<?php
/**
 * PHP security advisory check (php2shell, CVE-2026-109618 / CVE-2026-109619).
 *
 * Compares the running PHP version with the first fixed release of its branch
 * (php.net advisory, 21 October 2026). A plugin cannot patch PHP; this only tells
 * the site owner whether the version number is a fixed one and what to ask the host.
 *
 * @package OvanapAdminToolkit
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * First fixed release per PHP branch. Branches not listed get no official fix.
 *
 * @return array
 */
function ovkit_php_fixed_versions(): array {
	return array(
		'8.6' => '8.6.0RC4',
		'8.5' => '8.5.12',
		'8.4' => '8.4.27',
		'8.3' => '8.3.36',
		'8.2' => '8.2.35',
	);
}

/**
 * Patch status of the running PHP.
 *
 * Status values:
 * - patched:     version is at or above the fixed release of its branch.
 * - unpatched:   version is below the fixed release (unless the host backported the fix).
 * - unsupported: branch gets no official fix (8.1 and older); only a vendor backport helps.
 *
 * @param string $version PHP version to check (defaults to the running one).
 * @param string $sapi    Server API (defaults to the running one).
 * @return array
 */
function ovkit_php_patch_status( string $version = PHP_VERSION, string $sapi = PHP_SAPI ): array {
	$fixed = ovkit_php_fixed_versions();
	// Distribution builds append a package suffix ("8.3.6-1ubuntu1.2"); compare the upstream part only.
	if ( preg_match( '/^\d+\.\d+\.\d+(?:RC\d+)?/i', $version, $m ) ) {
		$version = $m[0];
	}
	$parts  = explode( '.', $version );
	$branch = $parts[0] . '.' . ( $parts[1] ?? '0' );
	$needed = $fixed[ $branch ] ?? '';

	if ( '' === $needed ) {
		$status = version_compare( $branch, '8.2', '<' ) ? 'unsupported' : 'patched';
	} else {
		$status = version_compare( $version, $needed, '>=' ) ? 'patched' : 'unpatched';
	}

	return array(
		'status'          => $status,
		'version'         => $version,
		'branch'          => $branch,
		'fixed_in'        => $needed,
		'sapi'            => $sapi,
		// mod_php runs PHP inside the web server process: the advisory rates it highest risk.
		'mod_php'         => ( 'apache2handler' === $sapi ),
		'upload_progress' => (bool) ini_get( 'session.upload_progress.enabled' ),
	);
}

/**
 * Plain-language summary of ovkit_php_patch_status() for admin screens.
 *
 * @param array $s Result of ovkit_php_patch_status().
 * @return array { label, detail, suggestion }
 */
function ovkit_php_patch_text( array $s ): array {
	$ask = __( 'Only your host can update PHP. Ask them: "Is our PHP patched for CVE-2026-109618 and CVE-2026-109619 (php2shell)?"', 'ovanap-admin-toolkit' );

	if ( 'patched' === $s['status'] ) {
		$detail = sprintf(
			/* translators: %s: PHP version. */
			__( 'PHP %s includes the php2shell fixes.', 'ovanap-admin-toolkit' ),
			$s['version']
		);
		$suggestion = '';
	} elseif ( 'unpatched' === $s['status'] ) {
		$detail = sprintf(
			/* translators: 1: PHP version, 2: first fixed version. */
			__( 'PHP %1$s is older than %2$s, the first release with the php2shell fixes. Some hosts patch PHP without changing the version number, so confirm with your host.', 'ovanap-admin-toolkit' ),
			$s['version'],
			$s['fixed_in']
		);
		$suggestion = $ask;
	} else {
		$detail = sprintf(
			/* translators: %s: PHP version. */
			__( 'PHP %s no longer gets official security fixes, and php2shell is not fixed upstream for it. Only a host-supplied backport protects it.', 'ovanap-admin-toolkit' ),
			$s['version']
		);
		$suggestion = __( 'Ask your host to move the site to PHP 8.2 or newer, or to confirm they backported the php2shell fixes.', 'ovanap-admin-toolkit' );
	}

	if ( 'patched' !== $s['status'] && $s['mod_php'] ) {
		$detail .= ' ' . __( 'This server runs PHP as an Apache module (mod_php), the setup the advisory rates as highest risk.', 'ovanap-admin-toolkit' );
	}
	if ( 'patched' !== $s['status'] && $s['upload_progress'] ) {
		$suggestion .= ' ' . __( 'Until then, the host can set session.upload_progress.enabled=0 in php.ini as a partial mitigation.', 'ovanap-admin-toolkit' );
	}

	return array(
		'label'      => __( 'PHP security patch (php2shell)', 'ovanap-admin-toolkit' ),
		'detail'     => $detail,
		'suggestion' => trim( $suggestion ),
	);
}

// Site Health > Status shows the same result to every administrator.
add_filter(
	'site_status_tests',
	function ( $tests ) {
		$tests['direct']['ovkit_php_patch'] = array(
			'label' => __( 'PHP security patch (php2shell)', 'ovanap-admin-toolkit' ),
			'test'  => function () {
				$s    = ovkit_php_patch_status();
				$text = ovkit_php_patch_text( $s );
				$ok   = 'patched' === $s['status'];
				return array(
					'label'       => $ok
						/* translators: %s: PHP version. */
						? sprintf( __( 'PHP %s has the php2shell security fixes', 'ovanap-admin-toolkit' ), $s['version'] )
						/* translators: %s: PHP version. */
						: sprintf( __( 'PHP %s may be missing the php2shell security fixes', 'ovanap-admin-toolkit' ), $s['version'] ),
					'status'      => $ok ? 'good' : ( 'unsupported' === $s['status'] ? 'critical' : 'recommended' ),
					'badge'       => array(
						'label' => __( 'Security', 'ovanap-admin-toolkit' ),
						'color' => $ok ? 'blue' : 'red',
					),
					'description' => '<p>' . esc_html( $text['detail'] ) . '</p>' . ( $text['suggestion'] ? '<p>' . esc_html( $text['suggestion'] ) . '</p>' : '' ),
					'actions'     => '',
					'test'        => 'ovkit_php_patch',
				);
			},
		);
		return $tests;
	}
);