<?php

namespace AFEB;

use DOMDocument;

if (!defined('ABSPATH')) {
    exit;
}

/**
 * "Vertex Addons for Elementor" Security Class
 * 
 * @class Security
 * @version 1.0.6
 */
class Security extends Base
{
    /**
     * Ajax request security check
     * 
     * @since 1.0.6
     * 
     * @param string $nonce
     * @param string|int $nonce_action
     * @param string $capability
     * 
     * @return string
     */
    public function ajax_request_validate($nonce = '', $nonce_action = -1, $capability = 'manage_options')
    {
        if (
            !wp_verify_nonce(sanitize_text_field(wp_unslash($nonce)), $nonce_action)
            || !current_user_can($capability)
        ) {
            wp_send_json_error(['message' => esc_html__('Ajax request is not valid', 'addons-for-elementor-builder')], 403);
        }
    }

    /**
     * Cleaning And sanitizing the CSS codes
     *
     * @since 1.0.6
     * 
     * @param string $css
     *
     * @return string
     */
    public function clean_and_sanitize_css($css)
    {
        return wp_strip_all_tags($css);
    }

    /**
     * Sanitize SVG content
     * 
     * @since 1.4.0

     * @param string $svg_content
     * 
     * @return string
     */
    public function sanitize_svg($svg_content)
    {
        $previous = libxml_use_internal_errors(true);
        $dom = new DOMDocument();

        $entity_loader = null;
        if (PHP_VERSION_ID < 80000 && function_exists('libxml_disable_entity_loader')) {
            $entity_loader = libxml_disable_entity_loader(true); // phpcs:ignore Generic.PHP.DeprecatedFunctions.Deprecated
        }

        $loaded = $dom->loadXML($svg_content, LIBXML_NONET | LIBXML_NOERROR | LIBXML_NOWARNING);

        if (PHP_VERSION_ID < 80000 && null !== $entity_loader) {
            libxml_disable_entity_loader($entity_loader); // phpcs:ignore Generic.PHP.DeprecatedFunctions.Deprecated
        }

        if (!$loaded || isset($dom->doctype) || !$dom->documentElement) {
            libxml_clear_errors();
            libxml_use_internal_errors($previous);

            return '';
        }

        // Remove scripts and inline event handlers from the SVG tree.
        $scripts = $dom->getElementsByTagName('script');
        while ($scripts->length > 0)
            $scripts->item(0)->parentNode->removeChild($scripts->item(0));

        foreach ($dom->getElementsByTagName('*') as $node) {
            if (!$node->hasAttributes()) {
                continue;
            }

            $unsafe_attributes = [];
            foreach ($node->attributes as $attribute) {
                $name = strtolower($attribute->nodeName);
                $value = trim($attribute->nodeValue);

                if (strpos($name, 'on') === 0) {
                    $unsafe_attributes[] = $attribute->nodeName;
                    continue;
                }

                if (
                    in_array($name, ['href', 'xlink:href'], true)
                    && preg_match('/^\s*javascript:/i', $value)
                ) {
                    $unsafe_attributes[] = $attribute->nodeName;
                }
            }

            foreach ($unsafe_attributes as $attribute_name) {
                $node->removeAttribute($attribute_name);
            }
        }

        libxml_clear_errors();
        libxml_use_internal_errors($previous);

        return $dom->saveXML($dom->documentElement) ?: '';
    }
}