Timeline for how to use sed command to replace everything before second occurrence?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 3, 2017 at 12:10 | history | edited | Jeff Schaller♦ | CC BY-SA 3.0 |
added 2 characters in body
|
| Aug 8, 2016 at 13:01 | history | edited | user172564 | CC BY-SA 3.0 |
added 360 characters in body
|
| Aug 7, 2016 at 15:21 | comment | added | user172564 | Let us continue this discussion in chat. | |
| Aug 7, 2016 at 15:21 | comment | added | user172564 |
@AlboBest I said, you can run a script looking for files having the first and the second line in common, then the script will call sed -i '1d' only in that condition!
|
|
| Aug 7, 2016 at 15:19 | comment | added | user183533 |
I ran this find * -type f -name "*.php" -exec sed -i '1d' {} \; but it just removes the first <?php on all the files it finds (no check) not sure about the bash thing - I'm on windows :P and I'm connected to my server via SSH (Putty).
|
|
| Aug 7, 2016 at 15:15 | comment | added | user172564 |
@AlboBest No need to look for them, just run a bash checking if and only if the first and second lines of a file are same, so delete the first. In this case, you'll have only one <?php in these kinda files.
|
|
| Aug 7, 2016 at 15:13 | comment | added | user183533 |
thanks, I tried right now but how to find all of these files that have <?php <?php with a line-break between them? pastebin.com/FYbxkdYR
|
|
| Aug 7, 2016 at 15:10 | comment | added | user172564 |
@AlboBest I think the best you can do is to run a bash script after using above commands telling if first and second lines are same, delete the first by sed -i '1d' yourFiles.php. I hope this can help.
|
|
| Aug 7, 2016 at 14:58 | comment | added | user183533 |
Thsnk you. This produces the same output as the command @AlexStrategies wrote. Quote: ------------------ in some files it left the first <?php in there so the output ended up being <?php <?php which would then give error on some of my page. Specifically this file pastebin.com/Tcxa9LBD ended up like this: pastebin.com/FYbxkdYR if that would be fixed also, it would be perfect. Any thought? Thnx
|
|
| Aug 7, 2016 at 14:50 | comment | added | user172564 | @AlexStragies Thanks a million, now it's fixed and won't break the php files. | |
| Aug 7, 2016 at 14:49 | history | undeleted | CommunityBot | ||
| Aug 7, 2016 at 14:49 | history | edited | user172564 | CC BY-SA 3.0 |
added 15 characters in body
|
| Aug 7, 2016 at 14:40 | history | deleted | CommunityBot | via Vote | |
| Aug 7, 2016 at 14:34 | comment | added | Alex Stragies |
You can't just delete the first line. The infection prependes itself before the original opening <? php tag in the first line. So, you have to cut until the second php tag in the first line. (See the pastebin-link). Your answer will "break" the php files.
|
|
| Aug 7, 2016 at 14:29 | comment | added | user172564 | Mate, before downvoting, check the file he sent for me in comments! | |
| Aug 7, 2016 at 14:29 | history | edited | user172564 | CC BY-SA 3.0 |
added 101 characters in body
|
| Aug 7, 2016 at 14:28 | comment | added | sjsam | How can you be sure that the entire script is contained in first line? | |
| Aug 7, 2016 at 14:27 | history | answered | user172564 | CC BY-SA 3.0 |