Date: Fri, 5 Dec 2008 05:51:32 +0100 From: Mel <fbsd.questions@rachie.is-a-geek.net> To: freebsd-questions@freebsd.org Cc: mcoyles@horbury.wakefield.sch.uk, Julien Cigar <jcigar@ulb.ac.be> Subject: Re: Mass find/replace... Message-ID: <200812050551.32850.fbsd.questions@rachie.is-a-geek.net> In-Reply-To: <1228395500.2781.41.camel@frodon.be-bif.ulb.ac.be> References: <002b01c95609$ed0c7200$c7255600$@wakefield.sch.uk> <1228395500.2781.41.camel@frodon.be-bif.ulb.ac.be>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 04 December 2008 13:58:20 Julien Cigar wrote:
> the following should work :
> $ find /home/horbury -type f -print0 | xargs -0 grep 'base64_decode'
> or :
> $ find /home/horbury -type f -exec grep 'base64_decode' {} \;
+ not \; or you will fork on every result.
Additionally, is this injected code one long string or broken down by the
mailer? Grep isn't the best way to deal with it. It's pretty easy to correct
with perl, bit trickier if it's multiline, still not too hard:
find /home/horbury -type f -exec \
perl -pi.bak -e 's,<\?/\*\*/eval\(base64_decode\(.*?\?>,,s' {} +
The originals will end up as filename.php.bak.
--
Mel
Problem with today's modular software: they start with the modules
and never get to the software part.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200812050551.32850.fbsd.questions>