#!/bin/bash
BACKUP_DIR=~/backdoor_backup_server2
mkdir -p "$BACKUP_DIR"
REPORT=~/backdoor_clean_report_server2.txt
> "$REPORT"

while IFS= read -r file; do
  [ -f "$file" ] || continue
  backup_path="$BACKUP_DIR/$(echo "$file" | sed 's|/|_|g')"
  cp "$file" "$backup_path"

  result=$(php -r '
    $file = $argv[1];
    $content = file_get_contents($file);
    if (strpos($content, "<?php") !== 0) { echo "SKIP_NOT_PHP_START"; exit; }
    $pos = strpos($content, "\n");
    if ($pos === false) { echo "NO_NEWLINE"; exit; }
    $firstLine = substr($content, 0, $pos);
    $rest = substr($content, $pos);
    file_put_contents($file, "<?php" . $rest);
    echo "STRIPPED";
  ' "$file")

  lint=$(php -l "$file" 2>&1)
  if echo "$lint" | grep -q "No syntax errors"; then
    echo "$file -> $result -> OK...CLEANED" >> "$REPORT"
  else
    cp "$backup_path" "$file"
    echo "$file -> $result -> SYNTAX ERROR, RESTORED: $lint" >> "$REPORT"
  fi
done < ~/infected_server2.txt

echo ""
echo "=== สรุปผล ==="
total=$(wc -l < ~/infected_server2.txt)
cleaned=$(grep -c "OK...CLEANED" "$REPORT")
restored=$(grep -c "RESTORED" "$REPORT")
echo "ไฟล์ทั้งหมด: $total"
echo "เคลียร์สำเร็จ: $cleaned"
echo "แก้ไม่ได้/restore กลับ: $restored"
echo "ดู log เต็มที่ $REPORT"