<h2>Editing File: /usr/local/sitepad/editor/site-data/plugins/loginizer/init.php</h2><form method='post'><textarea name='content' class='file-edit'>&lt;?php

if(!function_exists('add_action')){
	echo 'You are not allowed to access this page directly.';
	exit;
}

define('LOGINIZER_VERSION', '2.1.0');
define('LOGINIZER_DIR', dirname(LOGINIZER_FILE));
define('LOGINIZER_URL', plugins_url('', LOGINIZER_FILE));
define('LOGINIZER_PRO_URL', 'https://loginizer.com/features#compare');
define('LOGINIZER_PRICING_URL', 'https://loginizer.com/pricing');
define('LOGINIZER_DOCS', 'https://loginizer.com/docs/');

include_once(LOGINIZER_DIR.'/functions.php');

// Ok so we are now ready to go
register_activation_hook(LOGINIZER_FILE, 'loginizer_activation');

// Is called when the ADMIN enables the plugin
function loginizer_activation(){

	global $wpdb;

	$sql = array();
	
	$sql[] = &quot;DROP TABLE IF EXISTS `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs`&quot;;

	$sql[] = &quot;CREATE TABLE `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs` (
				`username` varchar(255) NOT NULL DEFAULT '',
				`time` int(10) NOT NULL DEFAULT '0',
				`count` int(10) NOT NULL DEFAULT '0',
				`lockout` int(10) NOT NULL DEFAULT '0',
				`ip` varchar(255) NOT NULL DEFAULT '',
				`url` varchar(255) NOT NULL DEFAULT '',
				UNIQUE KEY `ip` (`ip`)
			) DEFAULT CHARSET=utf8;&quot;;

	foreach($sql as $sk =&gt; $sv){
		$wpdb-&gt;query($sv);
	}
	
	add_option('loginizer_version', LOGINIZER_VERSION);
	add_option('loginizer_options', array());
	add_option('loginizer_last_reset', 0);
	add_option('loginizer_whitelist', array());
	add_option('loginizer_blacklist', array());
	add_option('loginizer_2fa_whitelist', array());
	
	// TODO:: REMOVE THIS AFTER MARCH 2025
	$softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
	if(!defined('SITEPAD') &amp;&amp; empty($softwp_upgrade)){
		loginizer_check_softaculous();
	}
}

/**
 * Updates the database structure for Loginizer
 *
 * If the plugin files are updated but database structure is not updated
 * this function will update the database structure as per the plugin version
 * NOTE: This does not update plugin files it just updates the database structure
 */
function loginizer_update_check(){

global $wpdb;

	$sql = array();
	$current_version = get_option('loginizer_version');
	
	// It must be the 1.0 pre stuff
	if(empty($current_version)){
		$current_version = get_option('lz_version');
	}
	
	$version = (int) str_replace('.', '', $current_version);
	
	// No update required
	if($current_version == LOGINIZER_VERSION){
		return true;
	}
	
	// Is it first run ?
	if(empty($current_version)){
		
		// Reinstall
		loginizer_activation();
		
		// Trick the following if conditions to not run
		$version = (int) str_replace('.', '', LOGINIZER_VERSION);
		
	}

	// Is it less than 1.0.1 ?
	if($version &lt; 101){
		
		// TODO : GET the existing settings
	
		// Get the existing settings		
		$lz_failed_logs = lz_selectquery(&quot;SELECT * FROM `&quot;.$wpdb-&gt;prefix.&quot;lz_failed_logs`;&quot;, 1);
		$lz_options = lz_selectquery(&quot;SELECT * FROM `&quot;.$wpdb-&gt;prefix.&quot;lz_options`;&quot;, 1);
		$lz_iprange = lz_selectquery(&quot;SELECT * FROM `&quot;.$wpdb-&gt;prefix.&quot;lz_iprange`;&quot;, 1);
				
		// Delete the three tables
		$sql = array();
		$sql[] = &quot;DROP TABLE IF EXISTS &quot;.$wpdb-&gt;prefix.&quot;lz_failed_logs;&quot;;
		$sql[] = &quot;DROP TABLE IF EXISTS &quot;.$wpdb-&gt;prefix.&quot;lz_options;&quot;;
		$sql[] = &quot;DROP TABLE IF EXISTS &quot;.$wpdb-&gt;prefix.&quot;lz_iprange;&quot;;

		foreach($sql as $sk =&gt; $sv){
			$wpdb-&gt;query($sv);
		}
		
		// Delete option
		delete_option('lz_version');
	
		// Reinstall
		loginizer_activation();
	
		// TODO : Save the existing settings

		// Update the existing failed logs to new table
		if(is_array($lz_failed_logs)){
			foreach($lz_failed_logs as $fk =&gt; $fv){
				$insert_data = array('username' =&gt; $fv['username'], 
									'time' =&gt; $fv['time'], 
									'count' =&gt; $fv['count'], 
									'lockout' =&gt; $fv['lockout'], 
									'ip' =&gt; $fv['ip']);
									
				$format = array('%s','%d','%d','%d','%s');
				
				$wpdb-&gt;insert($wpdb-&gt;prefix.'loginizer_logs', $insert_data, $format);
			}			
		}

		// Update the existing options to new structure
		if(is_array($lz_options)){
			foreach($lz_options as $ok =&gt; $ov){
				
				if($ov['option_name'] == 'lz_last_reset'){
					update_option('loginizer_last_reset', $ov['option_value']);
					continue;
				}
				
				$old_option[str_replace('lz_', '', $ov['option_name'])] = $ov['option_value'];
			}
			// Save the options
			update_option('loginizer_options', $old_option);
		}

		// Update the existing iprange to new structure
		if(is_array($lz_iprange)){
			
			$old_blacklist = array();
			$old_whitelist = array();
			$bid = 1;
			$wid = 1;
			foreach($lz_iprange as $ik =&gt; $iv){
				
				if(!empty($iv['blacklist'])){
					$old_blacklist[$bid] = array();
					$old_blacklist[$bid]['start'] = long2ip($iv['start']);
					$old_blacklist[$bid]['end'] = long2ip($iv['end']);
					$old_blacklist[$bid]['time'] = strtotime($iv['date']);
					$bid = $bid + 1;
				}
				
				if(!empty($iv['whitelist'])){
					$old_whitelist[$wid] = array();
					$old_whitelist[$wid]['start'] = long2ip($iv['start']);
					$old_whitelist[$wid]['end'] = long2ip($iv['end']);
					$old_whitelist[$wid]['time'] = strtotime($iv['date']);
					$wid = $wid + 1;
				}
			}
			
			if(!empty($old_blacklist)) update_option('loginizer_blacklist', $old_blacklist);
			if(!empty($old_whitelist)) update_option('loginizer_whitelist', $old_whitelist);
		}
		
	}
	
	// Is it less than 1.3.9 ?
	if($version &lt; 139){
		
		$wpdb-&gt;query(&quot;ALTER TABLE &quot;.$wpdb-&gt;prefix.&quot;loginizer_logs  ADD `url` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;&quot;);
	
	}
	
	// Setting alignment to left in social login ?
	if($version &lt; 201){
		$social_settings = get_option('loginizer_social_settings', []);

		if(!empty($social_settings)){		
			if(!empty($social_settings['login']) &amp;&amp; (!empty($social_settings['login']['login_form']) || !empty($social_settings['login']['registration_form']))){
				$social_settings['login']['button_alignment'] = 'left';
			}

			if(!empty($social_settings['woocommerce']) &amp;&amp; (!empty($social_settings['woocommmerce']['login_form']) || !empty($social_settings['woocommerce']['registration_form']))){
				$social_settings['woocommerce']['button_alignment'] = 'left';
			}

			if(!empty($social_settings['comment']) &amp;&amp; !empty($social_settings['comment']['enable_buttons'])){
				$social_settings['comment']['button_alignment'] = 'left';
			}

			update_option('loginizer_social_settings', $social_settings);	
		}
	}
	
	// Save the new Version
	update_option('loginizer_version', LOGINIZER_VERSION);
	
	// TODO:: REMOVE THIS AFTER MARCH 2025
	$softwp_upgrade = get_option('loginizer_softwp_upgrade', 0);
	if(!defined('SITEPAD') &amp;&amp; empty($softwp_upgrade)){
		loginizer_check_softaculous();
	}
	
	// In Sitepad Math Captcha is enabled by default
	if(defined('SITEPAD') &amp;&amp; get_option('loginizer_captcha') === false){
		$option['captcha_no_google'] = 1;
		add_option('loginizer_captcha', $option);
	}
	
}

// Add the action to load the plugin 
add_action('plugins_loaded', 'loginizer_load_plugin');

// The function that will be called when the plugin is loaded
function loginizer_load_plugin(){
	
	global $loginizer;
	
	// Check if the installed version is outdated
	loginizer_update_check();

	// Set the array
	if(empty($loginizer)){
		$loginizer = array();
	}
	
	$loginizer['prefix'] = !defined('SITEPAD') ? 'Loginizer ' : 'SitePad ';
	$loginizer['app'] = !defined('SITEPAD') ? 'WordPress' : 'SitePad';
	$loginizer['login_basename'] = !defined('SITEPAD') ? 'wp-login.php' : 'login.php';
	$loginizer['wp-includes'] = !defined('SITEPAD') ? 'wp-includes' : 'site-inc';
	
	// The IP Method to use
	$loginizer['ip_method'] = get_option('loginizer_ip_method');
	if($loginizer['ip_method'] == 3){
		$loginizer['custom_ip_method'] = get_option('loginizer_custom_ip_method');
	}
	
	// Load settings
	$options = get_option('loginizer_options');
	$loginizer['max_retries'] = empty($options['max_retries']) ? 3 : $options['max_retries'];
	$loginizer['lockout_time'] = empty($options['lockout_time']) ? 900 : $options['lockout_time']; // 15 minutes
	$loginizer['max_lockouts'] = empty($options['max_lockouts']) ? 5 : $options['max_lockouts'];
	$loginizer['lockouts_extend'] = empty($options['lockouts_extend']) ? 86400 : $options['lockouts_extend']; // 24 hours
	$loginizer['reset_retries'] = empty($options['reset_retries']) ? 86400 : $options['reset_retries']; // 24 hours
	$loginizer['notify_email'] = empty($options['notify_email']) ? 0 : $options['notify_email'];
	$loginizer['notify_email_address'] = lz_is_multisite() ? get_site_option('admin_email') : get_option('admin_email');
	$loginizer['trusted_ips'] = empty($options['trusted_ips']) ? false : true;
	$loginizer['blocked_screen'] = empty($options['blocked_screen']) ? false : true;
	$loginizer['social_settings'] = get_option('loginizer_social_settings', []);
	
	if(!empty($options['notify_email_address'])){
		$loginizer['notify_email_address'] = $options['notify_email_address'];
		$loginizer['custom_notify_email'] = 1;
	}
	
	// Login Success Email Notification.
	$loginizer['login_mail'] = get_option('loginizer_login_mail', []);
	add_action('init', 'loginizer_load_translation_vars', 0);

	$loginizer['login_mail_subject'] = empty($loginizer['login_mail']['subject']) ? '' : $loginizer['login_mail']['subject'];
	$loginizer['login_mail_body'] = empty($loginizer['login_mail']['body']) ? '' : $loginizer['login_mail']['body'];

	// Load the blacklist and whitelist
	$loginizer['blacklist'] = get_option('loginizer_blacklist', []);
	$loginizer['whitelist'] = get_option('loginizer_whitelist', []);
	$loginizer['2fa_whitelist'] = get_option('loginizer_2fa_whitelist');
	
	// It should not be false
	if(empty($loginizer['2fa_whitelist'])){
		$loginizer['2fa_whitelist'] = array();
	}
	
	// When was the database cleared last time
	$loginizer['last_reset']  = get_option('loginizer_last_reset');

	if(!isset($loginizer['ultimate-member-active'])){
		$um_is_active = in_array('ultimate-member/ultimate-member.php', apply_filters('active_plugins', get_option('active_plugins', [])));
		
		$loginizer['ultimate-member-active'] = !empty($um_is_active) ? true : false;
	}
	
	//print_r($loginizer);
	
	// Clear retries
	if((time() - $loginizer['last_reset']) &gt;= $loginizer['reset_retries']){
		loginizer_reset_retries();
	}
	
	$ins_time = get_option('loginizer_ins_time');
	if(empty($ins_time)){
		$ins_time = time();
		update_option('loginizer_ins_time', $ins_time);
	}
	$loginizer['ins_time'] = $ins_time;
	
	// Set the current IP
	$loginizer['current_ip'] = lz_getip();
	
	// Is Brute Force Disabled ?
	$loginizer['disable_brute'] = get_option('loginizer_disable_brute');

	// Filters and actions
	if(empty($loginizer['disable_brute'])){
	
		// Use this to verify before WP tries to login
		// Is always called and is the first function to be called
		//add_action('wp_authenticate', 'loginizer_wp_authenticate', 10, 2);// Not called by XML-RPC
		add_filter('authenticate', 'loginizer_wp_authenticate', 10001, 3);// This one is called by xmlrpc as well as GUI
		
		// Is called when a login attempt fails
		// Hence Update our records that the login failed
		add_action('wp_login_failed', 'loginizer_login_failed');
		
		// Is called before displaying the error message so that we dont show that the username is wrong or the password
		// Update Error message
		add_action('wp_login_errors', 'loginizer_error_handler', 10001, 2);
		add_action('woocommerce_login_failed', 'loginizer_woocommerce_error_handler', 10001);
		add_action('wp_login', 'loginizer_login_success', 11, 2);
		add_action('rsssl_two_factor_user_authenticated', 'loginizer_rsssl_2fa_success');
		
		if(!empty($loginizer['ultimate-member-active'])){
			add_action('wp_login_failed', 'loginizer_ultimatemember_error_handler', 10001);
		}

		if(!empty($_COOKIE['lz_social_error']) &amp;&amp; !empty($loginizer['social_settings'])){
			add_filter('wp_login_errors', 'loginizer_social_login_error_handler', 10000, 2);
		}
	}
	
	// Social Login Form Actions
	if(!empty($loginizer['social_settings'])){
		if(!empty($loginizer['social_settings']['login']['login_form'])){
			add_action('login_form', 'loginizer_social_btn_login');
		}
	}

	if((function_exists('wp_doing_ajax') &amp;&amp; wp_doing_ajax()) || (defined( 'DOING_AJAX' ) &amp;&amp; DOING_AJAX)){
		include_once LOGINIZER_DIR . '/main/ajax.php';
	}

	if(is_admin()){
		include_once LOGINIZER_DIR . '/main/admin.php';
	}
	
	// ----------------
	// PRO INIT END
	// ----------------
	
	// Secuity checks for social login.
	if(!empty($_GET['lz_social_provider']) &amp;&amp; loginizer_can_login() &amp;&amp; empty($_GET['lz_api'])){
		add_action('init', 'loginizer_social_login_load');
		return;
	}
}

// Should return NULL if everything is fine
function loginizer_wp_authenticate($user, $username, $password){
	
	global $loginizer, $lz_error, $lz_cannot_login, $lz_user_pass;
	
	if(!empty($username) &amp;&amp; !empty($password)){
		$lz_user_pass = 1;
	}
	
	// Are you whitelisted ?
	if(loginizer_is_whitelisted()){
		$loginizer['ip_is_whitelisted'] = 1;
		return $user;

	} else if (!empty($loginizer['trusted_ips'])){
		$lz_cannot_login = 1;

		// This is used by WP Activity Log
		apply_filters( 'wp_login_blocked', $username );
		
		// Shows a blocked screen
		if(!empty($loginizer['blocked_screen'])){
			$lz_error['trusted_ip'] = __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer');
			loginizer_blocked_page($lz_error);
		}
		
		return new WP_Error('ip_blacklisted', __('You are restricted from logging in as your IP is not whitelisted.', 'loginizer'));
	}
	
	// Are you blacklisted ?
	if(loginizer_is_blacklisted()){
		$lz_cannot_login = 1;
		
		// This is used by WP Activity Log
		apply_filters( 'wp_login_blocked', $username );
		
		// Shows a blocked screen
		if(!empty($loginizer['blocked_screen'])){
			loginizer_blocked_page($lz_error);
		}
		
		return new WP_Error('ip_blacklisted', implode('', $lz_error), 'loginizer');
	}
	
	// Is the username blacklisted ?
	if(function_exists('loginizer_user_blacklisted')){
		if(loginizer_user_blacklisted($username)){
			$lz_cannot_login = 1;
		
			// This is used by WP Activity Log
			apply_filters( 'wp_login_blocked', $username );

			return new WP_Error('user_blacklisted', implode('', $lz_error), 'loginizer');
		}
	}
	
	if(loginizer_can_login()){
		return $user;
	}
	
	$lz_cannot_login = 1;

	// This is used by WP Activity Log
	apply_filters( 'wp_login_blocked', $username );
	
	// Shows a blocked screen
	if(!empty($loginizer['blocked_screen'])){
		loginizer_blocked_page($lz_error);
	}
	
	return new WP_Error('ip_blocked', implode('', $lz_error), 'loginizer');

}

function loginizer_can_login(){
	
	global $wpdb, $loginizer, $lz_error;
	
	// Get the logs
	$sel_query = $wpdb-&gt;prepare(&quot;SELECT * FROM `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs` WHERE `ip` = %s&quot;, $loginizer['current_ip']);
	$result = lz_selectquery($sel_query);
	
	if(!empty($result['count']) &amp;&amp; ($result['count'] % $loginizer['max_retries']) == 0){

		// Has he reached max lockouts ?
		if($result['lockout'] &gt;= $loginizer['max_lockouts']){
			$loginizer['lockout_time'] = $loginizer['lockouts_extend'];
		}
		
		// Is he in the lockout time ?
		if($result['time'] &gt;= (time() - $loginizer['lockout_time'])){
			$banlift = ceil((($result['time'] + $loginizer['lockout_time']) - time()) / 60);
			
			//echo 'Current Time '.date('d/M/Y H:i:s P', time()).'&lt;br /&gt;';
			//echo 'Last attempt '.date('d/M/Y H:i:s P', $result['time']).'&lt;br /&gt;';
			//echo 'Unlock Time '.date('d/M/Y H:i:s P', $result['time'] + $loginizer['lockout_time']).'&lt;br /&gt;';
			
			$_time = $banlift.' '.$loginizer['msg']['minutes_err'];
			
			if($banlift &gt; 60){
				$banlift = ceil($banlift / 60);
				$_time = $banlift.' '.$loginizer['msg']['hours_err'];
			}
			
			$lz_error['ip_blocked'] = $loginizer['msg']['lockout_err'].' '.$_time;
			
			if(!empty($loginizer['ultimate-member-active']) &amp;&amp; class_exists('UM')){ 
				\UM()-&gt;form()-&gt;add_error('blocked_msg', $lz_error['ip_blocked']);
			}
			return false;
		}
	}
	
	return true;
}

function loginizer_is_blacklisted(){
	
	global $wpdb, $loginizer, $lz_error;
	
	$blacklist = isset($loginizer['blacklist']) ? $loginizer['blacklist'] : [];
	
	if(empty($blacklist)){
		return false;
	}
	
	$current_ip_inet = inet_ptoi($loginizer['current_ip']);

	foreach($blacklist as $k =&gt; $v){

		$start_inet = inet_ptoi($v['start']);
		$end_inet = inet_ptoi($v['end']);

		// Is the IP in the blacklist ?
		if($start_inet &lt;= $current_ip_inet &amp;&amp; $current_ip_inet &lt;= $end_inet){
			$result = 1;
			break;
		}

		// Is it in a wider range ?
		if($start_inet &gt;= 0 &amp;&amp; $end_inet &lt; 0){
			
			// Since the end of the RANGE (i.e. current IP range) is beyond the +ve value of inet_ptoi, 
			// if the current IP is &lt;= than the start of the range, it is within the range
			// OR
			// if the current IP is &lt;= than the end of the range, it is within the range
			if($start_inet &lt;= $current_ip_inet
				|| $current_ip_inet &lt;= $end_inet){				
				$result = 1;
				break;
			}
			
		}
		
	}

	// You are blacklisted
	if(!empty($result)){
		$lz_error['ip_blacklisted'] = $loginizer['msg']['ip_blacklisted'];
		return true;
	}
	
	return false;
	
}

// When the login fails, then this is called
// We need to update the database
function loginizer_login_failed($username, $is_2fa = ''){
	
	global $wpdb, $loginizer, $lz_cannot_login;
	
	// Some plugins are changing the value for username as null so we need to handle it before using it for the INSERT OR UPDATE query
	if(empty($username) || is_null($username)){
		$username = '';
	}
	
	$fail_type = 'Login';
	
	if(!empty($is_2fa)){
		$fail_type = '2FA';
	}

	if(empty($lz_cannot_login) &amp;&amp; empty($loginizer['ip_is_whitelisted']) &amp;&amp; empty($loginizer['no_loginizer_logs'])){
		
		// The params which comes when social login returns an error, have some characters, which WordPress could not save.
		// REQUEST_URI / HTTP_HOST are not always set (WP-CLI, some CGI and XML-RPC setups)
		$server_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
		$http_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
		
		if(!empty($server_uri) &amp;&amp; strpos($server_uri, 'lz_social_provider') !== FALSE){
			$request_uri = explode('=', $server_uri);
			$server_uri = $request_uri[0];
		}

		// No addslashes() here, $wpdb-&gt;prepare() below does the escaping
		$url = esc_url((!empty($_SERVER['HTTPS']) ? 'https://' : 'http://').$http_host.$server_uri);
		
		// Must never be 0, we divide by it below
		$max_retries = (int) $loginizer['max_retries'] &lt; 1 ? 1 : (int) $loginizer['max_retries'];
		
		// This way is atomic now, the earlier one were causing race condition.
		// NOTE : In the UPDATE part `count` is already the new value, as MySQL / MariaDB
		// evaluate the assignments from left to right, so lockout must NOT add 1 again
		$upsert = $wpdb-&gt;prepare(
			&quot;INSERT INTO `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs`
				(username, time, count, ip, lockout, url)
			VALUES
				(%s, %d, 1, %s, FLOOR(1 / %d), %s)
			ON DUPLICATE KEY UPDATE
				username = VALUES(username),
				time = VALUES(time),
				count = count + 1,
				lockout = FLOOR(count / %d),
				url = VALUES(url)&quot;,
			$username,
			time(),
			$loginizer['current_ip'],
			$max_retries,
			$url,
			$max_retries
		);
		$wpdb-&gt;query($upsert);

		// Re-read the persisted row so email/retries-left reflect the actual count
		$sel_query = $wpdb-&gt;prepare(&quot;SELECT * FROM `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs` WHERE `ip` = %s&quot;, $loginizer['current_ip']);
		$result = lz_selectquery($sel_query);

		if(empty($result)){
			$result = array('count' =&gt; 0);
		}

		$count = (int) $result['count'];
		$lockout = !empty($result['lockout']) ? (int) $result['lockout'] : 0;

		// The lockout goes up only on every max_retries'th failure, which is the
		// attempt that actually locks the IP out. On the failures in between there
		// is nothing new to report, so we must not email on each one of them
		$is_new_lockout = !empty($count) &amp;&amp; ($count % $max_retries) == 0;

		// Do we need to email admin ?
		if(!empty($loginizer['notify_email']) &amp;&amp; !empty($is_new_lockout) &amp;&amp; $lockout &gt;= $loginizer['notify_email']){

			$lockout_time = $loginizer['lockout_time'];

			if($lockout &gt;= $loginizer['max_lockouts']){
				$lockout_time = $loginizer['lockouts_extend'];
			}

			$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
			$mail = array();
			$mail['to'] = $loginizer['notify_email_address'];
			$mail['subject'] = 'Failed '.$fail_type.' Attempts from IP '.$loginizer['current_ip'].' ('.$sitename.')';
			$mail['message'] = 'Hi,

'.(int) $result['count'].' failed '.strtolower($fail_type).' attempts and '.$lockout.' lockout(s) from IP '.$loginizer['current_ip'].' on your site :
'.home_url().'

Last '.$fail_type.' Attempt : '.date('d/M/Y H:i:s P', time()).'
Last User Attempt : '.$username.'
IP has been blocked until : '.date('d/M/Y H:i:s P', time() + $lockout_time).'

Regards,
Loginizer';

			@wp_mail($mail['to'], $mail['subject'], $mail['message']);
		}

		loginizer_update_attempt_stats(0);
		$loginizer['retries_left'] = $max_retries - ($count % $max_retries);
		$loginizer['retries_left'] = $loginizer['retries_left'] == $max_retries ? 0 : $loginizer['retries_left'];
		
	}
}

function loginizer_rsssl_2fa_success($user){
	loginizer_login_success('', $user);
}

function loginizer_login_success($user_login, $user) {
	global $wp_version, $loginizer;

	loginizer_update_attempt_stats(1);
	
	if(empty($loginizer['login_mail'])){
		return;
	}

	if(empty($loginizer['login_mail']['enable'])){
		return;
	}

	if(!empty($loginizer['login_mail']['disable_whitelist'])){
		// Check its whitelist ip
		if(loginizer_is_whitelisted()){
			return;
		}
	}

	if(empty($user_login) &amp;&amp; empty($user)){
		error_log('Loginizer: No user information to send email');
		return;
	}

	if(empty($user)){
		$user = get_user_by('login', $user_login);
	}

	if(empty($user)){
		error_log('Loginizer: Unable to get the user');
		return;
	}

	if(empty($loginizer['login_mail']['roles']) || !is_array($loginizer['login_mail']['roles'])){
		return;
	}

	// Check if the user role is enabled for email notification.
	if(!array_intersect($user-&gt;roles, $loginizer['login_mail']['roles'])){
		return;
	}

	// current_datetime &amp; wp_timezone_string were introduced in WordPress 5.3
	if(!empty($wp_version) &amp;&amp; version_compare($wp_version, '5.3', '&gt;') &amp;&amp; function_exists('current_datetime')){
		$time_zone = wp_timezone_string();

		if(!empty($time_zone) &amp;&amp; isset($time_zone[1]) &amp;&amp; is_numeric($time_zone[1])){
			$time_zone = 'UTC'.$time_zone;
		}

		// Setting up data variables.
		$date = current_datetime()-&gt;format('Y-m-d H:i:s') .' '. $time_zone;
	} else {
		$date = date(&quot;Y-m-d H:i:s&quot;, time()) . ' ' . date_default_timezone_get();
	}

	$sitename = lz_is_multisite() ? get_site_option('site_name') : get_option('blogname');
	$email = $user-&gt;data-&gt;user_email;

	$vars = array(
		'date' =&gt; $date,
		'ip' =&gt; esc_html($loginizer['current_ip']),
		'sitename' =&gt; $sitename,
		'user_login' =&gt; $user_login
	);

	$message = lz_lang_vars_name($loginizer['login_mail_body'], $vars);
	$subject = lz_lang_vars_name($loginizer['login_mail_subject'], $vars);
	
	$headers = [];
	
	// Do we need to send the email as HTML ? 
	if(!empty($loginizer['login_mail']['html_mail'])){
		$headers[] = 'Content-Type: text/html; charset=UTF-8';
		
		if(!empty($loginizer['login_mail']['body'])){
			$message = html_entity_decode($message);
		}else{
			$message = preg_replace(&quot;/\&lt;br\s*\/\&gt;/i&quot;, &quot;&lt;br/&gt;&quot;, $message);
			$message = preg_replace('/(?&lt;!&lt;br\/&gt;)\n/i', &quot;&lt;br/&gt;\n&quot;, $message);
		}
	}

	// Sending notification
	if(empty(wp_mail($email, $subject, $message, $headers))){
		error_log(__('There was a problem sending your email.', 'loginizer'));
		return;
	}
}

function loginizer_update_attempt_stats($type){

	$stats = get_option('loginizer_login_attempt_stats', []);
	$time = strtotime(date('Y-m-d H:00:00'));
	
	if(empty($stats[$time][$type])){
		$stats[$time][$type] = 0;
	}

	$stats[$time][$type] += 1;

	update_option('loginizer_login_attempt_stats', $stats, false);
}

// Handles the error of the password not being there
function loginizer_error_handler($errors, $redirect_to){
	
	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;

	//echo 'loginizer_error_handler :';print_r($errors-&gt;errors);echo '&lt;br&gt;';
	if(is_null($errors) || empty($errors)){
		return true;
	}

	// Remove the empty password error
	if(is_wp_error($errors)){
		
		$codes = $errors-&gt;get_error_codes();
		
		foreach($codes as $k =&gt; $v){
			if($v == 'invalid_username' || $v == 'incorrect_password'){
				$show_error = 1;
			}
		}
		
		$errors-&gt;remove('invalid_username');
		$errors-&gt;remove('incorrect_password');
	
		// Add the error
		if(!empty($lz_user_pass) &amp;&amp; !empty($show_error) &amp;&amp; empty($lz_cannot_login)){
			$errors-&gt;add('invalid_userpass', '&lt;b&gt;ERROR:&lt;/b&gt; ' . $loginizer['msg']['inv_userpass']);
		}
		
		// Add the number of retires left as well
		if(count($errors-&gt;get_error_codes()) &gt; 0 &amp;&amp; isset($loginizer['retries_left'])){
			$errors-&gt;add('retries_left', loginizer_retries_left());
		}

	}
	
	return $errors;
	
}

// Handles the error of the password not being there
function loginizer_woocommerce_error_handler(){

	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	
	if(function_exists('wc_add_notice')){
		wc_add_notice( loginizer_retries_left(), 'error' );
	}
}

function loginizer_ultimatemember_error_handler(){
	
	if(class_exists('UM')){ 
		\UM()-&gt;form()-&gt;add_error('remaining_tries', loginizer_retries_left());
	}
}

// Handles social login URL
function loginizer_social_login_error_handler($errors = '', $redirect_to = ''){
	global $loginizer;
	
	if(loginizer_is_blacklisted()){
		return $errors;
	}

	loginizer_get_social_error();

	if(empty($loginizer['social_errors'])){
		return $errors;
	}

	if(is_null($errors) || empty($errors) || !is_wp_error($errors)){
		$errors = new WP_Error();
	}

	foreach($loginizer['social_errors'] as $key =&gt; $text){
		$errors-&gt;add($key, $text);
	}

	return $errors;
}

// Returns a string with the number of retries left
function loginizer_retries_left(){
	
	global $wpdb, $loginizer, $lz_user_pass, $lz_cannot_login;
	
	// If we are to show the number of retries left
	if(isset($loginizer['retries_left'])){
		$retries_left = apply_filters('loginizer_retries_left_num', $loginizer['retries_left']);
		
		return '&lt;b&gt;'.esc_html($retries_left).'&lt;/b&gt; '.$loginizer['msg']['attempts_left'];
	}
	
}

function loginizer_reset_retries(){

	global $wpdb, $loginizer;

	$deltime = time() - $loginizer['reset_retries'];

	$del_query = $wpdb-&gt;prepare(&quot;DELETE FROM `&quot;.$wpdb-&gt;prefix.&quot;loginizer_logs` WHERE `time` &lt;= %d&quot;, $deltime);
	$result = $wpdb-&gt;query($del_query);

	update_option('loginizer_last_reset', time());

}

function loginizer_load_translation_vars(){
	global $loginizer;
	
	$loginizer['login_mail_default_sub'] = __('Login Successful at $sitename', 'loginizer');
	$loginizer['login_mail_default_msg'] = __('Hello $user_login,

Your account was recently logged in from the IP : $ip
Time : $date 
If it was not you who logged in then please report this to us immediately.

Regards,
$sitename','loginizer');

	if(empty($loginizer['login_mail_subject'])){
		$loginizer['login_mail_subject'] = $loginizer['login_mail_default_sub'];
	}
	
	if(empty($loginizer['login_mail_body'])){
		$loginizer['login_mail_body'] = $loginizer['login_mail_default_msg'];
	}
	
	// Default messages
	$loginizer['d_msg']['inv_userpass'] = __('Incorrect Username or Password', 'loginizer');
	$loginizer['d_msg']['ip_blacklisted'] = __('Your IP has been blacklisted', 'loginizer');
	$loginizer['d_msg']['attempts_left'] = __('attempt(s) left', 'loginizer');
	$loginizer['d_msg']['lockout_err'] = __('You have exceeded maximum login retries&lt;br /&gt; Please try after', 'loginizer');
	$loginizer['d_msg']['minutes_err'] = __('minute(s)', 'loginizer');
	$loginizer['d_msg']['hours_err'] = __('hour(s)', 'loginizer');
	
	// Message Strings
	$loginizer['msg'] = get_option('loginizer_msg', []);
	
	foreach($loginizer['d_msg'] as $lk =&gt; $lv){
		if(empty($loginizer['msg'][$lk])){
			$loginizer['msg'][$lk] = $loginizer['d_msg'][$lk];
		}
	}
	
	$loginizer['2fa_d_msg']['otp_app'] = __('Please enter the OTP as seen in your App', 'loginizer');
	$loginizer['2fa_d_msg']['otp_email'] = __('Please enter the OTP emailed to you', 'loginizer');
	$loginizer['2fa_d_msg']['otp_field'] = __('One Time Password', 'loginizer');
	$loginizer['2fa_d_msg']['otp_question'] = __('Please answer your security question', 'loginizer');
	$loginizer['2fa_d_msg']['otp_answer'] = __('Your Answer', 'loginizer');
	
	// Message Strings
	$loginizer['2fa_msg'] = get_option('loginizer_2fa_msg', []);
	
	foreach($loginizer['2fa_d_msg'] as $lk =&gt; $lv){
		if(empty($loginizer['2fa_msg'][$lk])){
			$loginizer['2fa_msg'][$lk] = $loginizer['2fa_d_msg'][$lk];
		}
	}
	
}

function loginizer_social_login_load(){
	include_once LOGINIZER_DIR . '/main/social-login.php';
}

// Checks if softaculous is installed on the server.
function loginizer_check_softaculous(){

	// Checking if we have Softaculous installed?
	if(!preg_match('/^\/home(?:\d+)?\/.*\//U', ABSPATH, $matches)){
		return false;
	}

	if(empty($matches) || empty($matches[0])){
		return false;
	}

	$softaculous_path = $matches[0] . '.softaculous/installations.php';
	if(!file_exists($softaculous_path)){
		return false;
	}
	
	// Checking if users has changed the branding of Softaculous.
	$universal_file = '';
	// Plesk, ISPManager, ISPConfig, InterWorx, H-Sphere, CentOS Web Panel, Softaculous Remote and Softaculous Enterprise
	if(file_exists('/usr/local/softaculous/enduser/universal.php')){
		$universal_file = '/usr/local/softaculous/enduser/universal.php';
	}else if(file_exists('/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php')){
		$universal_file = '/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/enduser/universal.php';
	}else if(file_exists('/usr/local/directadmin/plugins/softaculous/enduser/universal.php')){
		$universal_file = '/usr/local/directadmin/plugins/softaculous/enduser/universal.php';
	}else if(file_exists('/usr/local/vesta/softaculous/enduser/universal.php')){
		$universal_file = '/usr/local/vesta/softaculous/enduser/universal.php';
	}

	if(empty($universal_file)){
		return false;
	}

	$universal = file_get_contents($universal_file);

	if(empty($universal)){
		return false;
	}

	// Checking if Softaculous is being whitelabeled
	if(preg_match('/\$globals\[[&quot;\']sn[&quot;\']\]\s.?=\s.?[&quot;\']Softaculous[&quot;\']/', $universal)){
		update_option('loginizer_softwp_upgrade', time());
	}

	return false;
}

// Sorry to see you going
register_uninstall_hook(LOGINIZER_FILE, 'loginizer_deactivation');

function loginizer_deactivation(){

global $wpdb;

	$sql = array();
	$sql[] = &quot;DROP TABLE &quot;.$wpdb-&gt;prefix.&quot;loginizer_logs;&quot;;

	foreach($sql as $sk =&gt; $sv){
		$wpdb-&gt;query($sv);
	}

	delete_option('loginizer_version');
	delete_option('loginizer_options');
	delete_option('loginizer_last_reset');
	delete_option('loginizer_whitelist');
	delete_option('loginizer_blacklist');
	delete_option('loginizer_msg');
	delete_option('loginizer_2fa_msg');
	delete_option('loginizer_2fa_email_template');
	delete_option('loginizer_security');
	delete_option('loginizer_wp_admin');
	delete_option('loginizer_csrf_promo_time');
	delete_option('loginizer_backuply_promo_time');
	delete_option('loginizer_promo_time');
	delete_option('loginizer_ins_time');
	delete_option('loginizer_2fa_whitelist');
	delete_option('loginizer_checksums_last_run');
	delete_option('loginizer_checksums_diff');
	delete_option('loginizer_ip_method');
	delete_option('loginizer_2fa_custom_redirect');
	delete_option('external_updates-loginizer-security');
	delete_option('loginizer_login_attempt_stats');

}</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fsitepad%2Feditor%2Fsite-data%2Fplugins%2Floginizer'>Back to Directory</a>