Mini Shell

#!/bin/bash

# Directory to search (defaults to current directory if not provided)
SEARCH_DIR="${1:-.}"

# Start date (edit this to control which files are affected)
START_DATE="2025-02-20"

# Specific PHP filenames to search for
TARGET_NAMES=("m.php" "index.php" "lanbai.php" "wp-the1me.php")

# Temp folder for saving index.php files
TEMP_DIR="/tmp/safe_index_backups_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$TEMP_DIR"

echo "=========================================="
echo "Scanning recursively under: $SEARCH_DIR"
echo "Targeting PHP files modified since: $START_DATE"
echo "Backup directory for index.php: $TEMP_DIR"
echo "=========================================="
echo

# Loop through each suspicious filename
for name in "${TARGET_NAMES[@]}"; do
    echo "🔍 Checking for: $name"
    
    # Use find recursively; handle filenames with spaces or special characters
    find "$SEARCH_DIR" -type f -name "$name" -newermt "$START_DATE" -print0 | while IFS= read -r -d '' file; do
        if [[ "$name" == "index.php" ]]; then
            # Backup the file instead of deleting
            REL_PATH="${file#$SEARCH_DIR/}"
            DEST_DIR="$TEMP_DIR/$(dirname "$REL_PATH")"
            mkdir -p "$DEST_DIR"
            echo "📦 Moving index.php -> $DEST_DIR/"
            mv "$file" "$DEST_DIR/"
        else
            # Delete all other suspicious PHP files
            echo "🗑️  Deleting: $file"
            rm -f "$file"
        fi
    done

    echo
done

echo "✅ Done!"
echo "All index.php files moved to: $TEMP_DIR"