Last active
May 2, 2016 12:12
-
-
Save remcotolsma/0492204a81ea6c70695936857e1a07d1 to your computer and use it in GitHub Desktop.
WordPress find hacked content.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
define( 'WP_USE_THEMES', false ); | |
require './wp-blog-header.php'; | |
global $wpdb; | |
$search = 'position:absolute;'; | |
$query = " | |
SELECT | |
COUNT( ID ) | |
FROM | |
$wpdb->posts | |
WHERE | |
post_content LIKE %s | |
; | |
"; | |
$query = $wpdb->prepare( $query, '%' . $search . '%' ); | |
$count = $wpdb->get_var( $query ); | |
echo $count; | |
$query = " | |
SELECT | |
ID, | |
post_title, | |
post_content | |
FROM | |
$wpdb->posts | |
WHERE | |
post_content LIKE %s | |
LIMIT | |
0, 25 | |
; | |
"; | |
$query = $wpdb->prepare( $query, '%' . $search . '%' ); | |
$posts = $wpdb->get_results( $query ); | |
function fix_content( $content, $search ) { | |
$tag_xml = '<?xml encoding="utf-8" ?>'; | |
//$tag_doctype = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">'; | |
$document = DOMDocument::loadHTML( $tag_xml . $content ); | |
$xpath = new DOMXpath( $document ); | |
$elements = $xpath->query( sprintf( '//div[contains(@style,"%s")]', $search ) ); | |
foreach ( $elements as $element ) { | |
$search = $document->saveXML( $element ); | |
$content = str_replace( $search, '', $content ); | |
} | |
return $content; | |
} | |
?> | |
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" /> | |
<style type="text/css"> | |
pre { | |
white-space: normal; | |
width: 60em; | |
} | |
</style> | |
<style type="text/css"> | |
ins { | |
background-color: #c6ffc6; | |
text-decoration: none; | |
} | |
del { | |
background-color: #ffc6c6; | |
} | |
</style> | |
<script type="text/javascript" src="//code.jquery.com/jquery-1.9.1.js"></script> | |
<script type="text/javascript" src="http://google-diff-match-patch.googlecode.com/svn/trunk/javascript/diff_match_patch.js"></script> | |
<script type="text/javascript" src="https://rawgit.com/shikher/jQuery.PrettyTextDiff/01222bca2a130133168dd43c9c289322f7ed9e20/jquery.pretty-text-diff.js"></script> | |
<script type='text/javascript'> | |
$( window ).load( function() { | |
$( 'tr' ).prettyTextDiff( { | |
cleanup: false | |
} ); | |
} ); | |
</script> | |
<?php if ( $posts ) : ?> | |
<table class="table table-striped"> | |
<thead> | |
<tr> | |
<th scope="col">ID</th> | |
<th scope="col">Title</th> | |
<th scope="col">Content</th> | |
<th scope="col">Fixed</th> | |
<th scope="col">Diff</th> | |
<th scope="col">Updated</th> | |
</tr> | |
</thead> | |
<tbody> | |
<?php foreach ( $posts as $post ) : ?> | |
<tr> | |
<?php | |
$original = $post->post_content; | |
$changed = fix_content( $original, $search ) | |
?> | |
<td> | |
<?php echo esc_html( $post->ID ); ?> | |
</td> | |
<td> | |
<?php echo esc_html( $post->post_title ); ?> | |
</td> | |
<td> | |
<pre class="original"><?php echo esc_html( $original ); ?> | |
</td> | |
<td> | |
<pre class="changed"><?php echo esc_html( $changed ); ?></pre> | |
</td> | |
<td class="diff"> | |
</td> | |
<td> | |
<?php | |
if ( filter_input( INPUT_GET, 'fix', FILTER_VALIDATE_BOOLEAN ) ) { | |
$result = $wpdb->update( | |
$wpdb->posts, | |
array( | |
'post_content' => $changed, | |
), | |
array( | |
'ID' => $post->ID | |
), | |
array( | |
'%s', | |
), | |
array( | |
'%d', | |
) | |
); | |
echo esc_html( $result ); | |
} | |
?> | |
</td> | |
</tr> | |
<?php endforeach; ?> | |
</tbody> | |
</table> | |
<?php endif; ?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment