<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class  Aabcore_Firewall {

	/**
	 * Register hooks.
	 */


    public function run() {
        $this->inspect_request();
    }


	/**
	 * Inspect every incoming request.
	 */
	public function inspect_request() {

		$reason = $this->should_block_request();

		if ( $reason ) {
			$this->block_request( $reason );
		}
	}

	/**
	 * Check whether the request matches a small set of suspicious patterns.
	 *
	 * @return string|false
	 */
	protected function should_block_request() {


		$uri = isset( $_SERVER['REQUEST_URI'] )	? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) )	: '';


		if ( isset( $_GET['aabcore_my_nonce'] ) ) {
	check_admin_referer( 'aabcore_my_action', 'aabcore_my_nonce' );
			return;
		}
$get_data  =  isset( $_GET )
			? wp_unslash( $_GET )
			: array();  

$post_data =  isset( $_POST )
			? wp_unslash( $_POST )
			: array();

$request = strtolower(
	urldecode(
		$uri . ' ' .
		http_build_query( $get_data ) . ' ' .
		http_build_query( $post_data )
	)
);


		$rules = array(

			// SQL injection.
			'/union\s+select/i' => 'SQL Injection',
			'/sleep\s*\(/i'     => 'SQL Injection',


			'/<iframe/i'                 => 'Cross Site Scripting',


			// XSS.
			'/<script\b/i'      => 'Cross-Site Scripting',
			'/javascript:/i'    => 'Cross-Site Scripting',

			// Directory traversal.
		//	'/\.\.\//'          => 'Directory Traversal',

			// PHP injection.
		//	'/<\?php/i'         => 'PHP Injection',

			// Common scanner probes.
			'/\/\.env/i'        => 'Sensitive File Probe',
			'/\/wp-config/i'    => 'Config File Probe',
		);

		foreach ( $rules as $pattern => $reason ) {
			if ( preg_match( $pattern, $request ) ) {
				return $reason;
			}
		}

		return false;
	}

	/**
	 * Log blocked requests.
	 *
	 * @param string $reason Block reason.
	 *//*
	protected function log_event( $reason ) {

		error_log(
			sprintf(
				'[Firewall] %s | IP: %s | URI: %s',
				$reason,
				sanitize_text_field( wp_unslash($_SERVER['REMOTE_ADDR'])) ?? 'unknown',
				sanitize_text_field( wp_unslash($_SERVER['REQUEST_URI'])) ?? '/'
			)
		);
	}*/

	/**
	 * Block the request.
	 *
	 * @param string $reason Block reason.
	 */
	protected function block_request( $reason ) {

		//$this->log_event( $reason );

		status_header( 403 );

		wp_die(
			esc_html__( 'Your request has been blocked by the firewall.', 'aabcore-malware-virus-scan' ),
			esc_html__( 'Access Denied', 'aabcore-malware-virus-scan' ),
			array(
				'response' => 403,
			)
		);
exit();
	}
}