';
$cust_html_code .= $cap_form;
return $cust_html_code;
}
}
function insert_captcha_question_form_multi($error)
{
global $aio_wp_security;
$aio_wp_security->captcha_obj->display_captcha_form();
}
function process_signup_form_multi($result)
{
global $aio_wp_security;
//Check if captcha enabled
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if ( $verify_captcha === false ) {
// wrong answer was entered
$result['errors']->add('generic', __('ERROR: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'));
}
return $result;
}
function insert_captcha_question_form(){
global $aio_wp_security;
if($aio_wp_security->configs->get_value('aiowps_default_recaptcha')) {
// Woocommerce "my account" page needs special consideration, ie,
// need to display two Google reCaptcha forms on same page (for login and register forms)
// For this case we use the "explicit" recaptcha display
$calling_hook = current_filter();
$site_key = esc_html( $aio_wp_security->configs->get_value('aiowps_recaptcha_site_key') );
if ( $calling_hook == 'woocommerce_login_form' || $calling_hook == 'woocommerce_lostpassword_form') {
echo '
';
return;
}
// For all other forms simply display google recaptcha as per normal
$aio_wp_security->captcha_obj->display_recaptcha_form();
} else {
// display plain maths captcha form
$aio_wp_security->captcha_obj->display_captcha_form();
}
}
function insert_honeypot_hidden_field(){
$honey_input = '
';
$honey_input .= '
';
echo $honey_input;
}
function process_comment_post( $comment )
{
global $aio_wp_security;
if (is_user_logged_in()) {
return $comment;
}
//Don't process captcha for comment replies inside admin menu
if (isset( $_REQUEST['action'] ) && $_REQUEST['action'] == 'replyto-comment' &&
(check_ajax_referer('replyto-comment', '_ajax_nonce', false) || check_ajax_referer('replyto-comment', '_ajax_nonce-replyto-comment', false))) {
return $comment;
}
//Don't do captcha for pingback/trackback
if ($comment['comment_type'] != '' && $comment['comment_type'] != 'comment') {
return $comment;
}
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if($verify_captcha === false) {
//Wrong answer
wp_die( __('Error: You entered an incorrect CAPTCHA answer. Please go back and try again.', 'all-in-one-wp-security-and-firewall'));
} else {
return($comment);
}
}
/**
* Process the main Wordpress account lost password login form post
* Called by wp hook "lostpassword_post"
*/
function process_lost_password_form_post()
{
global $aio_wp_security;
// Workaround - the woocommerce lost password form also uses the same "lostpassword_post" hook.
// We don't want to process woo forms here so ignore if this is a woo lost password $_POST
if (!array_key_exists('woocommerce-lost-password-nonce', $_POST)) {
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if ( $verify_captcha === false ) {
add_filter('allow_password_reset', array(&$this, 'add_lostpassword_captcha_error_msg'));
}
}
}
function add_lostpassword_captcha_error_msg()
{
//Insert an error just before the password reset process kicks in
return new WP_Error('aiowps_captcha_error',__('ERROR: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'));
}
function check_404_event()
{
if(is_404()){
//This means a 404 event has occurred - let's log it!
AIOWPSecurity_Utility::event_logger('404');
}
}
function buddy_press_signup_validate_captcha($errors)
{
global $bp, $aio_wp_security;
//Check captcha if required
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if($verify_captcha === false) {
// wrong answer was entered
$bp->signup->errors['aiowps-captcha-answer'] = __('Your CAPTCHA answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall');
}
return;
}
function aiowps_validate_woo_login_with_captcha( $errors, $username, $password ) {
global $aio_wp_security;
$locked = $aio_wp_security->user_login_obj->check_locked_user();
if(!empty($locked)){
$errors->add('authentication_failed', __('ERROR: Your IP address is currently locked please contact the administrator!', 'all-in-one-wp-security-and-firewall'));
return $errors;
}
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if($verify_captcha === false) {
// wrong answer was entered
$errors->add('authentication_failed', __('ERROR: Your answer was incorrect - please try again.', 'all-in-one-wp-security-and-firewall'));
}
return $errors;
}
/**
* Process the woocommerce lost password login form post
* Called by wp hook "lostpassword_post"
*/
function process_woo_lost_password_form_post()
{
global $aio_wp_security;
if(isset($_POST['woocommerce-lost-password-nonce'])) {
$verify_captcha = $aio_wp_security->captcha_obj->verify_captcha_submit();
if ( $verify_captcha === false ) {
add_filter('allow_password_reset', array(&$this, 'add_lostpassword_captcha_error_msg'));
}
}
}
/**
* Displays a notice message if the plugin was reactivated after being initially deactivated
* Gives users option of re-applying the aiowps rules which were deleted from the .htaccess after deactivation.
*/
function reapply_htaccess_rules_notice()
{
if (get_option('aiowps_temp_configs') !== FALSE){
echo '
'.__('Would you like All In One WP Security & Firewall to re-insert the security rules in your .htaccess file which were cleared when you deactivated the plugin?', 'all-in-one-wp-security-and-firewall').' YesNo
';
}
}
//This is a fix for cases when the password reset URL in the email was not decoding all html entities properly
function decode_reset_pw_msg($message, $key, $user_login, $user_data)
{
global $aio_wp_security;
$message = html_entity_decode($message);
return $message;
}
function modify_registration_page_messages($errors, $redirect_to)
{
if( isset($_GET['checkemail']) && 'registered' == $_GET['checkemail'] ){
if(is_wp_error($errors)){
$errors->remove('registered');
$pending_approval_msg = __('Your registration is pending approval.', 'all-in-one-wp-security-and-firewall');
$pending_approval_msg = apply_filters('aiowps_pending_registration_message', $pending_approval_msg);
$errors->add('registered', $pending_approval_msg, array('registered'=>'message'));
}
}
return $errors;
}
/*
* Re-wrote code which checks for REST API requests
* Below uses the "rest_api_init" action hook to check for REST requests.
* The code will block "unauthorized" requests whilst allowing genuine requests.
* (P. Petreski June 2018)
*/
function check_rest_api_requests($rest_server_object){
$rest_user = wp_get_current_user();
if(empty($rest_user->ID)){
$error_message = apply_filters('aiowps_rest_api_error_message', __('You are not authorized to perform this action.', 'disable-wp-rest-api'));
wp_die($error_message);
}
}
/**
* Enqueues the Google recaptcha api URL in the wp_head for general pages
* Caters for scenarios when recaptcha used on wp comments or custom wp login form
*
*/
function add_recaptcha_script()
{
// Enqueue the recaptcha api url
// Do NOT enqueue if this is the main woocommerce account login page because for woocommerce page we "explicitly" render the recaptcha widget
$is_woo = false;
if ( function_exists('is_account_page') ) {
// Check if this a woocommerce account page
$is_woo = is_account_page();
}
if ( empty( $is_woo ) ) {
//only enqueue when not a woocommerce page
wp_enqueue_script( 'google-recaptcha', 'https://www.google.com/recaptcha/api.js', false );
}
}
}