<?php
/**
 * Admin: settings page, manual fetch, CVE check, privacy text.
 *
 * @package SyncNetPatchRadar
 */

defined( 'ABSPATH' ) || exit;

add_action(
	'admin_menu',
	function () {
		add_options_page( __( 'SyncNet Patch Radar', 'syncnet-patch-radar' ), __( 'SyncNet Patch Radar', 'syncnet-patch-radar' ), 'manage_options', 'syncnet-patch-radar', 'cpradar_admin_page' );
	}
);

add_action(
	'admin_init',
	function () {
		register_setting(
			'cpradar',
			'cpradar_settings',
			array(
				'type'              => 'array',
				'sanitize_callback' => 'cpradar_sanitize',
			)
		);
		if ( function_exists( 'wp_add_privacy_policy_content' ) ) {
			wp_add_privacy_policy_content(
				__( 'SyncNet Patch Radar', 'syncnet-patch-radar' ),
				wp_kses_post( wpautop( __( 'Our security alerts page is compiled automatically from public data of the German BSI, the US agency CISA and the US National Vulnerability Database (NVD). Our server retrieves this data; visitors\' browsers do not connect to these services. The page sets no cookies and does not track visitors. Share buttons are plain links: only when you click LinkedIn, WhatsApp or Teams does the respective provider\'s page open and process data according to its own privacy policy.', 'syncnet-patch-radar' ) ) )
			);
		}
	}
);

/**
 * Sanitize settings.
 *
 * @param array $in Raw input.
 * @return array
 */
function cpradar_sanitize( $in ) {
	$old = cpradar_settings();
	$in  = is_array( $in ) ? $in : array();
	$out = array(
		'enabled'       => empty( $in['enabled'] ) ? 0 : 1,
		'bsi'           => empty( $in['bsi'] ) ? 0 : 1,
		'cisa'          => empty( $in['cisa'] ) ? 0 : 1,
		'nvd'           => empty( $in['nvd'] ) ? 0 : 1,
		'cvss'          => max( 7.0, min( 10.0, round( (float) str_replace( ',', '.', (string) ( $in['cvss'] ?? 9 ) ), 1 ) ) ),
		'days'          => max( 7, min( 365, (int) ( $in['days'] ?? 60 ) ) ),
		'fresh'         => max( 0, min( 90, (int) ( $in['fresh'] ?? 14 ) ) ),
		'menu_dot'      => max( 0, min( 168, (int) ( $in['menu_dot'] ?? 0 ) ) ),
		'subscribe_pos' => in_array( $in['subscribe_pos'] ?? '', array( 'top', 'bottom', 'both', 'none' ), true ) ? $in['subscribe_pos'] : 'bottom',
		'share_pos'     => in_array( $in['share_pos'] ?? '', array( 'top', 'bottom', 'both' ), true ) ? $in['share_pos'] : 'bottom',
		'nvd_key'       => sanitize_text_field( $in['nvd_key'] ?? '' ),
		'page_id'       => (int) ( $in['page_id'] ?? $old['page_id'] ),
		'intro'         => sanitize_textarea_field( $in['intro'] ?? '' ),
		'cta_text'      => sanitize_text_field( $in['cta_text'] ?? '' ),
		'cta_url'       => esc_url_raw( $in['cta_url'] ?? '' ),
		'credit'        => empty( $in['credit'] ) ? 0 : 1,
		'accent'        => sanitize_hex_color( $in['accent'] ?? '' ) ? sanitize_hex_color( $in['accent'] ) : '#2271b1',
		'products'      => sanitize_textarea_field( $in['products'] ?? '' ),
	);
	if ( $out['page_id'] !== (int) $old['page_id'] ) {
		update_option( 'cpradar_flush', 1, false );
	}
	return $out;
}

add_action( 'update_option_cpradar_settings', 'cpradar_after_save', 10, 2 );
add_action( 'add_option_cpradar_settings', 'cpradar_after_save' );

/**
 * Refetch after saving (and refresh URLs if the page changed).
 *
 * @param mixed $old_value Previous settings (only on update).
 * @param mixed $value     New settings (only on update).
 */
function cpradar_after_save( $old_value = array(), $value = array() ) {
	if ( is_array( $old_value ) && is_array( $value ) && ( $old_value['nvd_key'] ?? '' ) !== ( $value['nvd_key'] ?? '' ) ) {
		delete_option( 'cpradar_nvd_key_error' );
	}
	if ( get_option( 'cpradar_flush' ) ) {
		delete_option( 'cpradar_flush' );
		cpradar_rewrite_rules();
		flush_rewrite_rules( false );
	}
	cpradar_schedule();
	if ( is_admin() ) {
		cpradar_fetch(); // Does nothing while fetching is switched off.
	}
}

add_action(
	'admin_post_cpradar_fetch_now',
	function () {
		check_admin_referer( 'cpradar_fetch_now' );
		if ( current_user_can( 'manage_options' ) ) {
			cpradar_fetch();
		}
		wp_safe_redirect( admin_url( 'options-general.php?page=syncnet-patch-radar' ) );
		exit;
	}
);

add_action(
	'admin_post_cpradar_check',
	function () {
		check_admin_referer( 'cpradar_check' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'syncnet-patch-radar' ) );
		}
		$cve = strtoupper( trim( sanitize_text_field( wp_unslash( $_POST['cve'] ?? '' ) ) ) );
		set_transient( 'cpradar_check_' . get_current_user_id(), cpradar_check( $cve ), 10 * MINUTE_IN_SECONDS );
		wp_safe_redirect( admin_url( 'options-general.php?page=syncnet-patch-radar#cpr-check' ) );
		exit;
	}
);

/**
 * Check one CVE against all conditions.
 *
 * @param string $cve CVE ID.
 * @return array
 */
function cpradar_check( $cve ) {
	$r  = array(
		'cve'   => $cve,
		'lines' => array(),
	);
	$ok = function ( $text, $passed ) use ( &$r ) {
		$r['lines'][] = array( (bool) $passed, $text );
		return $passed;
	};
	if ( ! preg_match( '/^CVE-\d{4}-\d{4,}$/', $cve ) ) {
		$ok( __( 'Enter an ID in the format CVE-YYYY-NNNN', 'syncnet-patch-radar' ), false );
		return $r;
	}
	$stored = cpradar_alert( $cve );
	$ok( __( 'Currently listed', 'syncnet-patch-radar' ) . ( $stored ? ' (' . strtoupper( $stored['source'] ) . ')' : '' ), (bool) $stored );
	$key  = cpradar_nvd_key();
	$body = cpradar_get( add_query_arg( 'cveId', $cve, CPRADAR_NVD_URL ), '' !== $key ? array( 'apiKey' => $key ) : array() );
	if ( is_wp_error( $body ) ) {
		$ok( __( 'NVD reachable', 'syncnet-patch-radar' ) . ': ' . $body->get_error_message(), false );
		return $r;
	}
	$data = json_decode( $body, true );
	$c    = $data['vulnerabilities'][0]['cve'] ?? null;
	if ( ! $c ) {
		$ok( __( 'Found at the NVD', 'syncnet-patch-radar' ), false );
		return $r;
	}
	$s     = cpradar_settings();
	$limit = time() - DAY_IN_SECONDS * max( 7, (int) $s['days'] );
	$date  = strtotime( (string) ( $c['published'] ?? '' ) . 'Z' );
	$cna   = cpradar_nvd_cna( $c['sourceIdentifier'] ?? '' );
	$best  = cpradar_nvd_best_metric( $c );
	$text  = cpradar_nvd_description( $c );

	/* translators: %s: status */
	$ok( sprintf( __( 'Found at the NVD (status: %s)', 'syncnet-patch-radar' ), $c['vulnStatus'] ?? '?' ), true );
	/* translators: 1: date, 2: number of days */
	$ok( sprintf( __( 'Published %1$s – within %2$d days', 'syncnet-patch-radar' ), $date ? cpradar_date( $date ) : '?', (int) $s['days'] ), $date && $date >= $limit );
	/* translators: 1: source identifier, 2: vendor or note */
	$ok( sprintf( __( 'Reported by the vendor itself – source: "%1$s" %2$s', 'syncnet-patch-radar' ), $c['sourceIdentifier'] ?? '', $cna ? '= ' . $cna : __( '(not in the vendor list)', 'syncnet-patch-radar' ) ), '' !== $cna );
	if ( $best ) {
		/* translators: 1: minimum, 2: actual score */
		$ok( sprintf( __( 'CVSS at least %1$s (is %2$s)', 'syncnet-patch-radar' ), cpradar_score( $s['cvss'] ), cpradar_score( $best['baseScore'] ) ), (float) $best['baseScore'] >= (float) $s['cvss'] );
		/* translators: %s: attack vector */
		$ok( sprintf( __( 'Exploitable over the network (is %s)', 'syncnet-patch-radar' ), $best['attackVector'] ?? '?' ), 'NETWORK' === ( $best['attackVector'] ?? '' ) );
		/* translators: %s: privileges required */
		$ok( sprintf( __( 'No authentication needed (is %s)', 'syncnet-patch-radar' ), $best['privilegesRequired'] ?? '?' ), 'NONE' === ( $best['privilegesRequired'] ?? '' ) );
	} else {
		$ok( __( 'CVSS 3 score available', 'syncnet-patch-radar' ), false );
	}
	$product = $cna ? cpradar_nvd_product( $cna, $text ) : '';
	/* translators: %s: product or "none" */
	$ok( sprintf( __( 'Matching product: %s', 'syncnet-patch-radar' ), $product ? $product : __( 'none', 'syncnet-patch-radar' ) ), '' !== $product );
	$r['text'] = cpradar_short( $text, 300 );
	return $r;
}

/**
 * Settings page.
 */
function cpradar_admin_page() {
	$s        = cpradar_settings();
	$status   = (array) get_option( 'cpradar_status', array() );
	$progress = (array) get_option( 'cpradar_nvd_progress', array( 0, 0 ) );
	$check    = get_transient( 'cpradar_check_' . get_current_user_id() );
	?>
	<div class="wrap">
		<h1><?php esc_html_e( 'SyncNet Patch Radar', 'syncnet-patch-radar' ); ?></h1>
		<?php if ( $s['page_id'] && 'publish' !== get_post_status( $s['page_id'] ) ) : ?>
			<div class="notice notice-info inline"><p>
				<?php esc_html_e( 'The alerts page has been created as a draft. Give it the title you want, publish it and – if you like – add it to your menu.', 'syncnet-patch-radar' ); ?>
				<a href="<?php echo esc_url( (string) get_edit_post_link( $s['page_id'] ) ); ?>"><?php esc_html_e( 'Edit page', 'syncnet-patch-radar' ); ?></a>
			</p></div>
		<?php endif; ?>
		<?php if ( empty( $s['enabled'] ) ) : ?>
			<div class="notice notice-warning inline"><p>
				<strong><?php esc_html_e( 'Fetching is switched off.', 'syncnet-patch-radar' ); ?></strong>
				<?php esc_html_e( 'Nothing has been retrieved yet. Choose your sources below, tick "Fetch alerts" and save. Only then does your server connect to the services listed under "External services" at the bottom of this page.', 'syncnet-patch-radar' ); ?>
			</p></div>
		<?php endif; ?>
		<p><?php esc_html_e( 'Fetches alerts every hour. Shown is only what is rated critical by the BSI, known to be exploited (CISA) or rated at or above the CVSS threshold by the vendor (NVD) – and mentions one of the products below.', 'syncnet-patch-radar' ); ?></p>
		<p>
			<strong><?php esc_html_e( 'Last fetch:', 'syncnet-patch-radar' ); ?></strong>
			<?php
			if ( ! empty( $status['time'] ) ) {
				/* translators: 1: date and time, 2: number of alerts */
				echo esc_html( sprintf( __( '%1$s – %2$d alerts', 'syncnet-patch-radar' ), wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $status['time'] ), (int) $status['count'] ) );
			} else {
				esc_html_e( 'not yet', 'syncnet-patch-radar' );
			}
			if ( ! empty( $status['sources'] ) ) {
				echo '<br>' . esc_html__( 'Matching in last fetch:', 'syncnet-patch-radar' ) . ' ' . esc_html( implode( ' · ', array_map( fn( $k, $v ) => $k . ' ' . $v, array_keys( $status['sources'] ), $status['sources'] ) ) );
			}
			if ( get_option( 'cpradar_nvd_index' ) ) {
				/* translators: 1: checked, 2: total */
				echo '<br><strong>' . esc_html( sprintf( __( 'NVD: initial load running – %1$d of %2$d vulnerabilities checked. Continues hourly, or click "Fetch now" again.', 'syncnet-patch-radar' ), (int) $progress[0], (int) $progress[1] ) ) . '</strong>';
			}
			$key_error = get_option( 'cpradar_nvd_key_error' );
			if ( $key_error && '' !== trim( (string) $s['nvd_key'] ) ) {
				/* translators: 1: HTTP status code, 2: date and time */
				echo '<br><span style="color:#b32d2e"><strong>' . esc_html__( 'NVD API key rejected', 'syncnet-patch-radar' ) . '</strong> ' . esc_html( sprintf( __( '(HTTP status %1$d, %2$s). Fetching continues without the key, just more slowly. Please check: did you click the confirmation link in the e-mail from the NVD? Is the key entered exactly as in the e-mail?', 'syncnet-patch-radar' ), (int) $key_error[1], wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $key_error[0] ) ) ) . '</span>';
			}
			if ( ! empty( $status['errors'] ) ) {
				echo '<br><span style="color:#b32d2e"><strong>' . esc_html__( 'Errors:', 'syncnet-patch-radar' ) . '</strong> ' . esc_html( implode( ' · ', $status['errors'] ) ) . '</span>';
			}
			?>
		</p>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="cpradar_fetch_now"><?php wp_nonce_field( 'cpradar_fetch_now' ); ?>
			<?php
			if ( ! empty( $s['enabled'] ) ) {
				submit_button( __( 'Fetch now', 'syncnet-patch-radar' ), 'secondary', 'submit', false );
			}
			?>
			<a class="button" href="<?php echo esc_url( cpradar_page_url() ); ?>" target="_blank"><?php esc_html_e( 'View page', 'syncnet-patch-radar' ); ?></a>
		</form>

		<form method="post" action="options.php">
			<?php settings_fields( 'cpradar' ); ?>
			<h2><?php esc_html_e( 'Sources', 'syncnet-patch-radar' ); ?></h2>
			<table class="form-table" role="presentation">
				<tr><th scope="row"><?php esc_html_e( 'Fetching', 'syncnet-patch-radar' ); ?></th><td>
					<label><input type="checkbox" name="cpradar_settings[enabled]" value="1" <?php checked( $s['enabled'] ); ?>> <strong><?php esc_html_e( 'Fetch alerts', 'syncnet-patch-radar' ); ?></strong></label>
					<p class="description"><?php esc_html_e( 'Your server then retrieves data hourly from the sources selected below (see "External services"). Off by default.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Sources', 'syncnet-patch-radar' ); ?></th><td>
					<label><input type="checkbox" name="cpradar_settings[bsi]" value="1" <?php checked( $s['bsi'] ); ?>> <?php esc_html_e( 'BSI / CERT-Bund (Germany) – severity "critical" only (texts in German)', 'syncnet-patch-radar' ); ?></label><br>
					<label><input type="checkbox" name="cpradar_settings[cisa]" value="1" <?php checked( $s['cisa'] ); ?>> <?php esc_html_e( 'CISA (USA) – known exploited vulnerabilities (English)', 'syncnet-patch-radar' ); ?></label><br>
					<label><input type="checkbox" name="cpradar_settings[nvd]" value="1" <?php checked( $s['nvd'] ); ?>> <?php esc_html_e( 'NVD (USA) – vendor-reported vulnerabilities from CVSS', 'syncnet-patch-radar' ); ?></label>
					<input type="number" step="0.1" min="7" max="10" name="cpradar_settings[cvss]" value="<?php echo esc_attr( number_format( (float) $s['cvss'], 1, '.', '' ) ); ?>" class="small-text">
					<?php esc_html_e( ', exploitable over the network without authentication (English)', 'syncnet-patch-radar' ); ?>
				</td></tr>
				<tr><th scope="row"><label for="cpr-key"><?php esc_html_e( 'NVD API key (optional)', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-key" type="text" name="cpradar_settings[nvd_key]" value="<?php echo esc_attr( $s['nvd_key'] ); ?>" class="regular-text" autocomplete="off">
					<p class="description"><?php esc_html_e( 'Free at nvd.nist.gov/developers/request-an-api-key. Makes fetching considerably faster.', 'syncnet-patch-radar' ); ?>
					<?php if ( '' !== trim( (string) $s['nvd_key'] ) ) : ?>
						<?php if ( get_option( 'cpradar_nvd_key_error' ) ) : ?>
							<strong style="color:#b32d2e"><?php esc_html_e( 'The key was rejected on the last fetch.', 'syncnet-patch-radar' ); ?></strong>
						<?php else : ?>
							<strong><?php esc_html_e( 'Key saved.', 'syncnet-patch-radar' ); ?></strong>
						<?php endif; ?>
					<?php endif; ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-days"><?php esc_html_e( 'Show for', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-days" type="number" min="7" max="365" name="cpradar_settings[days]" value="<?php echo (int) $s['days']; ?>" class="small-text"> <?php esc_html_e( 'days', 'syncnet-patch-radar' ); ?>
				</td></tr>
				<tr><th scope="row"><label for="cpr-products"><?php esc_html_e( 'Products', 'syncnet-patch-radar' ); ?></label></th><td>
					<textarea id="cpr-products" name="cpradar_settings[products]" rows="12" cols="40" class="large-text code"><?php echo esc_textarea( $s['products'] ); ?></textarea>
					<p class="description"><?php esc_html_e( 'One name per line, matched as a whole word. Avoid generic words like "Edge" or "Office" – vendor names already cover their products.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
			</table>

			<h2><?php esc_html_e( 'Display', 'syncnet-patch-radar' ); ?></h2>
			<table class="form-table" role="presentation">
				<tr><th scope="row"><label for="cpr-page"><?php esc_html_e( 'Alerts page', 'syncnet-patch-radar' ); ?></label></th><td>
					<?php
					wp_dropdown_pages(
						array(
							'name'              => 'cpradar_settings[page_id]',
							'id'                => 'cpr-page',
							'selected'          => (int) $s['page_id'],
							'show_option_none'  => esc_html__( '— Select —', 'syncnet-patch-radar' ),
							'option_none_value' => 0,
						)
					);
					?>
					<p class="description"><?php esc_html_e( 'The page must contain the shortcode [syncnet_patch_radar].', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-intro"><?php esc_html_e( 'Introduction', 'syncnet-patch-radar' ); ?></label></th><td>
					<textarea id="cpr-intro" name="cpradar_settings[intro]" rows="3" class="large-text"><?php echo esc_textarea( $s['intro'] ); ?></textarea>
					<p class="description"><?php esc_html_e( 'Leave empty for the default text.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-subscribe-pos"><?php esc_html_e( 'RSS subscription box', 'syncnet-patch-radar' ); ?></label></th><td>
					<select id="cpr-subscribe-pos" name="cpradar_settings[subscribe_pos]">
						<?php
						foreach ( array(
							'bottom' => __( 'Below the list', 'syncnet-patch-radar' ),
							'top'    => __( 'Above the list', 'syncnet-patch-radar' ),
							'both'   => __( 'Above (compact) and below the list', 'syncnet-patch-radar' ),
							'none'   => __( 'Do not show', 'syncnet-patch-radar' ),
						) as $cpradar_value => $cpradar_label ) {
							echo '<option value="' . esc_attr( $cpradar_value ) . '"' . selected( $s['subscribe_pos'], $cpradar_value, false ) . '>' . esc_html( $cpradar_label ) . '</option>';
						}
						?>
					</select>
					<p class="description"><?php esc_html_e( 'Where visitors find the RSS feed addresses on the alerts page. The feeds themselves always work.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-share-pos"><?php esc_html_e( 'Share buttons', 'syncnet-patch-radar' ); ?></label></th><td>
					<select id="cpr-share-pos" name="cpradar_settings[share_pos]">
						<?php
						foreach ( array(
							'bottom' => __( 'Below the alert', 'syncnet-patch-radar' ),
							'top'    => __( 'Above the alert, below the title', 'syncnet-patch-radar' ),
							'both'   => __( 'Above (compact) and below the alert', 'syncnet-patch-radar' ),
						) as $cpradar_value => $cpradar_label ) {
							echo '<option value="' . esc_attr( $cpradar_value ) . '"' . selected( $s['share_pos'], $cpradar_value, false ) . '>' . esc_html( $cpradar_label ) . '</option>';
						}
						?>
					</select>
					<p class="description"><?php esc_html_e( 'Position of the share buttons on the page of a single alert.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-cta"><?php esc_html_e( 'Call to action (optional)', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-cta" type="text" name="cpradar_settings[cta_text]" value="<?php echo esc_attr( $s['cta_text'] ); ?>" class="large-text" placeholder="<?php esc_attr_e( 'Not sure whether you are affected? We check your systems.', 'syncnet-patch-radar' ); ?>"><br>
					<input type="url" name="cpradar_settings[cta_url]" value="<?php echo esc_attr( $s['cta_url'] ); ?>" class="regular-text" placeholder="https://example.com/contact/">
				</td></tr>
				<tr><th scope="row"><label for="cpr-dot"><?php esc_html_e( 'Red dot in the menu', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-dot" type="number" min="0" max="168" name="cpradar_settings[menu_dot]" value="<?php echo (int) $s['menu_dot']; ?>" class="small-text"> <?php esc_html_e( 'hours', 'syncnet-patch-radar' ); ?>
					<p class="description"><?php esc_html_e( 'The menu item linking to the alerts page gets a small red dot while an actively exploited vulnerability from the product list is not older than this. 0 = off.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-fresh"><?php esc_html_e( 'Latest-alert line', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-fresh" type="number" min="0" max="90" name="cpradar_settings[fresh]" value="<?php echo (int) $s['fresh']; ?>" class="small-text"> <?php esc_html_e( 'days', 'syncnet-patch-radar' ); ?>
					<p class="description"><?php esc_html_e( 'The shortcode [syncnet_patch_radar_latest] shows the newest alert as one discreet line while it is not older than this. 0 = off.', 'syncnet-patch-radar' ); ?></p>
				</td></tr>
				<tr><th scope="row"><label for="cpr-accent"><?php esc_html_e( 'Accent colour', 'syncnet-patch-radar' ); ?></label></th><td>
					<input id="cpr-accent" type="color" name="cpradar_settings[accent]" value="<?php echo esc_attr( $s['accent'] ); ?>">
				</td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Credit', 'syncnet-patch-radar' ); ?></th><td>
					<label><input type="checkbox" name="cpradar_settings[credit]" value="1" <?php checked( $s['credit'] ); ?>> <?php esc_html_e( 'Show a small "SyncNet Patch Radar by SyncNet | Oliver Giesbert" link below the list (off by default – thank you if you switch it on).', 'syncnet-patch-radar' ); ?></label>
				</td></tr>
			</table>
			<?php submit_button( __( 'Save and fetch again', 'syncnet-patch-radar' ) ); ?>
		</form>

		<h2 id="cpr-check"><?php esc_html_e( 'Check an alert', 'syncnet-patch-radar' ); ?></h2>
		<p><?php esc_html_e( 'Missing a vulnerability? Enter its ID – the plugin queries the NVD and shows which condition is met.', 'syncnet-patch-radar' ); ?></p>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="cpradar_check"><?php wp_nonce_field( 'cpradar_check' ); ?>
			<input type="text" name="cve" placeholder="CVE-2026-12345" class="regular-text" required>
			<?php submit_button( __( 'Check', 'syncnet-patch-radar' ), 'secondary', 'submit', false ); ?>
		</form>
		<?php if ( $check ) : ?>
			<div style="background:#fff;border:1px solid #c3c4c7;padding:12px 16px;margin-top:12px;max-width:900px">
				<p><strong><?php echo esc_html( $check['cve'] ); ?></strong></p>
				<ul style="margin:0">
					<?php foreach ( $check['lines'] as $line ) : ?>
						<li style="margin:4px 0"><span style="display:inline-block;width:1.4em;color:<?php echo $line[0] ? '#008a20' : '#b32d2e'; ?>"><?php echo $line[0] ? '✔' : '✘'; ?></span><?php echo esc_html( $line[1] ); ?></li>
					<?php endforeach; ?>
				</ul>
				<?php if ( ! empty( $check['text'] ) ) : ?>
					<p style="color:#646970"><em><?php echo esc_html( $check['text'] ); ?></em></p>
				<?php endif; ?>
			</div>
		<?php endif; ?>

		<h2><?php esc_html_e( 'Shortcodes', 'syncnet-patch-radar' ); ?></h2>
		<ul>
			<li><code>[syncnet_patch_radar]</code> – <?php esc_html_e( 'list with search, filters, alert pages and RSS', 'syncnet-patch-radar' ); ?></li>
			<li><code>[syncnet_patch_radar_latest]</code> – <?php esc_html_e( 'one discreet line with the newest alert, e.g. on the front page', 'syncnet-patch-radar' ); ?></li>
			<li><code>[syncnet_patch_radar_box count="3"]</code> – <?php esc_html_e( 'compact cards with a link to the list', 'syncnet-patch-radar' ); ?></li>
		</ul>
		<h2><?php esc_html_e( 'External services', 'syncnet-patch-radar' ); ?></h2>
		<p><?php esc_html_e( 'Once fetching is switched on, your server retrieves data from wid.cert-bund.de (BSI), cisa.gov (CISA) and services.nvd.nist.gov (NVD) – only from the sources you selected. No data about your visitors or your site is sent; requests to the NVD contain your NVD API key if you have entered one. The CVE check tool contacts the NVD only when you click "Check". Share buttons on alert pages are plain links to LinkedIn, WhatsApp and Microsoft Teams; these providers only receive data when a visitor clicks one. Tip: set up a real cron job calling wp-cron.php hourly so fetching runs reliably even with page caching.', 'syncnet-patch-radar' ); ?></p>
	</div>
	<?php
}

add_filter(
	'plugin_action_links_' . plugin_basename( CPRADAR_FILE ),
	function ( $links ) {
		array_unshift( $links, '<a href="' . esc_url( admin_url( 'options-general.php?page=syncnet-patch-radar' ) ) . '">' . esc_html__( 'Settings', 'syncnet-patch-radar' ) . '</a>' );
		return $links;
	}
);

add_action(
	'admin_notices',
	function () {
		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
		if ( ! $screen || 'plugins' !== $screen->id || ! current_user_can( 'manage_options' ) || ! empty( cpradar_settings()['enabled'] ) ) {
			return;
		}
		echo '<div class="notice notice-info"><p>' . esc_html__( 'SyncNet Patch Radar is installed. Nothing is fetched until you switch fetching on:', 'syncnet-patch-radar' ) . ' <a href="' . esc_url( admin_url( 'options-general.php?page=syncnet-patch-radar' ) ) . '">' . esc_html__( 'Open settings', 'syncnet-patch-radar' ) . '</a></p></div>';
	}
);