Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


  1. namespace MO_CAW\Common\Functionality;
  2. use MO_CAW\Common\Utils;
  3. use MO_CAW\Common\DB_Utils;
  4. use MO_CAW\Common\Constants;
  5. class SQL_API_Creation
  6. {
  7. public function __construct()
  8. {
  9. $yO = current_action();
  10. if (!(Constants::REST_API_INIT_HOOK === $yO)) {
  11. goto Z6;
  12. }
  13. $this->rest_init_functionalities();
  14. Z6:
  15. }
  16. protected function rest_init_functionalities()
  17. {
  18. $Pe = DB_Utils::get_configuration(array("type" => Constants::SQL_ENDPOINT));
  19. if (!isset($Pe[0])) {
  20. goto ci;
  21. }
  22. $this->register_rest_routes($Pe[0], $this);
  23. ci:
  24. }
  25. protected function register_rest_routes($RJ, $wF)
  26. {
  27. $Qi = $RJ["namespace"];
  28. $PG["endpoint_configuration"] = $RJ;
  29. register_rest_route($Qi, $RJ["connection_name"], array("methods" => \strtoupper($RJ["method"]), "callback" => array($wF, "sql_endpoint_callback"), "args" => $PG, "user" => wp_get_current_user(), "permission_callback" => array($wF, "authenticate_request")));
  30. }
  31. public function authenticate_request($uV)
  32. {
  33. return API_Security::authorize_custom_api_request($uV);
  34. }
  35. public function sql_endpoint_callback($uV)
  36. {
  37. $xz = $uV->get_attributes();
  38. $cQ = $uV->get_params();
  39. $q8 = $uV->get_body();
  40. $Ug = $uV->get_headers();
  41. $we = $uV->get_method();
  42. $A6 = $xz["args"]["endpoint_configuration"];
  43. $Xi = $A6["configuration"];
  44. $lF = $Xi["sql_queries"][0];
  45. $tN = !empty($Xi["response"]["response_content"]["success"]) ? json_decode($Xi["response"]["response_content"]["success"], true) : false;
  46. if ($A6["is_enabled"]) {
  47. goto kW;
  48. }
  49. $nm = array("status" => Constants::ERROR, "code" => 403, "error" => Constants::ENDPOINT_DEACTIVATED, "error_description" => Constants::API_DISABLED);
  50. wp_send_json($nm, 403);
  51. kW:
  52. if (\strtoupper(Constants::HTTP_GET) === $we || \strtoupper(Constants::HTTP_DELETE) === $we) {
  53. goto ZG;
  54. }
  55. if (\strtoupper(Constants::HTTP_POST) === $we || \strtoupper(Constants::HTTP_PUT) === $we) {
  56. goto o8;
  57. }
  58. $n9 = array("status" => Constants::ERROR, "code" => 400, "error" => Constants::INVALID_FORMAT, "error_description" => "Requested method is not registered using CUSTOM API for WP plugin.");
  59. wp_send_json($n9, 400);
  60. goto YE;
  61. ZG:
  62. $n9 = array("status" => Constants::ERROR, "code" => 400, "error" => Constants::INVALID_FORMAT, "error_description" => "Required arguments are missing or not passed in the correct format.");
  63. $T3 = $this->run_sql_query($cQ, $lF, $n9, $we);
  64. if (!(Constants::ERROR === $T3["status"])) {
  65. goto EF;
  66. }
  67. $tN = !empty($Xi["response"]["response_content"]["error"]) ? json_decode($Xi["response"]["response_content"]["error"], true) : false;
  68. EF:
  69. Utils::send_custom_api_response($T3, $tN);
  70. goto YE;
  71. o8:
  72. $n9 = array("status" => Constants::ERROR, "code" => 400, "error" => Constants::INVALID_FORMAT, "error_description" => "Required body parameters are missing or not passed in the correct format.");
  73. $ll = $Ug["content_type"][0] ?? '';
  74. $q8 = Utils::get_custom_api_curated_body($ll, $q8);
  75. if (!empty($q8)) {
  76. goto Dh;
  77. }
  78. wp_send_json($n9, 400);
  79. Dh:
  80. $T3 = $this->run_sql_query($q8, $lF, $n9, $we);
  81. if (!(Constants::ERROR === $T3["status"])) {
  82. goto Fg;
  83. }
  84. $tN = !empty($Xi["response"]["response_content"]["error"]) ? json_decode($Xi["response"]["response_content"]["error"], true) : false;
  85. Fg:
  86. Utils::send_custom_api_response($T3, $tN);
  87. YE:
  88. }
  89. private function run_sql_query($iY, $lF, $n9, $we)
  90. {
  91. $lF = $this->replace_dynamic_values($lF, $iY, $n9);
  92. return $this->execute_query($lF, $we);
  93. }
  94. protected function replace_dynamic_values($lF, $iY, $n9)
  95. {
  96. $Mn = "/{{[A-Za-z0-9-_]+}}/";
  97. preg_match_all($Mn, $lF, $uE);
  98. $Ql = array_unique($uE[0]);
  99. $Oa = count($iY);
  100. if (count($Ql) === $Oa) {
  101. goto pM;
  102. }
  103. wp_send_json($n9, 400);
  104. goto L6;
  105. pM:
  106. $Nm = 0;
  107. oz:
  108. if (!($Nm < $Oa)) {
  109. goto hX;
  110. }
  111. $mx = ltrim($Ql[$Nm], "{{");
  112. $mx = rtrim($mx, "}}");
  113. if (isset($iY[$mx]) && null !== $iY[$mx]) {
  114. goto ZT;
  115. }
  116. wp_send_json($n9, 400);
  117. goto Sg;
  118. ZT:
  119. $ng = is_int($iY[$mx]) ? $iY[$mx] : (string) $iY[$mx];
  120. $lF = str_replace($Ql[$Nm], $ng, $lF);
  121. Sg:
  122. qk:
  123. $Nm++;
  124. goto oz;
  125. hX:
  126. L6:
  127. return $lF;
  128. }
  129. protected function execute_query($lF, $we)
  130. {
  131. global $wpdb;
  132. $T3 = array();
  133. if (empty($lF)) {
  134. goto v9;
  135. }
  136. if (\strtoupper(Constants::HTTP_GET) === $we) {
  137. goto na;
  138. }
  139. $T3["data"] = $wpdb->query($lF);
  140. goto V0;
  141. na:
  142. $T3["data"] = $wpdb->get_results($lF);
  143. V0:
  144. v9:
  145. if ($wpdb->last_error) {
  146. goto gX;
  147. }
  148. $T3["status"] = Constants::SUCCESS;
  149. $T3["status_code"] = 200;
  150. goto IZ;
  151. gX:
  152. $T3["status"] = Constants::ERROR;
  153. $T3["status_code"] = 400;
  154. $T3["data"] = $wpdb->last_error;
  155. IZ:
  156. return $T3;
  157. }
  158. }



© 2023 Quttera Ltd. All rights reserved.