<?php
/**
 * Opening an attached file from the dashboard.
 *
 * The files sit in a folder that is closed to the public, so they cannot be
 * reached with an ordinary link. That is deliberate. This is the only way
 * through, and it is a narrow one:
 *
 * 1. The `manage_options` capability is required
 * 2. A nonce tied to that very file is required
 * 3. The path is built from OUR folder and the name out of the database, never
 *    from the address
 * 4. After it is built, it is checked once more that the file really is inside
 *    our folder, so that getting out through `..` is not possible
 *
 * Copyright (c) 2026 Quantum, Serbia. https://2ranq.com
 *
 * This program is free software: you can redistribute it and change it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 2 of the License, or any later version. The full
 * text is in LICENSE.txt, next to this file.
 *
 * @package Ranq_Forms
 */

defined( 'ABSPATH' ) || exit;

/**
 * Ranq_Forms_File_Access
 */
class Ranq_Forms_File_Access {

	/**
	 * The name of the action.
	 */
	const ACTION = 'ranq_forms_file';

	/**
	 * Hooks up.
	 *
	 * @return void
	 */
	public static function hooks() {

		add_action( 'admin_post_' . self::ACTION, array( __CLASS__, 'serve' ) );
	}

	/**
	 * The address the file is opened through.
	 *
	 * @param int $entry_id The entry id.
	 * @param int $index    Which file in order, when there are several.
	 *
	 * @return string
	 */
	public static function url( $entry_id, $index ) {

		return wp_nonce_url(
			admin_url(
				'admin-post.php?action=' . self::ACTION
				. '&entry=' . absint( $entry_id )
				. '&i=' . absint( $index )
			),
			self::ACTION . '_' . absint( $entry_id ) . '_' . absint( $index )
		);
	}

	/**
	 * Sends the file to the browser.
	 *
	 * @return void
	 */
	public static function serve() {

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to open this file.', '2ranq-forms' ), '', array( 'response' => 403 ) );
		}

		$entry_id = isset( $_GET['entry'] ) ? absint( wp_unslash( $_GET['entry'] ) ) : 0;
		$index    = isset( $_GET['i'] ) ? absint( wp_unslash( $_GET['i'] ) ) : 0;

		check_admin_referer( self::ACTION . '_' . $entry_id . '_' . $index );

		$file = self::find( $entry_id, $index );

		if ( ! $file ) {
			wp_die( esc_html__( 'That file no longer exists.', '2ranq-forms' ), '', array( 'response' => 404 ) );
		}

		$dir = Ranq_Forms_Uploads::dir();

		if ( ! $dir ) {
			wp_die( esc_html__( 'That file no longer exists.', '2ranq-forms' ), '', array( 'response' => 404 ) );
		}

		// The path is built from OUR folder and the name out of the database.
		$path = trailingslashit( $dir ) . ltrim( (string) $file['file'], '/\\' );
		$real = realpath( $path );
		$base = realpath( $dir );

		// And after all that, one more check that the file really is inside our folder.
		if ( ! $real || ! $base || 0 !== strpos( $real, $base ) || ! is_file( $real ) ) {
			wp_die( esc_html__( 'That file no longer exists.', '2ranq-forms' ), '', array( 'response' => 404 ) );
		}

		$name = isset( $file['name'] ) ? sanitize_file_name( $file['name'] ) : wp_basename( $real );
		$type = wp_check_filetype( $real );
		$mime = $type['type'] ? $type['type'] : 'application/octet-stream';

		nocache_headers();

		header( 'Content-Type: ' . $mime );
		header( 'Content-Length: ' . filesize( $real ) );
		header( 'Content-Disposition: attachment; filename="' . $name . '"' );

		// This is the most important header here. Without it the browser could decide
		// for itself that the file is something other than it says, and open it so.
		header( 'X-Content-Type-Options: nosniff' );

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- the file is sent to the browser, it is not read into memory.
		readfile( $real );

		exit;
	}

	/**
	 * Finds the data about a file inside an entry.
	 *
	 * @param int $entry_id The entry id.
	 * @param int $index    Which file in order.
	 *
	 * @return array|null
	 */
	private static function find( $entry_id, $index ) {

		global $wpdb;

		$table = Ranq_Forms_Install::entries_table();

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		$row = $wpdb->get_row(
			// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- the table name comes from $wpdb->prefix and cannot come from a visitor, and `prepare` cannot bind a table name.
			$wpdb->prepare( "SELECT fields FROM {$table} WHERE id = %d", $entry_id ),
			ARRAY_A
		);

		if ( ! $row ) {
			return null;
		}

		$values = json_decode( $row['fields'], true );

		if ( ! is_array( $values ) ) {
			return null;
		}

		// Every file out of every field of that entry, in order.
		$all = array();

		foreach ( $values as $value ) {

			if ( is_array( $value ) && ! empty( $value['files'] ) && is_array( $value['files'] ) ) {
				foreach ( $value['files'] as $one ) {
					$all[] = $one;
				}
			}
		}

		return isset( $all[ $index ] ) ? $all[ $index ] : null;
	}

	/**
	 * Every file of one entry, with the address to open it by.
	 *
	 * @param int   $entry_id The entry id.
	 * @param array $values   The entry values.
	 *
	 * @return array
	 */
	public static function list_for_entry( $entry_id, $values ) {

		$list  = array();
		$index = 0;

		foreach ( $values as $value ) {

			if ( ! is_array( $value ) || empty( $value['files'] ) || ! is_array( $value['files'] ) ) {
				continue;
			}

			foreach ( $value['files'] as $one ) {
				$list[] = array(
					'name' => isset( $one['name'] ) ? $one['name'] : '',
					'size' => isset( $one['size'] ) ? (int) $one['size'] : 0,
					'url'  => self::url( $entry_id, $index ),
				);

				++$index;
			}
		}

		return $list;
	}
}