<?php
/**
 * Critical PHP flaws: a red, non-dismissible warning on every admin screen, a critical Site
 * Audit finding and one email while the web server's PHP is below the fix for a flaw that lets
 * anyone run code on the server.
 *
 * WHY THIS EXISTS
 * ---------------
 * On 2026-10-21 php.net shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for php2shell
 * (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2): unauthenticated remote code execution in
 * PHP's own request handling, exploited within hours. It fires before WordPress loads, so no
 * plugin can block it; the only fix is the host upgrading PHP. PHP Advisory Alerts already says
 * so, but it is off on a default install (it fetches a feed), and most sites running this plugin
 * would have heard nothing.
 *
 * So the flaws that matter this much are listed here, in the plugin, and checked against the
 * local PHP version. Nothing is fetched and nothing about the site is sent: the check works with
 * every opt-in switch off. A new entry ships in a plugin release.
 *
 * WHICH PHP
 * ---------
 * On a web request, PHP_VERSION is the web server's. Under the CLI (WP-CLI, a system cron) it
 * may be a different binary, so the version recorded by CSDT_Php_Advisory::observe_runtime()
 * is used instead, and nothing is said while none is recorded.
 *
 * Writes: one option row when an alert is sent, once per flaw and PHP version. A page view that
 * sends nothing writes nothing.
 *
 * @package CloudScale_Cyber_DevTools
 */

defined( 'ABSPATH' ) || exit;

/**
 * Built-in list of critical PHP flaws, checked against the web server's PHP.
 */
final class CSDT_Php_Critical {

	/** {flaw id => PHP version it was alerted for}. Swept by uninstall's csdt_ prefix. */
	const OPTION_SENT = 'csdt_php_critical_sent';

	/**
	 * The flaws. 'fixed' maps each branch php.net patched to its first fixed release. A branch
	 * older than every listed one got no fix and is reported as exposed; a newer one shipped
	 * after the fix and is not.
	 *
	 * An optional 'requires' narrows a flaw to the environments it can be exploited in: 'os' is
	 * PHP_OS_FAMILY and 'sapi' is a list of web SAPIs. A flaw whose environment this site is not in
	 * is never reported, so a flaw that only bites PHP-CGI on Windows does not alarm the Linux and
	 * PHP-FPM sites that are the norm. 'note' is an extra sentence appended for that flaw.
	 */
	const FLAWS = array(
		array(
			'id'        => 'php2shell-2026-10',
			'name'      => 'php2shell',
			'cves'      => array( 'CVE-2026-109618', 'CVE-2026-109619' ),
			'cvss'      => '9.2',
			'disclosed' => '2026-10-21',
			'fixed'     => array(
				'8.2' => '8.2.35',
				'8.3' => '8.3.36',
				'8.4' => '8.4.27',
				'8.5' => '8.5.12',
			),
		),
		array(
			'id'        => 'php-cgi-argument-injection-2024-06',
			'name'      => 'PHP-CGI argument injection',
			'cves'      => array( 'CVE-2024-4577' ),
			'cvss'      => '9.8',
			'disclosed' => '2024-06-06',
			'fixed'     => array(
				'8.1' => '8.1.29',
				'8.2' => '8.2.20',
				'8.3' => '8.3.8',
			),
			'requires'  => array(
				'os'   => 'Windows',
				'sapi' => array( 'cgi-fcgi', 'cgi' ),
			),
			'note'      => 'This one is exploitable only where PHP runs in CGI mode (php-cgi) on Windows, which is this server. Serving PHP through PHP-FPM instead, or putting the CloudScale Edge Gateway in front of the site, also closes it.',
		),
	);

	/** Test-only PHP version, SAPI and OS. Null in production. */
	public static $version_override = null;
	public static $sapi_override    = null;
	public static $os_override      = null;

	/** Hooks. Called from CSDT_DevTools::init(). */
	public static function register(): void {
		add_action( 'admin_notices', array( __CLASS__, 'render_notice' ), 5, 0 );
		add_action( 'network_admin_notices', array( __CLASS__, 'render_notice' ), 5, 0 );
		// After CSDT_Php_Advisory::observe_runtime() (20), so a just-upgraded PHP is recorded first.
		add_action( 'admin_init', array( __CLASS__, 'maybe_alert' ), 30, 0 );
		// Core's own twice-daily cron, present on every install: sites nobody logs in to still email.
		add_action( 'wp_version_check', array( __CLASS__, 'maybe_alert' ), 30, 0 );
	}

	// ── Assessment ─────────────────────────────────────────────────────────

	/**
	 * The web server's PHP version, or '' when it cannot be known from this process.
	 *
	 * @return string
	 */
	public static function version(): string {
		$sapi = null !== self::$sapi_override ? self::$sapi_override : PHP_SAPI;
		if ( '' !== $sapi && ! in_array( $sapi, array( 'cli', 'phpdbg', 'embed', 'cli-server' ), true ) ) {
			return CSDT_Php_Advisory::clean_version( null !== self::$version_override ? self::$version_override : PHP_VERSION );
		}
		$rt = CSDT_Php_Advisory::runtime();
		return null === $rt ? '' : $rt['version'];
	}

	/**
	 * The web server's SAPI: this process's when it is a web one, else the recorded runtime SAPI,
	 * so the cron path knows it too. '' when it cannot be known.
	 *
	 * @return string
	 */
	public static function sapi(): string {
		$sapi = null !== self::$sapi_override ? self::$sapi_override : PHP_SAPI;
		if ( '' !== $sapi && ! in_array( $sapi, array( 'cli', 'phpdbg', 'embed', 'cli-server' ), true ) ) {
			return $sapi;
		}
		$rt = CSDT_Php_Advisory::runtime();
		return null === $rt ? '' : (string) $rt['sapi'];
	}

	/** The server's OS family (PHP_OS_FAMILY); the one machine serves both web requests and cron. */
	public static function os(): string {
		return null !== self::$os_override ? self::$os_override : PHP_OS_FAMILY;
	}

	/**
	 * Whether this site is in an environment a flaw's 'requires' narrows it to. A missing key is
	 * not a constraint; an unknown SAPI ('') matches nothing, so a flaw is never reported on a guess.
	 *
	 * @param array $requires {os?:string, sapi?:string[]}
	 * @return bool
	 */
	private static function environment_has( array $requires ): bool {
		if ( isset( $requires['os'] ) && self::os() !== $requires['os'] ) {
			return false;
		}
		if ( isset( $requires['sapi'] ) && ! in_array( self::sapi(), (array) $requires['sapi'], true ) ) {
			return false;
		}
		return true;
	}

	/**
	 * The listed flaws a PHP version has.
	 *
	 * @param string $version A clean PHP version, "8.3.35".
	 * @return array<int,array{id:string,name:string,cves:string[],cvss:string,disclosed:string,branch:string,fixed:string,upgrade:string,note:string}>
	 *         fixed is '' when php.net shipped no fix for the branch; upgrade is what to ask for;
	 *         note is an extra sentence for the flaw, or ''.
	 */
	public static function assess( string $version ): array {
		if ( ! preg_match( '/^(\d+)\.(\d+)\.\d+$/', $version, $m ) ) {
			return array();
		}
		$branch = $m[1] . '.' . $m[2];
		$out    = array();
		foreach ( self::FLAWS as $f ) {
			if ( isset( $f['requires'] ) && ! self::environment_has( $f['requires'] ) ) {
				continue;
			}
			$branches = array_keys( $f['fixed'] );
			usort( $branches, 'version_compare' );
			$fixed = '';
			if ( isset( $f['fixed'][ $branch ] ) ) {
				if ( version_compare( $version, $f['fixed'][ $branch ], '>=' ) ) {
					continue;
				}
				$fixed   = $f['fixed'][ $branch ];
				$upgrade = 'PHP ' . $fixed . ' or later';
			} elseif ( version_compare( $branch, $branches[0], '<' ) ) {
				$upgrade = 'a supported PHP branch: ' . implode( ', ', array_map( array( __CLASS__, 'or_later' ), array_values( $f['fixed'] ) ) );
			} else {
				continue;
			}
			$out[] = array(
				'id'        => $f['id'],
				'name'      => $f['name'],
				'cves'      => $f['cves'],
				'cvss'      => $f['cvss'],
				'disclosed' => $f['disclosed'],
				'branch'    => $branch,
				'fixed'     => $fixed,
				'upgrade'   => $upgrade,
				'note'      => $f['note'] ?? '',
			);
		}
		return $out;
	}

	/** "8.3.36" reads "8.3.36+". */
	private static function or_later( string $v ): string {
		return $v . '+';
	}

	/**
	 * The listed flaws this site's PHP has. Empty when none, or the version is unknown.
	 *
	 * @return array
	 */
	public static function current(): array {
		$v = self::version();
		return '' === $v ? array() : self::assess( $v );
	}

	/**
	 * One plain sentence per flaw: what it is and what to ask the host for.
	 *
	 * @param array  $hit     One assess() row.
	 * @param string $version The PHP version.
	 * @return string
	 */
	public static function sentence( array $hit, string $version ): string {
		$fix = '' === $hit['fixed']
			? 'php.net shipped no fix for PHP ' . $hit['branch'] . '. '
			: 'Fixed in PHP ' . $hit['fixed'] . '. ';
		$note = '' !== (string) ( $hit['note'] ?? '' ) ? ' ' . $hit['note'] : '';
		return 'PHP ' . $version . ' has ' . $hit['name'] . ' (' . implode( ', ', $hit['cves'] ) . ', CVSS ' . $hit['cvss'] . ', disclosed ' . $hit['disclosed'] . '): anyone on the internet can run code on this server without logging in. '
			. $fix . 'The flaw is in PHP itself, so no WordPress plugin or setting can block it. Ask your host to upgrade to ' . $hit['upgrade'] . ' today.' . $note;
	}

	// ── Site Audit ─────────────────────────────────────────────────────────

	/**
	 * The critical finding, or null when this site's PHP has no listed flaw. Never a request.
	 *
	 * @return array<string,mixed>|null
	 */
	public static function finding(): ?array {
		$v    = self::version();
		$hits = '' === $v ? array() : self::assess( $v );
		if ( array() === $hits ) {
			return null;
		}
		$names   = array();
		$details = array();
		$asks    = array();
		foreach ( $hits as $h ) {
			$names[]   = $h['name'];
			$details[] = self::sentence( $h, $v );
			$asks[]    = $h['upgrade'];
		}
		return array(
			'key'      => 'php_critical_unpatched',
			'category' => 'Security',
			'severity' => 'critical',
			'title'    => 'PHP ' . $v . ' has ' . implode( ' and ', $names ) . ': anyone can run code on this server',
			'detail'   => implode( ' ', $details ),
			'fix'      => 'Ask your host to upgrade to ' . implode( '; ', array_unique( $asks ) ) . '. On your own server, install the PHP update; on Docker, rebuild the image. Then reload any admin page: this warning clears by itself. Status: AI Security Scan → PHP Advisory Alerts.',
			'affected' => 'PHP ' . $v . ' (web server)',
		);
	}

	// ── The notice ─────────────────────────────────────────────────────────

	/** admin_notices: red, every admin screen, manage_options only, not dismissible while true. */
	public static function render_notice(): void {
		try {
			if ( ! current_user_can( 'manage_options' ) ) {
				return;
			}
			$v    = self::version();
			$hits = '' === $v ? array() : self::assess( $v );
			if ( array() === $hits ) {
				return;
			}
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
			return;
		}
		$href = admin_url( 'admin.php?page=' . CSDT_DevTools::TOOLS_SLUG . '&tab=security' ) . '#cs-panel-php-advisory';
		?>
		<div class="notice notice-error" id="csdt-php-critical-notice" style="border-left-width:6px;padding:10px 14px;background:#fef2f2;">
			<p style="margin:0 0 6px;font-size:15px;color:#7f1d1d;">
				<strong>
				<?php
				/* translators: %s: the PHP version. */
				echo esc_html( sprintf( __( 'Critical: this server\'s PHP %s can be taken over by anyone on the internet.', 'cloudscale-cyber-devtools' ), $v ) );
				?>
				</strong>
			</p>
			<?php foreach ( $hits as $h ) : ?>
			<p style="margin:0 0 6px;font-size:13px;color:#1f2937;"><?php echo esc_html( self::sentence( $h, $v ) ); ?></p>
			<?php endforeach; ?>
			<p style="margin:0;font-size:13px;">
				<a href="<?php echo esc_url( $href ); ?>"><?php esc_html_e( 'PHP Advisory Alerts', 'cloudscale-cyber-devtools' ); ?></a>
				<span style="color:#4b5563;"><?php esc_html_e( 'This warning goes away by itself once PHP is upgraded.', 'cloudscale-cyber-devtools' ); ?></span>
			</p>
		</div>
		<?php
	}

	// ── The alert ──────────────────────────────────────────────────────────

	/**
	 * Sends one alert per flaw and PHP version: Telegram when set up, and the admin email.
	 * Writes only when it sends. Fails open.
	 *
	 * @return int Alerts sent.
	 */
	public static function maybe_alert(): int {
		try {
			$v    = self::version();
			$hits = '' === $v ? array() : self::assess( $v );
			if ( array() === $hits ) {
				return 0;
			}
			$sent = get_option( self::OPTION_SENT, array() );
			$sent = is_array( $sent ) ? $sent : array();
			$n    = 0;
			foreach ( $hits as $h ) {
				if ( ( $sent[ $h['id'] ] ?? '' ) === $v ) {
					continue;
				}
				// Recorded before sending, so a slow or failing mailer never sends it twice.
				$sent[ $h['id'] ] = $v;
				update_option( self::OPTION_SENT, $sent, false );
				self::deliver( $h, $v );
				++$n;
			}
			return $n;
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
			return 0;
		}
	}

	/**
	 * One alert.
	 *
	 * @param array  $h One assess() row.
	 * @param string $v The PHP version.
	 * @return void
	 */
	private static function deliver( array $h, string $v ): void {
		$site = wp_specialchars_decode( (string) ( get_bloginfo( 'name' ) ?: home_url() ), ENT_QUOTES );
		$subj = sprintf( 'CRITICAL: PHP %s on %s has %s, upgrade PHP now', $v, $site, $h['name'] );
		$body = self::sentence( $h, $v ) . "\n\nSite: " . home_url() . "\nPHP Advisory Alerts: " . admin_url( 'admin.php?page=' . CSDT_DevTools::TOOLS_SLUG . '&tab=security' ) . '#cs-panel-php-advisory'
			. "\n\nSent once for this PHP version. The red warning in wp-admin stays until PHP is upgraded.";
		if ( class_exists( 'CSDT_Alert_Events' ) ) {
			CSDT_Alert_Events::send( CSDT_Alert_Events::SECURITY, $subj . "\n\n" . $body, 'Critical PHP flaw', 'critical' );
		}
		if ( is_callable( array( 'CSDT_Threat_Monitor', 'send_alert_email' ) ) ) {
			CSDT_Threat_Monitor::send_alert_email( (string) get_option( 'admin_email' ), $subj, $body );
		}
	}
}