<?php
/**
 * Shared "may this request be served from cache?" decision. Mirrors the copy
 * inside advanced-cache.php (which must stay self-contained). Keep both in sync.
 *
 * Cache layout (path based so Apache mod_rewrite can find files without PHP):
 *   wp-content/cache/zeroconfig/{host}/{path}/index-{d|m}[-{lang}].html[.gz]
 */
defined( 'ABSPATH' ) || exit;
// phpcs:disable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput -- The cache decision
// reads request metadata (method, path, host, user agent, cookie names) to name a cache file, and must give the same
// name as the copy in the drop-in, which runs before WordPress loads. The values are unslashed when WordPress is
// loaded and validated rather than rewritten: the path must not contain "..", NUL or more than 1000 characters, the
// host must be one of this site's own, the device is one letter, and language and currency must be known short codes.

if ( ! defined( 'ZEROCONFIG_TRACKING_PARAMS' ) ) {
	// Query-string keys that never change the page: serve from cache, ignore them.
	define( 'ZEROCONFIG_TRACKING_PARAMS', 'utm_|fbclid|gclid|dclid|gbraid|wbraid|msclkid|ttclid|twclid|li_fat_id|igshid|mc_cid|mc_eid|_ga$|_gl$|_ke$|ref$|srsltid|yclid|yadclid|ymclid|ysclid|yzclid|yqrid|ybaip|etext|epik|sscid|irclickid|vero_id|_hsenc|_hsmi|hsa_|mkt_tok|zanpid|trk_|ScCid|rb_clickid|s_kwcid|cx$|ie$|cof$' );
}

if ( ! function_exists( 'zeroconfig_cache_file' ) ) {
	function zeroconfig_cache_file( array $zc, $dir ) {
		// Inside WordPress the request arrays carry added slashes; the drop-in runs before that.
		$server = function_exists( 'wp_unslash' ) ? wp_unslash( $_SERVER ) : $_SERVER;
		$cookie = function_exists( 'wp_unslash' ) ? wp_unslash( $_COOKIE ) : $_COOKIE;
		if ( PHP_SAPI === 'cli' || ( defined( 'WP_CLI' ) && WP_CLI ) || ! isset( $server['REQUEST_METHOD'] ) ) {
			return false; // never serve cache to scripts, cron runners or WP-CLI
		}
		if ( 'GET' !== $server['REQUEST_METHOD'] ) {
			return false;
		}
		if ( isset( $_GET['zc_off'] ) || isset( $_GET['zc_test'] ) || isset( $_GET['zc_purge'] ) || isset( $_GET['preview'] ) || isset( $_GET['customize_changeset_uuid'] ) ) {
			return false;
		}
		$uri   = isset( $server['REQUEST_URI'] ) ? (string) $server['REQUEST_URI'] : '/';
		$parts = explode( '?', $uri, 2 );
		$path  = $parts[0];
		if ( ! empty( $parts[1] ) ) {
			parse_str( $parts[1], $q );
			foreach ( array_keys( $q ) as $k ) {
				if ( ! preg_match( '/^(' . ZEROCONFIG_TRACKING_PARAMS . ')/i', $k ) ) {
					return false;
				}
			}
		}
		if ( preg_match( '#^/(wp-admin|wp-login|wp-json|xmlrpc|wp-cron|wp-comments|feed)|\.(php|xml|txt)$|/feed/?$#i', $path ) ) {
			return false;
		}
		if ( false !== strpos( $path, '..' ) || false !== strpos( $path, "\0" ) || strlen( $path ) > 1000 ) {
			return false;
		}
		foreach ( (array) $zc['exclude'] as $ex ) {
			if ( '' !== $ex && false !== stripos( $path, $ex ) ) {
				return false;
			}
		}
		$lang = '';
		$cur  = '';
		foreach ( $cookie as $k => $v ) {
			if ( preg_match( '/^(wordpress_logged_in_|wp-postpass_|comment_author_|woocommerce_|wp_woocommerce_session_|edd_|wpsc_)/', $k ) ) {
				return false;
			}
			// Only a language the site really has (Polylang, WPML): made-up values must not each grow a copy.
			if ( ( 'pll_language' === $k || 'wp-wpml_current_language' === $k ) && in_array( (string) $v, isset( $zc['langs'] ) ? (array) $zc['langs'] : array(), true ) ) {
				$lang = '-' . preg_replace( '/[^a-z0-9_]/i', '', (string) $v );
			}
			// Multi-currency shops (Aelia, WCML, CURCY, WOOCS, YITH): a page priced in EUR must never reach
			// a visitor who chose USD, so the chosen currency is part of the key, like the language.
			// A three-letter currency code only (ISO 4217), so the number of copies stays bounded.
			if ( preg_match( '/^(aelia_cs_selected_currency|wcml_client_currency|wmc_current_currency|woocs_current_currency|yith_wcmcs_currency)$/', $k ) && preg_match( '/^[A-Za-z]{3}$/', (string) $v ) ) {
				$cur = '-' . strtolower( (string) $v );
			}
		}
		$lang .= $cur;
		$host = isset( $server['HTTP_HOST'] ) ? strtolower( (string) $server['HTTP_HOST'] ) : 'default';
		$host = preg_replace( '/[^a-z0-9.\-]/', '', $host );
		// Only this site's own address picks the folder. A forged Host must not: ".." would write and read
		// outside the cache directory, and every made-up name would grow another full copy of the site.
		if ( ! preg_match( '/^[a-z0-9](?:[a-z0-9\-]|\.(?!\.))*$/', $host ) || ( ! empty( $zc['hosts'] ) && ! in_array( $host, (array) $zc['hosts'], true ) ) ) {
			return false;
		}
		$ua   = isset( $server['HTTP_USER_AGENT'] ) ? (string) $server['HTTP_USER_AGENT'] : '';
		$dev  = preg_match( '/Mobile|Android|iPhone|iPad|iPod|Opera Mini|IEMobile/i', $ua ) ? 'm' : 'd';
		$rel  = trim( $path, '/' );
		return $dir . '/' . $host . ( '' !== $rel ? '/' . $rel : '' ) . '/index-' . $dev . $lang . '.html';
	}
}