403Webshell
Server IP : 138.197.107.151  /  Your IP : 216.73.217.7
Web Server : Apache/2.4.58 (Ubuntu)
System : Linux BloxBy-Builder 6.8.0-71-generic #71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 x86_64
User : wpbetasites_mrakzqskir ( 1022)
PHP Version : 8.3.6
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : OFF
Directory :  /proc/698958/task/698958/cwd/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /proc/698958/task/698958/cwd/sites.py
r"""Site identity: one WP Engine install is one site.

WHY THE INSTALL, NOT THE DOMAIN

A log file is named for the WP Engine *install* (20260709-0017-buckfirelaw...),
but the events inside it carry the *vhost* from each request line. Those are not
the same string, and one install serves several vhosts:

    buckfirelaw     -> buckfirelaw.com, buckfirelaw.wpengine.com
    allmandlawfirm  -> allmandlaw.com,  allmandlawfirm.wpengine.com

Keying the site table on the vhost therefore lists one site twice -- once under
its real domain and once under the WP Engine holding domain. Keying on the
install lists it once, and is also the only identity that can name a site whose
log file is empty: no events means no vhost to read.

WHY THE MAPPING IS NOT GUESSED

The install name is not a substring of the domain often enough to matter: it is
truncated to 14 characters, and it is chosen by hand, so it drifts from the
domain entirely.

    amdmedicalpllc  -> amdmedicalgroup.com
    bermanandrusso  -> brslaw.com
    awsmithpepper   -> peppersprayinjury.com
    aprsplasticsur  -> apresplasticsurgery.com

Matching install to domain by string similarity gets 99 of 241 installs wrong
(41%). So nothing here guesses. The parser already writes both halves of the
answer into every event key --

    events/date=2026-07-08/site=amdmedicalgroup.com/20260709-0011-amdmedicalpllc.jsonl
                                \_ vhost                          \_ install

-- and s3data reads the pairing straight out of the key. The mapping is observed,
not inferred.
"""

import re

# logs/nginx/20260709-0017-buckfirelaw.apachestyle.log.gz -> buckfirelaw
SOURCE_KEY_RE = re.compile(r"(?:^|/)\d{8}-\d{4}-(.+?)\.apachestyle\.log\.gz$")
# 20260709-0017-buckfirelaw(.jsonl stripped) -> buckfirelaw
STEM_RE = re.compile(r"^\d{8}-\d{4}-(.+)$")

# WP Engine parks every install on a holding domain. It is the same site as the
# real domain, so it must never become a row of its own.
ALIAS_SUFFIXES = (".wpengine.com", ".wpenginepowered.com")


def install_from_source_key(key):
    """Install name from a raw log key (or a manifest entry). None if not one."""
    m = SOURCE_KEY_RE.search(key)
    return m.group(1) if m else None


def install_from_stem(stem):
    """Install name from an event shard stem: 20260709-0017-foo -> foo."""
    m = STEM_RE.match(stem)
    return m.group(1) if m else None


def is_alias_domain(domain):
    """True for a WP Engine holding domain (<install>.wpengine[powered].com)."""
    return domain.endswith(ALIAS_SUFFIXES)


def primary_domain(install, domains):
    """The one domain that best names `install`, or None if it has no events.

    Deterministic, and deliberately independent of hit counts: the label a site
    carries must not change when the date range does. Real domains win over WP
    Engine holding domains; among those, an exact match on the install name wins,
    then a prefix match, then alphabetical order as a stable tie-break.
    """
    if not domains:
        return None
    real = sorted(d for d in domains if not is_alias_domain(d))
    pool = real or sorted(domains)

    def base(d):
        return d.split(".")[0]

    for d in pool:
        if base(d) == install:
            return d
    prefixed = [d for d in pool if base(d).startswith(install) or install.startswith(base(d))]
    if prefixed:
        return min(prefixed, key=lambda d: (len(d), d))
    return pool[0]


def display_name(install, domains):
    """What the site table shows. Falls back to the install for an empty log."""
    return primary_domain(install, domains) or install


def extra_domain_count(install, domains):
    """How many *other* real domains this install serves, for a '+N' hint.

    Aliases are not counted -- they are the same site by definition. Genuinely
    distinct brands sharing an install (buckfirelaw serves 9) are, so the row can
    say that its number covers more than the domain on the label.
    """
    primary = primary_domain(install, domains)
    if primary is None:
        return 0
    real = {d for d in domains if not is_alias_domain(d)}
    return max(0, len(real - {primary}))

Youez - 2016 - github.com/yon3zu
LinuXploit