#!/bin/bash
BASE=/var/www
echo "ovh_audit_start"
echo "DOMAIN|WP|BACKDOOR|PLUGINS|CASINO_SPAM|MU_PLUGINS"
for d in $(ls $BASE 2>/dev/null | grep -vE '^_|^html|backup'); do
  P="$BASE/$d"
  [ ! -f "$P/wp-config.php" ] && continue
  WPU="sudo -u www-data wp --path=$P --allow-root --skip-themes --skip-plugins"
  # backdoor mu-plugin?
  bd="-"
  [ -f "$P/wp-content/mu-plugins/ultra-builder-live.php" ] && bd="ULTRA"
  # inne mu-plugins
  muc=$(ls "$P/wp-content/mu-plugins/"*.php 2>/dev/null | grep -v index.php | wc -l)
  # liczba wtyczek (katalogi)
  plc=$(ls -d "$P/wp-content/plugins/"*/ 2>/dev/null | wc -l)
  # spam kasynowy (data 2025-08-27 lub sluggi)
  spam=$($WPU db query "SELECT COUNT(*) FROM wp_posts WHERE post_type='post' AND post_status='publish' AND (post_date='2025-08-27 15:37:58' OR post_name REGEXP 'casino|deposit-bonus|free-spins|-slot') AND post_content NOT LIKE '%lvbet%'" --skip-column-names 2>/dev/null | tr -d '[:space:]')
  [ -z "$spam" ] && spam="?"
  # czy WP odpowiada
  wpok=$($WPU option get blogname 2>/dev/null >/dev/null && echo "OK" || echo "ERR")
  echo "$d|$wpok|$bd|$plc|$spam|$muc"
done
echo "ovh_audit_done"