$status, 'message' => $message, 'data' => $data, ]); } else { header('Content-Type: text/html'); $page = << %%STATUS%%

%%STATUS%%

%%MESSAGE%% Go back to previous page
EOF; $page = str_replace('%%CLASS%%', $status, $page); $page = str_replace('%%STATUS%%', ucfirst($status), $page); $page = str_replace('%%MESSAGE%%', $message, $page); if ($data === TRUE) { $page = str_replace('%%GOBACK%%', '', $page); } else { $page = str_replace('%%GOBACK%%', 'hidden', $page); } echo $page; } die(); } /** * Show a specific page */ function v3_show_page($pagename = '', $args = []) { global $version; $page = ''; if ($pagename == 'menu') { $page = << xagio Recovery - Menu

Powered by Xagio $version

From here, you are able to disable/remove plugins or themes that cause issues on your website. Also, you can upgrade or downgrade Xagio installation.

EOF; } else if ($pagename == 'login') { $page = << xagio Recovery - Login

Powered by Xagio $version

Welcome to Xagio Recovery! To continue, please log in using your WordPress credentials!

EOF; } else { $page = 'Access Denied.'; } header('Content-Type: text/html'); foreach ($args as $arg => $val) { $page = str_replace('%%' . $arg . '%%', $val, $page); } echo $page; die(); } /** * Remove dir recursively */ function v3_remove_dir($dir) { if (is_dir($dir)) { $objects = scandir($dir); foreach ($objects as $object) { if ($object != "." && $object != "..") { if (is_dir($dir . "/" . $object)) v3_remove_dir($dir . "/" . $object); else @unlink($dir . "/" . $object); } } rmdir($dir); } } /** * Establishes a database connection */ global $wpdb; function v3_get_version() { global $wpdb; $row = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "XAGIO_CURRENT_VERSION"', ARRAY_A); return $row['option_value']; } function v3_get_option($field_name) { global $wpdb; $row = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "' . $field_name . '"', ARRAY_A); return @$row['option_value']; } function v3_db_communication() { global $table_prefix; // wp-config.php is neded for DB credentials // BUT, we create a clone of it, and comment out the require_once to // prevent wordpress errors from affecting this file if (!file_exists(XAG_DROP_PATH . 'wp-config-failsafe.php')) { file_put_contents(XAG_DROP_PATH . 'wp-config-failsafe.php', str_replace('require_once', '//require_once', file_get_contents(XAG_REC_ABS_PATH . 'wp-config.php'))); } require_once(XAG_DROP_PATH . 'wp-config-failsafe.php'); /** * WP Related vars */ if (!defined('WP_DEBUG')) { define('WP_DEBUG', FALSE); } if (!defined('WP_DEBUG_DISPLAY')) { define('WP_DEBUG_DISPLAY', FALSE); } // wp-db.php contains code for wpdb require_once(XAG_REC_ABS_PATH . 'wp-includes' . DIRECTORY_SEPARATOR . 'class-wp-error.php'); require_once(XAG_REC_ABS_PATH . 'wp-includes' . DIRECTORY_SEPARATOR . 'wp-db.php'); $wpdb = FALSE; $wpdb = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST); $wpdb->set_prefix($table_prefix); return $wpdb; } function mbstring_binary_safe_encoding($reset = FALSE) { static $encodings = []; static $overloaded = NULL; if (is_null($overloaded)) $overloaded = function_exists('mb_internal_encoding') && (ini_get('mbstring.func_overload') & 2); if (FALSE === $overloaded) return; if (!$reset) { $encoding = mb_internal_encoding(); array_push($encodings, $encoding); mb_internal_encoding('ISO-8859-1'); } if ($reset && $encodings) { $encoding = array_pop($encodings); mb_internal_encoding($encoding); } } function v3_unzip_file($zip_file) { // Check if download was a success if (file_exists($zip_file)) { // Now unzip the update if (class_exists('ZipArchive')) { $zip = new ZipArchive(); $res = $zip->open($zip_file); if ($res === TRUE) { @$zip->extractTo(XAG_PLUGIN_DIR); $zip->close(); } else { v3_send_output('error', 'ZipArchive failed to unzip the update zip.'); } } else { v3_send_output('error', 'ZipArchive is not installed.'); } } return file_exists(XAG_PATH); } function v3_download_file($location, $file) { if (file_exists($location)) { @unlink($location); } $fp = fopen($location, 'w+'); $ch = curl_init($file); curl_setopt($ch, CURLOPT_TIMEOUT, 60); curl_setopt($ch, CURLOPT_FILE, $fp); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE); curl_exec($ch); curl_close($ch); fclose($fp); } /** * Reset the mbstring internal encoding to a users previously set encoding. * * @see mbstring_binary_safe_encoding() * * @since 3.7.0 */ function reset_mbstring_encoding() { mbstring_binary_safe_encoding(TRUE); } function is_wp_error($thing) { return ($thing instanceof WP_Error); } function esc_sql($data) { global $wpdb; return $wpdb->_escape($data); } function wp_load_translations_early() { v3_send_output('error', 'Failed to connect to database.'); } function apply_filters($tag, $value) { return $value; } function has_filter($ignore = FALSE, $ignore2 = FALSE) { return TRUE; } function is_multisite() { if (defined('MULTISITE')) return MULTISITE; if (defined('SUBDOMAIN_INSTALL') || defined('VHOST') || defined('SUNRISE')) return TRUE; return FALSE; } /** * Check the provided username / password */ function v3_verify_auth() { global $wpdb; if (isset($_REQUEST['key'])) { $api_key = $_REQUEST['key']; $db_api_key = v3_get_option('XAGIO_API'); if ($db_api_key == $api_key) { return TRUE; } else { return FALSE; } } else if (isset($_POST['user'], $_POST['password'])) { // Check if the user exists $username = $wpdb->_escape($_POST['user']); $user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}users WHERE user_login = '$username' OR user_email = '$username';", ARRAY_A); if ($user === NULL) { v3_send_output('error', 'Invalid credentials, please try again.', TRUE); } require_once(XAG_REC_ABS_PATH . 'wp-includes' . DIRECTORY_SEPARATOR . 'class-phpass.php'); $wp_hasher = new PasswordHash(8, TRUE); $password = $_POST['password']; $check = $wp_hasher->CheckPassword($password, $user['user_pass']); if ($check == FALSE) { v3_send_output('error', 'Invalid credentials, please try again.', TRUE); } $_SESSION["loggedIn"] = TRUE; return TRUE; } else if (!isset($_SESSION["loggedIn"])) { return FALSE; } else { return $_SESSION["loggedIn"]; } } /** * Check for actions */ function v3_process_actions() { global $wpdb; if (!isset($_REQUEST['action'])) { return FALSE; } $action = $_REQUEST['action']; switch ($action) { case 'exit': $_SESSION["loggedIn"] = FALSE; v3_send_output('info', 'You have been logged out of recovery.'); break; case 'list-themes': $active_theme = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "template"', ARRAY_A); $active_theme = $active_theme['option_value']; chdir(XAG_THEME_DIR); $all_themes = array_filter(glob('*'), 'is_dir'); $formatted_themes = []; foreach ($all_themes as $theme) { if ($active_theme == $theme) { $formatted_themes[$theme] = TRUE; } else { $formatted_themes[$theme] = FALSE; } } v3_send_output('info', 'Theme data received.', $formatted_themes); break; case 'activate-theme': $theme = esc_sql($_POST['theme']); if (empty($theme)) { v3_send_output('error', 'Theme cannot be empty.'); } $wpdb->update($wpdb->prefix . 'options', [ 'option_value' => $theme, ], [ 'option_name' => 'template', ]); $wpdb->update($wpdb->prefix . 'options', [ 'option_value' => $theme, ], [ 'option_name' => 'stylesheet', ]); v3_send_output('info', 'Theme "' . $theme . '" has been activated.'); break; case 'delete-theme': $theme = esc_sql($_POST['theme']); if (empty($theme)) { v3_send_output('error', 'Theme cannot be empty.'); } v3_remove_dir(XAG_THEME_DIR . $theme); v3_send_output('info', 'Theme "' . $theme . '" has been removed.'); break; case 'list-plugins': $active_plugins = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "active_plugins"', ARRAY_A); $active_plugins = unserialize($active_plugins['option_value']); array_walk($active_plugins, function (&$item1, $key) { $item1 = dirname($item1); }); chdir(XAG_PLUGIN_DIR); $all_plugins = array_filter(glob('*'), 'is_dir'); $formatted_plugins = []; foreach ($all_plugins as $plugin) { if (in_array($plugin, $active_plugins)) { $formatted_plugins[$plugin] = TRUE; } else { $formatted_plugins[$plugin] = FALSE; } } v3_send_output('info', 'Plugin data received.', $formatted_plugins); break; case 'deactivate-plugin': $plugin = esc_sql($_POST['plugin']); if (empty($plugin)) { v3_send_output('error', 'Plugin cannot be empty.'); } $active_plugins = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "active_plugins"', ARRAY_A); $active_plugins = unserialize($active_plugins['option_value']); $new_active_plugins = []; foreach ($active_plugins as $plugin_dir) { $name = dirname($plugin_dir); if ($name != $plugin) { $new_active_plugins[] = $plugin_dir; } } $wpdb->update($wpdb->prefix . 'options', [ 'option_value' => serialize($new_active_plugins), ], [ 'option_name' => 'active_plugins', ]); v3_send_output('info', 'Plugin "' . $plugin . '" has been deactivated.'); break; case 'activate-plugin': $plugin = esc_sql($_POST['plugin']); if (empty($plugin)) { v3_send_output('error', 'Plugin cannot be empty.'); } $active_plugins = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "active_plugins"', ARRAY_A); $active_plugins = unserialize($active_plugins['option_value']); $active_plugins[] = $plugin . DIRECTORY_SEPARATOR . $plugin . '.php'; $wpdb->update($wpdb->prefix . 'options', [ 'option_value' => serialize($active_plugins), ], [ 'option_name' => 'active_plugins', ]); v3_send_output('info', 'Plugin "' . $plugin . '" has been activated.'); break; case 'delete-plugin': $plugin = esc_sql($_POST['plugin']); if (empty($plugin)) { v3_send_output('error', 'Plugin cannot be empty.'); } $active_plugins = $wpdb->get_row('SELECT * FROM ' . $wpdb->prefix . 'options WHERE option_name = "active_plugins"', ARRAY_A); $active_plugins = unserialize($active_plugins['option_value']); $new_active_plugins = []; foreach ($active_plugins as $plugin_dir) { $name = dirname($plugin_dir); if ($name != $plugin) { $new_active_plugins[] = $plugin_dir; } } $wpdb->update($wpdb->prefix . 'options', [ 'option_value' => serialize($active_plugins), ], [ 'option_name' => 'active_plugins', ]); v3_remove_dir(XAG_PLUGIN_DIR . $plugin); v3_send_output('info', 'Plugin "' . $plugin . '" has been removed.'); break; case 'upgrade-downgrade': $type = $_REQUEST['type']; $URL = 'https://app.xagio.net/api/download/Repo/' . $type; v3_download_file(XAG_PLUGIN_DIR . 'xagio.zip', $URL); if (v3_unzip_file(XAG_PLUGIN_DIR . 'xagio.zip')) { v3_send_output('info', 'Successfully upgraded/downgraded Xagio.'); } else { v3_send_output('error', 'Failed to upgrade/downgrade Xagio.'); } break; default: v3_send_output('error', 'Requested action does not exist.'); break; } return TRUE; } /** * Whether the request is ajax */ define('XAG_IS_AJAX', isset($_REQUEST['rmt'])); /** * Xagio Absolute Path */ define('XAG_PATH', '/home/advagaml/public_html/wp-content/plugins/xagio-seo' . DIRECTORY_SEPARATOR); /** * Get Dir Paths */ define('XAG_CONTENT_DIR', str_replace('plugins' . DIRECTORY_SEPARATOR . 'xagio-seo' . DIRECTORY_SEPARATOR, '', XAG_PATH)); define('XAG_PLUGIN_DIR', XAG_CONTENT_DIR . 'plugins' . DIRECTORY_SEPARATOR); define('XAG_THEME_DIR', XAG_CONTENT_DIR . 'themes' . DIRECTORY_SEPARATOR); $XAG_REC_ABS_PATH = ''; $XAG_REC_CURRENT_PATH = dirname(__FILE__) . '/'; $XAG_DROP_PATH = $XAG_REC_CURRENT_PATH; // if name of current directory is xagio if (basename($XAG_REC_CURRENT_PATH) == 'xagio-seo') { $XAG_REC_ABS_PATH = str_replace('/wp-content/plugins/xagio-seo', '', $XAG_REC_CURRENT_PATH) . '/'; } // Check if wp-load.php is present in the root directory if (!file_exists($XAG_REC_ABS_PATH . 'wp-load.php')) { // this is probably wp engine or something like that $XAG_REC_ABS_PATH = '/wordpress/'; } define('XAG_REC_ABS_PATH', $XAG_REC_ABS_PATH); define('XAG_DROP_PATH', $XAG_DROP_PATH); /** * Check if wp-config.php is present * if it is, continue with initialization */ if (file_exists(XAG_REC_ABS_PATH . 'wp-config.php')) { // Establish DB connection $wpdb = v3_db_communication(); // Get Psv3 Version $version = v3_get_version(); // Check if logged in if (v3_verify_auth()) { // Check if actions if (!v3_process_actions()) { // Show the log in screen v3_show_page('menu'); } } else { // Show the log in screen v3_show_page('login'); } } else { // wp-config.php is missing, possibly this file is in the wrong directory, or wp-config is missing. v3_send_output('error', 'Cannot find wp-config.php in ' . dirname(__FILE__) . '. Please make sure you have this file placed in your root directory, or if this file is indeed in the root directory, make sure wp-config.php is present.'); }