<?php
/**
 * Auto Login WordPress Tanpa Password
 * Taruh di document root (sejajar dengan wp-config.php)
 * 
 * Cara pakai:
 *   https://domainanda.com/auto.php?u=admin&t=TOKENRAHASIA
 *   https://domainanda.com/auto.php?u=admin&t=TOKENRAHASIA&r=/wp-admin/edit.php
 * 
 * HAPUS FILE INI SETELAH SELESAI DIGUNAKAN!
 */

// ============================================
// KONFIGURASI — GANTI TOKEN DI BAWAH INI!
// ============================================
define('SECRET_TOKEN', 'ganti-token-ini-dengan-acak-32karakter');

// Batas waktu (detik) — mencegah brute force
define('MAX_ATTEMPTS', 5);
define('LOCKOUT_TIME', 900); // 15 menit

// ============================================
// MULAI PROSES
// ============================================

// Load WordPress
$wp_load_path = __DIR__ . '/wp-load.php';

if (!file_exists($wp_load_path)) {
    // Coba cari wp-load.php di subfolder (kalau WP di subdirektori)
    $dirs = glob(__DIR__ . '/*/wp-load.php');
    if (!empty($dirs)) {
        $wp_load_path = $dirs[0];
    } else {
        die('❌ wp-load.php tidak ditemukan. Pastikan file ini di document root WordPress.');
    }
}

require_once $wp_load_path;

// ============================================
// VALIDASI TOKEN
// ============================================
$token = isset($_GET['t']) ? trim($_GET['t']) : '';

if (empty($token) || !hash_equals(SECRET_TOKEN, $token)) {
    // Rate limiting sederhana
    $lock_file = sys_get_temp_dir() . '/wp_auto_login_lock';
    $attempts = file_exists($lock_file) ? (int) file_get_contents($lock_file) : 0;
    
    if ($attempts >= MAX_ATTEMPTS) {
        http_response_code(429);
        die('❌ Terlalu banyak percobaan. Coba lagi nanti.');
    }
    
    file_put_contents($lock_file, $attempts + 1);
    sleep(2); // Delay biar ga bisa brute force cepat
    
    http_response_code(403);
    die('❌ Token tidak valid.');
}

// Reset counter kalau token benar
$lock_file = sys_get_temp_dir() . '/wp_auto_login_lock';
if (file_exists($lock_file)) {
    @unlink($lock_file);
}

// ============================================
// VALIDASI USER
// ============================================
$username = isset($_GET['u']) ? sanitize_user($_GET['u']) : '';

if (empty($username)) {
    http_response_code(400);
    die('❌ Parameter "u" (username) wajib diisi.');
}

// Cari user berdasarkan login atau email
$user = get_user_by('login', $username);
if (!$user && is_email($username)) {
    $user = get_user_by('email', $username);
}

if (!$user) {
    http_response_code(404);
    die('❌ User "' . esc_html($username) . '" tidak ditemukan.');
}

// Cek user diblokir / spam
if (get_user_meta($user->ID, 'wp_user_level', true) === false && !user_can($user->ID, 'read')) {
    die('❌ User tidak memiliki izin login.');
}

// ============================================
// PROSES LOGIN
// ============================================

// Bersihkan sesi lama
wp_clear_auth_cookie();

// Set current user & auth cookie
wp_set_current_user($user->ID);
wp_set_auth_cookie($user->ID, true); // true = "remember me" 14 hari

// Trigger hook wp_login
do_action('wp_login', $user->user_login, $user);

// Log aktivitas (opsional)
$log_file = __DIR__ . '/auto-login.log';
$log_entry = sprintf(
    "[%s] IP: %s | User: %s (ID: %d) | UA: %s\n",
    date('Y-m-d H:i:s'),
    $_SERVER['REMOTE_ADDR'] ?? 'unknown',
    $user->user_login,
    $user->ID,
    substr($_SERVER['HTTP_USER_AGENT'] ?? 'unknown', 0, 100)
);
@file_put_contents($log_file, $log_entry, FILE_APPEND | LOCK_EX);

// ============================================
// REDIRECT
// ============================================
$redirect = isset($_GET['r']) ? $_GET['r'] : '/wp-admin/';

// Validasi redirect — hanya boleh path relatif (cegah open redirect)
if (strpos($redirect, 'http') === 0 || strpos($redirect, '//') === 0) {
    $redirect = '/wp-admin/';
}

// Pastikan redirect diawali slash
if (strpos($redirect, '/') !== 0) {
    $redirect = '/' . $redirect;
}

$redirect_url = home_url($redirect);

// Bersihkan output buffer biar ga ada warning yang ganggu redirect
if (ob_get_level()) {
    ob_end_clean();
}

wp_safe_redirect($redirect_url);
exit;