name: cve-2026-49060-hippoo-lab

services:
  db-vuln:
    image: mariadb:10.11
    container_name: cve-2026-49060-db-vuln
    environment:
      MARIADB_DATABASE: wordpress
      MARIADB_USER: wordpress
      MARIADB_PASSWORD: wordpress
      MARIADB_ROOT_PASSWORD: rootpass
    volumes:
      - db-vuln:/var/lib/mysql
    networks:
      - lab
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 30

  db-patched:
    image: mariadb:10.11
    container_name: cve-2026-49060-db-patched
    environment:
      MARIADB_DATABASE: wordpress
      MARIADB_USER: wordpress
      MARIADB_PASSWORD: wordpress
      MARIADB_ROOT_PASSWORD: rootpass
    volumes:
      - db-patched:/var/lib/mysql
    networks:
      - lab
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 30

  vuln:
    build:
      context: ./vuln
      args:
        HIPPOO_VERSION: "1.9.4"
        WOOCOMMERCE_VERSION: "9.9.5"
    image: cve-2026-49060-vuln:1.9.4
    container_name: cve-2026-49060-vuln
    depends_on:
      db-vuln:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: db-vuln:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DEBUG: "1"
    volumes:
      - wp-vuln:/var/www/html
    ports:
      - "8081:80"
    networks:
      - lab
    healthcheck:
      test: ["CMD-SHELL", "test -f /var/www/html/.cve-2026-49060-ready"]
      interval: 5s
      timeout: 3s
      retries: 120

  patched:
    build:
      context: ./patched
      args:
        HIPPOO_VERSION: "1.9.5"
        WOOCOMMERCE_VERSION: "9.9.5"
    image: cve-2026-49060-patched:1.9.5
    container_name: cve-2026-49060-patched
    depends_on:
      db-patched:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: db-patched:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DEBUG: "1"
    volumes:
      - wp-patched:/var/www/html
    ports:
      - "8082:80"
    networks:
      - lab
    healthcheck:
      test: ["CMD-SHELL", "test -f /var/www/html/.cve-2026-49060-ready"]
      interval: 5s
      timeout: 3s
      retries: 120

  init-vuln:
    image: cve-2026-49060-vuln:1.9.4
    container_name: cve-2026-49060-init-vuln
    depends_on:
      db-vuln:
        condition: service_healthy
      vuln:
        condition: service_started
    environment:
      WORDPRESS_DB_HOST: db-vuln:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    volumes:
      - wp-vuln:/var/www/html
    networks:
      - lab
    entrypoint: []
    command:
      - bash
      - -c
      - |
          set -euo pipefail

          echo "[init-vuln] waiting for WordPress files"
          until [ -f /var/www/html/wp-load.php ]; do
            sleep 2
          done

          echo "[init-vuln] waiting for database"
          until wp db check --allow-root --path=/var/www/html; do
            sleep 2
          done

          if ! wp core is-installed --allow-root --path=/var/www/html; then
            echo "[init-vuln] installing WordPress core"
            wp core install \
              --allow-root \
              --path=/var/www/html \
              --url="http://localhost:8081" \
              --title="CVE-2026-49060 Hippoo vulnerable" \
              --admin_user="admin" \
              --admin_password="AdminPass123!" \
              --admin_email="[email protected]" \
              --skip-email
          else
            echo "[init-vuln] WordPress already installed"
          fi

          echo "[init-vuln] activating WooCommerce"
          wp plugin activate woocommerce --allow-root --path=/var/www/html

          echo "[init-vuln] activating Hippoo"
          wp plugin activate hippoo --allow-root --path=/var/www/html

          echo "[init-vuln] disabling WooCommerce tracking"
          wp option update woocommerce_allow_tracking no --allow-root --path=/var/www/html

          echo "[init-vuln] verifying active plugins"
          wp plugin list --allow-root --path=/var/www/html --status=active

          echo "[init-vuln] verifying admin user"
          wp user get admin --field=user_login --allow-root --path=/var/www/html

          echo "[init-vuln] creating readiness marker"
          touch /var/www/html/.cve-2026-49060-ready

          echo "[init-vuln] READY: http://localhost:8081 admin/AdminPass123! Hippoo 1.9.4"

          tail -f /dev/null

  init-patched:
    image: cve-2026-49060-patched:1.9.5
    container_name: cve-2026-49060-init-patched
    depends_on:
      db-patched:
        condition: service_healthy
      patched:
        condition: service_started
    environment:
      WORDPRESS_DB_HOST: db-patched:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    volumes:
      - wp-patched:/var/www/html
    networks:
      - lab
    entrypoint: []
    command:
      - bash
      - -c
      - |
          set -euo pipefail

          echo "[init-patched] waiting for WordPress files"
          until [ -f /var/www/html/wp-load.php ]; do
            sleep 2
          done

          echo "[init-patched] waiting for database"
          until wp db check --allow-root --path=/var/www/html; do
            sleep 2
          done

          if ! wp core is-installed --allow-root --path=/var/www/html; then
            echo "[init-patched] installing WordPress core"
            wp core install \
              --allow-root \
              --path=/var/www/html \
              --url="http://localhost:8082" \
              --title="CVE-2026-49060 Hippoo patched" \
              --admin_user="admin" \
              --admin_password="AdminPass123!" \
              --admin_email="[email protected]" \
              --skip-email
          else
            echo "[init-patched] WordPress already installed"
          fi

          echo "[init-patched] activating WooCommerce"
          wp plugin activate woocommerce --allow-root --path=/var/www/html

          echo "[init-patched] activating Hippoo"
          wp plugin activate hippoo --allow-root --path=/var/www/html

          echo "[init-patched] disabling WooCommerce tracking"
          wp option update woocommerce_allow_tracking no --allow-root --path=/var/www/html

          echo "[init-patched] verifying active plugins"
          wp plugin list --allow-root --path=/var/www/html --status=active

          echo "[init-patched] verifying admin user"
          wp user get admin --field=user_login --allow-root --path=/var/www/html

          echo "[init-patched] creating readiness marker"
          touch /var/www/html/.cve-2026-49060-ready

          echo "[init-patched] READY: http://localhost:8082 admin/AdminPass123! Hippoo 1.9.5"

          tail -f /dev/null

networks:
  lab:
    name: cve-2026-49060-lab

volumes:
  db-vuln:
  db-patched:
  wp-vuln:
  wp-patched: