From owner-freebsd-questions@FreeBSD.ORG Fri Dec 5 09:18:08 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 313E71065678 for ; Fri, 5 Dec 2008 09:18:08 +0000 (UTC) (envelope-from mcoyles@horbury.wakefield.sch.uk) Received: from smtp2.yhgfl.net (smtp3.yhgfl.net [89.207.208.210]) by mx1.freebsd.org (Postfix) with ESMTP id DDAD38FC0C for ; Fri, 5 Dec 2008 09:18:07 +0000 (UTC) (envelope-from mcoyles@horbury.wakefield.sch.uk) Received: from smtp2.yhgfl.net (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 720D91BC04F2 for ; Fri, 5 Dec 2008 09:18:05 +0000 (GMT) Received: from smtp3-wak.yhgfl.net (eca.yhgfl.net [89.207.208.91]) by smtp2.yhgfl.net (Email Security Appliance) with ESMTP id 371E71BC04E4 for ; Fri, 5 Dec 2008 09:18:05 +0000 (GMT) Received: from horbury.wakefield.sch.uk ([10.126.96.34]) by smtp3-wak.yhgfl.net (8.13.8/8.13.8/Debian-3) with ESMTP id mB59Hs0N030586 for ; Fri, 5 Dec 2008 09:17:55 GMT Received: from ITTEAM02 [10.126.96.253] by horbury.wakefield.sch.uk with ESMTP (SMTPD32-7.07) id A1BD9B0106; Fri, 05 Dec 2008 09:17:49 +0000 From: "Marc Coyles" To: References: <002b01c95609$ed0c7200$c7255600$@wakefield.sch.uk> <1228395500.2781.41.camel@frodon.be-bif.ulb.ac.be> <200812050551.32850.fbsd.questions@rachie.is-a-geek.net> In-Reply-To: <200812050551.32850.fbsd.questions@rachie.is-a-geek.net> Date: Fri, 5 Dec 2008 09:17:46 -0000 Message-ID: <004c01c956ba$56497410$02dc5c30$@wakefield.sch.uk> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AclWlTXUdF6aBdckTSKj/0Mh6WRVAwAIwfzA Content-Language: en-gb X-YHGfL-MailScanner-Information: Please contact the YHGfL Foundation for more information X-YHGfL-MailScanner: Found to be clean X-YHGfL-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0, required 0.5) X-YHGfL-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-4.399, required 5, autolearn=not spam, ALL_TRUSTED -1.80, BAYES_00 -2.60) X-MailScanner-From: mcoyles@horbury.wakefield.sch.uk Subject: RE: Mass find/replace... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: mcoyles@horbury.wakefield.sch.uk List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Dec 2008 09:18:08 -0000 > + not \; or you will fork on every result. >=20 > Additionally, is this injected code one long string or broken down > by the > mailer? Grep isn't the best way to deal with it. It's pretty easy > to correct > with perl, bit trickier if it's multiline, still not too hard: >=20 > find /home/horbury -type f -exec \ > perl -pi.bak -e 's,<\? /\*\*/eval\(base64_decode\(.*?\?>,,s' {} + >=20 Sadly that didn't work. It created .bak files for everything within = /home/Horbury recursively, but didn't make any changes - the = base64_decode is till present.=20 Additional point to note: this only needs performing on .php files, not = all files...=20 Would I be correct in guessing it's because the string for perl to = search for omits a space? IE: within the files, it's as follows: Whereas the perl appears to be looking for: Also... how to delete all files ending in .bak recursively? *grin* I'm presuming it'd be: Find /home/horbury -type f -name "*.bak" -exec \ Rm *.bak ??? Ta! Marc