<?php
/**
 * Upload sebagai patcher.php, akses sekali dari browser.
 * Akan memasang MU-plugin lalu menghapus dirinya sendiri.
 */

@ini_set('display_errors', '0');
error_reporting(E_ALL);

function gf_path($path) {
    return rtrim(str_replace('\\', '/', $path), '/');
}

function gf_is_wp_root($path) {
    $path = gf_path($path);

    return is_dir($path)
        && is_file($path . '/wp-load.php')
        && is_dir($path . '/wp-content');
}

function gf_find_wp_root($start_dir) {
    $real = realpath($start_dir);

    if ($real === false) {
        return false;
    }

    $current = gf_path($real);

    /*
     * Cari dari folder patcher.php, lalu naik ke semua parent.
     * public_html/patcher.php -> public_html
     * wp-content/backup/a/patcher.php -> root WP
     */
    while ($current !== '' && $current !== '/' && $current !== '.') {
        if (gf_is_wp_root($current)) {
            return $current;
        }

        $parent = gf_path(dirname($current));

        if ($parent === $current) {
            break;
        }

        $current = $parent;
    }

    /*
     * Fallback kalau patcher berada di bawah wp-content.
     * /home/user/public_html/wp-content/x/patcher.php
     * -> /home/user/public_html
     */
    $path = gf_path($real) . '/';
    $pos = strpos($path, '/wp-content/');

    if ($pos !== false) {
        $candidate = substr($path, 0, $pos);

        if (gf_is_wp_root($candidate)) {
            return gf_path($candidate);
        }
    }

    return false;
}

function gf_remove_self($file) {
    if (@unlink($file)) {
        return 'DELETED';
    }

    /*
     * Jika unlink tidak diizinkan, ubah extension agar tidak bisa
     * dieksekusi sebagai PHP lagi. Hapus manual bila perlu.
     */
    $disabled = dirname($file)
        . '/.'
        . basename($file)
        . '.disabled-'
        . substr(sha1(uniqid(mt_rand(), true)), 0, 12)
        . '.txt';

    if (@rename($file, $disabled)) {
        @chmod($disabled, 0000);
        return 'RENAMED_DISABLED: ' . $disabled;
    }

    @chmod($file, 0000);

    return 'DELETE_FAILED: ' . $file;
}

$installer = realpath(__FILE__);

if ($installer === false) {
    $installer = __FILE__;
}

$wp_root = gf_find_wp_root(dirname($installer));

if ($wp_root === false) {
    header('Content-Type: text/plain; charset=utf-8');
    exit('ERROR: WordPress root tidak ditemukan.');
}

$mu_dir = $wp_root . '/wp-content/mu-plugins';

if (!is_dir($mu_dir)) {
    if (!@mkdir($mu_dir, 0755, true) && !is_dir($mu_dir)) {
        header('Content-Type: text/plain; charset=utf-8');
        exit('ERROR: Gagal membuat: ' . $mu_dir);
    }
}

if (!is_writable($mu_dir)) {
    header('Content-Type: text/plain; charset=utf-8');
    exit('ERROR: Folder tidak writable: ' . $mu_dir);
}

$target = $mu_dir . '/wp2shell-single-point-mitigation.php';

$plugin = <<<'PHP'
<?php
/**
 * Plugin Name: wp2shell Single-Point Mitigation
 * Description: Menolak request batch REST API tanpa autentikasi.
 * Version: 1.0.0
 */

defined('ABSPATH') || exit;

if (!function_exists('gf_deny_unauth_batch_route')) {
    function gf_deny_unauth_batch_route($result, $server, $request) {
        if (!class_exists('WP_REST_Request') || !($request instanceof WP_REST_Request)) {
            return $result;
        }

        $route = $request->get_route();

        if (function_exists('untrailingslashit')) {
            $route = untrailingslashit($route);
        } else {
            $route = rtrim($route, '/');
        }

        if (strtolower($route) !== '/batch/v1') {
            return $result;
        }

        if (function_exists('is_user_logged_in') && is_user_logged_in()) {
            return $result;
        }

        return new WP_Error(
            'batch_requires_auth',
            'Batch REST API tidak diperbolehkan tanpa login.',
            array('status' => 401)
        );
    }

    add_filter('rest_pre_dispatch', 'gf_deny_unauth_batch_route', -1000, 3);
}
PHP;

/*
 * Tulis via temporary file lalu rename agar target tidak pernah
 * berada dalam kondisi setengah tertulis.
 */
$tmp = $target . '.tmp-' . substr(sha1(uniqid(mt_rand(), true)), 0, 12);

if (@file_put_contents($tmp, $plugin, LOCK_EX) === false) {
    header('Content-Type: text/plain; charset=utf-8');
    exit('ERROR: Gagal menulis temporary plugin.');
}

@chmod($tmp, 0644);

if (!@rename($tmp, $target)) {
    @unlink($tmp);

    header('Content-Type: text/plain; charset=utf-8');
    exit('ERROR: Gagal membuat MU-plugin.');
}

@chmod($target, 0644);

header('Content-Type: text/plain; charset=utf-8');

echo "SUCCESS\n";
echo "MU-plugin: " . $target . "\n";

/*
 * Output sukses dikirim dahulu. Setelah itu baru mencoba self-delete.
 */
@ob_flush();
@flush();

echo "Self-delete: " . gf_remove_self($installer) . "\n";