set -euo pipefail
WEB=/var/www/dulichdaohon/data/www/dulichdaohong.com
cd "$WEB"
TS=$(date +%Y%m%d-%H%M%S)
Q="/var/www/dulichdaohon/data/malware-quarantine-$TS"
mkdir -p "$Q"
echo "QUARANTINE=$Q"
# allow owner writes where needed
chmod u+w "$WEB" || true
# backup critical small files and metadata
{ pwd; date; wp core version --allow-root 2>/dev/null || wp core version || true; find . -maxdepth 2 -type f -printf '%TY-%Tm-%Td %TH:%TM %s %p\n' | sort -r | head -200; } > "$Q/scan-before.txt" 2>&1 || true
cp -a .htaccess wp-config.php "$Q/" 2>/dev/null || true
# collect checksum unexpected files (exclude wp-content for now)
(wp core verify-checksums --allow-root 2>&1 || true) > "$Q/wp-core-verify-before.txt"
awk -F': ' '/File should not exist:/ {print $2}' "$Q/wp-core-verify-before.txt" | sed 's#^./##' | sort -u > "$Q/unexpected-core-files.txt" || true
# add known malicious/suspicious root droppers
cat >> "$Q/unexpected-core-files.txt" <<'EOF'
about.php
content.php
radio.php
adminfuns.php
wp-conffq.php
wp-headre.php
wp-readme.php
wp-includes/vvwhvn.php
EOF
sort -u "$Q/unexpected-core-files.txt" -o "$Q/unexpected-core-files.txt"
# quarantine unexpected core/root files, not wp-content
while IFS= read -r f; do
  [ -z "$f" ] && continue
  case "$f" in wp-content/*) continue;; esac
  if [ -e "$f" ]; then
    mkdir -p "$Q/files/$(dirname "$f")"
    mv "$f" "$Q/files/$f" 2>/dev/null || { chmod u+w "$(dirname "$f")" 2>/dev/null || true; mv "$f" "$Q/files/$f" 2>/dev/null || true; }
    echo "moved $f"
  fi
done < "$Q/unexpected-core-files.txt" | tee "$Q/moved.log"
# reinstall WordPress core same version/locale if possible
VER=$(wp core version --allow-root 2>/dev/null || wp core version)
echo "Reinstall core $VER"
wp core download --version="$VER" --force --locale=vi --allow-root 2>&1 | tee "$Q/core-download.log" || wp core download --version="$VER" --force --allow-root 2>&1 | tee -a "$Q/core-download.log"
# restore wp-config and .htaccess if overwritten/missing
[ -f "$Q/wp-config.php" ] && cp -a "$Q/wp-config.php" wp-config.php
# scan wp-content for php in uploads and suspicious recent files
find wp-content/uploads -type f -name '*.php' -printf '%TY-%Tm-%Td %TH:%TM %s %p\n' 2>/dev/null | sort -r > "$Q/uploads-php.txt" || true
# quarantine PHP files inside uploads (usually malicious)
while read -r _date _time _size f; do
  [ -z "${f:-}" ] && continue
  mkdir -p "$Q/files/$(dirname "$f")"
  mv "$f" "$Q/files/$f" 2>/dev/null || true
  echo "moved upload php $f"
done < "$Q/uploads-php.txt" | tee "$Q/moved-uploads-php.log" || true
# plugin/theme info and checksum attempts
wp plugin list --allow-root 2>&1 | tee "$Q/plugin-list.txt" || true
wp theme list --allow-root 2>&1 | tee "$Q/theme-list.txt" || true
wp plugin verify-checksums --all --allow-root 2>&1 | tee "$Q/plugin-checksums.txt" || true
# deactivate obvious unknown plugin dirs with random names? only list for now.
# hardening htaccess for xmlrpc/readme/wp-config backups and php in uploads
cat > /tmp/htsec <<'EOF'
# BEGIN OpenClaw security hardening
<FilesMatch "^(xmlrpc\.php|readme\.html|license\.txt|wp-config\.php\.bak|wp-config\.php~|\.env)$">
Require all denied
</FilesMatch>
<FilesMatch "^(wp-config\.php)$">
Require all denied
</FilesMatch>
# END OpenClaw security hardening
EOF
if ! grep -q 'BEGIN OpenClaw security hardening' .htaccess 2>/dev/null; then cat /tmp/htsec .htaccess > .htaccess.new && mv .htaccess.new .htaccess; fi
mkdir -p wp-content/uploads
cat > wp-content/uploads/.htaccess <<'EOF'
<FilesMatch "\.php$">
Require all denied
</FilesMatch>
php_flag engine off
Options -ExecCGI
EOF
# final checks
(wp core verify-checksums --allow-root 2>&1 || true) > "$Q/wp-core-verify-after.txt"
wp option get siteurl --allow-root 2>/dev/null || true
wp option get home --allow-root 2>/dev/null || true
find . -maxdepth 3 -type f \( -name '*.php' -o -name '.*.php' \) -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %s %p\n' | sort -r > "$Q/recent-php-after.txt" || true
echo DONE