Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add/protect blocked send email #8117

Merged
merged 13 commits into from
Nov 13, 2017
Merged

Add/protect blocked send email #8117

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
7f9582c
Jetpack Protect: blocked login page
roccotripaldi Nov 3, 2017
cbb1204
Removes unused block.
roccotripaldi Nov 6, 2017
a73c968
Filtering login url
roccotripaldi Nov 7, 2017
9606864
Adding filters to reset-password urls
roccotripaldi Nov 7, 2017
19aa31f
Make it look nicer
enejb Nov 9, 2017
31b7fdd
Ensure folks can log out, even if their IP is blocked.
roccotripaldi Nov 9, 2017
20851c1
Only allow logouts if the user the nonce passes and they are currentl…
enejb Nov 9, 2017
ec38955
Slightly nicer screen when shown to in the iframe
enejb Nov 9, 2017
c1b843c
Fix spacing, remove debugging code.
roccotripaldi Nov 10, 2017
a0caeb0
Fixes as suggested by @gititon
enejb Nov 10, 2017
8ec53a9
Add constant that makes testing easier
enejb Nov 10, 2017
c50af89
Remove empty comment line
enejb Nov 10, 2017
42b5a98
Improve comment.
roccotripaldi Nov 13, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 28 additions & 11 deletions modules/protect.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ private function __construct() {
add_action( 'admin_init', array ( $this, 'maybe_display_security_warning' ) );

// This is a backup in case $pagenow fails for some reason
add_action( 'login_head', array ( $this, 'check_login_ability' ) );
add_action( 'login_head', array ( $this, 'check_login_ability' ), 100, 3 );

// Runs a script every day to clean up expired transients so they don't
// clog up our users' databases
Expand Down Expand Up @@ -541,6 +541,17 @@ function block_with_math() {
* Kill a login attempt
*/
function kill_login() {
if (
isset( $_GET['action'], $_GET['_wpnonce'] ) &&
'logout' === $_GET['action'] &&
wp_verify_nonce( $_GET['_wpnonce'], 'log-out' ) &&
wp_get_current_user()

) {
// Allow users to logout
return;
}

$ip = jetpack_protect_get_ip();
/**
* Fires before every killed login.
Expand All @@ -552,19 +563,24 @@ function kill_login() {
* @param string $ip IP flagged by Protect.
*/
do_action( 'jpp_kill_login', $ip );
$help_url = 'https://jetpack.com/support/security-features/#unblock';

$die_string = sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations. <a href="%2$s">Find out more...</a>', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ), esc_url( $help_url ) );

if( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) {
$die_string = sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations.', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ) );
wp_die(
$die_string,
__( 'Login Blocked by Jetpack', 'jetpack' ),
array ( 'response' => 403 )
);
}

wp_die(
$die_string,
__( 'Login Blocked by Jetpack', 'jetpack' ),
array ( 'response' => 403 )
);
require_once dirname( __FILE__ ) . '/protect/blocked-login-page.php';
$blocked_login_page = Jetpack_Protect_Blocked_Login_Page::instance( $ip );

if ( $blocked_login_page->is_blocked_user_valid() ) {
return;
}

$blocked_login_page->render_and_die();
}

/*
Expand Down Expand Up @@ -862,8 +878,9 @@ function get_local_host() {

}

Jetpack_Protect_Module::instance();
$jetpack_protect = Jetpack_Protect_Module::instance();

global $pagenow;
if ( isset( $pagenow ) && 'wp-login.php' == $pagenow ) {
Jetpack_Protect_Module::check_login_ability();
$jetpack_protect->check_login_ability();
}
Loading