<?php
/**
 * Media Upload Handler
 * 
 * Handles file uploads including SVG support with security checks.
 * 
 * @package WooNooW
 */

namespace WooNooW\Core;

class MediaUpload {
	
	/**
	 * Initialize media upload hooks
	 */
	public static function init() {
		// Allow SVG uploads
		add_filter( 'upload_mimes', [ __CLASS__, 'allow_svg_upload' ] );
		
		// Fix SVG mime type detection
		add_filter( 'wp_check_filetype_and_ext', [ __CLASS__, 'fix_svg_mime_type' ], 10, 5 );
		
		// Sanitize SVG on upload
		add_filter( 'wp_handle_upload_prefilter', [ __CLASS__, 'sanitize_svg_upload' ] );
	}
	
	/**
	 * Allow SVG file uploads
	 * 
	 * @param array $mimes Allowed mime types
	 * @return array Modified mime types
	 */
	public static function allow_svg_upload( $mimes ) {
		// Only allow for users with upload_files capability
		if ( ! current_user_can( 'upload_files' ) ) {
			return $mimes;
		}
		
		$mimes['svg'] = 'image/svg+xml';
		$mimes['svgz'] = 'image/svg+xml';
		
		return $mimes;
	}
	
	/**
	 * Fix SVG mime type detection
	 * 
	 * @param array  $data File data
	 * @param string $file File path
	 * @param string $filename File name
	 * @param array  $mimes Allowed mimes
	 * @param string $real_mime Real mime type
	 * @return array Modified file data
	 */
	public static function fix_svg_mime_type( $data, $file, $filename, $mimes, $real_mime ) {
		if ( ! $data['ext'] && ! $data['type'] ) {
			$wp_filetype = wp_check_filetype( $filename, $mimes );
			$ext = $wp_filetype['ext'];
			$type = $wp_filetype['type'];
			
			if ( $ext === 'svg' || $ext === 'svgz' ) {
				$data['ext'] = $ext;
				$data['type'] = $type;
			}
		}
		
		return $data;
	}
	
	/**
	 * Sanitize SVG files on upload
	 * 
	 * @param array $file Upload file data
	 * @return array Modified file data
	 */
	public static function sanitize_svg_upload( $file ) {
		// Only process SVG files
		if ( $file['type'] !== 'image/svg+xml' ) {
			return $file;
		}
		
		// Read file content
		$svg_content = file_get_contents( $file['tmp_name'] );
		
		if ( $svg_content === false ) {
			$file['error'] = __( 'Could not read SVG file', 'woonoow' );
			return $file;
		}
		
		// Basic security check - reject if contains script tags or event handlers
		$dangerous_patterns = [
			'/<script/i',
			'/javascript:/i',
			'/on\w+\s*=/i', // onclick, onload, etc.
		];
		
		foreach ( $dangerous_patterns as $pattern ) {
			if ( preg_match( $pattern, $svg_content ) ) {
				$file['error'] = __( 'SVG file contains potentially dangerous content', 'woonoow' );
				return $file;
			}
		}
		
		return $file;
	}
}
