PageRenderTime 111ms CodeModel.GetById 32ms RepoModel.GetById 0ms app.codeStats 1ms

/justjs/wp-content/plugins/askapache-password-protect/askapache-password-protect.php

https://github.com/jkreska/test1
PHP | 2269 lines | 1674 code | 346 blank | 249 comment | 352 complexity | ea848229c023828fc09bf41737fe970e MD5 | raw file
Possible License(s): GPL-2.0

Large files files are truncated, but you can click here to view the full file

    

  1. <?php

    2. 

  2. /*

    3. 

  3. Plugin Name: AskApache Password Protect

    4. 

  4. Plugin URI: http://www.askapache.com/htaccess/htaccess-security-block-spam-hackers.html

    5. 

  5. Description: Advanced Security: Password Protection, Anti-Spam, Anti-Exploits, more to come...

    6. 

  6. Version: 4.6.5.2

    7. 

  7. Author: AskApache

    8. 

  8. Author URI: http://www.askapache.com/

    9. 

  9. */

    10. 

  10. 

    11. 

  11. /**

    12. 

  12.  *   AskApache Password Protect WordPress Plugin for .htaccess Files

    13. 

  13.  * 	 Copyright (C) 2008  AskApache.comi

    14. 

  14.  *

    15. 

  15.  * 	 This program is free software: you can redistribute it and/or modify

    16. 

  16.  * 	 it under the terms of the GNU General Public License as published by

    17. 

  17.  * 	 the Free Software Foundation, either version 3 of the License, or

    18. 

  18.  * 	 (at your option) any later version.

    19. 

  19.  *

    20. 

  20.  * 	 This program is distributed in the hope that it will be useful,

    21. 

  21.  * 	 but WITHOUT ANY WARRANTY; without even the implied warranty of

    22. 

  22.  * 	 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

    23. 

  23.  * 	 GNU General Public License for more details.

    24. 

  24.  *

    25. 

  25.  * 	 You should have received a copy of the GNU General Public License

    26. 

  26.  * 	 along with this program.  If not, see <http://www.gnu.org/licenses/>.

    27. 

  27.  */

    28. 

  28. 

    29. 

  29. if ( defined( 'AA_PP_DEBUG' ) ) return;

    30. 

  30. 

    31. 

  31. // define( 'AA_PP_LOG_FILE', ABSPATH.'/askapache-passpro-log.txt' );  // set this to any file to log to

    32. 

  32. define( 'AA_PP_DEBUG', false ); // set this to 1 for verbose debugging

    33. 

  33. define( 'AA_PP_NET_DEBUG', false ); // set this to 1 for verbose network debugging

    34. 

  34. 

    35. 

  35. register_activation_hook( __FILE__, 'aa_pp_activate' );

    36. 

  36. register_deactivation_hook( __FILE__, 'aa_pp_deactivate' );

    37. 

  37. 

    38. 

  38. add_action( 'admin_menu', 'aa_pp_setup_options' );

    39. 

  39. 

    40. 

  40. if ( strpos( $_SERVER['REQUEST_URI'], basename( __FILE__ ) ) !== false ) add_action( 'admin_head', 'aa_pp_admin_header' );

    41. 

  41. 

    42. 

  42. if ( !defined('WP_CONTENT_DIR') ) define( 'WP_CONTENT_DIR', ABSPATH . 'wp-content' );

    43. 

  43. 

    44. 

  44. 

    45. 

  45. /**

    46. 

  46. * aa_pp_setup_options()

    47. 

  47.  *

    48. 

  48.  * @return

    49. 

  49.  */

    50. 

  50. function aa_pp_setup_options()

    51. 

  51. {

    52. 

  52. 	add_filter( 'plugin_action_links', 'aa_pp_plugin_settings', 10, 2 );

    53. 

  53. 	add_options_page( __( 'AskApache Password Protection', 'askapache-password-protection' ), __( 'AA PassPro', 'askapache-password-protection' ), 8, basename( __FILE__ ), 'aa_pp_main_page' );

    54. 

  54. }

    55. 

  55. 

    56. 

  56. 

    57. 

  57. 

    58. 

  58. /**

    59. 

  59. * aa_pp_plugin_settings()

    60. 

  60.  *

    61. 

  61.  * @param mixed $links

    62. 

  62.  * @param mixed $file

    63. 

  63.  * @return

    64. 

  64.  */

    65. 

  65. function aa_pp_plugin_settings( $links, $file )

    66. 

  66. {

    67. 

  67. 	static $this_plugin;

    68. 

  68. 	if ( !$this_plugin ) $this_plugin = plugin_basename( __FILE__ );

    69. 

  69. 	if ( $file == $this_plugin ) $links = array_merge( array( '<a href="' . attribute_escape( 'options-general.php?page=askapache-password-protect.php' ) . '">Settings</a>' ), $links );

    70. 

  70. 	return $links;

    71. 

  71. }

    72. 

  72. 

    73. 

  73. 

    74. 

  74. 

    75. 

  75. /**

    76. 

  76. * aa_pp_deactivate()

    77. 

  77.  *

    78. 

  78.  * @return

    79. 

  79.  */

    80. 

  80. function aa_pp_deactivate()

    81. 

  81. {

    82. 

  82. 	global $aa_PP, $aa_SIDS;

    83. 

  83. 	$aa_PP = get_option( 'askapache_password_protect' );

    84. 

  84. 	$aa_SIDS = get_option( 'askapache_password_protect_sids' );

    85. 

  85. 

    86. 

  86. 	aa_pp_deactivate_sid( 'PASSPRO', 'ASKAPACHE ', $aa_PP['root_htaccess'] );

    87. 

  87. 	aa_pp_deactivate_sid( 'PASSPRO', 'ASKAPACHE ', $aa_PP['admin_htaccess'] );

    88. 

  88. 

    89. 

  89. 	delete_option( 'askapache_password_protect' );

    90. 

  90. 	delete_option( 'askapache_password_protect_sids' );

    91. 

  91. }

    92. 

  92. 

    93. 

  93. 

    94. 

  94. 

    95. 

  95. /**

    96. 

  96. * aa_pp_activate()

    97. 

  97.  *

    98. 

  98.  * @return

    99. 

  99.  */

    100. 

  100. function aa_pp_activate()

    101. 

  101. {

    102. 

  102. 	global $wpdb, $aa_PP, $aa_SIDS;

    103. 

  103. 	$aa_PP = $s = $aa_SIDS = array();

    104. 

  104. 

    105. 

  105. 	foreach ( array( 'home_folder', 'wpadmin_folder', 'htpasswd_file', 'htaccess_file', 'original_htpasswd', 'original_htaccess', 'plugin_message', 'plugin_version', 'home', 'wpadmin', 'htpasswd_f', 'htaccess_f', 'user', 'plugin_message', 'home_folder', 'wpadmin_folder', 'htpasswd_file', 'htaccess_file', 'original_htpasswd', 'original_htaccess', 'plugin_message', 'plugin_version', 'pp_docroot_htaccess', 'pp_wp_includes_htaccess', 'pp_wp_content_htaccess', 'pp_wp_includes_htaccess', 'pp_main_base64', 'pp_ok' ) as $option )	delete_option( 'aa_'.$option );

    106. 

  106. 

    107. 

  107. 	$home = get_option( 'siteurl' );

    108. 

  108. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "home: $home" );

    109. 

  109. 	$su = parse_url( $home );

    110. 

  110. 	$path = ( !isset( $su['path'] ) || empty( $su['path'] ) ) ? '/' : rtrim( $su['path'], '/' ) . '/';

    111. 

  111. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "path: $path" );

    112. 

  112. 	$scheme = ( isset( $_SERVER['HTTPS'] ) && strtolower( $_SERVER['HTTPS'] ) == 'on' && $su['scheme'] == 'https' ) ? 'https' : 'http';

    113. 

  113. 	$home_path = rtrim( get_home_path(), '/' ) . '/';

    114. 

  114. 	$hu = str_replace( $scheme . '://', '', $home );

    115. 

  115. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "hu: $hu" );

    116. 

  116. 	$url = $scheme . '://' . rtrim( str_replace( rtrim( $path, '/' ), '', $hu ), '/' );

    117. 

  117. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "url: $url" );

    118. 

  118. 	$authdomain = "/ {$url}/";

    119. 

  119. 

    120. 

  120. 	update_option( 'askapache_password_protect', array( 

    121. 

  121. 			'step' => 'welcome',

    122. 

  122. 			'setup_complete' => 0,

    123. 

  123. 			'scheme' => $scheme,

    124. 

  124. 			'host' => $su['host'],

    125. 

  125. 			'root_path' => $path,

    126. 

  126. 			'home_path' => $home_path,

    127. 

  127. 			'test_dir' => WP_CONTENT_DIR.'/askapache',

    128. 

  128. 			'root_htaccess' => $home_path . '.htaccess',

    129. 

  129. 			'admin_htaccess' => $home_path . 'wp-admin/.htaccess',

    130. 

  130. 			'admin_mail' => get_option( 'admin_email' ),

    131. 

  131. 			'authdomain' => $authdomain,

    132. 

  132. 			'authname' => 'Protected By AskApache',

    133. 

  133. 			'authuserfile' => $home_path . '.htpasswda3',

    134. 

  134. 			'authuserdigest' => 'AuthDigestFile',

    135. 

  135. 			'algorithm' => 'md5',

    136. 

  136. 			'key' => wp_hash_password( wp_generate_password() ),

    137. 

  137. 			'htaccess_support' => 0,

    138. 

  138. 			'mod_alias_support' => 0,

    139. 

  139. 			'mod_rewrite_support' => 0,

    140. 

  140. 			'mod_security_support' => 0,

    141. 

  141. 			'mod_auth_digest_support' => 0,

    142. 

  142. 			'basic_support' => 0,

    143. 

  143. 			'digest_support' => 0,

    144. 

  144. 			'crypt_support' => 0,

    145. 

  145. 			'sha1_support' => 0,

    146. 

  146. 			'md5_support' => 0,

    147. 

  147. 			'revision_support' => 0,

    148. 

  148. 			'apache_version' => '',

    149. 

  149. 			'revisions' => array(),

    150. 

  150. 			'plugin_data' => get_plugin_data( __FILE__ ),

    151. 

  151. 			) );

    152. 

  152. 			

    153. 

  153. 	update_option( 'askapache_password_protect_sids', array( 

    154. 

  154. 			60000001 => array( 'Version' => '1.3',

    155. 

  155. 				'Name' => 'Directory Protection',

    156. 

  156. 				'Description' => 'Enable the DirectoryIndex Protection, preventing directory index listings and defaulting.',

    157. 

  157. 				'Rules' =>

    158. 

  158. 				'Options -Indexes%n%' . 

    159. 

  159. 				'DirectoryIndex index.html index.php %relative_root%index.php'

    160. 

  160. 				),

    161. 

  161. 

    162. 

  162. 			60000002 => array( 'Version' => '1.0',

    163. 

  163. 				'Name' => 'Loop Stopping Code',

    164. 

  164. 				'Description' => 'Stops Internal Redirect Loops',

    165. 

  165. 				'Rules' =>

    166. 

  166. 				'RewriteCond %{ENV:REDIRECT_STATUS} 200%n%' . 

    167. 

  167. 				'RewriteRule .* - [L]%n%'

    168. 

  168. 				),

    169. 

  169. 

    170. 

  170. 			10140001 => array( 'Version' => '1.1',

    171. 

  171. 				'Name' => 'Stop Hotlinking',

    172. 

  172. 				'Description' => 'Denies any request for static files (images, css, etc) if referrer is not local site or empty.',

    173. 

  173. 				'Rules' =>

    174. 

  174. 				'RewriteCond %{HTTP_REFERER} !^$%n%' . 

    175. 

  175. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    176. 

  176. 				'RewriteCond %{HTTP_REFERER} !^%scheme%://%host%.*$ [NC]%n%' . 

    177. 

  177. 				'RewriteRule \.(ico|pdf|flv|jpg|jpeg|mp3|mpg|mp4|mov|wav|wmv|png|gif|swf|css|js)$ - [F,NS,L]'

    178. 

  178. 				),

    179. 

  179. 

    180. 

  180. 			20030001 => array( 'Version' => '1.3',

    181. 

  181. 				'Name' => 'Password Protect wp-login.php',

    182. 

  182. 				'Description' => 'Requires a valid user/pass to access the login page..',

    183. 

  183. 				'Rules' =>

    184. 

  184. 				'<Files wp-login.php>%n%' . 

    185. 

  185. 				'Satisfy Any%n%' . 

    186. 

  186. 				'%generate_auth%%n%' . 

    187. 

  187. 				'</Files>'

    188. 

  188. 				),

    189. 

  189. 

    190. 

  190. 			21030002 => array( 'Version' => '1.3',

    191. 

  191. 				'Name' => 'Password Protect wp-admin',

    192. 

  192. 				'Description' => 'Requires a valid user/pass to access any non-static (css, js, images) file in this directory...',

    193. 

  193. 				'Rules' =>

    194. 

  194. 				'%generate_auth%%n%' . 

    195. 

  195. 				'<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|mp3|mpg|mp4|mov|wav|wmv|png|gif|swf|css|js)$">%n%' . 

    196. 

  196. 				'Allow from All%n%' . 

    197. 

  197. 				'</FilesMatch>%n%' . 

    198. 

  198. 				'<FilesMatch "(async-upload|admin-ajax)\.php$">%n%' . 

    199. 

  199. 				'<IfModule mod_security.c>%n%' . 

    200. 

  200. 				'SecFilterEngine Off%n%' . 

    201. 

  201. 				'</IfModule>%n%' . 

    202. 

  202. 				'Allow from All%n%' . 

    203. 

  203. 				'</FilesMatch>'

    204. 

  204. 				),

    205. 

  205. 

    206. 

  206. 			30140003 => array( 'Version' => '1.1',

    207. 

  207. 				'Name' => 'Forbid Proxies',

    208. 

  208. 				'Description' => 'Denies POST Request using a Proxy Server. Can access site, but not comment. See <a href="http://perishablepress.com/press/2008/04/20/how-to-block-proxy-servers-via-htaccess/">Perishable Press</a>',

    209. 

  209. 				'Rules' =>

    210. 

  210. 				'RewriteCond %{HTTP:VIA}%{HTTP:FORWARDED}%{HTTP:USERAGENT_VIA}%{HTTP:X_FORWARDED_FOR}%{HTTP:PROXY_CONNECTION} !^$ [OR]%n%' . 

    211. 

  211. 				'RewriteCond %{HTTP:XPROXY_CONNECTION}%{HTTP:HTTP_PC_REMOTE_ADDR}%{HTTP:HTTP_CLIENT_IP} !^$%n%' . 

    212. 

  212. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    213. 

  213. 				'RewriteCond %{REQUEST_METHOD} =POST%n%' . 

    214. 

  214. 				'RewriteRule .* - [F,NS,L]'

    215. 

  215. 				),

    216. 

  216. 

    217. 

  217. 			30140004 => array( 'Version' => '1.1',

    218. 

  218. 				'Name' => 'Real wp-comments-post.php',

    219. 

  219. 				'Description' => 'Denies any POST attempt made to a non-existing wp-comments-post.php..',

    220. 

  220. 				'Rules' =>

    221. 

  221. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ %relative_root%.*/wp-comments-post\.php.*\ HTTP/ [NC]%n%' . 

    222. 

  222. 				'RewriteRule .* - [F,NS,L]'

    223. 

  223. 				),

    224. 

  224. 

    225. 

  225. 			30140005 => array( 'Version' => '1.1',

    226. 

  226. 				'Name' => 'BAD Content Length',

    227. 

  227. 				'Description' => 'Denies any POST request that doesnt have a Content-Length Header..',

    228. 

  228. 				'Rules' =>

    229. 

  229. 				'RewriteCond %{REQUEST_METHOD} =POST%n%' . 

    230. 

  230. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    231. 

  231. 				'RewriteCond %{HTTP:Content-Length} ^$%n%' . 

    232. 

  232. 				'RewriteRule .* - [F,NS,L]'

    233. 

  233. 				),

    234. 

  234. 

    235. 

  235. 			30140006 => array( 'Version' => '1.1',

    236. 

  236. 				'Name' => 'BAD Content Type',

    237. 

  237. 				'Description' => 'Denies any POST request with a content type other than application/x-www-form-urlencoded|multipart/form-data..',

    238. 

  238. 				'Rules' =>

    239. 

  239. 				'RewriteCond %{REQUEST_METHOD} =POST%n%' . 

    240. 

  240. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    241. 

  241. 				'RewriteCond %{HTTP:Content-Type} !^(application/x-www-form-urlencoded|multipart/form-data.*(boundary.*)?)$ [NC]%n%' . 

    242. 

  242. 				'RewriteRule .* - [F,NS,L]'

    243. 

  243. 				),

    244. 

  244. 

    245. 

  245. 			30140007 => array( 'Version' => '1.1',

    246. 

  246. 				'Name' => 'NO HOST:',

    247. 

  247. 				'Description' => 'Denies requests that dont contain a HTTP HOST Header...',

    248. 

  248. 				'Rules' =>

    249. 

  249. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    250. 

  250. 				'RewriteCond %{HTTP_HOST} ^$%n%' . 

    251. 

  251. 				'RewriteRule .* - [F,NS,L]'

    252. 

  252. 				),

    253. 

  253. 

    254. 

  254. 			30140008 => array( 'Version' => '1.1',

    255. 

  255. 				'Name' => 'No UserAgent, No Post',

    256. 

  256. 				'Description' => 'Denies POST requests by blank user-agents. May prevent a small number of visitors from POSTING.',

    257. 

  257. 				'Rules' =>

    258. 

  258. 				'RewriteCond %{REQUEST_METHOD} =POST%n%' . 

    259. 

  259. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    260. 

  260. 				'RewriteCond %{HTTP_USER_AGENT} ^-?$%n%' . 

    261. 

  261. 				'RewriteRule .* - [F,NS,L]'

    262. 

  262. 				),

    263. 

  263. 

    264. 

  264. 			30140009 => array( 'Version' => '1.1',

    265. 

  265. 				'Name' => 'No Referer, No Comment',

    266. 

  266. 				'Description' => 'Denies any comment attempt with a blank HTTP_REFERER field, highly indicative of spam. May prevent some visitors from POSTING.',

    267. 

  267. 				'Rules' =>

    268. 

  268. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*/wp-comments-post\.php.*\ HTTP/ [NC]%n%' . 

    269. 

  269. 				'RewriteCond %{HTTP_REFERER} ^-?$%n%' . 

    270. 

  270. 				'RewriteRule .* - [F,NS,L]'

    271. 

  271. 				),

    272. 

  272. 

    273. 

  273. 			30140010 => array( 'Version' => '1.1',

    274. 

  274. 				'Name' => 'Trackback Spam',

    275. 

  275. 				'Description' => 'Denies obvious trackback spam.  See <a href="http://ocaoimh.ie/2008/07/03/more-ways-to-stop-spammers-and-unwanted-traffic/">Holy Shmoly!</a>',

    276. 

  276. 				'Rules' =>

    277. 

  277. 				'RewriteCond %{HTTP_USER_AGENT} ^.*(opera|mozilla|firefox|msie|safari).*$ [NC,OR]%n%' . 

    278. 

  278. 				'RewriteCond %{HTTP_USER_AGENT} ^-?$%n%' . 

    279. 

  279. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.+/trackback/?\ HTTP/ [NC]%n%' . 

    280. 

  280. 				'RewriteCond %{REQUEST_METHOD} =POST%n%' . 

    281. 

  281. 				'RewriteRule .* - [F,NS,L]'

    282. 

  282. 				),

    283. 

  283. 

    284. 

  284. 			40140011 => array( 'Version' => '1.2',

    285. 

  285. 				'Name' => 'Protect wp-content',

    286. 

  286. 				'Description' => 'Denies any Direct request for files ending in .php with a 403 Forbidden.. May break plugins/themes',

    287. 

  287. 				'Rules' =>

    288. 

  288. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ %relative_root%wp-content/.*$ [NC]%n%' . 

    289. 

  289. 				'RewriteCond %{REQUEST_FILENAME} !^.+(flexible-upload-wp25js|media)\.php$%n%' . 

    290. 

  290. 				'RewriteCond %{REQUEST_FILENAME} ^.+\.(php|html|htm|txt)$%n%' . 

    291. 

  291. 				'RewriteRule .* - [F,NS,L]'

    292. 

  292. 				),

    293. 

  293. 

    294. 

  294. 			40140012 => array( 'Version' => '1.2',

    295. 

  295. 				'Name' => 'Protect wp-includes',

    296. 

  296. 				'Description' => 'Denies any Direct request for files ending in .php with a 403 Forbidden.. May break plugins/themes',

    297. 

  297. 				'Rules' =>

    298. 

  298. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ %relative_root%wp-includes/.*$ [NC]%n%' . 

    299. 

  299. 				'RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ %relative_root%wp-includes/js/.+/.+\ HTTP/ [NC]%n%' . 

    300. 

  300. 				'RewriteCond %{REQUEST_FILENAME} ^.+\.php$%n%' . 

    301. 

  301. 				'RewriteRule .* - [F,NS,L]'

    302. 

  302. 				),

    303. 

  303. 

    304. 

  304. 			40140013 => array( 'Version' => '1.1',

    305. 

  305. 				'Name' => 'Common Exploit',

    306. 

  306. 				'Description' => 'Block common exploit requests with 403 Forbidden. These can help alot, may break some plugins.',

    307. 

  307. 				'Rules' =>

    308. 

  308. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    309. 

  309. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ ///.*\ HTTP/ [NC,OR]%n%' . 

    310. 

  310. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.+\?\=?(http|ftp|ssl|https):/.*\ HTTP/ [NC,OR]%n%' . 

    311. 

  311. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\?\?.*\ HTTP/ [NC,OR]%n%' . 

    312. 

  312. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\.(asp|ini|dll).*\ HTTP/ [NC,OR]%n%' . 

    313. 

  313. 				'RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\.(htpasswd|htaccess|aahtpasswd).*\ HTTP/ [NC]%n%' . 

    314. 

  314. 				'RewriteRule .* - [F,NS,L]'

    315. 

  315. 				),

    316. 

  316. 

    317. 

  317. 			50140001 => array( 'Version' => '1.1',

    318. 

  318. 				'Name' => 'Safe Request Methods',

    319. 

  319. 				'Description' => 'Denies any request not using <a href="/online-tools/request-method-scanner/">GET,PROPFIND,POST,OPTIONS,PUT,HEAD</a>..',

    320. 

  320. 				'Rules' =>

    321. 

  321. 				'RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST|PROPFIND|OPTIONS|PUT)$ [NC]%n%' . 

    322. 

  322. 				'RewriteRule .* - [F,NS,L]'

    323. 

  323. 				),

    324. 

  324. 

    325. 

  325. 			50140002 => array( 'Version' => '1.1',

    326. 

  326. 				'Name' => 'HTTP PROTOCOL',

    327. 

  327. 				'Description' => 'Denies any badly formed HTTP PROTOCOL in the request, 0.9, 1.0, and 1.1 only..',

    328. 

  328. 				'Rules' =>

    329. 

  329. 				'RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ .+\ HTTP/(0\.9|1\.0|1\.1) [NC]%n%' . 

    330. 

  330. 				'RewriteRule .* - [F,NS,L]'

    331. 

  331. 				),

    332. 

  332. 

    333. 

  333. 			50140003 => array( 'Version' => '1.1',

    334. 

  334. 				'Name' => 'SPECIFIC CHARACTERS',

    335. 

  335. 				'Description' => 'Denies any request for a url containing characters other than "a-zA-Z0-9.+/-?=&" - REALLY helps but may break your site depending on your links.',

    336. 

  336. 				'Rules' =>

    337. 

  337. 				'RewriteCond %{REQUEST_URI} !^%relative_root%(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]%n%' . 

    338. 

  338. 				'RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [A-Z0-9\.\+_/\-\?\=\&\%\#]+\ HTTP/ [NC]%n%' . 

    339. 

  339. 				'RewriteRule .* - [F,NS,L]'

    340. 

  340. 				),

    341. 

  341. 

    342. 

  342. 			50140004 => array( 'Version' => '1.1',

    343. 

  343. 				'Name' => 'Directory Traversal',

    344. 

  344. 				'Description' => 'Denies Requests containing ../ or ./. which is a directory traversal exploit attempt..',

    345. 

  345. 				'Rules' =>

    346. 

  346. 				'RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ .*([\.]+[\.]+).*\ HTTP/ [NC]%n%' . 

    347. 

  347. 				'RewriteRule .* - [F,NS,L]'

    348. 

  348. 				),

    349. 

  349. 

    350. 

  350. 			50140005 => array( 'Version' => '1.1',

    351. 

  351. 				'Name' => 'PHPSESSID Cookie',

    352. 

  352. 				'Description' => 'Only blocks when a PHPSESSID cookie is sent by the user and it contains characters other than 0-9a-z..',

    353. 

  353. 				'Rules' =>

    354. 

  354. 				'RewriteCond %{HTTP_COOKIE} ^.*PHPSESS?ID.*$%n%' . 

    355. 

  355. 				'RewriteCond %{HTTP_COOKIE} !^.*PHPSESS?ID=([0-9a-z]+);.*$%n%' . 

    356. 

  356. 				'RewriteRule .* - [F,NS,L]'

    357. 

  357. 				),

    358. 

  358. 

    359. 

  359. 			50140006 => array( 'Version' => '1.1',

    360. 

  360. 				'Name' => 'Bogus Graphics Exploit',

    361. 

  361. 				'Description' => 'Denies obvious exploit using bogus graphics..',

    362. 

  362. 				'Rules' =>

    363. 

  363. 				'RewriteCond %{HTTP:Content-Disposition} \.php [NC]%n%' . 

    364. 

  364. 				'RewriteCond %{HTTP:Content-Type} image/.+ [NC]%n%' . 

    365. 

  365. 				'RewriteRule .* - [F,NS,L]' )

    366. 

  366. 			)

    367. 

  367. 		);

    368. 

  368. 

    369. 

  369. 	$aa_SIDS = get_option( 'askapache_password_protect_sids' );

    370. 

  370. 	$sids = array_keys( $aa_SIDS );

    371. 

  371. 	foreach ( $sids as $sid )

    372. 

  372. 	{

    373. 

  373. 		$newinfo = aa_pp_sid_info( $sid );

    374. 

  374. 		$aa_SIDS[$sid] = array_merge( $aa_SIDS[$sid], $newinfo );

    375. 

  375. 	}

    376. 

  376. 

    377. 

  377. 	update_option( 'askapache_password_protect_sids', $aa_SIDS );

    378. 

  378. }

    379. 

  379. 

    380. 

  380. 

    381. 

  381. 

    382. 

  382. /**

    383. 

  383. * aa_pp_admin_header()

    384. 

  384.  *

    385. 

  385.  * @return

    386. 

  386.  */

    387. 

  387. function aa_pp_admin_header()

    388. 

  388. {

    389. 

  389. 	global $wpdb, $aa_PP, $aa_SIDS;

    390. 

  390. 

    391. 

  391. 	if ( !user_can_access_admin_page() ) wp_die( __( 'You do not have sufficient permissions to access this page.' ) );

    392. 

  392. 	if ( !current_user_can( 8 ) )wp_die( __( "You are not allowed to be here without upload permissions" ) );

    393. 

  393. 

    394. 

  394. 	$aa_PP = get_option( 'askapache_password_protect' );

    395. 

  395. 	$aa_SIDS = get_option( 'askapache_password_protect_sids' );

    396. 

  396. 

    397. 

  397. 	@set_time_limit( 60 );

    398. 

  398. 	@set_magic_quotes_runtime( 0 );

    399. 

  399. }

    400. 

  400. 

    401. 

  401. 

    402. 

  402. 

    403. 

  403. /**

    404. 

  404. * aa_pp_get_post_values()

    405. 

  405.  *

    406. 

  406.  * @param mixed $v

    407. 

  407.  * @return

    408. 

  408.  */

    409. 

  409. function aa_pp_get_post_values( $v )

    410. 

  410. {

    411. 

  411. 	global $aa_PP, $aa_SIDS;

    412. 

  412. 	$errors = new WP_Error;

    413. 

  413. 

    414. 

  414. 	$action = 'none';

    415. 

  415. 	foreach( array( 'a_htaccess_support', 'a_mod_alias_support', 'a_mod_rewrite_support', 'a_mod_security_support', 'a_mod_auth_digest_support', 'a_digest_support', 'a_basic_support' ) as $k )

    416. 

  416. 	{

    417. 

  417. 		if ( isset( $_POST[$k] ) && $v[$k] != 1 )

    418. 

  418. 		{

    419. 

  419. 			check_admin_referer( 'askapache-passpro-form' );

    420. 

  420. 			$v[substr( $k, 2 )] = 1;

    421. 

  421. 		}

    422. 

  422. 	}

    423. 

  423. 

    424. 

  424. 	foreach( array( 'a_user', 'a_authdomain', 'a_authtype', 'a_algorithm', 'a_authname', 'a_authuserfile', 'a_step', 'a_admin_email', 'a_root_htaccess', ) as $k )

    425. 

  425. 	{

    426. 

  426. 		if ( isset( $_POST[$k] ) && !empty( $_POST[$k] ) && $_POST[$k] != $v[$k] )

    427. 

  427. 		{

    428. 

  428. 			check_admin_referer( 'askapache-passpro-form' );

    429. 

  429. 			$v[substr( $k, 2 )] = $_POST[$k];

    430. 

  430. 		}

    431. 

  431. 	}

    432. 

  432. 

    433. 

  433. 	foreach ( array( 'activate-selected', 'deactivate-selected', 'delete-selected', 'm_move' ) as $action_key )

    434. 

  434. 	{

    435. 

  435. 		if ( isset( $_POST[$action_key] ) )

    436. 

  436. 		{

    437. 

  437. 			aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "Setting action to {$action_key}" );

    438. 

  438. 			$action = $action_key;

    439. 

  439. 			break;

    440. 

  440. 		}

    441. 

  441. 	}

    442. 

  442. 

    443. 

  443. 	if ( $action == 'm_move' )

    444. 

  444. 	{

    445. 

  445. 		check_admin_referer( 'askapache-move-area' );

    446. 

  446. 		foreach( array( 'm_read', 'm_reset', 'm_sid', 'm_setup', 'm_test', 'm_welcome', 'm_contact' ) as $where )

    447. 

  447. 		{

    448. 

  448. 			if ( isset( $_POST[$where] ) )

    449. 

  449. 			{

    450. 

  450. 				$aa_PP['step'] = substr( $where, 2 );

    451. 

  451. 				aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "Setting step to {$aa_PP['step']}" );

    452. 

  452. 				break;

    453. 

  453. 			}

    454. 

  454. 		}

    455. 

  455. 		return true;

    456. 

  456. 	}

    457. 

  457. 

    458. 

  458. 	foreach ( array( 'deactivate-sid', 'activate-sid', 'view-revision', 'activate-revision', 'delete-revision' ) as $ak )

    459. 

  459. 	{

    460. 

  460. 		if ( isset( $_GET[$ak] ) )

    461. 

  461. 		{

    462. 

  462. 			$action = $ak;

    463. 

  463. 			break;

    464. 

  464. 		}

    465. 

  465. 	}

    466. 

  466. 

    467. 

  467. 	if ( isset( $_POST['a_pass1'] ) && isset( $_POST['a_pass2'] ) )

    468. 

  468. 	{

    469. 

  469. 		if ( empty( $_POST['a_pass1'] ) || empty( $_POST['a_pass2'] ) )$errors->add( 'password-required', __( '<strong>ERROR</strong>: A password is required' ) );

    470. 

  470. 		if ( $_POST['a_pass1'] != $_POST['a_pass2'] )$errors->add( 'passwords-notsame', __( '<strong>ERROR</strong>: The passwords do not match.' ) );

    471. 

  471. 		else $pass = $_POST['a_pass1'];

    472. 

  472. 	}

    473. 

  473. 

    474. 

  474. 	if ( isset( $_POST['a_user'] ) && isset( $_POST['a_admin_email'] ) )

    475. 

  475. 	{

    476. 

  476. 		if ( empty( $_POST['a_user'] ) )$errors->add( 'username-required', __( '<strong>ERROR</strong>: A username is required.' ) );

    477. 

  477. 		if ( empty( $_POST['a_admin_email'] ) )$errors->add( 'adminemail-required', __( '<strong>ERROR</strong>: An admin email is required.' ) );

    478. 

  478. 		if ( !is_email( $_POST['a_admin_email'] ) )$errors->add( 'adminemail-bad', __( '<strong>ERROR</strong>: A valid admin email is required.' ) );

    479. 

  479. 	}

    480. 

  480. 

    481. 

  481. 	if ( isset( $v['authtype'] ) && !in_array( $v['authtype'], array( 'Digest', 'Basic' ) ) ) $errors->add( 'bad-authtype', __( '<strong>ERROR</strong>: Incorrect authtype' ) );

    482. 

  482. 

    483. 

  483. 	if ( isset( $v['algorithm'] ) && !in_array( $v['algorithm'], array( 'crypt', 'md5', 'sha1' ) ) ) $errors->add( 'bad-algorithm', __( '<strong>ERROR</strong>: Incorrect algorithm' ) );

    484. 

  484. 

    485. 

  485. 	if ( isset($v['user']) && strpos( $v['user'], ':' ) !== false ) $errors->add( 'bad-username', __( '<strong>ERROR</strong>: Username cannot contain the : character' ) );

    486. 

  486. 

    487. 

  487. 	if ( isset($v['authname']) && strlen( $v['authname'] ) > 65 ) $errors->add( 'bad-authname', __( '<strong>ERROR</strong>: Authname cannot exceed 65 characters, yours was ' . strlen( $v['authname'] ) . ' characters' ) );

    488. 

  488. 

    489. 

  489. 	if ( isset($v['authtype']) && $v['authtype'] == 'Digest' && $v['algorithm'] != 'md5' ) $errors->add( 'algorithm-authtype-mismatch', __( '<strong>ERROR</strong>: Digest Authentication can only use the md5 algorithm' ) );

    490. 

  490. 

    491. 

  491. 	foreach( array( $v['authuserfile'], $v['admin_htaccess'], $v['root_htaccess'] ) as $f )

    492. 

  492. 	{

    493. 

  493. 		if ( strpos( basename( $f ), '.ht' ) === false ) $errors->add( 'bad-authuserfilename', __( '<strong>ERROR</strong>: File names must start with .ht like .htaccess or .htpasswd-new3' ) );

    494. 

  494. 		if ( (int)$v['setup_complete'] != 0 )

    495. 

  495. 		{

    496. 

  496. 			if ( aa_pp_htaccess_file_init() && !@touch($f) || !@is_writable( $f ) ) $errors->add( 'unwritable-file', __( '<strong>ERROR</strong>: Please make ' . $f . ' writable and readable' ) );

    497. 

  497. 		}

    498. 

  498. 	}

    499. 

  499. 

    500. 

  500. 	if ( count( $errors->errors ) == 0 )

    501. 

  501. 	{

    502. 

  502. 		$aa_PP = $v;

    503. 

  503. 

    504. 

  504. 		switch ( $action )

    505. 

  505. 		{

    506. 

  506. 			case 'activate-revision':

    507. 

  507. 				$file = $_GET['activate-revision'];

    508. 

  508. 				check_admin_referer( 'activate-revision_' . $file );

    509. 

  509. 				break;

    510. 

  510. 			case 'view-revision':

    511. 

  511. 				$file = $_GET['view-revision'];

    512. 

  512. 				check_admin_referer( 'view-revision_' . $file );

    513. 

  513. 				break;

    514. 

  514. 			case 'delete-revision':

    515. 

  515. 				$file = $_GET['delete-revision'];

    516. 

  516. 				check_admin_referer( 'delete-revision_' . $file );

    517. 

  517. 				$g = array();

    518. 

  518. 				foreach( $aa_PP['revisions'] as $item )if ( $item['id'] != $file )$g[] = $item;

    519. 

  519. 				$v['revisions'] = $g;

    520. 

  520. 				break;

    521. 

  521. 			case 'activate-sid':

    522. 

  522. 				$sid = ( int )$_GET['activate-sid'];

    523. 

  523. 				check_admin_referer( 'activate-sid_' . $sid );

    524. 

  524. 				if ( !aa_pp_activate_sid( $sid ) ) $errors->add( 'sid-activation-failed', __( "Failed to activate sid {$sid}" ) );

    525. 

  525. 				echo '<img src="askapache-reset.bmp?' . rand( 1, 1000 ) . '" style="width:1px;height:1px;" />';

    526. 

  526. 				break;

    527. 

  527. 			case 'deactivate-sid':

    528. 

  528. 				$sid = ( int )$_GET['deactivate-sid'];

    529. 

  529. 				check_admin_referer( 'deactivate-sid_' . $sid );

    530. 

  530. 				if ( !aa_pp_deactivate_sid( $sid ) ) $errors->add( 'sid-deactivation-failed', __( "Failed to deactivate sid {$sid}" ) );

    531. 

  531. 				break;

    532. 

  532. 			case 'activate-selected':

    533. 

  533. 			case 'deactivate-selected':

    534. 

  534. 				check_admin_referer( 'askapache-bulk-sids' );

    535. 

  535. 				break;

    536. 

  536. 		}

    537. 

  537. 

    538. 

  538. 		if ( isset( $pass ) && count( $errors->errors ) == 0 )

    539. 

  539. 		{

    540. 

  540. 			$message_headers = 'From: "' . $blog_title . '" <wordpress@' . str_replace( 'www.', '', $aa_PP['host'] ) . '>';

    541. 

  541. 			$message = sprintf( __( "Your new username and password has been successfully set up at:\n\n%1\$s\n\nYou can log in to the administrator area with the following information:\n\n\nUsername: %2\$s\nPassword: %3\$s\n\nWe hope you enjoy your new protection. Thanks!\n\n--The AskApache Team\nhttp://www.askapache.com/" ), get_option( 'siteurl' ) . '/wp-admin/', $v['user'], $pass );

    542. 

  542. 

    543. 

  543. 			if ( !aa_pp_file_put_c( $v['authuserfile'], aa_pp_hashit( $v['authtype'], $v['user'], $pass, $v['authname'] ), false ) )

    544. 

  544. 				$errors->add( 'failed-create-authuserfile', __( '<strong>ERROR</strong>: Failed to create ' . $v['authuserfile'] ) );

    545. 

  545. 				

    546. 

  546. 			else if ( !wp_mail( $aa_PP['admin_email'], __( '__New AskApache User' ), $message, $message_headers ) )

    547. 

  547. 				$errors->add( 'failed-wp-mail', __( '<strong>ERROR</strong>: Failed to mail to ' . $aa_PP['admin_email'] ) );

    548. 

  548. 		}

    549. 

  549. 	}

    550. 

  550. 

    551. 

  551. 	if ( count( $errors->errors ) > 0 ) $v['step'] = $aa_PP['step'];

    552. 

  552. 

    553. 

  553. 	if ( $v['step'] == 'sid' && (int)$v['setup_complete'] != 1 )$v['setup_complete'] = 1;

    554. 

  554. 

    555. 

  555. 	$aa_PP = $v;

    556. 

  556. 

    557. 

  557. 	if ( count( $errors->errors ) > 0 ) return $errors;

    558. 

  558. 	else return true;

    559. 

  559. }

    560. 

  560. 

    561. 

  561. 

    562. 

  562. 

    563. 

  563. /**

    564. 

  564. * aa_pp_main_page()

    565. 

  565.  *

    566. 

  566.  * @return

    567. 

  567.  */

    568. 

  568. function aa_pp_main_page()

    569. 

  569. {

    570. 

  570. 	global $aa_PP, $aa_SIDS;

    571. 

  571. 	

    572. 

  572. 	$aa_PP = get_option( 'askapache_password_protect' );

    573. 

  573. 	$aa_SIDS = get_option( 'askapache_password_protect_sids' );

    574. 

  574. 

    575. 

  575. 	?>

    576. 

  576. <form method="post" action="options-general.php?page=askapache-password-protect.php"><?php wp_nonce_field( 'askapache-move-area' );

    577. 

  577. 	?>

    578. 

  578. <div class="tablenav">

    579. 

  579. <div class="alignleft">

    580. 

  580. <?php if ( $aa_PP['setup_complete'] != 0 )	{?>

    581. 

  581. <input type="submit" name="m_test" id="m_test" value="Self-Diagnostics" class="button-secondary" />

    582. 

  582. <input type="submit" name="m_read" id="m_read" value="Htaccess Files" class="button-secondary" />

    583. 

  583. <input type="submit" name="m_setup" id="m_setup" value="Password Configuration" class="button-secondary" />

    584. 

  584. <input type="submit" name="m_sid" id="m_sid" value="SID Module Management" class="button-secondary" />

    585. 

  585. <input type="submit" name="m_contact" id="m_contact" value="Improvements" class="button-secondary" />

    586. 

  586. <input type="hidden" name="m_move" id="m_move" value="m_move" />

    587. 

  587. <?php } ?>

    588. 

  588. </div>

    589. 

  589. <p style="float:right; margin-top:0;padding-top:0;"><a href="http://www.askapache.com/htaccess/apache-htaccess.html">AskApache .htaccess Tutorial</a></p>

    590. 

  590. </div>

    591. 

  591. <br class="clear" />

    592. 

  592. </form>

    593. 

  593. <?php

    594. 

  594. 

    595. 

  595. 	$errors = aa_pp_get_post_values( $aa_PP );

    596. 

  596. 	aa_pp_errors( $errors );

    597. 

  597. 

    598. 

  598. 	if ( (int)$aa_PP['setup_complete'] != 0 )

    599. 

  599. 	{

    600. 

  600. 		$errors = aa_pp_update_revisions( $aa_PP['admin_htaccess'] );

    601. 

  601. 		aa_pp_errors( $errors );

    602. 

  602. 

    603. 

  603. 		$errors = aa_pp_update_revisions( $aa_PP['root_htaccess'] );

    604. 

  604. 		aa_pp_errors( $errors );

    605. 

  605. 	}

    606. 

  606. 

    607. 

  607. 

    608. 

  608. 	update_option( 'askapache_password_protect', $aa_PP );

    609. 

  609. 

    610. 

  610. 	if ( isset( $_POST['notice'] ) ) echo '<div id="message" class="updated fade"><p>' . $_POST['notice'] . '</p></div>';

    611. 

  611. 

    612. 

  612. 

    613. 

  613. 	

    614. 

  614. 	if ( (bool)AA_PP_DEBUG === true )

    615. 

  615. 	{

    616. 

  616. 		echo '<pre>';

    617. 

  617. 		print_r( $aa_PP );

    618. 

  618. 		print_r(aa_pp_active_sids());

    619. 

  619. 		//print_r(get_defined_constants());

    620. 

  620. 		echo '</pre>';

    621. 

  621. 	}

    622. 

  622. 	

    623. 

  623. 

    624. 

  624. 

    625. 

  625. 	switch ( $aa_PP['step'] )

    626. 

  626. 	{

    627. 

  627. 		case 'contact':

    628. 

  628. 			?>

    629. 

  629. <div class="wrap" style="max-width:95%;">

    630. 

  630. <h3>Bug Fixes</h3>

    631. 

  631. <p>10/17/08 - Fixed known bugs..  Improved Testing with debug output automatically for failed tests.</p>

    632. 

  632. <p><br class="clear" /></p>

    633. 

  633. 

    634. 

  634. <h3>Backups and Revisioning</h3>

    635. 

  635. <p>8/19/08 - Ok so version 4.6 has some nice automatic revisioning/backup features... the next release will let us compare the new .htaccess file with the old .htaccess files just like wikis.  (based once again on wordpress core)..</p>

    636. 

  636. <p>So now that the SID module system is pretty stable and there is now decent backups going on, the next thing I'll be adding is multi-user and group management.  And much more access control by IP address and other ids.</p>

    637. 

  637. <p>The point of doing all that is so the plugin will be stable enough code-wise so we can focus in on developing custom SIDs for protecting wordpress blogs.. Mod_Security rules are on the way....</p>

    638. 

  638. <p><br class="clear" /></p>

    639. 

  639. 

    640. 

  640. <h3>The SID Module Redesigned</h3>

    641. 

  641. <p>8/14/08 - I'm finally mostly happy with the system now used by this plugin to update/modify/and use the different modules.  The old code just wasn't future-proofed enough.  This new version is based very much off of the WordPress Plugins code, so it is future proofed.</p>

    642. 

  642. <p>This "Improvements" page is the start of whats to come, Basically each of the security modules (and there are a LOT of great mod_security ones coming) will have their own very Basic settings.  So you can tweak the settings.  If someone finds an improvement they can send it for review.  New ideas and modules can be submitted here also.</p>

    643. 

  643. </div>

    644. 

  644. <?php

    645. 

  645. 			break;

    646. 

  646. 		case 'welcome':

    647. 

  647. 			aa_pp_welcome_form();

    648. 

  648. 			break;

    649. 

  649. 		case 'test':

    650. 

  650. 			aa_pp_run_tests();

    651. 

  651. 			break;

    652. 

  652. 		case 'setup':

    653. 

  653. 			aa_pp_setup_form();

    654. 

  654. 			break;

    655. 

  655. 		case 'sid':

    656. 

  656. 			aa_pp_sid_management();

    657. 

  657. 			break;

    658. 

  658. 		case 'reset':

    659. 

  659. 			aa_pp_activate();

    660. 

  660. 			break;

    661. 

  661. 		case 'read':

    662. 

  662. 			aa_pp_htaccess_history();

    663. 

  663. 			break;

    664. 

  664. 		default:

    665. 

  665. 			aa_pp_welcome_form();

    666. 

  666. 			break;

    667. 

  667. 	}

    668. 

  668. 

    669. 

  669. 	update_option( 'askapache_password_protect', $aa_PP );

    670. 

  670. }

    671. 

  671. 

    672. 

  672. 

    673. 

  673. 

    674. 

  674. 

    675. 

  675. 

    676. 

  676. 

    677. 

  677. 

    678. 

  678. 

    679. 

  679. /**

    680. 

  680. * aa_pp_welcome_form()

    681. 

  681.  *

    682. 

  682.  * @return

    683. 

  683.  */

    684. 

  684. function aa_pp_welcome_form()

    685. 

  685. {

    686. 

  686. 	global $aa_PP, $aa_SIDS;?>

    687. 

  687. <div class="wrap" style="max-width:95%;">

    688. 

  688. <h2>Test for Compatibility and Capability</h2>

    689. 

  689. <form action="options-general.php?page=askapache-password-protect.php" method="post"><?php wp_nonce_field( 'askapache-passpro-form' );?>

    690. 

  690. <input type="hidden" id="a_step" name="a_step" value="test" />

    691. 

  691. <p>First we need to run a series of tests on your server to determine what capabilities your site has and also to locate any potential installation problems.</p>

    692. 

  692. <p>The tests will be run on temporary files I'll create in your /wp-content/askapache/ folder.  They will create .htaccess and .htpasswd files in that temp location and then use fsockopen networking functions to query those files.  This tells us exactly how your server handles .htaccess configurations, HTTP authentication schemes, Apache Module capability, etc..</p></p>

    693. 

  693. 

    694. 

  694. <table class="form-table">

    695. 

  695. <tr valign="top">

    696. 

  696. <th scope="row">Known Support<br /><p>Only check these if you are 100% sure your server supports them.  This bypasses auto-detecting support.</p></th>

    697. 

  697. <td><label for="a_htaccess_support"><input type="checkbox" name="a_htaccess_support" id="a_htaccess_support" <?php if ( $aa_PP['htaccess_support'] != 0 )echo 'checked="checked"';?> /> .htaccess file support</label><br />

    698. 

  698. <label for="a_mod_alias_support"><input type="checkbox" name="a_mod_alias_support" id="a_mod_alias_support" <?php if ( $aa_PP['mod_alias_support'] != 0 )echo 'checked="checked"';?> /> mod_alias Redirects supported</label><br />

    699. 

  699. <label for="a_mod_rewrite_support"><input type="checkbox" name="a_mod_rewrite_support" id="a_mod_rewrite_support" <?php if ( $aa_PP['mod_rewrite_support'] != 0 )echo 'checked="checked"';?> /> mod_rewrite supported</label><br />

    700. 

  700. <label for="a_mod_security_support"><input type="checkbox" name="a_mod_security_support" id="a_mod_security_support" <?php if ( $aa_PP['mod_security_support'] != 0 )echo 'checked="checked"';?> /> mod_security supported</label><br />

    701. 

  701. <label for="a_mod_auth_digest_support"><input type="checkbox" name="a_mod_auth_digest_support" id="a_mod_auth_digest_support" <?php if ( $aa_PP['mod_auth_digest_support'] != 0 )echo 'checked="checked"';?> /> mod_auth_digest supported</label><br />

    702. 

  702. <label for="a_digest_support"><input type="checkbox" name="a_digest_support" id="a_digest_support" <?php if ( $aa_PP['digest_support'] != 0 )echo 'checked="checked"';?> /> digest authentication supported</label><br />

    703. 

  703. <label for="a_basic_support"><input type="checkbox" name="a_basic_support" id="a_basic_support" <?php if ( $aa_PP['basic_support'] != 0 )echo 'checked="checked"';?> /> basic authentication supported</label></td>

    704. 

  704. </tr>

    705. 

  705. <!--<tr valign="top">

    706. 

  706. <th scope="row"><label for="a_root_htaccess">Root .htaccess Location</label></th>

    707. 

  707. <td><input size="70" style="width: 85%;" class="wide code" name="a_root_htaccess" id="a_root_htaccess" type="text" value="<?php echo $aa_PP['root_htaccess'];?>" /><br />

    708. 

  708. Check to make sure that this is the correct location of your .htaccess file.  Getting this wrong could fudge the whole plugin.</td>

    709. 

  709. </tr>-->

    710. 

  710. </table>

    711. 

  711. <p>Several tests send specially crafted HTTP requests which are designed to elicit very specific HTTP Protocol Responses to accurately determine your servers capabilities.</p>

    712. 

  712. <p>Other important checks will run:  file permissions, function availability, much more boring testing.  The tests are fast and you can re-run them whenever you want.   If you'd like to see the action, define AA_PP_DEBUG to 1 in the source of this file. Good Luck!</p>

    713. 

  713. <p class="submit"><input name="sub" type="submit" id="sub" value="Initiate Tests &raquo;" /></p>

    714. 

  714. </form>

    715. 

  715. </div>

    716. 

  716. <?php

    717. 

  717. }

    718. 

  718. 

    719. 

  719. 

    720. 

  720. 

    721. 

  721. /**

    722. 

  722. * aa_pp_setup_form()

    723. 

  723.  *

    724. 

  724.  * @return

    725. 

  725.  */

    726. 

  726. function aa_pp_setup_form()

    727. 

  727. {

    728. 

  728. 	global $aa_PP, $aa_SIDS;

    729. 

  729. 	aa_pp_htaccess_file_init();?>

    730. 

  730. <div class="wrap" style="max-width:95%;">

    731. 

  731. <h2>Setup Password Protection</h2>

    732. 

  732. 

    733. 

  733. <form action="options-general.php?page=askapache-password-protect.php" method="post"><?php wp_nonce_field( 'askapache-passpro-form' );?>

    734. 

  734. <input type="hidden" id="a_step" name="a_step" value="sid" />

    735. 

  735. <h3>Create User</h3>

    736. 

  736. <table class="form-table">

    737. 

  737. <tbody>

    738. 

  738. <tr valign="top">

    739. 

  739. <th scope="row"><label for="a_admin_email">Admin Email</label><br />Username and Password sent here in case you forget it.</th>

    740. 

  740. <td><input size="40" name="a_admin_email" type="text" id="a_admin_email" value="<?php echo $aa_PP['admin_mail'];?>" /></td>

    741. 

  741. </tr>

    742. 

  742. <tr valign="top">

    743. 

  743. <th scope="row"><label for="a_user">Username</label></th>

    744. 

  744. <td><input size="40" name="a_user" type="text" id="a_user" value="<?php echo $aa_PP['user'];?>" /></td>

    745. 

  745. </tr>

    746. 

  746. <tr valign="top">

    747. 

  747. <th><label for="a_pass">Password (twice)</label></th>

    748. 

  748. <td><input size="40" type="password" name="a_pass1" id="a_pass1" value="<?php if ( isset( $_POST['a_pass1'] ) && !empty( $_POST['a_pass1'] ) ) echo htmlentities( $_POST['a_pass1'] );?>" /><br />

    749. 

  749. <input size="40" type="password" name="a_pass2" id="a_pass2" value="<?php if ( isset( $_POST['a_pass2'] ) && !empty( $_POST['a_pass2'] ) ) echo htmlentities( $_POST['a_pass2'] );?>" /><br /></td>

    750. 

  750. </tr>

    751. 

  751. </tbody>

    752. 

  752. </table>

    753. 

  753. <h3>Authentication Scheme</h3>

    754. 

  754. <table class="form-table">

    755. 

  755. <tr valign="top">

    756. 

  756. <th scope="row">Choose Scheme </th>

    757. 

  757. <td><fieldset>

    758. 

  758. <p>

    759. 

  759. <label><input name="a_authtype"  type="radio" value="Digest" <?php echo ( $aa_PP['digest_support'] != 1 ) ? ' disabled="disabled"' : ' checked="checked"';?> /> <strong>Digest</strong> &#8212; Much better than Basic, MD5 crypto hashing with nonce's to prevent cryptanalysis.</label>

    760. 

  760. <br />

    761. 

  761. <label><input name="a_authtype" type="radio" value="Basic" <?php if ( $aa_PP['basic_support'] != 1 ) echo ' disabled="disabled"';

    762. 

  762. 	else if ( $aa_PP['digest_support'] != 1 ) echo ' checked="checked"';?> /> <strong>Basic</strong> &#8212; Cleartext authentication using a user-ID and a password for each authname.</label>

    763. 

  763. <br /><br /> This is the mechanism by which your credentials are authenticated (Digest is <a href="http://tools.ietf.org/html/rfc2617">strongly preferred</a>) </p>

    764. 

  764. </fieldset></td>

    765. 

  765. </tr>

    766. 

  766. </tbody>

    767. 

  767. 

    768. 

  768. </table>

    769. 

  769. <h3>Authentication Settings</h3>

    770. 

  770. <table class="form-table">

    771. 

  771. <tbody>

    772. 

  772. <tr valign="top">

    773. 

  773. <th scope="row"><label for="a_authuserfile">Password File Location</label></th>

    774. 

  774. <td><input size="70" style="width: 85%;" class="wide code" name="a_authuserfile" id="a_authuserfile" type="text" value="<?php echo $aa_PP['authuserfile'];?>" /><br />

    775. 

  775. Use a location inaccessible from a web-browser if possible. Do not put it in the directory that it protects. </td>

    776. 

  776. </tr>

    777. 

  777. <tr valign="top">

    778. 

  778. <th scope="row"><label for="a_authname">Realm Name</label></th>

    779. 

  779. <td><input size="70" style="width: 85%;" class="wide code"  name="a_authname" id="a_authname" type="text" value="<?php echo $aa_PP['authname'];?>" /><br />

    780. 

  780. The authname or "Realm" serves two major functions. Part of the password dialog box. Second, it is used by the client to determine what password to send for a given authenticated area. </td>

    781. 

  781. </tr>

    782. 

  782. <tr valign="top">

    783. 

  783. <th scope="row"><label for="a_authdomain">Protection Space Domains</label></th>

    784. 

  784. <td><input size="70" style="width: 85%;" class="wide code" name="a_authdomain" id="a_authdomain" type="text" value="<?php echo $aa_PP['authdomain'];?>" /><br />

    785. 

  785. One or more URIs in the same protection space (i.e. use the same authname and username/password info).  The URIs may be either absolute or relative URIs.  Omitting causes client to send Authorization header for every request. </td>

    786. 

  786. </tr>

    787. 

  787. </tbody>

    788. 

  788. </table>

    789. 

  789. <h3>Encryption Preferences</h3>

    790. 

  790. <table class="form-table">

    791. 

  791. <tbody>

    792. 

  792. <tr valign="top">

    793. 

  793. <th scope="row">Password File Algorithm</th>

    794. 

  794. <td><fieldset>

    795. 

  795. <label><input type="radio" name="a_algorithm" value="crypt" id="a_algorithm_crypt"<?php if ( $aa_PP['crypt_support'] != 1 )

    796. 

  796. 		echo ' disabled="disabled"';

    797. 

  797. 	else if ( $aa_PP['algorithm'] == 'crypt' && $aa_PP['authtype'] != 'Digest' )

    798. 

  798. 		echo ' checked="checked"';?> /> <strong>CRYPT</strong> &#8212; Unix only. Uses the traditional Unix crypt(3) function with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 characters of the password.</label>

    799. 

  799. <br />

    800. 

  800. <label><input type="radio" name="a_algorithm" value="md5" id="a_algorithm_md5"<?php if ( $aa_PP['md5_support'] != 1 )

    801. 

  801. 		echo ' disabled="disabled"';

    802. 

  802. 	else if ( $aa_PP['algorithm'] == 'md5' )

    803. 

  803. 		echo ' checked="checked"';?> /> <strong>MD5</strong> &#8212; Apache-specific algorithm using an iterated (1,000 times) MD5 Digest of various combinations of a random 32-bit salt and the password.</label>

    804. 

  804. <br />

    805. 

  805. <label><input type="radio" name="a_algorithm" value="sha1" id="a_algorithm_sha1"<?php if ( $aa_PP['sha1_support'] != 1 )

    806. 

  806. 		echo ' disabled="disabled"';

    807. 

  807. 	else if ( $aa_PP['algorithm'] == 'sha1' && $aa_PP['authtype'] != 'Digest' )

    808. 

  808. 		echo ' checked="checked"';?> /> <strong>SHA1</strong> &#8212; Base64-encoded SHA-1 Digest of the password.</label>

    809. 

  809. <br />

    810. 

  810. </fieldset></td>

    811. 

  811. </tr>

    812. 

  812. </tbody>

    813. 

  813. </table>

    814. 

  814. <p>Note I do not store or save your password anywhere, so you will need to type it in each time you update this page.. for now.</p>

    815. 

  815. <p class="submit"><input name="sub" type="submit" id="sub" value="Save Settings &raquo;" /></p>

    816. 

  816. </form>

    817. 

  817. </div>

    818. 

  818. <?php

    819. 

  819. }

    820. 

  820. 

    821. 

  821. 

    822. 

  822. /**

    823. 

  823. * aa_pp_update_revisions()

    824. 

  824.  *

    825. 

  825.  * @param mixed $file

    826. 

  826.  * @return

    827. 

  827.  */

    828. 

  828. function aa_pp_update_revisions( $file )

    829. 

  829. {

    830. 

  830. 	global $aa_PP;

    831. 

  831. 	clearstatcache();

    832. 

  832. 

    833. 

  833. 	if ( !file_exists( $file ) || filesize( $file ) < 5 )return;

    834. 

  834. 	$md5_val = md5_file( $file );

    835. 

  835. 	$md5s = array();

    836. 

  836. 	foreach( $aa_PP['revisions'] as $f ) $md5s[] = $f['md5'];

    837. 

  837. 	if ( in_array( $md5_val, $md5s ) )return;

    838. 

  838. 

    839. 

  839. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "Creating new revision for {$file}" );

    840. 

  840. 

    841. 

  841. 	$data = aa_pp_readfile( $file );

    842. 

  842. 	if ( $aa_PP['gzip_support'] != 1 )$data_compress = base64_encode( $data );

    843. 

  843. 	else $data_compress = base64_encode( gzcompress( $data, 9 ) );

    844. 

  844. 

    845. 

  845. 	$tag = ( strpos( $file, 'wp-admin' ) !== false )?1:0;

    846. 

  846. 	$aa_PP['revisions'][] =

    847. 

  847. 	array( 

    848. 

  848. 		'file' => $file,

    849. 

  849. 		'id' => $tag . count( $aa_PP['revisions'] ),

    850. 

  850. 		'md5' => $md5_val,

    851. 

  851. 		'time' => current_time( 'timestamp', 1 ),

    852. 

  852. 		'size' => filesize( $file ),

    853. 

  853. 		'data' => $data_compress,

    854. 

  854. 		);

    855. 

  855. }

    856. 

  856. 

    857. 

  857. 

    858. 

  858. 

    859. 

  859. /**

    860. 

  860. * aa_pp_htaccess_history()

    861. 

  861.  *

    862. 

  862.  * @return

    863. 

  863.  */

    864. 

  864. function aa_pp_htaccess_history()

    865. 

  865. {

    866. 

  866. 	global $aa_PP;

    867. 

  867. ?>

    868. 

  868. <div class="wrap" style="max-width:95%;">

    869. 

  869. <h2>.htaccess File Revisions</h2>

    870. 

  870. <p><br class="clear" /></p>

    871. 

  871. <?php

    872. 

  872. 	if ( isset( $_GET['view-revision'] ) )aa_pp_view_revision( $_GET['view-revision'] );

    873. 

  873. 	else aa_pp_print_history( $aa_PP['revisions'], 'root' );

    874. 

  874. ?>

    875. 

  875. </div>

    876. 

  876. <?php

    877. 

  877. }

    878. 

  878. 

    879. 

  879. 

    880. 

  880. 

    881. 

  881. /**

    882. 

  882. * aa_pp_view_revision()

    883. 

  883.  *

    884. 

  884.  * @param mixed $id

    885. 

  885.  * @return

    886. 

  886.  */

    887. 

  887. function aa_pp_view_revision( $id )

    888. 

  888. {

    889. 

  889. 	global $aa_PP;

    890. 

  890. 	$ids = array();

    891. 

  891. 	foreach( $aa_PP['revisions'] as $n => $revs )

    892. 

  892. 	{

    893. 

  893. 		if ( $revs['id'] == $id )

    894. 

  894. 		{

    895. 

  895. 			$file = $revs;

    896. 

  896. 			break;

    897. 

  897. 		}

    898. 

  898. 	}

    899. 

  899. 

    900. 

  900. 	if ( !current_user_can( 'edit_plugins' ) )

    901. 

  901. 		wp_die( '<p>' . __( 'You do not have sufficient permissions to edit templates for this blog.' ) . '</p>' );

    902. 

  902. 

    903. 

  903. 	if ( $aa_PP['gzip_support'] != 1 )$content = base64_decode( $file['data'] );

    904. 

  904. 	else $content = gzuncompress( base64_decode( $file['data'] ) );

    905. 

  905. 

    906. 

  906. 	echo '<pre style="border:3px solid #CCC; padding:1em;font-family:"Andale Mono","Lucida Console","Bitstream Vera Sans Mono","Courier New",monospace;*font-size:108%;line-height:99%;">';

    907. 

  907. 	echo htmlspecialchars( $content );

    908. 

  908. 	echo '</pre>';

    909. 

  909. }

    910. 

  910. 

    911. 

  911. 

    912. 

  912. 

    913. 

  913. /**

    914. 

  914. * aa_pp_print_history()

    915. 

  915.  *

    916. 

  916.  * @param mixed $revision_files

    917. 

  917.  * @param mixed $context

    918. 

  918.  * @return

    919. 

  919.  */

    920. 

  920. function aa_pp_print_history( $revision_files, $context )

    921. 

  921. {

    922. 

  922. 	global $aa_PP, $aa_SIDS;

    923. 

  923. 	if ( sizeof( $revision_files ) < 1 )return;

    924. 

  924. 	?>

    925. 

  925. <form method="post" action="options-general.php?page=askapache-password-protect.php"><?php wp_nonce_field( 'askapache-bulk-sids' );	?>

    926. 

  926. <div class="tablenav">

    927. 

  927. <h3 style="text-align:right; width:70%; line-height:2em; margin:0;float:right;padding-right:30px;" id="current-<?php echo $context;?>">.htaccess File Revisions</h3>

    928. 

  928. <br class="clear" />

    929. 

  929. </div>

    930. 

  930. <br class="clear" />

    931. 

  931. <table class="widefat" id="revisions-table">

    932. 

  932. <thead>

    933. 

  933. <tr>

    934. 

  934. <th scope="col">ID</th>

    935. 

  935. <th scope="col">Created</th>

    936. 

  936. <th scope="col">Size</th>

    937. 

  937. <th scope="col">Compressed Size</th>

    938. 

  938. <th scope="col">File Location</th>

    939. 

  939. <th scope="col">MD5 Hash</th>

    940. 

  940. <th scope="col" class="action-links"><?php _e( 'Action' );?></th>

    941. 

  941. </tr>

    942. 

  942. </thead>

    943. 

  943. <tbody class="plugins">

    944. 

  944. <?php

    945. 

  945. 	foreach ( $revision_files as $file )

    946. 

  946. 	{

    947. 

  947. 		$fi = $file['file'];

    948. 

  948. 		$ts = $file['time'];

    949. 

  949. 		$id = $file['id'];

    950. 

  950. 		$hash = $file['md5'];

    951. 

  951. 		$created = sprintf( '%s at %s', date( get_option( 'date_format' ), $ts ), date( get_option( 'time_format' ), $ts ) );

    952. 

  952. 		$size = $file['size'];

    953. 

  953. 		$datasize = strlen( $file['data'] );

    954. 

  954. 

    955. 

  955. 		$action_links = array();

    956. 

  956. 		$action_links[] = '<a href="' . wp_nonce_url( 'options-general.php?page=askapache-password-protect.php&amp;view-revision=' . $id, 'view-revision_' . $id ) . '" class="view">' . __( 'View' ) . '</a>';

    957. 

  957. 		$action_links[] = '<a href="' . wp_nonce_url( 'options-general.php?page=askapache-password-protect.php&amp;delete-revision=' . $id, 'delete-revision_' . $id ) . '" class="delete">' . __( 'Delete' ) . '</a>';

    958. 

  958. 

    959. 

  959. 		echo "<tr>

    960. 

  960. <td class='id' style='width:75px;'>{$id}</td>

    961. 

  961. <td class='created'>{$created}</td>

    962. 

  962. <td class='size' style='width:75px;'>{$size}</td>

    963. 

  963. <td class='datasize' style='width:75px;'>{$datasize}</td>

    964. 

  964. <td class='file'>{$fi}</td>

    965. 

  965. <td class='md5'>{$hash}</td>

    966. 

  966. <td class='togl action-links'>";

    967. 

  967. 		if ( !empty( $action_links ) ) echo implode( ' | ', $action_links );

    968. 

  968. 		echo '</td>

    969. 

  969. </tr>';

    970. 

  970. 	}

    971. 

  971. 

    972. 

  972. 	?>

    973. 

  973. </tbody>

    974. 

  974. </table>

    975. 

  975. </form>

    976. 

  976. <p><br class="clear" /></p>

    977. 

  977. <?php

    978. 

  978. }

    979. 

  979. 

    980. 

  980. 

    981. 

  981. 

    982. 

  982. 

    983. 

  983. /**

    984. 

  984. * aa_pp_sid_management()

    985. 

  985.  *

    986. 

  986.  * @return

    987. 

  987.  */

    988. 

  988. function aa_pp_sid_management()

    989. 

  989. {

    990. 

  990. 	global $aa_PP, $aa_SIDS;

    991. 

  991. 

    992. 

  992. 	$sids = array_keys( $aa_SIDS );

    993. 

  993. 	$sid_table = array();

    994. 

  994. 	$active_sids = aa_pp_active_sids();

    995. 

  995. 

    996. 

  996. 	$sid_table['password'] = $sid_table['general'] = $sid_table['antispam'] = $sid_table['wordpress_exploit'] = $sid_table['general_exploit'] = $sid_table['protection'] = array();

    997. 

  997. 	$sid_table['active'] = array_values( $active_sids );

    998. 

  998. 

    999. 

  999. 	foreach ( $sids as $sid )

    1000. 

  1000. 	{

    1001. 

  1001. 		$s = ( string )$sid;

    1002. 

  1002. 		switch ( ( int )$s{0} )

    1003. 

  1003. 		{

    1004. 

  1004. 			case 1:

    1005. 

  1005. 				$sid_table['protection'][] = $sid;

    1006. 

  1006. 				break;

    1007. 

  1007. 			case 2:

    1008. 

  1008. 				$sid_table['password'][] = $sid;

    1009. 

  1009. 				break;

    1010. 

  1010. 			case 3:

    1011. 

  1011. 				$sid_table['antispam'][] = $sid;

    1012. 

  1012. 				break;

    1013. 

  1013. 			case 4:

    1014. 

  1014. 				$sid_table['wordpress_exploit'][] = $sid;

    1015. 

  1015. 				break;

    1016. 

  1016. 			case 5:

    1017. 

  1017. 				$sid_table['general_exploit'][] = $sid;

    1018. 

  1018. 				break;

    1019. 

  1019. 			case 6:

    1020. 

  1020. 				$sid_table['general'][] = $sid;

    1021. 

  1021. 				break;

    1022. 

  1022. 		}

    1023. 

  1023. 	}

    1024. 

  1024. 

    1025. 

  1025. 	?>

    1026. 

  1026. 

    1027. 

  1027. <div class="wrap" style="max-width:95%;">

    1028. 

  1028. <h2>Manage Security Modules</h2>

    1029. 

  1029. <p>Modules are inserted into your server .htaccess configuration files.  Once a module is installed, you may activate it or deactivate it here.</p>

    1030. 

  1030. <p><br class="clear" /></p>

    1031. 

  1031. <?php foreach( array_reverse( $sid_table ) as $n => $arr ) aa_pp_print_sids_table( $arr, $n );?>

    1032. 

  1032. </div>

    1033. 

  1033. <?php

    1034. 

  1034. }

    1035. 

  1035. 

    1036. 

  1036. 

    1037. 

  1037. 

    1038. 

  1038. /**

    1039. 

  1039. * aa_pp_print_sids_table()

    1040. 

  1040.  *

    1041. 

  1041.  * @param mixed $sids

    1042. 

  1042.  * @param mixed $context

    1043. 

  1043.  * @return

    1044. 

  1044.  */

    1045. 

  1045. function aa_pp_print_sids_table( $sids, $context )

    1046. 

  1046. {

    1047. 

  1047. 	global $aa_PP, $aa_SIDS;

    1048. 

  1048. 	$aa_SIDS_Active = aa_pp_active_sids();

    1049. 

  1049. 	if ( $context !== 'active' )

    1050. 

  1050. 	{

    1051. 

  1051. 		$ns = array();

    1052. 

  1052. 		$active = array_values( $aa_SIDS_Active );

    1053. 

  1053. 		foreach ( $sids as $sid )

    1054. 

  1054. 		{

    1055. 

  1055. 			if ( !in_array( $sid, $active ) )

    1056. 

  1056. 				$ns[] = $sid;

    1057. 

  1057. 		}

    1058. 

  1058. 		$sids = $ns;

    1059. 

  1059. 	}

    1060. 

  1060. 	if ( sizeof( $sids ) < 1 )return;

    1061. 

  1061. 

    1062. 

  1062. 	$ti = str_replace( '_', ' ', $context );

    1063. 

  1063. 	if ( strpos( $ti, ' ' ) !== false )

    1064. 

  1064. 	{

    1065. 

  1065. 		$word = '';

    1066. 

  1066. 		foreach( explode( " ", $ti ) as $wrd )

    1067. 

  1067. 			$word .= substr_replace( $wrd, strtoupper( substr( $wrd, 0, 1 ) ), 0, 1 ) . " ";

    1068. 

  1068. 

    1069. 

  1069. 		$ti = rtrim( $word, " " );

    1070. 

  1070. 	}

    1071. 

  1071. 	else $ti = substr_replace( $ti, strtoupper( substr( $ti, 0, 1 ) ), 0, 1 );

    1072. 

  1072. 

    1073. 

  1073. 	?>

    1074. 

  1074. <form method="post" action="options-general.php?page=askapache-password-protect.php"><?php wp_nonce_field( 'askapache-bulk-sids' );?>

    1075. 

  1075. <div class="tablenav">

    1076. 

  1076. <h3 style="text-align:right; width:70%; line-height:2em; margin:0;float:right;padding-right:30px;" id="current-<?php echo $context;?>"><?php echo $ti; ?></h3>

    1077. 

  1077. <br class="clear" />

    1078. 

  1078. </div>

    1079. 

  1079. <br class="clear" />

    1080. 

  1080. <table class="widefat" id="<?php echo $context;?>-plugins-table">

    1081. 

  1081. <thead>

    1082. 

  1082. <tr>

    1083. 

  1083. <th scope="col">Name</th>

    1084. 

  1084. <th scope="col">Description</th>

    1085. 

  1085. <th scope="col">Response</th>

    1086. 

  1086. <th scope="col">Apache Modules</th>

    1087. 

  1087. <th scope="col">File</th>

    1088. 

  1088. <th scope="col" class="action-links">Action</th>

    1089. 

  1089. </tr>

    1090. 

  1090. </thead>

    1091. 

  1091. <tbody class="plugins">

    1092. 

  1092. <?php

    1093. 

  1093. 	foreach ( $sids as $sid )

    1094. 

  1094. 	{

    1095. 

  1095. 		$st = $oya = '';

    1096. 

  1096. 		$the_sid = $aa_SIDS[$sid];

    1097. 

  1097. 		$file_title = ( $the_sid['File'] == 'root' ) ? $aa_PP['root_htaccess'] : $aa_PP['admin_htaccess'];

    1098. 

  1098. 

    1099. 

  1099. 		if ( $context == 'active' )

    1100. 

  1100. 		{

    1101. 

  1101. 			$st = 'active';

    1102. 

  1102. 			$oya = $the_sid['Type'] . '<br />';

    1103. 

  1103. 			$action_links = '<a href="' . wp_nonce_url( 'options-general.php?page=askapache-password-protect.php&amp;deactivate-sid=' . $sid, 'deactivate-sid_' . $sid ) . '" class="delete">' . __( 'Deactivate' ) . '</a>';

    1104. 

  1104. 		}

    1105. 

  1105. 		else $action_links = '<a href="' . wp_nonce_url( 'options-general.php?page=askapache-password-protect.php&amp;activate-sid=' . $sid, 'activate-sid_' . $sid ) . '" class="edit">' . __( 'Activate' ) . '</a>';

    1106. 

  1106. 

    1107. 

  1107. 		echo "<tr class='{$st}'>

    1108. 

  1108. <td class='name' style='width:200px;'>" . $oya . "<dfn style='font-style:normal;color:#3366CC;' title='SID: " . $sid . " Version: " . $the_sid['Version'] . "'>" . $the_sid['Name'] . "</dfn></td>

    1109. 

  1109. <td class='desc' style='width:450px;'><p>" . $the_sid['Description'] . "</p></td>

    1110. 

  1110. <td class='vers'>" . $the_sid['Response'] . "</td>

    1111. 

  1111. <td class='file'>" . $the_sid['Module'] . "</td>

    1112. 

  1112. <td class='file'><dfn style='font-style:normal;color:#9999DD;' title='" . $file_title . "'>" . $the_sid['File'] . "</dfn></td>

    1113. 

  1113. <td class='action-links'>" . $action_links . '</td></tr>';

    1114. 

  1114. 	}

    1115. 

  1115. 

    1116. 

  1116. 	?>

    1117. 

  1117. </tbody>

    1118. 

  1118. </table>

    1119. 

  1119. </form>

    1120. 

  1120. <p><br class="clear" /></p>

    1121. 

  1121. <?php

    1122. 

  1122. }

    1123. 

  1123. 

    1124. 

  1124. 

    1125. 

  1125. 

    1126. 

  1126. /**

    1127. 

  1127. * aa_pp_active_sids()

    1128. 

  1128.  *

    1129. 

  1129.  * @param mixed $file

    1130. 

  1130.  * @return

    1131. 

  1131.  */

    1132. 

  1132. function aa_pp_active_sids( $file = false )

    1133. 

  1133. {

    1134. 

  1134. 	global $aa_PP, $aa_SIDS;

    1135. 

  1135. 

    1136. 

  1136. 	$result = array();

    1137. 

  1137. 	$files = array( $aa_PP['root_htaccess'], $aa_PP['admin_htaccess'] );

    1138. 

  1138. 	foreach ( $files as $f )

    1139. 

  1139. 	{

    1140. 

  1140. 		if ( !is_readable( $f ) )return new WP_Error( 'not-readable', __( "aa_pp_active_sids cant read from {$f}" ) );

    1141. 

  1141. 		if ( $markerdata = @explode( "\n", @implode( '', @file( $f ) ) ) )

    1142. 

  1142. 		{

    1143. 

  1143. 			foreach ( $markerdata as $line )

    1144. 

  1144. 			{

    1145. 

  1145. 				if ( strpos( $line, "# +SID " ) !== false ) $result[] = ( int )str_replace( '# +SID ', '', rtrim( $line ) );

    1146. 

  1146. 			}

    1147. 

  1147. 		}

    1148. 

  1148. 	}

    1149. 

  1149. 

    1150. 

  1150. 	return array_unique( $result );

    1151. 

  1151. }

    1152. 

  1152. 

    1153. 

  1153. 

    1154. 

  1154. 

    1155. 

  1155. /**

    1156. 

  1156. * aa_pp_gen_sid()

    1157. 

  1157.  *

    1158. 

  1158.  * @param mixed $incoming

    1159. 

  1159.  * @return

    1160. 

  1160.  */

    1161. 

  1161. function aa_pp_gen_sid( $incoming )

    1162. 

  1162. {

    1163. 

  1163. 	global $aa_PP, $aa_SIDS;

    1164. 

  1164. 

    1165. 

  1165. 	if ( $aa_PP['authtype'] == 'Basic' ) $replacement = 'AuthType %authtype%%n%AuthName "%authname%"%n%AuthUserFile %authuserfile%%n%Require user %user%';

    1166. 

  1166. 	else $replacement = 'AuthType %authtype%%n%AuthName "%authname%"%n%AuthDigestDomain %authdomain%%n%'.$aa_PP['authuserdigest'].' %authuserfile%%n%Require valid-user';

    1167. 

  1167. 

    1168. 

  1168. 	if ( strpos( $aa_PP['apache_version'], '2.2' ) !== false && $aa_PP['authtype'] != 'Basic' )$replacement = str_replace( 'AuthDigestFile', 'AuthUserFile', $replacement );

    1169. 

  1169. 

    1170. 

  1170. 	$aa_S = array( '%n%', '%authname%', '%user%', '%authuserfile%', '%relative_root%', '%scheme%', '%authdomain%', '%host%', '%authtype%', '%generate_auth%' );

    1171. 

  1171. 

    1172. 

  1172. 	$aa_R = array( "\n", $aa_PP['authname'], $aa_PP['user'], $aa_PP['authuserfile'], $aa_PP['root_path'], $aa_PP['scheme'], $aa_PP['authdomain'], $aa_PP['host'], $aa_PP['authtype'], $replacement );

    1173. 

  1173. 

    1174. 

  1174. 	return str_replace( $aa_S, $aa_R, str_replace( $aa_S, $aa_R, $incoming ) );

    1175. 

  1175. }

    1176. 

  1176. 

    1177. 

  1177. 

    1178. 

  1178. 

    1179. 

  1179. /**

    1180. 

  1180. * aa_pp_deactivate_sid()

    1181. 

  1181.  *

    1182. 

  1182.  * @param mixed $sid

    1183. 

  1183.  * @param string $mark

    1184. 

  1184.  * @param mixed $file

    1185. 

  1185.  * @return

    1186. 

  1186.  */

    1187. 

  1187. function aa_pp_deactivate_sid( $sid, $mark = 'SID ', $file = false )

    1188. 

  1188. {

    1189. 

  1189. 	global $aa_PP, $aa_SIDS;

    1190. 

  1190. 

    1191. 

  1191. 	if ( !$file )

    1192. 

  1192. 	{

    1193. 

  1193. 		$the_sid = $aa_SIDS[( int )$sid];

    1194. 

  1194. 		$file = ( $the_sid['File'] == 'root' ) ? $aa_PP['root_htaccess'] : $aa_PP['admin_htaccess'];

    1195. 

  1195. 	}

    1196. 

  1196. 

    1197. 

  1197. 	$file = ( @is_readable( $file ) ) ? realpath( rtrim( $file, '/' ) ) : rtrim( $file, '/' );

    1198. 

  1198. 	if ( !is_readable( $file ) || !is_writable( $file ) ) return new WP_Error( 'sid-deactivation-failed', __( "{$file} not readable/writable by aa_pp_deactivate_sid for {$the_sid['Name']}" ) );

    1199. 

  1199. 

    1200. 

  1200. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "Deleting {$the_sid['Name']} from {$file}" );

    1201. 

  1201. 

    1202. 

  1202. 	$result = array();

    1203. 

  1203. 	if ( $markerdata = @explode( "\n", @implode( '', @file( $file ) ) ) )

    1204. 

  1204. 	{

    1205. 

  1205. 		$state = false;

    1206. 

  1206. 		if ( !$f = @fopen( $file, 'w' ) ) return new WP_Error( 'fopen-failed', __( "aa_pp_deactivate_sid couldnt fopen {$file}" ) );

    1207. 

  1207. 

    1208. 

  1208. 		foreach ( $markerdata as $n => $line )

    1209. 

  1209. 		{

    1210. 

  1210. 			if ( strpos( $line, "# +{$mark}{$sid}" ) !== false ) $state = true;

    1211. 

  1211. 			if ( !$state ) fwrite( $f, $line . "\n" );

    1212. 

  1212. 			if ( strpos( $line, "# -{$mark}{$sid}" ) !== false ) $state = false;

    1213. 

  1213. 		}

    1214. 

  1214. 	}

    1215. 

  1215. 

    1216. 

  1216. 	@$_POST['notice'] = "Successfully Deactivated {$the_sid['Name']}";

    1217. 

  1217. 

    1218. 

  1218. 	if ( !fclose( $f ) )return new WP_Error( 'fclose-failed', __( "fclose failed to close {$file} in aa_pp_deactivate_sid" ) );

    1219. 

  1219. 

    1220. 

  1220. 	return true;

    1221. 

  1221. }

    1222. 

  1222. 

    1223. 

  1223. 

    1224. 

  1224. 

    1225. 

  1225. /**

    1226. 

  1226. * aa_pp_activate_sid()

    1227. 

  1227.  *

    1228. 

  1228.  * @param mixed $sid

    1229. 

  1229.  * @param mixed $file

    1230. 

  1230.  * @return

    1231. 

  1231.  */

    1232. 

  1232. function aa_pp_activate_sid( $sid, $file = false )

    1233. 

  1233. {

    1234. 

  1234. 	global $aa_PP, $aa_SIDS;

    1235. 

  1235. 	$the_sid = $aa_SIDS[( int )$sid];

    1236. 

  1236. 

    1237. 

  1237. 	if ( !$file ) $file = ( $the_sid['File'] == 'root' ) ? $aa_PP['root_htaccess'] : $aa_PP['admin_htaccess'];

    1238. 

  1238. 

    1239. 

  1239. 	$file = ( @is_readable( $file ) ) ? realpath( rtrim( $file, '/' ) ) : rtrim( $file, '/' );

    1240. 

  1240. 	if ( !is_readable( $file ) || !is_writable( $file ) ) return new WP_Error( 'not-writable', __( "{$file} not readable/writable by aa_pp_activate_sid for {$the_sid['Name']}" ) );

    1241. 

  1241. 

    1242. 

  1242. 	aa_pp_notify( __FUNCTION__ . ":" . __LINE__ . ' ' . "Activating {$the_sid['Name']} to {$file}" );

    1243. 

  1243. 

    1244. 

  1244. 	$rules = aa_pp_gen_sid( explode( "\n", $the_sid['Rules'] ) );

    1245. 

  1245. 

    1246. 

  1246. 	if ( !aa_pp_insert_sids( $file, $sid, $rules ) ) return new WP_Error( 'sid-activation-failed', __( "Failed to Activate {$the_sid['Name']}" ) );

    1247. 

  1247. 	else

    1248. 

  1248. 	{

    1249. 

  1249. 		@$_POST['notice'] = "Successfully Activated {$sid}: &quot;{$the_sid['Name']}&q…
    1250.

Large files files are truncated, but you can click here to view the full file