---
- name: Mitigating CVE-2024-2961
  hosts: all, !wolf-serv1.uk.plesk-server.com
  gather_facts: false

  tasks:
    - name: Check if gconv-modules-extra.conf exists
      ansible.builtin.stat:
        path: /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf
      register: gconv_modules_extra_exist
    - name: Check if gconv-modules exists
      ansible.builtin.stat:
        path: /usr/lib64/gconv/gconv-modules
      register: gconv_modules_exist
    - name: Match and comment out block in the configuration file
      ansible.builtin.shell: |
        set -o pipefail
        file="{{ '/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf' if gconv_modules_extra_exist.stat.exists else '/usr/lib64/gconv/gconv-modules' }}"
        grep -n "ISO2022CNEXT//" "$file" | while read -r line; do line_number=$(echo "$line" | cut -d':' -f1); sed -i "${line_number},$((line_number + 2)) s/^/# /" "$file"; done
        rm -f /usr/lib64/gconv/gconv-modules.cache
      register: config_changes
      notify:
        - run_iconvconfig
      when: gconv_modules_extra_exist.stat.exists or gconv_modules_exist.stat.exists

  handlers:
    - name: Run iconvconfig
      ansible.builtin.command: iconvconfig
      when: config_changes.changed
      listen: run_iconvconfig