get_names();
?>
'sanitize_textarea_field',
'default' => '',
)
);
register_setting(
'access_guard_options',
'access_guard_custom_ban_messages',
array(
'sanitize_callback' => 'wp_kses_post',
'default' => '',
)
);
register_setting(
'access_guard_options',
'access_guard_access_control_rules',
array(
'sanitize_callback' => array( $this, 'sanitize_role_list' ),
'default' => array(),
)
);
register_setting(
'access_guard_options',
'access_guard_ip_whitelist',
array(
'sanitize_callback' => 'sanitize_textarea_field',
'default' => '',
)
);
}
public function sanitize_role_list( $roles ) {
if ( ! is_array( $roles ) ) {
return array();
}
$valid_roles = array_keys( wp_roles()->get_names() );
return array_values( array_intersect( array_map( 'sanitize_key', $roles ), $valid_roles ) );
}
public function check_access() {
if ( is_admin() ) {
return;
}
// Never lock administrators out of the front end.
if ( current_user_can( 'manage_options' ) ) {
return;
}
if ( $this->check_ip_ban() ) {
$this->display_ban_message();
exit;
}
if ( $this->is_ip_whitelist_blocked() ) {
$this->display_ban_message();
exit;
}
if ( $this->is_restricted_content() && ! $this->has_access() ) {
$this->display_ban_message();
exit;
}
if ( $this->is_role_banned() ) {
$this->display_ban_message();
exit;
}
}
public function check_ip_ban() {
$user_ip = $this->get_user_ip();
if ( '' === $user_ip ) {
return false;
}
$ip_block_list = explode( "\n", (string) get_option( 'access_guard_ip_block_list', '' ) );
foreach ( $ip_block_list as $ip ) {
$ip = trim( $ip );
if ( $ip && $this->is_ip_in_range( $user_ip, $ip ) ) {
return true;
}
}
return false;
}
private function is_ip_whitelist_blocked() {
$whitelist_raw = trim( (string) get_option( 'access_guard_ip_whitelist', '' ) );
if ( '' === $whitelist_raw ) {
return false; // Whitelist disabled.
}
$user_ip = $this->get_user_ip();
if ( '' === $user_ip ) {
return false;
}
foreach ( explode( "\n", $whitelist_raw ) as $ip ) {
$ip = trim( $ip );
if ( $ip && $this->is_ip_in_range( $user_ip, $ip ) ) {
return false; // IP is allowed.
}
}
return true;
}
public function is_role_banned() {
if ( ! is_user_logged_in() ) {
return false;
}
$banned_user_roles = get_option( 'access_guard_access_control_rules', array() );
if ( empty( $banned_user_roles ) ) {
return false;
}
$user = wp_get_current_user();
$roles = (array) $user->roles;
return (bool) array_intersect( $banned_user_roles, $roles );
}
private function has_access() {
return current_user_can( 'read' );
}
private function is_ip_in_range( $user_ip, $ip ) {
if ( false === strpos( $ip, '-' ) ) {
return $user_ip === $ip;
}
$ip_range = explode( '-', $ip, 2 );
$start_ip = ip2long( trim( $ip_range[0] ) );
$end_ip = ip2long( trim( $ip_range[1] ) );
$user_ip = ip2long( $user_ip );
if ( false === $start_ip || false === $end_ip || false === $user_ip ) {
return false;
}
return $user_ip >= $start_ip && $user_ip <= $end_ip;
}
public function restrict_content( $content ) {
global $post;
if ( ! ( $post instanceof WP_Post ) ) {
return $content;
}
$restricted = get_post_meta( $post->ID, 'access_guard_restricted', true );
if ( $restricted && ! current_user_can( 'read' ) ) {
return __( 'This content is restricted. Please contact the administrator for access.', 'access-guard' );
}
return $content;
}
private function is_restricted_content() {
global $post;
if ( ! ( $post instanceof WP_Post ) ) {
return false;
}
return (bool) get_post_meta( $post->ID, 'access_guard_restricted', true );
}
private function get_user_ip() {
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- validated below via filter_var().
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
return filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : '';
}
public function block_locked_out_login( $user ) {
if ( is_wp_error( $user ) ) {
return $user;
}
$ip = $this->get_user_ip();
if ( '' !== $ip && get_transient( $this->login_lockout_key( $ip ) ) ) {
return new WP_Error(
'access_guard_locked_out',
__( 'Too many failed login attempts. Please try again in a few minutes.', 'access-guard' )
);
}
return $user;
}
public function record_failed_login() {
$ip = $this->get_user_ip();
if ( '' === $ip ) {
return;
}
$key = $this->login_attempts_key( $ip );
$attempts = (int) get_transient( $key ) + 1;
set_transient( $key, $attempts, self::LOGIN_LOCKOUT_SECONDS );
if ( $attempts >= self::LOGIN_MAX_ATTEMPTS ) {
set_transient( $this->login_lockout_key( $ip ), 1, self::LOGIN_LOCKOUT_SECONDS );
}
}
public function clear_failed_login() {
$ip = $this->get_user_ip();
if ( '' === $ip ) {
return;
}
delete_transient( $this->login_attempts_key( $ip ) );
delete_transient( $this->login_lockout_key( $ip ) );
}
private function login_attempts_key( $ip ) {
return 'access_guard_attempts_' . md5( $ip );
}
private function login_lockout_key( $ip ) {
return 'access_guard_lockout_' . md5( $ip );
}
private function display_ban_message() {
$custom_ban_messages = get_option( 'access_guard_custom_ban_messages', '' );
wp_enqueue_style( 'dashicons' );
wp_enqueue_style(
'access-guard-bootstrap',
plugins_url( '/assets/css/bootstrap.min.css', __FILE__ ),
array(),
ACCESS_GUARD_VERSION
);
?>
<?php esc_html_e( 'Access Guard', 'access-guard' ); ?>