import json, subprocess

result = subprocess.run(
    ["mysql", "-u", "vedaholiday_user", "-pVeda@12345Secure", "vedaholiday_db", "-N", "-r",
     "-e", "SELECT meta_value FROM wpie_postmeta WHERE post_id = 2255 AND meta_key = '_elementor_data'"],
    capture_output=True, text=True
)
data = result.stdout.strip()
parsed = json.loads(data)

to_remove = []
for idx, el in enumerate(parsed):
    el_str = json.dumps(el).lower()
    if "cazeus" in el_str or "position: absolute" in el_str:
        to_remove.append(idx)
        print("Malicious element at index {}, id={}".format(idx, el.get("id")))

if to_remove:
    to_remove.sort(reverse=True)
    for idx in to_remove:
        el_id = parsed[idx].get("id", "?")
        print("Removing element {} with id={}".format(idx, el_id))
        parsed.pop(idx)

    cleaned = json.dumps(parsed)

    with open("/tmp/elementor_update.sql", "w") as f:
        f.write("UPDATE wpie_postmeta SET meta_value = '")
        f.write(cleaned.replace("'", "''"))
        f.write("' WHERE post_id = 2255 AND meta_key = '_elementor_data';\n")

    subprocess.run(
        ["mysql", "-u", "vedaholiday_user", "-pVeda@12345Secure", "vedaholiday_db", "-e", "source /tmp/elementor_update.sql"],
        capture_output=True, text=True
    )

    result2 = subprocess.run(
        ["mysql", "-u", "vedaholiday_user", "-pVeda@12345Secure", "vedaholiday_db", "-N", "-r",
         "-e", "SELECT meta_value FROM wpie_postmeta WHERE post_id = 2255 AND meta_key = '_elementor_data'"],
        capture_output=True, text=True
    )
    data2 = result2.stdout.strip()
    if "cazeus" in data2.lower():
        print("WARNING: Casino spam still present!")
    else:
        print("SUCCESS! Cleaned: {} -> {} bytes".format(len(data), len(data2)))
else:
    print("No malicious elements found")
    print("Total elements: {}".format(len(parsed)))
    print("Last element: id={}, type={}".format(parsed[-1].get("id"), parsed[-1].get("elType")))
    last_str = json.dumps(parsed[-1])
    print("Last element snippet: {}".format(last_str[-300:]))