Completed
Push — kraftbj-patch-4 ( 4d7745 )
by
unknown
10:14
created

Jetpack_Protect_Module::get_protect_key()   C

Complexity

Conditions 8
Paths 16

Size

Total Lines 72
Code Lines 36

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 8
eloc 36
nc 16
nop 0
dl 0
loc 72
rs 6.3883
c 0
b 0
f 0

How to fix   Long Method   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
/**
3
 * Module Name: Protect
4
 * Module Description: Block suspicious-looking sign in activity
5
 * Sort Order: 1
6
 * Recommendation Order: 4
7
 * First Introduced: 3.4
8
 * Requires Connection: Yes
9
 * Auto Activate: Yes
10
 * Module Tags: Recommended
11
 * Feature: Security
12
 * Additional Search Queries: security, secure, protection, botnet, brute force, protect, login
13
 */
14
15
include_once JETPACK__PLUGIN_DIR . 'modules/protect/shared-functions.php';
16
17
class Jetpack_Protect_Module {
18
19
	private static $__instance = null;
20
	public $api_key;
21
	public $api_key_error;
22
	public $whitelist;
23
	public $whitelist_error;
24
	public $whitelist_saved;
25
	private $user_ip;
26
	private $local_host;
27
	private $api_endpoint;
28
	public $last_request;
29
	public $last_response_raw;
30
	public $last_response;
31
	private $block_login_with_math;
32
33
	/**
34
	 * Singleton implementation
35
	 *
36
	 * @return object
37
	 */
38
	public static function instance() {
39
		if ( ! is_a( self::$__instance, 'Jetpack_Protect_Module' ) ) {
40
			self::$__instance = new Jetpack_Protect_Module();
41
		}
42
43
		return self::$__instance;
44
	}
45
46
	/**
47
	 * Registers actions
48
	 */
49
	private function __construct() {
50
		add_action( 'jetpack_activate_module_protect', array ( $this, 'on_activation' ) );
51
		add_action( 'jetpack_deactivate_module_protect', array ( $this, 'on_deactivation' ) );
52
		add_action( 'jetpack_modules_loaded', array ( $this, 'modules_loaded' ) );
53
		add_action( 'login_init', array ( $this, 'check_use_math' ) );
54
		add_filter( 'authenticate', array ( $this, 'check_preauth' ), 10, 3 );
55
		add_action( 'wp_login', array ( $this, 'log_successful_login' ), 10, 2 );
56
		add_action( 'wp_login_failed', array ( $this, 'log_failed_attempt' ) );
57
		add_action( 'admin_init', array ( $this, 'maybe_update_headers' ) );
58
		add_action( 'admin_init', array ( $this, 'maybe_display_security_warning' ) );
59
60
		// This is a backup in case $pagenow fails for some reason
61
		add_action( 'login_head', array ( $this, 'check_login_ability' ) );
62
63
		// Runs a script every day to clean up expired transients so they don't
64
		// clog up our users' databases
65
		require_once( JETPACK__PLUGIN_DIR . '/modules/protect/transient-cleanup.php' );
66
	}
67
68
	/**
69
	 * On module activation, try to get an api key
70
	 */
71
	public function on_activation() {
72
		if ( is_multisite() && is_main_site() && get_site_option( 'jetpack_protect_active', 0 ) == 0 ) {
73
			update_site_option( 'jetpack_protect_active', 1 );
74
		}
75
76
		update_site_option( 'jetpack_protect_activating', 'activating' );
77
78
		// Get BruteProtect's counter number
79
		Jetpack_Protect_Module::protect_call( 'check_key' );
80
	}
81
82
	/**
83
	 * On module deactivation, unset protect_active
84
	 */
85
	public function on_deactivation() {
86
		if ( is_multisite() && is_main_site() ) {
87
			update_site_option( 'jetpack_protect_active', 0 );
88
		}
89
	}
90
91
	public function maybe_get_protect_key() {
92
		if ( get_site_option( 'jetpack_protect_activating', false ) && ! get_site_option( 'jetpack_protect_key', false ) ) {
93
			$key = $this->get_protect_key();
94
			delete_site_option( 'jetpack_protect_activating' );
95
			return $key;
96
		}
97
98
		return get_site_option( 'jetpack_protect_key' );
99
	}
100
101
	/**
102
	 * Sends a "check_key" API call once a day.  This call allows us to track IP-related
103
	 * headers for this server via the Protect API, in order to better identify the source
104
	 * IP for login attempts
105
	 */
106
	public function maybe_update_headers( $force = false ) {
107
		$updated_recently = $this->get_transient( 'jpp_headers_updated_recently' );
108
109
		if ( ! $force ) {
110
			if ( isset( $_GET['protect_update_headers'] ) ) {
111
				$force = true;
112
			}
113
		}
114
115
		// check that current user is admin so we prevent a lower level user from adding
116
		// a trusted header, allowing them to brute force an admin account
117
		if ( ( $updated_recently && ! $force ) || ! current_user_can( 'update_plugins' ) ) {
118
			return;
119
		}
120
121
		$response = Jetpack_Protect_Module::protect_call( 'check_key' );
122
		$this->set_transient( 'jpp_headers_updated_recently', 1, DAY_IN_SECONDS );
123
124
		if ( isset( $response['msg'] ) && $response['msg'] ) {
125
			update_site_option( 'trusted_ip_header', json_decode( $response['msg'] ) );
126
		}
127
128
	}
129
130
	public function maybe_display_security_warning() {
131
		if ( is_multisite() && current_user_can( 'manage_network' ) ) {
132
			if ( ! function_exists( 'is_plugin_active_for_network' ) ) {
133
				require_once( ABSPATH . '/wp-admin/includes/plugin.php' );
134
			}
135
136
			if ( ! ( is_plugin_active_for_network( 'jetpack/jetpack.php' ) || is_plugin_active_for_network( 'jetpack-dev/jetpack.php' ) ) {
0 ignored issues
show
Bug introduced by
Avoid IF statements that are always true or false
Loading history...
137
				add_action( 'load-index.php', array ( $this, 'prepare_jetpack_protect_multisite_notice' ) );
0 ignored issues
show
Bug introduced by
This code did not parse for me. Apparently, there is an error somewhere around this line:

Syntax error, unexpected ';'
Loading history...
138
			}
139
		}
140
	}
141
142
	public function prepare_jetpack_protect_multisite_notice() {
143
		add_action( 'admin_print_styles', array ( $this, 'admin_banner_styles' ) );
144
		add_action( 'admin_notices', array ( $this, 'admin_jetpack_manage_notice' ) );
145
	}
146
147
	public function admin_banner_styles() {
148
		global $wp_styles;
149
150
		$min = ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) ? '' : '.min';
151
152
		wp_enqueue_style( 'jetpack', plugins_url( "css/jetpack-banners{$min}.css", JETPACK__PLUGIN_FILE ), false, JETPACK__VERSION );
153
		$wp_styles->add_data( 'jetpack', 'rtl', true );
154
	}
155
156
	public function admin_jetpack_manage_notice() {
157
158
		$dismissed = get_site_option( 'jetpack_dismissed_protect_multisite_banner' );
159
160
		if ( $dismissed ) {
161
			return;
162
		}
163
164
		$referer     = '&_wp_http_referer=' . add_query_arg( '_wp_http_referer', null );
165
		$opt_out_url = wp_nonce_url( Jetpack::admin_url( 'jetpack-notice=jetpack-protect-multisite-opt-out' . $referer ), 'jetpack_protect_multisite_banner_opt_out' );
166
167
		?>
168
		<div id="message" class="updated jetpack-message jp-banner is-opt-in protect-error"
169
		     style="display:block !important;">
170
			<a class="jp-banner__dismiss" href="<?php echo esc_url( $opt_out_url ); ?>"
171
			   title="<?php esc_attr_e( 'Dismiss this notice.', 'jetpack' ); ?>"></a>
172
173
			<div class="jp-banner__content">
174
				<h2><?php esc_html_e( 'Protect cannot keep your site secure.', 'jetpack' ); ?></h2>
175
176
				<p><?php printf( __( 'Thanks for activating Protect! To start protecting your site, please network activate Jetpack on your Multisite installation and activate Protect on your primary site. Due to the way logins are handled on WordPress Multisite, Jetpack must be network-enabled in order for Protect to work properly. <a href="%s" target="_blank">Learn More</a>', 'jetpack' ), 'http://jetpack.com/support/multisite-protect' ); ?></p>
177
			</div>
178
			<div class="jp-banner__action-container is-opt-in">
179
				<a href="<?php echo esc_url( network_admin_url( 'plugins.php' ) ); ?>" class="jp-banner__button"
180
				   id="wpcom-connect"><?php _e( 'View Network Admin', 'jetpack' ); ?></a>
181
			</div>
182
		</div>
183
		<?php
184
	}
185
186
	/**
187
	 * Request an api key from wordpress.com
188
	 *
189
	 * @return bool | string
190
	 */
191
	public function get_protect_key() {
192
193
		$protect_blog_id = Jetpack_Protect_Module::get_main_blog_jetpack_id();
194
195
		// If we can't find the the blog id, that means we are on multisite, and the main site never connected
196
		// the protect api key is linked to the main blog id - instruct the user to connect their main blog
197
		if ( ! $protect_blog_id ) {
198
			$this->api_key_error = __( 'Your main blog is not connected to WordPress.com. Please connect to get an API key.', 'jetpack' );
199
200
			return false;
201
		}
202
203
		$request = array (
204
			'jetpack_blog_id'      => $protect_blog_id,
205
			'bruteprotect_api_key' => get_site_option( 'bruteprotect_api_key' ),
206
			'multisite'            => '0',
207
		);
208
209
		// Send the number of blogs on the network if we are on multisite
210
		if ( is_multisite() ) {
211
			$request['multisite'] = get_blog_count();
212
			if ( ! $request['multisite'] ) {
213
				global $wpdb;
214
				$request['multisite'] = $wpdb->get_var( "SELECT COUNT(blog_id) as c FROM $wpdb->blogs WHERE spam = '0' AND deleted = '0' and archived = '0'" );
215
			}
216
		}
217
218
		// Request the key
219
		Jetpack::load_xml_rpc_client();
220
		$xml = new Jetpack_IXR_Client( array (
221
			'user_id' => get_current_user_id()
222
		) );
223
		$xml->query( 'jetpack.protect.requestKey', $request );
224
225
		// Hmm, can't talk to wordpress.com
226
		if ( $xml->isError() ) {
227
			$code                = $xml->getErrorCode();
228
			$message             = $xml->getErrorMessage();
229
			$this->api_key_error = sprintf( __( 'Error connecting to WordPress.com. Code: %1$s, %2$s', 'jetpack' ), $code, $message );
230
231
			return false;
232
		}
233
234
		$response = $xml->getResponse();
235
236
		// Hmm. Can't talk to the protect servers ( api.bruteprotect.com )
237
		if ( ! isset( $response['data'] ) ) {
238
			$this->api_key_error = __( 'No reply from Jetpack servers', 'jetpack' );
239
240
			return false;
241
		}
242
243
		// There was an issue generating the key
244
		if ( empty( $response['success'] ) ) {
245
			$this->api_key_error = $response['data'];
246
247
			return false;
248
		}
249
250
		// Key generation successful!
251
		$active_plugins = Jetpack::get_active_plugins();
252
253
		// We only want to deactivate BruteProtect if we successfully get a key
254
		if ( in_array( 'bruteprotect/bruteprotect.php', $active_plugins ) ) {
255
			Jetpack_Client_Server::deactivate_plugin( 'bruteprotect/bruteprotect.php', 'BruteProtect' );
256
		}
257
258
		$key = $response['data'];
259
		update_site_option( 'jetpack_protect_key', $key );
260
261
		return $key;
262
	}
263
264
	/**
265
	 * Called via WP action wp_login_failed to log failed attempt with the api
266
	 *
267
	 * Fires custom, plugable action jpp_log_failed_attempt with the IP
268
	 *
269
	 * @return void
270
	 */
271
	function log_failed_attempt() {
272
		/**
273
		 * Fires before every failed login attempt.
274
		 *
275
		 * @module protect
276
		 *
277
		 * @since 3.4.0
278
		 *
279
		 * @param string jetpack_protect_get_ip IP stored by Protect.
280
		 */
281
		do_action( 'jpp_log_failed_attempt', jetpack_protect_get_ip() );
282
283
		if ( isset( $_COOKIE['jpp_math_pass'] ) ) {
284
285
			$transient = $this->get_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] );
286
			$transient--;
287
288
			if ( ! $transient || $transient < 1 ) {
289
				$this->delete_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'] );
290
				setcookie( 'jpp_math_pass', 0, time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false );
291
			} else {
292
				$this->set_transient( 'jpp_math_pass_' . $_COOKIE['jpp_math_pass'], $transient, DAY_IN_SECONDS );
293
			}
294
295
		}
296
		$this->protect_call( 'failed_attempt' );
297
	}
298
299
	/**
300
	 * Set up the Protect configuration page
301
	 */
302
	public function modules_loaded() {
303
		Jetpack::enable_module_configurable( __FILE__ );
304
		Jetpack::module_configuration_load( __FILE__, array ( $this, 'configuration_load' ) );
305
		Jetpack::module_configuration_head( __FILE__, array ( $this, 'configuration_head' ) );
306
		Jetpack::module_configuration_screen( __FILE__, array ( $this, 'configuration_screen' ) );
307
	}
308
309
	/**
310
	 * Logs a successful login back to our servers, this allows us to make sure we're not blocking
311
	 * a busy IP that has a lot of good logins along with some forgotten passwords. Also saves current user's ip
312
	 * to the ip address whitelist
313
	 */
314
	public function log_successful_login( $user_login, $user = null ) {
315
		if ( ! $user ) { // For do_action( 'wp_login' ) calls that lacked passing the 2nd arg.
316
			$user = get_user_by( 'login', $user_login );
317
		}
318
319
		$this->protect_call( 'successful_login', array ( 'roles' => $user->roles ) );
320
	}
321
322
323
	/**
324
	 * Checks for loginability BEFORE authentication so that bots don't get to go around the log in form.
325
	 *
326
	 * If we are using our math fallback, authenticate via math-fallback.php
327
	 *
328
	 * @param string $user
329
	 * @param string $username
330
	 * @param string $password
331
	 *
332
	 * @return string $user
333
	 */
334
	function check_preauth( $user = 'Not Used By Protect', $username = 'Not Used By Protect', $password = 'Not Used By Protect' ) {
335
		$allow_login = $this->check_login_ability( true );
336
		$use_math    = $this->get_transient( 'brute_use_math' );
337
338
		if ( ! $allow_login ) {
339
			$this->block_with_math();
340
		}
341
342
		if ( ( 1 == $use_math || 1 == $this->block_login_with_math ) && isset( $_POST['log'] ) ) {
343
			include_once dirname( __FILE__ ) . '/protect/math-fallback.php';
344
			Jetpack_Protect_Math_Authenticate::math_authenticate();
345
		}
346
347
		return $user;
348
	}
349
350
	/**
351
	 * Get all IP headers so that we can process on our server...
352
	 *
353
	 * @return string
354
	 */
355
	function get_headers() {
356
		$ip_related_headers = array (
357
			'GD_PHP_HANDLER',
358
			'HTTP_AKAMAI_ORIGIN_HOP',
359
			'HTTP_CF_CONNECTING_IP',
360
			'HTTP_CLIENT_IP',
361
			'HTTP_FASTLY_CLIENT_IP',
362
			'HTTP_FORWARDED',
363
			'HTTP_FORWARDED_FOR',
364
			'HTTP_INCAP_CLIENT_IP',
365
			'HTTP_TRUE_CLIENT_IP',
366
			'HTTP_X_CLIENTIP',
367
			'HTTP_X_CLUSTER_CLIENT_IP',
368
			'HTTP_X_FORWARDED',
369
			'HTTP_X_FORWARDED_FOR',
370
			'HTTP_X_IP_TRAIL',
371
			'HTTP_X_REAL_IP',
372
			'HTTP_X_VARNISH',
373
			'REMOTE_ADDR'
374
		);
375
376
		foreach ( $ip_related_headers as $header ) {
377
			if ( isset( $_SERVER[ $header ] ) ) {
378
				$output[ $header ] = $_SERVER[ $header ];
379
			}
380
		}
381
382
		return $output;
383
	}
384
385
	/*
386
	 * Checks if the IP address has been whitelisted
387
	 *
388
	 * @param string $ip
389
	 *
390
	 * @return bool
391
	 */
392
	function ip_is_whitelisted( $ip ) {
393
		// If we found an exact match in wp-config
394
		if ( defined( 'JETPACK_IP_ADDRESS_OK' ) && JETPACK_IP_ADDRESS_OK == $ip ) {
395
			return true;
396
		}
397
398
		$whitelist = jetpack_protect_get_local_whitelist();
399
400
		if ( is_multisite() ) {
401
			$whitelist = array_merge( $whitelist, get_site_option( 'jetpack_protect_global_whitelist', array () ) );
402
		}
403
404
		if ( ! empty( $whitelist ) ) :
405
			foreach ( $whitelist as $item ) :
406
				// If the IPs are an exact match
407
				if ( ! $item->range && isset( $item->ip_address ) && $item->ip_address == $ip ) {
408
					return true;
409
				}
410
411
				if ( $item->range && isset( $item->range_low ) && isset( $item->range_high ) ) {
412
					if ( jetpack_protect_ip_address_is_in_range( $ip, $item->range_low, $item->range_high ) ) {
413
						return true;
414
					}
415
				}
416
			endforeach;
417
		endif;
418
419
		return false;
420
	}
421
422
	/**
423
	 * Checks the status for a given IP. API results are cached as transients
424
	 *
425
	 * @param bool $preauth Whether or not we are checking prior to authorization
426
	 *
427
	 * @return bool Either returns true, fires $this->kill_login, or includes a math fallback and returns false
428
	 */
429
	function check_login_ability( $preauth = false ) {
430
		$ip = jetpack_protect_get_ip();
431
432
		// Server is misconfigured and we can't get an IP
433
		if ( ! $ip && class_exists( 'Jetpack' ) ) {
434
			Jetpack::deactivate_module( 'protect' );
435
			ob_start();
436
			Jetpack::state( 'message', 'protect_misconfigured_ip' );
437
			ob_end_clean();
438
			return true;
439
		}
440
441
		/**
442
		 * Short-circuit check_login_ability.
443
		 *
444
		 * If there is an alternate way to validate the current IP such as
445
		 * a hard-coded list of IP addresses, we can short-circuit the rest
446
		 * of the login ability checks and return true here.
447
		 *
448
		 * @module protect
449
		 *
450
		 * @since 4.4.0
451
		 *
452
		 * @param bool false Should we allow all logins for the current ip? Default: false
453
		 */
454
		if ( apply_filters( 'jpp_allow_login', false, $ip ) ) {
455
			return true;
456
		}
457
458
		$headers         = $this->get_headers();
459
		$header_hash     = md5( json_encode( $headers ) );
460
		$transient_name  = 'jpp_li_' . $header_hash;
461
		$transient_value = $this->get_transient( $transient_name );
462
463
		if ( jetpack_protect_ip_is_private( $ip ) ) {
464
			return true;
465
		}
466
467
		if ( $this->ip_is_whitelisted( $ip ) ) {
468
			return true;
469
		}
470
471
		// Check out our transients
472
		if ( isset( $transient_value ) && 'ok' == $transient_value['status'] ) {
473
			return true;
474
		}
475
476
		if ( isset( $transient_value ) && 'blocked' == $transient_value['status'] ) {
477
			$this->block_with_math();
478
		}
479
480
		if ( isset( $transient_value ) && 'blocked-hard' == $transient_value['status'] ) {
481
			$this->kill_login();
482
		}
483
484
		// If we've reached this point, this means that the IP isn't cached.
485
		// Now we check with the Protect API to see if we should allow login
486
		$response = $this->protect_call( $action = 'check_ip' );
487
488
		if ( isset( $response['math'] ) && ! function_exists( 'brute_math_authenticate' ) ) {
489
			include_once dirname( __FILE__ ) . '/protect/math-fallback.php';
490
			new Jetpack_Protect_Math_Authenticate;
491
492
			return false;
493
		}
494
495
		if ( 'blocked' == $response['status'] ) {
496
			$this->block_with_math();
497
		}
498
499
		if ( 'blocked-hard' == $response['status'] ) {
500
			$this->kill_login();
501
		}
502
503
		return true;
504
	}
505
506
	function block_with_math() {
507
		/**
508
		 * By default, Protect will allow a user who has been blocked for too
509
		 * many failed logins to start answering math questions to continue logging in
510
		 *
511
		 * For added security, you can disable this.
512
		 *
513
		 * @module protect
514
		 *
515
		 * @since 3.6.0
516
		 *
517
		 * @param bool Whether to allow math for blocked users or not.
518
		 */
519
520
		$this->block_login_with_math = 1;
521
		/**
522
		 * Allow Math fallback for blocked IPs.
523
		 *
524
		 * @module protect
525
		 *
526
		 * @since 3.6.0
527
		 *
528
		 * @param bool true Should we fallback to the Math questions when an IP is blocked. Default to true.
529
		 */
530
		$allow_math_fallback_on_fail = apply_filters( 'jpp_use_captcha_when_blocked', true );
531
		if ( ! $allow_math_fallback_on_fail ) {
532
			$this->kill_login();
533
		}
534
		include_once dirname( __FILE__ ) . '/protect/math-fallback.php';
535
		new Jetpack_Protect_Math_Authenticate;
536
537
		return false;
538
	}
539
540
	/*
541
	 * Kill a login attempt
542
	 */
543
	function kill_login() {
544
		$ip = jetpack_protect_get_ip();
545
		/**
546
		 * Fires before every killed login.
547
		 *
548
		 * @module protect
549
		 *
550
		 * @since 3.4.0
551
		 *
552
		 * @param string $ip IP flagged by Protect.
553
		 */
554
		do_action( 'jpp_kill_login', $ip );
555
		$help_url = 'https://jetpack.com/support/security-features/#unblock';
556
557
		$die_string = sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations.  <a href="%2$s">Find out more...</a>', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ), esc_url( $help_url ) );
558
559
		if( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) {
560
			$die_string = sprintf( __( 'Your IP (%1$s) has been flagged for potential security violations.', 'jetpack' ), str_replace( 'http://', '', esc_url( 'http://' . $ip ) ) );
561
		}
562
563
		wp_die(
564
			$die_string,
565
			__( 'Login Blocked by Jetpack', 'jetpack' ),
566
			array ( 'response' => 403 )
567
		);
568
	}
569
570
	/*
571
	 * Checks if the protect API call has failed, and if so initiates the math captcha fallback.
572
	 */
573
	public function check_use_math() {
574
		$use_math = $this->get_transient( 'brute_use_math' );
575
		if ( $use_math ) {
576
			include_once dirname( __FILE__ ) . '/protect/math-fallback.php';
577
			new Jetpack_Protect_Math_Authenticate;
578
		}
579
	}
580
581
	/**
582
	 * Get or delete API key
583
	 */
584
	public function configuration_load() {
585
586
		if ( isset( $_POST['action'] ) && $_POST['action'] == 'jetpack_protect_save_whitelist' && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) {
587
			$whitelist             = str_replace( ' ', '', $_POST['whitelist'] );
588
			$whitelist             = explode( PHP_EOL, $whitelist );
589
			$result                = jetpack_protect_save_whitelist( $whitelist );
590
			$this->whitelist_saved = ! is_wp_error( $result );
591
			$this->whitelist_error = is_wp_error( $result );
592
		}
593
594
		if ( isset( $_POST['action'] ) && 'get_protect_key' == $_POST['action'] && wp_verify_nonce( $_POST['_wpnonce'], 'jetpack-protect' ) ) {
595
			$result = $this->get_protect_key();
596
			// Only redirect on success
597
			// If it fails we need access to $this->api_key_error
598
			if ( $result ) {
599
				wp_safe_redirect( Jetpack::module_configuration_url( 'protect' ) );
600
			}
601
		}
602
603
		$this->api_key = get_site_option( 'jetpack_protect_key', false );
604
		$this->user_ip = jetpack_protect_get_ip();
605
	}
606
607
	public function configuration_head() {
608
		wp_enqueue_style( 'jetpack-protect' );
609
	}
610
611
	/**
612
	 * Prints the configuration screen
613
	 */
614
	public function configuration_screen() {
615
		require_once dirname( __FILE__ ) . '/protect/config-ui.php';
616
	}
617
618
	/**
619
	 * If we're in a multisite network, return the blog ID of the primary blog
620
	 *
621
	 * @return int
622
	 */
623
	public function get_main_blog_id() {
624
		if ( ! is_multisite() ) {
625
			return false;
626
		}
627
628
		global $current_site;
629
		$primary_blog_id = $current_site->blog_id;
630
631
		return $primary_blog_id;
632
	}
633
634
	/**
635
	 * Get jetpack blog id, or the jetpack blog id of the main blog in the main network
636
	 *
637
	 * @return int
638
	 */
639
	public function get_main_blog_jetpack_id() {
640
		if ( ! is_main_site() ) {
641
			switch_to_blog( $this->get_main_blog_id() );
642
			$id = Jetpack::get_option( 'id', false );
643
			restore_current_blog();
644
		} else {
645
			$id = Jetpack::get_option( 'id' );
646
		}
647
648
		return $id;
649
	}
650
651
	public function check_api_key() {
652
		$response = $this->protect_call( 'check_key' );
653
654
		if ( isset( $response['ckval'] ) ) {
655
			return true;
656
		}
657
658
		if ( isset( $response['error'] ) ) {
659
660
			if ( $response['error'] == 'Invalid API Key' ) {
661
				$this->api_key_error = __( 'Your API key is invalid', 'jetpack' );
662
			}
663
664
			if ( $response['error'] == 'API Key Required' ) {
665
				$this->api_key_error = __( 'No API key', 'jetpack' );
666
			}
667
		}
668
669
		$this->api_key_error = __( 'There was an error contacting Jetpack servers.', 'jetpack' );
670
671
		return false;
672
	}
673
674
	/**
675
	 * Calls over to the api using wp_remote_post
676
	 *
677
	 * @param string $action 'check_ip', 'check_key', or 'failed_attempt'
678
	 * @param array $request Any custom data to post to the api
679
	 *
680
	 * @return array
681
	 */
682
	function protect_call( $action = 'check_ip', $request = array () ) {
683
		global $wp_version, $wpdb, $current_user;
684
685
		$api_key = $this->maybe_get_protect_key();
686
687
		$user_agent = "WordPress/{$wp_version} | Jetpack/" . constant( 'JETPACK__VERSION' );
688
689
		$request['action']            = $action;
690
		$request['ip']                = jetpack_protect_get_ip();
691
		$request['host']              = $this->get_local_host();
692
		$request['headers']           = json_encode( $this->get_headers() );
693
		$request['jetpack_version']   = constant( 'JETPACK__VERSION' );
694
		$request['wordpress_version'] = strval( $wp_version );
695
		$request['api_key']           = $api_key;
696
		$request['multisite']         = "0";
697
698
		if ( is_multisite() ) {
699
			$request['multisite'] = get_blog_count();
700
		}
701
702
703
		/**
704
		 * Filter controls maximum timeout in waiting for reponse from Protect servers.
705
		 *
706
		 * @module protect
707
		 *
708
		 * @since 4.0.4
709
		 *
710
		 * @param int $timeout Max time (in seconds) to wait for a response.
711
		 */
712
		$timeout = apply_filters( 'jetpack_protect_connect_timeout', 30 );
713
714
		$args = array (
715
			'body'        => $request,
716
			'user-agent'  => $user_agent,
717
			'httpversion' => '1.0',
718
			'timeout'     => absint( $timeout )
719
		);
720
721
		$response_json           = wp_remote_post( $this->get_api_host(), $args );
722
		$this->last_response_raw = $response_json;
723
		$headers                 = $this->get_headers();
724
		$header_hash             = md5( json_encode( $headers ) );
725
		$transient_name          = 'jpp_li_' . $header_hash;
726
		$this->delete_transient( $transient_name );
727
728
		if ( is_array( $response_json ) ) {
729
			$response = json_decode( $response_json['body'], true );
730
		}
731
732
		if ( isset( $response['blocked_attempts'] ) && $response['blocked_attempts'] ) {
733
			update_site_option( 'jetpack_protect_blocked_attempts', $response['blocked_attempts'] );
734
		}
735
736
		if ( isset( $response['status'] ) && ! isset( $response['error'] ) ) {
737
			$response['expire'] = time() + $response['seconds_remaining'];
738
			$this->set_transient( $transient_name, $response, $response['seconds_remaining'] );
739
			$this->delete_transient( 'brute_use_math' );
740
		} else { // Fallback to Math Captcha if no response from API host
741
			$this->set_transient( 'brute_use_math', 1, 600 );
742
			$response['status'] = 'ok';
743
			$response['math']   = true;
744
		}
745
746
		if ( isset( $response['error'] ) ) {
747
			update_site_option( 'jetpack_protect_error', $response['error'] );
748
		} else {
749
			delete_site_option( 'jetpack_protect_error' );
750
		}
751
752
		return $response;
753
	}
754
755
756
	/**
757
	 * Wrapper for WordPress set_transient function, our version sets
758
	 * the transient on the main site in the network if this is a multisite network
759
	 *
760
	 * We do it this way (instead of set_site_transient) because of an issue where
761
	 * sitewide transients are always autoloaded
762
	 * https://core.trac.wordpress.org/ticket/22846
763
	 *
764
	 * @param string $transient Transient name. Expected to not be SQL-escaped. Must be
765
	 *                           45 characters or fewer in length.
766
	 * @param mixed $value Transient value. Must be serializable if non-scalar.
767
	 *                           Expected to not be SQL-escaped.
768
	 * @param int $expiration Optional. Time until expiration in seconds. Default 0.
769
	 *
770
	 * @return bool False if value was not set and true if value was set.
771
	 */
772
	function set_transient( $transient, $value, $expiration ) {
773
		if ( is_multisite() && ! is_main_site() ) {
774
			switch_to_blog( $this->get_main_blog_id() );
775
			$return = set_transient( $transient, $value, $expiration );
776
			restore_current_blog();
777
778
			return $return;
779
		}
780
781
		return set_transient( $transient, $value, $expiration );
782
	}
783
784
	/**
785
	 * Wrapper for WordPress delete_transient function, our version deletes
786
	 * the transient on the main site in the network if this is a multisite network
787
	 *
788
	 * @param string $transient Transient name. Expected to not be SQL-escaped.
789
	 *
790
	 * @return bool true if successful, false otherwise
791
	 */
792
	function delete_transient( $transient ) {
793
		if ( is_multisite() && ! is_main_site() ) {
794
			switch_to_blog( $this->get_main_blog_id() );
795
			$return = delete_transient( $transient );
796
			restore_current_blog();
797
798
			return $return;
799
		}
800
801
		return delete_transient( $transient );
802
	}
803
804
	/**
805
	 * Wrapper for WordPress get_transient function, our version gets
806
	 * the transient on the main site in the network if this is a multisite network
807
	 *
808
	 * @param string $transient Transient name. Expected to not be SQL-escaped.
809
	 *
810
	 * @return mixed Value of transient.
811
	 */
812
	function get_transient( $transient ) {
813
		if ( is_multisite() && ! is_main_site() ) {
814
			switch_to_blog( $this->get_main_blog_id() );
815
			$return = get_transient( $transient );
816
			restore_current_blog();
817
818
			return $return;
819
		}
820
821
		return get_transient( $transient );
822
	}
823
824
	function get_api_host() {
825
		if ( isset( $this->api_endpoint ) ) {
826
			return $this->api_endpoint;
827
		}
828
829
		//Check to see if we can use SSL
830
		$this->api_endpoint = Jetpack::fix_url_for_bad_hosts( JETPACK_PROTECT__API_HOST );
831
832
		return $this->api_endpoint;
833
	}
834
835
	function get_local_host() {
836
		if ( isset( $this->local_host ) ) {
837
			return $this->local_host;
838
		}
839
840
		$uri = 'http://' . strtolower( $_SERVER['HTTP_HOST'] );
841
842
		if ( is_multisite() ) {
843
			$uri = network_home_url();
844
		}
845
846
		$uridata = parse_url( $uri );
847
848
		$domain = $uridata['host'];
849
850
		// If we still don't have the site_url, get it
851
		if ( ! $domain ) {
852
			$uri     = get_site_url( 1 );
853
			$uridata = parse_url( $uri );
854
			$domain  = $uridata['host'];
855
		}
856
857
		$this->local_host = $domain;
858
859
		return $this->local_host;
860
	}
861
862
}
863
864
Jetpack_Protect_Module::instance();
865
866
if ( isset( $pagenow ) && 'wp-login.php' == $pagenow ) {
867
	Jetpack_Protect_Module::check_login_ability();
868
}
869