#!/bin/bash
echo "########## REMEDIATION START $(date) ##########"
DATE=20260712
Q=~/_quarantine_elysian_$DATE
BK=~/.maintenance-logs/backups-cluster128-$DATE
mkdir -p "$Q" "$BK" && echo "quarantaine=$Q  backups=$BK"
SITES="abtan amar assayag azogui lahmi lasvergnas medicalesthetique medina miquel nassif s-hombrouck smileart-ads zeitoun-saal"
STD='/(index|wp-config|wp-config-sample|wp-load|wp-blog-header|wp-cron|wp-login|wp-settings|wp-mail|wp-signup|wp-activate|wp-trackback|wp-comments-post|wp-links-opml|xmlrpc)\.php$'

echo "############ 0. BACKUP DB (best-effort, non bloquant) ############"
for src in medina medicalesthetique; do
  IFS=$'\t' read -r DBN DBU DBP DBH DBPT < <(php ~/_creds.php $src)
  [ -n "$DBN" ] || { echo "  creds $src KO -> skip dump"; continue; }
  CNF=$(mktemp)
  printf '[client]\nuser=%s\npassword=%s\nhost=%s\nport=%s\n' "$DBU" "$DBP" "$DBH" "$DBPT" > "$CNF"
  if mysqldump --defaults-extra-file="$CNF" --no-tablespaces --single-transaction "$DBN" > "$BK/$DBN.sql" 2>"$BK/$DBN.err"; then
    echo "  dump $DBN OK ($(wc -c <"$BK/$DBN.sql") o)"
  else
    echo "  dump $DBN ECHEC ($(head -1 "$BK/$DBN.err")) -> on continue (JSON uredik fera office de restore)"
  fi
  rm -f "$CNF"
done

echo "############ 1. NETTOYAGE FICHIERS (par site) ############"
for s in $SITES; do
  S=~/$s
  [ -f "$S/wp-config.php" ] || { echo "[$s] SKIP (pas de wp-config)"; continue; }
  echo "=== [$s] ==="
  cp -p "$S/wp-config.php" "$BK/$s-wp-config.php.bak"
  sed -i "/if (!defined('__LPK_IN__')) {/,/^}$/d" "$S/wp-config.php"
  if ! php -l "$S/wp-config.php" >/dev/null 2>&1; then
    echo "  wp-config lint KO -> restore + fallback (jusqu'a EOF)"
    cp -p "$BK/$s-wp-config.php.bak" "$S/wp-config.php"
    sed -i "/if (!defined('__LPK_IN__')) {/,\$d" "$S/wp-config.php"
    php -l "$S/wp-config.php" >/dev/null 2>&1 || { echo "  FALLBACK KO -> restore original (MANUEL)"; cp -p "$BK/$s-wp-config.php.bak" "$S/wp-config.php"; }
  fi
  if grep -q "__LPK_IN__\|linksparagon" "$S/wp-config.php"; then echo "  !! RESIDU wp-config"; else echo "  wp-config nettoye"; fi
  [ -f "$S/wp-content/mu-plugins/wp-security.php" ] && mv "$S/wp-content/mu-plugins/wp-security.php" "$Q/$s-wp-security.php" && echo "  backdoor mu-plugin -> quarantaine"
  for f in $(find -L "$S" -maxdepth 1 -name '*.php' 2>/dev/null | grep -vE "$STD"); do
    mv "$f" "$Q/$s-$(basename "$f")" && echo "  racine $(basename "$f") -> quarantaine"
  done
  for f in $(find -L "$S/wp-content" -maxdepth 1 -type f -regextype posix-extended -regex '.*/[0-9a-f]{10,}\.php' 2>/dev/null); do
    mv "$f" "$Q/$s-$(basename "$f")" && echo "  wp-content $(basename "$f") -> quarantaine"
  done
  if head -c 500 "$S/index.php" 2>/dev/null | grep -q "isGoogleUserAgent"; then
    mv "$S/index.php" "$Q/$s-index.php.doorway"
    cat > "$S/index.php" <<'IDXEOF'
<?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

define( 'WP_USE_THEMES', true );

require __DIR__ . '/wp-blog-header.php';
IDXEOF
    echo "  index.php doorway -> quarantaine + index.php propre"
  fi
  [ -f "$S/license.html" ] && mv "$S/license.html" "$Q/$s-license.html" && echo "  license.html -> quarantaine"
  [ -f "$S/google39141c274e829486.html" ] && mv "$S/google39141c274e829486.html" "$Q/$s-google39141c274e829486.html" && echo "  token GSC attaquant -> quarantaine"
  [ -d "$S/wp-content/plugins/wp-file-manager" ] && mv "$S/wp-content/plugins/wp-file-manager" "$Q/$s-wp-file-manager" && echo "  wp-file-manager -> quarantaine (RCE)"
  rm -rf "$S/wp-content/cache/"* 2>/dev/null
done

echo "############ 2. NETTOYAGE DB ############"
for s in $SITES; do php ~/_dbclean.php "$s"; done

echo "############ 3. CONTROLE FINAL ############"
echo "-- residus wp-config --"; for s in $SITES; do grep -lq "__LPK_IN__\|linksparagon" ~/$s/wp-config.php 2>/dev/null && echo "  RESTE: $s"; done; echo "  (rien = OK)"
echo "-- backdoor mu-plugin restant --"; find -L ~ -maxdepth 4 -name wp-security.php 2>/dev/null | grep mu-plugins; echo "  (rien = OK)"
echo "-- doorway restant --"; for s in $SITES; do head -c 500 ~/$s/index.php 2>/dev/null | grep -q isGoogleUserAgent && echo "  RESTE: $s"; done; echo "  (rien = OK)"
echo "-- quarantaine --"; ls -la "$Q" | tail -n +2 | wc -l | xargs echo "  fichiers en quarantaine:"
echo "########## REMEDIATION END $(date) ##########"