORWARDED_FOR',  
  296. 'HTTP_INCAP_CLIENT_IP',  
  297. 'HTTP_TRUE_CLIENT_IP',  
  298. 'HTTP_X_CLIENTIP',  
  299. 'HTTP_X_CLUSTER_CLIENT_IP',  
  300. 'HTTP_X_FORWARDED',  
  301. 'HTTP_X_FORWARDED_FOR',  
  302. 'HTTP_X_IP_TRAIL',  
  303. 'HTTP_X_REAL_IP',  
  304. 'HTTP_X_VARNISH',  
  305. 'REMOTE_ADDR' 
  306. ); 
  307.  
  308. foreach ( $ip_related_headers as $header ) { 
  309. if ( isset( $_SERVER[ $header ] ) ) { 
  310. $output[ $header ] = $_SERVER[ $header ]; 
  311.  
  312. return $output; 
  313.  
  314. /** 
  315. * Checks if the IP address has been whitelisted 
  316. * @param string $ip 
  317. * @return bool 
  318. */ 
  319. function ip_is_whitelisted( $ip ) { 
  320. // If we found an exact match in wp-config 
  321. if ( defined( 'JETPACK_IP_ADDRESS_OK' ) && JETPACK_IP_ADDRESS_OK == $ip ) { 
  322. return true; 
  323.  
  324. $whitelist = jetpack_protect_get_local_whitelist(); 
  325.  
  326. if ( is_multisite() ) { 
  327. $whitelist = array_merge( $whitelist, get_site_option( 'jetpack_protect_global_whitelist', array () ) ); 
  328.  
  329. if ( ! empty( $whitelist ) ) : 
  330. foreach ( $whitelist as $item ) : 
  331. // If the IPs are an exact match 
  332. if ( ! $item->range && isset( $item->ip_address ) && $item->ip_address == $ip ) { 
  333. return true; 
  334.  
  335. if ( $item->range && isset( $item->range_low ) && isset( $item->range_high ) ) { 
  336. if ( jetpack_protect_ip_address_is_in_range( $ip, $item->range_low, $item->range_high ) ) { 
  337. return true; 
  338. endforeach; 
  339. endif; 
  340.  
  341. return false; 
  342.  
  343. /** 
  344. * Checks the status for a given IP. API results are cached as transients 
  345. * @param bool $preauth Whether or not we are checking prior to authorization 
  346. * @return bool Either returns true, fires $this->kill_login, or includes a math fallback and returns false 
  347. */ 
  348. function check_login_ability( $preauth = false ) { 
  349. $headers = $this->get_headers(); 
  350. $header_hash = md5( json_encode( $headers ) ); 
  351. $transient_name = 'jpp_li_' . $header_hash; 
  352. $transient_value = $this->get_transient( $transient_name ); 
  353. $ip = jetpack_protect_get_ip(); 
  354.  
  355. if ( jetpack_protect_ip_is_private( $ip ) ) { 
  356. return true; 
  357.  
  358. if ( $this->ip_is_whitelisted( $ip ) ) { 
  359. return true; 
  360.  
  361. // Check out our transients 
  362. if ( isset( $transient_value ) && 'ok' == $transient_value['status'] ) { 
  363. return true; 
  364.  
  365. if ( isset( $transient_value ) && 'blocked' == $transient_value['status'] ) { 
  366. $this->block_with_math(); 
  367.  
  368. if ( isset( $transient_value ) && 'blocked-hard' == $transient_value['status'] ) { 
  369. $this->kill_login(); 
  370.  
  371. // If we've reached this point, this means that the IP isn't cached. 
  372. // Now we check with the Protect API to see if we should allow login 
  373. $response = $this->protect_call( $action = 'check_ip' ); 
  374.  
  375. if ( isset( $response['math'] ) && ! function_exists( 'brute_math_authenticate' ) ) { 
  376. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  377. new Jetpack_Protect_Math_Authenticate; 
  378.  
  379. return false; 
  380.  
  381. if ( 'blocked' == $response['status'] ) { 
  382. $this->block_with_math(); 
  383.  
  384. if ( 'blocked-hard' == $response['status'] ) { 
  385. $this->kill_login(); 
  386.  
  387. return true; 
  388.  
  389. function block_with_math() { 
  390. /** 
  391. * By default, Protect will allow a user who has been blocked for too 
  392. * many failed logins to start answering math questions to continue logging in 
  393. * For added security, you can disable this. 
  394. * @module protect 
  395. * @since 3.6.0 
  396. * @param bool Whether to allow math for blocked users or not. 
  397. */ 
  398.  
  399. $this->block_login_with_math = 1; 
  400. /** 
  401. * Allow Math fallback for blocked IPs. 
  402. * @module protect 
  403. * @since 3.6.0 
  404. * @param bool true Should we fallback to the Math questions when an IP is blocked. Default to true. 
  405. */ 
  406. $allow_math_fallback_on_fail = apply_filters( 'jpp_use_captcha_when_blocked', true ); 
  407. if ( ! $allow_math_fallback_on_fail ) { 
  408. $this->kill_login(); 
  409. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  410. new Jetpack_Protect_Math_Authenticate; 
  411.  
  412. return false; 
  413.  
  414. /** 
  415. * Kill a login attempt 
  416. */ 
  417. function kill_login() { 
  418. $ip = jetpack_protect_get_ip(); 
  419. /** 
  420. * Fires before every killed login. 
  421. * @module protect 
  422. * @since 3.4.0 
  423. * @param string $ip IP flagged by Protect. 
  424. */ 
  425. do_action( 'jpp_kill_login', $ip ); 
  426. $help_url = 'http://jetpack.me/support/security/'; 
  427.  
  428. wp_die( 
  429. sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations. <a href="%2$s">Find out more...</a>', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ), esc_url( $help_url ) ),  
  430. __( 'Login Blocked by Jetpack', 'jetpack' ),  
  431. array ( 'response' => 403 ) 
  432. ); 
  433.  
  434. /** 
  435. * Checks if the protect API call has failed, and if so initiates the math captcha fallback. 
  436. */ 
  437. public function check_use_math() { 
  438. $use_math = $this->get_transient( 'brute_use_math' ); 
  439. if ( $use_math ) { 
  440. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  441. new Jetpack_Protect_Math_Authenticate; 
  442.  
  443. /** 
  444. * Get or delete API key 
  445. */ 
  446. public function configuration_load() { 
  447.  
  448. if ( isset( $_POST['action'] ) && $_POST['action'] == 'jetpack_protect_save_whitelist' && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) { 
  449. $whitelist = str_replace( ' ', '', $_POST['whitelist'] ); 
  450. $whitelist = explode( PHP_EOL, $whitelist ); 
  451. $result = jetpack_protect_save_whitelist( $whitelist ); 
  452. $this->whitelist_saved = ! is_wp_error( $result ); 
  453. $this->whitelist_error = is_wp_error( $result ); 
  454.  
  455. if ( isset( $_POST['action'] ) && 'get_protect_key' == $_POST['action'] && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) { 
  456. $result = $this->get_protect_key(); 
  457. // Only redirect on success 
  458. // If it fails we need access to $this->api_key_error 
  459. if ( $result ) { 
  460. wp_safe_redirect( Jetpack::module_configuration_url( 'protect' ) ); 
  461.  
  462. $this->api_key = get_site_option( 'jetpack_protect_key', false ); 
  463. $this->user_ip = jetpack_protect_get_ip(); 
  464.  
  465. public function configuration_head() { 
  466. wp_enqueue_style( 'jetpack-protect' ); 
  467.  
  468. /** 
  469. * Prints the configuration screen 
  470. */ 
  471. public function configuration_screen() { 
  472. require_once dirname( __FILE__ ) . '/protect/config-ui.php'; 
  473.  
  474. /** 
  475. * If we're in a multisite network, return the blog ID of the primary blog 
  476. * @return int 
  477. */ 
  478. public function get_main_blog_id() { 
  479. if ( ! is_multisite() ) { 
  480. return false; 
  481.  
  482. global $current_site; 
  483. $primary_blog_id = $current_site->blog_id; 
  484.  
  485. return $primary_blog_id; 
  486.  
  487. /** 
  488. * Get jetpack blog id, or the jetpack blog id of the main blog in the main network 
  489. * @return int 
  490. */ 
  491. public function get_main_blog_jetpack_id() { 
  492. if ( ! is_main_site() ) { 
  493. switch_to_blog( $this->get_main_blog_id() ); 
  494. $id = Jetpack::get_option( 'id', false ); 
  495. restore_current_blog(); 
  496. } else { 
  497. $id = Jetpack::get_option( 'id' ); 
  498.  
  499. return $id; 
  500.  
  501. public function check_api_key() { 
  502. $response = $this->protect_call( 'check_key' ); 
  503.  
  504. if ( isset( $response['ckval'] ) ) { 
  505. return true; 
  506.  
  507. if ( isset( $response['error'] ) ) { 
  508.  
  509. if ( $response['error'] == 'Invalid API Key' ) { 
  510. $this->api_key_error = __( 'Your API key is invalid', 'jetpack' ); 
  511.  
  512. if ( $response['error'] == 'API Key Required' ) { 
  513. $this->api_key_error = __( 'No API key', 'jetpack' ); 
  514.  
  515. $this->api_key_error = __( 'There was an error contacting Jetpack servers.', 'jetpack' ); 
  516.  
  517. return false; 
  518.  
  519. /** 
  520. * Calls over to the api using wp_remote_post 
  521. * @param string $action 'check_ip', 'check_key', or 'failed_attempt' 
  522. * @param array $request Any custom data to post to the api 
  523. * @return array 
  524. */ 
  525. function protect_call( $action = 'check_ip', $request = array () ) { 
  526. global $wp_version, $wpdb, $current_user; 
  527.  
  528. $api_key = get_site_option( 'jetpack_protect_key' ); 
  529.  
  530. $user_agent = "WordPress/{$wp_version} | Jetpack/" . constant( 'JETPACK__VERSION' ); 
  531.  
  532. $request['action'] = $action; 
  533. $request['ip'] = jetpack_protect_get_ip(); 
  534. $request['host'] = $this->get_local_host(); 
  535. $request['headers'] = json_encode( $this->get_headers() ); 
  536. $request['jetpack_version'] = constant( 'JETPACK__VERSION' ); 
  537. $request['wordpress_version'] = strval( $wp_version ); 
  538. $request['api_key'] = $api_key; 
  539. $request['multisite'] = "0"; 
  540.  
  541. if ( is_multisite() ) { 
  542. $request['multisite'] = get_blog_count(); 
  543.  
  544. $args = array ( 
  545. 'body' => $request,  
  546. 'user-agent' => $user_agent,  
  547. 'httpversion' => '1.0',  
  548. 'timeout' => 15 
  549. ); 
  550.  
  551. $response_json = wp_remote_post( $this->get_api_host(), $args ); 
  552. $this->last_response_raw = $response_json; 
  553. $headers = $this->get_headers(); 
  554. $header_hash = md5( json_encode( $headers ) ); 
  555. $transient_name = 'jpp_li_' . $header_hash; 
  556. $this->delete_transient( $transient_name ); 
  557.  
  558. if ( is_array( $response_json ) ) { 
  559. $response = json_decode( $response_json['body'], true ); 
  560.  
  561. if ( isset( $response['blocked_attempts'] ) && $response['blocked_attempts'] ) { 
  562. update_site_option( 'jetpack_protect_blocked_attempts', $response['blocked_attempts'] ); 
  563.  
  564. if ( isset( $response['status'] ) && ! isset( $response['error'] ) ) { 
  565. $response['expire'] = time() + $response['seconds_remaining']; 
  566. $this->set_transient( $transient_name, $response, $response['seconds_remaining'] ); 
  567. $this->delete_transient( 'brute_use_math' ); 
  568. } else { // Fallback to Math Captcha if no response from API host 
  569. $this->set_transient( 'brute_use_math', 1, 600 ); 
  570. $response['status'] = 'ok'; 
  571. $response['math'] = true; 
  572.  
  573. if ( isset( $response['error'] ) ) { 
  574. update_site_option( 'jetpack_protect_error', $response['error'] ); 
  575. } else { 
  576. delete_site_option( 'jetpack_protect_error' ); 
  577.  
  578. return $response; 
  579.  
  580.  
  581. /** 
  582. * Wrapper for WordPress set_transient function, our version sets 
  583. * the transient on the main site in the network if this is a multisite network 
  584. * We do it this way (instead of set_site_transient) because of an issue where 
  585. * sitewide transients are always autoloaded 
  586. * https://core.trac.wordpress.org/ticket/22846 
  587. * @param string $transient Transient name. Expected to not be SQL-escaped. Must be 
  588. * 45 characters or fewer in length. 
  589. * @param mixed $value Transient value. Must be serializable if non-scalar. 
  590. * Expected to not be SQL-escaped. 
  591. * @param int $expiration Optional. Time until expiration in seconds. Default 0. 
  592. * @return bool False if value was not set and true if value was set. 
  593. */ 
  594. function set_transient( $transient, $value, $expiration ) { 
  595. if ( is_multisite() && ! is_main_site() ) { 
  596. switch_to_blog( $this->get_main_blog_id() ); 
  597. $return = set_transient( $transient, $value, $expiration ); 
  598. restore_current_blog(); 
  599.  
  600. return $return; 
  601.  
  602. return set_transient( $transient, $value, $expiration ); 
  603.  
  604. /** 
  605. * Wrapper for WordPress delete_transient function, our version deletes 
  606. * the transient on the main site in the network if this is a multisite network 
  607. * @param string $transient Transient name. Expected to not be SQL-escaped. 
  608. * @return bool true if successful, false otherwise 
  609. */ 
  610. function delete_transient( $transient ) { 
  611. if ( is_multisite() && ! is_main_site() ) { 
  612. switch_to_blog( $this->get_main_blog_id() ); 
  613. $return = delete_transient( $transient ); 
  614. restore_current_blog(); 
  615.  
  616. return $return; 
  617.  
  618. return delete_transient( $transient ); 
  619.  
  620. /** 
  621. * Wrapper for WordPress get_transient function, our version gets 
  622. * the transient on the main site in the network if this is a multisite network 
  623. * @param string $transient Transient name. Expected to not be SQL-escaped. 
  624. * @return mixed Value of transient. 
  625. */ 
  626. function get_transient( $transient ) { 
  627. if ( is_multisite() && ! is_main_site() ) { 
  628. switch_to_blog( $this->get_main_blog_id() ); 
  629. $return = get_transient( $transient ); 
  630. restore_current_blog(); 
  631.  
  632. return $return; 
  633.  
  634. return get_transient( $transient ); 
  635.  
  636. function get_api_host() { 
  637. if ( isset( $this->api_endpoint ) ) { 
  638. return $this->api_endpoint; 
  639.  
  640. //Check to see if we can use SSL 
  641. $this->api_endpoint = Jetpack::fix_url_for_bad_hosts( JETPACK_PROTECT__API_HOST ); 
  642.  
  643. return $this->api_endpoint; 
  644.  
  645. function get_local_host() { 
  646. if ( isset( $this->local_host ) ) { 
  647. return $this->local_host; 
  648.  
  649. $uri = 'http://' . strtolower( $_SERVER['HTTP_HOST'] ); 
  650.  
  651. if ( is_multisite() ) { 
  652. $uri = network_home_url(); 
  653.  
  654. $uridata = parse_url( $uri ); 
  655.  
  656. $domain = $uridata['host']; 
  657.  
  658. // If we still don't have the site_url, get it 
  659. if ( ! $domain ) { 
  660. $uri = get_site_url( 1 ); 
  661. $uridata = parse_url( $uri ); 
  662. $domain = $uridata['host']; 
  663.  
  664. $this->local_host = $domain; 
  665.  
  666. return $this->local_host; 
  667.