options = get_option(self::OPTION_SETTINGS, []);
require_once plugin_dir_path(__FILE__) . 'class-advaipbl-waf-manager.php';
require_once plugin_dir_path(__FILE__) . 'class-advaipbl-rate-limiting-manager.php';
require_once plugin_dir_path(__FILE__) . 'class-advaipbl-asn-manager.php';
require_once plugin_dir_path(__FILE__) . 'class-advaipbl-dashboard-manager.php';
$this->api_manager = new ADVAIPBL_Api_Manager();
$this->session_manager = new ADVAIPBL_User_Session_Manager($this, $this->api_manager);
$this->waf_manager = new ADVAIPBL_Waf_Manager($this);
$this->rate_limit_manager = new ADVAIPBL_Rate_Limiting_Manager($this);
$this->asn_manager = new ADVAIPBL_Asn_Manager($this, $this->api_manager);
$this->dashboard_manager = new ADVAIPBL_Dashboard_Manager($this, $this->session_manager);
$this->add_hooks();
}
private function add_hooks() {
// Hooks del Frontend y Globales
add_action('wp_enqueue_scripts', [$this, 'enqueue_live_feed_assets']);
add_action('init', [$this, 'log_wp_cron_execution'], 1);
add_action('init', [$this->rate_limit_manager, 'check_request_rate'], -1);
add_action('init', [$this, 'run_all_block_checks'], 0);
add_action('init', [$this, 'add_admin_ip_to_whitelist_on_first_run']);
add_action('status_header', [$this, 'detect_http_error_status'], 10, 2);
add_action('init', [$this, 'prevent_author_enumeration_redirect'], 9);
add_action('wp_login_failed', [$this, 'registrar_intento_login_fallido']);
add_action('login_init', [ $this, 'handle_login_page_restriction' ], 1 );
add_filter('rest_endpoints', [ $this, 'disable_rest_api_user_endpoints' ] );
add_action('rest_api_init', [$this, 'register_live_feed_api_endpoint']);
add_shortcode('advaipbl_live_feed', [$this, 'render_live_feed_shortcode']);
if ( ! empty( $this->options['show_admin_bar_menu'] ) && '1' === $this->options['show_admin_bar_menu'] ) {
add_action( 'admin_bar_menu', [ $this, 'add_admin_bar_menu' ], 999 );
}
// Hooks de Cron
add_action('advaipbl_purge_old_logs_event', [$this, 'purge_old_logs']);
add_action('advaipbl_send_summary_email', [$this, 'process_and_send_summary']);
add_filter('cron_schedules', [$this, 'add_cron_intervals']);
add_action('advaipbl_clear_expired_blocks_event', [$this, 'limpiar_ips_expiradas']);
// Hooks del Backend
if (is_admin()) {
add_action('admin_init', [$this, 'check_database_update']);
add_action('admin_init', [$this, 'schedule_cron_jobs']);
add_action('admin_init', [$this, 'conditionally_remove_admin_notices']);
add_action('admin_menu', [$this, 'admin_menu']);
add_action('admin_init', [$this, 'register_settings']);
add_action('admin_init', [$this, 'handle_admin_actions']);
add_action('update_option_' . self::OPTION_SETTINGS, [$this, 'on_settings_update'], 10, 2);
add_action('update_option_' . self::OPTION_WAF_RULES, [$this, 'on_waf_rules_update'], 10, 2);
add_action('admin_post_advaipbl_refresh_spamhaus', [$this, 'handle_spamhaus_refresh_action']);
add_action('admin_notices', [$this, 'display_admin_notice']);
add_action('admin_enqueue_scripts', [$this, 'load_admin_scripts']);
// Hooks de AJAX y Admin Post
add_action('wp_ajax_advaipbl_test_outbound_connection', [$this, 'ajax_test_outbound_connection']);
add_action('wp_ajax_advaipbl_add_ip_to_whitelist', [$this, 'ajax_add_ip_to_whitelist']);
add_action('wp_ajax_advaipbl_verify_api_key', [$this, 'ajax_verify_api_key']);
add_action('wp_ajax_advaipbl_get_dashboard_stats', [$this, 'ajax_get_dashboard_stats']);
add_action('wp_ajax_advaipbl_export_settings_ajax', [ $this, 'handle_export_settings_ajax' ] );
add_action('admin_post_advaipbl_import_settings', [ $this, 'handle_import_settings' ] );
add_action('admin_post_advaipbl_clear_location_cache_action', [$this, 'handle_clear_cache_action']);
add_action('admin_post_advaipbl_send_test_email', [ $this, 'handle_send_test_email' ] );
add_action('admin_post_advaipbl_send_test_push', [ $this, 'handle_send_test_push' ] );
}
add_action('advaipbl_update_spamhaus_list_event', [$this, 'update_spamhaus_list']);
if ( ! empty( $this->options['xmlrpc_protection_mode'] ) && 'disabled' === $this->options['xmlrpc_protection_mode'] ) {
add_filter( 'xmlrpc_enabled', '__return_false' );
remove_action( 'wp_head', 'rsd_link' );
remove_action( 'wp_head', 'wlwmanifest_link' );
}
if ( !empty($this->options['recaptcha_enable']) && '1' === $this->options['recaptcha_enable'] && !empty($this->options['recaptcha_site_key']) && !empty($this->options['recaptcha_secret_key']) ) {
add_action('login_enqueue_scripts', array($this, 'enqueue_recaptcha_script'));
add_action('login_form', array($this, 'display_recaptcha_field'));
add_filter('authenticate', array($this, 'validate_recaptcha_response'), 20, 3);
}
}
public function ajax_get_dashboard_stats() {
// 1. Verificamos el nonce. El primer argumento debe coincidir con la acción del nonce que creamos.
check_ajax_referer('wp_ajax_advaipbl_get_dashboard_stats', 'nonce');
if (!current_user_can('manage_options')) {
wp_send_json_error(['message' => 'Permission denied.']);
}
$stats = $this->dashboard_manager->get_dashboard_stats();
if ($stats) {
wp_send_json_success($stats);
} else {
wp_send_json_error(['message' => 'Could not retrieve stats.']);
}
}
/**
* Registra el endpoint de la API REST para el feed de ataques en vivo.
*/
public function register_live_feed_api_endpoint() {
register_rest_route('advaipbl/v1', '/live-attacks', [
'methods' => WP_REST_Server::READABLE,
'callback' => [$this, 'get_live_attacks_for_feed'],
'permission_callback' => '__return_true', // Es público, solo lee datos no sensibles.
'args' => [
'since' => [
'description' => 'Get attacks since this log ID.',
'type' => 'integer',
'sanitize_callback' => 'absint',
],
],
]);
}
/**
* Callback para el endpoint de la API. Devuelve los últimos ataques.
*
* @param WP_REST_Request $request
* @return WP_REST_Response
*/
public function get_live_attacks_for_feed(WP_REST_Request $request) {
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
$since_id = $request->get_param('since');
// Añadimos "AND log_type != 'general'" a la consulta para excluir los logs de auditoría.
$query = "SELECT log_id, timestamp, ip, log_type, message, details
FROM {$table_name}
WHERE level = 'critical' AND log_type != 'general'";
if ($since_id) {
$query .= $wpdb->prepare(" AND log_id > %d", $since_id);
}
$query .= " ORDER BY log_id DESC LIMIT 20";
$results = $wpdb->get_results($query, ARRAY_A);
$attacks = [];
$last_id = 0;
if (!empty($results)) {
$last_id = (int) $results[0]['log_id'];
foreach ($results as $row) {
$details = json_decode($row['details'], true) ?: [];
$location = 'Unknown Location';
if (!empty($details['city']) && !empty($details['country'])) {
$location = $details['city'] . ', ' . $details['country'];
} elseif (!empty($details['country'])) {
$location = $details['country'];
}
$attacks[] = [
'id' => (int) $row['log_id'],
'time' => human_time_diff(strtotime($row['timestamp'])) . ' ago',
'ip' => esc_html($row['ip']),
'type' => esc_html(ucwords(str_replace('_', ' ', $row['log_type']))),
'location' => esc_html($location),
'method' => esc_html($details['method'] ?? 'N/A'),
'details' => esc_html($row['message']),
'user_agent' => esc_html($details['user_agent'] ?? 'N/A'),
'uri' => esc_html($details['uri'] ?? ($details['url'] ?? '')),
];
}
}
$response_data = [
'attacks' => $attacks,
'last_id' => $last_id,
];
return new WP_REST_Response($response_data, 200);
}
/**
* Función del shortcode [advaipbl_live_feed].
* Genera el HTML y el CSS necesario para el feed, y encola el script JS.
*
* @param array $atts Atributos del shortcode.
* @return string El HTML y CSS para el feed.
*/
public function render_live_feed_shortcode($atts) {
wp_enqueue_script('advaipbl-live-feed-js', plugin_dir_url(dirname(__FILE__)) . 'js/advaipbl-live-feed.js', ['jquery'], ADVAIPBL_VERSION, true);
wp_localize_script('advaipbl-live-feed-js', 'advaipbl_feed_data', [
'api_url' => get_rest_url(null, 'advaipbl/v1/live-attacks'),
'text' => [
'blocked_from' => __('blocked from', 'advanced-ip-blocker'),
'type' => __('Type', 'advanced-ip-blocker'),
'method' => __('Method', 'advanced-ip-blocker'),
'details' => __('Details', 'advanced-ip-blocker'),
'uri' => __('URI', 'advanced-ip-blocker'),
'user_agent' => __('User Agent', 'advanced-ip-blocker'),
]
]);
$logo_url_desktop = plugin_dir_url(dirname(__FILE__)) . 'assets/img/logo-ligth.png';
$logo_url_mobile = plugin_dir_url(dirname(__FILE__)) . 'assets/img/icon-256x256.png';
$css = '';
$html = '
⬤
Live Security Feed
Awaiting security events...
';
return $css . $html;
}
/**
* Encola los assets del feed en vivo.
* Actualmente obsoleto, ya que el shortcode 'render_live_feed_shortcode'
* ahora inyecta los estilos y encola el script directamente para máxima compatibilidad con temas.
*/
public function enqueue_live_feed_assets() {
// Esta función se mantiene por compatibilidad histórica pero la lógica
// se ha movido al renderizado del shortcode.
}
/**
* Detecta y registra las ejecuciones de WP-Cron.
* Enganchada a 'init' con una prioridad alta para ejecutarse pronto.
*/
public function log_wp_cron_execution() {
// wp-cron.php puede ser llamado de dos maneras.
// 1. A través de una constante definida, que es la forma más común.
// 2. A través de la URL, si alguien lo llama directamente.
$is_doing_cron = ( defined( 'DOING_CRON' ) && DOING_CRON );
$is_cron_url = ( isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'wp-cron.php') !== false );
if ( $is_doing_cron || $is_cron_url ) {
// Obtenemos los detalles de la petición
$ip = $this->get_client_ip();
// Evitamos el "ruido" de registrar la misma IP repetidamente en un corto periodo.
// Creamos un transient que dura 60 segundos.
$transient_key = 'advaipbl_cron_log_lock_' . md5($ip);
if ( false !== get_transient($transient_key) ) {
return; // Ya hemos registrado esta IP recientemente.
}
set_transient($transient_key, true, 60);
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
$details = [
'url' => $_SERVER['REQUEST_URI'] ?? 'N/A',
'method' => $_SERVER['REQUEST_METHOD'] ?? 'N/A',
'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'N/A',
];
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
@$wpdb->insert(
$table_name,
[
'timestamp' => current_time('mysql', 1),
'ip' => $ip,
'log_type' => 'wp_cron', // Usamos un tipo de log único
'level' => 'info',
'message' => __('WP-Cron execution triggered.', 'advanced-ip-blocker'),
'details' => wp_json_encode($details)
]
);
}
}
/**
* Muestra la tabla de logs específica para las ejecuciones de WP-Cron.
* Esto es principalmente una herramienta de diagnóstico.
*/
private function display_cron_logs_tab() {
// Añadimos una descripción para que el usuario sepa para qué es esta pestaña.
echo '
';
esc_html_e( 'This log shows which IP addresses are triggering WP-Cron tasks on your site. This can be a visitor, a search engine bot, or your own server if you have configured a real cron job.', 'advanced-ip-blocker' );
echo '
';
$this->display_log_table_generic('wp_cron');
}
/**
* Enqueues the Google reCAPTCHA API script on the login page.
*/
public function enqueue_recaptcha_script() {
$version = $this->options['recaptcha_version'] ?? 'v3';
$site_key = $this->options['recaptcha_site_key'] ?? '';
// La comprobación de si la clave está vacía ya se hace en add_hooks,
// pero una doble comprobación no hace daño.
if (empty($site_key)) {
return;
}
$script_url = 'https://www.google.com/recaptcha/api.js';
if ('v3' === $version) {
$script_url = add_query_arg('render', $site_key, $script_url);
}
wp_enqueue_script(
'google-recaptcha',
$script_url,
array(),
null,
true
);
}
/**
* Se dispara cuando las reglas del WAF son actualizadas desde la página de ajustes.
* Registra el evento en el log general.
*
* @param mixed $old_value El valor antiguo de la opción.
* @param mixed $new_value El nuevo valor de la opción.
*/
public function on_waf_rules_update($old_value, $new_value) {
// Solo registramos si el valor ha cambiado realmente.
if ($old_value !== $new_value) {
$message = sprintf(
/* translators: %s: El nombre de usuario del administrador que realizó el cambio. */
__('WAF rules list updated by %s.', 'advanced-ip-blocker'),
$this->get_current_admin_username()
);
$this->log_event($message, 'info');
}
}
/**
* Descarga y procesa la lista Spamhaus ASN DROP y la guarda en la base de datos.
* Es llamada por el WP-Cron y por la acción de refresco manual.
*/
/**
* Descarga y procesa la lista Spamhaus ASN DROP y la guarda en la base de datos.
* Es llamada por el WP-Cron y por la acción de refresco manual.
*/
public function update_spamhaus_list() {
$url = 'https://www.spamhaus.org/drop/asndrop.json';
$response = wp_remote_get($url, ['timeout' => 15]);
if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) {
$error_message = is_wp_error($response) ? $response->get_error_message() : 'HTTP ' . wp_remote_retrieve_response_code($response);
$this->log_event(sprintf('Failed to download Spamhaus ASN list. Error: %s', $error_message), 'error');
return;
}
$body_string = wp_remote_retrieve_body($response);
// El archivo de Spamhaus es una secuencia de objetos JSON, no un único array JSON.
// Lo dividimos en objetos individuales.
// Usamos una expresión regular para encontrar cada objeto JSON { ... }
preg_match_all('/\{.*?\}/', $body_string, $matches);
if (empty($matches[0])) {
$this->log_event('Failed to parse Spamhaus ASN list: No valid JSON objects found in the response.', 'error');
return;
}
$json_objects = $matches[0];
$asns = [];
foreach ($json_objects as $json_string) {
$entry = json_decode($json_string, true);
if (json_last_error() === JSON_ERROR_NONE && isset($entry['asn'])) {
// El formato es correcto y tiene la clave 'asn'.
$asns[] = 'AS' . $entry['asn'];
}
}
if (empty($asns)) {
$this->log_event('Spamhaus ASN list was parsed but no ASN entries were extracted.', 'warning');
return;
}
update_option('advaipbl_spamhaus_asn_list', array_unique($asns));
update_option('advaipbl_spamhaus_last_update', time());
$this->log_event(sprintf('Successfully updated Spamhaus ASN list with %d entries.', count($asns)), 'info');
}
public function handle_spamhaus_refresh_action() {
if (!current_user_can('manage_options') || !wp_verify_nonce($_GET['_wpnonce'] ?? '', 'advaipbl-refresh-spamhaus')) {
wp_die('Security check failed.');
}
$this->update_spamhaus_list();
set_transient(self::TRANSIENT_ADMIN_NOTICE, ['message' => __('Spamhaus ASN list has been updated.', 'advanced-ip-blocker'), 'type' => 'success'], 30);
wp_safe_redirect(wp_get_referer());
exit;
}
/**
* Muestra la pestaña para gestionar el bloqueo por ASN, ahora con estados separados.
*/
private function display_asn_blocking_tab() {
$provider = $this->options['geolocation_provider'] ?? '';
$is_compatible = in_array($provider, ['ip-api.com', 'ipinfo.io'], true);
$is_spamhaus_enabled = !empty($this->options['enable_spamhaus_asn']);
$is_manual_enabled = !empty($this->options['enable_manual_asn']);
$settings_url = admin_url('admin.php?page=advaipbl_settings_page-settings');
$spamhaus_stats = $this->dashboard_manager->get_spamhaus_stats();
?>
Warning: Your current geolocation provider (%1$s) does not support ASN lookups. This feature is fully supported by ip-api.com and ipinfo.io. Please change your provider to use ASN blocking.', 'advanced-ip-blocker'),
['strong' => [], 'a' => ['href' => []]]
),
esc_html($provider),
esc_url($settings_url)
); ?>
options['recaptcha_site_key'] ?? '';
$version = $this->options['recaptcha_version'] ?? 'v3';
if ('v2' === $version) {
echo '';
} else {
echo '';
?>
options['recaptcha_secret_key'] ?? '';
// La comprobación principal ya se hace en add_hooks,
// pero si alguien modificara la opción mientras tanto, esto es un seguro.
if (empty($secret_key)) {
return $user;
}
if (!isset($_POST['g-recaptcha-response']) || empty($_POST['g-recaptcha-response'])) {
return new WP_Error('recaptcha_empty', __('ERROR: Please complete the reCAPTCHA verification.', 'advanced-ip-blocker'));
}
$token = sanitize_text_field($_POST['g-recaptcha-response']);
$visitor_ip = $this->get_client_ip();
$response = wp_remote_post('https://www.google.com/recaptcha/api/siteverify', array(
'body' => array(
'secret' => $secret_key,
'response' => $token,
'remoteip' => $visitor_ip,
),
));
if (is_wp_error($response)) {
return new WP_Error('recaptcha_api_error', __('ERROR: Could not connect to the reCAPTCHA service.', 'advanced-ip-blocker'));
}
$result = json_decode(wp_remote_retrieve_body($response), true);
if (!isset($result['success']) || true !== $result['success']) {
return new WP_Error('recaptcha_failed', __('ERROR: reCAPTCHA verification failed. Please try again.', 'advanced-ip-blocker'));
}
$version = $this->options['recaptcha_version'] ?? 'v3';
if ('v3' === $version) {
$threshold = (float) ($this->options['recaptcha_score_threshold'] ?? 0.5);
if (!isset($result['score']) || $result['score'] < $threshold) {
return new WP_Error('recaptcha_low_score', __('ERROR: Your action was blocked as it was flagged as automated.', 'advanced-ip-blocker'));
}
}
return $user;
}
/**
* Detecta plugins activos que probablemente usan la interfaz XML-RPC.
*
* Utiliza una combinación de una lista de plugins conocidos y un análisis de los hooks de XML-RPC.
*
* @return array Un array con los nombres de los plugins detectados. Vacío si no se encuentra ninguno.
*/
private function get_xmlrpc_dependent_plugins() {
$dependent_plugins = [];
$active_plugins = get_option('active_plugins');
// 1. Lista de plugins conocidos que dependen de XML-RPC.
$known_slugs = [
'jetpack/jetpack.php',
// Si encuentras más en el futuro, como la app de WooCommerce si usa un plugin puente.
'xmlrpc-debugger/xmlrpc-debugger.php'
];
foreach ($known_slugs as $slug) {
if (in_array($slug, $active_plugins, true)) {
$plugin_path = WP_PLUGIN_DIR . '/' . $slug;
if (file_exists($plugin_path)) {
$plugin_data = get_plugin_data($plugin_path);
if (!empty($plugin_data['Name'])) {
$dependent_plugins[$slug] = $plugin_data['Name'];
}
}
}
}
// 2. Análisis de Hooks (Heurística).
// Buscamos plugins que se enganchen a los eventos de XML-RPC.
global $wp_filter;
$xmlrpc_hooks = [
'xmlrpc_methods',
'xmlrpc_call',
'xmlrpc_call_success',
'xmlrpc_call_failure',
'xmlrpc_before_insert_post',
];
foreach ($xmlrpc_hooks as $hook_name) {
if (isset($wp_filter[$hook_name])) {
foreach ($wp_filter[$hook_name]->callbacks as $priority => $callbacks) {
foreach ($callbacks as $callback) {
$function = $callback['function'];
$reflection = null;
try {
if (is_array($function) && is_object($function[0])) {
$reflection = new ReflectionClass($function[0]);
} elseif (is_string($function) && function_exists($function)) {
$reflection = new ReflectionFunction($function);
}
} catch (ReflectionException $e) {
// Ignorar funciones/clases que no se pueden reflejar (ej. closures)
continue;
}
if ($reflection) {
$file_path = $reflection->getFileName();
// Comprobamos si la ruta del archivo está dentro del directorio de plugins.
if ($file_path && strpos($file_path, WP_PLUGIN_DIR) !== false) {
$plugin_dir_path = str_replace('\\', '/', WP_PLUGIN_DIR);
$file_path = str_replace('\\', '/', $file_path);
$relative_path = ltrim(str_replace($plugin_dir_path, '', $file_path), '/');
$plugin_slug_parts = explode('/', $relative_path);
$plugin_folder = $plugin_slug_parts[0];
// Buscamos el nombre real del plugin para no mostrar solo el slug.
foreach ($active_plugins as $active_plugin_slug) {
if (strpos($active_plugin_slug, $plugin_folder) === 0) {
if (!isset($dependent_plugins[$active_plugin_slug])) {
$plugin_data = get_plugin_data(WP_PLUGIN_DIR . '/' . $active_plugin_slug);
if (!empty($plugin_data['Name'])) {
$dependent_plugins[$active_plugin_slug] = $plugin_data['Name'];
}
}
break;
}
}
}
}
}
}
}
}
return array_values($dependent_plugins);
}
/**
* Obtiene el número de IPs bloqueadas.
* La primera vez que se llama, ejecuta la limpieza de IPs expiradas y cachea el resultado.
*
* @return int El número total de entradas bloqueadas.
*/
private function get_blocked_count() {
// Si ya hemos calculado el conteo en esta petición, lo devolvemos directamente.
if ( null !== $this->blocked_count ) {
return $this->blocked_count;
}
// 1. Ejecutar la limpieza de IPs expiradas PRIMERO.
$this->limpiar_ips_expiradas();
// 2. Obtener las entradas limpias y contarlas.
$entries = $this->get_all_blocked_entries();
$this->blocked_count = count( $entries );
// 3. Devolver el conteo.
return $this->blocked_count;
}
/**
* AJAX callback to test the server's outbound connection.
*/
public function ajax_test_outbound_connection() {
if ( ! current_user_can('manage_options') ) {
wp_send_json_error( [ 'message' => 'Permission denied.' ] );
}
check_ajax_referer( 'advaipbl_test_connection_nonce', 'nonce' );
$response = wp_remote_get('https://api.ipify.org?format=json', [ 'timeout' => 10 ]);
if ( is_wp_error($response) ) {
wp_send_json_error( [ 'message' => 'Error: ' . $response->get_error_message() ] );
}
$http_code = wp_remote_retrieve_response_code( $response );
if ( $http_code !== 200 ) {
wp_send_json_error( [ 'message' => sprintf( 'Error: Received HTTP status code %d.', $http_code ) ] );
}
$body = json_decode( wp_remote_retrieve_body( $response ), true );
if ( isset( $body['ip'] ) && filter_var( $body['ip'], FILTER_VALIDATE_IP ) ) {
wp_send_json_success( [ 'message' => sprintf( 'Success! Connection established from IP: %s', $body['ip'] ) ] );
}
wp_send_json_error( [ 'message' => 'Error: The response from the test service was invalid.' ] );
}
/**
* Gets the username of the current logged-in administrator.
*
* @return string The username or a default string if not available.
*/
private function get_current_admin_username() {
$user = wp_get_current_user();
// Si el usuario existe y tiene un ID, devuelve su login. Si no, devuelve un texto genérico.
return ( $user && $user->ID ) ? $user->user_login : __( 'an unknown user', 'advanced-ip-blocker' );
}
/**
* Añade una entrada (IP o rango) a la whitelist y se asegura de que sea eliminada
* de todas las listas de bloqueo. Este es el método centralizado para esta acción.
*
* @param string $entry_to_whitelist La IP o rango a añadir a la whitelist.
* @param string $detail Una descripción de por qué se añadió.
* @return bool True si la entrada se añadió con éxito, false si ya existía.
*/
public function add_to_whitelist_and_unblock( $entry_to_whitelist, $detail ) {
if ( ! $this->is_valid_ip_or_range( $entry_to_whitelist ) ) {
return false;
}
$whitelist = get_option( self::OPTION_WHITELIST, [] );
if ( array_key_exists( $entry_to_whitelist, $whitelist ) ) {
return false;
}
$whitelist[ $entry_to_whitelist ] = [ 'timestamp' => time(), 'detail' => $detail ];
update_option( self::OPTION_WHITELIST, $whitelist );
if ( filter_var( $entry_to_whitelist, FILTER_VALIDATE_IP ) ) {
$this->desbloquear_ip( $entry_to_whitelist );
} else {
// Usar el mapa de constantes para limpiar el rango de TODAS las listas.
$option_key_map = [
'geoblock' => self::OPTION_BLOCKED_GEO,
'honeypot' => self::OPTION_BLOCKED_HONEYPOT,
'user_agent' => self::OPTION_BLOCKED_USER_AGENT,
'manual' => self::OPTION_BLOCKED_MANUAL,
'404' => self::OPTION_BLOCKED_404,
'403' => self::OPTION_BLOCKED_403,
'login' => self::OPTION_BLOCKED_LOGIN,
];
foreach ( $option_key_map as $type => $option_key ) {
$list = get_option( $option_key, [] );
if ( is_array($list) && array_key_exists( $entry_to_whitelist, $list ) ) {
unset( $list[ $entry_to_whitelist ] );
update_option( $option_key, $list );
}
}
}
/* translators: 1: The whitelisted IP/range, 2: The admin username. */
$this->log_event( sprintf( __( 'Entry %1$s added to whitelist by %2$s.', 'advanced-ip-blocker' ), $entry_to_whitelist, $this->get_current_admin_username() ), 'info', is_array($entry_to_whitelist) ? wp_json_encode($entry_to_whitelist) : $entry_to_whitelist );
return true;
}
/**
* AJAX callback to add a specific IP to the whitelist.
* This is used by the interactive buttons in the admin interface.
*/
public function ajax_add_ip_to_whitelist() {
// 1. Validar permisos y nonce de seguridad (esto no cambia).
if ( ! current_user_can('manage_options') ) {
wp_send_json_error( [ 'message' => __( 'Permission denied.', 'advanced-ip-blocker' ) ] );
}
check_ajax_referer( 'advaipbl_add_whitelist_nonce', 'nonce' );
// 2. Obtener y validar la IP del POST. Esta función AJAX solo maneja IPs individuales.
if ( ! isset( $_POST['ip'] ) || ! filter_var( wp_unslash( $_POST['ip'] ), FILTER_VALIDATE_IP ) ) {
wp_send_json_error( [ 'message' => __( 'Invalid or missing IP address.', 'advanced-ip-blocker' ) ] );
}
$ip = sanitize_text_field( wp_unslash( $_POST['ip'] ) );
$detail = isset( $_POST['detail'] ) ? sanitize_text_field( wp_unslash( $_POST['detail'] ) ) : __('Added via admin action', 'advanced-ip-blocker');
// 3. Reutilizar nuestra nueva lógica centralizada.
$success = $this->add_to_whitelist_and_unblock( $ip, $detail );
if ( $success ) {
/* translators: %s: The IP address that was successfully whitelisted. */
wp_send_json_success( [ 'message' => sprintf( __( '%s successfully added to the whitelist.', 'advanced-ip-blocker' ), $ip ) ] );
} else {
/* translators: %s: The IP address that is already whitelisted. */
wp_send_json_success( [ 'message' => sprintf( __( '%s is already whitelisted.', 'advanced-ip-blocker' ), $ip ) ] );
}
}
public function handle_clear_cache_action() {
if (!isset($_GET['_wpnonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'advaipbl_clear_location_cache_nonce')) {
wp_die('Invalid nonce.');
}
if (!current_user_can('manage_options')) {
wp_die('Permission denied.');
}
delete_transient(ADVAIPBL_USM_LOCATION_CACHE_KEY);
/* translators: %s: Admin username. */
$this->log_event( sprintf( __( 'User session location cache manually cleared by %s.', 'advanced-ip-blocker' ), $this->get_current_admin_username() ), 'info' );
set_transient('advaipbl_admin_notice', ['message' => __('Location cache has been cleared.', 'advanced-ip-blocker'), 'type' => 'success'], 30);
wp_safe_redirect(wp_get_referer());
exit;
}
/**
* Envuelve el contenido de un email en una plantilla HTML básica y profesional.
*
* @param string $subject El asunto del email.
* @param string $content_html El contenido principal del email en HTML.
* @return string El cuerpo completo del email en HTML.
*/
private function get_html_email_template( $subject, $content_html ) {
$site_name = get_bloginfo( 'name' );
$site_url = home_url();
$settings_url = admin_url( 'options-general.php?page=advaipbl_settings_page' );
$logo_url = plugin_dir_url( dirname( __FILE__ ) ) . 'assets/img/logo-email.png';
// Estilos CSS en línea
$body_style = "background-color: #f6f7f8; padding: 20px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol';";
$wrapper_style = "background-color: #ffffff; border: 1px solid #e0e0e0; border-radius: 4px; padding: 40px; max-width: 600px; margin: 0 auto;";
$logo_wrapper_style = "text-align: center; margin-bottom: 25px;";
// Estilos flexibles para el logo
$logo_style = "max-width: 220px; height: auto; border: 0; display: inline-block; vertical-align: middle;";
$header_style = "font-size: 24px; font-weight: bold; color: #2271b1; margin-top: 0; margin-bottom: 20px; text-align: center;";
$footer_style = "font-size: 12px; color: #777777; text-align: center; margin-top: 30px; line-height: 1.6; border-top: 1px solid #e0e0e0; padding-top: 20px;";
ob_start();
?>
options['notification_email'] ) && is_email( $this->options['notification_email'] ) ? $this->options['notification_email'] : get_option( 'admin_email' );
$site_name = get_bloginfo( 'name' );
$settings_url = admin_url( 'options-general.php?page=advaipbl_settings_page' );
// Asunto para la línea "Subject:" del email (largo y descriptivo).
/* translators: %s: The name of the website. */
$email_subject = sprintf( __( '[%s] Welcome & Quick Setup Guide for Advanced IP Blocker', 'advanced-ip-blocker' ), $site_name );
// Título para el
dentro del cuerpo del email (corto y limpio).
$template_title = __( 'Welcome & Quick Setup Guide', 'advanced-ip-blocker' );
// 3. Construir el contenido HTML del email
$content_html =
'
' . esc_html__( 'Thank you for using Advanced IP Blocker! This email confirms your email settings are working. Here is a quick guide to get the most out of the plugin:', 'advanced-ip-blocker' ) . '
' .
/* translators: %s: a link to the Status & Debug tab. */
sprintf(
wp_kses(
__( 'This is the most important step to prevent locking yourself out. Go to the Status & Debug tab to confirm that your IP address and your server\'s IP are correctly detected. If they are not on the whitelist, add them with a single click.', 'advanced-ip-blocker' ),
[ 'a' => [ 'href' => [] ] ]
),
esc_url( add_query_arg( 'tab', 'status', $settings_url ) )
) .
'
' .
/* translators: %s: a link to the User Agents tab. */
sprintf(
wp_kses(
__( 'Go to the User Agents tab and copy the suggested list of malicious bots into the "Blocked" text area.', 'advanced-ip-blocker' ),
[ 'a' => [ 'href' => [] ] ]
),
esc_url( add_query_arg( 'tab', 'user_agents', $settings_url ) )
) . ' ' .
/* translators: %s: a link to the Honeypot URLs tab. */
sprintf(
wp_kses(
__( 'Then, go to the Honeypot URLs tab and do the same. This will immediately block thousands of common automated attacks.', 'advanced-ip-blocker' ),
[ 'a' => [ 'href' => [] ] ]
),
esc_url( add_query_arg( 'tab', 'honeypot', $settings_url ) )
) .
'
' .
/* translators: %s: a link to the main Settings tab. */
sprintf(
wp_kses(
__( 'Finally, visit the main Settings tab to enable logging and configure notification frequency to your liking. The default blocking rules are a great starting point for most sites.', 'advanced-ip-blocker' ),
[ 'a' => [ 'href' => [] ] ]
),
esc_url( add_query_arg( 'tab', 'general_settings', $settings_url ) )
) .
'
';
// 4. Envolver en la plantilla y enviar (usando las nuevas variables)
$body = $this->get_html_email_template( $template_title, $content_html );
add_filter( 'wp_mail_content_type', [ $this, 'set_html_mail_content_type' ] );
$sent = wp_mail( $to, $email_subject, $body );
remove_filter( 'wp_mail_content_type', [ $this, 'set_html_mail_content_type' ] );
// 5. Lógica de notificación y redirección
if ( $sent ) {
$message = __( 'The setup guide has been sent successfully to your configured email address.', 'advanced-ip-blocker' );
$type = 'success';
/* translators: 1: Recipient's email address, 2: Admin username */
$this->log_event( sprintf( __( 'Setup guide sent to %1$s by %2$s.', 'advanced-ip-blocker' ), $to, $this->get_current_admin_username() ), 'info' );
} else {
$message = __( 'Failed to send the setup guide email. Please check your site\'s email configuration.', 'advanced-ip-blocker' );
$type = 'error';
/* translators: 1: Recipient's email address, 2: Admin username */
$this->log_event( sprintf( __( 'FAILED to send setup guide to %1$s. Action by %2$s.', 'advanced-ip-blocker' ), $to, $this->get_current_admin_username() ), 'error' );
}
set_transient( 'advaipbl_admin_notice', [ 'message' => $message, 'type' => $type ], 30 );
wp_safe_redirect( wp_get_referer() );
exit;
}
public function load_admin_scripts($hook) {
if ( strpos( $hook, 'advaipbl_settings_page' ) === false ) {
return;
}
$this->session_manager->enqueue_scripts_styles();
wp_enqueue_style( 'advaipbl-styles-main', plugin_dir_url( dirname( __FILE__ ) ) . 'css/advaipbl-styles.css', [], ADVAIPBL_VERSION );
wp_enqueue_style( 'advaipbl-select2-css', plugin_dir_url( dirname( __FILE__ ) ) . 'assets/css/select2.min.css', [], '4.1.0-rc.0' );
wp_enqueue_script( 'advaipbl-select2-js', plugin_dir_url( dirname( __FILE__ ) ) . 'assets/js/select2.min.js', [ 'jquery' ], '4.1.0-rc.0', true );
wp_enqueue_script( 'advaipbl-admin-js', plugin_dir_url( dirname( __FILE__ ) ) . 'js/advaipbl-admin.js', [ 'jquery', 'advaipbl-select2-js' ], ADVAIPBL_VERSION, true );
$floating_bar_css = " #advaipbl-floating-save-bar { position: fixed; bottom: 0; left: 160px; right: 0; background-color: #fff; box-shadow: 0 -2px 5px rgba(0,0,0,0.1); padding: 15px 30px; z-index: 999; transition: transform 0.3s ease-in-out; transform: translateY(100%); } #advaipbl-floating-save-bar.advaipbl-save-bar-visible { transform: translateY(0); } .advaipbl-save-bar-content { display: flex; justify-content: space-between; align-items: center; max-width: 1200px; margin: 0 auto; } .advaipbl-save-bar-text { font-size: 1.1em; font-weight: 600; } .advaipbl-save-bar-buttons .button { margin-left: 10px; } @media screen and (max-width: 960px) { #advaipbl-floating-save-bar { left: 36px; } } @media screen and (max-width: 782px) { #advaipbl-floating-save-bar { left: 0; padding: 10px 15px; } .advaipbl-save-bar-text { display: none; } .advaipbl-save-bar-content { justify-content: flex-end; } }";
wp_add_inline_style('advaipbl-styles-main', $floating_bar_css);
// --- Procesar información del servidor ---
$server_ip = $this->get_server_ip();
$server_info = [
'ip' => $server_ip,
'country_code' => '',
'country_name' => '',
'is_whitelisted' => false
];
if ( $server_ip ) {
$location = $this->api_manager->fetch_location( $server_ip );
if ( $location && empty( $location['error'] ) ) {
$server_info['country_code'] = $location['country_code'] ?? '';
$server_info['country_name'] = $location['country'] ?? '';
}
$server_info['is_whitelisted'] = $this->is_whitelisted( $server_ip );
}
// --- Procesar información del administrador (usuario actual) ---
$admin_ip = $this->get_client_ip();
$admin_info = [
'ip' => $admin_ip,
'country_code' => '',
'country_name' => '',
'is_whitelisted' => false
];
if ( $admin_ip && filter_var( $admin_ip, FILTER_VALIDATE_IP ) ) {
$location = $this->api_manager->fetch_location( $admin_ip );
if ( $location && empty( $location['error'] ) ) {
$admin_info['country_code'] = $location['country_code'] ?? '';
$admin_info['country_name'] = $location['country'] ?? '';
}
$admin_info['is_whitelisted'] = $this->is_whitelisted( $admin_ip );
}
// --- Obtener el conteo de entradas bloqueadas ---
$blocked_count = count( $this->get_all_blocked_entries() );
// --- Localizar scripts con datos para el frontend ---
wp_localize_script('advaipbl-admin-js', 'advaipbl_admin_data', [
'counts' => [
'blocked' => $blocked_count,
],
'geoblock' => [
'server' => $server_info,
'admin' => $admin_info,
'blocked_countries' => $this->options['geoblock_countries'] ?? [],
],
'nonces' => [
'test_connection' => wp_create_nonce( 'advaipbl_test_connection_nonce' ),
'add_whitelist' => wp_create_nonce( 'advaipbl_add_whitelist_nonce' ),
'export' => wp_create_nonce( 'advaipbl_export_nonce' ),
'verify_api' => wp_create_nonce( 'advaipbl_verify_api_nonce' ),
'get_dashboard_stats' => wp_create_nonce( 'wp_ajax_advaipbl_get_dashboard_stats' )
],
'text' => [
'server_whitelisted' => __( 'Info: Your server is located in %1$s and its IP (%2$s) is correctly whitelisted. You can safely block this country.', 'advanced-ip-blocker' ),
'server_not_whitelisted' => __( 'CRITICAL WARNING! Your server is located in %1$s and its IP (%2$s) is NOT whitelisted. Blocking this country WILL likely break your site. Please add the server IP to the whitelist BEFORE blocking this country.', 'advanced-ip-blocker' ),
'admin_whitelisted' => __( 'Info: Your current IP address (%1$s) from %2$s is whitelisted. You will not be locked out if you block this country.', 'advanced-ip-blocker' ),
'admin_not_whitelisted' => __( 'Caution: Your current IP address (%1$s) from %2$s is NOT whitelisted. If you block this country, you may lose access to your admin panel.', 'advanced-ip-blocker' ),
'remove_server_ip_warning' => __( 'CRITICAL WARNING: This IP (%1$s) belongs to your server, located in a blocked country (%2$s). REMOVING IT FROM THE WHITELIST WILL LIKELY BREAK YOUR SITE!', 'advanced-ip-blocker' ),
'remove_admin_ip_warning' => __( 'CAUTION: This is your current IP address (%1$s) from a blocked country (%2$s). REMOVING THIS IP FROM THE WHITELIST MAY LOCK YOU OUT OF YOUR ADMIN PANEL.', 'advanced-ip-blocker' ),
'confirm_removal' => __( 'Are you absolutely sure you want to proceed?', 'advanced-ip-blocker' ),
'add_to_whitelist_btn' => __( 'Add to Whitelist', 'advanced-ip-blocker' ),
'adding_to_whitelist' => __( 'Adding...', 'advanced-ip-blocker' ),
'added_to_whitelist' => __( 'Successfully Added!', 'advanced-ip-blocker' ),
'select2_placeholder' => __( 'Search for a country to block...', 'advanced-ip-blocker' ),
'verify_api_button' => __( 'Verify', 'advanced-ip-blocker' ),
'verifying_api' => __( 'Verifying...', 'advanced-ip-blocker' ),
'enter_api_key' => __( 'Please enter an API key.', 'advanced-ip-blocker' ),
'ajax_error' => __( 'AJAX error. Check browser console.', 'advanced-ip-blocker' ),
'discard_title' => __( 'Discard Changes?', 'advanced-ip-blocker' ),
'discard_message' => __( 'You have unsaved changes. Are you sure you want to discard them?', 'advanced-ip-blocker' ),
'discard_confirm_btn' => __( 'Yes, Discard', 'advanced-ip-blocker' ),
'attacks_label' => __( 'attacks', 'advanced-ip-blocker' ),
'blocks_label' => __( 'blocks', 'advanced-ip-blocker' ),
'confirm_bulk_action_title' => __( 'Confirm Bulk Action', 'advanced-ip-blocker' ),
'confirm_bulk_unblock_message' => __( 'Are you sure you want to unblock the selected %d entries? This action cannot be undone.', 'advanced-ip-blocker' ),
'confirm_bulk_unblock_button' => __( 'Yes, Unblock Selected', 'advanced-ip-blocker' ),
'alert_no_action' => __( 'Please select a bulk action.', 'advanced-ip-blocker' ),
'alert_no_items' => __( 'Please select at least one item to apply the action.', 'advanced-ip-blocker' ),
],
]);
// --- Determinar la sub-pestaña activa del panel de administración ---
$active_sub_tab = null;
$current_page_slug = isset( $_GET['page'] ) ? sanitize_key( $_GET['page'] ) : '';
if ( isset( $_GET['sub-tab'] ) ) {
$active_sub_tab = sanitize_key( $_GET['sub-tab'] );
} else {
$page_slug_to_sub_tab_map = [
'advaipbl_settings_page' => 'main_dashboard',
'advaipbl_settings_page-settings' => 'general_settings',
'advaipbl_settings_page-rules' => 'waf',
'advaipbl_settings_page-ip-management' => 'blocked_ips',
'advaipbl_settings_page-logs' => 'security_log',
'advaipbl_settings_page-about' => 'credits',
];
if ( isset( $page_slug_to_sub_tab_map[ $current_page_slug ] ) ) {
$active_sub_tab = $page_slug_to_sub_tab_map[ $current_page_slug ];
}
}
// --- Lógica condicional basada en la sub-pestaña activa ---
if ( 'main_dashboard' === $active_sub_tab ) {
// Código para el dashboard principal
// Enqueue de scripts y estilos específicos para el dashboard
wp_enqueue_script('chartjs', 'https://cdn.jsdelivr.net/npm/chart.js@3.9.1/dist/chart.min.js', [], '3.9.1', true);
// Leaflet Core
wp_enqueue_style('leaflet-css', 'https://unpkg.com/leaflet@1.9.4/dist/leaflet.css');
wp_enqueue_script('leaflet-js', 'https://unpkg.com/leaflet@1.9.4/dist/leaflet.js', [], '1.9.4', true);
// Leaflet MarkerCluster
wp_enqueue_style('leaflet-markercluster-css', 'https://unpkg.com/leaflet.markercluster@1.5.3/dist/MarkerCluster.css');
wp_enqueue_style('leaflet-markercluster-default-css', 'https://unpkg.com/leaflet.markercluster@1.5.3/dist/MarkerCluster.Default.css');
wp_enqueue_script('leaflet-markercluster-js', 'https://unpkg.com/leaflet.markercluster@1.5.3/dist/leaflet.markercluster.js', ['leaflet-js'], '1.5.3', true);
// Nuestro script del dashboard, que ahora depende de markercluster
wp_enqueue_script('advaipbl-dashboard-js', plugin_dir_url( dirname( __FILE__ ) ) . 'js/advaipbl-dashboard.js', ['jquery', 'chartjs', 'leaflet-markercluster-js'], ADVAIPBL_VERSION, true);
} // <-- ¡Aquí cierra correctamente el primer 'if'!
// Ahora, el siguiente 'if' está en su lugar correcto.
if ('credits' === $active_sub_tab) {
wp_enqueue_script('stripe-buy-button', 'https://js.stripe.com/v3/buy-button.js', [], null, true);}
}
public function detect_http_error_status($status_header, $code) {
if ($this->error_handled_this_request || is_admin()) {
return;
}
$excluded_urls = $this->options['excluded_error_urls'] ?? '';
if (!empty($excluded_urls)) {
$excluded_list = array_filter(array_map('trim', explode("\n", $excluded_urls)));
$current_url = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : '';
foreach ($excluded_list as $excluded_item) {
if (!empty($excluded_item) && stripos($current_url, $excluded_item) !== false) {
return;
}
}
}
if ($code === 404) {
$this->error_handled_this_request = true;
$ip = $this->get_client_ip();
if ($this->is_whitelisted($ip)) return;
// La lógica del Honeypot solo se ejecuta si está activado
if (!empty($this->options['enable_honeypot_blocking'])) {
$honeypot_urls = get_option(self::OPTION_HONEYPOT_URLS, []);
if (!empty($honeypot_urls)) {
$requested_url = isset($_SERVER['REQUEST_URI']) ? strtolower(esc_url_raw(wp_unslash($_SERVER['REQUEST_URI']))) : '';
foreach ($honeypot_urls as $trap_url) {
if (!empty($trap_url) && stripos($requested_url, strtolower(trim($trap_url))) !== false) {
$reason = sprintf(__('Honeypot URL accessed: %s', 'advanced-ip-blocker'), $trap_url);
$this->block_ip_instantly($ip, 'honeypot', $reason, ['url' => $requested_url]);
}
}
}
}
$this->handle_error('404');
} elseif ($code === 403) {
$this->error_handled_this_request = true;
$ip = $this->get_client_ip();
$all_block_types = ['geoblock', 'honeypot', '404', '403', 'login', 'user_agent', 'waf', 'rate_limit', 'asn', 'xmlrpc_block'];
foreach ($all_block_types as $type) {
if (get_transient('advaipbl_bloqueo_' . $type . '_' . md5($ip))) {
return;
}
}
$this->handle_error('403');
}
}
/**
* Renders the checkbox for the Whitelist Login Access feature, including security checks.
*/
public function restrict_login_page_callback() {
$args = [
'name' => 'restrict_login_page',
'label' => __( 'Restrict access to wp-login.php to whitelisted IPs only', 'advanced-ip-blocker' )
];
$client_ip = $this->get_client_ip();
$is_whitelisted = $this->is_whitelisted( $client_ip );
// Llama al callback del checkbox normal
$this->checkbox_field_callback($args);
// Añadimos la advertencia de seguridad
echo '
' . esc_html__( 'WARNING: This is a highly restrictive feature. Only enable it if you have a static IP address and public user registration is disabled on your site.', 'advanced-ip-blocker' ) . '
';
// Si la IP del admin no está en la whitelist, mostramos un aviso y un botón para añadirla
if ( ! $is_whitelisted ) {
echo '
';
/* translators: %s: The admin's current IP address. */
echo '' . sprintf( esc_html__( 'Your current IP address (%s) is NOT whitelisted.', 'advanced-ip-blocker' ), esc_html( $client_ip ) ) . ' ' . esc_html__( 'You MUST add it to the whitelist before enabling this feature, or you will be locked out.', 'advanced-ip-blocker' ); echo '';
echo '
';
}
}
/**
* Handles the actual restriction of the login page.
* Hooked to 'login_init'.
*/
public function handle_login_page_restriction() {
// Solo actuar si la opción está activada
if ( ! empty( $this->options['restrict_login_page'] ) ) {
$client_ip = $this->get_client_ip();
// Si la IP del visitante no está en la whitelist...
if ( ! $this->is_whitelisted( $client_ip ) ) {
/* translators: %s: The IP address that was denied access. */
$this->log_event( sprintf( __( 'Access to wp-login.php denied for non-whitelisted IP: %s', 'advanced-ip-blocker' ), $client_ip ), 'critical', $client_ip );
// Mostramos un mensaje genérico de acceso denegado y terminamos.
wp_die(
__( 'Access to this page has been restricted by the administrator.', 'advanced-ip-blocker' ),
__( 'Access Denied', 'advanced-ip-blocker' ),
[ 'response' => 403 ]
);
}
}
}
/**
* Disables the REST API user endpoints for non-authenticated users if the option is enabled.
*
* @param array $endpoints The available REST API endpoints.
* @return array The modified endpoints.
*/
public function disable_rest_api_user_endpoints( $endpoints ) {
// Solo actuar si la opción está activada en los ajustes.
if ( ! empty( $this->options['disable_user_enumeration'] ) && ! is_user_logged_in() ) {
if ( isset( $endpoints['/wp/v2/users'] ) ) {
unset( $endpoints['/wp/v2/users'] );
}
if ( isset( $endpoints['/wp/v2/users/(?P[\d]+)'] ) ) {
unset( $endpoints['/wp/v2/users/(?P[\d]+)'] );
}
}
return $endpoints;
}
/**
* Prevents user enumeration by redirecting author archive scans at an early hook.
* Enganchado a 'init'.
*/
public function prevent_author_enumeration_redirect() {
// Solo actuar si la opción está activada y no estamos en el admin.
if ( ! empty( $this->options['prevent_author_scanning'] ) && ! is_admin() ) {
// Comprobamos directamente el parámetro GET 'author'. Es mucho más fiable.
if ( isset( $_GET['author'] ) && is_numeric( $_GET['author'] ) ) {
wp_safe_redirect( home_url(), 301 );
exit;
}
}
}
/**
* Checks if a given IP address falls within a specified range (CIDR or hyphenated).
*
* @param string $ip The IP address to check.
* @param string $range The range to check against (e.g., "192.168.1.0/24" or "192.168.1.100-192.168.1.200").
* @return bool True if the IP is in the range, false otherwise.
*/
public function is_ip_in_range( $ip, $range ) {
// 1. Comprobar si es un rango CIDR
if ( strpos( $range, '/' ) !== false ) {
list( $subnet, $bits ) = explode( '/', $range );
if ( filter_var( $subnet, FILTER_VALIDATE_IP ) && is_numeric( $bits ) ) {
$ip_long = ip2long( $ip );
$subnet_long = ip2long( $subnet );
$mask = -1 << ( 32 - (int) $bits );
$subnet_masked = $subnet_long & $mask;
return ( $ip_long & $mask ) === $subnet_masked;
}
}
// 2. Comprobar si es un rango con guion
if ( strpos( $range, '-' ) !== false ) {
list( $start_ip, $end_ip ) = explode( '-', $range, 2 );
$start_ip = trim( $start_ip );
$end_ip = trim( $end_ip );
if ( filter_var( $start_ip, FILTER_VALIDATE_IP ) && filter_var( $end_ip, FILTER_VALIDATE_IP ) ) {
$ip_long = ip2long( $ip );
$start_long = ip2long( $start_ip );
$end_long = ip2long( $end_ip );
return $ip_long >= $start_long && $ip_long <= $end_long;
}
}
// 3. Si no es un rango, es una IP individual. Hacemos una comparación directa.
return $ip === $range;
}
public function run_all_block_checks() {
if ( defined( 'WP_CLI' ) && WP_CLI ) {
return;
}
$ip = $this->get_client_ip();
if ($this->is_whitelisted($ip)) {
return;
}
$automatic_block_reasons = ['geoblock', 'honeypot', '404', '403', 'login', 'user_agent', 'waf', 'rate_limit', 'asn', 'xmlrpc_block'];
foreach ($automatic_block_reasons as $type) {
if (get_transient('advaipbl_bloqueo_' . $type . '_' . md5($ip))) {
$this->access_denied_page(__('403 - Access Denied', 'advanced-ip-blocker'), $this->get_block_message($type));
}
}
$manual_blocks = get_option( self::OPTION_BLOCKED_MANUAL, [] );
if ( ! empty( $manual_blocks ) ) {
foreach ( array_keys( $manual_blocks ) as $entry ) {
if ( $this->is_ip_in_range( $ip, $entry ) ) {
$this->access_denied_page( __('403 - Access Denied', 'advanced-ip-blocker'), $this->get_block_message('manual') );
}
}
}
$is_xmlrpc_request = (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'xmlrpc.php') !== false);
if ($is_xmlrpc_request && ($this->options['xmlrpc_protection_mode'] ?? 'smart') === 'smart') {
$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$visitor_asn = false;
if (in_array($this->options['geolocation_provider'] ?? '', ['ip-api.com', 'ipinfo.io'], true)) {
$location_data = $this->api_manager->fetch_location($ip);
if ($location_data && empty($location_data['error'])) {
$visitor_asn = $this->asn_manager->extract_asn_from_data($location_data);
}
}
if ($visitor_asn === 'AS2635') { return; }
$automattic_ua_patterns = [ '/^WordPress\/\d+\.\d+/i', '/jetpack by wordpress\.com/i', '/woocommerce/i' ];
$third_party_allowed_ua = [ 'Microsoft-Live-Writer' ];
$ua_is_automattic = false;
foreach ($automattic_ua_patterns as $pattern) { if (preg_match($pattern, $user_agent)) { $ua_is_automattic = true; break; } }
if ($visitor_asn && $ua_is_automattic) {
$reason = sprintf(__('Blocked spoofed XML-RPC request. IP from ASN %s claimed to be Automattic.', 'advanced-ip-blocker'), $visitor_asn);
$log_data = ['user_agent' => $user_agent, 'uri' => $_SERVER['REQUEST_URI'] ?? 'N/A', 'asn' => $visitor_asn];
$this->block_ip_instantly($ip, 'xmlrpc_block', $reason, $log_data);
}
$is_third_party_allowed = false;
foreach ($third_party_allowed_ua as $allowed_ua) { if (stripos($user_agent, $allowed_ua) !== false) { $is_third_party_allowed = true; break; } }
if ($is_third_party_allowed) { return; }
if (false === $visitor_asn && $ua_is_automattic) { return; }
if (!$ua_is_automattic && !$is_third_party_allowed) {
$reason = sprintf(__('Blocked untrusted XML-RPC request from User-Agent: %s', 'advanced-ip-blocker'), $user_agent);
$log_data = ['user_agent' => $user_agent, 'uri' => $_SERVER['REQUEST_URI'] ?? 'N/A', 'asn' => $visitor_asn ?: 'API Failed/Unavailable'];
$this->block_ip_instantly($ip, 'xmlrpc_block', $reason, $log_data);
}
return;
}
if ( ! empty( $this->options['enable_waf'] ) ) {
$triggered_rule = $this->waf_manager->run_waf_scan();
if ( $triggered_rule !== false ) {
$reason_message = sprintf(__('WAF Rule Triggered: %s', 'advanced-ip-blocker'), $triggered_rule);
$log_data = ['rule' => $triggered_rule, 'uri' => $_SERVER['REQUEST_URI'] ?? 'N/A', 'method' => $_SERVER['REQUEST_METHOD'] ?? 'N/A'];
$this->block_ip_instantly($ip, 'waf', $reason_message, $log_data);
}
}
if (!empty($this->options['enable_geoblocking'])) {
$blocked_countries = $this->options['geoblock_countries'] ?? [];
if ( ! empty( $blocked_countries ) ) {
$location = $this->api_manager->fetch_location( $ip );
if ( $location && ! empty( $location['country_code'] ) ) {
if ( in_array( $location['country_code'], $blocked_countries, true ) ) {
$reason = sprintf( __( 'Country block: %s', 'advanced-ip-blocker' ), $location['country'] ?? $location['country_code'] );
$log_data = [ 'country' => $location['country'] ?? '', 'uri' => $_SERVER['REQUEST_URI'] ?? 'N/A' ];
$this->block_ip_instantly( $ip, 'geoblock', $reason, $log_data );
}
}
}
}
if (!empty($this->options['enable_spamhaus_asn']) || !empty($this->options['enable_manual_asn'])) {
$provider = $this->options['geolocation_provider'] ?? '';
if (in_array($provider, ['ip-api.com', 'ipinfo.io'], true)) {
$this->asn_manager->check_asn_block($ip);
}
}
if (!empty($this->options['enable_user_agent_blocking'])) {
$user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
if (!empty($user_agent) && !$this->is_internal_request($user_agent)) {
$is_ua_whitelisted = false;
$whitelisted_user_agents = get_option('advaipbl_whitelisted_user_agents', []);
if (!empty($whitelisted_user_agents)) {
foreach ($whitelisted_user_agents as $whitelisted_ua_raw) {
// Limpiamos la regla: quitamos el comentario y los espacios.
$whitelisted_ua = trim(preg_replace('/#.*$/', '', $whitelisted_ua_raw));
if (!empty($whitelisted_ua) && stripos($user_agent, $whitelisted_ua) !== false) {
$is_ua_whitelisted = true;
break;
}
}
}
if (!$is_ua_whitelisted) {
$blocked_user_agents = get_option('advaipbl_blocked_user_agents', []);
if (!empty($blocked_user_agents)) {
foreach ($blocked_user_agents as $blocked_ua_raw) {
// Limpiamos la regla: quitamos el comentario y los espacios.
$blocked_ua = trim(preg_replace('/#.*$/', '', $blocked_ua_raw));
if (!empty($blocked_ua) && stripos($user_agent, $blocked_ua) !== false) {
$reason_message = sprintf(__('Blocked User-Agent pattern: %s', 'advanced-ip-blocker'), $blocked_ua);
$log_data = [
'user_agent' => $user_agent,
'detail' => $reason_message,
'uri' => $_SERVER['REQUEST_URI'] ?? 'N/A'
];
$this->block_ip_instantly($ip, 'user_agent', $reason_message, $log_data);
}
}
}
}
}
}
}
public function get_all_blocked_ips_for_cli() {
$all_blocked = [];
// Mapeo de tipos técnicos a etiquetas legibles y constantes de opción.
// Esto centraliza la configuración y es fácil de leer.
$block_type_definitions = [
'geoblock' => [
'label' => __('Geoblock', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_GEO,
],
'honeypot' => [
'label' => __('Honeypot', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_HONEYPOT,
],
'user_agent' => [
'label' => __('User-Agent', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_USER_AGENT,
],
'manual' => [
'label' => __('Manual Block', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_MANUAL,
],
'404' => [
'label' => __('404 Error', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_404,
],
'403' => [
'label' => __('403 Error', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_403,
],
'login' => [
'label' => __('Login Failure', 'advanced-ip-blocker'),
'option' => self::OPTION_BLOCKED_LOGIN,
],
'xmlrpc_block' => [ 'label' => __('XML-RPC Block', 'advanced-ip-blocker'), 'option' => self::OPTION_BLOCKED_XMLRPC ],
];
// Iteramos sobre las definiciones de cada tipo de bloqueo.
foreach ( $block_type_definitions as $type => $definition ) {
$entries = get_option( $definition['option'], [] );
if ( ! is_array($entries) || empty($entries) ) {
continue;
}
// Iteramos sobre cada IP/rango dentro de esa lista.
foreach ( $entries as $ip_or_range => $block_data ) {
$timestamp = is_array($block_data) && isset($block_data['timestamp']) ? $block_data['timestamp'] : time();
$detail = is_array($block_data) && isset($block_data['detail']) ? $block_data['detail'] : '';
$all_blocked[] = [
'ip' => $ip_or_range,
'type' => $type, // El tipo técnico
'type_label' => $definition['label'], // La etiqueta legible
'timestamp' => $timestamp, // Timestamp numérico para ordenar
'detail' => $detail,
];
}
}
// Ordenar por timestamp descendente después de haber recopilado todo.
if (!empty($all_blocked)) {
usort($all_blocked, function($a, $b) {
return $b['timestamp'] <=> $a['timestamp'];
});
}
return $all_blocked;
}
public function is_whitelisted($ip) {
if ( ! filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) ) {
return false; // No es una IP pública válida, no puede estar en la whitelist.
}
$whitelist = get_option( self::OPTION_WHITELIST, [] );
if ( empty( $whitelist ) ) {
return false;
}
// Comprobación rápida para IPs individuales (la mayoría de los casos)
if ( array_key_exists( $ip, $whitelist ) ) {
return true;
}
// Iterar sobre las claves de la whitelist para buscar rangos.
foreach ( array_keys( $whitelist ) as $entry ) {
// Si la entrada no es la IP exacta, podría ser un rango.
if ( $entry !== $ip && $this->is_ip_in_range( $ip, $entry ) ) {
return true;
}
}
return false;
}
private function is_internal_request($user_agent) { return strpos($user_agent, 'WordPress/') === 0; }
private function get_block_message($type) {
$messages = [
'geoblock' => __('Access from your country has been blocked.', 'advanced-ip-blocker'),
'honeypot' => __('Access blocked due to suspicious activity.', 'advanced-ip-blocker'),
'manual' => __('Access manually blocked.', 'advanced-ip-blocker'),
'404' => __('Access blocked due to repeated 404 errors.', 'advanced-ip-blocker'),
'403' => __('Access blocked due to repeated attempts on protected resources.', 'advanced-ip-blocker'),
'login' => __('Access blocked due to multiple failed login attempts.', 'advanced-ip-blocker'),
'user_agent' => __('Access blocked due to suspicious User-Agent.', 'advanced-ip-blocker'),
'waf' => __('Your request was blocked by the security firewall.', 'advanced-ip-blocker'),
'rate_limit' => __('Your connection has been temporarily suspended due to an excessive request rate.', 'advanced-ip-blocker'),
'asn' => __('Access from your network (ASN) has been blocked by the administrator.', 'advanced-ip-blocker'),
'xmlrpc_block' => __('Blocked suspicious XML-RPC request.', 'advanced-ip-blocker'),
];
return $messages[$type] ?? __('Access blocked.', 'advanced-ip-blocker');
}
public function block_ip_instantly($ip, $type, $reason_message, $extra_data = []) {
if (get_transient('advaipbl_bloqueo_' . $type . '_' . md5($ip))) {
return;
}
// --- Lógica de Bloqueo (Transients y Opciones Persistentes) ---
$duration_key = 'duration_' . $type;
$duration_in_minutes = (int) ($this->options[$duration_key] ?? 1440);
$duration_in_seconds = $duration_in_minutes * 60;
if ('manual' === $type || ('asn' === $type && $duration_in_minutes <= 0)) {
$duration_in_seconds = 10 * YEAR_IN_SECONDS;
}
set_transient('advaipbl_bloqueo_' . $type . '_' . md5($ip), true, $duration_in_seconds);
// Manejo de casos especiales donde el nombre de la constante no sigue el patrón.
$option_constant_name = '';
if ('xmlrpc_block' === $type) {
// Usamos el nombre de la constante correcta directamente.
$option_constant_name = 'OPTION_BLOCKED_XMLRPC';
} elseif ('geoblock' === $type) {
// Usamos el nombre de la constante correcta directamente.
$option_constant_name = 'OPTION_BLOCKED_GEO';
} else {
// Para todos los demás tipos, usamos la lógica dinámica que ya funcionaba.
$option_constant_name = 'OPTION_BLOCKED_' . strtoupper($type);
}
if (defined("self::{$option_constant_name}")) {
$option_key = constant("self::{$option_constant_name}");
$list = get_option($option_key, []);
if (!is_array($list)) $list = [];
$detail_to_store = $reason_message;
if ($type === 'user_agent' && isset($extra_data['user_agent'])) {
$detail_to_store = $extra_data['user_agent'];
} elseif ($type === 'honeypot' && isset($extra_data['url'])) {
$detail_to_store = $extra_data['url'];
}
$list[$ip] = ['timestamp' => time(), 'detail' => $detail_to_store];
update_option($option_key, $list);
}
// --- LÓGICA DE LOG UNIFICADO Y ENRIQUECIDO ---
$location_data = $this->api_manager->fetch_location($ip);
$geo_details = [];
if ($location_data && empty($location_data['error'])) {
$geo_details['country'] = $location_data['country'] ?? null;
$geo_details['country_code'] = $location_data['country_code'] ?? null;
$geo_details['city'] = $location_data['city'] ?? null;
$geo_details['lat'] = $location_data['lat'] ?? null;
$geo_details['lon'] = $location_data['lon'] ?? null;
}
// Añadimos la razón específica a los datos del log antes de pasarlos.
$extra_data['_reason'] = $reason_message;
$log_details = array_merge($extra_data, $geo_details);
$this->log_specific_error($type, $ip, $log_details, 'critical');
// --- NOTIFICAR Y TERMINAR ---
$this->send_block_notification($ip, $type, 1, $extra_data);
$this->access_denied_page(__('403 - Access Denied', 'advanced-ip-blocker'), $this->get_block_message($type));
exit;
}
public function add_admin_ip_to_whitelist_on_first_run() {
if ( get_option('advaipbl_admin_ip_whitelist_trigger') ) {
if ( ! wp_doing_cron() && is_user_logged_in() && current_user_can('manage_options') ) {
$whitelist = get_option('advaipbl_ips_whitelist', []);
$ips_to_add = [];
// 1. Obtener IP del administrador.
$admin_ip = $this->get_client_ip();
if ( filter_var($admin_ip, FILTER_VALIDATE_IP) && !array_key_exists($admin_ip, $whitelist) ) {
$ips_to_add[$admin_ip] = __('Admin IP (auto-added on activation)', 'advanced-ip-blocker');
}
// 2. Obtener IP del servidor.
$server_ip = $this->get_server_ip();
if ( $server_ip && !array_key_exists($server_ip, $whitelist) ) {
// Evitar añadir la misma IP dos veces si el admin y el servidor son el mismo.
if (!isset($ips_to_add[$server_ip])) {
$ips_to_add[$server_ip] = __('Server IP (auto-added on activation)', 'advanced-ip-blocker');
}
}
if ( ! empty($ips_to_add) ) {
foreach ($ips_to_add as $ip => $detail) {
$whitelist[$ip] = [ 'timestamp' => time(), 'detail' => $detail ];
/* translators: %1$s: The IP address, %2$s: The reason/detail for whitelisting. */
$this->log_event( sprintf( __( 'IP %1$s added to whitelist. Reason: %2$s', 'advanced-ip-blocker' ), $ip, $detail ), 'info', $ip );
}
update_option('advaipbl_ips_whitelist', $whitelist);
}
delete_option('advaipbl_admin_ip_whitelist_trigger');
}
}
}
public function schedule_cron_jobs() {
if (!wp_next_scheduled('advaipbl_purge_old_logs_event')) {
wp_schedule_event(time(), 'daily', 'advaipbl_purge_old_logs_event');
}
$freq = $this->options['notification_frequency'] ?? 'disabled';
if (($freq === 'daily' || $freq === 'weekly') && !wp_next_scheduled('advaipbl_send_summary_email')) {
$this->schedule_notification_cron();
}
}
public function purge_old_logs() {
$this->options = get_option(self::OPTION_SETTINGS, []);
$retention_days = (int) ($this->options['log_retention_days'] ?? 30);
if ($retention_days <= 0) return;
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$wpdb->query($wpdb->prepare("DELETE FROM $table_name WHERE timestamp < DATE_SUB(NOW(), INTERVAL %d DAY)", $retention_days));
}
public function check_database_update() {
if (get_option('ip_blocker_pro_db_version') != ADVAIPBL_DB_VERSION) {
self::setup_database_tables();
}
if (get_option('ip_blocker_pro_log_migration_status') !== 'complete') {
$this->migrate_old_logs();
}
$this->migrate_whitelist_format();
}
private function migrate_old_logs() {
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
$logs_migrated = 0;
$log_types_to_migrate = ['404', '403'];
foreach ($log_types_to_migrate as $type) {
$option_name = ADVAIPBL_PLUGIN_NAME . "_{$type}_errors_log";
$old_logs = get_option($option_name, []);
if (empty($old_logs)) {
delete_option($option_name);
continue;
}
foreach ($old_logs as $log_entry) {
if (!is_array($log_entry) || !isset($log_entry['ip']) || !isset($log_entry['timestamp'])) continue;
$details = ['url' => $log_entry['url'] ?? '', 'method' => $log_entry['method'] ?? 'N/A', 'referrer' => $log_entry['referrer'] ?? 'N/A', 'user_agent' => $log_entry['user_agent'] ?? 'N/A'];
/* translators: %s: The error type, e.g., 404 or 403. */
$message = sprintf(__("A %s error occurred (migrated).", 'advanced-ip-blocker'), $type);
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
if ($wpdb->insert($table_name, ['timestamp' => date_i18n('Y-m-d H:i:s', $log_entry['timestamp']), 'ip' => $log_entry['ip'], 'log_type' => $type, 'level' => 'warning', 'message' => $message, 'details' => wp_json_encode($details)])) {
$logs_migrated++;
}
}
delete_option($option_name);
}
if ($logs_migrated > 0) {
/* translators: %d: The number of migrated log records. */
$this->log_event(sprintf(__('%d old log records have been migrated to the new table.', 'advanced-ip-blocker'), $logs_migrated), 'info');
}
update_option('ip_blocker_pro_log_migration_status', 'complete');
}
/**
* Migrates the old whitelist format ( ip => timestamp ) to the new format ( ip => [ 'timestamp' => ..., 'detail' => ... ] ).
* Runs only if needed.
*/
private function migrate_whitelist_format() {
$whitelist = get_option('advaipbl_ips_whitelist', []);
if ( empty($whitelist) ) {
return; // Nada que migrar.
}
// Comprobamos el formato de la primera entrada para ver si necesita migración.
$first_entry = reset($whitelist);
if ( is_array($first_entry) && isset($first_entry['timestamp']) ) {
return; // Ya está en el nuevo formato.
}
$migrated_whitelist = [];
foreach ($whitelist as $ip => $timestamp) {
if ( is_string($ip) && filter_var($ip, FILTER_VALIDATE_IP) ) {
$migrated_whitelist[$ip] = [
'timestamp' => is_numeric($timestamp) ? $timestamp : time(),
'detail' => __('Migrated from old format', 'advanced-ip-blocker')
];
}
}
update_option( 'advaipbl_ips_whitelist', $migrated_whitelist );
$this->log_event('Whitelist data format successfully migrated.', 'info');
}
public static function setup_database_tables() { global $wpdb; $charset_collate = $wpdb->get_charset_collate(); require_once(ABSPATH . 'wp-admin/includes/upgrade.php'); $table_name_logs = $wpdb->prefix . 'advaipbl_logs'; $sql_logs = "CREATE TABLE $table_name_logs ( log_id BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT, timestamp DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00', ip VARCHAR(100) NOT NULL, log_type VARCHAR(20) NOT NULL, level VARCHAR(20) NOT NULL, message TEXT NOT NULL, details LONGTEXT NULL, PRIMARY KEY (log_id), KEY ip (ip(16)), KEY log_type (log_type), KEY timestamp (timestamp) ) $charset_collate;"; dbDelta($sql_logs); $table_name_queue = $wpdb->prefix . 'advaipbl_notifications_queue'; $sql_queue = "CREATE TABLE $table_name_queue ( id BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT, timestamp DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00', ip VARCHAR(100) NOT NULL, block_type VARCHAR(20) NOT NULL, reason TEXT NOT NULL, PRIMARY KEY (id), KEY timestamp (timestamp) ) $charset_collate;"; dbDelta($sql_queue); update_option('ip_blocker_pro_db_version', ADVAIPBL_DB_VERSION); }
public static function get_formatted_datetime($timestamp) { if (!is_numeric($timestamp)) { $timestamp = strtotime($timestamp); } if ($timestamp === false) { return __('Invalid date', 'advanced-ip-blocker'); } $options = get_option('advaipbl_settings', []); $timezone_string = $options['log_timezone'] ?? wp_timezone_string(); try { $date = new DateTime('@' . $timestamp); $timezone = new DateTimeZone($timezone_string); $date->setTimezone($timezone); return $date->format('Y-m-d H:i:s T'); } catch (Exception $e) { $format = get_option('date_format') . ' ' . get_option('time_format'); return date_i18n($format, $timestamp); } }
/**
* Parsea una cadena de User-Agent y devuelve una descripción legible.
*
* @param string $ua La cadena de User-Agent.
* @return string Una descripción formateada (ej. "Chrome on Windows").
*/
private static function parse_user_agent($ua) {
if (empty($ua) || $ua === __('Unknown', 'advanced-ip-blocker')) {
return __('Unknown device', 'advanced-ip-blocker');
}
$os = __('Unknown OS', 'advanced-ip-blocker');
$browser = __('Unknown Browser', 'advanced-ip-blocker');
// Mapeos para una detección más precisa
$os_map = [
'/windows nt 10/i' => 'Windows 10/11',
'/windows nt 6.3/i' => 'Windows 8.1',
'/windows nt 6.2/i' => 'Windows 8',
'/windows nt 6.1/i' => 'Windows 7',
'/windows nt 6.0/i' => 'Windows Vista',
'/windows nt 5.1/i' => 'Windows XP',
'/macintosh|mac os x/i' => 'Mac OS',
'/linux/i' => 'Linux',
'/android/i' => 'Android',
'/iphone/i' => 'iPhone',
'/ipad/i' => 'iPad',
];
$browser_map = [
'/msie/i' => 'Internet Explorer',
'/firefox/i' => 'Firefox',
'/safari/i' => 'Safari',
'/chrome/i' => 'Chrome',
'/edge/i' => 'Edge',
'/opera/i' => 'Opera',
'/netscape/i' => 'Netscape',
'/maxthon/i' => 'Maxthon',
'/konqueror/i' => 'Konqueror',
'/mobile/i' => 'Mobile Browser',
];
foreach ($os_map as $regex => $value) {
if (preg_match($regex, $ua)) {
$os = $value;
break;
}
}
foreach ($browser_map as $regex => $value) {
if (preg_match($regex, $ua)) {
$browser = $value;
break;
}
}
// Corrección para que "Chrome" no se identifique como "Safari"
if ($browser === 'Safari' && strpos(strtolower($ua), 'chrome') !== false) {
$browser = 'Chrome';
}
/* translators: 1: Browser name, 2: Operating System name. */
return sprintf(__('%1$s on %2$s', 'advanced-ip-blocker'), $browser, $os);
}
/**
* Obtiene la IP del visitante actual. Actúa como un wrapper para get_ip_intelligence()
*
* @return string La IP del visitante.
*/
public function get_client_ip() {
if ( null !== $this->client_ip ) {
return $this->client_ip;
}
$ip_data = $this->get_ip_intelligence();
$this->client_ip = $ip_data['visitor_ip'] ?? '0.0.0.0';
return $this->client_ip;
}
/**
* Obtiene un análisis completo y verificado de las direcciones IP de una petición.
*/
public function get_ip_intelligence() {
// 1. Inicializar la estructura de datos de retorno
$result = [
'visitor_ip' => null,
'visitor_ip_source' => null,
'proxy_chain' => [],
'is_proxied' => false,
'cdn_info' => [
'provider' => 'None',
'ray_id' => null,
'country' => null,
],
];
// 2. Unificar todas las cabeceras disponibles en un solo array (insensible a mayúsculas)
$headers = [];
if (function_exists('apache_request_headers')) {
$headers = apache_request_headers();
}
foreach ($_SERVER as $key => $value) {
if (strpos($key, 'HTTP_') === 0) {
$header_key = str_replace('_', '-', strtolower(substr($key, 5)));
$headers[$header_key] = $value;
}
}
$headers = array_change_key_case($headers, CASE_LOWER);
// 3. Jerarquía de Confianza para determinar la IP del visitante
// Nivel 1: Cabeceras de Cloudflare (Máxima Confianza)
if (isset($headers['cf-connecting-ip'])) {
$result['visitor_ip'] = filter_var($headers['cf-connecting-ip'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: CF-Connecting-IP';
$result['is_proxied'] = true;
$result['cdn_info']['provider'] = 'Cloudflare';
$result['cdn_info']['ray_id'] = $headers['cf-ray'] ?? null;
$result['cdn_info']['country'] = $headers['cf-ipcountry'] ?? null;
}
// Nivel 2: Cabeceras de otros Proxies/CDNs conocidos (Alta Confianza)
elseif (isset($headers['true-client-ip'])) {
$result['visitor_ip'] = filter_var($headers['true-client-ip'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: True-Client-IP';
$result['is_proxied'] = true;
$result['cdn_info']['provider'] = 'Akamai (probable)';
}
elseif (isset($headers['fastly-client-ip'])) {
$result['visitor_ip'] = filter_var($headers['fastly-client-ip'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: Fastly-Client-IP';
$result['is_proxied'] = true;
$result['cdn_info']['provider'] = 'Fastly';
}
elseif (isset($headers['x-real-ip'])) { // Común en Nginx y otros proxies
$result['visitor_ip'] = filter_var($headers['x-real-ip'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: X-Real-IP';
$result['is_proxied'] = true;
$result['cdn_info']['provider'] = 'Proxy Inverso (Nginx/Otro)';
}
elseif (isset($headers['x-cluster-client-ip'])) { // Común en Google Cloud
$result['visitor_ip'] = filter_var($headers['x-cluster-client-ip'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: X-Cluster-Client-IP';
$result['is_proxied'] = true;
$result['cdn_info']['provider'] = 'Proxy de Cluster (Google Cloud?)';
}
// Añadimos variaciones de X-Forwarded-For que a veces se usan.
elseif (isset($headers['x-forwarded'])) {
$forwarded_ips = array_map('trim', explode(',', $headers['x-forwarded']));
$result['visitor_ip'] = filter_var($forwarded_ips[0], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: X-Forwarded';
$result['is_proxied'] = true;
}
elseif (isset($headers['forwarded-for'])) {
$forwarded_ips = array_map('trim', explode(',', $headers['forwarded-for']));
$result['visitor_ip'] = filter_var($forwarded_ips[0], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: Forwarded-For';
$result['is_proxied'] = true;
}
// Nivel 3: Cabecera estándar X-Forwarded-For (Confianza Media)
elseif (isset($headers['x-forwarded-for'])) {
// X-Forwarded-For puede ser una lista: "cliente, proxy1, proxy2"
$forwarded_ips = array_map('trim', explode(',', $headers['x-forwarded-for']));
// La IP del cliente real es siempre la primera de la lista.
$result['visitor_ip'] = filter_var($forwarded_ips[0], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Header: X-Forwarded-For';
$result['is_proxied'] = true;
// El resto de IPs en la lista son los proxies intermedios.
if (count($forwarded_ips) > 1) {
$result['proxy_chain'] = array_slice($forwarded_ips, 1);
}
}
// Nivel 4: Conexión Directa (Baja Confianza si se espera un proxy)
if ($result['visitor_ip'] === null) {
$result['visitor_ip'] = filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP);
$result['visitor_ip_source'] = 'Direct Connection (REMOTE_ADDR)';
}
// 4. Poblar la cadena de proxies
// Si la petición fue a través de un proxy, REMOTE_ADDR contendrá la IP del último proxy.
if ($result['is_proxied'] && isset($_SERVER['REMOTE_ADDR'])) {
$last_proxy_ip = filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP);
if ($last_proxy_ip && !in_array($last_proxy_ip, $result['proxy_chain'])) {
// Añadir al final de la cadena de proxies.
$result['proxy_chain'][] = $last_proxy_ip;
}
}
return $result;
}
/**
* Gets the server's public IP address using a robust method.
* It first tries the fast $_SERVER variable, then falls back to an external API call.
*
* @return string|null The server's IP address or null if not found.
*/
private function get_server_ip() {
// Método 1: El más rápido, si está disponible y es una IP pública.
$server_ip = $_SERVER['SERVER_ADDR'] ?? null;
if ( $server_ip && filter_var( $server_ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) ) {
return $server_ip;
}
// Método 2: Fallback a un servicio externo (muy fiable).
// Hacemos una petición a un servicio que nos devuelve nuestra propia IP.
$response = wp_remote_get( 'https://api.ipify.org' );
if ( ! is_wp_error( $response ) && wp_remote_retrieve_response_code( $response ) === 200 ) {
$ip = trim( wp_remote_retrieve_body( $response ) );
if ( filter_var( $ip, FILTER_VALIDATE_IP ) ) {
return $ip;
}
}
// Si ambos métodos fallan, no podemos determinar la IP.
return null;
}
public function log_event( $message, $level = 'info', $details = [] ) {
if ( empty( $this->options['enable_logging'] ) ) {
return;
}
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
@$wpdb->insert(
$table_name,
[
'timestamp' => current_time( 'mysql', 1 ),
'ip' => $this->get_client_ip(),
'log_type' => 'general',
'level' => $level,
'message' => $message,
'details' => ! empty( $details ) ? wp_json_encode( $details ) : null,
]
);
}
public function log_specific_error($type, $ip, $extra_data = [], $level = 'warning') {
if (empty($this->options['enable_logging'])) {
return;
}
global $wpdb;
$table_name = $wpdb->prefix . 'advaipbl_logs';
$details = [
'url' => $_SERVER['REQUEST_URI'] ?? '',
'method' => $_SERVER['REQUEST_METHOD'] ?? 'N/A',
'referrer' => $_SERVER['HTTP_REFERER'] ?? 'N/A',
'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'N/A',
];
if (is_array($extra_data)) {
$details = array_merge($details, $extra_data);
}
if (!isset($details['lat']) || !isset($details['lon'])) {
$location_data = $this->api_manager->fetch_location($ip);
if ($location_data && empty($location_data['error'])) {
$details['country'] = $location_data['country'] ?? null;
$details['country_code'] = $location_data['country_code'] ?? null;
$details['city'] = $location_data['city'] ?? null;
$details['lat'] = $location_data['lat'] ?? null;
$details['lon'] = $location_data['lon'] ?? null;
}
}
$message = '';
switch ($type) {
case 'login': $message = sprintf(__('Failed login attempt for user: %s', 'advanced-ip-blocker'), $details['username'] ?? __('unknown', 'advanced-ip-blocker')); break;
case 'waf': $message = sprintf(__('Request blocked by WAF rule: %s', 'advanced-ip-blocker'), $details['rule'] ?? __('unknown rule', 'advanced-ip-blocker')); break;
case 'rate_limit': $message = sprintf(__('Rate limit exceeded: %1$d requests in %2$d seconds.', 'advanced-ip-blocker'), $details['count'] ?? 0, $details['window'] ?? 0); break;
case 'asn': $message = sprintf(__('Request blocked due to blacklisted ASN: %s', 'advanced-ip-blocker'), $details['asn_number'] ?? 'N/A'); break;
case 'xmlrpc_block': $message = $details['_reason'] ?? sprintf(__('Blocked untrusted XML-RPC request from User-Agent: %s', 'advanced-ip-blocker'), $details['user_agent'] ?? 'N/A'); break;
case 'honeypot': $message = sprintf(__('Honeypot URL accessed: %s', 'advanced-ip-blocker'), $details['url'] ?? 'N/A'); break;
case 'geoblock': $message = sprintf(__('Blocked access from country: %s', 'advanced-ip-blocker'), $details['country'] ?? 'N/A'); break;
case 'user_agent': $message = sprintf(__('Blocked due to User-Agent match: %s', 'advanced-ip-blocker'), $details['user_agent'] ?? 'N/A'); break;
default: $message = sprintf(__('A %s error occurred.', 'advanced-ip-blocker'), strtoupper($type)); break;
}
// 1. Insertar el log específico del evento (comportamiento actual)
@$wpdb->insert(
$table_name,
[
'timestamp' => current_time('mysql', 1),
'ip' => $ip,
'log_type' => $type,
'level' => $level,
'message' => $message,
'details' => wp_json_encode($details)
]
);
// 2. Si el evento es un bloqueo (nivel 'critical'), añadimos una entrada de auditoría al log general.
if ('critical' === $level) {
$type_label = ucwords(str_replace('_', ' ', $type));
$general_log_message = sprintf(
/* translators: 1: IP Address, 2: Block Type Label (e.g., "WAF Block") */
__('IP %1$s was automatically blocked. Reason: %2$s.', 'advanced-ip-blocker'),
$ip,
$type_label
);
$this->log_event($general_log_message, 'critical', ['original_log_type' => $type]);
}
}
public function registrar_intento_login_fallido( $username ) {
$this->handle_error( 'login', [ 'username' => $username ] );
}
private function handle_error($type, $extra_data = []) {
$ip = $this->get_client_ip();
if ($this->is_whitelisted($ip)) {
return;
}
$all_block_types = ['geoblock', 'honeypot', 'manual', '404', '403', 'login', 'user_agent', 'waf', 'rate_limit', 'asn', 'xmlrpc_block'];
foreach ($all_block_types as $reason_type) {
if (get_transient('advaipbl_bloqueo_' . $reason_type . '_' . md5($ip))) {
$this->log_specific_error($type, $ip, $extra_data);
return;
}
}
$this->log_specific_error($type, $ip, $extra_data);
$s = $this->options;
$minute_in_seconds = 60;
$threshold = (int) ($s["threshold_{$type}"] ?? 5);
$window = (int) ($s["transient_expiration_{$type}"] ?? 60) * $minute_in_seconds;
$count_key = "advaipbl_errores_{$type}_" . md5($ip);
$errors = (int) get_transient($count_key) + 1;
set_transient($count_key, $errors, $window);
// No se guarda en un transient, se pasa directamente a la cola de bloqueo.
if ($errors >= $threshold) {
// Obtenemos el detalle del evento actual, no de un transient antiguo.
$trigger_detail = ($type === 'login')
? ($extra_data['username'] ?? 'N/A')
: (isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : 'N/A');
self::$block_queue = [
'ip' => $ip,
'type' => $type,
'trigger' => $trigger_detail, // Usamos el detalle actual.
'to' => !empty($this->options['notification_email']) && is_email($this->options['notification_email']) ? $this->options['notification_email'] : get_option('admin_email'),
'options' => $this->options,
'errors' => $errors,
];
if (!self::$shutdown_hook_registered) {
register_shutdown_function([$this, 'execute_shutdown_block']);
self::$shutdown_hook_registered = true;
}
delete_transient($count_key);
}
}
/**
* Versión simplificada para procesar el bloqueo en el shutdown.
* Envía un email de texto plano sin usar funciones complejas de WP.
*/
public function execute_shutdown_block() {
if (empty(self::$block_queue)) {
return;
}
$q = self::$block_queue;
$ip = $q['ip'];
$type = $q['type'];
$trigger = $q['trigger'];
$to = $q['to'];
$options = $q['options'];
$errors = (isset($q['errors']) && is_numeric($q['errors'])) ? $q['errors'] : 1;
// 1. Mapear el tipo de bloqueo a su constante de opción correspondiente.
$option_key_map = [
'404' => self::OPTION_BLOCKED_404,
'403' => self::OPTION_BLOCKED_403,
'login' => self::OPTION_BLOCKED_LOGIN,
];
$option_key = $option_key_map[$type] ?? null;
if ( ! $option_key ) {
return;
}
// 2. Acciones de bloqueo (transient y opción persistente)
$duration = (int) ($options["duration_{$type}"] ?? 120) * 60;
$block_key = "advaipbl_bloqueo_{$type}_" . md5($ip);
set_transient($block_key, true, $duration);
$list = get_option($option_key, []);
if (!is_array($list)) $list = [];
$list[$ip] = ['timestamp' => time(), 'detail' => $trigger];
update_option($option_key, $list);
// 3. Obtener datos de geolocalización COMPLETOS
$location_data = $this->api_manager->fetch_location($ip);
$geo_details = [];
if ($location_data && empty($location_data['error'])) {
$geo_details['country'] = $location_data['country'] ?? null;
$geo_details['country_code'] = $location_data['country_code'] ?? null;
$geo_details['city'] = $location_data['city'] ?? null;
$geo_details['lat'] = $location_data['lat'] ?? null;
$geo_details['lon'] = $location_data['lon'] ?? null;
}
// 4. Lógica de email y logs
$notification_enabled = !empty($options['enable_email_notifications']) && '1' === $options['enable_email_notifications'];
$frequency = $options['notification_frequency'] ?? 'disabled';
$email_sent = null;
$reason = '';
switch ($type) {
case '404':
case '403':
$reason = sprintf(__("Generated %1\$d %2\$s errors. Triggering URL: %3\$s", 'advanced-ip-blocker'), $errors, strtoupper($type), $trigger);
break;
case 'login':
$reason = sprintf(__('Made %1$d failed login attempts for user: %2$s', 'advanced-ip-blocker'), $errors, $trigger);
break;
}
if ($notification_enabled && $frequency === 'instant') {
$site_name = get_bloginfo( 'name' );
$email_subject = sprintf(__('[%s] Security Alert: IP Automatically Blocked', 'advanced-ip-blocker'), $site_name);
$template_title = __('Security Alert: IP Blocked', 'advanced-ip-blocker');
$duration_text = sprintf(__('%d minutes', 'advanced-ip-blocker'), (int) ($options["duration_{$type}"] ?? 120));
$button_url = admin_url('admin.php?page=advaipbl_ip_management&sub-tab=blocked_ips');
$button_style = "background-color: #2271b1; color: #ffffff; padding: 12px 25px; text-decoration: none; border-radius: 4px; display: inline-block; font-weight: bold;";
$content_html =
'
' . esc_html__( "An IP address has been automatically blocked on your website.", 'advanced-ip-blocker' ) . '
display_dashboard_tab(); break;
case 'status': $this->display_status_tab(); break;
case 'general_settings': $this->display_general_settings_tab(); break;
case 'import_export': $this->render_import_export_controls_callback(); break;
case 'waf': $this->display_waf_tab(); break;
case 'user_agents': $this->display_user_agents_tab(); break;
case 'honeypot': $this->display_honeypot_tab(); break;
case 'asn_blocking': $this->display_asn_blocking_tab(); break;
case 'blocked_ips': $this->display_blocked_ips_tab(); break;
case 'whitelist': $this->display_whitelist_tab(); break;
case 'security_log': $this->display_security_log_tab(); break;
case 'general_log': $this->display_general_log_tab(); break;
case 'user_sessions': $this->session_manager->display_admin_page(); break;
case 'cron_logs': $this->display_cron_logs_tab(); break;
case 'credits': $this->display_credits_tab(); break;
default: echo '
';
}
/**
* Renders a dropdown to select the number of items per page.
*
* @param int $current_per_page The currently selected number of items per page.
*/
public function render_per_page_selector( $current_per_page ) {
$per_page_options = [ 20, 50, 100, 200 ];
?>
$column_key,
'order' => $next_order,
]);
$url = add_query_arg($url_params, admin_url('admin.php'));
echo '
display_log_table_generic($security_log_types);
}
/**
* Muestra la pestaña de logs generales (auditoría), restaurada a su formato original.
*/
private function display_general_log_tab() {
if (empty($this->options['enable_logging'])) {
echo '
' . esc_html__('General event logging is disabled in the "Settings" tab.', 'advanced-ip-blocker') . '
 . ')
 . ')
) . 'assets/img/logo-ligth.png'); ?>){kind=logo}