<?php

namespace WPScan;

// Exit if accessed directly.
defined( 'ABSPATH' ) || exit;

/**
 * Notification.
 *
 * Used for the Notifications logic.
 *
 * @since 1.0.0
 */
class Notification {
	// Page slug.
	private $page;

	/**
	 * Class constructor.
	 *
	 * @since 1.0.0
	 * @param object $parent parent.
	 * @access public
	 * @return void
	 */
	public function __construct($parent) {
		$this->parent = $parent;
		$this->page   = 'wpscan_notification';

		add_action( 'admin_init', array( $this, 'admin_init' ) );
		add_action( 'admin_init', array( $this, 'add_meta_box_notification' ) );
	}

	/**
	 * Notification Options
	 *
	 * @since 1.0.0
	 * @access public
	 * @return void
	 */
	public function admin_init() {
		$total = $this->parent->get_total();

		register_setting( $this->page, $this->parent->OPT_EMAIL, array( $this, 'sanitize_email' ) );
		register_setting( $this->page, $this->parent->OPT_INTERVAL, array( $this, 'sanitize_interval' ) );

		$section = $this->page . '_section';

		add_settings_section(
			$section,
			null,
			array( $this, 'introduction' ),
			$this->page
		);

		add_settings_field(
			$this->parent->OPT_EMAIL,
			__( 'E-mail', 'wpscan' ),
			array( $this, 'field_email' ),
			$this->page,
			$section
		);

		add_settings_field(
			$this->parent->OPT_INTERVAL,
			__( 'Send Alerts', 'wpscan' ),
			array( $this, 'field_interval' ),
			$this->page,
			$section
		);
	}

	/**
	 * Add meta box
	 *
	 * @since 1.0.0
	 * @access public
	 * @return void
	 */
	public function add_meta_box_notification() {
		add_meta_box(
			'wpscan-metabox-notification',
			__( 'Notification', 'wpscan' ),
			array( $this, 'do_meta_box_notification' ),
			'wpscan',
			'side',
			'low'
		);
	}

	/**
	 * Render meta box
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function do_meta_box_notification() {
		echo '<form action="options.php" method="post">';

		settings_fields( $this->page );

		do_settings_sections( $this->page );

		submit_button();

		echo '</form>';
	}

	/**
	 * Introduction
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function introduction() {
		echo '<p>' . __( 'Fill in the options below if you want to be notified by mail about new vulnerabilities. To add multiple e-mail addresses comma separate them.', 'wpscan' ) . '</p>';
	}

	/**
	 * Email field
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function field_email()
	{
		echo sprintf(
			'<input type="text" name="%s" value="%s" class="regular-text" placeholder="email@domain.com, copy@domain.com">',
			esc_attr( $this->parent->OPT_EMAIL ),
			esc_attr( get_option( $this->parent->OPT_EMAIL, '' ) )
		);
	}

	/**
	 * Interval field
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function field_interval() {
		$interval = get_option( $this->parent->OPT_INTERVAL, 'd' );

		echo '<select name="' . $this->parent->OPT_INTERVAL . '">';
		echo '<option value="o" ' . selected( 'o', $interval, false ) . '>' . __( 'Disabled', 'wpscan' ) . '</option>';
		echo '<option value="d" ' . selected( 'd', $interval, false ) . '>' . __( 'Daily', 'wpscan' ) . '</option>';
		echo '<option value="1" ' . selected( 1, $interval, false ) . '>' . __( 'Every Monday', 'wpscan' ) . '</option>';
		echo '<option value="2" ' . selected( 2, $interval, false ) . '>' . __( 'Every Tuesday', 'wpscan' ) . '</option>';
		echo '<option value="3" ' . selected( 3, $interval, false ) . '>' . __( 'Every Wednesday', 'wpscan' ) . '</option>';
		echo '<option value="4" ' . selected( 4, $interval, false ) . '>' . __( 'Every Thursday', 'wpscan' ) . '</option>';
		echo '<option value="5" ' . selected( 5, $interval, false ) . '>' . __( 'Every Friday', 'wpscan' ) . '</option>';
		echo '<option value="6" ' . selected( 6, $interval, false ) . '>' . __( 'Every Saturday', 'wpscan' ) . '</option>';
		echo '<option value="7" ' . selected( 7, $interval, false ) . '>' . __( 'Every Sunday', 'wpscan' ) . '</option>';
		echo '<option value="m" ' . selected( 'm', $interval, false ) . '>' . __( 'Every Month', 'wpscan' ) . '</option>';
		echo '</selected>';
	}

	/**
	 * Sanitize email
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function sanitize_email( $value ) {
		if ( ! empty( $value ) ) {
			$emails = explode( ',', $value );

			foreach ( $emails as $email ) {
				if ( ! is_email( trim( $email ) ) ) {
					add_settings_error( $this->parent->OPT_EMAIL, 'invalid-email', __( 'You have entered an invalid e-mail address.', 'wpscan' ) );
					$value = '';
				}
			}
		}

		return $value;
	}

	/**
	 * Sanitize interval
	 *
	 * @since 1.0.0
	 * @access public
	 * @return string
	 */
	public function sanitize_interval( $value ) {
		$allowed_values = array( 'o', 'd', 1, 2, 3, 4, 5, 6, 7, 'm' );

		if ( ! in_array( $value, $allowed_values ) ) {
			// return default value.
			return 'd';
		}

		return $value;
	}

	/**
	 * Send the notification
	 *
	 * @since 1.0.0
	 * @access public
	 * @return void
	 */
	public function notify() {
		if ( ! function_exists( 'get_plugins' ) ) {
			require_once ABSPATH . 'wp-admin/includes/plugin.php';
		}

		$email    = get_option( $this->parent->OPT_EMAIL );
		$interval = get_option( $this->parent->OPT_INTERVAL, 'd' );

		// Check email or if notifications are disabled.
		if ( empty( $email ) || 'o' === $interval ) {
			return;
		}

		// Check weekly interval.
		if ( is_numeric( $interval ) && date( 'N' ) !== $interval ) {
			return;
		}

		// Check monthly interval.
		if ( $interval === 'm' && date( 'j' ) !== 1 ) {
			return;
		}

		// Send email.
		$has_vulnerabilities = false;

		$msg  = '<!doctype html><html><head><meta charset="utf-8"></head><body>';
		$msg .= '<p>' . __( 'Hello,', 'wpscan' ) . '</p>';
		$msg .= '<p>' . sprintf(__( 'The %s found some vulnerabilities in %s, listed below.', 'wpscan' ), '<a href="https://wordpress.org/plugins/wpscan/">WPScan WordPress security plugin</a>' , '<a href="' . get_bloginfo( 'url' ) . '">' . get_bloginfo( 'name' ) . '</a>' ) . '</p>';

		// WordPress
		$list = $this->email_vulnerabilities( 'wordpress' , get_bloginfo( 'version' ));

		if ( ! empty( $list ) ) {
			$has_vulnerabilities = true;

			$msg .= '<p><b>WordPress</b><br>';
			$msg .= join( '<br>', $list ) . '</p>';
		}

		// Plugins.
		foreach ( get_plugins() as $name => $details ) {
			$slug = $this->parent->get_plugin_slug( $name, $details );
			$list = $this->email_vulnerabilities( 'plugins', $slug );

			if ( ! empty( $list ) ) {
				$has_vulnerabilities = true;

				$msg .= '<p><b>' . __( 'Plugin', 'wpscan' ) . ' ' . esc_html( $details['Name'] ) . '</b><br>';
				$msg .= join( '<br>', $list ) . '</p>';
			}
		}

		// Themes.
		foreach ( wp_get_themes() as $name => $details ) {
			$slug = $this->parent->get_theme_slug( $name, $details );
			$list = $this->email_vulnerabilities( 'themes', $slug );

			if ( ! empty( $list ) ) {
				$has_vulnerabilities = true;

				$msg .= '<p><b>' . __( 'Theme', 'wpscan' ) . ' ' . esc_html( $details['Name'] ) . '</b><br>';
				$msg .= join( '<br>', $list ) . '</p>';
			}
		}

		// Security checks.
		foreach ( $this->parent->classes['checks/system']->checks as $id => $data ) {
			$list = $this->email_vulnerabilities( 'security-checks', $id );

			if ( ! empty( $list ) ) {
				$has_vulnerabilities = true;

				$msg .= '<p><b>' . __( 'Security check', 'wpscan' ) . ' ' . esc_html( $data['instance']->title() ) . '</b><br>';
				$msg .= join( '<br>', $list ) . '</p>';
			}
		}

		$msg .= '<p>' . sprintf(__( 'Found our WPScan security plugin helpful? Please %s', 'wpscan' ), '<a href="https://wordpress.org/support/plugin/wpscan/reviews/#new-post">leave a review.</a></p>');

		$msg .= '<p>' . __( 'Thank you,', 'wpscan' ) . '<br/>' . __( 'The WPScan Team', 'wpscan' ) . '</p>';

		$msg .= '</body></html>';

		if ( $has_vulnerabilities ) {
			$subject = sprintf(
				__( '[WPScan Alert] Some vulnerabilities were found in %s!', 'wpscan' ),
				get_bloginfo( 'name' )
			);

			$headers = array( 'Content-Type: text/html; charset=UTF-8' );

			wp_mail( $email, $subject, $msg, $headers );
		}
	}

	/**
	 * List of vulnerabilities to send by mail
	 *
	 * @since 1.0.0
	 * @access public
	 * @return array
	 */
	public function email_vulnerabilities( $type, $name ) {
		$report  = $this->parent->get_report()[ $type ];
		$ignored = $this->parent->get_ignored_vulnerabilities();

		if ( array_key_exists( $name, $report ) ) {
			$report = $report[ $name ];
		}

		if ( ! isset( $report['vulnerabilities'] ) ) {
			return null;
		}

		$list = [];

		foreach ( $report['vulnerabilities'] as $item ) {
			$id    = 'security-checks' === $type ? $item['id'] : $item->id;
			$title = 'security-checks' === $type ? $item['title'] : $this->parent->get_sanitized_vulnerability_title( $item );

			if ( in_array( $id, $ignored ) ) {
				continue;
			}

			if ( 'security-checks' !== $type ) {
				$html  = '<a href="' . esc_url( 'https://wpscan.com/vulnerability/' . $id ) . '" target="_blank">';
				$html .= esc_html( $title );
				$html .= '</a>';
			} else {
				$html = esc_html( $title );
			}

			$list[] = $html;
		}

		return $list;
	}
}
