<?php

/** *********************************************
 * LiteSpeed Web Server Cache Manager
 *
 * @author    Michael Alegre
 * @copyright 2018-2026 LiteSpeed Technologies, Inc.
 * *******************************************
 */

namespace Lsc\Wp;


use ZipArchive;

class Util
{

    /**
     *
     * @param string $tag
     *
     * @return string
     */
    public static function get_request_var( $tag )
    {
        if ( isset($_REQUEST[$tag]) ) {
            return trim($_REQUEST[$tag]);
        }

        /**
         * Request var not found in $_REQUEST, try checking POST and
         * QUERY_STRING environment variables.
         */
        if ( $_SERVER['REQUEST_METHOD'] === 'POST' ) {
            $querystring = urldecode(getenv('POST'));
        }
        else {
            $querystring = urldecode(getenv('QUERY_STRING'));
        }

        if ( $querystring != ''
                && preg_match("/(?:^|\?|&)$tag=([^&]+)/", $querystring, $m) ) {

            return trim($m[1]);
        }

        return null;
    }

    /**
     *
     * @param string $tag
     *
     * @return array
     */
    public static function get_request_list( $tag )
    {
        $varValue = null;

        if ( isset($_REQUEST[$tag]) ) {
            $varValue = $_REQUEST[$tag];
        }
        else {
            /**
             * Request var not found in $_REQUEST, try checking POST and
             * QUERY_STRING environment variables.
             */
            if ( $_SERVER['REQUEST_METHOD'] === 'POST' ) {
                $querystring = urldecode(getenv('POST'));
            }
            else {
                $querystring = urldecode(getenv('QUERY_STRING'));
            }

            if ( $querystring != ''
                    && preg_match_all("/(?:^|\?|&)$tag\[]=([^&]+)/", $querystring, $m) ) {

                $varValue = $m[1];
            }
        }

        return (is_array($varValue)) ? $varValue : null;
    }

    /**
     *
     * @throws LSCMException  Thrown indirectly by Logger::info() call.
     */
    public static function restartLsws()
    {
        Logger::info('Performing a Graceful Restart to apply changes...');

        /**
         * @noinspection PhpMethodParametersCountMismatchInspection  Suppress
         *     for PHP 5.x.
         */
        if ( php_uname('s') == 'FreeBSD' ) {
            $lswsCtl = '/usr/local/etc/rc.d/lsws.sh';
        }
        else {
            $lswsCtl = '/sbin/service lsws';
        }

        exec("$lswsCtl restart");
    }

    /**
     * @since 2.1.15
     *
     * @param int $startTime
     * @param int $timeout
     *
     * @return bool
     */
    public static function timedOut( $startTime, $timeout )
    {
        return ((time() - $startTime) > $timeout);
    }

    /**
     * This function is used to get the file owner by name. Useful in cases
     * where UID is not accepted or setting a files group to match its owner
     * (It is not safe to assume UID == GID or GID exists for username 'x').
     *
     * @since 2.2.0
     *
     * @param string $filepath
     *
     * @return array  Keys are id, name, group_id
     */
    public static function populateOwnerInfo( $filepath )
    {
        clearstatcache();
        $ownerID = fileowner($filepath);
        $ownerInfo = posix_getpwuid($ownerID);

        return array(
            'user_id'   => $ownerID,
            'user_name' => $ownerInfo['name'],
            'group_id'  => filegroup($filepath)
        );
    }

    /**
     *
     * @param string $file
     * @param string $owner
     * @param string $group
     */
    public static function changeUserGroup( $file, $owner, $group )
    {
        chown($file, $owner);
        chgrp($file, $group);
    }

    /**
     * Set file permissions of $file2 to match those of $file1.
     *
     * @since 2.2.0
     *
     * @param string $file1
     * @param string $file2
     */
    public static function matchPermissions( $file1, $file2 )
    {
        /**
         * convert fileperms() returned dec to oct
         */
        chmod($file2, (fileperms($file1) & 0777));
    }

    /**
     *
     * @since 1.14.3
     *
     * @param string $url
     * @param bool   $headerOnly
     *
     * @return string
     */
    public static function getUrlContentsUsingFileGetContents(
        $url,
        $headerOnly = false )
    {
        if ( ini_get('allow_url_fopen') ) {
            /**
             * silence warning when OpenSSL missing while getting LSCWP ver
             * file.
             */
            $url_content = @file_get_contents($url);

            if ( $url_content !== false ) {

                if ( $headerOnly ) {
                    return implode("\n", $http_response_header);
                }

                return $url_content;
            }
        }

        return '';
    }

    /**
     *
     * @since 1.14.3
     *
     * @param string $url
     * @param bool   $headerOnly
     *
     * @return string
     */
    public static function getUrlContentsUsingPhpCurl(
        $url,
        $headerOnly = false )
    {
        if ( function_exists('curl_version') ) {
            $ch = curl_init();

            curl_setopt_array(
                $ch,
                array(
                    CURLOPT_URL            => $url,
                    CURLOPT_RETURNTRANSFER => true,
                    CURLOPT_HEADER         => $headerOnly,
                    CURLOPT_NOBODY         => $headerOnly,
                    CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1
                )
            );

            $url_content = curl_exec($ch);
            curl_close($ch);

            if ( $url_content !== false ) {
                return $url_content;
            }
        }

        return '';
    }

    /**
     *
     * @since 1.14.3
     *
     * @param string $url
     * @param string $headerOnly
     *
     * @return string
     */
    public static function getUrlContentsUsingExecCurl(
        $url,
        $headerOnly = false )
    {
        $cmd = 'curl -s';

        if ( $headerOnly ) {
            $cmd .= ' -I';
        }

        exec("$cmd " . escapeshellarg($url), $output, $ret);

        if ( $ret === 0 ) {
            return implode("\n", $output);
        }

        return '';
    }

    /**
     *
     * @param string $url
     * @param bool   $headerOnly
     *
     * @return string
     */
    public static function get_url_contents( $url, $headerOnly = false )
    {
        $content = self::getUrlContentsUsingFileGetContents($url, $headerOnly);

        if ( $content != '' ) {
            return $content;
        }

        $content = self::getUrlContentsUsingPhpCurl($url, $headerOnly);

        if ( $content != '' ) {
            return $content;
        }

        return self::getUrlContentsUsingExecCurl($url, $headerOnly);
    }

    /**
     *
     * @param string $dir
     *
     * @return false|string
     */
    public static function DirectoryMd5( $dir )
    {
        if ( !is_dir($dir) ) {
            return false;
        }

        $fileMd5s = array();
        $d = dir($dir);

        while ( ($entry = $d->read()) !== false ) {

            if ( $entry != '.' && $entry != '..' ) {
                $currEntry = "$dir/$entry";

                if ( is_dir($currEntry) ) {
                    $fileMd5s[] = self::DirectoryMd5($currEntry);
                }
                else {
                    $fileMd5s[] = md5_file($currEntry);
                }
            }
        }

        $d->close();
        return md5(implode('', $fileMd5s));
    }

    /**
     *
     * @param string $file
     * @param string $backup
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     */
    private static function matchFileSettings( $file, $backup )
    {
        clearstatcache();
        $ownerID = fileowner($file);
        $groupID = filegroup($file);

        if ( $ownerID === false || $groupID === false ) {
            Logger::debug("Could not get owner/group of file $file");

            unlink($backup);

            Logger::debug("Removed file $backup");
            return false;
        }

        self::changeUserGroup($backup, $ownerID, $groupID);
        self::matchPermissions($file, $backup);

        return true;
    }

    /**
     *
     * @param string $filepath
     * @param string $bak
     *
     * @return string
     */
    private static function getBackupSuffix(
        $filepath,
        $bak = '_lscachebak_orig' )
    {
        $i = 1;

        if ( file_exists($filepath . $bak) ) {
            $bak = sprintf("_lscachebak_%02d", $i);

            while ( file_exists($filepath . $bak) ) {
                $i++;
                $bak = sprintf("_lscachebak_%02d", $i);
            }
        }

        return $bak;
    }

    /**
     *
     * @param string $filepath
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     * @throws LSCMException  Thrown indirectly by Logger::verbose() call.
     * @throws LSCMException  Thrown indirectly by self::matchFileSettings()
     *     call.
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     * @throws LSCMException  Thrown indirectly by Logger::info() call.
     */
    public static function createBackup( $filepath )
    {
        $backup = $filepath . self::getBackupSuffix($filepath);

        if ( !copy($filepath, $backup) ) {
            Logger::debug(
                "Could not backup file $filepath to location $backup"
            );

            return false;
        }

        Logger::verbose("Created file $backup");

        if ( !self::matchFileSettings($filepath, $backup) ) {
            Logger::debug(
                "Could not backup file $filepath to location $backup"
            );

            return false;
        }

        Logger::debug('Matched owner/group setting for both files');
        Logger::info(
            "Successfully backed up file $filepath to location $backup"
        );

        return true;
    }

    /**
     *
     * @param string $zipFile
     * @param string $dest
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     */
    public static function unzipFile( $zipFile, $dest )
    {
        if ( class_exists('\ZipArchive') ) {
            $zipArchive = new ZipArchive();

            if ( $zipArchive->open($zipFile) === true ) {
                $realDest = realpath($dest);

                if ( $realDest === false ) {
                    $zipArchive->close();
                    Logger::debug(
                        "Could not unzip $zipFile: destination directory does not exist."
                    );
                    return false;
                }

                $realDest = rtrim($realDest, '/') . '/';
                $slipDetected = false;

                for ( $i = 0; $i < $zipArchive->numFiles; $i++ ) {
                    $entryName = $zipArchive->getNameIndex($i);

                    if ( $entryName === false ) {
                        continue;
                    }

                    /**
                     * Resolve the entry path without relying on realpath()
                     * (extracted file does not exist yet). Walk each segment,
                     * collapsing '.' and '..', then check the result is
                     * confined to $realDest.
                     */
                    $parts = [];

                    foreach ( explode('/', $realDest . $entryName) as $part ) {

                        if ( $part === '' || $part === '.' ) {
                            continue;
                        }

                        if ( $part === '..' ) {
                            array_pop($parts);
                        }
                        else {
                            $parts[] = $part;
                        }
                    }

                    $resolvedPath = '/' . implode('/', $parts);

                    if ( strncmp($realDest, $resolvedPath . '/', strlen($realDest)) !== 0 ) {
                        $slipDetected = true;
                        break;
                    }
                }

                if ( $slipDetected ) {
                    $zipArchive->close();
                    Logger::debug(
                        "Zip-slip attempt detected in $zipFile - extraction aborted."
                    );
                    return false;
                }

                $extracted = $zipArchive->extractTo($dest);
                $zipArchive->close();

                if ( $extracted ) {
                    return true;
                }
            }

            Logger::debug("Could not unzip $zipFile using ZipArchive.");
        }
        else {
            Logger::debug(
                "Could not unzip $zipFile: ZipArchive extension unavailable."
            );
        }

        return false;
    }

    /**
     * Returns true if $path is a non-empty absolute filesystem path
     * containing only characters safe for use in shell commands and Apache
     * configuration (alphanumerics, underscore, hyphen, period, forward
     * slash) and no '..' traversal segments.
     *
     * Use this to gate values before interpolating them into shell commands
     * or writing them into configuration files.
     *
     * @since 1.17.10
     *
     * @param string $path
     *
     * @return bool
     */
    public static function isSafeAbsPath( $path )
    {
        if ( !is_string($path) || $path === '' || $path[0] !== '/' ) {
            return false;
        }

        if ( !preg_match('#^/[A-Za-z0-9_./\-]*$#', $path) ) {
            return false;
        }

        $normalizedPath = rtrim($path, '/');

        if ( $normalizedPath === '' ) {
            return false;
        }

        foreach ( array_slice(explode('/', $normalizedPath), 1) as $segment ) {

            if ( $segment === '' || $segment === '.' || $segment === '..' ) {
                return false;
            }
        }

        return true;
    }

    /**
     * Check if a given directory is empty.
     *
     * @param string $dir
     *
     * @return bool
     */
    public static function is_dir_empty( $dir )
    {
        if ( !($handle = @opendir($dir)) ) {
            return true;
        }

        while ( ($entry = readdir($handle)) !== false ) {

            if ( $entry != '.' && $entry != '..' ) {
                return false;
            }
        }

        return true;
    }

    /**
     *
     * @param string $vhCacheRoot
     */
    public static function ensureVHCacheRootInCage( $vhCacheRoot )
    {
        $cageFsFile = '/etc/cagefs/cagefs.mp';

        if ( file_exists($cageFsFile) ) {

            if ( $vhCacheRoot[0] == '/' ) {
                $cageVhCacheRoot =
                    '%' . str_replace('/$vh_user', '', $vhCacheRoot);

                $matchFound = preg_grep(
                    "!^\s*" . str_replace('!', '\!', $cageVhCacheRoot) . "!im",
                    file($cageFsFile)
                );

                if ( !$matchFound ) {
                    file_put_contents(
                        $cageFsFile,
                        "\n$cageVhCacheRoot",
                        FILE_APPEND
                    );

                    exec('/usr/sbin/cagefsctl --remount-all');
                }
            }
        }
    }

    /**
     * Recursively a directory's contents and optionally the directory itself.
     *
     * @param string $dir        Directory path
     * @param bool   $keepParent Only remove directory contents when true.
     *
     * @return bool
     */
    public static function rrmdir( $dir, $keepParent = false )
    {
        if ( !is_string($dir)
                || $dir === ''
                || $dir === '/'
                || $dir === '.'
                || $dir === '..' ) {
            return false;
        }

        /**
         * V14 (CWE-59): if the top-level path itself is a symlink, never descend
         * through it. is_dir() follows symlinks, so recursing here would
         * enumerate and delete the link target's contents. Remove only the
         * link node instead.
         */
        if ( is_link($dir) ) {
            return $keepParent ? false : unlink($dir);
        }

        if ( is_dir($dir) ) {

            if ( ($matches = glob("$dir/*")) === false ) {
                return false;
            }

            foreach ( $matches as $file ) {

                /**
                 * V14 (CWE-59): never descend into symlinked directories. A symlink
                 * whose target is a directory makes is_dir() true, which would
                 * cause recursion to delete files outside the intended tree.
                 * Remove the link node itself instead.
                 */
                if ( is_link($file) ) {
                    unlink($file);
                }
                elseif ( is_dir($file) ) {
                    self::rrmdir($file);
                }
                else {
                    unlink($file);
                }
            }

            if ( !$keepParent ) {
                rmdir($dir);
            }

            return true;
        }

        return false;
    }

    /**
     * Wrapper for idn_to_utf8() function call to avoid "undefined" exceptions
     * when PHP intl module is not installed and enabled.
     *
     * @since 1.13.13.1
     *
     * @param string     $domain
     * @param int        $flags
     * @param int|null   $variant
     * @param array|null $idna_info
     *
     * @return false|string
     */
    public static function tryIdnToUtf8(
        $domain,
        $flags = 0,
        $variant = null,
        &$idna_info = null
    )
    {
        if ( empty($domain) || !function_exists('idn_to_utf8') ) {
            return $domain;
        }

        if ( defined('INTL_IDNA_VARIANT_UTS46') ) {

            if ( $variant == null ) {
                $variant = INTL_IDNA_VARIANT_UTS46;
            }

            return idn_to_utf8($domain, $flags, $variant, $idna_info);
        }

        return idn_to_utf8($domain, $flags);
    }

    /**
     * Wrapper for idn_to_ascii() function call to avoid "undefined" exceptions
     * when PHP intl module is not installed and enabled.
     *
     * @since 1.13.13.1
     *
     * @param string     $domain
     * @param int|null   $flags
     * @param int|null   $variant
     * @param array|null $idna_info
     *
     * @return false|string
     */
    public static function tryIdnToAscii(
        $domain,
        $flags = null,
        $variant = null,
        &$idna_info = null
    )
    {
        if ( empty($domain) || !function_exists('idn_to_ascii') ) {
            return $domain;
        }

        if ( $flags == null ) {
            $flags = IDNA_DEFAULT;
        }

        if ( defined('INTL_IDNA_VARIANT_UTS46') ) {

            if ( $variant == null ) {
                $variant = INTL_IDNA_VARIANT_UTS46;
            }

            return idn_to_ascii($domain, $flags, $variant, $idna_info);
        }

        return idn_to_ascii($domain, $flags);
    }

    /**
     * Version comparison function capable of properly comparing versions with
     * trailing ".0" groups such as '6.1' which is equal to '6.1.0' which is
     * equal to '6.1.000.0' etc.
     *
     * @since 1.14.2
     *
     * @param string      $ver1
     * @param string      $ver2
     * @param string|null $operator
     *
     * @return bool|int
     */
    public static function betterVersionCompare(
        $ver1,
        $ver2,
        $operator = null )
    {
        $pattern = '/(\.0+)+($|-)/';

        return version_compare(
            preg_replace($pattern, '', $ver1),
            preg_replace($pattern, '', $ver2),
            $operator
        );
    }

    /**
     *
     * @since 1.15.0.1
     *
     * @param string                           $constantName
     * @param array|bool|float|int|null|string $value
     * @param bool                             $caseInsensitive  Optional
     *     parameter used for define calls in PHP versions below 7.3.
     *
     * @return bool
     *
     * @noinspection PhpDeprecationInspection  Ignore deprecation of define()
     *     parameter $case_insensitive for PHP versions below 7.3.
     * @noinspection RedundantSuppression
     */
    public static function define_wrapper(
        $constantName,
        $value,
        $caseInsensitive = false )
    {
        if ( PHP_VERSION_ID < 70300 ) {
            return define($constantName, $value, $caseInsensitive);
        }
        else {
            return define($constantName, $value);
        }
    }

    /**
     *
     * @since 1.17.1.1
     *
     * @param int $wpStatus
     *
     * @return string[]  [ stateMsg => string, link => string ]
     */
    public static function getFatalErrorStateMessageAndLink( $wpStatus )
    {
        $stateMsg = $anchor = '';

        if ( $wpStatus & WPInstall::ST_ERR_EXECMD ) {
            $stateMsg = 'WordPress fatal error encountered during action '
                . 'execution. This is most likely caused by custom code in '
                . 'this WordPress installation.';
            $anchor   = '#fatal-error-encountered-during-action-execution';
        }
        if ( $wpStatus & WPInstall::ST_ERR_EXECMD_DB ) {
            $stateMsg = 'Error establishing WordPress database connection.';
        }
        elseif ( $wpStatus & WPInstall::ST_ERR_TIMEOUT ) {
            $stateMsg = 'Timeout occurred during action execution.';
            $anchor   = '#timeout-occurred-during-action-execution';
        }
        elseif ( $wpStatus & WPInstall::ST_ERR_SITEURL ) {
            $stateMsg = 'Could not retrieve WordPress siteURL.';
            $anchor   = '#could-not-retrieve-wordpress-siteurl';
        }
        elseif ( $wpStatus & WPInstall::ST_ERR_DOCROOT ) {
            $stateMsg = 'Could not match WordPress siteURL to a known '
                . 'control panel docroot.';
            $anchor   = '#could-not-match-wordpress-siteurl-to-a-known-'
                . 'cpanel-docroot';
        }
        elseif ( $wpStatus & WPInstall::ST_ERR_WPCONFIG ) {
            $stateMsg = 'Could not find a valid wp-config.php file.';
            $anchor   = '#could-not-find-a-valid-wp-configphp-file';
        }

        $stateMsg .= ' Click for more information.';

        return array(
            'stateMsg' => $stateMsg,
            'link'     => 'https://docs.litespeedtech.com/lsws/cp/cpanel/'
                . "whm-litespeed-plugin/troubleshooting/$anchor"
        );
    }

    /**
     * Locate a usable CA-certificate bundle in a panel-agnostic way.
     *
     * Probes well-known locations on the major Linux distributions and
     * supported control panels in priority order (OS-level bundles are
     * preferred over panel-managed ones). Returns the first readable path,
     * or '' when nothing is found (callers should then rely on the tool's
     * built-in default trust store).
     *
     * @return string  Absolute path to a CA bundle, or '' if none found.
     */
    public static function getSystemCaBundle()
    {
        static $resolved = null;

        if ( $resolved !== null ) {
            return $resolved;
        }

        $candidates = array(
            // OS-level bundles — preferred; kept current by the distro.
            '/etc/ssl/certs/ca-certificates.crt',               // Debian/Ubuntu/Alpine
            '/etc/pki/tls/certs/ca-bundle.crt',                 // RHEL/CentOS/AlmaLinux/Rocky
            '/etc/ssl/cert.pem',                                 // FreeBSD/OpenBSD/macOS
            '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',// RHEL update-ca-trust
            '/etc/ssl/ca-bundle.pem',                            // SUSE/openSUSE
            // Panel-managed bundles — fallback when OS bundle is absent.
            '/usr/local/cpanel/3rdparty/share/ca-bundle/curl-ca-bundle.crt',
            '/opt/psa/var/certificates/ca-bundle.crt',           // Plesk
            '/usr/local/directadmin/conf/carootcert.pem',        // DirectAdmin
        );

        foreach ( $candidates as $path ) {
            if ( is_file($path) && is_readable($path) ) {
                return $resolved = $path;
            }
        }

        return $resolved = '';
    }

    /**
     * Build the wget '--ca-certificate=...' argument string.
     *
     * Returns the shell-quoted flag with a trailing space when a bundle is
     * found, or '' when nothing was found (callers should omit the flag and
     * rely on the system default trust store — never pass
     * --no-check-certificate).
     *
     * @return string
     */
    public static function getWgetCaArg()
    {
        $bundle = self::getSystemCaBundle();

        return $bundle === ''
            ? ''
            : '--ca-certificate=' . escapeshellarg($bundle) . ' ';
    }

    /**
     * Build the curl '--cacert ...' argument string.
     *
     * Returns the shell-quoted flag with a trailing space when a bundle is
     * found, or '' when nothing was found (callers should omit the flag and
     * rely on the system default trust store — never pass --insecure).
     *
     * @return string
     */
    public static function getCurlCaArg()
    {
        $bundle = self::getSystemCaBundle();

        return $bundle === ''
            ? ''
            : '--cacert ' . escapeshellarg($bundle) . ' ';
    }

}