IP Geo Block

• Fix issue: Add an option "Metadata Exploit Protection" in "Validation rules and behavior" section and make it disabled by default because it potentially caused "Sorry, your request cannot be accepted".
• Fix issue: Fix the issue that direct request to PHP files under plugins/themes directory was "404 Not found" when WP-ZEP enabled.
• Fix issue: Fix the incorrect link to the corresponding option page on error message in multisite environment.
• Improvement: Update the url to the google map api to prevent 301 redirection.
• Improvement: Use RIPE stat Data API to get whois information instead of using YQL (Yahoo! Query Language) which was retired on Jan. 3, 2019.

Sorry for the frequent update. * Fix issue: Remove wp_user_roles from "Metadata Exploit Protection" which was equipped in 3.0.17 because some plugins/themes would add their own role and capability without admin authority.

• Fix issue: Fixed the fatal error under certain condition.

• Fix issue: Inadequate verification of IPv4 with some CIDR notation.
• Fix issue: Insufficient path parsing for document root and content directory when real path and symbolic link were mixtured on virtual host.
• Fix issue: Unexpected blocking on admin dashboard when home url is different from site url.
• Fix issue: wp-signup.php was not blocked when only "Register" was enabled as "Target actions" at "Login form" in "Back-end target settings" section.
• Improvement: Improve compatibility with Advanced Access Manager.
• Improvement: Use comment syntax @codingStandardsIgnoreLine for deprecated function on PHP7+ to avoid false positive by some scanning tool like PHP Compatibility Checker. Hava a happy new year!

• Fix issue: Avoid the error of "Can not load Geolocation API libraries" caused by the race condition on upgrading this plugin.
• New feature: Enhance protecting against certain types of attacks by privilege escalation.
• New feature: Add a new option of "Network wide settings" in "Plugin settings" section to synchronize all the settings with the main blog on multisite.
• New feature: Add "Preset filters" using ip-geo-block-logs[-preset] filter hook to make analyze logs easy on "Logs" tab.
• Improvement: When pwd is set at "$_POST key to record with value" in "Privacy and record settings" section, mask the password in logs unless the login attempt is blocked.
• Improvement: Flush out the buffer of "Live update" on "Logs" tab when stop button is activated to avoid data remains.
• Improvement: Update the geolocation API service "geoip.nekudo.com" to "ipapi.com".
• Improvement: Update the class for Maxmind GeoLite Legacy databases to prepare against the upcoming expiry of support.
• See 3.0.17 release note for some details.

• Fix issue: Fix the issue that some functions did not work properly when "Validation timing" was set as "mu-plugins" (ip-geo-block-mu.php) under some conditions before WP 4.0.
• New feature: Add "Sites list" page at Network admin page to look through the status of the sites if this plugin is network activated on multisite.
• Improvement: Support Swift Performance Lite cache plugin with "Disk Cashe with PHP" caching mode.
• Improvement: Apply simulation mode to not only the front-end but also to the back-end.
• Improvement: Optimize SQL issuing to reduce some queries.
• See 3.0.16 release note for some details.

• Fix issue: Fix the issue that "Can not find Geolocation API libraries" error would always appear when once Geolite2, Maxmind and IP2Location were unselected.
• Fix issue: Fix the issue that https in ipstack.com is available only for premiums users.
• New feature: Introduce a new filter hook ip-geo-block-logs-preset that adds an UI of "Preset filters" at "Search in logs".
• Improvement: Prevent to make a cached page by WP Fastest Cache on blocking when "Validation timing" is "init" action hook.
• Improvement: Make the priofity of "UA string and qualification" is higher than that of "Block badly-behaved bots and crawlers" on public facing pages.
• Improvement: Update google charts based on the release note.
• Improvement: Always show "Google Maps API key" text box in "Plugin settings" section. If it is saved as empty, Google Maps API will no longer be used and a simple map will appear on "Search" tab.
• Improvement: Follow the change the RIPE whois format related to AS number.
• Improvement: Add UI to select the number of entries per page on IP address tables.
• Improvement: Multiple entries on IP address tables can be selected across the pages for bulk action.
• Improvement: Multiple Geolocation APIs can be selected on "Search" tab.
• Improvement: The country code of admin should not be cached if it's ZZ during initialization process.

• Deprecate: Remove the hotfix in 3.0.12.1 because of WordPress 4.9.7 Security and Maintenance Release.
• Fix issue: Local databases settings will be updated when Geolocation API folder can not be found on activation. (forum topic)
• Fix issue: Fix the issue of "ip_geo_block_cache doesn't exist" at activation on clean installation.
• Fix issue: Fix the issue that "Remove entries by IP address" did not work when "Anonymize IP address" in "Privacy and record settings" section was enabled.
• Fix issue: Ipdata.co became to require API key for registered user to make up to 1500 requests daily.
• Improvement: AES256 is applied to encrypt IP address if the algorithm is available. (PHP 5.3.3+)
• Improvement: Add "Do not send IP address to external APIs" apart from "Anonymize IP address" in "Privacy and record settings" section.

• Fix issue: Fix wrong handling of anonymized IPv6 on clicking a link or applying bulk actions.
• Fix issue: Fix the issue that added a server's country code which was not in "Whitelist of country code" but its IP address was in "Whitelist of extra IP addresses prior to country code" on activation. (forum topic)
• Fix issue: Fix the issue of "Fatal error: Call to undefined function" which caused 500 Internal error on admin screen under a certain condition.
• Fix issue: Fix the issue of undefined symbol for openssl in PHP 5.3.5 and under.
• New feature: Introduce an emergency login link in "Plugins settings" section.
• New feature: Introduce a new filter hook ip-geo-block-dns to specify the primary and secondary domain name resolvers.
• New feature: Introduce a new filter hook ip-geo-block-logs. (forum topic)
• New feature: Introduce a new drop-in file drop-in-admin.php in Geolocation API library folder.
• Improvement: Provide help links on "Settings" tab.
• Improvement: Sort out some related items in the section on "Settings" tab.
• Improvement: All the http had been replaced to https if possible.

• Issue fix: Unexpected blocking cause by an extra slash at the end of $_SERVER['DOCUMENT_ROOT'] that might be added by server's configuration. (forum topic)
• Issue fix: Human friendly error page now works properly. (forum topic)
• Issue fix: Fix the conflict with WP hide & Security Enhancer. (forum topic)
• Issue fix: Hotfix WordPress File Delete to Code Execution by RIPS Technologies.

• Improvement: Enhance "Privacy and record settings" where "Expiration time [sec] for Logs" can be specified.
• Improvement: Add "Export cache" in "Statistics in IP address cache" on "Statistics" tab.
• Fix: Fix some minor bugs.

• Improvement: To comply with GDPR, IP address in logs/cache will be always encrypted. The option of "Anonymize IP address" was renamed to "Privacy friendly" in "Privacy and record settings". It will not only anonymize an IP address but also will restrict on sending to the 3rd parties such as geolocation APIs and whois service.
• Improvement: Update geolocation APIs and add a new one.
• Improvement: Change the JavaScript compressor from Google Closure Compiler to UglifyJS 2 to prevent "Uncaught TypeError: Cannot read property toLowerCase of undefined" in a certain environment.
• Fix: Fix the issue that blocking occurred immediately instead of displaying the login page again when login failed, even the number of times did not exceed the limit.
• See 3.0.11 release note for some details.

• Fix: JavaScript error caused by bad handling form tag without method property. This error was happened with Wordfence Live Traffic.
• Fix: Inconsistent tags on the settings dashboard.
• Fix: "Add AS number to Whitelist/Blacklist" at "Bulk action" in "Statistics in cache" section on "Statistics" tab did not work properly because of illegal regular expression.
• Fix: Add a fallback function to support WP 3.7 and PHP before 5.3.

• Fix: Add a fallback process to add some fields into database table especially for MariaDB.
• Fix: Fatal error that would cause a blank page in PHP 5.3 and under or single site.
• Fix: Validation timing was not proper when redirection happened in admin context. (#36)

This release is intented to fix the issue reported at forum here and here.

If you still find the error "/plugins/ip-geo-block/classes/class-ip-geo-block-logs.php (837) Unknown column last in field list", please deactivate plugin once and activate again. You will see the same error message again, but the things should be fixed.

• New feature: Add "Block badly-behaved bots and crawlers" in "Front-end target settings" section that validates the frequency of request.
• Improvement: Add a help link to the document for some sections.
• Improvement: Add descriptions on "Target actions" at "Login form" in "Back-end target settings" section.
• Improvement: Add new descriptions "passUA" and "blockUA" for result in Logs to identify the reason when "UA string and qualification" is applied.
• Improvement: AS Number can be handled in "UA string and qualification".
• Improvement: Make WP cron job for "Auto updating" reliably in multisite environment.
• Improvement: Better logout compatibility for redirecting to the previous page after login.
• Improvement: Validate the prefix of IP address CIDR to prevent unexpected fatal error.
• Improvement: Prevent opening a new window on clicking "Visit Site" in the admin bar menu for multi site by multi domain type.
• Bug fix: Fix the issue of failing to retrieve client IP address from Chrome Data Saver.
• Bug fix: Fix the issue of illegal redirection after "Save Changes" on "Settings" => "General Settings" page.
• Bug fix: Fix the issue of unexpected blocking against the requests to plugins/themes area when "Force to load WP core" is enabled on windows server.
• Bug fix: Fix the issue that "Search now" was not available when google map failed to load.

• New featuer: Add CIDR calculator for IPv4 / IPv6.
• Improvement: Avoid blocking by wp-zep when IP address is private or loopback network.
• Improvement: Chnage the priority of internal action hook for better compatibility with other plugins/themes.
• Maintenance: Change the priority order of local geolocation databases.
• Bug fix: Fix the issue that the target action for login form on settings tab could not unchecked on saving changes.
• Bug fix: Fix some other minor bugs.
• See 3.0.9 release note for some details.

• Improvement: Use both Maxmind Legacy and GeoLite2 databases parallely.
• Improvement: Remove self IP address from cache on activation or upgrade to prevent blocking caused by 'ZZ' in cache.

• Bug fix: Update Geolocation API library for Maxmind GeoLite2.
• Bug fix: Fix the issue of potentially fatal error related to "Force to load WP core".

Sorry for frequent update but the following bug should be fixed. * Bug fix: Fix the bug that "Candidate actions/pages" at "Exceptions" in "Admin ajax/post" were not displayed.

• New feature: Add "Live update" mode on "Logs" tab.
• Improvement: List all the IP addresses in cache are now displayed and manageable on "Statistics" tab.
• Improvement: Add "Either blocked or passed" as a new condition for recording logs. It enables to verify the requests "passed" from the blacklisted countries or the countries not in the whitelist.
• Improvement: Add two new filter hooks to utilize Google APIs from native domain in China.
• See 3.0.5 release note for some details.

• Bug fix: Fix the issue that the emergent functionality didn't work when the number of login attempts reached to the limit.
• Bug fix: Fix the issue that the result would be always limited when "Max number of failed login attempts per IP address" is "Disabled".

• Improvement: Some minor refactoring for the future release.
• Improvement: Better throughput against attacks on admin area when "mu-plugins" (ip-geo-block-mu.php) is enable.
• Improvement: Avoid annoying error message related to private IP address.
• Bug fix: Fix the issue of excessive blocking by bad signature.
• Bug fix: Fix the issue of illegal usage of switch_to_blog(). See this notes on codex.
• Bug fix: Fix the issue of illegal JSON format on "Export settings".

• Improvement: Change the behavior of "Referrer Suppressor" not to open a new window on public facing pages.
• Improvement: Improve some of the descriptions of help text.
• Bug fix: Fix the bug of undefined symbol in admin class related to the Google Map API.
• Bug fix: Fix the bug of incompatible function arguments when the number of login fails reaches the limit.
• Bug fix: Fix the issue of not working blocking by country on specific pages correctly as the validation target.

• Bug fix: Blocking Wordfence scanning. (@)
• Bug fix: Illegal elimination of colon in text field for IP address. (@)
• Improved: Compatibility with PHP 7 that cause to feel relaxed. (@)
• Improved: Avoid resetting whitelist on update by InfiniteWP. (@)
• Trial feature: X-Robots-Tag HTTP header with noindex, nofollow for login page. (@)

• New feature: Add the function of blocking on front-end.
• New filter hook: Add ip-geo-block-public to extend validation on front-end.
• Improvement: Avoid conflict with "Open external links in a new window" plugin and some other reason to prevent duplicated window open. For more detail, see this discussion at support forum.
• Improvement: Better compatibility with some plugins, themes and widgets.
• Improvement: Deferred execution of SQL command to improve the response.
• Improvement: Make the response compatible with WP original when it is requested by GET method.
• See some details at release 3.0.0.

• Bug fix: Fix the blocking issue in some environments when upgrading from 2.2.9.1 to 3.0.0.
• Bug fix: Fix the blocking issue at opening a new window via context menu on dashboard.
• Bug fix: Fix the potential issue of 500 Internal error in cron job.
• Improvement: Revive 410 Gone for response code.
• Improvement: Prevent the issue of resetting matching rule and country code at upgrading.