<?php
/**
 * ================================================================================================
 * WORDPRESS EXPERT MALWARE SCANNER & CLEANER - PHP EDITION
 * ================================================================================================
 * 
 * Description: Scanner et nettoyeur de malware WordPress ultra-complet
 * Version: 3.0.0
 * Auteur: TeddyWP Expert Guide (https://teddywp.com/depannage-wordpress/)
 * License: GPL v3
 * 
 * Fonctionnalités:
 * - Interface web moderne et responsive
 * - Détection avancée de malware (patterns, heuristiques, ML)
 * - Analyse forensique approfondie
 * - Nettoyage intelligent et sécurisé
 * - Sécurisation post-infection
 * - API REST pour intégration
 * - Monitoring temps réel
 * - Rapports détaillés PDF/JSON
 * 
 * ================================================================================================
 */

// Configuration de sécurité
ini_set('max_execution_time', 0);
ini_set('memory_limit', '512M');
error_reporting(E_ALL);
set_time_limit(0);

/**
 * Classe principale du scanner de malware WordPress
 */
class WordPressMalwareScanner {
    
    // Configuration
    const VERSION = '3.0.0';
    const LOG_FILE = 'wp-malware-scanner.log';
    const QUARANTINE_DIR = 'quarantine';
    const BACKUP_DIR = 'backup';
    const REPORTS_DIR = 'reports';
    
    // Propriétés principales
    private $wp_path;
    private $scan_results = [];
    private $statistics = [
        'files_scanned' => 0,
        'infections_found' => 0,
        'backdoors_found' => 0,
        'injections_found' => 0,
        'suspicious_files' => 0,
        'cleaned_files' => 0,
        'quarantined_files' => 0
    ];
    
    // Patterns de détection malware
    private $malware_patterns = [
        // Backdoors
        'backdoor_eval' => '/eval\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)\s*\[.*?\]\s*\)/i',
        'backdoor_system' => '/system\s*\(\s*\$_(GET|POST|REQUEST)\s*\[.*?\]\s*\)/i',
        'backdoor_exec' => '/exec\s*\(\s*\$_(GET|POST|REQUEST)\s*\[.*?\]\s*\)/i',
        'backdoor_shell' => '/shell_exec\s*\(\s*\$_(GET|POST|REQUEST)\s*\[.*?\]\s*\)/i',
        'backdoor_passthru' => '/passthru\s*\(\s*\$_(GET|POST|REQUEST)\s*\[.*?\]\s*\)/i',
        'backdoor_assert' => '/assert\s*\(\s*\$_(GET|POST|REQUEST)\s*\[.*?\]\s*\)/i',
        'backdoor_base64' => '/eval\s*\(\s*base64_decode\s*\(/i',
        'backdoor_gzinflate' => '/eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(/i',
        'backdoor_str_rot13' => '/eval\s*\(\s*str_rot13\s*\(/i',
        'backdoor_create_function' => '/create_function\s*\(\s*[\'"][^\'\"]*[\'"]\s*,\s*\$_(GET|POST|REQUEST)/i',
        'backdoor_preg_replace' => '/preg_replace\s*\(\s*[\'"].*?e[\'"].*?\$_(GET|POST|REQUEST)/i',
        
        // Injections JavaScript malveillantes
        'js_injection_eval' => '/<script[^>]*>.*?eval\s*\(/i',
        'js_injection_unescape' => '/<script[^>]*>.*?unescape\s*\(/i',
        'js_injection_fromcharcode' => '/String\.fromCharCode\s*\(/i',
        'js_injection_document_write' => '/document\.write\s*\(\s*unescape/i',
        'js_injection_iframe_hidden' => '/<iframe[^>]*width\s*=\s*[\'"]?1[\'"]?[^>]*>/i',
        'js_injection_onclick' => '/onclick\s*=\s*[\'"].*?eval\s*\(/i',
        
        // Pharma hack
        'pharma_viagra' => '/viagra|cialis|levitra|pharmacy|prescription/i',
        'pharma_links' => '/<a[^>]*href=[\'"][^\'\"]*pharmacy[^\'\"]*[\'"]/i',
        
        // Redirections malveillantes
        'redirect_meta' => '/<meta[^>]*http-equiv\s*=\s*[\'"]refresh[\'"][^>]*url\s*=/i',
        'redirect_javascript' => '/window\.location\.href\s*=|document\.location\.replace/i',
        'redirect_header' => '/header\s*\(\s*[\'"]location:/i',
        
        // Code obfusqué
        'obfuscated_chr' => '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)/i',
        'obfuscated_hex' => '/\\\\x[0-9a-f]{2}/i',
        'obfuscated_base64_long' => '/[A-Za-z0-9+\/]{200,}/i',
        
        // Fichiers système sensibles
        'file_passwd' => '/\/etc\/passwd|\/etc\/shadow/i',
        'file_htaccess' => '/RewriteRule.*http:\/\/[^\/]*/i',
        
        // Fonctions dangereuses
        'dangerous_file_get_contents' => '/file_get_contents\s*\(\s*[\'"]https?:\/\//i',
        'dangerous_curl' => '/curl_exec\s*\(\s*\$[^)]*\)/i',
        'dangerous_fwrite' => '/fwrite\s*\(\s*fopen\s*\([^)]*\.php/i',
        'dangerous_move_uploaded' => '/move_uploaded_file\s*\([^)]*\.php/i',
        'dangerous_chmod_777' => '/chmod\s*\(\s*[^,]*,\s*0?777\s*\)/i',
    ];
    
    // Signatures de backdoors connus
    private $backdoor_signatures = [
        'c99shell' => 'c99shell|FilesMan|Safe Mode|eval\(gzinflate\(base64_decode',
        'r57shell' => 'r57shell|RST\(|\$_REQUEST\[\$_\]|eval\(\$_POST',
        'wso_shell' => 'WSO|WSOsetcookie|wso\d+|eval\(\$_\[\$_',
        'b374k' => 'b374k|0x62374b|preg_replace.*e.*\$_',
        'crystal_shell' => 'Crystal.*Shell|\$_=\$_GET|\$_\[\]=',
        'alfa_shell' => 'alfacgiapi|Edited By Alfa',
        'mini_shell' => 'mini.*shell|system\(\$_GET\[.*?\]\)',
        'idx_shell' => 'IndoXploit|idx_file|eval\(str_rot13',
        'adminer_shell' => 'eval\(gzinflate\(base64_decode.*adminer',
        'angel_shell' => 'Angel|AngelSecurityTeam',
        'fox_wso' => 'FoxWSO|FGS|eval\(\$_POST\[.*?\]\)',
        'sadrazam_shell' => 'Sadrazam|configration|eval\(base64_decode\(\$_POST',
        'jackal_shell' => 'Jackal.*Shell|eval\(\$_REQUEST\[.*?\]\)',
        'jspshell' => 'JspShell|eval\(new\(java\.lang\.String\)',
        'dark_security' => 'DarkSecurity.*Team|d4rk.*cr3w',
        'gfs_shell' => 'GFS.*shell|eval\(\$_\[\$_\]',
        'tryag_shell' => 'tryag.*shell|eval\(stripslashes\(\$_REQUEST',
        'w4ck1ng' => 'w4ck1ng|eval\(\$_POST\[.*?chr.*?\]',
        'versaf_shell' => 'Versaf|eval\(\$_POST\[".*?"\]\)',
        'fx29_shell' => 'Fx29Sh|eval\(\$_POST\[chr\(',
    ];
    
    // Extensions de fichiers à scanner
    private $scan_extensions = [
        'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar',
        'js', 'html', 'htm', 'htaccess', 'txt', 'inc', 'tpl', 'sql'
    ];
    
    // Dossiers à exclure du scan
    private $exclude_dirs = [
        '.git', '.svn', 'node_modules', 'vendor', 'cache', 'logs'
    ];
    
    /**
     * Constructeur
     */
    public function __construct($wp_path = null) {
        $this->wp_path = $wp_path ?: $this->detectWordPressPath();
        $this->initializeDirectories();
        $this->startSession();
    }
    
    /**
     * Détection automatique du chemin WordPress
     */
    private function detectWordPressPath() {
        $possible_paths = [
            dirname(__FILE__),
            dirname(dirname(__FILE__)),
            '/var/www/html',
            '/var/www/wordpress',
            $_SERVER['DOCUMENT_ROOT'] ?? ''
        ];
        
        foreach ($possible_paths as $path) {
            if (file_exists($path . '/wp-config.php') || file_exists($path . '/wp-settings.php')) {
                return realpath($path);
            }
        }
        
        throw new Exception('Installation WordPress non détectée. Veuillez spécifier le chemin.');
    }
    
    /**
     * Initialisation des répertoires de travail
     */
    private function initializeDirectories() {
        $dirs = [self::QUARANTINE_DIR, self::BACKUP_DIR, self::REPORTS_DIR];
        foreach ($dirs as $dir) {
            if (!is_dir($dir)) {
                mkdir($dir, 0755, true);
            }
        }
    }
    
    /**
     * Démarrage de session pour l'interface web
     */
    private function startSession() {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
    }
    
    /**
     * Logging centralisé
     */
    private function log($level, $message) {
        $timestamp = date('Y-m-d H:i:s');
        $log_entry = "[$timestamp] [$level] $message" . PHP_EOL;
        file_put_contents(self::LOG_FILE, $log_entry, FILE_APPEND | LOCK_EX);
    }
    
    /**
     * Validation de l'installation WordPress
     */
    public function validateWordPress() {
        if (!is_dir($this->wp_path)) {
            throw new Exception("Chemin WordPress invalide: {$this->wp_path}");
        }
        
        if (!file_exists($this->wp_path . '/wp-config.php') && !file_exists($this->wp_path . '/wp-settings.php')) {
            throw new Exception("Installation WordPress non détectée dans: {$this->wp_path}");
        }
        
        $this->log('INFO', "WordPress validé dans: {$this->wp_path}");
        return true;
    }
    
    /**
     * Obtenir les informations WordPress
     */
    public function getWordPressInfo() {
        $info = [
            'path' => $this->wp_path,
            'version' => 'Non détectée',
            'plugins' => [],
            'themes' => [],
            'users' => []
        ];
        
        // Version WordPress
        $version_file = $this->wp_path . '/wp-includes/version.php';
        if (file_exists($version_file)) {
            $content = file_get_contents($version_file);
            if (preg_match('/\$wp_version\s*=\s*[\'"]([^\'"]+)[\'"]/', $content, $matches)) {
                $info['version'] = $matches[1];
            }
        }
        
        // Plugins installés
        $plugins_dir = $this->wp_path . '/wp-content/plugins';
        if (is_dir($plugins_dir)) {
            $info['plugins'] = array_diff(scandir($plugins_dir), ['.', '..']);
        }
        
        // Thèmes installés
        $themes_dir = $this->wp_path . '/wp-content/themes';
        if (is_dir($themes_dir)) {
            $info['themes'] = array_diff(scandir($themes_dir), ['.', '..']);
        }
        
        return $info;
    }
    
    /**
     * Création de sauvegarde complète
     */
    public function createBackup() {
        $this->log('INFO', 'Création de la sauvegarde complète...');
        
        $backup_timestamp = date('Y-m-d_H-i-s');
        $backup_file = self::BACKUP_DIR . "/wp_backup_{$backup_timestamp}.tar.gz";
        
        // Sauvegarde des fichiers
        $exclude_dirs = implode(' --exclude=', $this->exclude_dirs);
        $command = "tar --exclude={$exclude_dirs} -czf {$backup_file} -C " . dirname($this->wp_path) . " " . basename($this->wp_path);
        
        exec($command, $output, $return_code);
        
        if ($return_code === 0) {
            $this->log('SUCCESS', "Sauvegarde créée: {$backup_file}");
            return $backup_file;
        } else {
            $this->log('ERROR', "Échec de la sauvegarde: " . implode("\n", $output));
            return false;
        }
    }
    
    /**
     * Calcul de l'entropie d'un fichier (détection code obfusqué)
     */
    private function calculateEntropy($data) {
        if (empty($data)) return 0;
        
        $char_counts = array_count_values(str_split($data));
        $data_length = strlen($data);
        $entropy = 0;
        
        foreach ($char_counts as $count) {
            $p = $count / $data_length;
            $entropy -= $p * log($p, 2);
        }
        
        return $entropy;
    }
    
    /**
     * Détection de patterns malware dans un fichier
     */
    private function scanMalwarePatterns($file_path, $content) {
        $threats = [];
        
        foreach ($this->malware_patterns as $pattern_name => $pattern) {
            if (preg_match($pattern, $content)) {
                $threats[] = [
                    'type' => 'pattern',
                    'name' => $pattern_name,
                    'severity' => $this->getPatternSeverity($pattern_name),
                    'description' => $this->getPatternDescription($pattern_name)
                ];
            }
        }
        
        return $threats;
    }
    
    /**
     * Détection de signatures de backdoors connus
     */
    private function scanBackdoorSignatures($file_path, $content) {
        $threats = [];
        
        foreach ($this->backdoor_signatures as $backdoor_name => $signature_pattern) {
            if (preg_match("/{$signature_pattern}/i", $content)) {
                $threats[] = [
                    'type' => 'backdoor',
                    'name' => $backdoor_name,
                    'severity' => 'critical',
                    'description' => "Backdoor connu détecté: {$backdoor_name}"
                ];
                $this->statistics['backdoors_found']++;
            }
        }
        
        return $threats;
    }
    
    /**
     * Analyse heuristique avancée
     */
    private function heuristicAnalysis($file_path, $content) {
        $threats = [];
        $suspicion_score = 0;
        
        // Analyse de l'entropie
        $entropy = $this->calculateEntropy($content);
        if ($entropy > 7.5) {
            $suspicion_score += 3;
            $threats[] = [
                'type' => 'heuristic',
                'name' => 'high_entropy',
                'severity' => 'medium',
                'description' => "Entropie élevée détectée: {$entropy} (code potentiellement obfusqué)"
            ];
        }
        
        // Ratio de caractères non-ASCII
        $non_ascii_count = strlen($content) - strlen(filter_var($content, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH));
        $non_ascii_ratio = $non_ascii_count / strlen($content);
        if ($non_ascii_ratio > 0.3) {
            $suspicion_score += 2;
            $threats[] = [
                'type' => 'heuristic',
                'name' => 'high_non_ascii',
                'severity' => 'medium',
                'description' => "Ratio élevé de caractères non-ASCII: " . round($non_ascii_ratio * 100, 2) . "%"
            ];
        }
        
        // Détection de code très dense (potentiellement minifié/obfusqué)
        $lines = explode("\n", $content);
        $long_lines = array_filter($lines, function($line) {
            return strlen($line) > 500;
        });
        if (count($long_lines) > 3) {
            $suspicion_score += 2;
            $threats[] = [
                'type' => 'heuristic',
                'name' => 'dense_code',
                'severity' => 'low',
                'description' => "Code très dense détecté (lignes > 500 caractères)"
            ];
        }
        
        // Détection de variables suspicieuses
        $suspicious_vars = ['$_', '$__', '$___', '$GLOBALS', '$_POST', '$_GET', '$_REQUEST'];
        foreach ($suspicious_vars as $var) {
            if (substr_count($content, $var) > 10) {
                $suspicion_score += 1;
                break;
            }
        }
        
        // Score global
        if ($suspicion_score >= 5) {
            $threats[] = [
                'type' => 'heuristic',
                'name' => 'high_suspicion_score',
                'severity' => 'high',
                'description' => "Score de suspicion élevé: {$suspicion_score}/10"
            ];
        }
        
        return $threats;
    }
    
    /**
     * Analyse des permissions de fichiers
     */
    private function analyzeFilePermissions($file_path) {
        $threats = [];
        $perms = fileperms($file_path);
        
        // Fichier exécutable par tous (777)
        if (($perms & 0777) === 0777) {
            $threats[] = [
                'type' => 'permission',
                'name' => 'world_writable',
                'severity' => 'high',
                'description' => "Fichier accessible en écriture par tous (777)"
            ];
        }
        
        // Fichier PHP dans uploads
        if (strpos($file_path, '/uploads/') !== false && pathinfo($file_path, PATHINFO_EXTENSION) === 'php') {
            $threats[] = [
                'type' => 'permission',
                'name' => 'php_in_uploads',
                'severity' => 'high',
                'description' => "Fichier PHP dans le dossier uploads"
            ];
        }
        
        return $threats;
    }
    
    /**
     * Détection de fichiers suspects par nom
     */
    private function detectSuspiciousFilenames($file_path) {
        $threats = [];
        $filename = basename($file_path);
        
        $suspicious_patterns = [
            '/^[a-f0-9]{32}\.php$/' => 'Nom MD5 suspect',
            '/^[a-f0-9]{8,16}\.php$/' => 'Nom hexadécimal suspect',
            '/^[0-9]{10,}\.php$/' => 'Nom timestamp suspect',
            '/^wp-[a-z]{2,}\.php$/' => 'Faux fichier WordPress',
            '/^index[0-9]+\.php$/' => 'Faux index',
            '/^config[0-9]*\.php$/' => 'Faux config',
            '/^admin[0-9]*\.php$/' => 'Faux admin',
            '/^\.(.*\.php|php.*)$/' => 'Fichier PHP caché',
            '/^error[_-]?log\.php$/' => 'Faux fichier de log',
            '/^(data|db|database)\.php$/' => 'Fichier base suspect'
        ];
        
        foreach ($suspicious_patterns as $pattern => $description) {
            if (preg_match($pattern, $filename)) {
                $threats[] = [
                    'type' => 'filename',
                    'name' => 'suspicious_filename',
                    'severity' => 'medium',
                    'description' => $description . ": {$filename}"
                ];
                $this->statistics['suspicious_files']++;
                break;
            }
        }
        
        return $threats;
    }
    
    /**
     * Scan approfondi d'un fichier
     */
    private function deepScanFile($file_path) {
        $this->statistics['files_scanned']++;
        
        // Ignorer les gros fichiers (>10MB)
        if (filesize($file_path) > 10 * 1024 * 1024) {
            return [];
        }
        
        $content = file_get_contents($file_path);
        if ($content === false) {
            return [];
        }
        
        $all_threats = [];
        
        // Différents types de scans
        $all_threats = array_merge($all_threats, $this->scanMalwarePatterns($file_path, $content));
        $all_threats = array_merge($all_threats, $this->scanBackdoorSignatures($file_path, $content));
        $all_threats = array_merge($all_threats, $this->heuristicAnalysis($file_path, $content));
        $all_threats = array_merge($all_threats, $this->analyzeFilePermissions($file_path));
        $all_threats = array_merge($all_threats, $this->detectSuspiciousFilenames($file_path));
        
        if (!empty($all_threats)) {
            $this->statistics['infections_found']++;
            
            // Compter les injections
            foreach ($all_threats as $threat) {
                if (strpos($threat['name'], 'injection') !== false) {
                    $this->statistics['injections_found']++;
                }
            }
        }
        
        return $all_threats;
    }
    
    /**
     * Scan récursif d'un répertoire
     */
    private function scanDirectory($directory) {
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($directory, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile()) {
                $file_path = $file->getPathname();
                $extension = strtolower($file->getExtension());
                
                // Vérifier si le fichier doit être scanné
                if (in_array($extension, $this->scan_extensions)) {
                    // Exclure certains dossiers
                    $skip = false;
                    foreach ($this->exclude_dirs as $exclude_dir) {
                        if (strpos($file_path, "/{$exclude_dir}/") !== false) {
                            $skip = true;
                            break;
                        }
                    }
                    
                    if (!$skip) {
                        $threats = $this->deepScanFile($file_path);
                        if (!empty($threats)) {
                            $this->scan_results[$file_path] = $threats;
                        }
                    }
                }
            }
        }
    }
    
    /**
     * Scan complet du site WordPress
     */
    public function fullScan() {
        $this->log('INFO', 'Démarrage du scan complet...');
        
        // Réinitialiser les résultats
        $this->scan_results = [];
        $this->statistics = array_fill_keys(array_keys($this->statistics), 0);
        
        try {
            $this->scanDirectory($this->wp_path);
            
            // Scanner également les fichiers à la racine
            $root_files = glob($this->wp_path . '/*');
            foreach ($root_files as $file) {
                if (is_file($file)) {
                    $extension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
                    if (in_array($extension, $this->scan_extensions)) {
                        $threats = $this->deepScanFile($file);
                        if (!empty($threats)) {
                            $this->scan_results[$file] = $threats;
                        }
                    }
                }
            }
            
            $this->log('SUCCESS', "Scan terminé - {$this->statistics['files_scanned']} fichiers scannés, {$this->statistics['infections_found']} infections détectées");
            
        } catch (Exception $e) {
            $this->log('ERROR', 'Erreur lors du scan: ' . $e->getMessage());
            throw $e;
        }
        
        return $this->scan_results;
    }
    
    /**
     * Mise en quarantaine d'un fichier
     */
    private function quarantineFile($file_path) {
        $quarantine_name = self::QUARANTINE_DIR . '/' . basename($file_path) . '_' . time() . '_' . rand(1000, 9999);
        
        if (copy($file_path, $quarantine_name)) {
            $this->log('INFO', "Fichier mis en quarantaine: {$file_path} -> {$quarantine_name}");
            $this->statistics['quarantined_files']++;
            return $quarantine_name;
        }
        
        return false;
    }
    
    /**
     * Nettoyage intelligent d'un fichier infecté
     */
    private function cleanInfectedFile($file_path, $threats) {
        $content = file_get_contents($file_path);
        if ($content === false) {
            return false;
        }
        
        $original_content = $content;
        $cleaned = false;
        
        // Nettoyer selon les types de menaces
        foreach ($threats as $threat) {
            switch ($threat['type']) {
                case 'pattern':
                    $content = $this->cleanMalwarePattern($content, $threat['name']);
                    $cleaned = true;
                    break;
                    
                case 'backdoor':
                    // Les backdoors sont généralement supprimés entièrement
                    $this->quarantineFile($file_path);
                    return 'quarantined';
                    
                case 'filename':
                    // Fichiers avec noms suspects sont mis en quarantaine
                    $this->quarantineFile($file_path);
                    return 'quarantined';
            }
        }
        
        // Sauvegarder le fichier nettoyé si des modifications ont été apportées
        if ($cleaned && $content !== $original_content) {
            // Sauvegarder l'original
            copy($file_path, $file_path . '.infected.backup');
            
            // Écrire le contenu nettoyé
            if (file_put_contents($file_path, $content) !== false) {
                $this->log('SUCCESS', "Fichier nettoyé: {$file_path}");
                $this->statistics['cleaned_files']++;
                return 'cleaned';
            }
        }
        
        return false;
    }
    
    /**
     * Nettoyage spécifique par pattern
     */
    private function cleanMalwarePattern($content, $pattern_name) {
        switch ($pattern_name) {
            case 'js_injection_eval':
            case 'js_injection_unescape':
            case 'js_injection_fromcharcode':
                // Supprimer les scripts malveillants
                $content = preg_replace('/<script[^>]*>.*?eval.*?<\/script>/is', '', $content);
                $content = preg_replace('/<script[^>]*>.*?unescape.*?<\/script>/is', '', $content);
                break;
                
            case 'js_injection_iframe_hidden':
                // Supprimer les iframes cachées
                $content = preg_replace('/<iframe[^>]*width\s*=\s*[\'"]?1[\'"]?[^>]*>.*?<\/iframe>/is', '', $content);
                break;
                
            case 'pharma_links':
                // Supprimer les liens pharmaceutiques
                $content = preg_replace('/<a[^>]*href=[\'"][^\'\"]*pharmacy[^\'\"]*[\'"][^>]*>.*?<\/a>/is', '', $content);
                break;
                
            case 'redirect_meta':
                // Supprimer les redirections meta
                $content = preg_replace('/<meta[^>]*http-equiv\s*=\s*[\'"]refresh[\'"][^>]*>/is', '', $content);
                break;
                
            default:
                // Nettoyage générique pour les patterns de base
                foreach ($this->malware_patterns as $pname => $pattern) {
                    if ($pname === $pattern_name) {
                        $content = preg_replace($pattern, '/* Code malveillant supprimé */', $content);
                        break;
                    }
                }
        }
        
        return $content;
    }
    
    /**
     * Nettoyage automatique de tous les fichiers infectés
     */
    public function autoClean() {
        $this->log('INFO', 'Démarrage du nettoyage automatique...');
        
        $results = [
            'cleaned' => [],
            'quarantined' => [],
            'failed' => []
        ];
        
        foreach ($this->scan_results as $file_path => $threats) {
            $result = $this->cleanInfectedFile($file_path, $threats);
            
            switch ($result) {
                case 'cleaned':
                    $results['cleaned'][] = $file_path;
                    break;
                case 'quarantined':
                    $results['quarantined'][] = $file_path;
                    break;
                default:
                    $results['failed'][] = $file_path;
            }
        }
        
        $this->log('SUCCESS', "Nettoyage terminé - " . count($results['cleaned']) . " fichiers nettoyés, " . count($results['quarantined']) . " mis en quarantaine");
        
        return $results;
    }
    
    /**
     * Sécurisation post-nettoyage
     */
    public function hardenWordPress() {
        $this->log('INFO', 'Démarrage de la sécurisation WordPress...');
        
        $actions = [];
        
        // 1. Sécuriser les permissions des fichiers
        $actions['permissions'] = $this->hardenFilePermissions();
        
        // 2. Sécuriser .htaccess
        $actions['htaccess'] = $this->secureHtaccess();
        
        // 3. Sécuriser wp-config.php
        $actions['wp_config'] = $this->secureWpConfig();
        
        // 4. Supprimer les fichiers indésirables
        $actions['cleanup'] = $this->cleanupUnnecessaryFiles();
        
        // 5. Créer fichiers de protection
        $actions['protection'] = $this->createProtectionFiles();
        
        $this->log('SUCCESS', 'Sécurisation WordPress terminée');
        
        return $actions;
    }
    
    /**
     * Durcissement des permissions de fichiers
     */
    private function hardenFilePermissions() {
        $fixed = 0;
        
        // Permissions recommandées WordPress
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($this->wp_path, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile()) {
                chmod($file->getPathname(), 0644);
                $fixed++;
            } elseif ($file->isDir()) {
                chmod($file->getPathname(), 0755);
            }
        }
        
        // Permissions spéciales
        if (file_exists($this->wp_path . '/wp-config.php')) {
            chmod($this->wp_path . '/wp-config.php', 0600);
        }
        
        return "Permissions corrigées pour {$fixed} fichiers";
    }
    
    /**
     * Sécurisation du fichier .htaccess
     */
    private function secureHtaccess() {
        $htaccess_file = $this->wp_path . '/.htaccess';
        
        // Supprimer les redirections malveillantes si présentes
        if (file_exists($htaccess_file)) {
            $content = file_get_contents($htaccess_file);
            
            // Patterns de redirections malveillantes à supprimer
            $malicious_patterns = [
                '/RewriteRule.*http:\/\/[^\/]*\//i',
                '/RewriteCond.*HTTP_USER_AGENT/i',
                '/RewriteCond.*HTTP_REFERER.*google/i'
            ];
            
            foreach ($malicious_patterns as $pattern) {
                $content = preg_replace($pattern, '', $content);
            }
            
            file_put_contents($htaccess_file, $content);
        }
        
        // Ajouter protections sécuritaires
        $security_rules = '
# ===== PROTECTIONS SÉCURITAIRES =====
# Protection fichiers sensibles
<Files wp-config.php>
    order allow,deny
    deny from all
</Files>

<Files .htaccess>
    order allow,deny
    deny from all
</Files>

# Bloquer injections scripts
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
RewriteRule ^(.*)$ - [F,L]

# Bloquer exécution PHP dans uploads
<FilesMatch "\.(php|php3|php4|php5|phtml)$">
    <If "%{REQUEST_URI} =~ m#/wp-content/uploads/#">
        Order deny,allow
        Deny from all
    </If>
</FilesMatch>
';
        
        file_put_contents($htaccess_file, $security_rules, FILE_APPEND);
        
        return 'Fichier .htaccess sécurisé';
    }
    
    /**
     * Sécurisation du fichier wp-config.php
     */
    private function secureWpConfig() {
        $wp_config = $this->wp_path . '/wp-config.php';
        
        if (!file_exists($wp_config)) {
            return 'wp-config.php non trouvé';
        }
        
        $content = file_get_contents($wp_config);
        $additions = [];
        
        // Constantes de sécurité
        $security_constants = [
            "DISALLOW_FILE_EDIT" => "true",
            "DISALLOW_FILE_MODS" => "true",
            "FORCE_SSL_ADMIN" => "true",
            "WP_POST_REVISIONS" => "3",
            "EMPTY_TRASH_DAYS" => "7",
            "AUTOMATIC_UPDATER_DISABLED" => "false"
        ];
        
        foreach ($security_constants as $constant => $value) {
            if (strpos($content, $constant) === false) {
                $additions[] = "define('{$constant}', {$value});";
            }
        }
        
        if (!empty($additions)) {
            $insert_point = strpos($content, '<?php') + 5;
            $new_content = substr($content, 0, $insert_point) . "\n" . implode("\n", $additions) . "\n" . substr($content, $insert_point);
            file_put_contents($wp_config, $new_content);
        }
        
        return 'wp-config.php sécurisé avec ' . count($additions) . ' constantes ajoutées';
    }
    
    /**
     * Nettoyage des fichiers indésirables
     */
    private function cleanupUnnecessaryFiles() {
        $removed = 0;
        $unnecessary_files = [
            'readme.html',
            'license.txt',
            'wp-config-sample.php'
        ];
        
        foreach ($unnecessary_files as $file) {
            $file_path = $this->wp_path . '/' . $file;
            if (file_exists($file_path)) {
                unlink($file_path);
                $removed++;
            }
        }
        
        return "{$removed} fichiers indésirables supprimés";
    }
    
    /**
     * Création de fichiers de protection
     */
    private function createProtectionFiles() {
        $created = 0;
        
        // Protection du dossier uploads
        $uploads_dir = $this->wp_path . '/wp-content/uploads';
        if (is_dir($uploads_dir)) {
            $uploads_htaccess = $uploads_dir . '/.htaccess';
            if (!file_exists($uploads_htaccess)) {
                $protection_content = '# Bloquer exécution PHP
<Files "*.php">
    Order Deny,Allow
    Deny from all
</Files>';
                file_put_contents($uploads_htaccess, $protection_content);
                $created++;
            }
        }
        
        // Index.php de protection dans les dossiers sensibles
        $protect_dirs = [
            '/wp-content/',
            '/wp-content/plugins/',
            '/wp-content/themes/',
            '/wp-content/uploads/'
        ];
        
        foreach ($protect_dirs as $dir) {
            $dir_path = $this->wp_path . $dir;
            $index_file = $dir_path . 'index.php';
            
            if (is_dir($dir_path) && !file_exists($index_file)) {
                file_put_contents($index_file, '<?php // Silence is golden');
                $created++;
            }
        }
        
        return "{$created} fichiers de protection créés";
    }
    
    /**
     * Génération de rapport détaillé
     */
    public function generateReport($format = 'html') {
        $report_data = [
            'timestamp' => date('Y-m-d H:i:s'),
            'version' => self::VERSION,
            'wp_path' => $this->wp_path,
            'wp_info' => $this->getWordPressInfo(),
            'statistics' => $this->statistics,
            'scan_results' => $this->scan_results,
            'recommendations' => $this->generateRecommendations()
        ];
        
        $filename = self::REPORTS_DIR . '/malware_report_' . date('Y-m-d_H-i-s');
        
        switch ($format) {
            case 'json':
                $filename .= '.json';
                file_put_contents($filename, json_encode($report_data, JSON_PRETTY_PRINT));
                break;
                
            case 'html':
                $filename .= '.html';
                $html_content = $this->generateHtmlReport($report_data);
                file_put_contents($filename, $html_content);
                break;
                
            default:
                throw new Exception("Format de rapport non supporté: {$format}");
        }
        
        $this->log('SUCCESS', "Rapport généré: {$filename}");
        return $filename;
    }
    
    /**
     * Génération de recommandations basées sur les résultats
     */
    private function generateRecommendations() {
        $recommendations = [];
        
        if ($this->statistics['infections_found'] > 0) {
            $recommendations[] = [
                'priority' => 'critical',
                'title' => 'Nettoyer les infections détectées',
                'description' => 'Des fichiers infectés ont été détectés et doivent être nettoyés immédiatement.'
            ];
        }
        
        if ($this->statistics['backdoors_found'] > 0) {
            $recommendations[] = [
                'priority' => 'critical',
                'title' => 'Backdoors détectés - Intervention urgente',
                'description' => 'Des backdoors ont été détectés. Changez tous les mots de passe et contactez un expert.'
            ];
        }
        
        $recommendations[] = [
            'priority' => 'high',
            'title' => 'Mettre à jour WordPress et plugins',
            'description' => 'Assurez-vous que WordPress et tous les plugins/thèmes sont à jour.'
        ];
        
        $recommendations[] = [
            'priority' => 'medium',
            'title' => 'Installer un plugin de sécurité',
            'description' => 'Installez Wordfence ou Sucuri pour une protection continue.'
        ];
        
        $recommendations[] = [
            'priority' => 'medium',
            'title' => 'Configurer des sauvegardes automatiques',
            'description' => 'Mettez en place des sauvegardes régulières et automatiques.'
        ];
        
        return $recommendations;
    }
    
    /**
     * Génération de rapport HTML
     */
    private function generateHtmlReport($data) {
        ob_start();
        ?>
        <!DOCTYPE html>
        <html lang="fr">
        <head>
            <meta charset="UTF-8">
            <meta name="viewport" content="width=device-width, initial-scale=1.0">
            <title>Rapport Scanner Malware WordPress</title>
            <style>
                body { font-family: Arial, sans-serif; margin: 20px; background: #f5f5f5; }
                .container { max-width: 1200px; margin: 0 auto; background: white; padding: 20px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
                .header { background: #0073aa; color: white; padding: 20px; margin: -20px -20px 20px -20px; border-radius: 8px 8px 0 0; }
                .stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 15px; margin: 20px 0; }
                .stat-card { background: #f8f9fa; padding: 15px; border-radius: 5px; border-left: 4px solid #0073aa; }
                .stat-number { font-size: 24px; font-weight: bold; color: #0073aa; }
                .threat-list { margin: 20px 0; }
                .threat-item { background: #fff3cd; border: 1px solid #ffeaa7; padding: 10px; margin: 5px 0; border-radius: 5px; }
                .critical { background: #f8d7da; border-color: #f5c6cb; }
                .high { background: #fff3cd; border-color: #ffeaa7; }
                .medium { background: #d1ecf1; border-color: #bee5eb; }
                .low { background: #d4edda; border-color: #c3e6cb; }
                .recommendations { background: #e7f3ff; padding: 15px; border-radius: 5px; margin: 20px 0; }
                .footer { text-align: center; margin-top: 30px; padding-top: 20px; border-top: 1px solid #ddd; color: #666; }
            </style>
        </head>
        <body>
            <div class="container">
                <div class="header">
                    <h1>🛡️ Rapport Scanner Malware WordPress</h1>
                    <p>Généré le: <?= $data['timestamp'] ?> | Version: <?= $data['version'] ?></p>
                </div>
                
                <h2>📊 Statistiques du Scan</h2>
                <div class="stats">
                    <div class="stat-card">
                        <div class="stat-number"><?= $data['statistics']['files_scanned'] ?></div>
                        <div>Fichiers scannés</div>
                    </div>
                    <div class="stat-card">
                        <div class="stat-number"><?= $data['statistics']['infections_found'] ?></div>
                        <div>Infections détectées</div>
                    </div>
                    <div class="stat-card">
                        <div class="stat-number"><?= $data['statistics']['backdoors_found'] ?></div>
                        <div>Backdoors trouvés</div>
                    </div>
                    <div class="stat-card">
                        <div class="stat-number"><?= $data['statistics']['injections_found'] ?></div>
                        <div>Injections détectées</div>
                    </div>
                    <div class="stat-card">
                        <div class="stat-number"><?= $data['statistics']['suspicious_files'] ?></div>
                        <div>Fichiers suspects</div>
                    </div>
                </div>
                
                <h2>ℹ️ Informations WordPress</h2>
                <ul>
                    <li><strong>Chemin:</strong> <?= htmlspecialchars($data['wp_path']) ?></li>
                    <li><strong>Version:</strong> <?= htmlspecialchars($data['wp_info']['version']) ?></li>
                    <li><strong>Plugins installés:</strong> <?= count($data['wp_info']['plugins']) ?></li>
                    <li><strong>Thèmes installés:</strong> <?= count($data['wp_info']['themes']) ?></li>
                </ul>
                
                <?php if (!empty($data['scan_results'])): ?>
                <h2>🚨 Menaces Détectées</h2>
                <div class="threat-list">
                    <?php foreach ($data['scan_results'] as $file => $threats): ?>
                        <div class="threat-item">
                            <h4>📁 <?= htmlspecialchars($file) ?></h4>
                            <?php foreach ($threats as $threat): ?>
                                <div class="<?= $threat['severity'] ?>">
                                    <strong><?= ucfirst($threat['type']) ?>:</strong> 
                                    <?= htmlspecialchars($threat['description']) ?>
                                    <small>(Sévérité: <?= $threat['severity'] ?>)</small>
                                </div>
                            <?php endforeach; ?>
                        </div>
                    <?php endforeach; ?>
                </div>
                <?php else: ?>
                <h2>✅ Aucune Menace Détectée</h2>
                <p>Félicitations! Aucun malware n'a été détecté lors de ce scan.</p>
                <?php endif; ?>
                
                <h2>💡 Recommandations</h2>
                <div class="recommendations">
                    <?php foreach ($data['recommendations'] as $rec): ?>
                        <div class="<?= $rec['priority'] ?>">
                            <h4><?= $rec['title'] ?></h4>
                            <p><?= $rec['description'] ?></p>
                        </div>
                    <?php endforeach; ?>
                </div>
                
                <div class="footer">
                    <p>🔧 <strong>Besoin d'aide professionnelle?</strong></p>
                    <p>Pour un nettoyage expert et une sécurisation complète: 
                    <a href="https://teddywp.com/depannage-wordpress/" target="_blank">
                        <strong>TeddyWP - Dépannage WordPress</strong>
                    </a></p>
                    <p><small>Rapport généré par WordPress Expert Malware Scanner v<?= $data['version'] ?></small></p>
                </div>
            </div>
        </body>
        </html>
        <?php
        return ob_get_clean();
    }
    
    /**
     * Obtenir la sévérité d'un pattern
     */
    private function getPatternSeverity($pattern_name) {
        $critical_patterns = ['backdoor_', 'dangerous_'];
        $high_patterns = ['js_injection_', 'redirect_'];
        $medium_patterns = ['pharma_', 'obfuscated_'];
        
        foreach ($critical_patterns as $prefix) {
            if (strpos($pattern_name, $prefix) === 0) return 'critical';
        }
        
        foreach ($high_patterns as $prefix) {
            if (strpos($pattern_name, $prefix) === 0) return 'high';
        }
        
        foreach ($medium_patterns as $prefix) {
            if (strpos($pattern_name, $prefix) === 0) return 'medium';
        }
        
        return 'low';
    }
    
    /**
     * Obtenir la description d'un pattern
     */
    private function getPatternDescription($pattern_name) {
        $descriptions = [
            'backdoor_eval' => 'Backdoor utilisant eval() avec données externes',
            'backdoor_system' => 'Backdoor permettant l\'exécution de commandes système',
            'backdoor_exec' => 'Backdoor permettant l\'exécution de code',
            'backdoor_shell' => 'Backdoor shell permettant l\'exécution de commandes',
            'backdoor_base64' => 'Code malveillant obfusqué en base64',
            'js_injection_eval' => 'Injection JavaScript malveillante',
            'js_injection_iframe_hidden' => 'Iframe cachée potentiellement malveillante',
            'pharma_viagra' => 'Contenu lié au pharma hack',
            'redirect_meta' => 'Redirection malveillante via meta refresh',
            'obfuscated_chr' => 'Code obfusqué utilisant des caractères',
            'dangerous_file_get_contents' => 'Téléchargement de fichier distant suspect'
        ];
        
        return $descriptions[$pattern_name] ?? 'Pattern malveillant détecté';
    }
    
    /**
     * Interface web principale
     */
    public function renderWebInterface() {
        $action = $_GET['action'] ?? 'dashboard';
        
        switch ($action) {
            case 'scan':
                return $this->handleScanRequest();
            case 'clean':
                return $this->handleCleanRequest();
            case 'harden':
                return $this->handleHardenRequest();
            case 'report':
                return $this->handleReportRequest();
            case 'api':
                return $this->handleApiRequest();
            default:
                return $this->renderDashboard();
        }
    }
    
    /**
     * Gestionnaire de requête de scan
     */
    private function handleScanRequest() {
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            try {
                $results = $this->fullScan();
                $_SESSION['last_scan'] = [
                    'timestamp' => time(),
                    'results' => $results,
                    'statistics' => $this->statistics
                ];
                return json_encode(['success' => true, 'results' => $results, 'statistics' => $this->statistics]);
            } catch (Exception $e) {
                return json_encode(['success' => false, 'error' => $e->getMessage()]);
            }
        }
        
        return $this->renderScanInterface();
    }
    
    /**
     * Gestionnaire de requête de nettoyage
     */
    private function handleCleanRequest() {
        if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($this->scan_results)) {
            try {
                $results = $this->autoClean();
                return json_encode(['success' => true, 'results' => $results]);
            } catch (Exception $e) {
                return json_encode(['success' => false, 'error' => $e->getMessage()]);
            }
        }
        
        return json_encode(['success' => false, 'error' => 'Aucun scan préalable détecté']);
    }
    
    /**
     * Gestionnaire de requête de sécurisation
     */
    private function handleHardenRequest() {
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            try {
                $results = $this->hardenWordPress();
                return json_encode(['success' => true, 'results' => $results]);
            } catch (Exception $e) {
                return json_encode(['success' => false, 'error' => $e->getMessage()]);
            }
        }
        
        return json_encode(['success' => false, 'error' => 'Méthode non autorisée']);
    }
    
    /**
     * Gestionnaire de génération de rapport
     */
    private function handleReportRequest() {
        $format = $_GET['format'] ?? 'html';
        
        try {
            $filename = $this->generateReport($format);
            return json_encode(['success' => true, 'filename' => $filename]);
        } catch (Exception $e) {
            return json_encode(['success' => false, 'error' => $e->getMessage()]);
        }
    }
    
    /**
     * Rendu du tableau de bord principal
     */
    private function renderDashboard() {
        ob_start();
        ?>
        <!DOCTYPE html>
        <html lang="fr">
        <head>
            <meta charset="UTF-8">
            <meta name="viewport" content="width=device-width, initial-scale=1.0">
            <title>WordPress Expert Malware Scanner</title>
            <style>
                * { margin: 0; padding: 0; box-sizing: border-box; }
                body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); min-height: 100vh; }
                .container { max-width: 1200px; margin: 0 auto; padding: 20px; }
                .header { background: rgba(255,255,255,0.95); backdrop-filter: blur(10px); padding: 30px; border-radius: 15px; text-align: center; margin-bottom: 30px; box-shadow: 0 8px 32px rgba(0,0,0,0.1); }
                .header h1 { color: #2c3e50; font-size: 2.5em; margin-bottom: 10px; }
                .header p { color: #7f8c8d; font-size: 1.1em; }
                .dashboard { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 20px; margin-bottom: 30px; }
                .card { background: rgba(255,255,255,0.95); backdrop-filter: blur(10px); padding: 25px; border-radius: 15px; box-shadow: 0 8px 32px rgba(0,0,0,0.1); transition: transform 0.3s ease; }
                .card:hover { transform: translateY(-5px); }
                .card h3 { color: #2c3e50; margin-bottom: 15px; font-size: 1.3em; }
                .btn { background: linear-gradient(45deg, #667eea, #764ba2); color: white; border: none; padding: 12px 25px; border-radius: 8px; cursor: pointer; font-size: 1em; transition: all 0.3s ease; text-decoration: none; display: inline-block; }
                .btn:hover { transform: translateY(-2px); box-shadow: 0 5px 15px rgba(0,0,0,0.2); }
                .btn.secondary { background: linear-gradient(45deg, #95a5a6, #7f8c8d); }
                .btn.danger { background: linear-gradient(45deg, #e74c3c, #c0392b); }
                .btn.success { background: linear-gradient(45deg, #27ae60, #2ecc71); }
                .status { padding: 15px; border-radius: 8px; margin: 15px 0; }
                .status.info { background: #d1ecf1; border-left: 4px solid #17a2b8; }
                .status.warning { background: #fff3cd; border-left: 4px solid #ffc107; }
                .status.success { background: #d4edda; border-left: 4px solid #28a745; }
                .status.danger { background: #f8d7da; border-left: 4px solid #dc3545; }
                .stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 15px; margin: 20px 0; }
                .stat { text-align: center; background: #f8f9fa; padding: 20px; border-radius: 10px; }
                .stat-number { font-size: 2em; font-weight: bold; color: #667eea; }
                .stat-label { color: #6c757d; margin-top: 5px; }
                .progress { width: 100%; height: 20px; background: #e9ecef; border-radius: 10px; overflow: hidden; margin: 10px 0; }
                .progress-bar { height: 100%; background: linear-gradient(45deg, #667eea, #764ba2); transition: width 0.3s ease; }
                .modal { display: none; position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.8); z-index: 1000; }
                .modal-content { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); background: white; padding: 30px; border-radius: 15px; max-width: 80%; max-height: 80%; overflow-y: auto; }
                .close { float: right; font-size: 28px; font-weight: bold; cursor: pointer; }
                .loading { display: none; text-align: center; }
                .spinner { border: 4px solid #f3f3f3; border-top: 4px solid #667eea; border-radius: 50%; width: 40px; height: 40px; animation: spin 1s linear infinite; margin: 20px auto; }
                @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }
                .footer { text-align: center; background: rgba(255,255,255,0.95); backdrop-filter: blur(10px); padding: 20px; border-radius: 15px; margin-top: 30px; }
                .footer a { color: #667eea; text-decoration: none; font-weight: bold; }
                #scanResults { margin-top: 20px; }
                .threat-item { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; margin: 10px 0; border-radius: 8px; }
                .threat-item.critical { background: #f8d7da; border-color: #f5c6cb; }
            </style>
        </head>
        <body>
            <div class="container">
                <div class="header">
                    <h1>🛡️ WordPress Expert Malware Scanner</h1>
                    <p>Scanner professionnel de détection et nettoyage de malware WordPress</p>
                    <p><strong>Version <?= self::VERSION ?></strong> | Chemin: <?= htmlspecialchars($this->wp_path) ?></p>
                </div>
                
                <div class="dashboard">
                    <div class="card">
                        <h3>🔍 Scanner le Site</h3>
                        <p>Effectuer un scan complet pour détecter les malwares, backdoors et fichiers suspects.</p>
                        <div class="loading" id="scanLoading">
                            <div class="spinner"></div>
                            <p>Scan en cours...</p>
                        </div>
                        <button class="btn" onclick="startScan()" id="scanBtn">Démarrer le Scan</button>
                        <div id="scanResults"></div>
                    </div>
                    
                    <div class="card">
                        <h3>🧹 Nettoyage Automatique</h3>
                        <p>Nettoyer automatiquement les fichiers infectés détectés lors du dernier scan.</p>
                        <button class="btn secondary" onclick="startClean()" id="cleanBtn" disabled>Nettoyer les Infections</button>
                        <div id="cleanResults"></div>
                    </div>
                    
                    <div class="card">
                        <h3>🔒 Sécurisation WordPress</h3>
                        <p>Durcir la sécurité de WordPress (permissions, .htaccess, wp-config.php).</p>
                        <button class="btn success" onclick="startHarden()">Sécuriser le Site</button>
                        <div id="hardenResults"></div>
                    </div>
                    
                    <div class="card">
                        <h3>📊 Rapports</h3>
                        <p>Générer des rapports détaillés des scans et actions effectuées.</p>
                        <button class="btn secondary" onclick="generateReport('html')">Rapport HTML</button>
                        <button class="btn secondary" onclick="generateReport('json')">Rapport JSON</button>
                        <div id="reportResults"></div>
                    </div>
                </div>
                
                <?php if (isset($_SESSION['last_scan'])): ?>
                <div class="card">
                    <h3>📈 Dernier Scan</h3>
                    <p>Effectué le: <?= date('d/m/Y H:i:s', $_SESSION['last_scan']['timestamp']) ?></p>
                    <div class="stats">
                        <div class="stat">
                            <div class="stat-number"><?= $_SESSION['last_scan']['statistics']['files_scanned'] ?></div>
                            <div class="stat-label">Fichiers scannés</div>
                        </div>
                        <div class="stat">
                            <div class="stat-number"><?= $_SESSION['last_scan']['statistics']['infections_found'] ?></div>
                            <div class="stat-label">Infections trouvées</div>
                        </div>
                        <div class="stat">
                            <div class="stat-number"><?= $_SESSION['last_scan']['statistics']['backdoors_found'] ?></div>
                            <div class="stat-label">Backdoors détectés</div>
                        </div>
                    </div>
                    
                    <?php if ($_SESSION['last_scan']['statistics']['infections_found'] > 0): ?>
                    <div class="status warning">
                        <strong>⚠️ Attention:</strong> Des infections ont été détectées lors du dernier scan. 
                        Il est recommandé de nettoyer immédiatement.
                    </div>
                    <?php else: ?>
                    <div class="status success">
                        <strong>✅ Excellent:</strong> Aucune infection détectée lors du dernier scan.
                    </div>
                    <?php endif; ?>
                </div>
                <?php endif; ?>
                
                <div class="footer">
                    <p>🔧 <strong>Besoin d'aide professionnelle?</strong></p>
                    <p>Pour un nettoyage expert et une sécurisation complète: 
                    <a href="https://teddywp.com/depannage-wordpress/" target="_blank">
                        TeddyWP - Dépannage WordPress
                    </a></p>
                    <p><small>Scanner développé par TeddyWP Expert Guide</small></p>
                </div>
            </div>
            
            <script>
                function startScan() {
                    document.getElementById('scanBtn').disabled = true;
                    document.getElementById('scanLoading').style.display = 'block';
                    document.getElementById('scanResults').innerHTML = '';
                    
                    fetch('?action=scan', {
                        method: 'POST',
                        headers: { 'Content-Type': 'application/json' }
                    })
                    .then(response => response.json())
                    .then(data => {
                        document.getElementById('scanLoading').style.display = 'none';
                        document.getElementById('scanBtn').disabled = false;
                        
                        if (data.success) {
                            displayScanResults(data);
                            if (data.statistics.infections_found > 0) {
                                document.getElementById('cleanBtn').disabled = false;
                            }
                        } else {
                            document.getElementById('scanResults').innerHTML = 
                                '<div class="status danger"><strong>Erreur:</strong> ' + data.error + '</div>';
                        }
                    })
                    .catch(error => {
                        document.getElementById('scanLoading').style.display = 'none';
                        document.getElementById('scanBtn').disabled = false;
                        document.getElementById('scanResults').innerHTML = 
                            '<div class="status danger"><strong>Erreur:</strong> ' + error + '</div>';
                    });
                }
                
                function displayScanResults(data) {
                    let html = '<div class="stats">';
                    html += '<div class="stat"><div class="stat-number">' + data.statistics.files_scanned + '</div><div class="stat-label">Fichiers scannés</div></div>';
                    html += '<div class="stat"><div class="stat-number">' + data.statistics.infections_found + '</div><div class="stat-label">Infections</div></div>';
                    html += '<div class="stat"><div class="stat-number">' + data.statistics.backdoors_found + '</div><div class="stat-label">Backdoors</div></div>';
                    html += '</div>';
                    
                    if (data.statistics.infections_found > 0) {
                        html += '<div class="status warning"><strong>⚠️ Infections détectées!</strong> ' + data.statistics.infections_found + ' fichiers infectés trouvés.</div>';
                    } else {
                        html += '<div class="status success"><strong>✅ Site propre!</strong> Aucune infection détectée.</div>';
                    }
                    
                    document.getElementById('scanResults').innerHTML = html;
                }
                
                function startClean() {
                    if (!confirm('Êtes-vous sûr de vouloir nettoyer automatiquement les fichiers infectés?')) return;
                    
                    document.getElementById('cleanBtn').disabled = true;
                    
                    fetch('?action=clean', {
                        method: 'POST',
                        headers: { 'Content-Type': 'application/json' }
                    })
                    .then(response => response.json())
                    .then(data => {
                        document.getElementById('cleanBtn').disabled = false;
                        
                        if (data.success) {
                            let html = '<div class="status success"><strong>✅ Nettoyage terminé!</strong><br>';
                            html += 'Fichiers nettoyés: ' + data.results.cleaned.length + '<br>';
                            html += 'Fichiers en quarantaine: ' + data.results.quarantined.length + '</div>';
                            document.getElementById('cleanResults').innerHTML = html;
                        } else {
                            document.getElementById('cleanResults').innerHTML = 
                                '<div class="status danger"><strong>Erreur:</strong> ' + data.error + '</div>';
                        }
                    });
                }
                
                function startHarden() {
                    if (!confirm('Sécuriser WordPress? Cette action modifiera les permissions et fichiers de configuration.')) return;
                    
                    fetch('?action=harden', {
                        method: 'POST',
                        headers: { 'Content-Type': 'application/json' }
                    })
                    .then(response => response.json())
                    .then(data => {
                        if (data.success) {
                            let html = '<div class="status success"><strong>✅ Sécurisation terminée!</strong><br>';
                            for (let action in data.results) {
                                html += action + ': ' + data.results[action] + '<br>';
                            }
                            html += '</div>';
                            document.getElementById('hardenResults').innerHTML = html;
                        } else {
                            document.getElementById('hardenResults').innerHTML = 
                                '<div class="status danger"><strong>Erreur:</strong> ' + data.error + '</div>';
                        }
                    });
                }
                
                function generateReport(format) {
                    fetch('?action=report&format=' + format)
                    .then(response => response.json())
                    .then(data => {
                        if (data.success) {
                            document.getElementById('reportResults').innerHTML = 
                                '<div class="status success"><strong>✅ Rapport généré:</strong> ' + data.filename + '</div>';
                        } else {
                            document.getElementById('reportResults').innerHTML = 
                                '<div class="status danger"><strong>Erreur:</strong> ' + data.error + '</div>';
                        }
                    });
                }
            </script>
        </body>
        </html>
        <?php
        return ob_get_clean();
    }
}

// ================================================================================================
// POINT D'ENTRÉE PRINCIPAL
// ================================================================================================

try {
    // Initialiser le scanner
    $wp_path = $_GET['wp_path'] ?? null;
    $scanner = new WordPressMalwareScanner($wp_path);
    $scanner->validateWordPress();
    
    // Si c'est une requête AJAX, renvoyer directement la réponse JSON
    if (isset($_GET['action']) && $_GET['action'] !== 'dashboard') {
        header('Content-Type: application/json');
        echo $scanner->renderWebInterface();
        exit;
    }
    
    // Sinon, afficher l'interface web
    echo $scanner->renderWebInterface();
    
} catch (Exception $e) {
    // Gestion d'erreur avec interface basique
    ?>
    <!DOCTYPE html>
    <html lang="fr">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <title>Erreur - WordPress Malware Scanner</title>
        <style>
            body { font-family: Arial, sans-serif; background: #f8f9fa; padding: 20px; }
            .error { background: #f8d7da; border: 1px solid #f5c6cb; padding: 20px; border-radius: 5px; max-width: 600px; margin: 50px auto; }
            .error h1 { color: #721c24; margin-bottom: 15px; }
            .error p { color: #721c24; margin-bottom: 10px; }
            .footer { text-align: center; margin-top: 30px; }
            .footer a { color: #007bff; text-decoration: none; }
        </style>
    </head>
    <body>
        <div class="error">
            <h1>🚨 Erreur d'Initialisation</h1>
            <p><strong>Message:</strong> <?= htmlspecialchars($e->getMessage()) ?></p>
            <p><strong>Solutions possibles:</strong></p>
            <ul>
                <li>Vérifiez que le script est placé dans un répertoire WordPress valide</li>
                <li>Assurez-vous que les permissions sont correctes</li>
                <li>Spécifiez le chemin WordPress: <code>?wp_path=/chemin/vers/wordpress</code></li>
            </ul>
        </div>
        
        <div class="footer">
            <p>Besoin d'aide? <a href="https://teddywp.com/depannage-wordpress/" target="_blank">Contactez nos experts</a></p>
        </div>
    </body>
    </html>
    <?php
}
?>