/modules/protect.php

  1. <?php 
  2. /** 
  3. * Module Name: Protect 
  4. * Module Description: Prevent brute force attacks. 
  5. * Sort Order: 1 
  6. * Recommendation Order: 4 
  7. * First Introduced: 3.4 
  8. * Requires Connection: Yes 
  9. * Auto Activate: Yes 
  10. * Module Tags: Recommended 
  11. * Feature: Recommended, Performance-Security 
  12. * Additional Search Queries: security, secure, protection, botnet, brute force, protect, login 
  13. */ 
  14.  
  15. include_once JETPACK__PLUGIN_DIR . 'modules/protect/shared-functions.php'; 
  16.  
  17. class Jetpack_Protect_Module { 
  18.  
  19. private static $__instance = null; 
  20. public $api_key; 
  21. public $api_key_error; 
  22. public $whitelist; 
  23. public $whitelist_error; 
  24. public $whitelist_saved; 
  25. private $user_ip; 
  26. private $local_host; 
  27. private $api_endpoint; 
  28. public $last_request; 
  29. public $last_response_raw; 
  30. public $last_response; 
  31. private $block_login_with_math; 
  32.  
  33. /** 
  34. * Singleton implementation 
  35. * 
  36. * @return object 
  37. */ 
  38. public static function instance() { 
  39. if ( ! is_a( self::$__instance, 'Jetpack_Protect_Module' ) ) { 
  40. self::$__instance = new Jetpack_Protect_Module(); 
  41.  
  42. return self::$__instance; 
  43.  
  44. /** 
  45. * Registers actions 
  46. */ 
  47. private function __construct() { 
  48. add_action( 'jetpack_activate_module_protect', array ( $this, 'on_activation' ) ); 
  49. add_action( 'jetpack_deactivate_module_protect', array ( $this, 'on_deactivation' ) ); 
  50. add_action( 'init', array ( $this, 'maybe_get_protect_key' ) ); 
  51. add_action( 'jetpack_modules_loaded', array ( $this, 'modules_loaded' ) ); 
  52. add_action( 'login_head', array ( $this, 'check_use_math' ) ); 
  53. add_filter( 'authenticate', array ( $this, 'check_preauth' ), 10, 3 ); 
  54. add_action( 'wp_login', array ( $this, 'log_successful_login' ), 10, 2 ); 
  55. add_action( 'wp_login_failed', array ( $this, 'log_failed_attempt' ) ); 
  56. add_action( 'admin_init', array ( $this, 'maybe_update_headers' ) ); 
  57. add_action( 'admin_init', array ( $this, 'maybe_display_security_warning' ) ); 
  58.  
  59. // This is a backup in case $pagenow fails for some reason 
  60. add_action( 'login_head', array ( $this, 'check_login_ability' ) ); 
  61.  
  62. // Runs a script every day to clean up expired transients so they don't 
  63. // clog up our users' databases 
  64. require_once( JETPACK__PLUGIN_DIR . '/modules/protect/transient-cleanup.php' ); 
  65.  
  66. //this should move into on_activation in 3.8, but, for now, we want to make sure all sites get this option set 
  67. if ( is_multisite() && is_main_site() ) { 
  68. update_site_option( 'jetpack_protect_active', 1 ); 
  69.  
  70.  
  71.  
  72. /** 
  73. * On module activation, try to get an api key 
  74. */ 
  75. public function on_activation() { 
  76. update_site_option( 'jetpack_protect_activating', 'activating' ); 
  77.  
  78. // Get BruteProtect's counter number 
  79. Jetpack_Protect_Module::protect_call( 'check_key' ); 
  80.  
  81. /** 
  82. * On module deactivation, unset protect_active 
  83. */ 
  84. public function on_deactivation() { 
  85. if ( is_multisite() && is_main_site() ) { 
  86. update_site_option( 'jetpack_protect_active', 0 ); 
  87.  
  88. public function maybe_get_protect_key() { 
  89. if ( get_site_option( 'jetpack_protect_activating', false ) && ! get_site_option( 'jetpack_protect_key', false ) ) { 
  90. $this->get_protect_key(); 
  91. delete_site_option( 'jetpack_protect_activating' ); 
  92.  
  93. /** 
  94. * Sends a "check_key" API call once a day. This call allows us to track IP-related 
  95. * headers for this server via the Protect API, in order to better identify the source 
  96. * IP for login attempts 
  97. */ 
  98. public function maybe_update_headers( $force = false ) { 
  99. $updated_recently = $this->get_transient( 'jpp_headers_updated_recently' ); 
  100.  
  101. if ( ! $force ) { 
  102. if ( isset( $_GET['protect_update_headers'] ) ) { 
  103. $force = true; 
  104.  
  105. // check that current user is admin so we prevent a lower level user from adding 
  106. // a trusted header, allowing them to brute force an admin account 
  107. if ( ( $updated_recently && ! $force ) || ! current_user_can( 'update_plugins' ) ) { 
  108. return; 
  109.  
  110. $response = Jetpack_Protect_Module::protect_call( 'check_key' ); 
  111. $this->set_transient( 'jpp_headers_updated_recently', 1, DAY_IN_SECONDS ); 
  112.  
  113. if ( isset( $response['msg'] ) && $response['msg'] ) { 
  114. update_site_option( 'trusted_ip_header', json_decode( $response['msg'] ) ); 
  115.  
  116.  
  117. public function maybe_display_security_warning() { 
  118. if ( is_multisite() && current_user_can( 'manage_network' ) ) { 
  119. if ( ! function_exists( 'is_plugin_active_for_network' ) ) { 
  120. require_once( ABSPATH . '/wp-admin/includes/plugin.php' ); 
  121.  
  122. if ( ! is_plugin_active_for_network( 'jetpack/jetpack.php' ) ) { 
  123. add_action( 'load-index.php', array ( $this, 'prepare_jetpack_protect_multisite_notice' ) ); 
  124.  
  125. public function prepare_jetpack_protect_multisite_notice() { 
  126. add_action( 'admin_print_styles', array ( $this, 'admin_banner_styles' ) ); 
  127. add_action( 'admin_notices', array ( $this, 'admin_jetpack_manage_notice' ) ); 
  128.  
  129. public function admin_banner_styles() { 
  130. global $wp_styles; 
  131.  
  132. $min = ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) ? '' : '.min'; 
  133.  
  134. wp_enqueue_style( 'jetpack', plugins_url( "css/jetpack-banners{$min}.css", JETPACK__PLUGIN_FILE ), false, JETPACK__VERSION ); 
  135. $wp_styles->add_data( 'jetpack', 'rtl', true ); 
  136.  
  137. public function admin_jetpack_manage_notice() { 
  138.  
  139. $dismissed = get_site_option( 'jetpack_dismissed_protect_multisite_banner' ); 
  140.  
  141. if ( $dismissed ) { 
  142. return; 
  143.  
  144. $referer = '&_wp_http_referer=' . add_query_arg( '_wp_http_referer', null ); 
  145. $opt_out_url = wp_nonce_url( Jetpack::admin_url( 'jetpack-notice=jetpack-protect-multisite-opt-out' . $referer ), 'jetpack_protect_multisite_banner_opt_out' ); 
  146.  
  147. ?> 
  148. <div id="message" class="updated jetpack-message jp-banner is-opt-in protect-error" 
  149. style="display:block !important;"> 
  150. <a class="jp-banner__dismiss" href="<?php echo esc_url( $opt_out_url ); ?>" 
  151. title="<?php esc_attr_e( 'Dismiss this notice.', 'jetpack' ); ?>"></a> 
  152.  
  153. <div class="jp-banner__content"> 
  154. <h4><?php esc_html_e( 'Protect cannot keep your site secure.', 'jetpack' ); ?></h4> 
  155.  
  156. <p><?php printf( __( 'Thanks for activating Protect! To start protecting your site, please network activate Jetpack on your Multisite installation and activate Protect on your primary site. Due to the way logins are handled on WordPress Multisite, Jetpack must be network-enabled in order for Protect to work properly. <a href="%s" target="_blank">Learn More</a>', 'jetpack' ), 'http://jetpack.me/support/multisite-protect' ); ?></p> 
  157. </div> 
  158. <div class="jp-banner__action-container is-opt-in"> 
  159. <a href="<?php echo network_admin_url( 'plugins.php' ); ?>" class="jp-banner__button" 
  160. id="wpcom-connect"><?php _e( 'View Network Admin', 'jetpack' ); ?></a> 
  161. </div> 
  162. </div> 
  163. <?php 
  164.  
  165. /** 
  166. * Request an api key from wordpress.com 
  167. * 
  168. * @return bool | string 
  169. */ 
  170. public function get_protect_key() { 
  171.  
  172. $protect_blog_id = Jetpack_Protect_Module::get_main_blog_jetpack_id(); 
  173.  
  174. // If we can't find the the blog id, that means we are on multisite, and the main site never connected 
  175. // the protect api key is linked to the main blog id - instruct the user to connect their main blog 
  176. if ( ! $protect_blog_id ) { 
  177. $this->api_key_error = __( 'Your main blog is not connected to WordPress.com. Please connect to get an API key.', 'jetpack' ); 
  178.  
  179. return false; 
  180.  
  181. $request = array ( 
  182. 'jetpack_blog_id' => $protect_blog_id,  
  183. 'bruteprotect_api_key' => get_site_option( 'bruteprotect_api_key' ),  
  184. 'multisite' => '0',  
  185. ); 
  186.  
  187. // Send the number of blogs on the network if we are on multisite 
  188. if ( is_multisite() ) { 
  189. $request['multisite'] = get_blog_count(); 
  190. if ( ! $request['multisite'] ) { 
  191. global $wpdb; 
  192. $request['multisite'] = $wpdb->get_var( "SELECT COUNT(blog_id) as c FROM $wpdb->blogs WHERE spam = '0' AND deleted = '0' and archived = '0'" ); 
  193.  
  194. // Request the key 
  195. Jetpack::load_xml_rpc_client(); 
  196. $xml = new Jetpack_IXR_Client( array ( 
  197. 'user_id' => get_current_user_id() 
  198. ) ); 
  199. $xml->query( 'jetpack.protect.requestKey', $request ); 
  200.  
  201. // Hmm, can't talk to wordpress.com 
  202. if ( $xml->isError() ) { 
  203. $code = $xml->getErrorCode(); 
  204. $message = $xml->getErrorMessage(); 
  205. $this->api_key_error = sprintf( __( 'Error connecting to WordPress.com. Code: %1$s, %2$s', 'jetpack' ), $code, $message ); 
  206.  
  207. return false; 
  208.  
  209. $response = $xml->getResponse(); 
  210.  
  211. // Hmm. Can't talk to the protect servers ( api.bruteprotect.com ) 
  212. if ( ! isset( $response['data'] ) ) { 
  213. $this->api_key_error = __( 'No reply from Jetpack servers', 'jetpack' ); 
  214.  
  215. return false; 
  216.  
  217. // There was an issue generating the key 
  218. if ( empty( $response['success'] ) ) { 
  219. $this->api_key_error = $response['data']; 
  220.  
  221. return false; 
  222.  
  223. // Key generation successful! 
  224. $active_plugins = Jetpack::get_active_plugins(); 
  225.  
  226. // We only want to deactivate BruteProtect if we successfully get a key 
  227. if ( in_array( 'bruteprotect/bruteprotect.php', $active_plugins ) ) { 
  228. Jetpack_Client_Server::deactivate_plugin( 'bruteprotect/bruteprotect.php', 'BruteProtect' ); 
  229.  
  230. $key = $response['data']; 
  231. update_site_option( 'jetpack_protect_key', $key ); 
  232.  
  233. return $key; 
  234.  
  235. /** 
  236. * Called via WP action wp_login_failed to log failed attempt with the api 
  237. * 
  238. * Fires custom, plugable action jpp_log_failed_attempt with the IP 
  239. * 
  240. * @return void 
  241. */ 
  242. function log_failed_attempt() { 
  243. /** 
  244. * Fires before every failed login attempt. 
  245. * 
  246. * @module protect 
  247. * 
  248. * @since 3.4.0 
  249. * 
  250. * @param string jetpack_protect_get_ip IP stored by Protect. 
  251. */ 
  252. do_action( 'jpp_log_failed_attempt', jetpack_protect_get_ip() ); 
  253.  
  254. if ( isset( $_COOKIE['jpp_math_pass'] ) ) { 
  255.  
  256. $transient = $this->get_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); 
  257. $transient--; 
  258.  
  259. if ( ! $transient || $transient < 1 ) { 
  260. $this->delete_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] ); 
  261. setcookie( 'jpp_math_pass', 0, time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false ); 
  262. } else { 
  263. $this->set_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'], $transient, DAY_IN_SECONDS ); 
  264.  
  265. $this->protect_call( 'failed_attempt' ); 
  266.  
  267. /** 
  268. * Set up the Protect configuration page 
  269. */ 
  270. public function modules_loaded() { 
  271. Jetpack::enable_module_configurable( __FILE__ ); 
  272. Jetpack::module_configuration_load( __FILE__, array ( $this, 'configuration_load' ) ); 
  273. Jetpack::module_configuration_head( __FILE__, array ( $this, 'configuration_head' ) ); 
  274. Jetpack::module_configuration_screen( __FILE__, array ( $this, 'configuration_screen' ) ); 
  275.  
  276. /** 
  277. * Logs a successful login back to our servers, this allows us to make sure we're not blocking 
  278. * a busy IP that has a lot of good logins along with some forgotten passwords. Also saves current user's ip 
  279. * to the ip address whitelist 
  280. */ 
  281. public function log_successful_login( $user_login, $user ) { 
  282. $this->protect_call( 'successful_login', array ( 'roles' => $user->roles ) ); 
  283.  
  284.  
  285. /** 
  286. * Checks for loginability BEFORE authentication so that bots don't get to go around the log in form. 
  287. * 
  288. * If we are using our math fallback, authenticate via math-fallback.php 
  289. * 
  290. * @param string $user 
  291. * @param string $username 
  292. * @param string $password 
  293. * 
  294. * @return string $user 
  295. */ 
  296. function check_preauth( $user = 'Not Used By Protect', $username = 'Not Used By Protect', $password = 'Not Used By Protect' ) { 
  297. $allow_login = $this->check_login_ability( true ); 
  298. $use_math = $this->get_transient( 'brute_use_math' ); 
  299.  
  300. if ( ! $allow_login ) { 
  301. $this->block_with_math(); 
  302.  
  303. if ( ( 1 == $use_math || 1 == $this->block_login_with_math ) && isset( $_POST['log'] ) ) { 
  304. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  305. Jetpack_Protect_Math_Authenticate::math_authenticate(); 
  306.  
  307. return $user; 
  308.  
  309. /** 
  310. * Get all IP headers so that we can process on our server... 
  311. * 
  312. * @return string 
  313. */ 
  314. function get_headers() { 
  315. $ip_related_headers = array ( 
  316. 'GD_PHP_HANDLER',  
  317. 'HTTP_AKAMAI_ORIGIN_HOP',  
  318. 'HTTP_CF_CONNECTING_IP',  
  319. 'HTTP_CLIENT_IP',  
  320. 'HTTP_FASTLY_CLIENT_IP',  
  321. 'HTTP_FORWARDED',  
  322. 'HTTP_FORWARDED_FOR',  
  323. 'HTTP_INCAP_CLIENT_IP',  
  324. 'HTTP_TRUE_CLIENT_IP',  
  325. 'HTTP_X_CLIENTIP',  
  326. 'HTTP_X_CLUSTER_CLIENT_IP',  
  327. 'HTTP_X_FORWARDED',  
  328. 'HTTP_X_FORWARDED_FOR',  
  329. 'HTTP_X_IP_TRAIL',  
  330. 'HTTP_X_REAL_IP',  
  331. 'HTTP_X_VARNISH',  
  332. 'REMOTE_ADDR' 
  333. ); 
  334.  
  335. foreach ( $ip_related_headers as $header ) { 
  336. if ( isset( $_SERVER[ $header ] ) ) { 
  337. $output[ $header ] = $_SERVER[ $header ]; 
  338.  
  339. return $output; 
  340.  
  341. /** 
  342. * Checks if the IP address has been whitelisted 
  343. * 
  344. * @param string $ip 
  345. * 
  346. * @return bool 
  347. */ 
  348. function ip_is_whitelisted( $ip ) { 
  349. // If we found an exact match in wp-config 
  350. if ( defined( 'JETPACK_IP_ADDRESS_OK' ) && JETPACK_IP_ADDRESS_OK == $ip ) { 
  351. return true; 
  352.  
  353. $whitelist = jetpack_protect_get_local_whitelist(); 
  354.  
  355. if ( is_multisite() ) { 
  356. $whitelist = array_merge( $whitelist, get_site_option( 'jetpack_protect_global_whitelist', array () ) ); 
  357.  
  358. if ( ! empty( $whitelist ) ) : 
  359. foreach ( $whitelist as $item ) : 
  360. // If the IPs are an exact match 
  361. if ( ! $item->range && isset( $item->ip_address ) && $item->ip_address == $ip ) { 
  362. return true; 
  363.  
  364. if ( $item->range && isset( $item->range_low ) && isset( $item->range_high ) ) { 
  365. if ( jetpack_protect_ip_address_is_in_range( $ip, $item->range_low, $item->range_high ) ) { 
  366. return true; 
  367. endforeach; 
  368. endif; 
  369.  
  370. return false; 
  371.  
  372. /** 
  373. * Checks the status for a given IP. API results are cached as transients 
  374. * 
  375. * @param bool $preauth Whether or not we are checking prior to authorization 
  376. * 
  377. * @return bool Either returns true, fires $this->kill_login, or includes a math fallback and returns false 
  378. */ 
  379. function check_login_ability( $preauth = false ) { 
  380. $headers = $this->get_headers(); 
  381. $header_hash = md5( json_encode( $headers ) ); 
  382. $transient_name = 'jpp_li_' . $header_hash; 
  383. $transient_value = $this->get_transient( $transient_name ); 
  384. $ip = jetpack_protect_get_ip(); 
  385.  
  386. if ( jetpack_protect_ip_is_private( $ip ) ) { 
  387. return true; 
  388.  
  389. if ( $this->ip_is_whitelisted( $ip ) ) { 
  390. return true; 
  391.  
  392. // Check out our transients 
  393. if ( isset( $transient_value ) && 'ok' == $transient_value['status'] ) { 
  394. return true; 
  395.  
  396. if ( isset( $transient_value ) && 'blocked' == $transient_value['status'] ) { 
  397. $this->block_with_math(); 
  398.  
  399. if ( isset( $transient_value ) && 'blocked-hard' == $transient_value['status'] ) { 
  400. $this->kill_login(); 
  401.  
  402. // If we've reached this point, this means that the IP isn't cached. 
  403. // Now we check with the Protect API to see if we should allow login 
  404. $response = $this->protect_call( $action = 'check_ip' ); 
  405.  
  406. if ( isset( $response['math'] ) && ! function_exists( 'brute_math_authenticate' ) ) { 
  407. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  408. new Jetpack_Protect_Math_Authenticate; 
  409.  
  410. return false; 
  411.  
  412. if ( 'blocked' == $response['status'] ) { 
  413. $this->block_with_math(); 
  414.  
  415. if ( 'blocked-hard' == $response['status'] ) { 
  416. $this->kill_login(); 
  417.  
  418. return true; 
  419.  
  420. function block_with_math() { 
  421. /** 
  422. * By default, Protect will allow a user who has been blocked for too 
  423. * many failed logins to start answering math questions to continue logging in 
  424. * 
  425. * For added security, you can disable this. 
  426. * 
  427. * @module protect 
  428. * 
  429. * @since 3.6.0 
  430. * 
  431. * @param bool Whether to allow math for blocked users or not. 
  432. */ 
  433.  
  434. $this->block_login_with_math = 1; 
  435. /** 
  436. * Allow Math fallback for blocked IPs. 
  437. * 
  438. * @module protect 
  439. * 
  440. * @since 3.6.0 
  441. * 
  442. * @param bool true Should we fallback to the Math questions when an IP is blocked. Default to true. 
  443. */ 
  444. $allow_math_fallback_on_fail = apply_filters( 'jpp_use_captcha_when_blocked', true ); 
  445. if ( ! $allow_math_fallback_on_fail ) { 
  446. $this->kill_login(); 
  447. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  448. new Jetpack_Protect_Math_Authenticate; 
  449.  
  450. return false; 
  451.  
  452. /** 
  453. * Kill a login attempt 
  454. */ 
  455. function kill_login() { 
  456. $ip = jetpack_protect_get_ip(); 
  457. /** 
  458. * Fires before every killed login. 
  459. * 
  460. * @module protect 
  461. * 
  462. * @since 3.4.0 
  463. * 
  464. * @param string $ip IP flagged by Protect. 
  465. */ 
  466. do_action( 'jpp_kill_login', $ip ); 
  467. $help_url = 'http://jetpack.me/support/security/'; 
  468.  
  469. wp_die( 
  470. sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations. <a href="%2$s">Find out more...</a>', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ), esc_url( $help_url ) ),  
  471. __( 'Login Blocked by Jetpack', 'jetpack' ),  
  472. array ( 'response' => 403 ) 
  473. ); 
  474.  
  475. /** 
  476. * Checks if the protect API call has failed, and if so initiates the math captcha fallback. 
  477. */ 
  478. public function check_use_math() { 
  479. $use_math = $this->get_transient( 'brute_use_math' ); 
  480. if ( $use_math ) { 
  481. include_once dirname( __FILE__ ) . '/protect/math-fallback.php'; 
  482. new Jetpack_Protect_Math_Authenticate; 
  483.  
  484. /** 
  485. * Get or delete API key 
  486. */ 
  487. public function configuration_load() { 
  488.  
  489. if ( isset( $_POST['action'] ) && $_POST['action'] == 'jetpack_protect_save_whitelist' && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) { 
  490. $whitelist = str_replace( ' ', '', $_POST['whitelist'] ); 
  491. $whitelist = explode( PHP_EOL, $whitelist ); 
  492. $result = jetpack_protect_save_whitelist( $whitelist ); 
  493. $this->whitelist_saved = ! is_wp_error( $result ); 
  494. $this->whitelist_error = is_wp_error( $result ); 
  495.  
  496. if ( isset( $_POST['action'] ) && 'get_protect_key' == $_POST['action'] && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) { 
  497. $result = $this->get_protect_key(); 
  498. // Only redirect on success 
  499. // If it fails we need access to $this->api_key_error 
  500. if ( $result ) { 
  501. wp_safe_redirect( Jetpack::module_configuration_url( 'protect' ) ); 
  502.  
  503. $this->api_key = get_site_option( 'jetpack_protect_key', false ); 
  504. $this->user_ip = jetpack_protect_get_ip(); 
  505.  
  506. public function configuration_head() { 
  507. wp_enqueue_style( 'jetpack-protect' ); 
  508.  
  509. /** 
  510. * Prints the configuration screen 
  511. */ 
  512. public function configuration_screen() { 
  513. require_once dirname( __FILE__ ) . '/protect/config-ui.php'; 
  514.  
  515. /** 
  516. * If we're in a multisite network, return the blog ID of the primary blog 
  517. * 
  518. * @return int 
  519. */ 
  520. public function get_main_blog_id() { 
  521. if ( ! is_multisite() ) { 
  522. return false; 
  523.  
  524. global $current_site; 
  525. $primary_blog_id = $current_site->blog_id; 
  526.  
  527. return $primary_blog_id; 
  528.  
  529. /** 
  530. * Get jetpack blog id, or the jetpack blog id of the main blog in the main network 
  531. * 
  532. * @return int 
  533. */ 
  534. public function get_main_blog_jetpack_id() { 
  535. if ( ! is_main_site() ) { 
  536. switch_to_blog( $this->get_main_blog_id() ); 
  537. $id = Jetpack::get_option( 'id', false ); 
  538. restore_current_blog(); 
  539. } else { 
  540. $id = Jetpack::get_option( 'id' ); 
  541.  
  542. return $id; 
  543.  
  544. public function check_api_key() { 
  545. $response = $this->protect_call( 'check_key' ); 
  546.  
  547. if ( isset( $response['ckval'] ) ) { 
  548. return true; 
  549.  
  550. if ( isset( $response['error'] ) ) { 
  551.  
  552. if ( $response['error'] == 'Invalid API Key' ) { 
  553. $this->api_key_error = __( 'Your API key is invalid', 'jetpack' ); 
  554.  
  555. if ( $response['error'] == 'API Key Required' ) { 
  556. $this->api_key_error = __( 'No API key', 'jetpack' ); 
  557.  
  558. $this->api_key_error = __( 'There was an error contacting Jetpack servers.', 'jetpack' ); 
  559.  
  560. return false; 
  561.  
  562. /** 
  563. * Calls over to the api using wp_remote_post 
  564. * 
  565. * @param string $action 'check_ip', 'check_key', or 'failed_attempt' 
  566. * @param array $request Any custom data to post to the api 
  567. * 
  568. * @return array 
  569. */ 
  570. function protect_call( $action = 'check_ip', $request = array () ) { 
  571. global $wp_version, $wpdb, $current_user; 
  572.  
  573. $api_key = get_site_option( 'jetpack_protect_key' ); 
  574.  
  575. $user_agent = "WordPress/{$wp_version} | Jetpack/" . constant( 'JETPACK__VERSION' ); 
  576.  
  577. $request['action'] = $action; 
  578. $request['ip'] = jetpack_protect_get_ip(); 
  579. $request['host'] = $this->get_local_host(); 
  580. $request['headers'] = json_encode( $this->get_headers() ); 
  581. $request['jetpack_version'] = constant( 'JETPACK__VERSION' ); 
  582. $request['wordpress_version'] = strval( $wp_version ); 
  583. $request['api_key'] = $api_key; 
  584. $request['multisite'] = "0"; 
  585.  
  586. if ( is_multisite() ) { 
  587. $request['multisite'] = get_blog_count(); 
  588.  
  589. $args = array ( 
  590. 'body' => $request,  
  591. 'user-agent' => $user_agent,  
  592. 'httpversion' => '1.0',  
  593. 'timeout' => 15 
  594. ); 
  595.  
  596. $response_json = wp_remote_post( $this->get_api_host(), $args ); 
  597. $this->last_response_raw = $response_json; 
  598. $headers = $this->get_headers(); 
  599. $header_hash = md5( json_encode( $headers ) ); 
  600. $transient_name = 'jpp_li_' . $header_hash; 
  601. $this->delete_transient( $transient_name ); 
  602.  
  603. if ( is_array( $response_json ) ) { 
  604. $response = json_decode( $response_json['body'], true ); 
  605.  
  606. if ( isset( $response['blocked_attempts'] ) && $response['blocked_attempts'] ) { 
  607. update_site_option( 'jetpack_protect_blocked_attempts', $response['blocked_attempts'] ); 
  608.  
  609. if ( isset( $response['status'] ) && ! isset( $response['error'] ) ) { 
  610. $response['expire'] = time() + $response['seconds_remaining']; 
  611. $this->set_transient( $transient_name, $response, $response['seconds_remaining'] ); 
  612. $this->delete_transient( 'brute_use_math' ); 
  613. } else { // Fallback to Math Captcha if no response from API host 
  614. $this->set_transient( 'brute_use_math', 1, 600 ); 
  615. $response['status'] = 'ok'; 
  616. $response['math'] = true; 
  617.  
  618. if ( isset( $response['error'] ) ) { 
  619. update_site_option( 'jetpack_protect_error', $response['error'] ); 
  620. } else { 
  621. delete_site_option( 'jetpack_protect_error' ); 
  622.  
  623. return $response; 
  624.  
  625.  
  626. /** 
  627. * Wrapper for WordPress set_transient function, our version sets 
  628. * the transient on the main site in the network if this is a multisite network 
  629. * 
  630. * We do it this way (instead of set_site_transient) because of an issue where 
  631. * sitewide transients are always autoloaded 
  632. * https://core.trac.wordpress.org/ticket/22846 
  633. * 
  634. * @param string $transient Transient name. Expected to not be SQL-escaped. Must be 
  635. * 45 characters or fewer in length. 
  636. * @param mixed $value Transient value. Must be serializable if non-scalar. 
  637. * Expected to not be SQL-escaped. 
  638. * @param int $expiration Optional. Time until expiration in seconds. Default 0. 
  639. * 
  640. * @return bool False if value was not set and true if value was set. 
  641. */ 
  642. function set_transient( $transient, $value, $expiration ) { 
  643. if ( is_multisite() && ! is_main_site() ) { 
  644. switch_to_blog( $this->get_main_blog_id() ); 
  645. $return = set_transient( $transient, $value, $expiration ); 
  646. restore_current_blog(); 
  647.  
  648. return $return; 
  649.  
  650. return set_transient( $transient, $value, $expiration ); 
  651.  
  652. /** 
  653. * Wrapper for WordPress delete_transient function, our version deletes 
  654. * the transient on the main site in the network if this is a multisite network 
  655. * 
  656. * @param string $transient Transient name. Expected to not be SQL-escaped. 
  657. * 
  658. * @return bool true if successful, false otherwise 
  659. */ 
  660. function delete_transient( $transient ) { 
  661. if ( is_multisite() && ! is_main_site() ) { 
  662. switch_to_blog( $this->get_main_blog_id() ); 
  663. $return = delete_transient( $transient ); 
  664. restore_current_blog(); 
  665.  
  666. return $return; 
  667.  
  668. return delete_transient( $transient ); 
  669.  
  670. /** 
  671. * Wrapper for WordPress get_transient function, our version gets 
  672. * the transient on the main site in the network if this is a multisite network 
  673. * 
  674. * @param string $transient Transient name. Expected to not be SQL-escaped. 
  675. * 
  676. * @return mixed Value of transient. 
  677. */ 
  678. function get_transient( $transient ) { 
  679. if ( is_multisite() && ! is_main_site() ) { 
  680. switch_to_blog( $this->get_main_blog_id() ); 
  681. $return = get_transient( $transient ); 
  682. restore_current_blog(); 
  683.  
  684. return $return; 
  685.  
  686. return get_transient( $transient ); 
  687.  
  688. function get_api_host() { 
  689. if ( isset( $this->api_endpoint ) ) { 
  690. return $this->api_endpoint; 
  691.  
  692. //Check to see if we can use SSL 
  693. $this->api_endpoint = Jetpack::fix_url_for_bad_hosts( JETPACK_PROTECT__API_HOST ); 
  694.  
  695. return $this->api_endpoint; 
  696.  
  697. function get_local_host() { 
  698. if ( isset( $this->local_host ) ) { 
  699. return $this->local_host; 
  700.  
  701. $uri = 'http://' . strtolower( $_SERVER['HTTP_HOST'] ); 
  702.  
  703. if ( is_multisite() ) { 
  704. $uri = network_home_url(); 
  705.  
  706. $uridata = parse_url( $uri ); 
  707.  
  708. $domain = $uridata['host']; 
  709.  
  710. // If we still don't have the site_url, get it 
  711. if ( ! $domain ) { 
  712. $uri = get_site_url( 1 ); 
  713. $uridata = parse_url( $uri ); 
  714. $domain = $uridata['host']; 
  715.  
  716. $this->local_host = $domain; 
  717.  
  718. return $this->local_host; 
  719.  
  720.  
  721. Jetpack_Protect_Module::instance(); 
  722.  
  723. if ( isset( $pagenow ) && 'wp-login.php' == $pagenow ) { 
  724. Jetpack_Protect_Module::check_login_ability(); 
.